- {
- unsigned char pvk_hdr[24], *buf = NULL;
- const unsigned char *p;
- int buflen;
- EVP_PKEY *ret = NULL;
- unsigned int saltlen, keylen;
- if (BIO_read(in, pvk_hdr, 24) != 24)
- {
- PEMerr(PEM_F_B2I_PVK_BIO, PEM_R_PVK_DATA_TOO_SHORT);
- return NULL;
- }
- p = pvk_hdr;
-
- if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))
- return 0;
- buflen = (int) keylen + saltlen;
- buf = OPENSSL_malloc(buflen);
- if (!buf)
- {
- PEMerr(PEM_F_B2I_PVK_BIO, ERR_R_MALLOC_FAILURE);
- return 0;
- }
- p = buf;
- if (BIO_read(in, buf, buflen) != buflen)
- {
- PEMerr(PEM_F_B2I_PVK_BIO, PEM_R_PVK_DATA_TOO_SHORT);
- goto err;
- }
- ret = do_PVK_body(&p, saltlen, keylen, cb, u);
-
- err:
- if (buf)
- {
- OPENSSL_cleanse(buf, buflen);
- OPENSSL_free(buf);
- }
- return ret;
- }
-
-
-
-static int i2b_PVK(unsigned char **out, EVP_PKEY*pk, int enclevel,
- pem_password_cb *cb, void *u)
- {
- int outlen = 24, noinc, pklen;
- unsigned char *p, *salt = NULL;
- if (enclevel)
- outlen += PVK_SALTLEN;
- pklen = do_i2b(NULL, pk, 0);
- if (pklen < 0)
- return -1;
- outlen += pklen;
- if (!out)
- return outlen;
- if (*out)
- {
- p = *out;
- noinc = 0;
- }
- else
- {
- p = OPENSSL_malloc(outlen);
- if (!p)
- {
- PEMerr(PEM_F_I2B_PVK,ERR_R_MALLOC_FAILURE);
- return -1;
- }
- *out = p;
- noinc = 1;
- }
-
- write_ledword(&p, MS_PVKMAGIC);
- write_ledword(&p, 0);
- if (pk->type == EVP_PKEY_DSA)
- write_ledword(&p, MS_KEYTYPE_SIGN);
- else
- write_ledword(&p, MS_KEYTYPE_KEYX);
- write_ledword(&p, enclevel ? 1 : 0);
- write_ledword(&p, enclevel ? PVK_SALTLEN: 0);
- write_ledword(&p, pklen);
- if (enclevel)
- {
- if (RAND_bytes(p, PVK_SALTLEN) <= 0)
- goto error;
- salt = p;
- p += PVK_SALTLEN;
- }
- do_i2b(&p, pk, 0);
- if (enclevel == 0)
- return outlen;
- else
- {
- char psbuf[PEM_BUFSIZE];
- unsigned char keybuf[20];
- EVP_CIPHER_CTX cctx;
- int enctmplen, inlen;
- if (cb)
- inlen=cb(psbuf,PEM_BUFSIZE,1,u);
- else
- inlen=PEM_def_callback(psbuf,PEM_BUFSIZE,1,u);
- if (inlen <= 0)
- {
- PEMerr(PEM_F_I2B_PVK,PEM_R_BAD_PASSWORD_READ);
- goto error;
- }
- if (!derive_pvk_key(keybuf, salt, PVK_SALTLEN, psbuf, inlen))
- goto error;
- if (enclevel == 1)
- memset(keybuf + 5, 0, 11);
- p = salt + PVK_SALTLEN + 8;
- EVP_CIPHER_CTX_init(&cctx);
- EVP_EncryptInit_ex(&cctx, EVP_rc4(), NULL, keybuf, NULL);
- OPENSSL_cleanse(keybuf, 20);
- EVP_DecryptUpdate(&cctx, p, &enctmplen, p, pklen - 8);
- EVP_DecryptFinal_ex(&cctx, p + enctmplen, &enctmplen);
- EVP_CIPHER_CTX_cleanup(&cctx);
- }
- return outlen;
-
- error:
- return -1;
- }
+{
+ unsigned char pvk_hdr[24], *buf = NULL;
+ const unsigned char *p;
+ int buflen;
+ EVP_PKEY *ret = NULL;
+ unsigned int saltlen, keylen;
+ if (BIO_read(in, pvk_hdr, 24) != 24) {
+ PEMerr(PEM_F_B2I_PVK_BIO, PEM_R_PVK_DATA_TOO_SHORT);
+ return NULL;
+ }
+ p = pvk_hdr;
+
+ if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))
+ return 0;
+ buflen = (int)keylen + saltlen;
+ buf = OPENSSL_malloc(buflen);
+ if (!buf) {
+ PEMerr(PEM_F_B2I_PVK_BIO, ERR_R_MALLOC_FAILURE);
+ return 0;
+ }
+ p = buf;
+ if (BIO_read(in, buf, buflen) != buflen) {
+ PEMerr(PEM_F_B2I_PVK_BIO, PEM_R_PVK_DATA_TOO_SHORT);
+ goto err;
+ }
+ ret = do_PVK_body(&p, saltlen, keylen, cb, u);
+
+ err:
+ OPENSSL_clear_free(buf, buflen);
+ return ret;
+}
+
+static int i2b_PVK(unsigned char **out, EVP_PKEY *pk, int enclevel,
+ pem_password_cb *cb, void *u)
+{
+ int outlen = 24, pklen;
+ unsigned char *p, *salt = NULL;
+ EVP_CIPHER_CTX cctx;
+ EVP_CIPHER_CTX_init(&cctx);
+ if (enclevel)
+ outlen += PVK_SALTLEN;
+ pklen = do_i2b(NULL, pk, 0);
+ if (pklen < 0)
+ return -1;
+ outlen += pklen;
+ if (!out)
+ return outlen;
+ if (*out)
+ p = *out;
+ else {
+ p = OPENSSL_malloc(outlen);
+ if (!p) {
+ PEMerr(PEM_F_I2B_PVK, ERR_R_MALLOC_FAILURE);
+ return -1;
+ }
+ *out = p;
+ }
+
+ write_ledword(&p, MS_PVKMAGIC);
+ write_ledword(&p, 0);
+ if (pk->type == EVP_PKEY_DSA)
+ write_ledword(&p, MS_KEYTYPE_SIGN);
+ else
+ write_ledword(&p, MS_KEYTYPE_KEYX);
+ write_ledword(&p, enclevel ? 1 : 0);
+ write_ledword(&p, enclevel ? PVK_SALTLEN : 0);
+ write_ledword(&p, pklen);
+ if (enclevel) {
+ if (RAND_bytes(p, PVK_SALTLEN) <= 0)
+ goto error;
+ salt = p;
+ p += PVK_SALTLEN;
+ }
+ do_i2b(&p, pk, 0);
+ if (enclevel == 0)
+ return outlen;
+ else {
+ char psbuf[PEM_BUFSIZE];
+ unsigned char keybuf[20];
+ int enctmplen, inlen;
+ if (cb)
+ inlen = cb(psbuf, PEM_BUFSIZE, 1, u);
+ else
+ inlen = PEM_def_callback(psbuf, PEM_BUFSIZE, 1, u);
+ if (inlen <= 0) {
+ PEMerr(PEM_F_I2B_PVK, PEM_R_BAD_PASSWORD_READ);
+ goto error;
+ }
+ if (!derive_pvk_key(keybuf, salt, PVK_SALTLEN,
+ (unsigned char *)psbuf, inlen))
+ goto error;
+ if (enclevel == 1)
+ memset(keybuf + 5, 0, 11);
+ p = salt + PVK_SALTLEN + 8;
+ if (!EVP_EncryptInit_ex(&cctx, EVP_rc4(), NULL, keybuf, NULL))
+ goto error;
+ OPENSSL_cleanse(keybuf, 20);
+ if (!EVP_DecryptUpdate(&cctx, p, &enctmplen, p, pklen - 8))
+ goto error;
+ if (!EVP_DecryptFinal_ex(&cctx, p + enctmplen, &enctmplen))
+ goto error;
+ }
+ EVP_CIPHER_CTX_cleanup(&cctx);
+ return outlen;
+
+ error:
+ EVP_CIPHER_CTX_cleanup(&cctx);
+ return -1;
+}