cert_common.c

 
#include <freerdp/config.h>
 
#include <errno.h>
#include <stdio.h>
#include <string.h>
 
#include <winpr/assert.h>
#include <winpr/wtypes.h>
#include <winpr/crt.h>
#include <winpr/file.h>
#include <winpr/crypto.h>
 
#include <openssl/pem.h>
#include <openssl/rsa.h>
#include <openssl/bn.h>
 
#include "cert_common.h"
#include "crypto.h"
#include "opensslcompat.h"
 
#define TAG FREERDP_TAG("core")
 
static BOOL cert_info_allocate(rdpCertInfo* info, size_t size);
 
BOOL read_bignum(BYTE** dst, UINT32* length, const BIGNUM* num, BOOL alloc)
{
  WINPR_ASSERT(dst);
  WINPR_ASSERT(length);
  WINPR_ASSERT(num);
 
  if (alloc)
  {
    free(*dst);
    *dst = NULL;
    *length = 0;
  }
 
  const int len = BN_num_bytes(num);
  if (len < 0)
    return FALSE;
 
  if (!alloc)
  {
    if (*length < (UINT32)len)
      return FALSE;
  }
 
  if (len > 0)
  {
    if (alloc)
    {
      *dst = malloc((size_t)len);
      if (!*dst)
        return FALSE;
    }
    BN_bn2bin(num, *dst);
    crypto_reverse(*dst, (size_t)len);
    *length = (UINT32)len;
  }
 
  return TRUE;
}
 
BOOL cert_info_create(rdpCertInfo* dst, const BIGNUM* rsa, const BIGNUM* rsa_e)
{
  const rdpCertInfo empty = { 0 };
 
  WINPR_ASSERT(dst);
  WINPR_ASSERT(rsa);
 
  *dst = empty;
 
  if (!read_bignum(&dst->Modulus, &dst->ModulusLength, rsa, TRUE))
    goto fail;
 
  UINT32 len = sizeof(dst->exponent);
  BYTE* ptr = &dst->exponent[0];
  if (!read_bignum(&ptr, &len, rsa_e, FALSE))
    goto fail;
  return TRUE;
 
fail:
  cert_info_free(dst);
  return FALSE;
}
 
BOOL cert_info_clone(rdpCertInfo* dst, const rdpCertInfo* src)
{
  WINPR_ASSERT(dst);
  WINPR_ASSERT(src);
 
  *dst = *src;
 
  dst->Modulus = NULL;
  dst->ModulusLength = 0;
  if (src->ModulusLength > 0)
  {
    dst->Modulus = malloc(src->ModulusLength);
    if (!dst->Modulus)
      return FALSE;
    memcpy(dst->Modulus, src->Modulus, src->ModulusLength);
    dst->ModulusLength = src->ModulusLength;
  }
  return TRUE;
}
 
void cert_info_free(rdpCertInfo* info)
{
  WINPR_ASSERT(info);
  free(info->Modulus);
  info->ModulusLength = 0;
  info->Modulus = NULL;
}
 
BOOL cert_info_allocate(rdpCertInfo* info, size_t size)
{
  WINPR_ASSERT(info);
  cert_info_free(info);
 
  info->Modulus = (BYTE*)malloc(size);
 
  if (!info->Modulus && (size > 0))
  {
    WLog_ERR(TAG, "Failed to allocate info->Modulus of size %" PRIuz, size);
    return FALSE;
  }
  info->ModulusLength = (UINT32)size;
  return TRUE;
}
 
BOOL cert_info_read_modulus(rdpCertInfo* info, size_t size, wStream* s)
{
  if (!Stream_CheckAndLogRequiredLength(TAG, s, size))
    return FALSE;
  if (size > UINT32_MAX)
  {
    WLog_ERR(TAG, "modulus size %" PRIuz " exceeds limit of %" PRIu32, size, UINT32_MAX);
    return FALSE;
  }
  if (!cert_info_allocate(info, size))
    return FALSE;
  Stream_Read(s, info->Modulus, info->ModulusLength);
  return TRUE;
}
 
BOOL cert_info_read_exponent(rdpCertInfo* info, size_t size, wStream* s)
{
  if (!Stream_CheckAndLogRequiredLength(TAG, s, size))
    return FALSE;
  if (size > 4)
  {
    WLog_ERR(TAG, "exponent size %" PRIuz " exceeds limit of %" PRIu32, size, 4);
    return FALSE;
  }
  if (!info->Modulus || (info->ModulusLength == 0))
  {
    WLog_ERR(TAG, "invalid modulus=%p [%" PRIu32 "]", info->Modulus, info->ModulusLength);
    return FALSE;
  }
  Stream_Read(s, &info->exponent[4 - size], size);
  crypto_reverse(info->Modulus, info->ModulusLength);
  crypto_reverse(info->exponent, 4);
  return TRUE;
}
 
#if !defined(OPENSSL_VERSION_MAJOR) || (OPENSSL_VERSION_MAJOR < 3)
X509* x509_from_rsa(const RSA* rsa)
{
  EVP_PKEY* pubkey = NULL;
  X509* x509 = NULL;
  BIO* bio = BIO_new(
#if defined(LIBRESSL_VERSION_NUMBER)
      BIO_s_mem()
#else
      BIO_s_secmem()
#endif
  );
  if (!bio)
  {
    WLog_ERR(TAG, "BIO_new() failed");
    return NULL;
  }
 
  const int rc = PEM_write_bio_RSA_PUBKEY(bio, (RSA*)rsa);
  if (rc != 1)
  {
    WLog_ERR(TAG, "PEM_write_bio_RSA_PUBKEY(bio, (RSA*)rsa) failed");
    goto fail;
  }
 
  pubkey = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL);
  if (!pubkey)
  {
    WLog_ERR(TAG, "PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL) failed");
    goto fail;
  }
 
  x509 = X509_new();
  if (!x509)
  {
    WLog_ERR(TAG, "X509_new() failed");
    goto fail;
  }
 
  const int res = X509_set_pubkey(x509, pubkey);
  if (res != 1)
  {
    WLog_ERR(TAG, "X509_set_pubkey(x509, pubkey) failed");
    X509_free(x509);
    x509 = NULL;
    goto fail;
  }
fail:
  BIO_free_all(bio);
  EVP_PKEY_free(pubkey);
  return x509;
}
#endif