Unify the SSL privsep key loading functions.

ok eric@

5 files changed, 84 insertions, 78 deletions

diff --git a/usr.sbin/relayd/relay.c b/usr.sbin/relayd/relay.c
index d6d4cf6e43b..02d52aecc20 100644
--- a/usr.sbin/relayd/relay.c
+++ b/usr.sbin/relayd/relay.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: relay.c,v 1.169 2014/04/22 08:04:23 reyk Exp $	*/
+/*	$OpenBSD: relay.c,v 1.170 2014/05/20 17:33:36 reyk Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2014 Reyk Floeter <reyk@openbsd.org>
@@ -1914,7 +1914,7 @@ relay_ssl_ctx_create(struct relay *rlay)
 
 	log_debug("%s: loading private key", __func__);
 	if (!ssl_ctx_fake_private_key(ctx,
-	    &rlay->rl_conf.ssl_keyid,
+	    &rlay->rl_conf.ssl_keyid, sizeof(rlay->rl_conf.ssl_keyid),
 	    rlay->rl_ssl_cert, rlay->rl_conf.ssl_cert_len,
 	    &rlay->rl_ssl_x509, &rlay->rl_ssl_pkey))
 		goto err;
@@ -1924,9 +1924,9 @@ relay_ssl_ctx_create(struct relay *rlay)
 
 	if (rlay->rl_conf.ssl_cacert_len) {
 		log_debug("%s: loading CA private key", __func__);
-		if (!ssl_ctx_load_pkey(ctx,
-		    &rlay->rl_conf.ssl_cakeyid, rlay->rl_ssl_cacert,
-		    rlay->rl_conf.ssl_cacert_len,
+		if (!ssl_load_pkey(&rlay->rl_conf.ssl_cakeyid,
+		    sizeof(rlay->rl_conf.ssl_cakeyid),
+		    rlay->rl_ssl_cacert, rlay->rl_conf.ssl_cacert_len,
 		    &rlay->rl_ssl_cacertx509, &rlay->rl_ssl_capkey))
 			goto err;
 	}
diff --git a/usr.sbin/relayd/relayd.h b/usr.sbin/relayd/relayd.h
index d5adaac4f14..9e95790e9d1 100644
--- a/usr.sbin/relayd/relayd.h
+++ b/usr.sbin/relayd/relayd.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: relayd.h,v 1.179 2014/05/08 13:08:48 blambert Exp $	*/
+/*	$OpenBSD: relayd.h,v 1.180 2014/05/20 17:33:36 reyk Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2014 Reyk Floeter <reyk@openbsd.org>
@@ -1111,10 +1111,10 @@ SSL_CTX	*ssl_ctx_create(struct relayd *);
 void	 ssl_error(const char *, const char *);
 char	*ssl_load_key(struct relayd *, const char *, off_t *, char *);
 X509	*ssl_update_certificate(X509 *, EVP_PKEY *, EVP_PKEY *, X509 *);
-int	 ssl_ctx_load_pkey(SSL_CTX *, void *, char *, off_t,
-	    X509 **, EVP_PKEY **);
-int	 ssl_ctx_fake_private_key(SSL_CTX *, void *, char *, off_t,
+int	 ssl_load_pkey(const void *, size_t, char *, off_t,
 	    X509 **, EVP_PKEY **);
+int	 ssl_ctx_fake_private_key(SSL_CTX *, const void *, size_t,
+	    char *, off_t, X509 **, EVP_PKEY **);
 
 /* ssl_privsep.c */
 int	 ssl_ctx_use_certificate_chain(SSL_CTX *, char *, off_t);
diff --git a/usr.sbin/relayd/ssl.c b/usr.sbin/relayd/ssl.c
index 9f09d6ba0b8..4544d53cc3a 100644
--- a/usr.sbin/relayd/ssl.c
+++ b/usr.sbin/relayd/ssl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ssl.c,v 1.23 2014/05/06 11:03:02 reyk Exp $	*/
+/*	$OpenBSD: ssl.c,v 1.24 2014/05/20 17:33:36 reyk Exp $	*/
 
 /*
  * Copyright (c) 2007 - 2014 Reyk Floeter <reyk@openbsd.org>
@@ -405,14 +405,14 @@ ssl_update_certificate(X509 *oldcert, EVP_PKEY *pkey, EVP_PKEY *capkey,
 }
 
 int
-ssl_ctx_load_pkey(SSL_CTX *ctx, void *data, char *buf, off_t len,
+ssl_load_pkey(const void *data, size_t datalen, char *buf, off_t len,
     X509 **x509ptr, EVP_PKEY **pkeyptr)
 {
-	int		 ret = 0;
 	BIO		*in;
 	X509		*x509 = NULL;
 	EVP_PKEY	*pkey = NULL;
 	RSA		*rsa = NULL;
+	void		*exdata = NULL;
 
 	if ((in = BIO_new_mem_buf(buf, len)) == NULL) {
 		SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_BUF_LIB);
@@ -430,42 +430,48 @@ ssl_ctx_load_pkey(SSL_CTX *ctx, void *data, char *buf, off_t len,
 		goto fail;
 	}
 
-	if ((rsa = EVP_PKEY_get1_RSA(pkey)) == NULL) {
-		SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_EVP_LIB);
-		goto fail;
-	}
+	BIO_free(in);
 
-	RSA_set_ex_data(rsa, 0, data);
-	RSA_free(rsa); /* dereference, will be cleaned up with pkey */
+	if (data != NULL && datalen) {
+		if ((rsa = EVP_PKEY_get1_RSA(pkey)) == NULL ||
+		    (exdata = malloc(datalen)) == NULL) {
+			SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_EVP_LIB);
+			goto fail;
+		}
+
+		memcpy(exdata, data, datalen);
+		RSA_set_ex_data(rsa, 0, exdata);
+		RSA_free(rsa); /* dereference, will be cleaned up with pkey */
+	}
 
 	*x509ptr = x509;
 	*pkeyptr = pkey;
-	ret = 1;
 
-	goto done;
+	return (1);
 
  fail:
+	if (rsa != NULL)
+		RSA_free(rsa);
+	if (in != NULL)
+		BIO_free(in);
 	if (pkey != NULL)
 		EVP_PKEY_free(pkey);
 	if (x509 != NULL)
 		X509_free(x509);
 
- done:
-	if (in != NULL)
-		BIO_free(in);
-
-	return ret;
+	return (0);
 }
 
 int
-ssl_ctx_fake_private_key(SSL_CTX *ctx, void *data, char *buf, off_t len,
-    X509 **x509ptr, EVP_PKEY **pkeyptr)
+ssl_ctx_fake_private_key(SSL_CTX *ctx, const void *data, size_t datalen,
+    char *buf, off_t len, X509 **x509ptr, EVP_PKEY **pkeyptr)
 {
-	int	 ret;
+	int		 ret = 0;
+	EVP_PKEY	*pkey = NULL;
+	X509		*x509 = NULL;
 
-	if (!(ret = ssl_ctx_load_pkey(ctx, data, buf, len,
-	    x509ptr, pkeyptr)))
-		goto fail;
+	if (!ssl_load_pkey(data, datalen, buf, len, &x509, &pkey))
+		return (0);
 
 	/*
 	 * Use the public key as the "private" key - the secret key
@@ -473,20 +479,20 @@ ssl_ctx_fake_private_key(SSL_CTX *ctx, void *data, char *buf, off_t len,
 	 * contacted by the RSA engine.  The SSL/TLS library needs at
 	 * least the public key parameters in the current process.
 	 */
-	if (!SSL_CTX_use_PrivateKey(ctx, *pkeyptr)) {
+	ret = SSL_CTX_use_PrivateKey(ctx, pkey);
+	if (!ret)
 		SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_SSL_LIB);
-		goto fail;
-	}
 
-	return (1);
+	if (pkeyptr != NULL)
+		*pkeyptr = pkey;
+	else if (pkey != NULL)
+		EVP_PKEY_free(pkey);
 
- fail:
-	if (*pkeyptr != NULL)
-		EVP_PKEY_free(*pkeyptr);
-	if (*x509ptr != NULL)
-		X509_free(*x509ptr);
-	*x509ptr = NULL;
-	*pkeyptr = NULL;
+	if (x509ptr != NULL)
+		*x509ptr = x509;
+	else if (x509 != NULL)
+		X509_free(x509);
 
-	return (0);
+	return (ret);
 }
+
diff --git a/usr.sbin/smtpd/ssl.c b/usr.sbin/smtpd/ssl.c
index 6ea7c6b7df0..d402992a604 100644
--- a/usr.sbin/smtpd/ssl.c
+++ b/usr.sbin/smtpd/ssl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ssl.c,v 1.66 2014/05/20 14:21:45 reyk Exp $	*/
+/*	$OpenBSD: ssl.c,v 1.67 2014/05/20 17:33:36 reyk Exp $	*/
 
 /*
  * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
@@ -153,7 +153,7 @@ ssl_password_cb(char *buf, int size, int rwflag, void *u)
 #endif
 
 static int
-ssl_getpass_cb(char *buf, int size, int rwflag, void *u)
+ssl_password_cb(char *buf, int size, int rwflag, void *u)
 {
 	int	ret = 0;
 	size_t	len;
@@ -209,7 +209,7 @@ ssl_load_key(const char *name, off_t *len, char *pass, mode_t perm, const char *
 	}
 
 	(void)snprintf(prompt, sizeof prompt, "passphrase for %s: ", pkiname);
-	key = PEM_read_PrivateKey(fp, NULL, ssl_getpass_cb, prompt);
+	key = PEM_read_PrivateKey(fp, NULL, ssl_password_cb, prompt);
 	fclose(fp);
 	fp = NULL;
 	if (key == NULL)
@@ -276,7 +276,7 @@ ssl_ctx_create(const char *pkiname, char *cert, off_t cert_len)
 			ssl_error("ssl_ctx_create");
 			fatal("ssl_ctx_create: invalid certificate chain");
 		} else if (!ssl_ctx_fake_private_key(ctx,
-		    pkiname, pkinamelen, cert, cert_len)) {
+		    pkiname, pkinamelen, cert, cert_len, NULL, NULL)) {
 			ssl_error("ssl_ctx_create");
 			fatal("ssl_ctx_create: could not fake private key");
 		} else if (!SSL_CTX_check_private_key(ctx)) {
@@ -462,12 +462,14 @@ ssl_set_ecdh_curve(SSL_CTX *ctx, const char *curve)
 }
 
 int
-ssl_ctx_load_pkey(SSL_CTX *ctx, char *buf, off_t len,
+ssl_load_pkey(const void *data, size_t datalen, char *buf, off_t len,
     X509 **x509ptr, EVP_PKEY **pkeyptr)
 {
 	BIO		*in;
 	X509		*x509 = NULL;
 	EVP_PKEY	*pkey = NULL;
+	RSA		*rsa = NULL;
+	void		*exdata = NULL;
 
 	if ((in = BIO_new_mem_buf(buf, len)) == NULL) {
 		SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_BUF_LIB);
@@ -475,7 +477,7 @@ ssl_ctx_load_pkey(SSL_CTX *ctx, char *buf, off_t len,
 	}
 
 	if ((x509 = PEM_read_bio_X509(in, NULL,
-	    ssl_getpass_cb, NULL)) == NULL) {
+	    ssl_password_cb, NULL)) == NULL) {
 		SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_PEM_LIB);
 		goto fail;
 	}
@@ -487,14 +489,26 @@ ssl_ctx_load_pkey(SSL_CTX *ctx, char *buf, off_t len,
 
 	BIO_free(in);
 
+	if (data != NULL && datalen) {
+		if ((rsa = EVP_PKEY_get1_RSA(pkey)) == NULL ||
+		    (exdata = malloc(datalen)) == NULL) {
+			SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_EVP_LIB);
+			goto fail;
+		}
+
+		memcpy(exdata, data, datalen);
+		RSA_set_ex_data(rsa, 0, exdata);
+		RSA_free(rsa); /* dereference, will be cleaned up with pkey */
+	}
+
 	*x509ptr = x509;
 	*pkeyptr = pkey;
 
 	return (1);
 
  fail:
-	ssl_error("ssl_ctx_load_pkey");
-
+	if (rsa != NULL)
+		RSA_free(rsa);
 	if (in != NULL)
 		BIO_free(in);
 	if (pkey != NULL)
@@ -507,28 +521,15 @@ ssl_ctx_load_pkey(SSL_CTX *ctx, char *buf, off_t len,
 
 int
 ssl_ctx_fake_private_key(SSL_CTX *ctx, const void *data, size_t datalen,
-    char *buf, off_t len)
+    char *buf, off_t len, X509 **x509ptr, EVP_PKEY **pkeyptr)
 {
 	int		 ret = 0;
 	EVP_PKEY	*pkey = NULL;
 	X509		*x509 = NULL;
-	RSA		*rsa = NULL;
-	void		*exdata = NULL;
 
-	if (!ssl_ctx_load_pkey(ctx, buf, len, &x509, &pkey))
+	if (!ssl_load_pkey(data, datalen, buf, len, &x509, &pkey))
 		return (0);
 
-	if (data != NULL && datalen) {
-		if ((rsa = EVP_PKEY_get1_RSA(pkey)) == NULL ||
-		    (exdata = malloc(datalen)) == NULL) {
-			SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_EVP_LIB);
-			goto done;
-		}
-
-		memcpy(exdata, data, datalen);
-		RSA_set_ex_data(rsa, 0, exdata);
-	}
-
 	/*
 	 * Use the public key as the "private" key - the secret key
 	 * parameters are hidden in an extra process that will be
@@ -536,17 +537,17 @@ ssl_ctx_fake_private_key(SSL_CTX *ctx, const void *data, size_t datalen,
 	 * least the public key parameters in the current process.
 	 */
 	ret = SSL_CTX_use_PrivateKey(ctx, pkey);
-	if (!ret) {
+	if (!ret)
 		SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_SSL_LIB);
-		ssl_error("ssl_ctx_fake_private_key");
-	}
 
- done:
-	if (rsa != NULL)
-		RSA_free(rsa);
-	if (pkey != NULL)
+	if (pkeyptr != NULL)
+		*pkeyptr = pkey;
+	else if (pkey != NULL)
 		EVP_PKEY_free(pkey);
-	if (x509 != NULL)
+
+	if (x509ptr != NULL)
+		*x509ptr = x509;
+	else if (x509 != NULL)
 		X509_free(x509);
 
 	return (ret);
diff --git a/usr.sbin/smtpd/ssl.h b/usr.sbin/smtpd/ssl.h
index 923746eefd6..414e120e083 100644
--- a/usr.sbin/smtpd/ssl.h
+++ b/usr.sbin/smtpd/ssl.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ssl.h,v 1.8 2014/05/20 14:21:46 reyk Exp $	*/
+/*	$OpenBSD: ssl.h,v 1.9 2014/05/20 17:33:36 reyk Exp $	*/
 /*
  * Copyright (c) 2013 Gilles Chehade <gilles@poolp.org>
  *
@@ -61,11 +61,10 @@ int		ssl_load_certificate(struct pki *, const char *);
 int		ssl_load_keyfile(struct pki *, const char *, const char *);
 int		ssl_load_cafile(struct pki *, const char *);
 int		ssl_load_dhparams(struct pki *, const char *);
-
-int		ssl_ctx_load_pkey(SSL_CTX *, char *, off_t,
+int		ssl_load_pkey(const void *, size_t, char *, off_t,
 		    X509 **, EVP_PKEY **);
 int		ssl_ctx_fake_private_key(SSL_CTX *, const void *, size_t,
-		    char *, off_t);
+		    char *, off_t, X509 **, EVP_PKEY **);
 
 /* ssl_privsep.c */
 int		ssl_ctx_use_certificate_chain(SSL_CTX *, char *, off_t);