More SecurityContext calls accept a password.

runtime/bin/secure_socket.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "bin/secure_socket.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <stdio.h>
@@ skipping 264 matching lines @@
 }
 
 
 void FUNCTION_NAME(SecureSocket_FilterPointer)(Dart_NativeArguments args) {
   intptr_t filter_pointer = reinterpret_cast<intptr_t>(GetFilter(args));
   Dart_SetReturnValue(args, Dart_NewInteger(filter_pointer));
 }
 
 
 static Dart_Handle WrappedX509Certificate(X509* certificate) {
-  if (certificate == NULL) return Dart_Null();
+  if (certificate == NULL) {
+    return Dart_Null();
+  }
   Dart_Handle x509_type =
       DartUtils::GetDartType(DartUtils::kIOLibURL, "X509Certificate");
   if (Dart_IsError(x509_type)) {
     return x509_type;
   }
   Dart_Handle arguments[] = { NULL };
   Dart_Handle result =
       Dart_New(x509_type, DartUtils::NewString("_"), 0, arguments);
   if (Dart_IsError(result)) {
     return result;
   }
   ASSERT(Dart_IsInstance(result));
   Dart_Handle status = Dart_SetNativeInstanceField(
       result,
       kX509NativeFieldIndex,
       reinterpret_cast<intptr_t>(certificate));
   if (Dart_IsError(status)) {
     return status;
   }
   return result;
 }
 
 
 int CertificateCallback(int preverify_ok, X509_STORE_CTX* store_ctx) {
-  if (preverify_ok == 1) return 1;
+  if (preverify_ok == 1) {
+    return 1;
+  }
   Dart_Isolate isolate = Dart_CurrentIsolate();
   if (isolate == NULL) {
     FATAL("CertificateCallback called with no current isolate\n");
   }
   X509* certificate = X509_STORE_CTX_get_current_cert(store_ctx);
   int ssl_index = SSL_get_ex_data_X509_STORE_CTX_idx();
   SSL* ssl = static_cast<SSL*>(
       X509_STORE_CTX_get_ex_data(store_ctx, ssl_index));
   SSLFilter* filter = static_cast<SSLFilter*>(
       SSL_get_ex_data(ssl, SSLFilter::filter_ssl_index));
   Dart_Handle callback = filter->bad_certificate_callback();
-  if (Dart_IsNull(callback)) return 0;
+  if (Dart_IsNull(callback)) {
+    return 0;
+  }
   Dart_Handle args[1];
   args[0] = WrappedX509Certificate(certificate);
   if (Dart_IsError(args[0])) {
     filter->callback_error = args[0];
     return 0;
   }
   Dart_Handle result = Dart_InvokeClosure(callback, 1, args);
   if (!Dart_IsError(result) && !Dart_IsBoolean(result)) {
     result = Dart_NewUnhandledExceptionError(DartUtils::NewDartIOException(
         "HandshakeException",
@@ skipping 20 matching lines @@
 
 
 int PasswordCallback(char* buf, int size, int rwflag, void* userdata) {
   char* password = static_cast<char*>(userdata);
   ASSERT(size == PEM_BUFSIZE);
   strncpy(buf, password, size);
   return strlen(password);
 }
 
 
-void CheckStatus(int status,
-                 const char* type,
-                 const char* message) {
+void CheckStatus(int status, const char* type, const char* message) {
   // TODO(24183): Take appropriate action on failed calls,
   // throw exception that includes all messages from the error stack.
-  if (status == 1) return;
+  if (status == 1) {
+    return;
+  }
   if (SSL_LOG_STATUS) {
     int error = ERR_get_error();
     Log::PrintErr("Failed: %s status %d", message, status);
     char error_string[SSL_ERROR_MESSAGE_BUFFER_SIZE];
     ERR_error_string_n(error, error_string, SSL_ERROR_MESSAGE_BUFFER_SIZE);
     Log::PrintErr("ERROR: %d %s\n", error, error_string);
   }
   ThrowIOException(status, type, message);
 }
 
@@ skipping 170 matching lines @@
     ERR_clear_error();
     BIO_reset(bio);
 
     // Try to decode as PKCS12
     key = GetPrivateKeyPKCS12(bio, password);
   }
   return key;
 }
 
 
+static const char* GetPasswordArgument(Dart_NativeArguments args,
+                                       intptr_t index) {
+  Dart_Handle password_object =
+      ThrowIfError(Dart_GetNativeArgument(args, index));
+  const char* password = NULL;
+  if (Dart_IsString(password_object)) {
+    ThrowIfError(Dart_StringToCString(password_object, &password));
+    if (strlen(password) > PEM_BUFSIZE - 1) {
+      Dart_ThrowException(DartUtils::NewDartArgumentError(
+        "Password length is greater than 1023 (PEM_BUFSIZE)"));
+    }
+  } else if (Dart_IsNull(password_object)) {
+    password = "";
+  } else {
+    Dart_ThrowException(DartUtils::NewDartArgumentError(
+        "Password is not a String or null"));
+  }
+  return password;
+}
+
+
 void FUNCTION_NAME(SecurityContext_UsePrivateKeyBytes)(
     Dart_NativeArguments args) {
   SSL_CTX* context = GetSecurityContext(args);
-
-  Dart_Handle password_object = ThrowIfError(Dart_GetNativeArgument(args, 2));
-  const char* password = NULL;
-  if (Dart_IsString(password_object)) {
-    ThrowIfError(Dart_StringToCString(password_object, &password));
-    if (strlen(password) > PEM_BUFSIZE - 1) {
-      Dart_ThrowException(DartUtils::NewDartArgumentError(
-        "SecurityContext.usePrivateKey password length is greater than"
-        " 1023 (PEM_BUFSIZE)"));
-    }
-  } else if (Dart_IsNull(password_object)) {
-    password = "";
-  } else {
-    Dart_ThrowException(DartUtils::NewDartArgumentError(
-        "SecurityContext.usePrivateKey password is not a String or null"));
-  }
+  const char* password = GetPasswordArgument(args, 2);
 
   int status;
   {
     ScopedMemBIO bio(ThrowIfError(Dart_GetNativeArgument(args, 1)));
     EVP_PKEY *key = GetPrivateKey(bio.bio(), password);
     status = SSL_CTX_use_PrivateKey(context, key);
   }
 
   // TODO(24184): Handle different expected errors here - file missing,
   // incorrect password, file not a PEM, and throw exceptions.
   // CheckStatus should also throw an exception in uncaught cases.
   CheckStatus(status, "TlsException", "Failure in usePrivateKeyBytes");
 }
 
 
-static int SetTrustedCertificatesBytesPKCS12(SSL_CTX* context, BIO* bio) {
+static int SetTrustedCertificatesBytesPKCS12(SSL_CTX* context,
+                                             BIO* bio,
+                                             const char* password) {
   ScopedPKCS12 p12(d2i_PKCS12_bio(bio, NULL));
   if (p12.get() == NULL) {
     return NULL;
   }
 
   EVP_PKEY* key = NULL;
   X509 *cert = NULL;
   STACK_OF(X509) *ca_certs = NULL;
-  // There should be no private keys in this file, so we hardcode the password
-  // to "".
-  // TODO(zra): Allow passing a password anyway.
-  int status = PKCS12_parse(p12.get(), "", &key, &cert, &ca_certs);
+  int status = PKCS12_parse(p12.get(), password, &key, &cert, &ca_certs);
   if (status == 0) {
     return status;
   }
 
   ScopedX509Stack cert_stack(ca_certs);
-
-  // There should be no private key.
-  if (key != NULL) {
-    X509_free(cert);
-    return 0;
-  }
-
   X509_STORE* store = SSL_CTX_get_cert_store(context);
   status = X509_STORE_add_cert(store, cert);
   if (status == 0) {
     X509_free(cert);
     return status;
   }
 
   X509* ca;
   while ((ca = sk_X509_shift(cert_stack.get())) != NULL) {
     status = X509_STORE_add_cert(store, ca);
@@ skipping 27 matching lines @@
       (ERR_GET_REASON(err) != PEM_R_NO_START_LINE)) {
     // If bio contains data that is trying to be PEM but is malformed, then
     // this case will be triggered.
     status = 0;
   }
 
   return status;
 }
 
 
-static int SetTrustedCertificatesBytes(SSL_CTX* context, BIO* bio) {
+static int SetTrustedCertificatesBytes(SSL_CTX* context,
+                                       BIO* bio,
+                                       const char* password) {
   int status = SetTrustedCertificatesBytesPEM(context, bio);
   if (TryPKCS12(status != 0)) {
     ERR_clear_error();
     BIO_reset(bio);
-    status = SetTrustedCertificatesBytesPKCS12(context, bio);
+    status = SetTrustedCertificatesBytesPKCS12(context, bio, password);
   } else if (status != 0) {
     // The PEM file was successfully parsed.
     ERR_clear_error();
   }
   return status;
 }
 
 
 void FUNCTION_NAME(SecurityContext_SetTrustedCertificatesBytes)(
     Dart_NativeArguments args) {
   SSL_CTX* context = GetSecurityContext(args);
+  const char* password = GetPasswordArgument(args, 2);
   int status;
   {
     ScopedMemBIO bio(ThrowIfError(Dart_GetNativeArgument(args, 1)));
-    status = SetTrustedCertificatesBytes(context, bio.bio());
+    status = SetTrustedCertificatesBytes(context, bio.bio(), password);
   }
   CheckStatus(status,
               "TlsException",
               "Failure in setTrustedCertificatesBytes");
 }
 
 
 void FUNCTION_NAME(SecurityContext_TrustBuiltinRoots)(
     Dart_NativeArguments args) {
   SSL_CTX* context = GetSecurityContext(args);
   X509_STORE* store = SSL_CTX_get_cert_store(context);
   BIO* roots_bio =
       BIO_new_mem_buf(const_cast<unsigned char*>(root_certificates_pem),
                       root_certificates_pem_length);
   X509* root_cert;
   // PEM_read_bio_X509 reads PEM-encoded certificates from a bio (in our case,
   // backed by a memory buffer), and returns X509 objects, one by one.
   // When the end of the bio is reached, it returns null.
   while ((root_cert = PEM_read_bio_X509(roots_bio, NULL, NULL, NULL))) {
     X509_STORE_add_cert(store, root_cert);
   }
   BIO_free(roots_bio);
 }
 
 
-static int UseChainBytesPKCS12(SSL_CTX* context, BIO* bio) {
+static int UseChainBytesPKCS12(SSL_CTX* context,
+                               BIO* bio,
+                               const char* password) {
   ScopedPKCS12 p12(d2i_PKCS12_bio(bio, NULL));
   if (p12.get() == NULL) {
     return NULL;
   }
 
   EVP_PKEY* key = NULL;
   X509 *cert = NULL;
   STACK_OF(X509) *ca_certs = NULL;
-  // There should be no private keys in this file, so we hardcode the password
-  // to "".
-  // TODO(zra): Allow passing a password anyway.
-  int status = PKCS12_parse(p12.get(), "", &key, &cert, &ca_certs);
+  int status = PKCS12_parse(p12.get(), password, &key, &cert, &ca_certs);
   if (status == 0) {
     return status;
   }
 
   ScopedX509 x509(cert);
   ScopedX509Stack certs(ca_certs);
-
-  // There should be no private key.
-  if (key != NULL) {
-    return 0;
-  }
-
   status = SSL_CTX_use_certificate(context, x509.get());
   if (ERR_peek_error() != 0) {
     // Key/certificate mismatch doesn't imply status is 0.
     status = 0;
   }
   if (status == 0) {
     return status;
   }
 
   SSL_CTX_clear_chain_certs(context);
@@ skipping 48 matching lines @@
       (ERR_GET_REASON(err) != PEM_R_NO_START_LINE)) {
     // If bio contains data that is trying to be PEM but is malformed, then
     // this case will be triggered.
     status = 0;
   }
 
   return status;
 }
 
 
-static int UseChainBytes(SSL_CTX* context, BIO* bio) {
+static int UseChainBytes(SSL_CTX* context, BIO* bio, const char* password) {
   int status = UseChainBytesPEM(context, bio);
   if (TryPKCS12(status != 0)) {
     ERR_clear_error();
     BIO_reset(bio);
-    status = UseChainBytesPKCS12(context, bio);
+    status = UseChainBytesPKCS12(context, bio, password);
   } else if (status != 0) {
     // The PEM file was successfully read.
     ERR_clear_error();
   }
   return status;
 }
 
 
 void FUNCTION_NAME(SecurityContext_UseCertificateChainBytes)(
     Dart_NativeArguments args) {
   SSL_CTX* context = GetSecurityContext(args);
+  const char* password = GetPasswordArgument(args, 2);
   int status;
   {
     ScopedMemBIO bio(ThrowIfError(Dart_GetNativeArgument(args, 1)));
-    status = UseChainBytes(context, bio.bio());
+    status = UseChainBytes(context, bio.bio(), password);
   }
   CheckStatus(status,
               "TlsException",
               "Failure in useCertificateChainBytes");
 }
 
 
-static STACK_OF(X509_NAME)* GetCertificateNamesPKCS12(BIO* bio) {
+static STACK_OF(X509_NAME)* GetCertificateNamesPKCS12(BIO* bio,
+                                                      const char* password) {
   ScopedPKCS12 p12(d2i_PKCS12_bio(bio, NULL));
   if (p12.get() == NULL) {
     return NULL;
   }
 
   ScopedX509NAMEStack result(sk_X509_NAME_new_null());
   if (result.get() == NULL) {
     return NULL;
   }
 
   EVP_PKEY* key = NULL;
   X509 *cert = NULL;
   STACK_OF(X509) *ca_certs = NULL;
-  // There should be no private keys in this file, so we hardcode the password
-  // to "".
-  // TODO(zra): Allow passing a password anyway.
-  int status = PKCS12_parse(p12.get(), "", &key, &cert, &ca_certs);
+  int status = PKCS12_parse(p12.get(), password, &key, &cert, &ca_certs);
   if (status == 0) {
     return NULL;
   }
 
   ScopedX509 x509(cert);
   ScopedX509Stack certs(ca_certs);
-
-  // There should be no private key.
-  if (key != NULL) {
-    return NULL;
-  }
-
   X509_NAME* x509_name = X509_get_subject_name(x509.get());
   if (x509_name == NULL) {
     return NULL;
   }
 
   x509_name = X509_NAME_dup(x509_name);
   if (x509_name == NULL) {
     return NULL;
   }
 
@@ skipping 56 matching lines @@
   if ((ERR_GET_LIB(err) != ERR_LIB_PEM) ||
       (ERR_GET_REASON(err) != PEM_R_NO_START_LINE)) {
     // The data was trying to be PEM, but was malformed.
     return NULL;
   }
 
   return result.release();
 }
 
 
-static STACK_OF(X509_NAME)* GetCertificateNames(BIO* bio) {
+static STACK_OF(X509_NAME)* GetCertificateNames(BIO* bio,
+                                                const char* password) {
   STACK_OF(X509_NAME)* result = GetCertificateNamesPEM(bio);
   if (TryPKCS12(result != NULL)) {
     ERR_clear_error();
     BIO_reset(bio);
-    result = GetCertificateNamesPKCS12(bio);
+    result = GetCertificateNamesPKCS12(bio, password);
   } else if (result != NULL) {
     // The PEM file was successfully parsed.
     ERR_clear_error();
   }
   return result;
 }
 
 
 void FUNCTION_NAME(SecurityContext_SetClientAuthoritiesBytes)(
     Dart_NativeArguments args) {
   SSL_CTX* context = GetSecurityContext(args);
+  const char* password = GetPasswordArgument(args, 2);
   STACK_OF(X509_NAME)* certificate_names;
 
   {
     ScopedMemBIO bio(ThrowIfError(Dart_GetNativeArgument(args, 1)));
-    certificate_names = GetCertificateNames(bio.bio());
+    certificate_names = GetCertificateNames(bio.bio(), password);
   }
 
   if (certificate_names != NULL) {
     SSL_CTX_set_client_CA_list(context, certificate_names);
   } else {
     Dart_ThrowException(DartUtils::NewDartArgumentError(
         "Could not load certificate names from file in SetClientAuthorities"));
   }
 }
 
@@ skipping 614 matching lines @@
     } else {
       if (SSL_LOG_DATA) Log::Print(
           "WriteEncrypted  BIO_read wrote %d bytes\n", bytes_processed);
     }
   }
   return bytes_processed;
 }
 
 }  // namespace bin
 }  // namespace dart