Generic X.509 certificate helpers and secure file utilities

.gitignore

@@ -62,3 +62,4 @@ compile_commands.json.bak
 /serial-file-test
 /rand-file-test
 manpages/*.1.gz
+tests/x509/cert_setup_unit_test

Makefile.am

@@ -89,6 +89,7 @@ endif
 
 include src/include.am
 include wolfclu/include.am
+include tests/x509/unit_include.am
 if HAVE_PYTHON
 include tests/dh/include.am
 include tests/dsa/include.am

src/crypto/clu_crypto_setup.c

@@ -610,6 +610,42 @@ int wolfCLU_setup(int argc, char** argv, char action)
         }
     }
 
+    if (encCheck == 1 && decCheck == 1) {
+        WOLFCLU_LOG(WOLFCLU_E0,
+                "Encrypt and decrypt simultaneously is invalid");
+        wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
+        return WOLFCLU_FATAL_ERROR;
+    }
+
+    if (inCheck == 0 && decCheck == 1) {
+        wolfCLU_LogError("File/string to decrypt needed");
+        wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
+        return WOLFCLU_FATAL_ERROR;
+    }
+
+    if (ivCheck == 1) {
+        if (keyCheck == 0) {
+            WOLFCLU_LOG(WOLFCLU_E0,
+                    "-iv was explicitly set, but no -key or -inkey was"
+                    " provided. A non-password based key must be supplied"
+                    " when setting the -iv flag.");
+            wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
+            return WOLFCLU_FATAL_ERROR;
+        }
+    }
+
+    /* When the user supplies an explicit -key/-inkey, no salt-based
+     * key/iv derivation runs. The cipher therefore needs an explicit -iv:
+     * silently using the all-zero buffer would produce ciphertext that no
+     * one (including this tool on a later run) can decrypt safely. */
+    if (keyCheck == 1 && ivCheck == 0) {
+        WOLFCLU_LOG(WOLFCLU_E0,
+                "-key/-inkey requires -iv to be set: an IV must be"
+                " supplied alongside an explicit key.");
+        wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
+        return WOLFCLU_FATAL_ERROR;
+    }
+
     if (pwdKeyChk == 0 && keyCheck == 0) {
         if (decCheck == 1) {
             WOLFCLU_LOG(WOLFCLU_L0, "\nDECRYPT ERROR:");
@@ -631,6 +667,10 @@ int wolfCLU_setup(int argc, char** argv, char action)
                     "No -pwd flag set, please enter a password to use for"
                     " encrypting.");
             ret = wolfCLU_GetStdinPassword(pwdKey, &pwdBufSz);
+            if (ret != WOLFCLU_SUCCESS) {
+                wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
+                return WOLFCLU_FATAL_ERROR;
+            }
             pwdKeyChk = 1;
         }
     }
@@ -647,41 +687,6 @@ int wolfCLU_setup(int argc, char** argv, char action)
         inCheck = 1;
     }
 
-    if (encCheck == 1 && decCheck == 1) {
-        WOLFCLU_LOG(WOLFCLU_E0,
-                "Encrypt and decrypt simultaneously is invalid");
-        wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
-        return WOLFCLU_FATAL_ERROR;
-    }
-
-    if (inCheck == 0 && decCheck == 1) {
-        wolfCLU_LogError("File/string to decrypt needed");
-        wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
-        return WOLFCLU_FATAL_ERROR;
-    }
-
-    if (ivCheck == 1) {
-        if (keyCheck == 0) {
-            WOLFCLU_LOG(WOLFCLU_E0,
-                    "-iv was explicitly set, but no -key or -inkey was"
-                    " provided. A non-password based key must be supplied"
-                    " when setting the -iv flag.");
-            wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
-            return WOLFCLU_FATAL_ERROR;
-        }
-    }
-
-    /* When the user supplies an explicit -key/-inkey, no salt-based
-     * key/iv derivation runs. The cipher therefore needs an explicit -iv:
-     * silently using the all-zero buffer would produce ciphertext that no
-     * one (including this tool on a later run) can decrypt safely. */
-    if (keyCheck == 1 && ivCheck == 0) {
-        WOLFCLU_LOG(WOLFCLU_E0,
-                "-key/-inkey requires -iv to be set: an IV must be"
-                " supplied alongside an explicit key.");
-        wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
-        return WOLFCLU_FATAL_ERROR;
-    }
 
     if (pwdKeyChk == 1 && keyCheck == 1) {
         XMEMSET(pwdKey, 0, keySize + block);

src/dh/clu_dh.c

@@ -534,11 +534,18 @@ int wolfCLU_DhParamSetup(int argc, char** argv)
             WOLFCLU_LOG(WOLFCLU_E0, "No filesystem support. Unable to open output file");
             ret = WOLFCLU_FATAL_ERROR;
 #else
-            bioOut = wolfSSL_BIO_new_file(out, "wb");
-            if (bioOut == NULL) {
-                wolfCLU_LogError("Unable to open output file %s",
-                        optarg);
-                ret = WOLFCLU_FATAL_ERROR;
+            {
+                FILE* f = wolfCLU_OpenKeyFile(out);
+
+                bioOut = (f != NULL) ? wolfSSL_BIO_new_fp(f, BIO_CLOSE) : NULL;
+                if (bioOut == NULL) {
+                    if (f != NULL) {
+                        XFCLOSE(f);
+                    }
+                    wolfCLU_LogError("Unable to open output file %s",
+                            optarg);
+                    ret = WOLFCLU_FATAL_ERROR;
+                }
             }
 #endif
         }

src/dsa/clu_dsa.c

@@ -197,11 +197,18 @@ int wolfCLU_DsaParamSetup(int argc, char** argv)
             WOLFCLU_LOG(WOLFCLU_E0, "No filesystem support. Unable to open input file");
             ret = WOLFCLU_FATAL_ERROR;
 #else
-            bioOut = wolfSSL_BIO_new_file(out, "wb");
-            if (bioOut == NULL) {
-                wolfCLU_LogError("Unable to open output file %s",
-                        optarg);
-                ret = WOLFCLU_FATAL_ERROR;
+            {
+                FILE* f = wolfCLU_OpenKeyFile(out);
+
+                bioOut = (f != NULL) ? wolfSSL_BIO_new_fp(f, BIO_CLOSE) : NULL;
+                if (bioOut == NULL) {
+                    if (f != NULL) {
+                        XFCLOSE(f);
+                    }
+                    wolfCLU_LogError("Unable to open output file %s",
+                            optarg);
+                    ret = WOLFCLU_FATAL_ERROR;
+                }
             }
 #endif
         }