Re: [PATCH 08/10] pem: Support encrypted keys in l_pem_load_private_key

[Denis Kenzior <denkenz@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1635 bytes --]

Hi Andrew,

On 08/10/2017 06:10 PM, Andrew Zaborowski wrote:
> Add support for loading PKCS#8 encrypted private key files (those
> generated with "openssl pkcs8 ..." or "openssl pkey ..." commands, not
> "openssl rsa ..." commands).  The 'encrypted' parameter can be used to
> check if a password is required to decode the key if the caller knows
> nothing about the key other than the file path.
> ---
>   ell/pem.c | 90 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-----
>   ell/pem.h |  4 +--
>   ell/tls.c |  1 +
>   3 files changed, 86 insertions(+), 9 deletions(-)
> 
> diff --git a/ell/pem.c b/ell/pem.c
> index d1f180e..058b8b8 100644
> --- a/ell/pem.c
> +++ b/ell/pem.c
> @@ -36,6 +36,8 @@
>   #include "pem.h"
>   #include "base64.h"
>   #include "string.h"
> +#include "asn1-private.h"
> +#include "cipher.h"
>   
>   #define PEM_START_BOUNDARY	"-----BEGIN "
>   #define PEM_END_BOUNDARY	"-----END "
> @@ -232,11 +234,15 @@ LIB_EXPORT uint8_t *l_pem_load_certificate(const char *filename, size_t *len)
>   
>   LIB_EXPORT uint8_t *l_pem_load_private_key(const char *filename,
>   						const char *passphrase,
> +						bool *encrypted,
>   						size_t *len)
>   {
>   	uint8_t *content;
>   	char *label;
>   
> +	if (encrypted)
> +		*encrypted = false;
> +

So we set encrypted even if we fail?  Right now you're not even using 
this parameter, so I wonder if we should maybe introduce a new function, 
like l_pem_is_encrypted() instead?

>   	content = l_pem_load_file(filename, 0, &label, len);
>   
>   	if (!content)

Rest looks good.

Regards,
-Denis