Centralize password handling tool-openssl

crypto/fipsmodule/evp/evp.c

@@ -171,7 +171,7 @@ int EVP_read_pw_string_min(char *buf, int min_length, int length,
   int ret = -1;
   char verify_buf[1024];
 
-  if (!buf || min_length <= 0 || min_length >= length) {
+  if (!buf || min_length < 0 || min_length >= length) {
     return -1;
   }
 

crypto/pem/pem_pkey.c

@@ -109,7 +109,7 @@ EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
       cb = PEM_def_callback;
     }
     int pass_len = cb(psbuf, PEM_BUFSIZE, 0, u);
-    if (pass_len <= 0) {
+    if (pass_len < 0) {
       OPENSSL_PUT_ERROR(PEM, PEM_R_BAD_PASSWORD_READ);
       X509_SIG_free(p8);
       goto err;

tool-openssl/CMakeLists.txt

@@ -9,6 +9,7 @@ add_executable(
 
     crl.cc
     dgst.cc
+    pass_util.cc
     pkcs8.cc
     pkey.cc
     rehash.cc
@@ -87,6 +88,8 @@ if(BUILD_TESTING)
         crl_test.cc
         dgst.cc
         dgst_test.cc
+        pass_util.cc
+        pass_util_test.cc
         pkcs8.cc
         pkcs8_test.cc
         pkey.cc

tool-openssl/internal.h

@@ -5,8 +5,8 @@
 #define TOOL_OPENSSL_INTERNAL_H
 
 #include <openssl/digest.h>
-#include <memory>
 #include <algorithm>
+#include <memory>
 #include <string>
 #include <utility>
 #include <vector>
@@ -24,13 +24,67 @@ struct Tool {
 
 bool IsNumeric(const std::string &str);
 
-X509* CreateAndSignX509Certificate();
-X509_CRL* createTestCRL();
+X509 *CreateAndSignX509Certificate();
+X509_CRL *createTestCRL();
 bool isStringUpperCaseEqual(const std::string &a, const std::string &b);
 
+// Password extracting utility for -passin and -passout options
+namespace pass_util {
+// Password source types for handling different input methods
+enum class Source : uint8_t {
+  kNone,   // Empty or invalid source
+  kPass,   // Direct password with pass: prefix
+  kFile,   // Password from file with file: prefix
+  kEnv,    // Password from environment with env: prefix
+  kStdin,  // Password from stdin
+#ifndef _WIN32
+  kFd,     // Password from file descriptor with fd: prefix (Unix only)
+#endif
+};
+
+// Custom deleter for sensitive strings that securely clears memory before
+// deletion. This ensures passwords are securely removed from memory when no
+// longer needed, preventing potential exposure in memory dumps or swap files.
+void SensitiveStringDeleter(std::string *str);
+
+// Extracts password from a source string, modifying it in place if successful.
+// source: Password source string in one of the following formats:
+//   - pass:password (direct password, e.g., "pass:mypassword")
+//   - file:/path/to/file (password from file)
+//   - env:VAR_NAME (password from environment variable)
+//   - stdin (password from standard input)
+//   - fd:N (password from file descriptor N, Unix only)
+// The source string will be replaced with the extracted password if successful.
+// Returns bool indicating success or failure:
+//   - true: Password was successfully extracted and stored in source
+//   - false: Error occurred, error message printed to stderr
+// Error cases:
+//   - Invalid format string (missing or unknown prefix)
+//   - File access errors (file not found, permission denied)
+//   - Environment variable not set
+//   - Memory allocation failures
+bool ExtractPassword(bssl::UniquePtr<std::string> &source);
+
+// Same process as ExtractPassword but used for -passin and -passout within same
+// tool. Special handling:
+// - If same file is used for both passwords, reads first line for passin
+//   and second line for passout in a single file operation matching OpenSSL
+//   behavior
+// - If stdin is used for both passwords, reads first line for passin
+//   and second line for passout from standard input matching OpenSSL behavior
+bool ExtractPasswords(bssl::UniquePtr<std::string> &passin,
+                      bssl::UniquePtr<std::string> &passout);
+
+}  // namespace pass_util
+
+// Custom deleter used for -passin -passout options
+BSSL_NAMESPACE_BEGIN
+BORINGSSL_MAKE_DELETER(std::string, pass_util::SensitiveStringDeleter)
+BSSL_NAMESPACE_END
+
 bool LoadPrivateKeyAndSignCertificate(X509 *x509,
                                       const std::string &signkey_path);
-EVP_PKEY* CreateTestKey(int key_bits);
+EVP_PKEY *CreateTestKey(int key_bits);
 
 tool_func_t FindTool(const std::string &name);
 tool_func_t FindTool(int argc, char **argv, int &starting_arg);