1 /* 2 * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <stdio.h> 11 #include <string.h> 12 #include <sys/types.h> 13 #include "apps.h" 14 #include "progs.h" 15 #include <openssl/err.h> 16 #include <openssl/evp.h> 17 #include <openssl/x509.h> 18 #include <openssl/pkcs7.h> 19 #include <openssl/pem.h> 20 #include <openssl/objects.h> 21 22 static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile); 23 24 typedef enum OPTION_choice { 25 OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, 26 OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOCRL, OPT_CERTFILE 27 } OPTION_CHOICE; 28 29 const OPTIONS crl2pkcs7_options[] = { 30 {"help", OPT_HELP, '-', "Display this summary"}, 31 {"inform", OPT_INFORM, 'F', "Input format - DER or PEM"}, 32 {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"}, 33 {"in", OPT_IN, '<', "Input file"}, 34 {"out", OPT_OUT, '>', "Output file"}, 35 {"nocrl", OPT_NOCRL, '-', "No crl to load, just certs from '-certfile'"}, 36 {"certfile", OPT_CERTFILE, '<', 37 "File of chain of certs to a trusted CA; can be repeated"}, 38 {NULL} 39 }; 40 41 int crl2pkcs7_main(int argc, char **argv) 42 { 43 BIO *in = NULL, *out = NULL; 44 PKCS7 *p7 = NULL; 45 PKCS7_SIGNED *p7s = NULL; 46 STACK_OF(OPENSSL_STRING) *certflst = NULL; 47 STACK_OF(X509) *cert_stack = NULL; 48 STACK_OF(X509_CRL) *crl_stack = NULL; 49 X509_CRL *crl = NULL; 50 char *infile = NULL, *outfile = NULL, *prog, *certfile; 51 int i = 0, informat = FORMAT_PEM, outformat = FORMAT_PEM, ret = 1, nocrl = 52 0; 53 OPTION_CHOICE o; 54 55 prog = opt_init(argc, argv, crl2pkcs7_options); 56 while ((o = opt_next()) != OPT_EOF) { 57 switch (o) { 58 case OPT_EOF: 59 case OPT_ERR: 60 opthelp: 61 BIO_printf(bio_err, "%s: Use -help for summary.\n", prog); 62 goto end; 63 case OPT_HELP: 64 opt_help(crl2pkcs7_options); 65 ret = 0; 66 goto end; 67 case OPT_INFORM: 68 if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat)) 69 goto opthelp; 70 break; 71 case OPT_OUTFORM: 72 if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat)) 73 goto opthelp; 74 break; 75 case OPT_IN: 76 infile = opt_arg(); 77 break; 78 case OPT_OUT: 79 outfile = opt_arg(); 80 break; 81 case OPT_NOCRL: 82 nocrl = 1; 83 break; 84 case OPT_CERTFILE: 85 if ((certflst == NULL) 86 && (certflst = sk_OPENSSL_STRING_new_null()) == NULL) 87 goto end; 88 if (!sk_OPENSSL_STRING_push(certflst, opt_arg())) 89 goto end; 90 break; 91 } 92 } 93 argc = opt_num_rest(); 94 if (argc != 0) 95 goto opthelp; 96 97 if (!nocrl) { 98 in = bio_open_default(infile, 'r', informat); 99 if (in == NULL) 100 goto end; 101 102 if (informat == FORMAT_ASN1) 103 crl = d2i_X509_CRL_bio(in, NULL); 104 else if (informat == FORMAT_PEM) 105 crl = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL); 106 if (crl == NULL) { 107 BIO_printf(bio_err, "unable to load CRL\n"); 108 ERR_print_errors(bio_err); 109 goto end; 110 } 111 } 112 113 if ((p7 = PKCS7_new()) == NULL) 114 goto end; 115 if ((p7s = PKCS7_SIGNED_new()) == NULL) 116 goto end; 117 p7->type = OBJ_nid2obj(NID_pkcs7_signed); 118 p7->d.sign = p7s; 119 p7s->contents->type = OBJ_nid2obj(NID_pkcs7_data); 120 121 if (!ASN1_INTEGER_set(p7s->version, 1)) 122 goto end; 123 124 if (crl != NULL) { 125 if ((crl_stack = sk_X509_CRL_new_null()) == NULL) 126 goto end; 127 p7s->crl = crl_stack; 128 sk_X509_CRL_push(crl_stack, crl); 129 crl = NULL; /* now part of p7 for OPENSSL_freeing */ 130 } 131 132 if (certflst != NULL) { 133 if ((cert_stack = sk_X509_new_null()) == NULL) 134 goto end; 135 p7s->cert = cert_stack; 136 137 for (i = 0; i < sk_OPENSSL_STRING_num(certflst); i++) { 138 certfile = sk_OPENSSL_STRING_value(certflst, i); 139 if (add_certs_from_file(cert_stack, certfile) < 0) { 140 BIO_printf(bio_err, "error loading certificates\n"); 141 ERR_print_errors(bio_err); 142 goto end; 143 } 144 } 145 } 146 147 out = bio_open_default(outfile, 'w', outformat); 148 if (out == NULL) 149 goto end; 150 151 if (outformat == FORMAT_ASN1) 152 i = i2d_PKCS7_bio(out, p7); 153 else if (outformat == FORMAT_PEM) 154 i = PEM_write_bio_PKCS7(out, p7); 155 if (!i) { 156 BIO_printf(bio_err, "unable to write pkcs7 object\n"); 157 ERR_print_errors(bio_err); 158 goto end; 159 } 160 ret = 0; 161 end: 162 sk_OPENSSL_STRING_free(certflst); 163 BIO_free(in); 164 BIO_free_all(out); 165 PKCS7_free(p7); 166 X509_CRL_free(crl); 167 168 return ret; 169 } 170 171 /*- 172 *---------------------------------------------------------------------- 173 * int add_certs_from_file 174 * 175 * Read a list of certificates to be checked from a file. 176 * 177 * Results: 178 * number of certs added if successful, -1 if not. 179 *---------------------------------------------------------------------- 180 */ 181 static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile) 182 { 183 BIO *in = NULL; 184 int count = 0; 185 int ret = -1; 186 STACK_OF(X509_INFO) *sk = NULL; 187 X509_INFO *xi; 188 189 in = BIO_new_file(certfile, "r"); 190 if (in == NULL) { 191 BIO_printf(bio_err, "error opening the file, %s\n", certfile); 192 goto end; 193 } 194 195 /* This loads from a file, a stack of x509/crl/pkey sets */ 196 sk = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL); 197 if (sk == NULL) { 198 BIO_printf(bio_err, "error reading the file, %s\n", certfile); 199 goto end; 200 } 201 202 /* scan over it and pull out the CRL's */ 203 while (sk_X509_INFO_num(sk)) { 204 xi = sk_X509_INFO_shift(sk); 205 if (xi->x509 != NULL) { 206 sk_X509_push(stack, xi->x509); 207 xi->x509 = NULL; 208 count++; 209 } 210 X509_INFO_free(xi); 211 } 212 213 ret = count; 214 end: 215 /* never need to OPENSSL_free x */ 216 BIO_free(in); 217 sk_X509_INFO_free(sk); 218 return ret; 219 } 220