1 /* 2 * Copyright 1999-2017 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <stdio.h> 11 #include <stdlib.h> 12 #include <string.h> 13 #include <time.h> 14 #include "apps.h" 15 #include <openssl/bio.h> 16 #include <openssl/conf.h> 17 #include <openssl/err.h> 18 #include <openssl/evp.h> 19 #include <openssl/lhash.h> 20 #include <openssl/x509.h> 21 #include <openssl/pem.h> 22 23 typedef enum OPTION_choice { 24 OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, 25 OPT_NOOUT, OPT_PUBKEY, OPT_VERIFY, OPT_IN, OPT_OUT, 26 OPT_ENGINE, OPT_KEY, OPT_CHALLENGE, OPT_PASSIN, OPT_SPKAC, 27 OPT_SPKSECT 28 } OPTION_CHOICE; 29 30 OPTIONS spkac_options[] = { 31 {"help", OPT_HELP, '-', "Display this summary"}, 32 {"in", OPT_IN, '<', "Input file"}, 33 {"out", OPT_OUT, '>', "Output file"}, 34 {"key", OPT_KEY, '<', "Create SPKAC using private key"}, 35 {"passin", OPT_PASSIN, 's', "Input file pass phrase source"}, 36 {"challenge", OPT_CHALLENGE, 's', "Challenge string"}, 37 {"spkac", OPT_SPKAC, 's', "Alternative SPKAC name"}, 38 {"noout", OPT_NOOUT, '-', "Don't print SPKAC"}, 39 {"pubkey", OPT_PUBKEY, '-', "Output public key"}, 40 {"verify", OPT_VERIFY, '-', "Verify SPKAC signature"}, 41 {"spksect", OPT_SPKSECT, 's', 42 "Specify the name of an SPKAC-dedicated section of configuration"}, 43 #ifndef OPENSSL_NO_ENGINE 44 {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, 45 #endif 46 {NULL} 47 }; 48 49 int spkac_main(int argc, char **argv) 50 { 51 BIO *out = NULL; 52 CONF *conf = NULL; 53 ENGINE *e = NULL; 54 EVP_PKEY *pkey = NULL; 55 NETSCAPE_SPKI *spki = NULL; 56 char *challenge = NULL, *keyfile = NULL; 57 char *infile = NULL, *outfile = NULL, *passinarg = NULL, *passin = NULL; 58 char *spkstr = NULL, *prog; 59 const char *spkac = "SPKAC", *spksect = "default"; 60 int i, ret = 1, verify = 0, noout = 0, pubkey = 0; 61 OPTION_CHOICE o; 62 63 prog = opt_init(argc, argv, spkac_options); 64 while ((o = opt_next()) != OPT_EOF) { 65 switch (o) { 66 case OPT_EOF: 67 case OPT_ERR: 68 opthelp: 69 BIO_printf(bio_err, "%s: Use -help for summary.\n", prog); 70 goto end; 71 case OPT_HELP: 72 opt_help(spkac_options); 73 ret = 0; 74 goto end; 75 case OPT_IN: 76 infile = opt_arg(); 77 break; 78 case OPT_OUT: 79 outfile = opt_arg(); 80 break; 81 case OPT_NOOUT: 82 noout = 1; 83 break; 84 case OPT_PUBKEY: 85 pubkey = 1; 86 break; 87 case OPT_VERIFY: 88 verify = 1; 89 break; 90 case OPT_PASSIN: 91 passinarg = opt_arg(); 92 break; 93 case OPT_KEY: 94 keyfile = opt_arg(); 95 break; 96 case OPT_CHALLENGE: 97 challenge = opt_arg(); 98 break; 99 case OPT_SPKAC: 100 spkac = opt_arg(); 101 break; 102 case OPT_SPKSECT: 103 spksect = opt_arg(); 104 break; 105 case OPT_ENGINE: 106 e = setup_engine(opt_arg(), 0); 107 break; 108 } 109 } 110 argc = opt_num_rest(); 111 if (argc != 0) 112 goto opthelp; 113 114 if (!app_passwd(passinarg, NULL, &passin, NULL)) { 115 BIO_printf(bio_err, "Error getting password\n"); 116 goto end; 117 } 118 119 if (keyfile != NULL) { 120 pkey = load_key(strcmp(keyfile, "-") ? keyfile : NULL, 121 FORMAT_PEM, 1, passin, e, "private key"); 122 if (pkey == NULL) 123 goto end; 124 spki = NETSCAPE_SPKI_new(); 125 if (spki == NULL) 126 goto end; 127 if (challenge != NULL) 128 ASN1_STRING_set(spki->spkac->challenge, 129 challenge, (int)strlen(challenge)); 130 NETSCAPE_SPKI_set_pubkey(spki, pkey); 131 NETSCAPE_SPKI_sign(spki, pkey, EVP_md5()); 132 spkstr = NETSCAPE_SPKI_b64_encode(spki); 133 if (spkstr == NULL) 134 goto end; 135 136 out = bio_open_default(outfile, 'w', FORMAT_TEXT); 137 if (out == NULL) { 138 OPENSSL_free(spkstr); 139 goto end; 140 } 141 BIO_printf(out, "SPKAC=%s\n", spkstr); 142 OPENSSL_free(spkstr); 143 ret = 0; 144 goto end; 145 } 146 147 if ((conf = app_load_config(infile)) == NULL) 148 goto end; 149 150 spkstr = NCONF_get_string(conf, spksect, spkac); 151 152 if (spkstr == NULL) { 153 BIO_printf(bio_err, "Can't find SPKAC called \"%s\"\n", spkac); 154 ERR_print_errors(bio_err); 155 goto end; 156 } 157 158 spki = NETSCAPE_SPKI_b64_decode(spkstr, -1); 159 160 if (spki == NULL) { 161 BIO_printf(bio_err, "Error loading SPKAC\n"); 162 ERR_print_errors(bio_err); 163 goto end; 164 } 165 166 out = bio_open_default(outfile, 'w', FORMAT_TEXT); 167 if (out == NULL) 168 goto end; 169 170 if (!noout) 171 NETSCAPE_SPKI_print(out, spki); 172 pkey = NETSCAPE_SPKI_get_pubkey(spki); 173 if (verify) { 174 i = NETSCAPE_SPKI_verify(spki, pkey); 175 if (i > 0) { 176 BIO_printf(bio_err, "Signature OK\n"); 177 } else { 178 BIO_printf(bio_err, "Signature Failure\n"); 179 ERR_print_errors(bio_err); 180 goto end; 181 } 182 } 183 if (pubkey) 184 PEM_write_bio_PUBKEY(out, pkey); 185 186 ret = 0; 187 188 end: 189 NCONF_free(conf); 190 NETSCAPE_SPKI_free(spki); 191 BIO_free_all(out); 192 EVP_PKEY_free(pkey); 193 release_engine(e); 194 OPENSSL_free(passin); 195 return (ret); 196 } 197