1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * CDDL HEADER START
3*0Sstevel@tonic-gate *
4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
7*0Sstevel@tonic-gate * with the License.
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
11*0Sstevel@tonic-gate * See the License for the specific language governing permissions
12*0Sstevel@tonic-gate * and limitations under the License.
13*0Sstevel@tonic-gate *
14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
19*0Sstevel@tonic-gate *
20*0Sstevel@tonic-gate * CDDL HEADER END
21*0Sstevel@tonic-gate */
22*0Sstevel@tonic-gate /*
23*0Sstevel@tonic-gate * Copyright 2002-2003 Sun Microsystems, Inc. All rights reserved.
24*0Sstevel@tonic-gate * Use is subject to license terms.
25*0Sstevel@tonic-gate */
26*0Sstevel@tonic-gate
27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
28*0Sstevel@tonic-gate
29*0Sstevel@tonic-gate #include <stdio.h>
30*0Sstevel@tonic-gate #include <libintl.h>
31*0Sstevel@tonic-gate #include <locale.h>
32*0Sstevel@tonic-gate #include <sys/types.h>
33*0Sstevel@tonic-gate #include <sys/stat.h>
34*0Sstevel@tonic-gate #include <sys/wanboot_impl.h>
35*0Sstevel@tonic-gate #include <unistd.h>
36*0Sstevel@tonic-gate #include <string.h>
37*0Sstevel@tonic-gate #include <libinetutil.h>
38*0Sstevel@tonic-gate #include <wanbootutil.h>
39*0Sstevel@tonic-gate
40*0Sstevel@tonic-gate #include <openssl/crypto.h>
41*0Sstevel@tonic-gate #include <openssl/buffer.h>
42*0Sstevel@tonic-gate #include <openssl/bio.h>
43*0Sstevel@tonic-gate #include <openssl/err.h>
44*0Sstevel@tonic-gate #include <openssl/x509.h>
45*0Sstevel@tonic-gate #include <openssl/x509v3.h>
46*0Sstevel@tonic-gate #include <openssl/pkcs12.h>
47*0Sstevel@tonic-gate #include <openssl/evp.h>
48*0Sstevel@tonic-gate #include <p12aux.h>
49*0Sstevel@tonic-gate
50*0Sstevel@tonic-gate static boolean_t verbose = B_FALSE; /* When nonzero, do in verbose mode */
51*0Sstevel@tonic-gate
52*0Sstevel@tonic-gate /* The following match/cert values require PKCS12 */
53*0Sstevel@tonic-gate static int matchty; /* Type of matching do to on input */
54*0Sstevel@tonic-gate static char *k_matchval; /* localkeyid value to match */
55*0Sstevel@tonic-gate static uint_t k_len; /* length of k_matchval */
56*0Sstevel@tonic-gate
57*0Sstevel@tonic-gate #define IO_KEYFILE 1 /* Have a separate key file or data */
58*0Sstevel@tonic-gate #define IO_CERTFILE 2 /* Have a separate cert file or data */
59*0Sstevel@tonic-gate #define IO_TRUSTFILE 4 /* Have a separate trustanchor file */
60*0Sstevel@tonic-gate
61*0Sstevel@tonic-gate static char *input = NULL; /* Consolidated input file */
62*0Sstevel@tonic-gate static char *key_out = NULL; /* Key file to be output */
63*0Sstevel@tonic-gate static char *cert_out = NULL; /* Cert file to be output */
64*0Sstevel@tonic-gate static char *trust_out = NULL; /* Trust anchor file to be output */
65*0Sstevel@tonic-gate static uint_t outfiles; /* What files are there for output */
66*0Sstevel@tonic-gate static char *progname;
67*0Sstevel@tonic-gate
68*0Sstevel@tonic-gate /* Returns from time_check */
69*0Sstevel@tonic-gate typedef enum {
70*0Sstevel@tonic-gate CHK_TIME_OK = 0, /* Cert in effect and not expired */
71*0Sstevel@tonic-gate CHK_TIME_BEFORE_BAD, /* not_before field is invalid */
72*0Sstevel@tonic-gate CHK_TIME_AFTER_BAD, /* not_after field is invalid */
73*0Sstevel@tonic-gate CHK_TIME_IS_BEFORE, /* Cert not yet in force */
74*0Sstevel@tonic-gate CHK_TIME_HAS_EXPIRED /* Cert has expired */
75*0Sstevel@tonic-gate } time_errs_t;
76*0Sstevel@tonic-gate
77*0Sstevel@tonic-gate static int parse_keyid(const char *);
78*0Sstevel@tonic-gate static int do_certs(void);
79*0Sstevel@tonic-gate static int read_files(STACK_OF(X509) **, X509 **, EVP_PKEY **);
80*0Sstevel@tonic-gate static void check_certs(STACK_OF(X509) *, X509 **);
81*0Sstevel@tonic-gate static time_errs_t time_check_print(X509 *);
82*0Sstevel@tonic-gate static time_errs_t time_check(X509 *);
83*0Sstevel@tonic-gate static int write_files(STACK_OF(X509) *, X509 *, EVP_PKEY *);
84*0Sstevel@tonic-gate static int get_ifile(char *, char *, EVP_PKEY **, X509 **, STACK_OF(X509) **);
85*0Sstevel@tonic-gate static int do_ofile(char *, EVP_PKEY *, X509 *, STACK_OF(X509) *);
86*0Sstevel@tonic-gate static void usage(void);
87*0Sstevel@tonic-gate static const char *cryptoerr(void);
88*0Sstevel@tonic-gate
89*0Sstevel@tonic-gate int
main(int argc,char ** argv)90*0Sstevel@tonic-gate main(int argc, char **argv)
91*0Sstevel@tonic-gate {
92*0Sstevel@tonic-gate int i;
93*0Sstevel@tonic-gate
94*0Sstevel@tonic-gate /*
95*0Sstevel@tonic-gate * Do the necessary magic for localization support.
96*0Sstevel@tonic-gate */
97*0Sstevel@tonic-gate (void) setlocale(LC_ALL, "");
98*0Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)
99*0Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST"
100*0Sstevel@tonic-gate #endif
101*0Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN);
102*0Sstevel@tonic-gate
103*0Sstevel@tonic-gate progname = strrchr(argv[0], '/');
104*0Sstevel@tonic-gate if (progname != NULL)
105*0Sstevel@tonic-gate progname++;
106*0Sstevel@tonic-gate else
107*0Sstevel@tonic-gate progname = argv[0];
108*0Sstevel@tonic-gate
109*0Sstevel@tonic-gate wbku_errinit(progname);
110*0Sstevel@tonic-gate
111*0Sstevel@tonic-gate matchty = DO_FIRST_PAIR;
112*0Sstevel@tonic-gate while ((i = getopt(argc, argv, "vc:i:k:l:t:")) != -1) {
113*0Sstevel@tonic-gate switch (i) {
114*0Sstevel@tonic-gate case 'v':
115*0Sstevel@tonic-gate verbose = B_TRUE;
116*0Sstevel@tonic-gate break;
117*0Sstevel@tonic-gate
118*0Sstevel@tonic-gate case 'l':
119*0Sstevel@tonic-gate if (parse_keyid(optarg) < 0)
120*0Sstevel@tonic-gate return (EXIT_FAILURE);
121*0Sstevel@tonic-gate matchty = DO_FIND_KEYID;
122*0Sstevel@tonic-gate break;
123*0Sstevel@tonic-gate
124*0Sstevel@tonic-gate case 'c':
125*0Sstevel@tonic-gate cert_out = optarg;
126*0Sstevel@tonic-gate outfiles |= IO_CERTFILE;
127*0Sstevel@tonic-gate break;
128*0Sstevel@tonic-gate
129*0Sstevel@tonic-gate case 'k':
130*0Sstevel@tonic-gate key_out = optarg;
131*0Sstevel@tonic-gate outfiles |= IO_KEYFILE;
132*0Sstevel@tonic-gate break;
133*0Sstevel@tonic-gate
134*0Sstevel@tonic-gate case 't':
135*0Sstevel@tonic-gate trust_out = optarg;
136*0Sstevel@tonic-gate outfiles |= IO_TRUSTFILE;
137*0Sstevel@tonic-gate break;
138*0Sstevel@tonic-gate
139*0Sstevel@tonic-gate case 'i':
140*0Sstevel@tonic-gate input = optarg;
141*0Sstevel@tonic-gate break;
142*0Sstevel@tonic-gate
143*0Sstevel@tonic-gate default:
144*0Sstevel@tonic-gate usage();
145*0Sstevel@tonic-gate }
146*0Sstevel@tonic-gate }
147*0Sstevel@tonic-gate
148*0Sstevel@tonic-gate if (input == NULL) {
149*0Sstevel@tonic-gate wbku_printerr("no input file specified\n");
150*0Sstevel@tonic-gate usage();
151*0Sstevel@tonic-gate }
152*0Sstevel@tonic-gate
153*0Sstevel@tonic-gate /*
154*0Sstevel@tonic-gate * Need output files.
155*0Sstevel@tonic-gate */
156*0Sstevel@tonic-gate if (outfiles == 0) {
157*0Sstevel@tonic-gate wbku_printerr("at least one output file must be specified\n");
158*0Sstevel@tonic-gate usage();
159*0Sstevel@tonic-gate }
160*0Sstevel@tonic-gate
161*0Sstevel@tonic-gate if (do_certs() < 0)
162*0Sstevel@tonic-gate return (EXIT_FAILURE);
163*0Sstevel@tonic-gate
164*0Sstevel@tonic-gate return (EXIT_SUCCESS);
165*0Sstevel@tonic-gate }
166*0Sstevel@tonic-gate
167*0Sstevel@tonic-gate static int
parse_keyid(const char * keystr)168*0Sstevel@tonic-gate parse_keyid(const char *keystr)
169*0Sstevel@tonic-gate {
170*0Sstevel@tonic-gate const char *rp;
171*0Sstevel@tonic-gate char *wp;
172*0Sstevel@tonic-gate char *nkeystr;
173*0Sstevel@tonic-gate uint_t nkeystrlen;
174*0Sstevel@tonic-gate
175*0Sstevel@tonic-gate /*
176*0Sstevel@tonic-gate * In the worst case, we'll need one additional character in our
177*0Sstevel@tonic-gate * output string -- e.g. "A\0" -> "0A\0"
178*0Sstevel@tonic-gate */
179*0Sstevel@tonic-gate nkeystrlen = strlen(keystr) + 2;
180*0Sstevel@tonic-gate k_len = (nkeystrlen + 1) / 2;
181*0Sstevel@tonic-gate nkeystr = malloc(nkeystrlen);
182*0Sstevel@tonic-gate k_matchval = malloc(k_len);
183*0Sstevel@tonic-gate if (nkeystr == NULL || k_matchval == NULL) {
184*0Sstevel@tonic-gate free(nkeystr);
185*0Sstevel@tonic-gate free(k_matchval);
186*0Sstevel@tonic-gate wbku_printerr("cannot allocate keyid");
187*0Sstevel@tonic-gate return (-1);
188*0Sstevel@tonic-gate }
189*0Sstevel@tonic-gate
190*0Sstevel@tonic-gate /*
191*0Sstevel@tonic-gate * For convenience, we allow the user to put spaces between each digit
192*0Sstevel@tonic-gate * when entering it on the command line. As a result, we need to
193*0Sstevel@tonic-gate * process it into a format that hexascii_to_octet() can handle. Note
194*0Sstevel@tonic-gate * that we're careful to map strings like "AA B CC D" to "AA0BCC0D".
195*0Sstevel@tonic-gate */
196*0Sstevel@tonic-gate for (rp = keystr, wp = nkeystr; *rp != '\0'; rp++) {
197*0Sstevel@tonic-gate if (*rp == ' ')
198*0Sstevel@tonic-gate continue;
199*0Sstevel@tonic-gate
200*0Sstevel@tonic-gate if (rp[1] == ' ' || rp[1] == '\0') {
201*0Sstevel@tonic-gate *wp++ = '0'; /* one character sequence; prepend 0 */
202*0Sstevel@tonic-gate *wp++ = *rp;
203*0Sstevel@tonic-gate } else {
204*0Sstevel@tonic-gate *wp++ = *rp++;
205*0Sstevel@tonic-gate *wp++ = *rp;
206*0Sstevel@tonic-gate }
207*0Sstevel@tonic-gate }
208*0Sstevel@tonic-gate *wp = '\0';
209*0Sstevel@tonic-gate
210*0Sstevel@tonic-gate if (hexascii_to_octet(nkeystr, wp - nkeystr, k_matchval, &k_len) != 0) {
211*0Sstevel@tonic-gate free(nkeystr);
212*0Sstevel@tonic-gate free(k_matchval);
213*0Sstevel@tonic-gate wbku_printerr("invalid keyid `%s'\n", keystr);
214*0Sstevel@tonic-gate return (-1);
215*0Sstevel@tonic-gate }
216*0Sstevel@tonic-gate
217*0Sstevel@tonic-gate free(nkeystr);
218*0Sstevel@tonic-gate return (0);
219*0Sstevel@tonic-gate }
220*0Sstevel@tonic-gate
221*0Sstevel@tonic-gate static int
do_certs(void)222*0Sstevel@tonic-gate do_certs(void)
223*0Sstevel@tonic-gate {
224*0Sstevel@tonic-gate char *bufp;
225*0Sstevel@tonic-gate STACK_OF(X509) *ta_in = NULL;
226*0Sstevel@tonic-gate EVP_PKEY *pkey_in = NULL;
227*0Sstevel@tonic-gate X509 *xcert_in = NULL;
228*0Sstevel@tonic-gate
229*0Sstevel@tonic-gate sunw_crypto_init();
230*0Sstevel@tonic-gate
231*0Sstevel@tonic-gate if (read_files(&ta_in, &xcert_in, &pkey_in) < 0)
232*0Sstevel@tonic-gate return (-1);
233*0Sstevel@tonic-gate
234*0Sstevel@tonic-gate if (verbose) {
235*0Sstevel@tonic-gate if (xcert_in != NULL) {
236*0Sstevel@tonic-gate (void) printf(gettext("\nMain cert:\n"));
237*0Sstevel@tonic-gate
238*0Sstevel@tonic-gate /*
239*0Sstevel@tonic-gate * sunw_subject_attrs() returns a pointer to
240*0Sstevel@tonic-gate * memory allocated on our behalf. The same
241*0Sstevel@tonic-gate * behavior is exhibited by sunw_issuer_attrs().
242*0Sstevel@tonic-gate */
243*0Sstevel@tonic-gate bufp = sunw_subject_attrs(xcert_in, NULL, 0);
244*0Sstevel@tonic-gate if (bufp != NULL) {
245*0Sstevel@tonic-gate (void) printf(gettext(" Subject: %s\n"),
246*0Sstevel@tonic-gate bufp);
247*0Sstevel@tonic-gate OPENSSL_free(bufp);
248*0Sstevel@tonic-gate }
249*0Sstevel@tonic-gate
250*0Sstevel@tonic-gate bufp = sunw_issuer_attrs(xcert_in, NULL, 0);
251*0Sstevel@tonic-gate if (bufp != NULL) {
252*0Sstevel@tonic-gate (void) printf(gettext(" Issuer: %s\n"), bufp);
253*0Sstevel@tonic-gate OPENSSL_free(bufp);
254*0Sstevel@tonic-gate }
255*0Sstevel@tonic-gate
256*0Sstevel@tonic-gate (void) sunw_print_times(stdout, PRNT_BOTH, NULL,
257*0Sstevel@tonic-gate xcert_in);
258*0Sstevel@tonic-gate }
259*0Sstevel@tonic-gate
260*0Sstevel@tonic-gate if (ta_in != NULL) {
261*0Sstevel@tonic-gate X509 *x;
262*0Sstevel@tonic-gate int i;
263*0Sstevel@tonic-gate
264*0Sstevel@tonic-gate for (i = 0; i < sk_X509_num(ta_in); i++) {
265*0Sstevel@tonic-gate /* LINTED */
266*0Sstevel@tonic-gate x = sk_X509_value(ta_in, i);
267*0Sstevel@tonic-gate (void) printf(
268*0Sstevel@tonic-gate gettext("\nTrust Anchor cert %d:\n"), i);
269*0Sstevel@tonic-gate
270*0Sstevel@tonic-gate /*
271*0Sstevel@tonic-gate * sunw_subject_attrs() returns a pointer to
272*0Sstevel@tonic-gate * memory allocated on our behalf. We get the
273*0Sstevel@tonic-gate * same behavior from sunw_issuer_attrs().
274*0Sstevel@tonic-gate */
275*0Sstevel@tonic-gate bufp = sunw_subject_attrs(x, NULL, 0);
276*0Sstevel@tonic-gate if (bufp != NULL) {
277*0Sstevel@tonic-gate (void) printf(
278*0Sstevel@tonic-gate gettext(" Subject: %s\n"), bufp);
279*0Sstevel@tonic-gate OPENSSL_free(bufp);
280*0Sstevel@tonic-gate }
281*0Sstevel@tonic-gate
282*0Sstevel@tonic-gate bufp = sunw_issuer_attrs(x, NULL, 0);
283*0Sstevel@tonic-gate if (bufp != NULL) {
284*0Sstevel@tonic-gate (void) printf(
285*0Sstevel@tonic-gate gettext(" Issuer: %s\n"), bufp);
286*0Sstevel@tonic-gate OPENSSL_free(bufp);
287*0Sstevel@tonic-gate }
288*0Sstevel@tonic-gate
289*0Sstevel@tonic-gate (void) sunw_print_times(stdout, PRNT_BOTH,
290*0Sstevel@tonic-gate NULL, x);
291*0Sstevel@tonic-gate }
292*0Sstevel@tonic-gate }
293*0Sstevel@tonic-gate }
294*0Sstevel@tonic-gate
295*0Sstevel@tonic-gate check_certs(ta_in, &xcert_in);
296*0Sstevel@tonic-gate if (xcert_in != NULL && pkey_in != NULL) {
297*0Sstevel@tonic-gate if (sunw_check_keys(xcert_in, pkey_in) == 0) {
298*0Sstevel@tonic-gate wbku_printerr("warning: key and certificate do "
299*0Sstevel@tonic-gate "not match\n");
300*0Sstevel@tonic-gate }
301*0Sstevel@tonic-gate }
302*0Sstevel@tonic-gate
303*0Sstevel@tonic-gate return (write_files(ta_in, xcert_in, pkey_in));
304*0Sstevel@tonic-gate }
305*0Sstevel@tonic-gate
306*0Sstevel@tonic-gate static int
read_files(STACK_OF (X509)** t_in,X509 ** c_in,EVP_PKEY ** k_in)307*0Sstevel@tonic-gate read_files(STACK_OF(X509) **t_in, X509 **c_in, EVP_PKEY **k_in)
308*0Sstevel@tonic-gate {
309*0Sstevel@tonic-gate char *i_pass;
310*0Sstevel@tonic-gate
311*0Sstevel@tonic-gate i_pass = getpassphrase(gettext("Enter key password: "));
312*0Sstevel@tonic-gate
313*0Sstevel@tonic-gate if (get_ifile(input, i_pass, k_in, c_in, t_in) < 0)
314*0Sstevel@tonic-gate return (-1);
315*0Sstevel@tonic-gate
316*0Sstevel@tonic-gate /*
317*0Sstevel@tonic-gate * If we are only interested in getting a trust anchor, and if there
318*0Sstevel@tonic-gate * is no trust anchor but is a regular cert, use it instead. Do this
319*0Sstevel@tonic-gate * to handle the insanity with openssl, which requires a matching cert
320*0Sstevel@tonic-gate * and key in order to write a PKCS12 file.
321*0Sstevel@tonic-gate */
322*0Sstevel@tonic-gate if (outfiles == IO_TRUSTFILE) {
323*0Sstevel@tonic-gate if (c_in != NULL && *c_in != NULL && t_in != NULL) {
324*0Sstevel@tonic-gate if (*t_in == NULL) {
325*0Sstevel@tonic-gate if ((*t_in = sk_X509_new_null()) == NULL) {
326*0Sstevel@tonic-gate wbku_printerr("out of memory\n");
327*0Sstevel@tonic-gate return (-1);
328*0Sstevel@tonic-gate }
329*0Sstevel@tonic-gate }
330*0Sstevel@tonic-gate
331*0Sstevel@tonic-gate if (sk_X509_num(*t_in) == 0) {
332*0Sstevel@tonic-gate if (sk_X509_push(*t_in, *c_in) == 0) {
333*0Sstevel@tonic-gate wbku_printerr("out of memory\n");
334*0Sstevel@tonic-gate return (-1);
335*0Sstevel@tonic-gate }
336*0Sstevel@tonic-gate *c_in = NULL;
337*0Sstevel@tonic-gate }
338*0Sstevel@tonic-gate }
339*0Sstevel@tonic-gate }
340*0Sstevel@tonic-gate
341*0Sstevel@tonic-gate if ((outfiles & IO_KEYFILE) && *k_in == NULL) {
342*0Sstevel@tonic-gate wbku_printerr("no matching key found\n");
343*0Sstevel@tonic-gate return (-1);
344*0Sstevel@tonic-gate }
345*0Sstevel@tonic-gate if ((outfiles & IO_CERTFILE) && *c_in == NULL) {
346*0Sstevel@tonic-gate wbku_printerr("no matching certificate found\n");
347*0Sstevel@tonic-gate return (-1);
348*0Sstevel@tonic-gate }
349*0Sstevel@tonic-gate if ((outfiles & IO_TRUSTFILE) && *t_in == NULL) {
350*0Sstevel@tonic-gate wbku_printerr("no matching trust anchor found\n");
351*0Sstevel@tonic-gate return (-1);
352*0Sstevel@tonic-gate }
353*0Sstevel@tonic-gate
354*0Sstevel@tonic-gate return (0);
355*0Sstevel@tonic-gate }
356*0Sstevel@tonic-gate
357*0Sstevel@tonic-gate static void
check_certs(STACK_OF (X509)* ta_in,X509 ** c_in)358*0Sstevel@tonic-gate check_certs(STACK_OF(X509) *ta_in, X509 **c_in)
359*0Sstevel@tonic-gate {
360*0Sstevel@tonic-gate X509 *curr;
361*0Sstevel@tonic-gate time_errs_t ret;
362*0Sstevel@tonic-gate int i;
363*0Sstevel@tonic-gate int del_expired = (outfiles != 0);
364*0Sstevel@tonic-gate
365*0Sstevel@tonic-gate if (c_in != NULL && *c_in != NULL) {
366*0Sstevel@tonic-gate ret = time_check_print(*c_in);
367*0Sstevel@tonic-gate if ((ret != CHK_TIME_OK && ret != CHK_TIME_IS_BEFORE) &&
368*0Sstevel@tonic-gate del_expired) {
369*0Sstevel@tonic-gate (void) fprintf(stderr, gettext(" Removing cert\n"));
370*0Sstevel@tonic-gate X509_free(*c_in);
371*0Sstevel@tonic-gate *c_in = NULL;
372*0Sstevel@tonic-gate }
373*0Sstevel@tonic-gate }
374*0Sstevel@tonic-gate
375*0Sstevel@tonic-gate if (ta_in == NULL)
376*0Sstevel@tonic-gate return;
377*0Sstevel@tonic-gate
378*0Sstevel@tonic-gate for (i = 0; i < sk_X509_num(ta_in); ) {
379*0Sstevel@tonic-gate /* LINTED */
380*0Sstevel@tonic-gate curr = sk_X509_value(ta_in, i);
381*0Sstevel@tonic-gate ret = time_check_print(curr);
382*0Sstevel@tonic-gate if ((ret != CHK_TIME_OK && ret != CHK_TIME_IS_BEFORE) &&
383*0Sstevel@tonic-gate del_expired) {
384*0Sstevel@tonic-gate (void) fprintf(stderr, gettext(" Removing cert\n"));
385*0Sstevel@tonic-gate /* LINTED */
386*0Sstevel@tonic-gate curr = sk_X509_delete(ta_in, i);
387*0Sstevel@tonic-gate X509_free(curr);
388*0Sstevel@tonic-gate continue;
389*0Sstevel@tonic-gate }
390*0Sstevel@tonic-gate i++;
391*0Sstevel@tonic-gate }
392*0Sstevel@tonic-gate }
393*0Sstevel@tonic-gate
394*0Sstevel@tonic-gate static time_errs_t
time_check_print(X509 * cert)395*0Sstevel@tonic-gate time_check_print(X509 *cert)
396*0Sstevel@tonic-gate {
397*0Sstevel@tonic-gate char buf[256];
398*0Sstevel@tonic-gate int ret;
399*0Sstevel@tonic-gate
400*0Sstevel@tonic-gate ret = time_check(cert);
401*0Sstevel@tonic-gate if (ret == CHK_TIME_OK)
402*0Sstevel@tonic-gate return (CHK_TIME_OK);
403*0Sstevel@tonic-gate
404*0Sstevel@tonic-gate (void) fprintf(stderr, gettext(" Subject: %s"),
405*0Sstevel@tonic-gate sunw_subject_attrs(cert, buf, sizeof (buf)));
406*0Sstevel@tonic-gate (void) fprintf(stderr, gettext(" Issuer: %s"),
407*0Sstevel@tonic-gate sunw_issuer_attrs(cert, buf, sizeof (buf)));
408*0Sstevel@tonic-gate
409*0Sstevel@tonic-gate switch (ret) {
410*0Sstevel@tonic-gate case CHK_TIME_BEFORE_BAD:
411*0Sstevel@tonic-gate (void) fprintf(stderr,
412*0Sstevel@tonic-gate gettext("\n Invalid cert 'not before' field\n"));
413*0Sstevel@tonic-gate break;
414*0Sstevel@tonic-gate
415*0Sstevel@tonic-gate case CHK_TIME_AFTER_BAD:
416*0Sstevel@tonic-gate (void) fprintf(stderr,
417*0Sstevel@tonic-gate gettext("\n Invalid cert 'not after' field\n"));
418*0Sstevel@tonic-gate break;
419*0Sstevel@tonic-gate
420*0Sstevel@tonic-gate case CHK_TIME_HAS_EXPIRED:
421*0Sstevel@tonic-gate (void) sunw_print_times(stderr, PRNT_NOT_AFTER,
422*0Sstevel@tonic-gate gettext("\n Cert has expired\n"), cert);
423*0Sstevel@tonic-gate break;
424*0Sstevel@tonic-gate
425*0Sstevel@tonic-gate case CHK_TIME_IS_BEFORE:
426*0Sstevel@tonic-gate (void) sunw_print_times(stderr, PRNT_NOT_BEFORE,
427*0Sstevel@tonic-gate gettext("\n Warning: cert not yet valid\n"), cert);
428*0Sstevel@tonic-gate break;
429*0Sstevel@tonic-gate
430*0Sstevel@tonic-gate default:
431*0Sstevel@tonic-gate break;
432*0Sstevel@tonic-gate }
433*0Sstevel@tonic-gate
434*0Sstevel@tonic-gate return (ret);
435*0Sstevel@tonic-gate }
436*0Sstevel@tonic-gate
437*0Sstevel@tonic-gate static time_errs_t
time_check(X509 * cert)438*0Sstevel@tonic-gate time_check(X509 *cert)
439*0Sstevel@tonic-gate {
440*0Sstevel@tonic-gate int i;
441*0Sstevel@tonic-gate
442*0Sstevel@tonic-gate i = X509_cmp_time(X509_get_notBefore(cert), NULL);
443*0Sstevel@tonic-gate if (i == 0)
444*0Sstevel@tonic-gate return (CHK_TIME_BEFORE_BAD);
445*0Sstevel@tonic-gate if (i > 0)
446*0Sstevel@tonic-gate return (CHK_TIME_IS_BEFORE);
447*0Sstevel@tonic-gate /* After 'not before' time */
448*0Sstevel@tonic-gate
449*0Sstevel@tonic-gate i = X509_cmp_time(X509_get_notAfter(cert), NULL);
450*0Sstevel@tonic-gate if (i == 0)
451*0Sstevel@tonic-gate return (CHK_TIME_AFTER_BAD);
452*0Sstevel@tonic-gate if (i < 0)
453*0Sstevel@tonic-gate return (CHK_TIME_HAS_EXPIRED);
454*0Sstevel@tonic-gate return (CHK_TIME_OK);
455*0Sstevel@tonic-gate }
456*0Sstevel@tonic-gate
457*0Sstevel@tonic-gate static int
write_files(STACK_OF (X509)* t_out,X509 * c_out,EVP_PKEY * k_out)458*0Sstevel@tonic-gate write_files(STACK_OF(X509) *t_out, X509 *c_out, EVP_PKEY *k_out)
459*0Sstevel@tonic-gate {
460*0Sstevel@tonic-gate if (key_out != NULL) {
461*0Sstevel@tonic-gate if (verbose)
462*0Sstevel@tonic-gate (void) printf(gettext("%s: writing key\n"), progname);
463*0Sstevel@tonic-gate if (do_ofile(key_out, k_out, NULL, NULL) < 0)
464*0Sstevel@tonic-gate return (-1);
465*0Sstevel@tonic-gate }
466*0Sstevel@tonic-gate
467*0Sstevel@tonic-gate if (cert_out != NULL) {
468*0Sstevel@tonic-gate if (verbose)
469*0Sstevel@tonic-gate (void) printf(gettext("%s: writing cert\n"), progname);
470*0Sstevel@tonic-gate if (do_ofile(cert_out, NULL, c_out, NULL) < 0)
471*0Sstevel@tonic-gate return (-1);
472*0Sstevel@tonic-gate }
473*0Sstevel@tonic-gate
474*0Sstevel@tonic-gate if (trust_out != NULL) {
475*0Sstevel@tonic-gate if (verbose)
476*0Sstevel@tonic-gate (void) printf(gettext("%s: writing trust\n"),
477*0Sstevel@tonic-gate progname);
478*0Sstevel@tonic-gate if (do_ofile(trust_out, NULL, NULL, t_out) < 0)
479*0Sstevel@tonic-gate return (-1);
480*0Sstevel@tonic-gate }
481*0Sstevel@tonic-gate
482*0Sstevel@tonic-gate return (0);
483*0Sstevel@tonic-gate }
484*0Sstevel@tonic-gate
485*0Sstevel@tonic-gate static int
get_ifile(char * name,char * pass,EVP_PKEY ** tmp_k,X509 ** tmp_c,STACK_OF (X509)** tmp_t)486*0Sstevel@tonic-gate get_ifile(char *name, char *pass, EVP_PKEY **tmp_k, X509 **tmp_c,
487*0Sstevel@tonic-gate STACK_OF(X509) **tmp_t)
488*0Sstevel@tonic-gate {
489*0Sstevel@tonic-gate PKCS12 *p12;
490*0Sstevel@tonic-gate FILE *fp;
491*0Sstevel@tonic-gate int ret;
492*0Sstevel@tonic-gate struct stat sbuf;
493*0Sstevel@tonic-gate
494*0Sstevel@tonic-gate if (stat(name, &sbuf) == 0 && !S_ISREG(sbuf.st_mode)) {
495*0Sstevel@tonic-gate wbku_printerr("%s is not a regular file\n", name);
496*0Sstevel@tonic-gate return (-1);
497*0Sstevel@tonic-gate }
498*0Sstevel@tonic-gate
499*0Sstevel@tonic-gate if ((fp = fopen(name, "r")) == NULL) {
500*0Sstevel@tonic-gate wbku_printerr("cannot open input file %s", name);
501*0Sstevel@tonic-gate return (-1);
502*0Sstevel@tonic-gate }
503*0Sstevel@tonic-gate
504*0Sstevel@tonic-gate p12 = d2i_PKCS12_fp(fp, NULL);
505*0Sstevel@tonic-gate if (p12 == NULL) {
506*0Sstevel@tonic-gate wbku_printerr("cannot read file %s: %s\n", name, cryptoerr());
507*0Sstevel@tonic-gate (void) fclose(fp);
508*0Sstevel@tonic-gate return (-1);
509*0Sstevel@tonic-gate }
510*0Sstevel@tonic-gate (void) fclose(fp);
511*0Sstevel@tonic-gate
512*0Sstevel@tonic-gate ret = sunw_PKCS12_parse(p12, pass, matchty, k_matchval, k_len,
513*0Sstevel@tonic-gate NULL, tmp_k, tmp_c, tmp_t);
514*0Sstevel@tonic-gate if (ret <= 0) {
515*0Sstevel@tonic-gate if (ret == 0)
516*0Sstevel@tonic-gate wbku_printerr("cannot find matching cert and key\n");
517*0Sstevel@tonic-gate else
518*0Sstevel@tonic-gate wbku_printerr("cannot parse %s: %s\n", name,
519*0Sstevel@tonic-gate cryptoerr());
520*0Sstevel@tonic-gate PKCS12_free(p12);
521*0Sstevel@tonic-gate return (-1);
522*0Sstevel@tonic-gate }
523*0Sstevel@tonic-gate return (0);
524*0Sstevel@tonic-gate }
525*0Sstevel@tonic-gate
526*0Sstevel@tonic-gate static int
do_ofile(char * name,EVP_PKEY * pkey,X509 * cert,STACK_OF (X509)* ta)527*0Sstevel@tonic-gate do_ofile(char *name, EVP_PKEY *pkey, X509 *cert, STACK_OF(X509) *ta)
528*0Sstevel@tonic-gate {
529*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *klist = NULL;
530*0Sstevel@tonic-gate STACK_OF(X509) *clist = NULL;
531*0Sstevel@tonic-gate PKCS12 *p12 = NULL;
532*0Sstevel@tonic-gate int ret = 0;
533*0Sstevel@tonic-gate FILE *fp;
534*0Sstevel@tonic-gate struct stat sbuf;
535*0Sstevel@tonic-gate
536*0Sstevel@tonic-gate if (stat(name, &sbuf) == 0 && !S_ISREG(sbuf.st_mode)) {
537*0Sstevel@tonic-gate wbku_printerr("%s is not a regular file\n", name);
538*0Sstevel@tonic-gate return (-1);
539*0Sstevel@tonic-gate }
540*0Sstevel@tonic-gate
541*0Sstevel@tonic-gate if ((fp = fopen(name, "w")) == NULL) {
542*0Sstevel@tonic-gate wbku_printerr("cannot open output file %s", name);
543*0Sstevel@tonic-gate return (-1);
544*0Sstevel@tonic-gate }
545*0Sstevel@tonic-gate
546*0Sstevel@tonic-gate if ((clist = sk_X509_new_null()) == NULL ||
547*0Sstevel@tonic-gate (klist = sk_EVP_PKEY_new_null()) == NULL) {
548*0Sstevel@tonic-gate wbku_printerr("out of memory\n");
549*0Sstevel@tonic-gate ret = -1;
550*0Sstevel@tonic-gate goto cleanup;
551*0Sstevel@tonic-gate }
552*0Sstevel@tonic-gate
553*0Sstevel@tonic-gate if (cert != NULL && sk_X509_push(clist, cert) == 0) {
554*0Sstevel@tonic-gate wbku_printerr("out of memory\n");
555*0Sstevel@tonic-gate ret = -1;
556*0Sstevel@tonic-gate goto cleanup;
557*0Sstevel@tonic-gate }
558*0Sstevel@tonic-gate
559*0Sstevel@tonic-gate if (pkey != NULL && sk_EVP_PKEY_push(klist, pkey) == 0) {
560*0Sstevel@tonic-gate wbku_printerr("out of memory\n");
561*0Sstevel@tonic-gate ret = -1;
562*0Sstevel@tonic-gate goto cleanup;
563*0Sstevel@tonic-gate }
564*0Sstevel@tonic-gate
565*0Sstevel@tonic-gate p12 = sunw_PKCS12_create(WANBOOT_PASSPHRASE, klist, clist, ta);
566*0Sstevel@tonic-gate if (p12 == NULL) {
567*0Sstevel@tonic-gate wbku_printerr("cannot create %s: %s\n", name, cryptoerr());
568*0Sstevel@tonic-gate ret = -1;
569*0Sstevel@tonic-gate goto cleanup;
570*0Sstevel@tonic-gate }
571*0Sstevel@tonic-gate
572*0Sstevel@tonic-gate if (i2d_PKCS12_fp(fp, p12) == 0) {
573*0Sstevel@tonic-gate wbku_printerr("cannot write %s: %s\n", name, cryptoerr());
574*0Sstevel@tonic-gate ret = -1;
575*0Sstevel@tonic-gate goto cleanup;
576*0Sstevel@tonic-gate }
577*0Sstevel@tonic-gate
578*0Sstevel@tonic-gate cleanup:
579*0Sstevel@tonic-gate (void) fclose(fp);
580*0Sstevel@tonic-gate if (p12 != NULL)
581*0Sstevel@tonic-gate PKCS12_free(p12);
582*0Sstevel@tonic-gate /*
583*0Sstevel@tonic-gate * Put the cert and pkey off of the stack so that they won't
584*0Sstevel@tonic-gate * be freed two times. (If they get left in the stack then
585*0Sstevel@tonic-gate * they will be freed with the stack.)
586*0Sstevel@tonic-gate */
587*0Sstevel@tonic-gate if (clist != NULL) {
588*0Sstevel@tonic-gate if (cert != NULL && sk_X509_num(clist) == 1) {
589*0Sstevel@tonic-gate /* LINTED */
590*0Sstevel@tonic-gate (void) sk_X509_delete(clist, 0);
591*0Sstevel@tonic-gate }
592*0Sstevel@tonic-gate sk_X509_pop_free(clist, X509_free);
593*0Sstevel@tonic-gate }
594*0Sstevel@tonic-gate if (klist != NULL) {
595*0Sstevel@tonic-gate if (pkey != NULL && sk_EVP_PKEY_num(klist) == 1) {
596*0Sstevel@tonic-gate /* LINTED */
597*0Sstevel@tonic-gate (void) sk_EVP_PKEY_delete(klist, 0);
598*0Sstevel@tonic-gate }
599*0Sstevel@tonic-gate sk_EVP_PKEY_pop_free(klist, sunw_evp_pkey_free);
600*0Sstevel@tonic-gate }
601*0Sstevel@tonic-gate
602*0Sstevel@tonic-gate return (ret);
603*0Sstevel@tonic-gate }
604*0Sstevel@tonic-gate
605*0Sstevel@tonic-gate static void
usage(void)606*0Sstevel@tonic-gate usage(void)
607*0Sstevel@tonic-gate {
608*0Sstevel@tonic-gate (void) fprintf(stderr,
609*0Sstevel@tonic-gate gettext("usage:\n"
610*0Sstevel@tonic-gate " %s -i <file> -c <file> -k <file> -t <file> [-l <keyid> -v]\n"
611*0Sstevel@tonic-gate "\n"),
612*0Sstevel@tonic-gate progname);
613*0Sstevel@tonic-gate (void) fprintf(stderr,
614*0Sstevel@tonic-gate gettext(" where:\n"
615*0Sstevel@tonic-gate " -i - input file to be split into component parts and put in\n"
616*0Sstevel@tonic-gate " files given by -c, -k and -t\n"
617*0Sstevel@tonic-gate " -c - output file for the client certificate\n"
618*0Sstevel@tonic-gate " -k - output file for the client private key\n"
619*0Sstevel@tonic-gate " -t - output file for the remaining certificates (assumed\n"
620*0Sstevel@tonic-gate " to be trust anchors)\n"
621*0Sstevel@tonic-gate "\n Files are assumed to be pkcs12-format files.\n\n"
622*0Sstevel@tonic-gate " -v - verbose\n"
623*0Sstevel@tonic-gate " -l - value of 'localkeyid' attribute in client cert and\n"
624*0Sstevel@tonic-gate " private key to be selected from the input file.\n\n"));
625*0Sstevel@tonic-gate exit(EXIT_FAILURE);
626*0Sstevel@tonic-gate }
627*0Sstevel@tonic-gate
628*0Sstevel@tonic-gate /*
629*0Sstevel@tonic-gate * Return a pointer to a static buffer that contains a listing of crypto
630*0Sstevel@tonic-gate * errors. We presume that the user doesn't want more than 8KB of error
631*0Sstevel@tonic-gate * messages :-)
632*0Sstevel@tonic-gate */
633*0Sstevel@tonic-gate static const char *
cryptoerr(void)634*0Sstevel@tonic-gate cryptoerr(void)
635*0Sstevel@tonic-gate {
636*0Sstevel@tonic-gate static char errbuf[8192];
637*0Sstevel@tonic-gate ulong_t err;
638*0Sstevel@tonic-gate const char *pfile;
639*0Sstevel@tonic-gate int line;
640*0Sstevel@tonic-gate unsigned int nerr = 0;
641*0Sstevel@tonic-gate
642*0Sstevel@tonic-gate errbuf[0] = '\0';
643*0Sstevel@tonic-gate while ((err = ERR_get_error_line(&pfile, &line)) != 0) {
644*0Sstevel@tonic-gate if (++nerr > 1)
645*0Sstevel@tonic-gate (void) strlcat(errbuf, "\n\t", sizeof (errbuf));
646*0Sstevel@tonic-gate
647*0Sstevel@tonic-gate if (err == (ulong_t)-1) {
648*0Sstevel@tonic-gate (void) strlcat(errbuf, strerror(errno),
649*0Sstevel@tonic-gate sizeof (errbuf));
650*0Sstevel@tonic-gate break;
651*0Sstevel@tonic-gate }
652*0Sstevel@tonic-gate (void) strlcat(errbuf, ERR_reason_error_string(err),
653*0Sstevel@tonic-gate sizeof (errbuf));
654*0Sstevel@tonic-gate }
655*0Sstevel@tonic-gate
656*0Sstevel@tonic-gate return (errbuf);
657*0Sstevel@tonic-gate }
658