1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2002-2003 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate #include <stdio.h> 30*0Sstevel@tonic-gate #include <libintl.h> 31*0Sstevel@tonic-gate #include <locale.h> 32*0Sstevel@tonic-gate #include <sys/types.h> 33*0Sstevel@tonic-gate #include <sys/stat.h> 34*0Sstevel@tonic-gate #include <sys/wanboot_impl.h> 35*0Sstevel@tonic-gate #include <unistd.h> 36*0Sstevel@tonic-gate #include <string.h> 37*0Sstevel@tonic-gate #include <libinetutil.h> 38*0Sstevel@tonic-gate #include <wanbootutil.h> 39*0Sstevel@tonic-gate 40*0Sstevel@tonic-gate #include <openssl/crypto.h> 41*0Sstevel@tonic-gate #include <openssl/buffer.h> 42*0Sstevel@tonic-gate #include <openssl/bio.h> 43*0Sstevel@tonic-gate #include <openssl/err.h> 44*0Sstevel@tonic-gate #include <openssl/x509.h> 45*0Sstevel@tonic-gate #include <openssl/x509v3.h> 46*0Sstevel@tonic-gate #include <openssl/pkcs12.h> 47*0Sstevel@tonic-gate #include <openssl/evp.h> 48*0Sstevel@tonic-gate #include <p12aux.h> 49*0Sstevel@tonic-gate 50*0Sstevel@tonic-gate static boolean_t verbose = B_FALSE; /* When nonzero, do in verbose mode */ 51*0Sstevel@tonic-gate 52*0Sstevel@tonic-gate /* The following match/cert values require PKCS12 */ 53*0Sstevel@tonic-gate static int matchty; /* Type of matching do to on input */ 54*0Sstevel@tonic-gate static char *k_matchval; /* localkeyid value to match */ 55*0Sstevel@tonic-gate static uint_t k_len; /* length of k_matchval */ 56*0Sstevel@tonic-gate 57*0Sstevel@tonic-gate #define IO_KEYFILE 1 /* Have a separate key file or data */ 58*0Sstevel@tonic-gate #define IO_CERTFILE 2 /* Have a separate cert file or data */ 59*0Sstevel@tonic-gate #define IO_TRUSTFILE 4 /* Have a separate trustanchor file */ 60*0Sstevel@tonic-gate 61*0Sstevel@tonic-gate static char *input = NULL; /* Consolidated input file */ 62*0Sstevel@tonic-gate static char *key_out = NULL; /* Key file to be output */ 63*0Sstevel@tonic-gate static char *cert_out = NULL; /* Cert file to be output */ 64*0Sstevel@tonic-gate static char *trust_out = NULL; /* Trust anchor file to be output */ 65*0Sstevel@tonic-gate static uint_t outfiles; /* What files are there for output */ 66*0Sstevel@tonic-gate static char *progname; 67*0Sstevel@tonic-gate 68*0Sstevel@tonic-gate /* Returns from time_check */ 69*0Sstevel@tonic-gate typedef enum { 70*0Sstevel@tonic-gate CHK_TIME_OK = 0, /* Cert in effect and not expired */ 71*0Sstevel@tonic-gate CHK_TIME_BEFORE_BAD, /* not_before field is invalid */ 72*0Sstevel@tonic-gate CHK_TIME_AFTER_BAD, /* not_after field is invalid */ 73*0Sstevel@tonic-gate CHK_TIME_IS_BEFORE, /* Cert not yet in force */ 74*0Sstevel@tonic-gate CHK_TIME_HAS_EXPIRED /* Cert has expired */ 75*0Sstevel@tonic-gate } time_errs_t; 76*0Sstevel@tonic-gate 77*0Sstevel@tonic-gate static int parse_keyid(const char *); 78*0Sstevel@tonic-gate static int do_certs(void); 79*0Sstevel@tonic-gate static int read_files(STACK_OF(X509) **, X509 **, EVP_PKEY **); 80*0Sstevel@tonic-gate static void check_certs(STACK_OF(X509) *, X509 **); 81*0Sstevel@tonic-gate static time_errs_t time_check_print(X509 *); 82*0Sstevel@tonic-gate static time_errs_t time_check(X509 *); 83*0Sstevel@tonic-gate static int write_files(STACK_OF(X509) *, X509 *, EVP_PKEY *); 84*0Sstevel@tonic-gate static int get_ifile(char *, char *, EVP_PKEY **, X509 **, STACK_OF(X509) **); 85*0Sstevel@tonic-gate static int do_ofile(char *, EVP_PKEY *, X509 *, STACK_OF(X509) *); 86*0Sstevel@tonic-gate static void usage(void); 87*0Sstevel@tonic-gate static const char *cryptoerr(void); 88*0Sstevel@tonic-gate 89*0Sstevel@tonic-gate int 90*0Sstevel@tonic-gate main(int argc, char **argv) 91*0Sstevel@tonic-gate { 92*0Sstevel@tonic-gate int i; 93*0Sstevel@tonic-gate 94*0Sstevel@tonic-gate /* 95*0Sstevel@tonic-gate * Do the necessary magic for localization support. 96*0Sstevel@tonic-gate */ 97*0Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 98*0Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) 99*0Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" 100*0Sstevel@tonic-gate #endif 101*0Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 102*0Sstevel@tonic-gate 103*0Sstevel@tonic-gate progname = strrchr(argv[0], '/'); 104*0Sstevel@tonic-gate if (progname != NULL) 105*0Sstevel@tonic-gate progname++; 106*0Sstevel@tonic-gate else 107*0Sstevel@tonic-gate progname = argv[0]; 108*0Sstevel@tonic-gate 109*0Sstevel@tonic-gate wbku_errinit(progname); 110*0Sstevel@tonic-gate 111*0Sstevel@tonic-gate matchty = DO_FIRST_PAIR; 112*0Sstevel@tonic-gate while ((i = getopt(argc, argv, "vc:i:k:l:t:")) != -1) { 113*0Sstevel@tonic-gate switch (i) { 114*0Sstevel@tonic-gate case 'v': 115*0Sstevel@tonic-gate verbose = B_TRUE; 116*0Sstevel@tonic-gate break; 117*0Sstevel@tonic-gate 118*0Sstevel@tonic-gate case 'l': 119*0Sstevel@tonic-gate if (parse_keyid(optarg) < 0) 120*0Sstevel@tonic-gate return (EXIT_FAILURE); 121*0Sstevel@tonic-gate matchty = DO_FIND_KEYID; 122*0Sstevel@tonic-gate break; 123*0Sstevel@tonic-gate 124*0Sstevel@tonic-gate case 'c': 125*0Sstevel@tonic-gate cert_out = optarg; 126*0Sstevel@tonic-gate outfiles |= IO_CERTFILE; 127*0Sstevel@tonic-gate break; 128*0Sstevel@tonic-gate 129*0Sstevel@tonic-gate case 'k': 130*0Sstevel@tonic-gate key_out = optarg; 131*0Sstevel@tonic-gate outfiles |= IO_KEYFILE; 132*0Sstevel@tonic-gate break; 133*0Sstevel@tonic-gate 134*0Sstevel@tonic-gate case 't': 135*0Sstevel@tonic-gate trust_out = optarg; 136*0Sstevel@tonic-gate outfiles |= IO_TRUSTFILE; 137*0Sstevel@tonic-gate break; 138*0Sstevel@tonic-gate 139*0Sstevel@tonic-gate case 'i': 140*0Sstevel@tonic-gate input = optarg; 141*0Sstevel@tonic-gate break; 142*0Sstevel@tonic-gate 143*0Sstevel@tonic-gate default: 144*0Sstevel@tonic-gate usage(); 145*0Sstevel@tonic-gate } 146*0Sstevel@tonic-gate } 147*0Sstevel@tonic-gate 148*0Sstevel@tonic-gate if (input == NULL) { 149*0Sstevel@tonic-gate wbku_printerr("no input file specified\n"); 150*0Sstevel@tonic-gate usage(); 151*0Sstevel@tonic-gate } 152*0Sstevel@tonic-gate 153*0Sstevel@tonic-gate /* 154*0Sstevel@tonic-gate * Need output files. 155*0Sstevel@tonic-gate */ 156*0Sstevel@tonic-gate if (outfiles == 0) { 157*0Sstevel@tonic-gate wbku_printerr("at least one output file must be specified\n"); 158*0Sstevel@tonic-gate usage(); 159*0Sstevel@tonic-gate } 160*0Sstevel@tonic-gate 161*0Sstevel@tonic-gate if (do_certs() < 0) 162*0Sstevel@tonic-gate return (EXIT_FAILURE); 163*0Sstevel@tonic-gate 164*0Sstevel@tonic-gate return (EXIT_SUCCESS); 165*0Sstevel@tonic-gate } 166*0Sstevel@tonic-gate 167*0Sstevel@tonic-gate static int 168*0Sstevel@tonic-gate parse_keyid(const char *keystr) 169*0Sstevel@tonic-gate { 170*0Sstevel@tonic-gate const char *rp; 171*0Sstevel@tonic-gate char *wp; 172*0Sstevel@tonic-gate char *nkeystr; 173*0Sstevel@tonic-gate uint_t nkeystrlen; 174*0Sstevel@tonic-gate 175*0Sstevel@tonic-gate /* 176*0Sstevel@tonic-gate * In the worst case, we'll need one additional character in our 177*0Sstevel@tonic-gate * output string -- e.g. "A\0" -> "0A\0" 178*0Sstevel@tonic-gate */ 179*0Sstevel@tonic-gate nkeystrlen = strlen(keystr) + 2; 180*0Sstevel@tonic-gate k_len = (nkeystrlen + 1) / 2; 181*0Sstevel@tonic-gate nkeystr = malloc(nkeystrlen); 182*0Sstevel@tonic-gate k_matchval = malloc(k_len); 183*0Sstevel@tonic-gate if (nkeystr == NULL || k_matchval == NULL) { 184*0Sstevel@tonic-gate free(nkeystr); 185*0Sstevel@tonic-gate free(k_matchval); 186*0Sstevel@tonic-gate wbku_printerr("cannot allocate keyid"); 187*0Sstevel@tonic-gate return (-1); 188*0Sstevel@tonic-gate } 189*0Sstevel@tonic-gate 190*0Sstevel@tonic-gate /* 191*0Sstevel@tonic-gate * For convenience, we allow the user to put spaces between each digit 192*0Sstevel@tonic-gate * when entering it on the command line. As a result, we need to 193*0Sstevel@tonic-gate * process it into a format that hexascii_to_octet() can handle. Note 194*0Sstevel@tonic-gate * that we're careful to map strings like "AA B CC D" to "AA0BCC0D". 195*0Sstevel@tonic-gate */ 196*0Sstevel@tonic-gate for (rp = keystr, wp = nkeystr; *rp != '\0'; rp++) { 197*0Sstevel@tonic-gate if (*rp == ' ') 198*0Sstevel@tonic-gate continue; 199*0Sstevel@tonic-gate 200*0Sstevel@tonic-gate if (rp[1] == ' ' || rp[1] == '\0') { 201*0Sstevel@tonic-gate *wp++ = '0'; /* one character sequence; prepend 0 */ 202*0Sstevel@tonic-gate *wp++ = *rp; 203*0Sstevel@tonic-gate } else { 204*0Sstevel@tonic-gate *wp++ = *rp++; 205*0Sstevel@tonic-gate *wp++ = *rp; 206*0Sstevel@tonic-gate } 207*0Sstevel@tonic-gate } 208*0Sstevel@tonic-gate *wp = '\0'; 209*0Sstevel@tonic-gate 210*0Sstevel@tonic-gate if (hexascii_to_octet(nkeystr, wp - nkeystr, k_matchval, &k_len) != 0) { 211*0Sstevel@tonic-gate free(nkeystr); 212*0Sstevel@tonic-gate free(k_matchval); 213*0Sstevel@tonic-gate wbku_printerr("invalid keyid `%s'\n", keystr); 214*0Sstevel@tonic-gate return (-1); 215*0Sstevel@tonic-gate } 216*0Sstevel@tonic-gate 217*0Sstevel@tonic-gate free(nkeystr); 218*0Sstevel@tonic-gate return (0); 219*0Sstevel@tonic-gate } 220*0Sstevel@tonic-gate 221*0Sstevel@tonic-gate static int 222*0Sstevel@tonic-gate do_certs(void) 223*0Sstevel@tonic-gate { 224*0Sstevel@tonic-gate char *bufp; 225*0Sstevel@tonic-gate STACK_OF(X509) *ta_in = NULL; 226*0Sstevel@tonic-gate EVP_PKEY *pkey_in = NULL; 227*0Sstevel@tonic-gate X509 *xcert_in = NULL; 228*0Sstevel@tonic-gate 229*0Sstevel@tonic-gate sunw_crypto_init(); 230*0Sstevel@tonic-gate 231*0Sstevel@tonic-gate if (read_files(&ta_in, &xcert_in, &pkey_in) < 0) 232*0Sstevel@tonic-gate return (-1); 233*0Sstevel@tonic-gate 234*0Sstevel@tonic-gate if (verbose) { 235*0Sstevel@tonic-gate if (xcert_in != NULL) { 236*0Sstevel@tonic-gate (void) printf(gettext("\nMain cert:\n")); 237*0Sstevel@tonic-gate 238*0Sstevel@tonic-gate /* 239*0Sstevel@tonic-gate * sunw_subject_attrs() returns a pointer to 240*0Sstevel@tonic-gate * memory allocated on our behalf. The same 241*0Sstevel@tonic-gate * behavior is exhibited by sunw_issuer_attrs(). 242*0Sstevel@tonic-gate */ 243*0Sstevel@tonic-gate bufp = sunw_subject_attrs(xcert_in, NULL, 0); 244*0Sstevel@tonic-gate if (bufp != NULL) { 245*0Sstevel@tonic-gate (void) printf(gettext(" Subject: %s\n"), 246*0Sstevel@tonic-gate bufp); 247*0Sstevel@tonic-gate OPENSSL_free(bufp); 248*0Sstevel@tonic-gate } 249*0Sstevel@tonic-gate 250*0Sstevel@tonic-gate bufp = sunw_issuer_attrs(xcert_in, NULL, 0); 251*0Sstevel@tonic-gate if (bufp != NULL) { 252*0Sstevel@tonic-gate (void) printf(gettext(" Issuer: %s\n"), bufp); 253*0Sstevel@tonic-gate OPENSSL_free(bufp); 254*0Sstevel@tonic-gate } 255*0Sstevel@tonic-gate 256*0Sstevel@tonic-gate (void) sunw_print_times(stdout, PRNT_BOTH, NULL, 257*0Sstevel@tonic-gate xcert_in); 258*0Sstevel@tonic-gate } 259*0Sstevel@tonic-gate 260*0Sstevel@tonic-gate if (ta_in != NULL) { 261*0Sstevel@tonic-gate X509 *x; 262*0Sstevel@tonic-gate int i; 263*0Sstevel@tonic-gate 264*0Sstevel@tonic-gate for (i = 0; i < sk_X509_num(ta_in); i++) { 265*0Sstevel@tonic-gate /* LINTED */ 266*0Sstevel@tonic-gate x = sk_X509_value(ta_in, i); 267*0Sstevel@tonic-gate (void) printf( 268*0Sstevel@tonic-gate gettext("\nTrust Anchor cert %d:\n"), i); 269*0Sstevel@tonic-gate 270*0Sstevel@tonic-gate /* 271*0Sstevel@tonic-gate * sunw_subject_attrs() returns a pointer to 272*0Sstevel@tonic-gate * memory allocated on our behalf. We get the 273*0Sstevel@tonic-gate * same behavior from sunw_issuer_attrs(). 274*0Sstevel@tonic-gate */ 275*0Sstevel@tonic-gate bufp = sunw_subject_attrs(x, NULL, 0); 276*0Sstevel@tonic-gate if (bufp != NULL) { 277*0Sstevel@tonic-gate (void) printf( 278*0Sstevel@tonic-gate gettext(" Subject: %s\n"), bufp); 279*0Sstevel@tonic-gate OPENSSL_free(bufp); 280*0Sstevel@tonic-gate } 281*0Sstevel@tonic-gate 282*0Sstevel@tonic-gate bufp = sunw_issuer_attrs(x, NULL, 0); 283*0Sstevel@tonic-gate if (bufp != NULL) { 284*0Sstevel@tonic-gate (void) printf( 285*0Sstevel@tonic-gate gettext(" Issuer: %s\n"), bufp); 286*0Sstevel@tonic-gate OPENSSL_free(bufp); 287*0Sstevel@tonic-gate } 288*0Sstevel@tonic-gate 289*0Sstevel@tonic-gate (void) sunw_print_times(stdout, PRNT_BOTH, 290*0Sstevel@tonic-gate NULL, x); 291*0Sstevel@tonic-gate } 292*0Sstevel@tonic-gate } 293*0Sstevel@tonic-gate } 294*0Sstevel@tonic-gate 295*0Sstevel@tonic-gate check_certs(ta_in, &xcert_in); 296*0Sstevel@tonic-gate if (xcert_in != NULL && pkey_in != NULL) { 297*0Sstevel@tonic-gate if (sunw_check_keys(xcert_in, pkey_in) == 0) { 298*0Sstevel@tonic-gate wbku_printerr("warning: key and certificate do " 299*0Sstevel@tonic-gate "not match\n"); 300*0Sstevel@tonic-gate } 301*0Sstevel@tonic-gate } 302*0Sstevel@tonic-gate 303*0Sstevel@tonic-gate return (write_files(ta_in, xcert_in, pkey_in)); 304*0Sstevel@tonic-gate } 305*0Sstevel@tonic-gate 306*0Sstevel@tonic-gate static int 307*0Sstevel@tonic-gate read_files(STACK_OF(X509) **t_in, X509 **c_in, EVP_PKEY **k_in) 308*0Sstevel@tonic-gate { 309*0Sstevel@tonic-gate char *i_pass; 310*0Sstevel@tonic-gate 311*0Sstevel@tonic-gate i_pass = getpassphrase(gettext("Enter key password: ")); 312*0Sstevel@tonic-gate 313*0Sstevel@tonic-gate if (get_ifile(input, i_pass, k_in, c_in, t_in) < 0) 314*0Sstevel@tonic-gate return (-1); 315*0Sstevel@tonic-gate 316*0Sstevel@tonic-gate /* 317*0Sstevel@tonic-gate * If we are only interested in getting a trust anchor, and if there 318*0Sstevel@tonic-gate * is no trust anchor but is a regular cert, use it instead. Do this 319*0Sstevel@tonic-gate * to handle the insanity with openssl, which requires a matching cert 320*0Sstevel@tonic-gate * and key in order to write a PKCS12 file. 321*0Sstevel@tonic-gate */ 322*0Sstevel@tonic-gate if (outfiles == IO_TRUSTFILE) { 323*0Sstevel@tonic-gate if (c_in != NULL && *c_in != NULL && t_in != NULL) { 324*0Sstevel@tonic-gate if (*t_in == NULL) { 325*0Sstevel@tonic-gate if ((*t_in = sk_X509_new_null()) == NULL) { 326*0Sstevel@tonic-gate wbku_printerr("out of memory\n"); 327*0Sstevel@tonic-gate return (-1); 328*0Sstevel@tonic-gate } 329*0Sstevel@tonic-gate } 330*0Sstevel@tonic-gate 331*0Sstevel@tonic-gate if (sk_X509_num(*t_in) == 0) { 332*0Sstevel@tonic-gate if (sk_X509_push(*t_in, *c_in) == 0) { 333*0Sstevel@tonic-gate wbku_printerr("out of memory\n"); 334*0Sstevel@tonic-gate return (-1); 335*0Sstevel@tonic-gate } 336*0Sstevel@tonic-gate *c_in = NULL; 337*0Sstevel@tonic-gate } 338*0Sstevel@tonic-gate } 339*0Sstevel@tonic-gate } 340*0Sstevel@tonic-gate 341*0Sstevel@tonic-gate if ((outfiles & IO_KEYFILE) && *k_in == NULL) { 342*0Sstevel@tonic-gate wbku_printerr("no matching key found\n"); 343*0Sstevel@tonic-gate return (-1); 344*0Sstevel@tonic-gate } 345*0Sstevel@tonic-gate if ((outfiles & IO_CERTFILE) && *c_in == NULL) { 346*0Sstevel@tonic-gate wbku_printerr("no matching certificate found\n"); 347*0Sstevel@tonic-gate return (-1); 348*0Sstevel@tonic-gate } 349*0Sstevel@tonic-gate if ((outfiles & IO_TRUSTFILE) && *t_in == NULL) { 350*0Sstevel@tonic-gate wbku_printerr("no matching trust anchor found\n"); 351*0Sstevel@tonic-gate return (-1); 352*0Sstevel@tonic-gate } 353*0Sstevel@tonic-gate 354*0Sstevel@tonic-gate return (0); 355*0Sstevel@tonic-gate } 356*0Sstevel@tonic-gate 357*0Sstevel@tonic-gate static void 358*0Sstevel@tonic-gate check_certs(STACK_OF(X509) *ta_in, X509 **c_in) 359*0Sstevel@tonic-gate { 360*0Sstevel@tonic-gate X509 *curr; 361*0Sstevel@tonic-gate time_errs_t ret; 362*0Sstevel@tonic-gate int i; 363*0Sstevel@tonic-gate int del_expired = (outfiles != 0); 364*0Sstevel@tonic-gate 365*0Sstevel@tonic-gate if (c_in != NULL && *c_in != NULL) { 366*0Sstevel@tonic-gate ret = time_check_print(*c_in); 367*0Sstevel@tonic-gate if ((ret != CHK_TIME_OK && ret != CHK_TIME_IS_BEFORE) && 368*0Sstevel@tonic-gate del_expired) { 369*0Sstevel@tonic-gate (void) fprintf(stderr, gettext(" Removing cert\n")); 370*0Sstevel@tonic-gate X509_free(*c_in); 371*0Sstevel@tonic-gate *c_in = NULL; 372*0Sstevel@tonic-gate } 373*0Sstevel@tonic-gate } 374*0Sstevel@tonic-gate 375*0Sstevel@tonic-gate if (ta_in == NULL) 376*0Sstevel@tonic-gate return; 377*0Sstevel@tonic-gate 378*0Sstevel@tonic-gate for (i = 0; i < sk_X509_num(ta_in); ) { 379*0Sstevel@tonic-gate /* LINTED */ 380*0Sstevel@tonic-gate curr = sk_X509_value(ta_in, i); 381*0Sstevel@tonic-gate ret = time_check_print(curr); 382*0Sstevel@tonic-gate if ((ret != CHK_TIME_OK && ret != CHK_TIME_IS_BEFORE) && 383*0Sstevel@tonic-gate del_expired) { 384*0Sstevel@tonic-gate (void) fprintf(stderr, gettext(" Removing cert\n")); 385*0Sstevel@tonic-gate /* LINTED */ 386*0Sstevel@tonic-gate curr = sk_X509_delete(ta_in, i); 387*0Sstevel@tonic-gate X509_free(curr); 388*0Sstevel@tonic-gate continue; 389*0Sstevel@tonic-gate } 390*0Sstevel@tonic-gate i++; 391*0Sstevel@tonic-gate } 392*0Sstevel@tonic-gate } 393*0Sstevel@tonic-gate 394*0Sstevel@tonic-gate static time_errs_t 395*0Sstevel@tonic-gate time_check_print(X509 *cert) 396*0Sstevel@tonic-gate { 397*0Sstevel@tonic-gate char buf[256]; 398*0Sstevel@tonic-gate int ret; 399*0Sstevel@tonic-gate 400*0Sstevel@tonic-gate ret = time_check(cert); 401*0Sstevel@tonic-gate if (ret == CHK_TIME_OK) 402*0Sstevel@tonic-gate return (CHK_TIME_OK); 403*0Sstevel@tonic-gate 404*0Sstevel@tonic-gate (void) fprintf(stderr, gettext(" Subject: %s"), 405*0Sstevel@tonic-gate sunw_subject_attrs(cert, buf, sizeof (buf))); 406*0Sstevel@tonic-gate (void) fprintf(stderr, gettext(" Issuer: %s"), 407*0Sstevel@tonic-gate sunw_issuer_attrs(cert, buf, sizeof (buf))); 408*0Sstevel@tonic-gate 409*0Sstevel@tonic-gate switch (ret) { 410*0Sstevel@tonic-gate case CHK_TIME_BEFORE_BAD: 411*0Sstevel@tonic-gate (void) fprintf(stderr, 412*0Sstevel@tonic-gate gettext("\n Invalid cert 'not before' field\n")); 413*0Sstevel@tonic-gate break; 414*0Sstevel@tonic-gate 415*0Sstevel@tonic-gate case CHK_TIME_AFTER_BAD: 416*0Sstevel@tonic-gate (void) fprintf(stderr, 417*0Sstevel@tonic-gate gettext("\n Invalid cert 'not after' field\n")); 418*0Sstevel@tonic-gate break; 419*0Sstevel@tonic-gate 420*0Sstevel@tonic-gate case CHK_TIME_HAS_EXPIRED: 421*0Sstevel@tonic-gate (void) sunw_print_times(stderr, PRNT_NOT_AFTER, 422*0Sstevel@tonic-gate gettext("\n Cert has expired\n"), cert); 423*0Sstevel@tonic-gate break; 424*0Sstevel@tonic-gate 425*0Sstevel@tonic-gate case CHK_TIME_IS_BEFORE: 426*0Sstevel@tonic-gate (void) sunw_print_times(stderr, PRNT_NOT_BEFORE, 427*0Sstevel@tonic-gate gettext("\n Warning: cert not yet valid\n"), cert); 428*0Sstevel@tonic-gate break; 429*0Sstevel@tonic-gate 430*0Sstevel@tonic-gate default: 431*0Sstevel@tonic-gate break; 432*0Sstevel@tonic-gate } 433*0Sstevel@tonic-gate 434*0Sstevel@tonic-gate return (ret); 435*0Sstevel@tonic-gate } 436*0Sstevel@tonic-gate 437*0Sstevel@tonic-gate static time_errs_t 438*0Sstevel@tonic-gate time_check(X509 *cert) 439*0Sstevel@tonic-gate { 440*0Sstevel@tonic-gate int i; 441*0Sstevel@tonic-gate 442*0Sstevel@tonic-gate i = X509_cmp_time(X509_get_notBefore(cert), NULL); 443*0Sstevel@tonic-gate if (i == 0) 444*0Sstevel@tonic-gate return (CHK_TIME_BEFORE_BAD); 445*0Sstevel@tonic-gate if (i > 0) 446*0Sstevel@tonic-gate return (CHK_TIME_IS_BEFORE); 447*0Sstevel@tonic-gate /* After 'not before' time */ 448*0Sstevel@tonic-gate 449*0Sstevel@tonic-gate i = X509_cmp_time(X509_get_notAfter(cert), NULL); 450*0Sstevel@tonic-gate if (i == 0) 451*0Sstevel@tonic-gate return (CHK_TIME_AFTER_BAD); 452*0Sstevel@tonic-gate if (i < 0) 453*0Sstevel@tonic-gate return (CHK_TIME_HAS_EXPIRED); 454*0Sstevel@tonic-gate return (CHK_TIME_OK); 455*0Sstevel@tonic-gate } 456*0Sstevel@tonic-gate 457*0Sstevel@tonic-gate static int 458*0Sstevel@tonic-gate write_files(STACK_OF(X509) *t_out, X509 *c_out, EVP_PKEY *k_out) 459*0Sstevel@tonic-gate { 460*0Sstevel@tonic-gate if (key_out != NULL) { 461*0Sstevel@tonic-gate if (verbose) 462*0Sstevel@tonic-gate (void) printf(gettext("%s: writing key\n"), progname); 463*0Sstevel@tonic-gate if (do_ofile(key_out, k_out, NULL, NULL) < 0) 464*0Sstevel@tonic-gate return (-1); 465*0Sstevel@tonic-gate } 466*0Sstevel@tonic-gate 467*0Sstevel@tonic-gate if (cert_out != NULL) { 468*0Sstevel@tonic-gate if (verbose) 469*0Sstevel@tonic-gate (void) printf(gettext("%s: writing cert\n"), progname); 470*0Sstevel@tonic-gate if (do_ofile(cert_out, NULL, c_out, NULL) < 0) 471*0Sstevel@tonic-gate return (-1); 472*0Sstevel@tonic-gate } 473*0Sstevel@tonic-gate 474*0Sstevel@tonic-gate if (trust_out != NULL) { 475*0Sstevel@tonic-gate if (verbose) 476*0Sstevel@tonic-gate (void) printf(gettext("%s: writing trust\n"), 477*0Sstevel@tonic-gate progname); 478*0Sstevel@tonic-gate if (do_ofile(trust_out, NULL, NULL, t_out) < 0) 479*0Sstevel@tonic-gate return (-1); 480*0Sstevel@tonic-gate } 481*0Sstevel@tonic-gate 482*0Sstevel@tonic-gate return (0); 483*0Sstevel@tonic-gate } 484*0Sstevel@tonic-gate 485*0Sstevel@tonic-gate static int 486*0Sstevel@tonic-gate get_ifile(char *name, char *pass, EVP_PKEY **tmp_k, X509 **tmp_c, 487*0Sstevel@tonic-gate STACK_OF(X509) **tmp_t) 488*0Sstevel@tonic-gate { 489*0Sstevel@tonic-gate PKCS12 *p12; 490*0Sstevel@tonic-gate FILE *fp; 491*0Sstevel@tonic-gate int ret; 492*0Sstevel@tonic-gate struct stat sbuf; 493*0Sstevel@tonic-gate 494*0Sstevel@tonic-gate if (stat(name, &sbuf) == 0 && !S_ISREG(sbuf.st_mode)) { 495*0Sstevel@tonic-gate wbku_printerr("%s is not a regular file\n", name); 496*0Sstevel@tonic-gate return (-1); 497*0Sstevel@tonic-gate } 498*0Sstevel@tonic-gate 499*0Sstevel@tonic-gate if ((fp = fopen(name, "r")) == NULL) { 500*0Sstevel@tonic-gate wbku_printerr("cannot open input file %s", name); 501*0Sstevel@tonic-gate return (-1); 502*0Sstevel@tonic-gate } 503*0Sstevel@tonic-gate 504*0Sstevel@tonic-gate p12 = d2i_PKCS12_fp(fp, NULL); 505*0Sstevel@tonic-gate if (p12 == NULL) { 506*0Sstevel@tonic-gate wbku_printerr("cannot read file %s: %s\n", name, cryptoerr()); 507*0Sstevel@tonic-gate (void) fclose(fp); 508*0Sstevel@tonic-gate return (-1); 509*0Sstevel@tonic-gate } 510*0Sstevel@tonic-gate (void) fclose(fp); 511*0Sstevel@tonic-gate 512*0Sstevel@tonic-gate ret = sunw_PKCS12_parse(p12, pass, matchty, k_matchval, k_len, 513*0Sstevel@tonic-gate NULL, tmp_k, tmp_c, tmp_t); 514*0Sstevel@tonic-gate if (ret <= 0) { 515*0Sstevel@tonic-gate if (ret == 0) 516*0Sstevel@tonic-gate wbku_printerr("cannot find matching cert and key\n"); 517*0Sstevel@tonic-gate else 518*0Sstevel@tonic-gate wbku_printerr("cannot parse %s: %s\n", name, 519*0Sstevel@tonic-gate cryptoerr()); 520*0Sstevel@tonic-gate PKCS12_free(p12); 521*0Sstevel@tonic-gate return (-1); 522*0Sstevel@tonic-gate } 523*0Sstevel@tonic-gate return (0); 524*0Sstevel@tonic-gate } 525*0Sstevel@tonic-gate 526*0Sstevel@tonic-gate static int 527*0Sstevel@tonic-gate do_ofile(char *name, EVP_PKEY *pkey, X509 *cert, STACK_OF(X509) *ta) 528*0Sstevel@tonic-gate { 529*0Sstevel@tonic-gate STACK_OF(EVP_PKEY) *klist = NULL; 530*0Sstevel@tonic-gate STACK_OF(X509) *clist = NULL; 531*0Sstevel@tonic-gate PKCS12 *p12 = NULL; 532*0Sstevel@tonic-gate int ret = 0; 533*0Sstevel@tonic-gate FILE *fp; 534*0Sstevel@tonic-gate struct stat sbuf; 535*0Sstevel@tonic-gate 536*0Sstevel@tonic-gate if (stat(name, &sbuf) == 0 && !S_ISREG(sbuf.st_mode)) { 537*0Sstevel@tonic-gate wbku_printerr("%s is not a regular file\n", name); 538*0Sstevel@tonic-gate return (-1); 539*0Sstevel@tonic-gate } 540*0Sstevel@tonic-gate 541*0Sstevel@tonic-gate if ((fp = fopen(name, "w")) == NULL) { 542*0Sstevel@tonic-gate wbku_printerr("cannot open output file %s", name); 543*0Sstevel@tonic-gate return (-1); 544*0Sstevel@tonic-gate } 545*0Sstevel@tonic-gate 546*0Sstevel@tonic-gate if ((clist = sk_X509_new_null()) == NULL || 547*0Sstevel@tonic-gate (klist = sk_EVP_PKEY_new_null()) == NULL) { 548*0Sstevel@tonic-gate wbku_printerr("out of memory\n"); 549*0Sstevel@tonic-gate ret = -1; 550*0Sstevel@tonic-gate goto cleanup; 551*0Sstevel@tonic-gate } 552*0Sstevel@tonic-gate 553*0Sstevel@tonic-gate if (cert != NULL && sk_X509_push(clist, cert) == 0) { 554*0Sstevel@tonic-gate wbku_printerr("out of memory\n"); 555*0Sstevel@tonic-gate ret = -1; 556*0Sstevel@tonic-gate goto cleanup; 557*0Sstevel@tonic-gate } 558*0Sstevel@tonic-gate 559*0Sstevel@tonic-gate if (pkey != NULL && sk_EVP_PKEY_push(klist, pkey) == 0) { 560*0Sstevel@tonic-gate wbku_printerr("out of memory\n"); 561*0Sstevel@tonic-gate ret = -1; 562*0Sstevel@tonic-gate goto cleanup; 563*0Sstevel@tonic-gate } 564*0Sstevel@tonic-gate 565*0Sstevel@tonic-gate p12 = sunw_PKCS12_create(WANBOOT_PASSPHRASE, klist, clist, ta); 566*0Sstevel@tonic-gate if (p12 == NULL) { 567*0Sstevel@tonic-gate wbku_printerr("cannot create %s: %s\n", name, cryptoerr()); 568*0Sstevel@tonic-gate ret = -1; 569*0Sstevel@tonic-gate goto cleanup; 570*0Sstevel@tonic-gate } 571*0Sstevel@tonic-gate 572*0Sstevel@tonic-gate if (i2d_PKCS12_fp(fp, p12) == 0) { 573*0Sstevel@tonic-gate wbku_printerr("cannot write %s: %s\n", name, cryptoerr()); 574*0Sstevel@tonic-gate ret = -1; 575*0Sstevel@tonic-gate goto cleanup; 576*0Sstevel@tonic-gate } 577*0Sstevel@tonic-gate 578*0Sstevel@tonic-gate cleanup: 579*0Sstevel@tonic-gate (void) fclose(fp); 580*0Sstevel@tonic-gate if (p12 != NULL) 581*0Sstevel@tonic-gate PKCS12_free(p12); 582*0Sstevel@tonic-gate /* 583*0Sstevel@tonic-gate * Put the cert and pkey off of the stack so that they won't 584*0Sstevel@tonic-gate * be freed two times. (If they get left in the stack then 585*0Sstevel@tonic-gate * they will be freed with the stack.) 586*0Sstevel@tonic-gate */ 587*0Sstevel@tonic-gate if (clist != NULL) { 588*0Sstevel@tonic-gate if (cert != NULL && sk_X509_num(clist) == 1) { 589*0Sstevel@tonic-gate /* LINTED */ 590*0Sstevel@tonic-gate (void) sk_X509_delete(clist, 0); 591*0Sstevel@tonic-gate } 592*0Sstevel@tonic-gate sk_X509_pop_free(clist, X509_free); 593*0Sstevel@tonic-gate } 594*0Sstevel@tonic-gate if (klist != NULL) { 595*0Sstevel@tonic-gate if (pkey != NULL && sk_EVP_PKEY_num(klist) == 1) { 596*0Sstevel@tonic-gate /* LINTED */ 597*0Sstevel@tonic-gate (void) sk_EVP_PKEY_delete(klist, 0); 598*0Sstevel@tonic-gate } 599*0Sstevel@tonic-gate sk_EVP_PKEY_pop_free(klist, sunw_evp_pkey_free); 600*0Sstevel@tonic-gate } 601*0Sstevel@tonic-gate 602*0Sstevel@tonic-gate return (ret); 603*0Sstevel@tonic-gate } 604*0Sstevel@tonic-gate 605*0Sstevel@tonic-gate static void 606*0Sstevel@tonic-gate usage(void) 607*0Sstevel@tonic-gate { 608*0Sstevel@tonic-gate (void) fprintf(stderr, 609*0Sstevel@tonic-gate gettext("usage:\n" 610*0Sstevel@tonic-gate " %s -i <file> -c <file> -k <file> -t <file> [-l <keyid> -v]\n" 611*0Sstevel@tonic-gate "\n"), 612*0Sstevel@tonic-gate progname); 613*0Sstevel@tonic-gate (void) fprintf(stderr, 614*0Sstevel@tonic-gate gettext(" where:\n" 615*0Sstevel@tonic-gate " -i - input file to be split into component parts and put in\n" 616*0Sstevel@tonic-gate " files given by -c, -k and -t\n" 617*0Sstevel@tonic-gate " -c - output file for the client certificate\n" 618*0Sstevel@tonic-gate " -k - output file for the client private key\n" 619*0Sstevel@tonic-gate " -t - output file for the remaining certificates (assumed\n" 620*0Sstevel@tonic-gate " to be trust anchors)\n" 621*0Sstevel@tonic-gate "\n Files are assumed to be pkcs12-format files.\n\n" 622*0Sstevel@tonic-gate " -v - verbose\n" 623*0Sstevel@tonic-gate " -l - value of 'localkeyid' attribute in client cert and\n" 624*0Sstevel@tonic-gate " private key to be selected from the input file.\n\n")); 625*0Sstevel@tonic-gate exit(EXIT_FAILURE); 626*0Sstevel@tonic-gate } 627*0Sstevel@tonic-gate 628*0Sstevel@tonic-gate /* 629*0Sstevel@tonic-gate * Return a pointer to a static buffer that contains a listing of crypto 630*0Sstevel@tonic-gate * errors. We presume that the user doesn't want more than 8KB of error 631*0Sstevel@tonic-gate * messages :-) 632*0Sstevel@tonic-gate */ 633*0Sstevel@tonic-gate static const char * 634*0Sstevel@tonic-gate cryptoerr(void) 635*0Sstevel@tonic-gate { 636*0Sstevel@tonic-gate static char errbuf[8192]; 637*0Sstevel@tonic-gate ulong_t err; 638*0Sstevel@tonic-gate const char *pfile; 639*0Sstevel@tonic-gate int line; 640*0Sstevel@tonic-gate unsigned int nerr = 0; 641*0Sstevel@tonic-gate 642*0Sstevel@tonic-gate errbuf[0] = '\0'; 643*0Sstevel@tonic-gate while ((err = ERR_get_error_line(&pfile, &line)) != 0) { 644*0Sstevel@tonic-gate if (++nerr > 1) 645*0Sstevel@tonic-gate (void) strlcat(errbuf, "\n\t", sizeof (errbuf)); 646*0Sstevel@tonic-gate 647*0Sstevel@tonic-gate if (err == (ulong_t)-1) { 648*0Sstevel@tonic-gate (void) strlcat(errbuf, strerror(errno), 649*0Sstevel@tonic-gate sizeof (errbuf)); 650*0Sstevel@tonic-gate break; 651*0Sstevel@tonic-gate } 652*0Sstevel@tonic-gate (void) strlcat(errbuf, ERR_reason_error_string(err), 653*0Sstevel@tonic-gate sizeof (errbuf)); 654*0Sstevel@tonic-gate } 655*0Sstevel@tonic-gate 656*0Sstevel@tonic-gate return (errbuf); 657*0Sstevel@tonic-gate } 658