1*0Sstevel@tonic-gate /* apps/crl2p7.c */
2*0Sstevel@tonic-gate /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3*0Sstevel@tonic-gate * All rights reserved.
4*0Sstevel@tonic-gate *
5*0Sstevel@tonic-gate * This package is an SSL implementation written
6*0Sstevel@tonic-gate * by Eric Young (eay@cryptsoft.com).
7*0Sstevel@tonic-gate * The implementation was written so as to conform with Netscapes SSL.
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * This library is free for commercial and non-commercial use as long as
10*0Sstevel@tonic-gate * the following conditions are aheared to. The following conditions
11*0Sstevel@tonic-gate * apply to all code found in this distribution, be it the RC4, RSA,
12*0Sstevel@tonic-gate * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13*0Sstevel@tonic-gate * included with this distribution is covered by the same copyright terms
14*0Sstevel@tonic-gate * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15*0Sstevel@tonic-gate *
16*0Sstevel@tonic-gate * Copyright remains Eric Young's, and as such any Copyright notices in
17*0Sstevel@tonic-gate * the code are not to be removed.
18*0Sstevel@tonic-gate * If this package is used in a product, Eric Young should be given attribution
19*0Sstevel@tonic-gate * as the author of the parts of the library used.
20*0Sstevel@tonic-gate * This can be in the form of a textual message at program startup or
21*0Sstevel@tonic-gate * in documentation (online or textual) provided with the package.
22*0Sstevel@tonic-gate *
23*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
24*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions
25*0Sstevel@tonic-gate * are met:
26*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the copyright
27*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer.
28*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
29*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the
30*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution.
31*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software
32*0Sstevel@tonic-gate * must display the following acknowledgement:
33*0Sstevel@tonic-gate * "This product includes cryptographic software written by
34*0Sstevel@tonic-gate * Eric Young (eay@cryptsoft.com)"
35*0Sstevel@tonic-gate * The word 'cryptographic' can be left out if the rouines from the library
36*0Sstevel@tonic-gate * being used are not cryptographic related :-).
37*0Sstevel@tonic-gate * 4. If you include any Windows specific code (or a derivative thereof) from
38*0Sstevel@tonic-gate * the apps directory (application code) you must include an acknowledgement:
39*0Sstevel@tonic-gate * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40*0Sstevel@tonic-gate *
41*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42*0Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44*0Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45*0Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46*0Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47*0Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49*0Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50*0Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51*0Sstevel@tonic-gate * SUCH DAMAGE.
52*0Sstevel@tonic-gate *
53*0Sstevel@tonic-gate * The licence and distribution terms for any publically available version or
54*0Sstevel@tonic-gate * derivative of this code cannot be changed. i.e. this code cannot simply be
55*0Sstevel@tonic-gate * copied and put under another distribution licence
56*0Sstevel@tonic-gate * [including the GNU Public Licence.]
57*0Sstevel@tonic-gate */
58*0Sstevel@tonic-gate
59*0Sstevel@tonic-gate /* This was written by Gordon Chaffee <chaffee@plateau.cs.berkeley.edu>
60*0Sstevel@tonic-gate * and donated 'to the cause' along with lots and lots of other fixes to
61*0Sstevel@tonic-gate * the library. */
62*0Sstevel@tonic-gate
63*0Sstevel@tonic-gate #include <stdio.h>
64*0Sstevel@tonic-gate #include <string.h>
65*0Sstevel@tonic-gate #include <sys/types.h>
66*0Sstevel@tonic-gate #include <sys/stat.h>
67*0Sstevel@tonic-gate #include "apps.h"
68*0Sstevel@tonic-gate #include <openssl/err.h>
69*0Sstevel@tonic-gate #include <openssl/evp.h>
70*0Sstevel@tonic-gate #include <openssl/x509.h>
71*0Sstevel@tonic-gate #include <openssl/pkcs7.h>
72*0Sstevel@tonic-gate #include <openssl/pem.h>
73*0Sstevel@tonic-gate #include <openssl/objects.h>
74*0Sstevel@tonic-gate
75*0Sstevel@tonic-gate static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile);
76*0Sstevel@tonic-gate #undef PROG
77*0Sstevel@tonic-gate #define PROG crl2pkcs7_main
78*0Sstevel@tonic-gate
79*0Sstevel@tonic-gate /* -inform arg - input format - default PEM (DER or PEM)
80*0Sstevel@tonic-gate * -outform arg - output format - default PEM
81*0Sstevel@tonic-gate * -in arg - input file - default stdin
82*0Sstevel@tonic-gate * -out arg - output file - default stdout
83*0Sstevel@tonic-gate */
84*0Sstevel@tonic-gate
85*0Sstevel@tonic-gate int MAIN(int, char **);
86*0Sstevel@tonic-gate
MAIN(int argc,char ** argv)87*0Sstevel@tonic-gate int MAIN(int argc, char **argv)
88*0Sstevel@tonic-gate {
89*0Sstevel@tonic-gate int i,badops=0;
90*0Sstevel@tonic-gate BIO *in=NULL,*out=NULL;
91*0Sstevel@tonic-gate int informat,outformat;
92*0Sstevel@tonic-gate char *infile,*outfile,*prog,*certfile;
93*0Sstevel@tonic-gate PKCS7 *p7 = NULL;
94*0Sstevel@tonic-gate PKCS7_SIGNED *p7s = NULL;
95*0Sstevel@tonic-gate X509_CRL *crl=NULL;
96*0Sstevel@tonic-gate STACK *certflst=NULL;
97*0Sstevel@tonic-gate STACK_OF(X509_CRL) *crl_stack=NULL;
98*0Sstevel@tonic-gate STACK_OF(X509) *cert_stack=NULL;
99*0Sstevel@tonic-gate int ret=1,nocrl=0;
100*0Sstevel@tonic-gate
101*0Sstevel@tonic-gate apps_startup();
102*0Sstevel@tonic-gate
103*0Sstevel@tonic-gate if (bio_err == NULL)
104*0Sstevel@tonic-gate if ((bio_err=BIO_new(BIO_s_file())) != NULL)
105*0Sstevel@tonic-gate BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
106*0Sstevel@tonic-gate
107*0Sstevel@tonic-gate infile=NULL;
108*0Sstevel@tonic-gate outfile=NULL;
109*0Sstevel@tonic-gate informat=FORMAT_PEM;
110*0Sstevel@tonic-gate outformat=FORMAT_PEM;
111*0Sstevel@tonic-gate
112*0Sstevel@tonic-gate prog=argv[0];
113*0Sstevel@tonic-gate argc--;
114*0Sstevel@tonic-gate argv++;
115*0Sstevel@tonic-gate while (argc >= 1)
116*0Sstevel@tonic-gate {
117*0Sstevel@tonic-gate if (strcmp(*argv,"-inform") == 0)
118*0Sstevel@tonic-gate {
119*0Sstevel@tonic-gate if (--argc < 1) goto bad;
120*0Sstevel@tonic-gate informat=str2fmt(*(++argv));
121*0Sstevel@tonic-gate }
122*0Sstevel@tonic-gate else if (strcmp(*argv,"-outform") == 0)
123*0Sstevel@tonic-gate {
124*0Sstevel@tonic-gate if (--argc < 1) goto bad;
125*0Sstevel@tonic-gate outformat=str2fmt(*(++argv));
126*0Sstevel@tonic-gate }
127*0Sstevel@tonic-gate else if (strcmp(*argv,"-in") == 0)
128*0Sstevel@tonic-gate {
129*0Sstevel@tonic-gate if (--argc < 1) goto bad;
130*0Sstevel@tonic-gate infile= *(++argv);
131*0Sstevel@tonic-gate }
132*0Sstevel@tonic-gate else if (strcmp(*argv,"-nocrl") == 0)
133*0Sstevel@tonic-gate {
134*0Sstevel@tonic-gate nocrl=1;
135*0Sstevel@tonic-gate }
136*0Sstevel@tonic-gate else if (strcmp(*argv,"-out") == 0)
137*0Sstevel@tonic-gate {
138*0Sstevel@tonic-gate if (--argc < 1) goto bad;
139*0Sstevel@tonic-gate outfile= *(++argv);
140*0Sstevel@tonic-gate }
141*0Sstevel@tonic-gate else if (strcmp(*argv,"-certfile") == 0)
142*0Sstevel@tonic-gate {
143*0Sstevel@tonic-gate if (--argc < 1) goto bad;
144*0Sstevel@tonic-gate if(!certflst) certflst = sk_new_null();
145*0Sstevel@tonic-gate sk_push(certflst,*(++argv));
146*0Sstevel@tonic-gate }
147*0Sstevel@tonic-gate else
148*0Sstevel@tonic-gate {
149*0Sstevel@tonic-gate BIO_printf(bio_err,"unknown option %s\n",*argv);
150*0Sstevel@tonic-gate badops=1;
151*0Sstevel@tonic-gate break;
152*0Sstevel@tonic-gate }
153*0Sstevel@tonic-gate argc--;
154*0Sstevel@tonic-gate argv++;
155*0Sstevel@tonic-gate }
156*0Sstevel@tonic-gate
157*0Sstevel@tonic-gate if (badops)
158*0Sstevel@tonic-gate {
159*0Sstevel@tonic-gate bad:
160*0Sstevel@tonic-gate BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
161*0Sstevel@tonic-gate BIO_printf(bio_err,"where options are\n");
162*0Sstevel@tonic-gate BIO_printf(bio_err," -inform arg input format - DER or PEM\n");
163*0Sstevel@tonic-gate BIO_printf(bio_err," -outform arg output format - DER or PEM\n");
164*0Sstevel@tonic-gate BIO_printf(bio_err," -in arg input file\n");
165*0Sstevel@tonic-gate BIO_printf(bio_err," -out arg output file\n");
166*0Sstevel@tonic-gate BIO_printf(bio_err," -certfile arg certificates file of chain to a trusted CA\n");
167*0Sstevel@tonic-gate BIO_printf(bio_err," (can be used more than once)\n");
168*0Sstevel@tonic-gate BIO_printf(bio_err," -nocrl no crl to load, just certs from '-certfile'\n");
169*0Sstevel@tonic-gate ret = 1;
170*0Sstevel@tonic-gate goto end;
171*0Sstevel@tonic-gate }
172*0Sstevel@tonic-gate
173*0Sstevel@tonic-gate ERR_load_crypto_strings();
174*0Sstevel@tonic-gate
175*0Sstevel@tonic-gate in=BIO_new(BIO_s_file());
176*0Sstevel@tonic-gate out=BIO_new(BIO_s_file());
177*0Sstevel@tonic-gate if ((in == NULL) || (out == NULL))
178*0Sstevel@tonic-gate {
179*0Sstevel@tonic-gate ERR_print_errors(bio_err);
180*0Sstevel@tonic-gate goto end;
181*0Sstevel@tonic-gate }
182*0Sstevel@tonic-gate
183*0Sstevel@tonic-gate if (!nocrl)
184*0Sstevel@tonic-gate {
185*0Sstevel@tonic-gate if (infile == NULL)
186*0Sstevel@tonic-gate BIO_set_fp(in,stdin,BIO_NOCLOSE);
187*0Sstevel@tonic-gate else
188*0Sstevel@tonic-gate {
189*0Sstevel@tonic-gate if (BIO_read_filename(in,infile) <= 0)
190*0Sstevel@tonic-gate {
191*0Sstevel@tonic-gate perror(infile);
192*0Sstevel@tonic-gate goto end;
193*0Sstevel@tonic-gate }
194*0Sstevel@tonic-gate }
195*0Sstevel@tonic-gate
196*0Sstevel@tonic-gate if (informat == FORMAT_ASN1)
197*0Sstevel@tonic-gate crl=d2i_X509_CRL_bio(in,NULL);
198*0Sstevel@tonic-gate else if (informat == FORMAT_PEM)
199*0Sstevel@tonic-gate crl=PEM_read_bio_X509_CRL(in,NULL,NULL,NULL);
200*0Sstevel@tonic-gate else {
201*0Sstevel@tonic-gate BIO_printf(bio_err,"bad input format specified for input crl\n");
202*0Sstevel@tonic-gate goto end;
203*0Sstevel@tonic-gate }
204*0Sstevel@tonic-gate if (crl == NULL)
205*0Sstevel@tonic-gate {
206*0Sstevel@tonic-gate BIO_printf(bio_err,"unable to load CRL\n");
207*0Sstevel@tonic-gate ERR_print_errors(bio_err);
208*0Sstevel@tonic-gate goto end;
209*0Sstevel@tonic-gate }
210*0Sstevel@tonic-gate }
211*0Sstevel@tonic-gate
212*0Sstevel@tonic-gate if ((p7=PKCS7_new()) == NULL) goto end;
213*0Sstevel@tonic-gate if ((p7s=PKCS7_SIGNED_new()) == NULL) goto end;
214*0Sstevel@tonic-gate p7->type=OBJ_nid2obj(NID_pkcs7_signed);
215*0Sstevel@tonic-gate p7->d.sign=p7s;
216*0Sstevel@tonic-gate p7s->contents->type=OBJ_nid2obj(NID_pkcs7_data);
217*0Sstevel@tonic-gate
218*0Sstevel@tonic-gate if (!ASN1_INTEGER_set(p7s->version,1)) goto end;
219*0Sstevel@tonic-gate if ((crl_stack=sk_X509_CRL_new_null()) == NULL) goto end;
220*0Sstevel@tonic-gate p7s->crl=crl_stack;
221*0Sstevel@tonic-gate if (crl != NULL)
222*0Sstevel@tonic-gate {
223*0Sstevel@tonic-gate sk_X509_CRL_push(crl_stack,crl);
224*0Sstevel@tonic-gate crl=NULL; /* now part of p7 for OPENSSL_freeing */
225*0Sstevel@tonic-gate }
226*0Sstevel@tonic-gate
227*0Sstevel@tonic-gate if ((cert_stack=sk_X509_new_null()) == NULL) goto end;
228*0Sstevel@tonic-gate p7s->cert=cert_stack;
229*0Sstevel@tonic-gate
230*0Sstevel@tonic-gate if(certflst) for(i = 0; i < sk_num(certflst); i++) {
231*0Sstevel@tonic-gate certfile = sk_value(certflst, i);
232*0Sstevel@tonic-gate if (add_certs_from_file(cert_stack,certfile) < 0)
233*0Sstevel@tonic-gate {
234*0Sstevel@tonic-gate BIO_printf(bio_err, "error loading certificates\n");
235*0Sstevel@tonic-gate ERR_print_errors(bio_err);
236*0Sstevel@tonic-gate goto end;
237*0Sstevel@tonic-gate }
238*0Sstevel@tonic-gate }
239*0Sstevel@tonic-gate
240*0Sstevel@tonic-gate sk_free(certflst);
241*0Sstevel@tonic-gate
242*0Sstevel@tonic-gate if (outfile == NULL)
243*0Sstevel@tonic-gate {
244*0Sstevel@tonic-gate BIO_set_fp(out,stdout,BIO_NOCLOSE);
245*0Sstevel@tonic-gate #ifdef OPENSSL_SYS_VMS
246*0Sstevel@tonic-gate {
247*0Sstevel@tonic-gate BIO *tmpbio = BIO_new(BIO_f_linebuffer());
248*0Sstevel@tonic-gate out = BIO_push(tmpbio, out);
249*0Sstevel@tonic-gate }
250*0Sstevel@tonic-gate #endif
251*0Sstevel@tonic-gate }
252*0Sstevel@tonic-gate else
253*0Sstevel@tonic-gate {
254*0Sstevel@tonic-gate if (BIO_write_filename(out,outfile) <= 0)
255*0Sstevel@tonic-gate {
256*0Sstevel@tonic-gate perror(outfile);
257*0Sstevel@tonic-gate goto end;
258*0Sstevel@tonic-gate }
259*0Sstevel@tonic-gate }
260*0Sstevel@tonic-gate
261*0Sstevel@tonic-gate if (outformat == FORMAT_ASN1)
262*0Sstevel@tonic-gate i=i2d_PKCS7_bio(out,p7);
263*0Sstevel@tonic-gate else if (outformat == FORMAT_PEM)
264*0Sstevel@tonic-gate i=PEM_write_bio_PKCS7(out,p7);
265*0Sstevel@tonic-gate else {
266*0Sstevel@tonic-gate BIO_printf(bio_err,"bad output format specified for outfile\n");
267*0Sstevel@tonic-gate goto end;
268*0Sstevel@tonic-gate }
269*0Sstevel@tonic-gate if (!i)
270*0Sstevel@tonic-gate {
271*0Sstevel@tonic-gate BIO_printf(bio_err,"unable to write pkcs7 object\n");
272*0Sstevel@tonic-gate ERR_print_errors(bio_err);
273*0Sstevel@tonic-gate goto end;
274*0Sstevel@tonic-gate }
275*0Sstevel@tonic-gate ret=0;
276*0Sstevel@tonic-gate end:
277*0Sstevel@tonic-gate if (in != NULL) BIO_free(in);
278*0Sstevel@tonic-gate if (out != NULL) BIO_free_all(out);
279*0Sstevel@tonic-gate if (p7 != NULL) PKCS7_free(p7);
280*0Sstevel@tonic-gate if (crl != NULL) X509_CRL_free(crl);
281*0Sstevel@tonic-gate
282*0Sstevel@tonic-gate apps_shutdown();
283*0Sstevel@tonic-gate OPENSSL_EXIT(ret);
284*0Sstevel@tonic-gate }
285*0Sstevel@tonic-gate
286*0Sstevel@tonic-gate /*
287*0Sstevel@tonic-gate *----------------------------------------------------------------------
288*0Sstevel@tonic-gate * int add_certs_from_file
289*0Sstevel@tonic-gate *
290*0Sstevel@tonic-gate * Read a list of certificates to be checked from a file.
291*0Sstevel@tonic-gate *
292*0Sstevel@tonic-gate * Results:
293*0Sstevel@tonic-gate * number of certs added if successful, -1 if not.
294*0Sstevel@tonic-gate *----------------------------------------------------------------------
295*0Sstevel@tonic-gate */
add_certs_from_file(STACK_OF (X509)* stack,char * certfile)296*0Sstevel@tonic-gate static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile)
297*0Sstevel@tonic-gate {
298*0Sstevel@tonic-gate struct stat st;
299*0Sstevel@tonic-gate BIO *in=NULL;
300*0Sstevel@tonic-gate int count=0;
301*0Sstevel@tonic-gate int ret= -1;
302*0Sstevel@tonic-gate STACK_OF(X509_INFO) *sk=NULL;
303*0Sstevel@tonic-gate X509_INFO *xi;
304*0Sstevel@tonic-gate
305*0Sstevel@tonic-gate if ((stat(certfile,&st) != 0))
306*0Sstevel@tonic-gate {
307*0Sstevel@tonic-gate BIO_printf(bio_err,"unable to load the file, %s\n",certfile);
308*0Sstevel@tonic-gate goto end;
309*0Sstevel@tonic-gate }
310*0Sstevel@tonic-gate
311*0Sstevel@tonic-gate in=BIO_new(BIO_s_file());
312*0Sstevel@tonic-gate if ((in == NULL) || (BIO_read_filename(in,certfile) <= 0))
313*0Sstevel@tonic-gate {
314*0Sstevel@tonic-gate BIO_printf(bio_err,"error opening the file, %s\n",certfile);
315*0Sstevel@tonic-gate goto end;
316*0Sstevel@tonic-gate }
317*0Sstevel@tonic-gate
318*0Sstevel@tonic-gate /* This loads from a file, a stack of x509/crl/pkey sets */
319*0Sstevel@tonic-gate sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL);
320*0Sstevel@tonic-gate if (sk == NULL) {
321*0Sstevel@tonic-gate BIO_printf(bio_err,"error reading the file, %s\n",certfile);
322*0Sstevel@tonic-gate goto end;
323*0Sstevel@tonic-gate }
324*0Sstevel@tonic-gate
325*0Sstevel@tonic-gate /* scan over it and pull out the CRL's */
326*0Sstevel@tonic-gate while (sk_X509_INFO_num(sk))
327*0Sstevel@tonic-gate {
328*0Sstevel@tonic-gate xi=sk_X509_INFO_shift(sk);
329*0Sstevel@tonic-gate if (xi->x509 != NULL)
330*0Sstevel@tonic-gate {
331*0Sstevel@tonic-gate sk_X509_push(stack,xi->x509);
332*0Sstevel@tonic-gate xi->x509=NULL;
333*0Sstevel@tonic-gate count++;
334*0Sstevel@tonic-gate }
335*0Sstevel@tonic-gate X509_INFO_free(xi);
336*0Sstevel@tonic-gate }
337*0Sstevel@tonic-gate
338*0Sstevel@tonic-gate ret=count;
339*0Sstevel@tonic-gate end:
340*0Sstevel@tonic-gate /* never need to OPENSSL_free x */
341*0Sstevel@tonic-gate if (in != NULL) BIO_free(in);
342*0Sstevel@tonic-gate if (sk != NULL) sk_X509_INFO_free(sk);
343*0Sstevel@tonic-gate return(ret);
344*0Sstevel@tonic-gate }
345*0Sstevel@tonic-gate
346