1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/os/ossrv/ssl/tsrc/topenssl/src/crl.c Fri Jun 15 03:10:57 2012 +0200
1.3 @@ -0,0 +1,431 @@
1.4 +/* apps/crl.c */
1.5 +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
1.6 + * All rights reserved.
1.7 + *
1.8 + * This package is an SSL implementation written
1.9 + * by Eric Young (eay@cryptsoft.com).
1.10 + * The implementation was written so as to conform with Netscapes SSL.
1.11 + *
1.12 + * This library is free for commercial and non-commercial use as long as
1.13 + * the following conditions are aheared to. The following conditions
1.14 + * apply to all code found in this distribution, be it the RC4, RSA,
1.15 + * lhash, DES, etc., code; not just the SSL code. The SSL documentation
1.16 + * included with this distribution is covered by the same copyright terms
1.17 + * except that the holder is Tim Hudson (tjh@cryptsoft.com).
1.18 + *
1.19 + * Copyright remains Eric Young's, and as such any Copyright notices in
1.20 + * the code are not to be removed.
1.21 + * If this package is used in a product, Eric Young should be given attribution
1.22 + * as the author of the parts of the library used.
1.23 + * This can be in the form of a textual message at program startup or
1.24 + * in documentation (online or textual) provided with the package.
1.25 + *
1.26 + * Redistribution and use in source and binary forms, with or without
1.27 + * modification, are permitted provided that the following conditions
1.28 + * are met:
1.29 + * 1. Redistributions of source code must retain the copyright
1.30 + * notice, this list of conditions and the following disclaimer.
1.31 + * 2. Redistributions in binary form must reproduce the above copyright
1.32 + * notice, this list of conditions and the following disclaimer in the
1.33 + * documentation and/or other materials provided with the distribution.
1.34 + * 3. All advertising materials mentioning features or use of this software
1.35 + * must display the following acknowledgement:
1.36 + * "This product includes cryptographic software written by
1.37 + * Eric Young (eay@cryptsoft.com)"
1.38 + * The word 'cryptographic' can be left out if the rouines from the library
1.39 + * being used are not cryptographic related :-).
1.40 + * 4. If you include any Windows specific code (or a derivative thereof) from
1.41 + * the apps directory (application code) you must include an acknowledgement:
1.42 + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
1.43 + *
1.44 + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
1.45 + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
1.46 + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
1.47 + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
1.48 + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
1.49 + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
1.50 + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1.51 + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
1.52 + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
1.53 + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
1.54 + * SUCH DAMAGE.
1.55 + *
1.56 + * The licence and distribution terms for any publically available version or
1.57 + * derivative of this code cannot be changed. i.e. this code cannot simply be
1.58 + * copied and put under another distribution licence
1.59 + * [including the GNU Public Licence.]
1.60 + */
1.61 +
1.62 +#include <stdio.h>
1.63 +#include <stdlib.h>
1.64 +#include <string.h>
1.65 +#include "apps.h"
1.66 +#include <openssl/bio.h>
1.67 +#include <openssl/err.h>
1.68 +#include <openssl/x509.h>
1.69 +#include <openssl/x509v3.h>
1.70 +#include <openssl/pem.h>
1.71 +
1.72 +#undef PROG
1.73 +#define PROG crl_main
1.74 +
1.75 +#undef POSTFIX
1.76 +#define POSTFIX ".rvk"
1.77 +
1.78 +static const char *crl_usage[]={
1.79 +"usage: crl args\n",
1.80 +"\n",
1.81 +" -inform arg - input format - default PEM (DER or PEM)\n",
1.82 +" -outform arg - output format - default PEM\n",
1.83 +" -text - print out a text format version\n",
1.84 +" -in arg - input file - default stdin\n",
1.85 +" -out arg - output file - default stdout\n",
1.86 +" -hash - print hash value\n",
1.87 +" -fingerprint - print the crl fingerprint\n",
1.88 +" -issuer - print issuer DN\n",
1.89 +" -lastupdate - lastUpdate field\n",
1.90 +" -nextupdate - nextUpdate field\n",
1.91 +" -noout - no CRL output\n",
1.92 +" -CAfile name - verify CRL using certificates in file \"name\"\n",
1.93 +" -CApath dir - verify CRL using certificates in \"dir\"\n",
1.94 +" -nameopt arg - various certificate name options\n",
1.95 +NULL
1.96 +};
1.97 +
1.98 +static X509_CRL *load_crl(char *file, int format);
1.99 +static BIO *bio_out=NULL;
1.100 +
1.101 +
1.102 +int MAIN(int, char **);
1.103 +
1.104 +int MAIN(int argc, char **argv)
1.105 + {
1.106 + unsigned long nmflag = 0;
1.107 + X509_CRL *x=NULL;
1.108 + char *CAfile = NULL, *CApath = NULL;
1.109 + int ret=1,i,num,badops=0;
1.110 + BIO *out=NULL;
1.111 + int informat,outformat;
1.112 + char *infile=NULL,*outfile=NULL;
1.113 + int hash=0,issuer=0,lastupdate=0,nextupdate=0,noout=0,text=0;
1.114 + int fingerprint = 0;
1.115 + const char **pp;
1.116 + X509_STORE *store = NULL;
1.117 + X509_STORE_CTX ctx;
1.118 + X509_LOOKUP *lookup = NULL;
1.119 + X509_OBJECT xobj;
1.120 + EVP_PKEY *pkey;
1.121 + int do_ver = 0;
1.122 + const EVP_MD *md_alg,*digest=EVP_sha1();
1.123 +
1.124 + apps_startup();
1.125 +
1.126 + if (bio_err == NULL)
1.127 + if ((bio_err=BIO_new(BIO_s_file())) != NULL)
1.128 + BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
1.129 + if (!load_config(bio_err, NULL))
1.130 + goto end;
1.131 +
1.132 + if (bio_out == NULL)
1.133 +
1.134 + if ((bio_out=BIO_new(BIO_s_file())) != NULL)
1.135 + {
1.136 + BIO_set_fp(bio_out,stdout,BIO_NOCLOSE);
1.137 +
1.138 +#ifdef OPENSSL_SYS_VMS
1.139 + {
1.140 + BIO *tmpbio = BIO_new(BIO_f_linebuffer());
1.141 + bio_out = BIO_push(tmpbio, bio_out);
1.142 + }
1.143 +#endif
1.144 + }
1.145 +
1.146 + informat=FORMAT_PEM;
1.147 + outformat=FORMAT_PEM;
1.148 +
1.149 + argc--;
1.150 + argv++;
1.151 + num=0;
1.152 + while (argc >= 1)
1.153 + {
1.154 +#ifdef undef
1.155 + if (strcmp(*argv,"-p") == 0)
1.156 + {
1.157 + if (--argc < 1) goto bad;
1.158 + if (!args_from_file(++argv,Nargc,Nargv)) { goto end; }*/
1.159 + }
1.160 +#endif
1.161 + if (strcmp(*argv,"-inform") == 0)
1.162 + {
1.163 + if (--argc < 1) goto bad;
1.164 + informat=str2fmt(*(++argv));
1.165 + }
1.166 + else if (strcmp(*argv,"-outform") == 0)
1.167 + {
1.168 + if (--argc < 1) goto bad;
1.169 + outformat=str2fmt(*(++argv));
1.170 + }
1.171 + else if (strcmp(*argv,"-in") == 0)
1.172 + {
1.173 + if (--argc < 1) goto bad;
1.174 + infile= *(++argv);
1.175 + }
1.176 + else if (strcmp(*argv,"-out") == 0)
1.177 + {
1.178 + if (--argc < 1) goto bad;
1.179 + outfile= *(++argv);
1.180 + }
1.181 + else if (strcmp(*argv,"-CApath") == 0)
1.182 + {
1.183 + if (--argc < 1) goto bad;
1.184 + CApath = *(++argv);
1.185 + do_ver = 1;
1.186 + }
1.187 + else if (strcmp(*argv,"-CAfile") == 0)
1.188 + {
1.189 + if (--argc < 1) goto bad;
1.190 + CAfile = *(++argv);
1.191 + do_ver = 1;
1.192 + }
1.193 + else if (strcmp(*argv,"-verify") == 0)
1.194 + do_ver = 1;
1.195 + else if (strcmp(*argv,"-text") == 0)
1.196 + text = 1;
1.197 + else if (strcmp(*argv,"-hash") == 0)
1.198 + hash= ++num;
1.199 + else if (strcmp(*argv,"-nameopt") == 0)
1.200 + {
1.201 + if (--argc < 1) goto bad;
1.202 + if (!set_name_ex(&nmflag, *(++argv))) goto bad;
1.203 + }
1.204 + else if (strcmp(*argv,"-issuer") == 0)
1.205 + issuer= ++num;
1.206 + else if (strcmp(*argv,"-lastupdate") == 0)
1.207 + lastupdate= ++num;
1.208 + else if (strcmp(*argv,"-nextupdate") == 0)
1.209 + nextupdate= ++num;
1.210 + else if (strcmp(*argv,"-noout") == 0)
1.211 + noout= ++num;
1.212 + else if (strcmp(*argv,"-fingerprint") == 0)
1.213 + fingerprint= ++num;
1.214 + else if ((md_alg=EVP_get_digestbyname(*argv + 1)))
1.215 + {
1.216 + /* ok */
1.217 + digest=md_alg;
1.218 + }
1.219 + else
1.220 + {
1.221 + BIO_printf(bio_err,"unknown option %s\n",*argv);
1.222 + badops=1;
1.223 + break;
1.224 + }
1.225 + argc--;
1.226 + argv++;
1.227 + }
1.228 +
1.229 + if (badops)
1.230 + {
1.231 +bad:
1.232 + for (pp=crl_usage; (*pp != NULL); pp++)
1.233 + BIO_printf(bio_err,"%s",*pp);
1.234 + goto end;
1.235 + }
1.236 +
1.237 + ERR_load_crypto_strings();
1.238 + x=load_crl(infile,informat);
1.239 + if (x == NULL) { goto end; }
1.240 +
1.241 + if(do_ver) {
1.242 + store = X509_STORE_new();
1.243 + lookup=X509_STORE_add_lookup(store,X509_LOOKUP_file());
1.244 + if (lookup == NULL) goto end;
1.245 + if (!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM))
1.246 + X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
1.247 +
1.248 + lookup=X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir());
1.249 + if (lookup == NULL) goto end;
1.250 + if (!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM))
1.251 + X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
1.252 + ERR_clear_error();
1.253 +
1.254 + if(!X509_STORE_CTX_init(&ctx, store, NULL, NULL)) {
1.255 + BIO_printf(bio_err,
1.256 + "Error initialising X509 store\n");
1.257 + goto end;
1.258 + }
1.259 +
1.260 + i = X509_STORE_get_by_subject(&ctx, X509_LU_X509,
1.261 + X509_CRL_get_issuer(x), &xobj);
1.262 + if(i <= 0) {
1.263 + BIO_printf(bio_err,
1.264 + "Error getting CRL issuer certificate\n");
1.265 + goto end;
1.266 + }
1.267 + pkey = X509_get_pubkey(xobj.data.x509);
1.268 + X509_OBJECT_free_contents(&xobj);
1.269 + if(!pkey) {
1.270 + BIO_printf(bio_err,
1.271 + "Error getting CRL issuer public key\n");
1.272 + goto end;
1.273 + }
1.274 + i = X509_CRL_verify(x, pkey);
1.275 + EVP_PKEY_free(pkey);
1.276 + if(i < 0) goto end;
1.277 + if(i == 0) BIO_printf(bio_err, "verify failure\n");
1.278 + else BIO_printf(bio_err, "verify OK\n");
1.279 + }
1.280 +
1.281 + if (num)
1.282 + {
1.283 + for (i=1; i<=num; i++)
1.284 + {
1.285 + if (issuer == i)
1.286 + {
1.287 + print_name(bio_out, "issuer=", X509_CRL_get_issuer(x), nmflag);
1.288 + }
1.289 +
1.290 + if (hash == i)
1.291 + {
1.292 + BIO_printf(bio_out,"%08lx\n",
1.293 + X509_NAME_hash(X509_CRL_get_issuer(x)));
1.294 + }
1.295 + if (lastupdate == i)
1.296 + {
1.297 + BIO_printf(bio_out,"lastUpdate=");
1.298 + ASN1_TIME_print(bio_out,
1.299 + X509_CRL_get_lastUpdate(x));
1.300 + BIO_printf(bio_out,"\n");
1.301 + }
1.302 + if (nextupdate == i)
1.303 + {
1.304 + BIO_printf(bio_out,"nextUpdate=");
1.305 + if (X509_CRL_get_nextUpdate(x))
1.306 + ASN1_TIME_print(bio_out,
1.307 + X509_CRL_get_nextUpdate(x));
1.308 + else
1.309 + BIO_printf(bio_out,"NONE");
1.310 + BIO_printf(bio_out,"\n");
1.311 + }
1.312 + if (fingerprint == i)
1.313 + {
1.314 + int j;
1.315 + unsigned int n;
1.316 + unsigned char md[EVP_MAX_MD_SIZE];
1.317 +
1.318 + if (!X509_CRL_digest(x,digest,md,&n))
1.319 + {
1.320 + BIO_printf(bio_err,"out of memory\n");
1.321 + goto end;
1.322 + }
1.323 + BIO_printf(bio_out,"%s Fingerprint=",
1.324 + OBJ_nid2sn(EVP_MD_type(digest)));
1.325 + for (j=0; j<(int)n; j++)
1.326 + {
1.327 + BIO_printf(bio_out,"%02X%c",md[j],
1.328 + (j+1 == (int)n)
1.329 + ?'\n':':');
1.330 + }
1.331 + }
1.332 + }
1.333 + }
1.334 +
1.335 + out=BIO_new(BIO_s_file());
1.336 + if (out == NULL)
1.337 + {
1.338 + ERR_print_errors(bio_err);
1.339 + goto end;
1.340 + }
1.341 +
1.342 + if (outfile == NULL)
1.343 + {
1.344 + BIO_set_fp(out,stdout,BIO_NOCLOSE);
1.345 +#ifdef OPENSSL_SYS_VMS
1.346 + {
1.347 + BIO *tmpbio = BIO_new(BIO_f_linebuffer());
1.348 + out = BIO_push(tmpbio, out);
1.349 + }
1.350 +#endif
1.351 + }
1.352 + else
1.353 + {
1.354 + if (BIO_write_filename(out,outfile) <= 0)
1.355 + {
1.356 + perror(outfile);
1.357 + goto end;
1.358 + }
1.359 + }
1.360 +
1.361 + if (text) X509_CRL_print(out, x);
1.362 +
1.363 + if (noout)
1.364 + {
1.365 + ret = 0;
1.366 + goto end;
1.367 + }
1.368 +
1.369 + if (outformat == FORMAT_ASN1)
1.370 + i=(int)i2d_X509_CRL_bio(out,x);
1.371 + else if (outformat == FORMAT_PEM)
1.372 + i=PEM_write_bio_X509_CRL(out,x);
1.373 + else
1.374 + {
1.375 + BIO_printf(bio_err,"bad output format specified for outfile\n");
1.376 + goto end;
1.377 + }
1.378 + if (!i) { BIO_printf(bio_err,"unable to write CRL\n"); goto end; }
1.379 + ret=0;
1.380 +end:
1.381 + BIO_free_all(out);
1.382 + BIO_free_all(bio_out);
1.383 + bio_out=NULL;
1.384 + X509_CRL_free(x);
1.385 + if(store) {
1.386 + X509_STORE_CTX_cleanup(&ctx);
1.387 + X509_STORE_free(store);
1.388 + }
1.389 + apps_shutdown();
1.390 + OPENSSL_EXIT(ret);
1.391 + }
1.392 +
1.393 +static X509_CRL *load_crl(char *infile, int format)
1.394 + {
1.395 + X509_CRL *x=NULL;
1.396 + BIO *in=NULL;
1.397 +
1.398 + in=BIO_new(BIO_s_file());
1.399 + if (in == NULL)
1.400 + {
1.401 + ERR_print_errors(bio_err);
1.402 + goto end;
1.403 + }
1.404 +
1.405 + if (infile == NULL)
1.406 + BIO_set_fp(in,stdin,BIO_NOCLOSE);
1.407 + else
1.408 + {
1.409 + if (BIO_read_filename(in,infile) <= 0)
1.410 + {
1.411 + perror(infile);
1.412 + goto end;
1.413 + }
1.414 + }
1.415 + if (format == FORMAT_ASN1)
1.416 + x=d2i_X509_CRL_bio(in,NULL);
1.417 + else if (format == FORMAT_PEM)
1.418 + x=PEM_read_bio_X509_CRL(in,NULL,NULL,NULL);
1.419 + else {
1.420 + BIO_printf(bio_err,"bad input format specified for input crl\n");
1.421 + goto end;
1.422 + }
1.423 + if (x == NULL)
1.424 + {
1.425 + BIO_printf(bio_err,"unable to load CRL\n");
1.426 + ERR_print_errors(bio_err);
1.427 + goto end;
1.428 + }
1.429 +
1.430 +end:
1.431 + BIO_free(in);
1.432 + return(x);
1.433 + }
1.434 +