crl2p7.c 9.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337
  1. /* apps/crl2p7.c */
  2. /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  3. * All rights reserved.
  4. *
  5. * This package is an SSL implementation written
  6. * by Eric Young (eay@cryptsoft.com).
  7. * The implementation was written so as to conform with Netscapes SSL.
  8. *
  9. * This library is free for commercial and non-commercial use as long as
  10. * the following conditions are aheared to. The following conditions
  11. * apply to all code found in this distribution, be it the RC4, RSA,
  12. * lhash, DES, etc., code; not just the SSL code. The SSL documentation
  13. * included with this distribution is covered by the same copyright terms
  14. * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15. *
  16. * Copyright remains Eric Young's, and as such any Copyright notices in
  17. * the code are not to be removed.
  18. * If this package is used in a product, Eric Young should be given attribution
  19. * as the author of the parts of the library used.
  20. * This can be in the form of a textual message at program startup or
  21. * in documentation (online or textual) provided with the package.
  22. *
  23. * Redistribution and use in source and binary forms, with or without
  24. * modification, are permitted provided that the following conditions
  25. * are met:
  26. * 1. Redistributions of source code must retain the copyright
  27. * notice, this list of conditions and the following disclaimer.
  28. * 2. Redistributions in binary form must reproduce the above copyright
  29. * notice, this list of conditions and the following disclaimer in the
  30. * documentation and/or other materials provided with the distribution.
  31. * 3. All advertising materials mentioning features or use of this software
  32. * must display the following acknowledgement:
  33. * "This product includes cryptographic software written by
  34. * Eric Young (eay@cryptsoft.com)"
  35. * The word 'cryptographic' can be left out if the rouines from the library
  36. * being used are not cryptographic related :-).
  37. * 4. If you include any Windows specific code (or a derivative thereof) from
  38. * the apps directory (application code) you must include an acknowledgement:
  39. * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40. *
  41. * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44. * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51. * SUCH DAMAGE.
  52. *
  53. * The licence and distribution terms for any publically available version or
  54. * derivative of this code cannot be changed. i.e. this code cannot simply be
  55. * copied and put under another distribution licence
  56. * [including the GNU Public Licence.]
  57. */
  58. /* This was written by Gordon Chaffee <chaffee@plateau.cs.berkeley.edu>
  59. * and donated 'to the cause' along with lots and lots of other fixes to
  60. * the library. */
  61. #include <stdio.h>
  62. #include <string.h>
  63. #include <sys/types.h>
  64. #include "apps.h"
  65. #include <openssl/err.h>
  66. #include <openssl/evp.h>
  67. #include <openssl/x509.h>
  68. #include <openssl/pkcs7.h>
  69. #include <openssl/pem.h>
  70. #include <openssl/objects.h>
  71. static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile);
  72. #undef PROG
  73. #define PROG crl2pkcs7_main
  74. /* -inform arg - input format - default PEM (DER or PEM)
  75. * -outform arg - output format - default PEM
  76. * -in arg - input file - default stdin
  77. * -out arg - output file - default stdout
  78. */
  79. int MAIN(int, char **);
  80. int MAIN(int argc, char **argv)
  81. {
  82. int i,badops=0;
  83. BIO *in=NULL,*out=NULL;
  84. int informat,outformat;
  85. char *infile,*outfile,*prog,*certfile;
  86. PKCS7 *p7 = NULL;
  87. PKCS7_SIGNED *p7s = NULL;
  88. X509_CRL *crl=NULL;
  89. STACK_OF(OPENSSL_STRING) *certflst=NULL;
  90. STACK_OF(X509_CRL) *crl_stack=NULL;
  91. STACK_OF(X509) *cert_stack=NULL;
  92. int ret=1,nocrl=0;
  93. apps_startup();
  94. if (bio_err == NULL)
  95. if ((bio_err=BIO_new(BIO_s_file())) != NULL)
  96. BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
  97. infile=NULL;
  98. outfile=NULL;
  99. informat=FORMAT_PEM;
  100. outformat=FORMAT_PEM;
  101. prog=argv[0];
  102. argc--;
  103. argv++;
  104. while (argc >= 1)
  105. {
  106. if (strcmp(*argv,"-inform") == 0)
  107. {
  108. if (--argc < 1) goto bad;
  109. informat=str2fmt(*(++argv));
  110. }
  111. else if (strcmp(*argv,"-outform") == 0)
  112. {
  113. if (--argc < 1) goto bad;
  114. outformat=str2fmt(*(++argv));
  115. }
  116. else if (strcmp(*argv,"-in") == 0)
  117. {
  118. if (--argc < 1) goto bad;
  119. infile= *(++argv);
  120. }
  121. else if (strcmp(*argv,"-nocrl") == 0)
  122. {
  123. nocrl=1;
  124. }
  125. else if (strcmp(*argv,"-out") == 0)
  126. {
  127. if (--argc < 1) goto bad;
  128. outfile= *(++argv);
  129. }
  130. else if (strcmp(*argv,"-certfile") == 0)
  131. {
  132. if (--argc < 1) goto bad;
  133. if(!certflst) certflst = sk_OPENSSL_STRING_new_null();
  134. sk_OPENSSL_STRING_push(certflst,*(++argv));
  135. }
  136. else
  137. {
  138. BIO_printf(bio_err,"unknown option %s\n",*argv);
  139. badops=1;
  140. break;
  141. }
  142. argc--;
  143. argv++;
  144. }
  145. if (badops)
  146. {
  147. bad:
  148. BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
  149. BIO_printf(bio_err,"where options are\n");
  150. BIO_printf(bio_err," -inform arg input format - DER or PEM\n");
  151. BIO_printf(bio_err," -outform arg output format - DER or PEM\n");
  152. BIO_printf(bio_err," -in arg input file\n");
  153. BIO_printf(bio_err," -out arg output file\n");
  154. BIO_printf(bio_err," -certfile arg certificates file of chain to a trusted CA\n");
  155. BIO_printf(bio_err," (can be used more than once)\n");
  156. BIO_printf(bio_err," -nocrl no crl to load, just certs from '-certfile'\n");
  157. ret = 1;
  158. goto end;
  159. }
  160. ERR_load_crypto_strings();
  161. in=BIO_new(BIO_s_file());
  162. out=BIO_new(BIO_s_file());
  163. if ((in == NULL) || (out == NULL))
  164. {
  165. ERR_print_errors(bio_err);
  166. goto end;
  167. }
  168. if (!nocrl)
  169. {
  170. if (infile == NULL)
  171. BIO_set_fp(in,stdin,BIO_NOCLOSE);
  172. else
  173. {
  174. if (BIO_read_filename(in,infile) <= 0)
  175. {
  176. perror(infile);
  177. goto end;
  178. }
  179. }
  180. if (informat == FORMAT_ASN1)
  181. crl=d2i_X509_CRL_bio(in,NULL);
  182. else if (informat == FORMAT_PEM)
  183. crl=PEM_read_bio_X509_CRL(in,NULL,NULL,NULL);
  184. else {
  185. BIO_printf(bio_err,"bad input format specified for input crl\n");
  186. goto end;
  187. }
  188. if (crl == NULL)
  189. {
  190. BIO_printf(bio_err,"unable to load CRL\n");
  191. ERR_print_errors(bio_err);
  192. goto end;
  193. }
  194. }
  195. if ((p7=PKCS7_new()) == NULL) goto end;
  196. if ((p7s=PKCS7_SIGNED_new()) == NULL) goto end;
  197. p7->type=OBJ_nid2obj(NID_pkcs7_signed);
  198. p7->d.sign=p7s;
  199. p7s->contents->type=OBJ_nid2obj(NID_pkcs7_data);
  200. if (!ASN1_INTEGER_set(p7s->version,1)) goto end;
  201. if ((crl_stack=sk_X509_CRL_new_null()) == NULL) goto end;
  202. p7s->crl=crl_stack;
  203. if (crl != NULL)
  204. {
  205. sk_X509_CRL_push(crl_stack,crl);
  206. crl=NULL; /* now part of p7 for OPENSSL_freeing */
  207. }
  208. if ((cert_stack=sk_X509_new_null()) == NULL) goto end;
  209. p7s->cert=cert_stack;
  210. if(certflst) for(i = 0; i < sk_OPENSSL_STRING_num(certflst); i++) {
  211. certfile = sk_OPENSSL_STRING_value(certflst, i);
  212. if (add_certs_from_file(cert_stack,certfile) < 0)
  213. {
  214. BIO_printf(bio_err, "error loading certificates\n");
  215. ERR_print_errors(bio_err);
  216. goto end;
  217. }
  218. }
  219. sk_OPENSSL_STRING_free(certflst);
  220. if (outfile == NULL)
  221. {
  222. BIO_set_fp(out,stdout,BIO_NOCLOSE);
  223. #ifdef OPENSSL_SYS_VMS
  224. {
  225. BIO *tmpbio = BIO_new(BIO_f_linebuffer());
  226. out = BIO_push(tmpbio, out);
  227. }
  228. #endif
  229. }
  230. else
  231. {
  232. if (BIO_write_filename(out,outfile) <= 0)
  233. {
  234. perror(outfile);
  235. goto end;
  236. }
  237. }
  238. if (outformat == FORMAT_ASN1)
  239. i=i2d_PKCS7_bio(out,p7);
  240. else if (outformat == FORMAT_PEM)
  241. i=PEM_write_bio_PKCS7(out,p7);
  242. else {
  243. BIO_printf(bio_err,"bad output format specified for outfile\n");
  244. goto end;
  245. }
  246. if (!i)
  247. {
  248. BIO_printf(bio_err,"unable to write pkcs7 object\n");
  249. ERR_print_errors(bio_err);
  250. goto end;
  251. }
  252. ret=0;
  253. end:
  254. if (in != NULL) BIO_free(in);
  255. if (out != NULL) BIO_free_all(out);
  256. if (p7 != NULL) PKCS7_free(p7);
  257. if (crl != NULL) X509_CRL_free(crl);
  258. apps_shutdown();
  259. OPENSSL_EXIT(ret);
  260. }
  261. /*
  262. *----------------------------------------------------------------------
  263. * int add_certs_from_file
  264. *
  265. * Read a list of certificates to be checked from a file.
  266. *
  267. * Results:
  268. * number of certs added if successful, -1 if not.
  269. *----------------------------------------------------------------------
  270. */
  271. static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile)
  272. {
  273. BIO *in=NULL;
  274. int count=0;
  275. int ret= -1;
  276. STACK_OF(X509_INFO) *sk=NULL;
  277. X509_INFO *xi;
  278. in=BIO_new(BIO_s_file());
  279. if ((in == NULL) || (BIO_read_filename(in,certfile) <= 0))
  280. {
  281. BIO_printf(bio_err,"error opening the file, %s\n",certfile);
  282. goto end;
  283. }
  284. /* This loads from a file, a stack of x509/crl/pkey sets */
  285. sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL);
  286. if (sk == NULL) {
  287. BIO_printf(bio_err,"error reading the file, %s\n",certfile);
  288. goto end;
  289. }
  290. /* scan over it and pull out the CRL's */
  291. while (sk_X509_INFO_num(sk))
  292. {
  293. xi=sk_X509_INFO_shift(sk);
  294. if (xi->x509 != NULL)
  295. {
  296. sk_X509_push(stack,xi->x509);
  297. xi->x509=NULL;
  298. count++;
  299. }
  300. X509_INFO_free(xi);
  301. }
  302. ret=count;
  303. end:
  304. /* never need to OPENSSL_free x */
  305. if (in != NULL) BIO_free(in);
  306. if (sk != NULL) sk_X509_INFO_free(sk);
  307. return(ret);
  308. }