smime.c 27 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775
  1. /* smime.c */
  2. /*
  3. * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  4. * project.
  5. */
  6. /* ====================================================================
  7. * Copyright (c) 1999-2004 The OpenSSL Project. All rights reserved.
  8. *
  9. * Redistribution and use in source and binary forms, with or without
  10. * modification, are permitted provided that the following conditions
  11. * are met:
  12. *
  13. * 1. Redistributions of source code must retain the above copyright
  14. * notice, this list of conditions and the following disclaimer.
  15. *
  16. * 2. Redistributions in binary form must reproduce the above copyright
  17. * notice, this list of conditions and the following disclaimer in
  18. * the documentation and/or other materials provided with the
  19. * distribution.
  20. *
  21. * 3. All advertising materials mentioning features or use of this
  22. * software must display the following acknowledgment:
  23. * "This product includes software developed by the OpenSSL Project
  24. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  25. *
  26. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  27. * endorse or promote products derived from this software without
  28. * prior written permission. For written permission, please contact
  29. * licensing@OpenSSL.org.
  30. *
  31. * 5. Products derived from this software may not be called "OpenSSL"
  32. * nor may "OpenSSL" appear in their names without prior written
  33. * permission of the OpenSSL Project.
  34. *
  35. * 6. Redistributions of any form whatsoever must retain the following
  36. * acknowledgment:
  37. * "This product includes software developed by the OpenSSL Project
  38. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  39. *
  40. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  41. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  42. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  43. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  44. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  45. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  46. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  47. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  49. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  50. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  51. * OF THE POSSIBILITY OF SUCH DAMAGE.
  52. * ====================================================================
  53. *
  54. * This product includes cryptographic software written by Eric Young
  55. * (eay@cryptsoft.com). This product includes software written by Tim
  56. * Hudson (tjh@cryptsoft.com).
  57. *
  58. */
  59. /* S/MIME utility function */
  60. #include <stdio.h>
  61. #include <string.h>
  62. #include "apps.h"
  63. #include <openssl/crypto.h>
  64. #include <openssl/pem.h>
  65. #include <openssl/err.h>
  66. #include <openssl/x509_vfy.h>
  67. #include <openssl/x509v3.h>
  68. #undef PROG
  69. #define PROG smime_main
  70. static int save_certs(char *signerfile, STACK_OF(X509) *signers);
  71. static int smime_cb(int ok, X509_STORE_CTX *ctx);
  72. #define SMIME_OP 0x10
  73. #define SMIME_IP 0x20
  74. #define SMIME_SIGNERS 0x40
  75. #define SMIME_ENCRYPT (1 | SMIME_OP)
  76. #define SMIME_DECRYPT (2 | SMIME_IP)
  77. #define SMIME_SIGN (3 | SMIME_OP | SMIME_SIGNERS)
  78. #define SMIME_VERIFY (4 | SMIME_IP)
  79. #define SMIME_PK7OUT (5 | SMIME_IP | SMIME_OP)
  80. #define SMIME_RESIGN (6 | SMIME_IP | SMIME_OP | SMIME_SIGNERS)
  81. int MAIN(int, char **);
  82. int MAIN(int argc, char **argv)
  83. {
  84. ENGINE *e = NULL;
  85. int operation = 0;
  86. int ret = 0;
  87. char **args;
  88. const char *inmode = "r", *outmode = "w";
  89. char *infile = NULL, *outfile = NULL;
  90. char *signerfile = NULL, *recipfile = NULL;
  91. STACK_OF(OPENSSL_STRING) *sksigners = NULL, *skkeys = NULL;
  92. char *certfile = NULL, *keyfile = NULL, *contfile = NULL;
  93. const EVP_CIPHER *cipher = NULL;
  94. PKCS7 *p7 = NULL;
  95. X509_STORE *store = NULL;
  96. X509 *cert = NULL, *recip = NULL, *signer = NULL;
  97. EVP_PKEY *key = NULL;
  98. STACK_OF(X509) *encerts = NULL, *other = NULL;
  99. BIO *in = NULL, *out = NULL, *indata = NULL;
  100. int badarg = 0;
  101. int flags = PKCS7_DETACHED;
  102. char *to = NULL, *from = NULL, *subject = NULL;
  103. char *CAfile = NULL, *CApath = NULL;
  104. char *passargin = NULL, *passin = NULL;
  105. char *inrand = NULL;
  106. int need_rand = 0;
  107. int indef = 0;
  108. const EVP_MD *sign_md = NULL;
  109. int informat = FORMAT_SMIME, outformat = FORMAT_SMIME;
  110. int keyform = FORMAT_PEM;
  111. char *engine = NULL;
  112. X509_VERIFY_PARAM *vpm = NULL;
  113. args = argv + 1;
  114. ret = 1;
  115. apps_startup();
  116. if (bio_err == NULL) {
  117. if ((bio_err = BIO_new(BIO_s_file())) != NULL)
  118. BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
  119. }
  120. if (!load_config(bio_err, NULL))
  121. goto end;
  122. while (!badarg && *args && *args[0] == '-') {
  123. if (!strcmp(*args, "-encrypt"))
  124. operation = SMIME_ENCRYPT;
  125. else if (!strcmp(*args, "-decrypt"))
  126. operation = SMIME_DECRYPT;
  127. else if (!strcmp(*args, "-sign"))
  128. operation = SMIME_SIGN;
  129. else if (!strcmp(*args, "-resign"))
  130. operation = SMIME_RESIGN;
  131. else if (!strcmp(*args, "-verify"))
  132. operation = SMIME_VERIFY;
  133. else if (!strcmp(*args, "-pk7out"))
  134. operation = SMIME_PK7OUT;
  135. #ifndef OPENSSL_NO_DES
  136. else if (!strcmp(*args, "-des3"))
  137. cipher = EVP_des_ede3_cbc();
  138. else if (!strcmp(*args, "-des"))
  139. cipher = EVP_des_cbc();
  140. #endif
  141. #ifndef OPENSSL_NO_SEED
  142. else if (!strcmp(*args, "-seed"))
  143. cipher = EVP_seed_cbc();
  144. #endif
  145. #ifndef OPENSSL_NO_RC2
  146. else if (!strcmp(*args, "-rc2-40"))
  147. cipher = EVP_rc2_40_cbc();
  148. else if (!strcmp(*args, "-rc2-128"))
  149. cipher = EVP_rc2_cbc();
  150. else if (!strcmp(*args, "-rc2-64"))
  151. cipher = EVP_rc2_64_cbc();
  152. #endif
  153. #ifndef OPENSSL_NO_AES
  154. else if (!strcmp(*args, "-aes128"))
  155. cipher = EVP_aes_128_cbc();
  156. else if (!strcmp(*args, "-aes192"))
  157. cipher = EVP_aes_192_cbc();
  158. else if (!strcmp(*args, "-aes256"))
  159. cipher = EVP_aes_256_cbc();
  160. #endif
  161. #ifndef OPENSSL_NO_CAMELLIA
  162. else if (!strcmp(*args, "-camellia128"))
  163. cipher = EVP_camellia_128_cbc();
  164. else if (!strcmp(*args, "-camellia192"))
  165. cipher = EVP_camellia_192_cbc();
  166. else if (!strcmp(*args, "-camellia256"))
  167. cipher = EVP_camellia_256_cbc();
  168. #endif
  169. else if (!strcmp(*args, "-text"))
  170. flags |= PKCS7_TEXT;
  171. else if (!strcmp(*args, "-nointern"))
  172. flags |= PKCS7_NOINTERN;
  173. else if (!strcmp(*args, "-noverify"))
  174. flags |= PKCS7_NOVERIFY;
  175. else if (!strcmp(*args, "-nochain"))
  176. flags |= PKCS7_NOCHAIN;
  177. else if (!strcmp(*args, "-nocerts"))
  178. flags |= PKCS7_NOCERTS;
  179. else if (!strcmp(*args, "-noattr"))
  180. flags |= PKCS7_NOATTR;
  181. else if (!strcmp(*args, "-nodetach"))
  182. flags &= ~PKCS7_DETACHED;
  183. else if (!strcmp(*args, "-nosmimecap"))
  184. flags |= PKCS7_NOSMIMECAP;
  185. else if (!strcmp(*args, "-binary"))
  186. flags |= PKCS7_BINARY;
  187. else if (!strcmp(*args, "-nosigs"))
  188. flags |= PKCS7_NOSIGS;
  189. else if (!strcmp(*args, "-stream"))
  190. indef = 1;
  191. else if (!strcmp(*args, "-indef"))
  192. indef = 1;
  193. else if (!strcmp(*args, "-noindef"))
  194. indef = 0;
  195. else if (!strcmp(*args, "-nooldmime"))
  196. flags |= PKCS7_NOOLDMIMETYPE;
  197. else if (!strcmp(*args, "-crlfeol"))
  198. flags |= PKCS7_CRLFEOL;
  199. else if (!strcmp(*args, "-rand")) {
  200. if (!args[1])
  201. goto argerr;
  202. args++;
  203. inrand = *args;
  204. need_rand = 1;
  205. }
  206. #ifndef OPENSSL_NO_ENGINE
  207. else if (!strcmp(*args, "-engine")) {
  208. if (!args[1])
  209. goto argerr;
  210. engine = *++args;
  211. }
  212. #endif
  213. else if (!strcmp(*args, "-passin")) {
  214. if (!args[1])
  215. goto argerr;
  216. passargin = *++args;
  217. } else if (!strcmp(*args, "-to")) {
  218. if (!args[1])
  219. goto argerr;
  220. to = *++args;
  221. } else if (!strcmp(*args, "-from")) {
  222. if (!args[1])
  223. goto argerr;
  224. from = *++args;
  225. } else if (!strcmp(*args, "-subject")) {
  226. if (!args[1])
  227. goto argerr;
  228. subject = *++args;
  229. } else if (!strcmp(*args, "-signer")) {
  230. if (!args[1])
  231. goto argerr;
  232. /* If previous -signer argument add signer to list */
  233. if (signerfile) {
  234. if (!sksigners)
  235. sksigners = sk_OPENSSL_STRING_new_null();
  236. sk_OPENSSL_STRING_push(sksigners, signerfile);
  237. if (!keyfile)
  238. keyfile = signerfile;
  239. if (!skkeys)
  240. skkeys = sk_OPENSSL_STRING_new_null();
  241. sk_OPENSSL_STRING_push(skkeys, keyfile);
  242. keyfile = NULL;
  243. }
  244. signerfile = *++args;
  245. } else if (!strcmp(*args, "-recip")) {
  246. if (!args[1])
  247. goto argerr;
  248. recipfile = *++args;
  249. } else if (!strcmp(*args, "-md")) {
  250. if (!args[1])
  251. goto argerr;
  252. sign_md = EVP_get_digestbyname(*++args);
  253. if (sign_md == NULL) {
  254. BIO_printf(bio_err, "Unknown digest %s\n", *args);
  255. goto argerr;
  256. }
  257. } else if (!strcmp(*args, "-inkey")) {
  258. if (!args[1])
  259. goto argerr;
  260. /* If previous -inkey arument add signer to list */
  261. if (keyfile) {
  262. if (!signerfile) {
  263. BIO_puts(bio_err, "Illegal -inkey without -signer\n");
  264. goto argerr;
  265. }
  266. if (!sksigners)
  267. sksigners = sk_OPENSSL_STRING_new_null();
  268. sk_OPENSSL_STRING_push(sksigners, signerfile);
  269. signerfile = NULL;
  270. if (!skkeys)
  271. skkeys = sk_OPENSSL_STRING_new_null();
  272. sk_OPENSSL_STRING_push(skkeys, keyfile);
  273. }
  274. keyfile = *++args;
  275. } else if (!strcmp(*args, "-keyform")) {
  276. if (!args[1])
  277. goto argerr;
  278. keyform = str2fmt(*++args);
  279. } else if (!strcmp(*args, "-certfile")) {
  280. if (!args[1])
  281. goto argerr;
  282. certfile = *++args;
  283. } else if (!strcmp(*args, "-CAfile")) {
  284. if (!args[1])
  285. goto argerr;
  286. CAfile = *++args;
  287. } else if (!strcmp(*args, "-CApath")) {
  288. if (!args[1])
  289. goto argerr;
  290. CApath = *++args;
  291. } else if (!strcmp(*args, "-in")) {
  292. if (!args[1])
  293. goto argerr;
  294. infile = *++args;
  295. } else if (!strcmp(*args, "-inform")) {
  296. if (!args[1])
  297. goto argerr;
  298. informat = str2fmt(*++args);
  299. } else if (!strcmp(*args, "-outform")) {
  300. if (!args[1])
  301. goto argerr;
  302. outformat = str2fmt(*++args);
  303. } else if (!strcmp(*args, "-out")) {
  304. if (!args[1])
  305. goto argerr;
  306. outfile = *++args;
  307. } else if (!strcmp(*args, "-content")) {
  308. if (!args[1])
  309. goto argerr;
  310. contfile = *++args;
  311. } else if (args_verify(&args, NULL, &badarg, bio_err, &vpm))
  312. continue;
  313. else if ((cipher = EVP_get_cipherbyname(*args + 1)) == NULL)
  314. badarg = 1;
  315. args++;
  316. }
  317. if (!(operation & SMIME_SIGNERS) && (skkeys || sksigners)) {
  318. BIO_puts(bio_err, "Multiple signers or keys not allowed\n");
  319. goto argerr;
  320. }
  321. if (operation & SMIME_SIGNERS) {
  322. /* Check to see if any final signer needs to be appended */
  323. if (keyfile && !signerfile) {
  324. BIO_puts(bio_err, "Illegal -inkey without -signer\n");
  325. goto argerr;
  326. }
  327. if (signerfile) {
  328. if (!sksigners)
  329. sksigners = sk_OPENSSL_STRING_new_null();
  330. sk_OPENSSL_STRING_push(sksigners, signerfile);
  331. if (!skkeys)
  332. skkeys = sk_OPENSSL_STRING_new_null();
  333. if (!keyfile)
  334. keyfile = signerfile;
  335. sk_OPENSSL_STRING_push(skkeys, keyfile);
  336. }
  337. if (!sksigners) {
  338. BIO_printf(bio_err, "No signer certificate specified\n");
  339. badarg = 1;
  340. }
  341. signerfile = NULL;
  342. keyfile = NULL;
  343. need_rand = 1;
  344. } else if (operation == SMIME_DECRYPT) {
  345. if (!recipfile && !keyfile) {
  346. BIO_printf(bio_err,
  347. "No recipient certificate or key specified\n");
  348. badarg = 1;
  349. }
  350. } else if (operation == SMIME_ENCRYPT) {
  351. if (!*args) {
  352. BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n");
  353. badarg = 1;
  354. }
  355. need_rand = 1;
  356. } else if (!operation)
  357. badarg = 1;
  358. if (badarg) {
  359. argerr:
  360. BIO_printf(bio_err, "Usage smime [options] cert.pem ...\n");
  361. BIO_printf(bio_err, "where options are\n");
  362. BIO_printf(bio_err, "-encrypt encrypt message\n");
  363. BIO_printf(bio_err, "-decrypt decrypt encrypted message\n");
  364. BIO_printf(bio_err, "-sign sign message\n");
  365. BIO_printf(bio_err, "-verify verify signed message\n");
  366. BIO_printf(bio_err, "-pk7out output PKCS#7 structure\n");
  367. #ifndef OPENSSL_NO_DES
  368. BIO_printf(bio_err, "-des3 encrypt with triple DES\n");
  369. BIO_printf(bio_err, "-des encrypt with DES\n");
  370. #endif
  371. #ifndef OPENSSL_NO_SEED
  372. BIO_printf(bio_err, "-seed encrypt with SEED\n");
  373. #endif
  374. #ifndef OPENSSL_NO_RC2
  375. BIO_printf(bio_err, "-rc2-40 encrypt with RC2-40 (default)\n");
  376. BIO_printf(bio_err, "-rc2-64 encrypt with RC2-64\n");
  377. BIO_printf(bio_err, "-rc2-128 encrypt with RC2-128\n");
  378. #endif
  379. #ifndef OPENSSL_NO_AES
  380. BIO_printf(bio_err, "-aes128, -aes192, -aes256\n");
  381. BIO_printf(bio_err,
  382. " encrypt PEM output with cbc aes\n");
  383. #endif
  384. #ifndef OPENSSL_NO_CAMELLIA
  385. BIO_printf(bio_err, "-camellia128, -camellia192, -camellia256\n");
  386. BIO_printf(bio_err,
  387. " encrypt PEM output with cbc camellia\n");
  388. #endif
  389. BIO_printf(bio_err,
  390. "-nointern don't search certificates in message for signer\n");
  391. BIO_printf(bio_err,
  392. "-nosigs don't verify message signature\n");
  393. BIO_printf(bio_err,
  394. "-noverify don't verify signers certificate\n");
  395. BIO_printf(bio_err,
  396. "-nocerts don't include signers certificate when signing\n");
  397. BIO_printf(bio_err, "-nodetach use opaque signing\n");
  398. BIO_printf(bio_err,
  399. "-noattr don't include any signed attributes\n");
  400. BIO_printf(bio_err,
  401. "-binary don't translate message to text\n");
  402. BIO_printf(bio_err, "-certfile file other certificates file\n");
  403. BIO_printf(bio_err, "-signer file signer certificate file\n");
  404. BIO_printf(bio_err,
  405. "-recip file recipient certificate file for decryption\n");
  406. BIO_printf(bio_err, "-in file input file\n");
  407. BIO_printf(bio_err,
  408. "-inform arg input format SMIME (default), PEM or DER\n");
  409. BIO_printf(bio_err,
  410. "-inkey file input private key (if not signer or recipient)\n");
  411. BIO_printf(bio_err,
  412. "-keyform arg input private key format (PEM or ENGINE)\n");
  413. BIO_printf(bio_err, "-out file output file\n");
  414. BIO_printf(bio_err,
  415. "-outform arg output format SMIME (default), PEM or DER\n");
  416. BIO_printf(bio_err,
  417. "-content file supply or override content for detached signature\n");
  418. BIO_printf(bio_err, "-to addr to address\n");
  419. BIO_printf(bio_err, "-from ad from address\n");
  420. BIO_printf(bio_err, "-subject s subject\n");
  421. BIO_printf(bio_err,
  422. "-text include or delete text MIME headers\n");
  423. BIO_printf(bio_err,
  424. "-CApath dir trusted certificates directory\n");
  425. BIO_printf(bio_err, "-CAfile file trusted certificates file\n");
  426. BIO_printf(bio_err,
  427. "-no_alt_chains only ever use the first certificate chain found\n");
  428. BIO_printf(bio_err,
  429. "-crl_check check revocation status of signer's certificate using CRLs\n");
  430. BIO_printf(bio_err,
  431. "-crl_check_all check revocation status of signer's certificate chain using CRLs\n");
  432. #ifndef OPENSSL_NO_ENGINE
  433. BIO_printf(bio_err,
  434. "-engine e use engine e, possibly a hardware device.\n");
  435. #endif
  436. BIO_printf(bio_err, "-passin arg input file pass phrase source\n");
  437. BIO_printf(bio_err, "-rand file%cfile%c...\n", LIST_SEPARATOR_CHAR,
  438. LIST_SEPARATOR_CHAR);
  439. BIO_printf(bio_err,
  440. " load the file (or the files in the directory) into\n");
  441. BIO_printf(bio_err, " the random number generator\n");
  442. BIO_printf(bio_err,
  443. "cert.pem recipient certificate(s) for encryption\n");
  444. goto end;
  445. }
  446. e = setup_engine(bio_err, engine, 0);
  447. if (!app_passwd(bio_err, passargin, NULL, &passin, NULL)) {
  448. BIO_printf(bio_err, "Error getting password\n");
  449. goto end;
  450. }
  451. if (need_rand) {
  452. app_RAND_load_file(NULL, bio_err, (inrand != NULL));
  453. if (inrand != NULL)
  454. BIO_printf(bio_err, "%ld semi-random bytes loaded\n",
  455. app_RAND_load_files(inrand));
  456. }
  457. ret = 2;
  458. if (!(operation & SMIME_SIGNERS))
  459. flags &= ~PKCS7_DETACHED;
  460. if (operation & SMIME_OP) {
  461. if (outformat == FORMAT_ASN1)
  462. outmode = "wb";
  463. } else {
  464. if (flags & PKCS7_BINARY)
  465. outmode = "wb";
  466. }
  467. if (operation & SMIME_IP) {
  468. if (informat == FORMAT_ASN1)
  469. inmode = "rb";
  470. } else {
  471. if (flags & PKCS7_BINARY)
  472. inmode = "rb";
  473. }
  474. if (operation == SMIME_ENCRYPT) {
  475. if (!cipher) {
  476. #ifndef OPENSSL_NO_DES
  477. cipher = EVP_des_ede3_cbc();
  478. #else
  479. BIO_printf(bio_err, "No cipher selected\n");
  480. goto end;
  481. #endif
  482. }
  483. encerts = sk_X509_new_null();
  484. while (*args) {
  485. if (!(cert = load_cert(bio_err, *args, FORMAT_PEM,
  486. NULL, e, "recipient certificate file"))) {
  487. #if 0 /* An appropriate message is already printed */
  488. BIO_printf(bio_err,
  489. "Can't read recipient certificate file %s\n",
  490. *args);
  491. #endif
  492. goto end;
  493. }
  494. sk_X509_push(encerts, cert);
  495. cert = NULL;
  496. args++;
  497. }
  498. }
  499. if (certfile) {
  500. if (!(other = load_certs(bio_err, certfile, FORMAT_PEM, NULL,
  501. e, "certificate file"))) {
  502. ERR_print_errors(bio_err);
  503. goto end;
  504. }
  505. }
  506. if (recipfile && (operation == SMIME_DECRYPT)) {
  507. if (!(recip = load_cert(bio_err, recipfile, FORMAT_PEM, NULL,
  508. e, "recipient certificate file"))) {
  509. ERR_print_errors(bio_err);
  510. goto end;
  511. }
  512. }
  513. if (operation == SMIME_DECRYPT) {
  514. if (!keyfile)
  515. keyfile = recipfile;
  516. } else if (operation == SMIME_SIGN) {
  517. if (!keyfile)
  518. keyfile = signerfile;
  519. } else
  520. keyfile = NULL;
  521. if (keyfile) {
  522. key = load_key(bio_err, keyfile, keyform, 0, passin, e,
  523. "signing key file");
  524. if (!key)
  525. goto end;
  526. }
  527. if (infile) {
  528. if (!(in = BIO_new_file(infile, inmode))) {
  529. BIO_printf(bio_err, "Can't open input file %s\n", infile);
  530. goto end;
  531. }
  532. } else
  533. in = BIO_new_fp(stdin, BIO_NOCLOSE);
  534. if (operation & SMIME_IP) {
  535. if (informat == FORMAT_SMIME)
  536. p7 = SMIME_read_PKCS7(in, &indata);
  537. else if (informat == FORMAT_PEM)
  538. p7 = PEM_read_bio_PKCS7(in, NULL, NULL, NULL);
  539. else if (informat == FORMAT_ASN1)
  540. p7 = d2i_PKCS7_bio(in, NULL);
  541. else {
  542. BIO_printf(bio_err, "Bad input format for PKCS#7 file\n");
  543. goto end;
  544. }
  545. if (!p7) {
  546. BIO_printf(bio_err, "Error reading S/MIME message\n");
  547. goto end;
  548. }
  549. if (contfile) {
  550. BIO_free(indata);
  551. if (!(indata = BIO_new_file(contfile, "rb"))) {
  552. BIO_printf(bio_err, "Can't read content file %s\n", contfile);
  553. goto end;
  554. }
  555. }
  556. }
  557. if (outfile) {
  558. if (!(out = BIO_new_file(outfile, outmode))) {
  559. BIO_printf(bio_err, "Can't open output file %s\n", outfile);
  560. goto end;
  561. }
  562. } else {
  563. out = BIO_new_fp(stdout, BIO_NOCLOSE);
  564. #ifdef OPENSSL_SYS_VMS
  565. {
  566. BIO *tmpbio = BIO_new(BIO_f_linebuffer());
  567. out = BIO_push(tmpbio, out);
  568. }
  569. #endif
  570. }
  571. if (operation == SMIME_VERIFY) {
  572. if (!(store = setup_verify(bio_err, CAfile, CApath)))
  573. goto end;
  574. X509_STORE_set_verify_cb(store, smime_cb);
  575. if (vpm)
  576. X509_STORE_set1_param(store, vpm);
  577. }
  578. ret = 3;
  579. if (operation == SMIME_ENCRYPT) {
  580. if (indef)
  581. flags |= PKCS7_STREAM;
  582. p7 = PKCS7_encrypt(encerts, in, cipher, flags);
  583. } else if (operation & SMIME_SIGNERS) {
  584. int i;
  585. /*
  586. * If detached data content we only enable streaming if S/MIME output
  587. * format.
  588. */
  589. if (operation == SMIME_SIGN) {
  590. if (flags & PKCS7_DETACHED) {
  591. if (outformat == FORMAT_SMIME)
  592. flags |= PKCS7_STREAM;
  593. } else if (indef)
  594. flags |= PKCS7_STREAM;
  595. flags |= PKCS7_PARTIAL;
  596. p7 = PKCS7_sign(NULL, NULL, other, in, flags);
  597. if (!p7)
  598. goto end;
  599. if (flags & PKCS7_NOCERTS) {
  600. for (i = 0; i < sk_X509_num(other); i++) {
  601. X509 *x = sk_X509_value(other, i);
  602. PKCS7_add_certificate(p7, x);
  603. }
  604. }
  605. } else
  606. flags |= PKCS7_REUSE_DIGEST;
  607. for (i = 0; i < sk_OPENSSL_STRING_num(sksigners); i++) {
  608. signerfile = sk_OPENSSL_STRING_value(sksigners, i);
  609. keyfile = sk_OPENSSL_STRING_value(skkeys, i);
  610. signer = load_cert(bio_err, signerfile, FORMAT_PEM, NULL,
  611. e, "signer certificate");
  612. if (!signer)
  613. goto end;
  614. key = load_key(bio_err, keyfile, keyform, 0, passin, e,
  615. "signing key file");
  616. if (!key)
  617. goto end;
  618. if (!PKCS7_sign_add_signer(p7, signer, key, sign_md, flags))
  619. goto end;
  620. X509_free(signer);
  621. signer = NULL;
  622. EVP_PKEY_free(key);
  623. key = NULL;
  624. }
  625. /* If not streaming or resigning finalize structure */
  626. if ((operation == SMIME_SIGN) && !(flags & PKCS7_STREAM)) {
  627. if (!PKCS7_final(p7, in, flags))
  628. goto end;
  629. }
  630. }
  631. if (!p7) {
  632. BIO_printf(bio_err, "Error creating PKCS#7 structure\n");
  633. goto end;
  634. }
  635. ret = 4;
  636. if (operation == SMIME_DECRYPT) {
  637. if (!PKCS7_decrypt(p7, key, recip, out, flags)) {
  638. BIO_printf(bio_err, "Error decrypting PKCS#7 structure\n");
  639. goto end;
  640. }
  641. } else if (operation == SMIME_VERIFY) {
  642. STACK_OF(X509) *signers;
  643. if (PKCS7_verify(p7, other, store, indata, out, flags))
  644. BIO_printf(bio_err, "Verification successful\n");
  645. else {
  646. BIO_printf(bio_err, "Verification failure\n");
  647. goto end;
  648. }
  649. signers = PKCS7_get0_signers(p7, other, flags);
  650. if (!save_certs(signerfile, signers)) {
  651. BIO_printf(bio_err, "Error writing signers to %s\n", signerfile);
  652. ret = 5;
  653. goto end;
  654. }
  655. sk_X509_free(signers);
  656. } else if (operation == SMIME_PK7OUT)
  657. PEM_write_bio_PKCS7(out, p7);
  658. else {
  659. if (to)
  660. BIO_printf(out, "To: %s\n", to);
  661. if (from)
  662. BIO_printf(out, "From: %s\n", from);
  663. if (subject)
  664. BIO_printf(out, "Subject: %s\n", subject);
  665. if (outformat == FORMAT_SMIME) {
  666. if (operation == SMIME_RESIGN)
  667. SMIME_write_PKCS7(out, p7, indata, flags);
  668. else
  669. SMIME_write_PKCS7(out, p7, in, flags);
  670. } else if (outformat == FORMAT_PEM)
  671. PEM_write_bio_PKCS7_stream(out, p7, in, flags);
  672. else if (outformat == FORMAT_ASN1)
  673. i2d_PKCS7_bio_stream(out, p7, in, flags);
  674. else {
  675. BIO_printf(bio_err, "Bad output format for PKCS#7 file\n");
  676. goto end;
  677. }
  678. }
  679. ret = 0;
  680. end:
  681. if (need_rand)
  682. app_RAND_write_file(NULL, bio_err);
  683. if (ret)
  684. ERR_print_errors(bio_err);
  685. sk_X509_pop_free(encerts, X509_free);
  686. sk_X509_pop_free(other, X509_free);
  687. if (vpm)
  688. X509_VERIFY_PARAM_free(vpm);
  689. if (sksigners)
  690. sk_OPENSSL_STRING_free(sksigners);
  691. if (skkeys)
  692. sk_OPENSSL_STRING_free(skkeys);
  693. X509_STORE_free(store);
  694. X509_free(cert);
  695. X509_free(recip);
  696. X509_free(signer);
  697. EVP_PKEY_free(key);
  698. PKCS7_free(p7);
  699. release_engine(e);
  700. BIO_free(in);
  701. BIO_free(indata);
  702. BIO_free_all(out);
  703. if (passin)
  704. OPENSSL_free(passin);
  705. return (ret);
  706. }
  707. static int save_certs(char *signerfile, STACK_OF(X509) *signers)
  708. {
  709. int i;
  710. BIO *tmp;
  711. if (!signerfile)
  712. return 1;
  713. tmp = BIO_new_file(signerfile, "w");
  714. if (!tmp)
  715. return 0;
  716. for (i = 0; i < sk_X509_num(signers); i++)
  717. PEM_write_bio_X509(tmp, sk_X509_value(signers, i));
  718. BIO_free(tmp);
  719. return 1;
  720. }
  721. /* Minimal callback just to output policy info (if any) */
  722. static int smime_cb(int ok, X509_STORE_CTX *ctx)
  723. {
  724. int error;
  725. error = X509_STORE_CTX_get_error(ctx);
  726. if ((error != X509_V_ERR_NO_EXPLICIT_POLICY)
  727. && ((error != X509_V_OK) || (ok != 2)))
  728. return ok;
  729. policies_print(NULL, ctx);
  730. return ok;
  731. }