crl.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418
  1. /* apps/crl.c */
  2. /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  3. * All rights reserved.
  4. *
  5. * This package is an SSL implementation written
  6. * by Eric Young (eay@cryptsoft.com).
  7. * The implementation was written so as to conform with Netscapes SSL.
  8. *
  9. * This library is free for commercial and non-commercial use as long as
  10. * the following conditions are aheared to. The following conditions
  11. * apply to all code found in this distribution, be it the RC4, RSA,
  12. * lhash, DES, etc., code; not just the SSL code. The SSL documentation
  13. * included with this distribution is covered by the same copyright terms
  14. * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15. *
  16. * Copyright remains Eric Young's, and as such any Copyright notices in
  17. * the code are not to be removed.
  18. * If this package is used in a product, Eric Young should be given attribution
  19. * as the author of the parts of the library used.
  20. * This can be in the form of a textual message at program startup or
  21. * in documentation (online or textual) provided with the package.
  22. *
  23. * Redistribution and use in source and binary forms, with or without
  24. * modification, are permitted provided that the following conditions
  25. * are met:
  26. * 1. Redistributions of source code must retain the copyright
  27. * notice, this list of conditions and the following disclaimer.
  28. * 2. Redistributions in binary form must reproduce the above copyright
  29. * notice, this list of conditions and the following disclaimer in the
  30. * documentation and/or other materials provided with the distribution.
  31. * 3. All advertising materials mentioning features or use of this software
  32. * must display the following acknowledgement:
  33. * "This product includes cryptographic software written by
  34. * Eric Young (eay@cryptsoft.com)"
  35. * The word 'cryptographic' can be left out if the rouines from the library
  36. * being used are not cryptographic related :-).
  37. * 4. If you include any Windows specific code (or a derivative thereof) from
  38. * the apps directory (application code) you must include an acknowledgement:
  39. * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40. *
  41. * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44. * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51. * SUCH DAMAGE.
  52. *
  53. * The licence and distribution terms for any publically available version or
  54. * derivative of this code cannot be changed. i.e. this code cannot simply be
  55. * copied and put under another distribution licence
  56. * [including the GNU Public Licence.]
  57. */
  58. #include <stdio.h>
  59. #include <stdlib.h>
  60. #include <string.h>
  61. #include "apps.h"
  62. #include <openssl/bio.h>
  63. #include <openssl/err.h>
  64. #include <openssl/x509.h>
  65. #include <openssl/x509v3.h>
  66. #include <openssl/pem.h>
  67. #undef PROG
  68. #define PROG crl_main
  69. #undef POSTFIX
  70. #define POSTFIX ".rvk"
  71. static const char *crl_usage[] = {
  72. "usage: crl args\n",
  73. "\n",
  74. " -inform arg - input format - default PEM (DER or PEM)\n",
  75. " -outform arg - output format - default PEM\n",
  76. " -text - print out a text format version\n",
  77. " -in arg - input file - default stdin\n",
  78. " -out arg - output file - default stdout\n",
  79. " -hash - print hash value\n",
  80. " -fingerprint - print the crl fingerprint\n",
  81. " -issuer - print issuer DN\n",
  82. " -lastupdate - lastUpdate field\n",
  83. " -nextupdate - nextUpdate field\n",
  84. " -crlnumber - print CRL number\n",
  85. " -noout - no CRL output\n",
  86. " -CAfile name - verify CRL using certificates in file \"name\"\n",
  87. " -CApath dir - verify CRL using certificates in \"dir\"\n",
  88. " -nameopt arg - various certificate name options\n",
  89. NULL
  90. };
  91. static X509_CRL *load_crl(char *file, int format);
  92. static BIO *bio_out = NULL;
  93. int MAIN(int, char **);
  94. int MAIN(int argc, char **argv)
  95. {
  96. unsigned long nmflag = 0;
  97. X509_CRL *x = NULL;
  98. char *CAfile = NULL, *CApath = NULL;
  99. int ret = 1, i, num, badops = 0;
  100. BIO *out = NULL;
  101. int informat, outformat;
  102. char *infile = NULL, *outfile = NULL;
  103. int hash = 0, issuer = 0, lastupdate = 0, nextupdate = 0, noout =
  104. 0, text = 0;
  105. int fingerprint = 0, crlnumber = 0;
  106. const char **pp;
  107. X509_STORE *store = NULL;
  108. X509_STORE_CTX ctx;
  109. X509_LOOKUP *lookup = NULL;
  110. X509_OBJECT xobj;
  111. EVP_PKEY *pkey;
  112. int do_ver = 0;
  113. const EVP_MD *md_alg, *digest = EVP_sha1();
  114. apps_startup();
  115. if (bio_err == NULL)
  116. if ((bio_err = BIO_new(BIO_s_file())) != NULL)
  117. BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
  118. if (!load_config(bio_err, NULL))
  119. goto end;
  120. if (bio_out == NULL)
  121. if ((bio_out = BIO_new(BIO_s_file())) != NULL) {
  122. BIO_set_fp(bio_out, stdout, BIO_NOCLOSE);
  123. #ifdef OPENSSL_SYS_VMS
  124. {
  125. BIO *tmpbio = BIO_new(BIO_f_linebuffer());
  126. bio_out = BIO_push(tmpbio, bio_out);
  127. }
  128. #endif
  129. }
  130. informat = FORMAT_PEM;
  131. outformat = FORMAT_PEM;
  132. argc--;
  133. argv++;
  134. num = 0;
  135. while (argc >= 1) {
  136. #ifdef undef
  137. if (strcmp(*argv, "-p") == 0) {
  138. if (--argc < 1)
  139. goto bad;
  140. if (!args_from_file(++argv, Nargc, Nargv)) {
  141. goto end;
  142. }
  143. */}
  144. #endif
  145. if (strcmp(*argv, "-inform") == 0) {
  146. if (--argc < 1)
  147. goto bad;
  148. informat = str2fmt(*(++argv));
  149. } else if (strcmp(*argv, "-outform") == 0) {
  150. if (--argc < 1)
  151. goto bad;
  152. outformat = str2fmt(*(++argv));
  153. } else if (strcmp(*argv, "-in") == 0) {
  154. if (--argc < 1)
  155. goto bad;
  156. infile = *(++argv);
  157. } else if (strcmp(*argv, "-out") == 0) {
  158. if (--argc < 1)
  159. goto bad;
  160. outfile = *(++argv);
  161. } else if (strcmp(*argv, "-CApath") == 0) {
  162. if (--argc < 1)
  163. goto bad;
  164. CApath = *(++argv);
  165. do_ver = 1;
  166. } else if (strcmp(*argv, "-CAfile") == 0) {
  167. if (--argc < 1)
  168. goto bad;
  169. CAfile = *(++argv);
  170. do_ver = 1;
  171. } else if (strcmp(*argv, "-verify") == 0)
  172. do_ver = 1;
  173. else if (strcmp(*argv, "-text") == 0)
  174. text = 1;
  175. else if (strcmp(*argv, "-hash") == 0)
  176. hash = ++num;
  177. else if (strcmp(*argv, "-nameopt") == 0) {
  178. if (--argc < 1)
  179. goto bad;
  180. if (!set_name_ex(&nmflag, *(++argv)))
  181. goto bad;
  182. } else if (strcmp(*argv, "-issuer") == 0)
  183. issuer = ++num;
  184. else if (strcmp(*argv, "-lastupdate") == 0)
  185. lastupdate = ++num;
  186. else if (strcmp(*argv, "-nextupdate") == 0)
  187. nextupdate = ++num;
  188. else if (strcmp(*argv, "-noout") == 0)
  189. noout = ++num;
  190. else if (strcmp(*argv, "-fingerprint") == 0)
  191. fingerprint = ++num;
  192. else if (strcmp(*argv, "-crlnumber") == 0)
  193. crlnumber = ++num;
  194. else if ((md_alg = EVP_get_digestbyname(*argv + 1))) {
  195. /* ok */
  196. digest = md_alg;
  197. } else {
  198. BIO_printf(bio_err, "unknown option %s\n", *argv);
  199. badops = 1;
  200. break;
  201. }
  202. argc--;
  203. argv++;
  204. }
  205. if (badops) {
  206. bad:
  207. for (pp = crl_usage; (*pp != NULL); pp++)
  208. BIO_printf(bio_err, "%s", *pp);
  209. goto end;
  210. }
  211. ERR_load_crypto_strings();
  212. x = load_crl(infile, informat);
  213. if (x == NULL) {
  214. goto end;
  215. }
  216. if (do_ver) {
  217. store = X509_STORE_new();
  218. lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
  219. if (lookup == NULL)
  220. goto end;
  221. if (!X509_LOOKUP_load_file(lookup, CAfile, X509_FILETYPE_PEM))
  222. X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);
  223. lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
  224. if (lookup == NULL)
  225. goto end;
  226. if (!X509_LOOKUP_add_dir(lookup, CApath, X509_FILETYPE_PEM))
  227. X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
  228. ERR_clear_error();
  229. if (!X509_STORE_CTX_init(&ctx, store, NULL, NULL)) {
  230. BIO_printf(bio_err, "Error initialising X509 store\n");
  231. goto end;
  232. }
  233. i = X509_STORE_get_by_subject(&ctx, X509_LU_X509,
  234. X509_CRL_get_issuer(x), &xobj);
  235. if (i <= 0) {
  236. BIO_printf(bio_err, "Error getting CRL issuer certificate\n");
  237. goto end;
  238. }
  239. pkey = X509_get_pubkey(xobj.data.x509);
  240. X509_OBJECT_free_contents(&xobj);
  241. if (!pkey) {
  242. BIO_printf(bio_err, "Error getting CRL issuer public key\n");
  243. goto end;
  244. }
  245. i = X509_CRL_verify(x, pkey);
  246. EVP_PKEY_free(pkey);
  247. if (i < 0)
  248. goto end;
  249. if (i == 0)
  250. BIO_printf(bio_err, "verify failure\n");
  251. else
  252. BIO_printf(bio_err, "verify OK\n");
  253. }
  254. if (num) {
  255. for (i = 1; i <= num; i++) {
  256. if (issuer == i) {
  257. print_name(bio_out, "issuer=", X509_CRL_get_issuer(x),
  258. nmflag);
  259. }
  260. if (crlnumber == i) {
  261. ASN1_INTEGER *crlnum;
  262. crlnum = X509_CRL_get_ext_d2i(x, NID_crl_number, NULL, NULL);
  263. BIO_printf(bio_out, "crlNumber=");
  264. if (crlnum) {
  265. i2a_ASN1_INTEGER(bio_out, crlnum);
  266. ASN1_INTEGER_free(crlnum);
  267. } else
  268. BIO_puts(bio_out, "<NONE>");
  269. BIO_printf(bio_out, "\n");
  270. }
  271. if (hash == i) {
  272. BIO_printf(bio_out, "%08lx\n",
  273. X509_NAME_hash(X509_CRL_get_issuer(x)));
  274. }
  275. if (lastupdate == i) {
  276. BIO_printf(bio_out, "lastUpdate=");
  277. ASN1_TIME_print(bio_out, X509_CRL_get_lastUpdate(x));
  278. BIO_printf(bio_out, "\n");
  279. }
  280. if (nextupdate == i) {
  281. BIO_printf(bio_out, "nextUpdate=");
  282. if (X509_CRL_get_nextUpdate(x))
  283. ASN1_TIME_print(bio_out, X509_CRL_get_nextUpdate(x));
  284. else
  285. BIO_printf(bio_out, "NONE");
  286. BIO_printf(bio_out, "\n");
  287. }
  288. if (fingerprint == i) {
  289. int j;
  290. unsigned int n;
  291. unsigned char md[EVP_MAX_MD_SIZE];
  292. if (!X509_CRL_digest(x, digest, md, &n)) {
  293. BIO_printf(bio_err, "out of memory\n");
  294. goto end;
  295. }
  296. BIO_printf(bio_out, "%s Fingerprint=",
  297. OBJ_nid2sn(EVP_MD_type(digest)));
  298. for (j = 0; j < (int)n; j++) {
  299. BIO_printf(bio_out, "%02X%c", md[j], (j + 1 == (int)n)
  300. ? '\n' : ':');
  301. }
  302. }
  303. }
  304. }
  305. out = BIO_new(BIO_s_file());
  306. if (out == NULL) {
  307. ERR_print_errors(bio_err);
  308. goto end;
  309. }
  310. if (outfile == NULL) {
  311. BIO_set_fp(out, stdout, BIO_NOCLOSE);
  312. #ifdef OPENSSL_SYS_VMS
  313. {
  314. BIO *tmpbio = BIO_new(BIO_f_linebuffer());
  315. out = BIO_push(tmpbio, out);
  316. }
  317. #endif
  318. } else {
  319. if (BIO_write_filename(out, outfile) <= 0) {
  320. perror(outfile);
  321. goto end;
  322. }
  323. }
  324. if (text)
  325. X509_CRL_print(out, x);
  326. if (noout) {
  327. ret = 0;
  328. goto end;
  329. }
  330. if (outformat == FORMAT_ASN1)
  331. i = (int)i2d_X509_CRL_bio(out, x);
  332. else if (outformat == FORMAT_PEM)
  333. i = PEM_write_bio_X509_CRL(out, x);
  334. else {
  335. BIO_printf(bio_err, "bad output format specified for outfile\n");
  336. goto end;
  337. }
  338. if (!i) {
  339. BIO_printf(bio_err, "unable to write CRL\n");
  340. goto end;
  341. }
  342. ret = 0;
  343. end:
  344. BIO_free_all(out);
  345. BIO_free_all(bio_out);
  346. bio_out = NULL;
  347. X509_CRL_free(x);
  348. if (store) {
  349. X509_STORE_CTX_cleanup(&ctx);
  350. X509_STORE_free(store);
  351. }
  352. apps_shutdown();
  353. OPENSSL_EXIT(ret);
  354. }
  355. static X509_CRL *load_crl(char *infile, int format)
  356. {
  357. X509_CRL *x = NULL;
  358. BIO *in = NULL;
  359. in = BIO_new(BIO_s_file());
  360. if (in == NULL) {
  361. ERR_print_errors(bio_err);
  362. goto end;
  363. }
  364. if (infile == NULL)
  365. BIO_set_fp(in, stdin, BIO_NOCLOSE);
  366. else {
  367. if (BIO_read_filename(in, infile) <= 0) {
  368. perror(infile);
  369. goto end;
  370. }
  371. }
  372. if (format == FORMAT_ASN1)
  373. x = d2i_X509_CRL_bio(in, NULL);
  374. else if (format == FORMAT_PEM)
  375. x = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
  376. else {
  377. BIO_printf(bio_err, "bad input format specified for input crl\n");
  378. goto end;
  379. }
  380. if (x == NULL) {
  381. BIO_printf(bio_err, "unable to load CRL\n");
  382. ERR_print_errors(bio_err);
  383. goto end;
  384. }
  385. end:
  386. BIO_free(in);
  387. return (x);
  388. }