bin/openssl/crl2p7.c

   1 /* $OpenBSD: crl2p7.c,v 1.7 2017/01/20 08:57:11 deraadt Exp $ */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58
  59 /* This was written by Gordon Chaffee <chaffee@plateau.cs.berkeley.edu>
  60  * and donated 'to the cause' along with lots and lots of other fixes to
  61  * the library. */
  62
  63 #include <sys/types.h>
  64
  65 #include <stdio.h>
  66 #include <string.h>
  67
  68 #include "apps.h"
  69
  70 #include <openssl/err.h>
  71 #include <openssl/evp.h>
  72 #include <openssl/objects.h>
  73 #include <openssl/pem.h>
  74 #include <openssl/pkcs7.h>
  75 #include <openssl/x509.h>
  76
  77 static int add_certs_from_file(STACK_OF(X509) * stack, char *certfile);
  78
  79 static struct {
  80         STACK_OF(OPENSSL_STRING) *certflst;
  81         char *infile;
  82         int informat;
  83         int nocrl;
  84         char *outfile;
  85         int outformat;
  86 } crl2p7_config;
  87
  88 static int
  89 crl2p7_opt_certfile(char *arg)
  90 {
  91         if (crl2p7_config.certflst == NULL)
  92                 crl2p7_config.certflst = sk_OPENSSL_STRING_new_null();
  93         if (crl2p7_config.certflst == NULL) {
  94                 fprintf(stderr, "out of memory\n");
  95                 return (1);
  96         }
  97         if (!sk_OPENSSL_STRING_push(crl2p7_config.certflst, arg)) {
  98                 fprintf(stderr, "out of memory\n");
  99                 return (1);
 100         }
 101
 102         return (0);
 103 }
 104
 105 static struct option crl2p7_options[] = {
 106         {
 107                 .name = "certfile",
 108                 .argname = "file",
 109                 .desc = "Chain of PEM certificates to a trusted CA",
 110                 .type = OPTION_ARG_FUNC,
 111                 .opt.argfunc = crl2p7_opt_certfile,
 112         },
 113         {
 114                 .name = "in",
 115                 .argname = "file",
 116                 .desc = "Input file (default stdin)",
 117                 .type = OPTION_ARG,
 118                 .opt.arg = &crl2p7_config.infile,
 119         },
 120         {
 121                 .name = "inform",
 122                 .argname = "format",
 123                 .desc = "Input format (DER or PEM (default))",
 124                 .type = OPTION_ARG_FORMAT,
 125                 .opt.value = &crl2p7_config.informat,
 126         },
 127         {
 128                 .name = "nocrl",
 129                 .desc = "Do not read CRL from input or include CRL in output",
 130                 .type = OPTION_FLAG,
 131                 .opt.flag = &crl2p7_config.nocrl,
 132         },
 133         {
 134                 .name = "out",
 135                 .argname = "file",
 136                 .desc = "Output file (default stdout)",
 137                 .type = OPTION_ARG,
 138                 .opt.arg = &crl2p7_config.outfile,
 139         },
 140         {
 141                 .name = "outform",
 142                 .argname = "format",
 143                 .desc = "Output format (DER or PEM (default))",
 144                 .type = OPTION_ARG_FORMAT,
 145                 .opt.value = &crl2p7_config.outformat,
 146         },
 147         { NULL },
 148 };
 149
 150 static void
 151 crl2p7_usage(void)
 152 {
 153         fprintf(stderr,
 154             "usage: crl2p7 [-certfile file] [-in file] [-inform DER | PEM]\n"
 155             "    [-nocrl] [-out file] [-outform DER | PEM]\n\n");
 156         options_usage(crl2p7_options);
 157 }
 158
 159 int
 160 crl2pkcs7_main(int argc, char **argv)
 161 {
 162         int i;
 163         BIO *in = NULL, *out = NULL;
 164         char *certfile;
 165         PKCS7 *p7 = NULL;
 166         PKCS7_SIGNED *p7s = NULL;
 167         X509_CRL *crl = NULL;
 168         STACK_OF(X509_CRL) *crl_stack = NULL;
 169         STACK_OF(X509) *cert_stack = NULL;
 170         int ret = 1;
 171
 172         if (single_execution) {
 173                 if (pledge("stdio cpath wpath rpath", NULL) == -1) {
 174                         perror("pledge");
 175                         exit(1);
 176                 }
 177         }
 178
 179         memset(&crl2p7_config, 0, sizeof(crl2p7_config));
 180
 181         crl2p7_config.informat = FORMAT_PEM;
 182         crl2p7_config.outformat = FORMAT_PEM;
 183
 184         if (options_parse(argc, argv, crl2p7_options, NULL, NULL) != 0) {
 185                 crl2p7_usage();
 186                 goto end;
 187         }
 188
 189         in = BIO_new(BIO_s_file());
 190         out = BIO_new(BIO_s_file());
 191         if (in == NULL || out == NULL) {
 192                 ERR_print_errors(bio_err);
 193                 goto end;
 194         }
 195         if (!crl2p7_config.nocrl) {
 196                 if (crl2p7_config.infile == NULL)
 197                         BIO_set_fp(in, stdin, BIO_NOCLOSE);
 198                 else {
 199                         if (BIO_read_filename(in, crl2p7_config.infile) <= 0) {
 200                                 perror(crl2p7_config.infile);
 201                                 goto end;
 202                         }
 203                 }
 204
 205                 if (crl2p7_config.informat == FORMAT_ASN1)
 206                         crl = d2i_X509_CRL_bio(in, NULL);
 207                 else if (crl2p7_config.informat == FORMAT_PEM)
 208                         crl = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
 209                 else {
 210                         BIO_printf(bio_err,
 211                             "bad input format specified for input crl\n");
 212                         goto end;
 213                 }
 214                 if (crl == NULL) {
 215                         BIO_printf(bio_err, "unable to load CRL\n");
 216                         ERR_print_errors(bio_err);
 217                         goto end;
 218                 }
 219         }
 220         if ((p7 = PKCS7_new()) == NULL)
 221                 goto end;
 222         if ((p7s = PKCS7_SIGNED_new()) == NULL)
 223                 goto end;
 224         p7->type = OBJ_nid2obj(NID_pkcs7_signed);
 225         p7->d.sign = p7s;
 226         p7s->contents->type = OBJ_nid2obj(NID_pkcs7_data);
 227
 228         if (!ASN1_INTEGER_set(p7s->version, 1))
 229                 goto end;
 230         if ((crl_stack = sk_X509_CRL_new_null()) == NULL)
 231                 goto end;
 232         p7s->crl = crl_stack;
 233         if (crl != NULL) {
 234                 sk_X509_CRL_push(crl_stack, crl);
 235                 crl = NULL;     /* now part of p7 for freeing */
 236         }
 237         if ((cert_stack = sk_X509_new_null()) == NULL)
 238                 goto end;
 239         p7s->cert = cert_stack;
 240
 241         if (crl2p7_config.certflst) {
 242                 for (i = 0; i < sk_OPENSSL_STRING_num(crl2p7_config.certflst); i++) {
 243                         certfile = sk_OPENSSL_STRING_value(crl2p7_config.certflst, i);
 244                         if (add_certs_from_file(cert_stack, certfile) < 0) {
 245                                 BIO_printf(bio_err,
 246                                     "error loading certificates\n");
 247                                 ERR_print_errors(bio_err);
 248                                 goto end;
 249                         }
 250                 }
 251         }
 252
 253         sk_OPENSSL_STRING_free(crl2p7_config.certflst);
 254
 255         if (crl2p7_config.outfile == NULL) {
 256                 BIO_set_fp(out, stdout, BIO_NOCLOSE);
 257         } else {
 258                 if (BIO_write_filename(out, crl2p7_config.outfile) <= 0) {
 259                         perror(crl2p7_config.outfile);
 260                         goto end;
 261                 }
 262         }
 263
 264         if (crl2p7_config.outformat == FORMAT_ASN1)
 265                 i = i2d_PKCS7_bio(out, p7);
 266         else if (crl2p7_config.outformat == FORMAT_PEM)
 267                 i = PEM_write_bio_PKCS7(out, p7);
 268         else {
 269                 BIO_printf(bio_err,
 270                     "bad output format specified for outfile\n");
 271                 goto end;
 272         }
 273         if (!i) {
 274                 BIO_printf(bio_err, "unable to write pkcs7 object\n");
 275                 ERR_print_errors(bio_err);
 276                 goto end;
 277         }
 278         ret = 0;
 279
 280 end:
 281         if (in != NULL)
 282                 BIO_free(in);
 283         if (out != NULL)
 284                 BIO_free_all(out);
 285         if (p7 != NULL)
 286                 PKCS7_free(p7);
 287         if (crl != NULL)
 288                 X509_CRL_free(crl);
 289
 290         return (ret);
 291 }
 292
 293 static int
 294 add_certs_from_file(STACK_OF(X509) *stack, char *certfile)
 295 {
 296         BIO *in = NULL;
 297         int count = 0;
 298         int ret = -1;
 299         STACK_OF(X509_INFO) *sk = NULL;
 300         X509_INFO *xi;
 301
 302         in = BIO_new(BIO_s_file());
 303         if (in == NULL || BIO_read_filename(in, certfile) <= 0) {
 304                 BIO_printf(bio_err, "error opening the file, %s\n", certfile);
 305                 goto end;
 306         }
 307         /* This loads from a file, a stack of x509/crl/pkey sets */
 308         sk = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL);
 309         if (sk == NULL) {
 310                 BIO_printf(bio_err, "error reading the file, %s\n", certfile);
 311                 goto end;
 312         }
 313         /* scan over it and pull out the CRL's */
 314         while (sk_X509_INFO_num(sk)) {
 315                 xi = sk_X509_INFO_shift(sk);
 316                 if (xi->x509 != NULL) {
 317                         sk_X509_push(stack, xi->x509);
 318                         xi->x509 = NULL;
 319                         count++;
 320                 }
 321                 X509_INFO_free(xi);
 322         }
 323
 324         ret = count;
 325
 326 end:
 327         /* never need to free x */
 328         if (in != NULL)
 329                 BIO_free(in);
 330         if (sk != NULL)
 331                 sk_X509_INFO_free(sk);
 332         return (ret);
 333 }