[BACK]Return to crl.c CVS log [TXT][DIR] Up to [local] / src / usr.bin / openssl

Annotation of src/usr.bin/openssl/crl.c, Revision 1.14

1.14    ! tb          1: /* $OpenBSD: crl.c,v 1.13 2019/07/14 03:30:45 guenther Exp $ */
1.1       jsing       2: /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
                      3:  * All rights reserved.
                      4:  *
                      5:  * This package is an SSL implementation written
                      6:  * by Eric Young (eay@cryptsoft.com).
                      7:  * The implementation was written so as to conform with Netscapes SSL.
                      8:  *
                      9:  * This library is free for commercial and non-commercial use as long as
                     10:  * the following conditions are aheared to.  The following conditions
                     11:  * apply to all code found in this distribution, be it the RC4, RSA,
                     12:  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
                     13:  * included with this distribution is covered by the same copyright terms
                     14:  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
                     15:  *
                     16:  * Copyright remains Eric Young's, and as such any Copyright notices in
                     17:  * the code are not to be removed.
                     18:  * If this package is used in a product, Eric Young should be given attribution
                     19:  * as the author of the parts of the library used.
                     20:  * This can be in the form of a textual message at program startup or
                     21:  * in documentation (online or textual) provided with the package.
                     22:  *
                     23:  * Redistribution and use in source and binary forms, with or without
                     24:  * modification, are permitted provided that the following conditions
                     25:  * are met:
                     26:  * 1. Redistributions of source code must retain the copyright
                     27:  *    notice, this list of conditions and the following disclaimer.
                     28:  * 2. Redistributions in binary form must reproduce the above copyright
                     29:  *    notice, this list of conditions and the following disclaimer in the
                     30:  *    documentation and/or other materials provided with the distribution.
                     31:  * 3. All advertising materials mentioning features or use of this software
                     32:  *    must display the following acknowledgement:
                     33:  *    "This product includes cryptographic software written by
                     34:  *     Eric Young (eay@cryptsoft.com)"
                     35:  *    The word 'cryptographic' can be left out if the rouines from the library
                     36:  *    being used are not cryptographic related :-).
                     37:  * 4. If you include any Windows specific code (or a derivative thereof) from
                     38:  *    the apps directory (application code) you must include an acknowledgement:
                     39:  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
                     40:  *
                     41:  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
                     42:  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
                     43:  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
                     44:  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
                     45:  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
                     46:  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
                     47:  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
                     48:  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
                     49:  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
                     50:  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
                     51:  * SUCH DAMAGE.
                     52:  *
                     53:  * The licence and distribution terms for any publically available version or
                     54:  * derivative of this code cannot be changed.  i.e. this code cannot simply be
                     55:  * copied and put under another distribution licence
                     56:  * [including the GNU Public Licence.]
                     57:  */
                     58:
                     59: #include <stdio.h>
                     60: #include <stdlib.h>
                     61: #include <string.h>
                     62:
                     63: #include "apps.h"
                     64:
                     65: #include <openssl/bio.h>
                     66: #include <openssl/err.h>
                     67: #include <openssl/pem.h>
                     68: #include <openssl/x509.h>
                     69: #include <openssl/x509v3.h>
                     70:
1.2       jsing      71: static struct {
                     72:        char *cafile;
                     73:        char *capath;
                     74:        int crlnumber;
                     75:        int fingerprint;
                     76:        int hash;
                     77:        int hash_old;
                     78:        char *infile;
                     79:        int informat;
                     80:        int issuer;
                     81:        int lastupdate;
                     82:        char *nameopt;
                     83:        int nextupdate;
                     84:        int noout;
                     85:        char *outfile;
                     86:        int outformat;
                     87:        int text;
                     88:        int verify;
                     89: } crl_config;
                     90:
1.13      guenther   91: static const struct option crl_options[] = {
1.2       jsing      92:        {
                     93:                .name = "CAfile",
                     94:                .argname = "file",
                     95:                .desc = "Verify the CRL using certificates in the given file",
                     96:                .type = OPTION_ARG,
                     97:                .opt.arg = &crl_config.cafile,
                     98:        },
                     99:        {
                    100:                .name = "CApath",
                    101:                .argname = "path",
                    102:                .desc = "Verify the CRL using certificates in the given path",
                    103:                .type = OPTION_ARG,
                    104:                .opt.arg = &crl_config.capath,
                    105:        },
                    106:        {
                    107:                .name = "crlnumber",
                    108:                .desc = "Print the CRL number",
                    109:                .type = OPTION_FLAG_ORD,
                    110:                .opt.flag = &crl_config.crlnumber,
                    111:        },
                    112:        {
                    113:                .name = "fingerprint",
                    114:                .desc = "Print the CRL fingerprint",
                    115:                .type = OPTION_FLAG_ORD,
                    116:                .opt.flag = &crl_config.fingerprint,
                    117:        },
                    118:        {
                    119:                .name = "hash",
                    120:                .desc = "Print the hash of the issuer name",
                    121:                .type = OPTION_FLAG_ORD,
                    122:                .opt.flag = &crl_config.hash,
                    123:        },
                    124:        {
                    125:                .name = "hash_old",
                    126:                .desc = "Print an old-style (MD5) hash of the issuer name",
                    127:                .type = OPTION_FLAG_ORD,
                    128:                .opt.flag = &crl_config.hash_old,
                    129:        },
                    130:        {
                    131:                .name = "in",
                    132:                .argname = "file",
                    133:                .desc = "Input file to read from (stdin if unspecified)",
                    134:                .type = OPTION_ARG,
                    135:                .opt.arg = &crl_config.infile,
                    136:        },
                    137:        {
                    138:                .name = "inform",
                    139:                .argname = "format",
                    140:                .desc = "Input format (DER or PEM)",
                    141:                .type = OPTION_ARG_FORMAT,
                    142:                .opt.value = &crl_config.informat,
                    143:        },
                    144:        {
                    145:                .name = "issuer",
                    146:                .desc = "Print the issuer name",
                    147:                .type = OPTION_FLAG_ORD,
                    148:                .opt.flag = &crl_config.issuer,
                    149:        },
                    150:        {
                    151:                .name = "lastupdate",
                    152:                .desc = "Print the lastUpdate field",
                    153:                .type = OPTION_FLAG_ORD,
                    154:                .opt.flag = &crl_config.lastupdate,
                    155:        },
                    156:        {
                    157:                .name = "nameopt",
                    158:                .argname = "options",
                    159:                .desc = "Specify certificate name options",
                    160:                .type = OPTION_ARG,
                    161:                .opt.arg = &crl_config.nameopt,
                    162:        },
                    163:        {
                    164:                .name = "nextupdate",
                    165:                .desc = "Print the nextUpdate field",
                    166:                .type = OPTION_FLAG_ORD,
                    167:                .opt.flag = &crl_config.nextupdate,
                    168:        },
                    169:        {
                    170:                .name = "noout",
                    171:                .desc = "Do not output the encoded version of the CRL",
                    172:                .type = OPTION_FLAG,
                    173:                .opt.flag = &crl_config.noout,
                    174:        },
                    175:        {
                    176:                .name = "out",
                    177:                .argname = "file",
                    178:                .desc = "Output file to write to (stdout if unspecified)",
                    179:                .type = OPTION_ARG,
                    180:                .opt.arg = &crl_config.outfile,
                    181:        },
                    182:        {
                    183:                .name = "outform",
                    184:                .argname = "format",
                    185:                .desc = "Output format (DER or PEM)",
                    186:                .type = OPTION_ARG_FORMAT,
                    187:                .opt.value = &crl_config.outformat,
                    188:        },
                    189:        {
                    190:                .name = "text",
                    191:                .desc = "Print out the CRL in text form",
                    192:                .type = OPTION_FLAG,
                    193:                .opt.flag = &crl_config.text,
                    194:        },
                    195:        {
                    196:                .name = "verify",
                    197:                .desc = "Verify the signature on the CRL",
                    198:                .type = OPTION_FLAG,
                    199:                .opt.flag = &crl_config.verify,
                    200:        },
1.5       bcook     201:        {NULL},
1.1       jsing     202: };
                    203:
1.2       jsing     204: static void
                    205: crl_usage(void)
                    206: {
                    207:        fprintf(stderr,
                    208:            "usage: crl [-CAfile file] [-CApath dir] [-fingerprint] [-hash]\n"
                    209:            "    [-in file] [-inform DER | PEM] [-issuer] [-lastupdate]\n"
                    210:            "    [-nextupdate] [-noout] [-out file] [-outform DER | PEM]\n"
                    211:            "    [-text]\n\n");
                    212:        options_usage(crl_options);
                    213: }
                    214:
1.1       jsing     215: static X509_CRL *load_crl(char *file, int format);
                    216: static BIO *bio_out = NULL;
                    217:
                    218: int
                    219: crl_main(int argc, char **argv)
                    220: {
                    221:        unsigned long nmflag = 0;
                    222:        X509_CRL *x = NULL;
1.2       jsing     223:        int ret = 1, i;
1.1       jsing     224:        BIO *out = NULL;
                    225:        X509_STORE *store = NULL;
1.14    ! tb        226:        X509_STORE_CTX *ctx = NULL;
1.1       jsing     227:        X509_LOOKUP *lookup = NULL;
                    228:        X509_OBJECT xobj;
                    229:        EVP_PKEY *pkey;
1.2       jsing     230:        const EVP_MD *digest;
                    231:        char *digest_name = NULL;
1.8       doug      232:
                    233:        if (single_execution) {
1.10      deraadt   234:                if (pledge("stdio cpath wpath rpath", NULL) == -1) {
1.8       doug      235:                        perror("pledge");
1.9       doug      236:                        exit(1);
                    237:                }
1.8       doug      238:        }
1.1       jsing     239:
1.2       jsing     240:        if (bio_out == NULL) {
1.1       jsing     241:                if ((bio_out = BIO_new(BIO_s_file())) != NULL) {
                    242:                        BIO_set_fp(bio_out, stdout, BIO_NOCLOSE);
                    243:                }
1.2       jsing     244:        }
                    245:
1.12      jsg       246:        digest = EVP_sha256();
1.2       jsing     247:
                    248:        memset(&crl_config, 0, sizeof(crl_config));
                    249:        crl_config.informat = FORMAT_PEM;
                    250:        crl_config.outformat = FORMAT_PEM;
1.1       jsing     251:
1.6       jsing     252:        if (options_parse(argc, argv, crl_options, &digest_name, NULL) != 0) {
1.2       jsing     253:                crl_usage();
                    254:                goto end;
                    255:        }
                    256:
                    257:        if (crl_config.cafile != NULL || crl_config.capath != NULL)
                    258:                crl_config.verify = 1;
                    259:
                    260:        if (crl_config.nameopt != NULL) {
                    261:                if (set_name_ex(&nmflag, crl_config.nameopt) != 1) {
                    262:                        fprintf(stderr,
                    263:                            "Invalid -nameopt argument '%s'\n",
                    264:                            crl_config.nameopt);
                    265:                        goto end;
1.1       jsing     266:                }
1.2       jsing     267:        }
                    268:
                    269:        if (digest_name != NULL) {
                    270:                if ((digest = EVP_get_digestbyname(digest_name)) == NULL) {
                    271:                        fprintf(stderr,
                    272:                            "Unknown message digest algorithm '%s'\n",
                    273:                            digest_name);
                    274:                        goto end;
1.1       jsing     275:                }
                    276:        }
                    277:
1.2       jsing     278:        x = load_crl(crl_config.infile, crl_config.informat);
                    279:        if (x == NULL)
1.1       jsing     280:                goto end;
1.2       jsing     281:
                    282:        if (crl_config.verify) {
1.1       jsing     283:                store = X509_STORE_new();
1.14    ! tb        284:                if (store == NULL)
        !           285:                        goto end;
1.1       jsing     286:                lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
                    287:                if (lookup == NULL)
                    288:                        goto end;
1.2       jsing     289:                if (!X509_LOOKUP_load_file(lookup, crl_config.cafile,
                    290:                    X509_FILETYPE_PEM))
1.1       jsing     291:                        X509_LOOKUP_load_file(lookup, NULL,
                    292:                            X509_FILETYPE_DEFAULT);
                    293:
                    294:                lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
                    295:                if (lookup == NULL)
                    296:                        goto end;
1.2       jsing     297:                if (!X509_LOOKUP_add_dir(lookup, crl_config.capath,
                    298:                    X509_FILETYPE_PEM))
1.1       jsing     299:                        X509_LOOKUP_add_dir(lookup, NULL,
                    300:                            X509_FILETYPE_DEFAULT);
                    301:                ERR_clear_error();
                    302:
1.14    ! tb        303:                if ((ctx = X509_STORE_CTX_new()) == NULL)
        !           304:                        goto end;
        !           305:
        !           306:                if (!X509_STORE_CTX_init(ctx, store, NULL, NULL)) {
1.1       jsing     307:                        BIO_printf(bio_err,
                    308:                            "Error initialising X509 store\n");
                    309:                        goto end;
                    310:                }
1.14    ! tb        311:                i = X509_STORE_get_by_subject(ctx, X509_LU_X509,
1.1       jsing     312:                    X509_CRL_get_issuer(x), &xobj);
                    313:                if (i <= 0) {
                    314:                        BIO_printf(bio_err,
                    315:                            "Error getting CRL issuer certificate\n");
                    316:                        goto end;
                    317:                }
1.14    ! tb        318:                pkey = X509_get_pubkey(X509_OBJECT_get0_X509(&xobj));
1.1       jsing     319:                X509_OBJECT_free_contents(&xobj);
                    320:                if (!pkey) {
                    321:                        BIO_printf(bio_err,
                    322:                            "Error getting CRL issuer public key\n");
                    323:                        goto end;
                    324:                }
                    325:                i = X509_CRL_verify(x, pkey);
                    326:                EVP_PKEY_free(pkey);
                    327:                if (i < 0)
                    328:                        goto end;
                    329:                if (i == 0)
                    330:                        BIO_printf(bio_err, "verify failure\n");
                    331:                else
                    332:                        BIO_printf(bio_err, "verify OK\n");
                    333:        }
1.2       jsing     334:
                    335:        /* Print requested information the order that the flags were given. */
                    336:        for (i = 1; i <= argc; i++) {
                    337:                if (crl_config.issuer == i) {
                    338:                        print_name(bio_out, "issuer=",
                    339:                            X509_CRL_get_issuer(x), nmflag);
                    340:                }
                    341:                if (crl_config.crlnumber == i) {
                    342:                        ASN1_INTEGER *crlnum;
                    343:                        crlnum = X509_CRL_get_ext_d2i(x,
                    344:                            NID_crl_number, NULL, NULL);
                    345:                        BIO_printf(bio_out, "crlNumber=");
                    346:                        if (crlnum) {
                    347:                                i2a_ASN1_INTEGER(bio_out, crlnum);
                    348:                                ASN1_INTEGER_free(crlnum);
                    349:                        } else
                    350:                                BIO_puts(bio_out, "<NONE>");
                    351:                        BIO_printf(bio_out, "\n");
                    352:                }
                    353:                if (crl_config.hash == i) {
                    354:                        BIO_printf(bio_out, "%08lx\n",
                    355:                            X509_NAME_hash(X509_CRL_get_issuer(x)));
                    356:                }
1.1       jsing     357: #ifndef OPENSSL_NO_MD5
1.2       jsing     358:                if (crl_config.hash_old == i) {
                    359:                        BIO_printf(bio_out, "%08lx\n",
                    360:                            X509_NAME_hash_old(X509_CRL_get_issuer(x)));
                    361:                }
1.1       jsing     362: #endif
1.2       jsing     363:                if (crl_config.lastupdate == i) {
                    364:                        BIO_printf(bio_out, "lastUpdate=");
                    365:                        ASN1_TIME_print(bio_out,
                    366:                            X509_CRL_get_lastUpdate(x));
                    367:                        BIO_printf(bio_out, "\n");
                    368:                }
                    369:                if (crl_config.nextupdate == i) {
                    370:                        BIO_printf(bio_out, "nextUpdate=");
                    371:                        if (X509_CRL_get_nextUpdate(x))
1.1       jsing     372:                                ASN1_TIME_print(bio_out,
1.2       jsing     373:                                    X509_CRL_get_nextUpdate(x));
                    374:                        else
                    375:                                BIO_printf(bio_out, "NONE");
                    376:                        BIO_printf(bio_out, "\n");
                    377:                }
                    378:                if (crl_config.fingerprint == i) {
                    379:                        int j;
                    380:                        unsigned int n;
                    381:                        unsigned char md[EVP_MAX_MD_SIZE];
                    382:
                    383:                        if (!X509_CRL_digest(x, digest, md, &n)) {
                    384:                                BIO_printf(bio_err, "out of memory\n");
                    385:                                goto end;
1.1       jsing     386:                        }
1.2       jsing     387:                        BIO_printf(bio_out, "%s Fingerprint=",
                    388:                            OBJ_nid2sn(EVP_MD_type(digest)));
                    389:                        for (j = 0; j < (int) n; j++) {
                    390:                                BIO_printf(bio_out, "%02X%c", md[j],
                    391:                                    (j + 1 == (int)n) ? '\n' : ':');
1.1       jsing     392:                        }
                    393:                }
                    394:        }
1.2       jsing     395:
1.1       jsing     396:        out = BIO_new(BIO_s_file());
                    397:        if (out == NULL) {
                    398:                ERR_print_errors(bio_err);
                    399:                goto end;
                    400:        }
1.2       jsing     401:        if (crl_config.outfile == NULL) {
1.1       jsing     402:                BIO_set_fp(out, stdout, BIO_NOCLOSE);
                    403:        } else {
1.2       jsing     404:                if (BIO_write_filename(out, crl_config.outfile) <= 0) {
                    405:                        perror(crl_config.outfile);
1.1       jsing     406:                        goto end;
                    407:                }
                    408:        }
                    409:
1.2       jsing     410:        if (crl_config.text)
1.1       jsing     411:                X509_CRL_print(out, x);
                    412:
1.2       jsing     413:        if (crl_config.noout) {
1.1       jsing     414:                ret = 0;
                    415:                goto end;
                    416:        }
1.2       jsing     417:        if (crl_config.outformat == FORMAT_ASN1)
1.1       jsing     418:                i = (int) i2d_X509_CRL_bio(out, x);
1.2       jsing     419:        else if (crl_config.outformat == FORMAT_PEM)
1.1       jsing     420:                i = PEM_write_bio_X509_CRL(out, x);
                    421:        else {
                    422:                BIO_printf(bio_err,
                    423:                    "bad output format specified for outfile\n");
                    424:                goto end;
                    425:        }
                    426:        if (!i) {
                    427:                BIO_printf(bio_err, "unable to write CRL\n");
                    428:                goto end;
                    429:        }
                    430:        ret = 0;
                    431:
1.11      jsing     432:  end:
1.1       jsing     433:        BIO_free_all(out);
                    434:        BIO_free_all(bio_out);
                    435:        bio_out = NULL;
                    436:        X509_CRL_free(x);
1.14    ! tb        437:        X509_STORE_CTX_free(ctx);
        !           438:        X509_STORE_free(store);
1.1       jsing     439:
                    440:        return (ret);
                    441: }
                    442:
                    443: static X509_CRL *
                    444: load_crl(char *infile, int format)
                    445: {
                    446:        X509_CRL *x = NULL;
                    447:        BIO *in = NULL;
                    448:
                    449:        in = BIO_new(BIO_s_file());
                    450:        if (in == NULL) {
                    451:                ERR_print_errors(bio_err);
                    452:                goto end;
                    453:        }
                    454:        if (infile == NULL)
                    455:                BIO_set_fp(in, stdin, BIO_NOCLOSE);
                    456:        else {
                    457:                if (BIO_read_filename(in, infile) <= 0) {
                    458:                        perror(infile);
                    459:                        goto end;
                    460:                }
                    461:        }
                    462:        if (format == FORMAT_ASN1)
                    463:                x = d2i_X509_CRL_bio(in, NULL);
                    464:        else if (format == FORMAT_PEM)
                    465:                x = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
                    466:        else {
                    467:                BIO_printf(bio_err,
                    468:                    "bad input format specified for input crl\n");
                    469:                goto end;
                    470:        }
                    471:        if (x == NULL) {
                    472:                BIO_printf(bio_err, "unable to load CRL\n");
                    473:                ERR_print_errors(bio_err);
                    474:                goto end;
                    475:        }
                    476:
1.11      jsing     477:  end:
1.1       jsing     478:        BIO_free(in);
                    479:        return (x);
                    480: }