xref: /freebsd/crypto/openssl/apps/crl.c (revision 74bf4e164ba5851606a27d4feff27717452583e5)
1 /* apps/crl.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  *
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  *
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  *
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  *
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58 
59 #include <stdio.h>
60 #include <stdlib.h>
61 #include <string.h>
62 #include "apps.h"
63 #include <openssl/bio.h>
64 #include <openssl/err.h>
65 #include <openssl/x509.h>
66 #include <openssl/x509v3.h>
67 #include <openssl/pem.h>
68 
69 #undef PROG
70 #define PROG	crl_main
71 
72 #undef POSTFIX
73 #define	POSTFIX	".rvk"
74 
75 static char *crl_usage[]={
76 "usage: crl args\n",
77 "\n",
78 " -inform arg     - input format - default PEM (DER or PEM)\n",
79 " -outform arg    - output format - default PEM\n",
80 " -text           - print out a text format version\n",
81 " -in arg         - input file - default stdin\n",
82 " -out arg        - output file - default stdout\n",
83 " -hash           - print hash value\n",
84 " -fingerprint    - print the crl fingerprint\n",
85 " -issuer         - print issuer DN\n",
86 " -lastupdate     - lastUpdate field\n",
87 " -nextupdate     - nextUpdate field\n",
88 " -noout          - no CRL output\n",
89 " -CAfile  name   - verify CRL using certificates in file \"name\"\n",
90 " -CApath  dir    - verify CRL using certificates in \"dir\"\n",
91 " -nameopt arg    - various certificate name options\n",
92 NULL
93 };
94 
95 static X509_CRL *load_crl(char *file, int format);
96 static BIO *bio_out=NULL;
97 
98 int MAIN(int, char **);
99 
100 int MAIN(int argc, char **argv)
101 	{
102 	unsigned long nmflag = 0;
103 	X509_CRL *x=NULL;
104 	char *CAfile = NULL, *CApath = NULL;
105 	int ret=1,i,num,badops=0;
106 	BIO *out=NULL;
107 	int informat,outformat;
108 	char *infile=NULL,*outfile=NULL;
109 	int hash=0,issuer=0,lastupdate=0,nextupdate=0,noout=0,text=0;
110 	int fingerprint = 0;
111 	char **pp;
112 	X509_STORE *store = NULL;
113 	X509_STORE_CTX ctx;
114 	X509_LOOKUP *lookup = NULL;
115 	X509_OBJECT xobj;
116 	EVP_PKEY *pkey;
117 	int do_ver = 0;
118 	const EVP_MD *md_alg,*digest=EVP_md5();
119 
120 	apps_startup();
121 
122 	if (bio_err == NULL)
123 		if ((bio_err=BIO_new(BIO_s_file())) != NULL)
124 			BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
125 
126 	if (!load_config(bio_err, NULL))
127 		goto end;
128 
129 	if (bio_out == NULL)
130 		if ((bio_out=BIO_new(BIO_s_file())) != NULL)
131 			{
132 			BIO_set_fp(bio_out,stdout,BIO_NOCLOSE);
133 #ifdef OPENSSL_SYS_VMS
134 			{
135 			BIO *tmpbio = BIO_new(BIO_f_linebuffer());
136 			bio_out = BIO_push(tmpbio, bio_out);
137 			}
138 #endif
139 			}
140 
141 	informat=FORMAT_PEM;
142 	outformat=FORMAT_PEM;
143 
144 	argc--;
145 	argv++;
146 	num=0;
147 	while (argc >= 1)
148 		{
149 #ifdef undef
150 		if	(strcmp(*argv,"-p") == 0)
151 			{
152 			if (--argc < 1) goto bad;
153 			if (!args_from_file(++argv,Nargc,Nargv)) { goto end; }*/
154 			}
155 #endif
156 		if 	(strcmp(*argv,"-inform") == 0)
157 			{
158 			if (--argc < 1) goto bad;
159 			informat=str2fmt(*(++argv));
160 			}
161 		else if (strcmp(*argv,"-outform") == 0)
162 			{
163 			if (--argc < 1) goto bad;
164 			outformat=str2fmt(*(++argv));
165 			}
166 		else if (strcmp(*argv,"-in") == 0)
167 			{
168 			if (--argc < 1) goto bad;
169 			infile= *(++argv);
170 			}
171 		else if (strcmp(*argv,"-out") == 0)
172 			{
173 			if (--argc < 1) goto bad;
174 			outfile= *(++argv);
175 			}
176 		else if (strcmp(*argv,"-CApath") == 0)
177 			{
178 			if (--argc < 1) goto bad;
179 			CApath = *(++argv);
180 			do_ver = 1;
181 			}
182 		else if (strcmp(*argv,"-CAfile") == 0)
183 			{
184 			if (--argc < 1) goto bad;
185 			CAfile = *(++argv);
186 			do_ver = 1;
187 			}
188 		else if (strcmp(*argv,"-verify") == 0)
189 			do_ver = 1;
190 		else if (strcmp(*argv,"-text") == 0)
191 			text = 1;
192 		else if (strcmp(*argv,"-hash") == 0)
193 			hash= ++num;
194 		else if (strcmp(*argv,"-nameopt") == 0)
195 			{
196 			if (--argc < 1) goto bad;
197 			if (!set_name_ex(&nmflag, *(++argv))) goto bad;
198 			}
199 		else if (strcmp(*argv,"-issuer") == 0)
200 			issuer= ++num;
201 		else if (strcmp(*argv,"-lastupdate") == 0)
202 			lastupdate= ++num;
203 		else if (strcmp(*argv,"-nextupdate") == 0)
204 			nextupdate= ++num;
205 		else if (strcmp(*argv,"-noout") == 0)
206 			noout= ++num;
207 		else if (strcmp(*argv,"-fingerprint") == 0)
208 			fingerprint= ++num;
209 		else if ((md_alg=EVP_get_digestbyname(*argv + 1)))
210 			{
211 			/* ok */
212 			digest=md_alg;
213 			}
214 		else
215 			{
216 			BIO_printf(bio_err,"unknown option %s\n",*argv);
217 			badops=1;
218 			break;
219 			}
220 		argc--;
221 		argv++;
222 		}
223 
224 	if (badops)
225 		{
226 bad:
227 		for (pp=crl_usage; (*pp != NULL); pp++)
228 			BIO_printf(bio_err,"%s",*pp);
229 		goto end;
230 		}
231 
232 	ERR_load_crypto_strings();
233 	x=load_crl(infile,informat);
234 	if (x == NULL) { goto end; }
235 
236 	if(do_ver) {
237 		store = X509_STORE_new();
238 		lookup=X509_STORE_add_lookup(store,X509_LOOKUP_file());
239 		if (lookup == NULL) goto end;
240 		if (!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM))
241 			X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
242 
243 		lookup=X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir());
244 		if (lookup == NULL) goto end;
245 		if (!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM))
246 			X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
247 		ERR_clear_error();
248 
249 		if(!X509_STORE_CTX_init(&ctx, store, NULL, NULL)) {
250 			BIO_printf(bio_err,
251 				"Error initialising X509 store\n");
252 			goto end;
253 		}
254 
255 		i = X509_STORE_get_by_subject(&ctx, X509_LU_X509,
256 					X509_CRL_get_issuer(x), &xobj);
257 		if(i <= 0) {
258 			BIO_printf(bio_err,
259 				"Error getting CRL issuer certificate\n");
260 			goto end;
261 		}
262 		pkey = X509_get_pubkey(xobj.data.x509);
263 		X509_OBJECT_free_contents(&xobj);
264 		if(!pkey) {
265 			BIO_printf(bio_err,
266 				"Error getting CRL issuer public key\n");
267 			goto end;
268 		}
269 		i = X509_CRL_verify(x, pkey);
270 		EVP_PKEY_free(pkey);
271 		if(i < 0) goto end;
272 		if(i == 0) BIO_printf(bio_err, "verify failure\n");
273 		else BIO_printf(bio_err, "verify OK\n");
274 	}
275 
276 	if (num)
277 		{
278 		for (i=1; i<=num; i++)
279 			{
280 			if (issuer == i)
281 				{
282 				print_name(bio_out, "issuer=", X509_CRL_get_issuer(x), nmflag);
283 				}
284 
285 			if (hash == i)
286 				{
287 				BIO_printf(bio_out,"%08lx\n",
288 					X509_NAME_hash(X509_CRL_get_issuer(x)));
289 				}
290 			if (lastupdate == i)
291 				{
292 				BIO_printf(bio_out,"lastUpdate=");
293 				ASN1_TIME_print(bio_out,
294 						X509_CRL_get_lastUpdate(x));
295 				BIO_printf(bio_out,"\n");
296 				}
297 			if (nextupdate == i)
298 				{
299 				BIO_printf(bio_out,"nextUpdate=");
300 				if (X509_CRL_get_nextUpdate(x))
301 					ASN1_TIME_print(bio_out,
302 						X509_CRL_get_nextUpdate(x));
303 				else
304 					BIO_printf(bio_out,"NONE");
305 				BIO_printf(bio_out,"\n");
306 				}
307 			if (fingerprint == i)
308 				{
309 				int j;
310 				unsigned int n;
311 				unsigned char md[EVP_MAX_MD_SIZE];
312 
313 				if (!X509_CRL_digest(x,digest,md,&n))
314 					{
315 					BIO_printf(bio_err,"out of memory\n");
316 					goto end;
317 					}
318 				BIO_printf(bio_out,"%s Fingerprint=",
319 						OBJ_nid2sn(EVP_MD_type(digest)));
320 				for (j=0; j<(int)n; j++)
321 					{
322 					BIO_printf(bio_out,"%02X%c",md[j],
323 						(j+1 == (int)n)
324 						?'\n':':');
325 					}
326 				}
327 			}
328 		}
329 
330 	out=BIO_new(BIO_s_file());
331 	if (out == NULL)
332 		{
333 		ERR_print_errors(bio_err);
334 		goto end;
335 		}
336 
337 	if (outfile == NULL)
338 		{
339 		BIO_set_fp(out,stdout,BIO_NOCLOSE);
340 #ifdef OPENSSL_SYS_VMS
341 		{
342 		BIO *tmpbio = BIO_new(BIO_f_linebuffer());
343 		out = BIO_push(tmpbio, out);
344 		}
345 #endif
346 		}
347 	else
348 		{
349 		if (BIO_write_filename(out,outfile) <= 0)
350 			{
351 			perror(outfile);
352 			goto end;
353 			}
354 		}
355 
356 	if (text) X509_CRL_print(out, x);
357 
358 	if (noout) goto end;
359 
360 	if 	(outformat == FORMAT_ASN1)
361 		i=(int)i2d_X509_CRL_bio(out,x);
362 	else if (outformat == FORMAT_PEM)
363 		i=PEM_write_bio_X509_CRL(out,x);
364 	else
365 		{
366 		BIO_printf(bio_err,"bad output format specified for outfile\n");
367 		goto end;
368 		}
369 	if (!i) { BIO_printf(bio_err,"unable to write CRL\n"); goto end; }
370 	ret=0;
371 end:
372 	BIO_free_all(out);
373 	BIO_free_all(bio_out);
374 	bio_out=NULL;
375 	X509_CRL_free(x);
376 	if(store) {
377 		X509_STORE_CTX_cleanup(&ctx);
378 		X509_STORE_free(store);
379 	}
380 	apps_shutdown();
381 	OPENSSL_EXIT(ret);
382 	}
383 
384 static X509_CRL *load_crl(char *infile, int format)
385 	{
386 	X509_CRL *x=NULL;
387 	BIO *in=NULL;
388 
389 	in=BIO_new(BIO_s_file());
390 	if (in == NULL)
391 		{
392 		ERR_print_errors(bio_err);
393 		goto end;
394 		}
395 
396 	if (infile == NULL)
397 		BIO_set_fp(in,stdin,BIO_NOCLOSE);
398 	else
399 		{
400 		if (BIO_read_filename(in,infile) <= 0)
401 			{
402 			perror(infile);
403 			goto end;
404 			}
405 		}
406 	if 	(format == FORMAT_ASN1)
407 		x=d2i_X509_CRL_bio(in,NULL);
408 	else if (format == FORMAT_PEM)
409 		x=PEM_read_bio_X509_CRL(in,NULL,NULL,NULL);
410 	else	{
411 		BIO_printf(bio_err,"bad input format specified for input crl\n");
412 		goto end;
413 		}
414 	if (x == NULL)
415 		{
416 		BIO_printf(bio_err,"unable to load CRL\n");
417 		ERR_print_errors(bio_err);
418 		goto end;
419 		}
420 
421 end:
422 	BIO_free(in);
423 	return(x);
424 	}
425 
426