1 /* 2 * Copyright 1999-2018 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <stdio.h> 11 #include <stdlib.h> 12 #include <string.h> 13 #include <time.h> 14 #include "apps.h" 15 #include "progs.h" 16 #include <openssl/bio.h> 17 #include <openssl/conf.h> 18 #include <openssl/err.h> 19 #include <openssl/evp.h> 20 #include <openssl/x509.h> 21 #include <openssl/pem.h> 22 23 typedef enum OPTION_choice { 24 OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, 25 OPT_NOOUT, OPT_PUBKEY, OPT_VERIFY, OPT_IN, OPT_OUT, 26 OPT_ENGINE, OPT_KEY, OPT_CHALLENGE, OPT_PASSIN, OPT_SPKAC, 27 OPT_SPKSECT, OPT_KEYFORM 28 } OPTION_CHOICE; 29 30 const OPTIONS spkac_options[] = { 31 {"help", OPT_HELP, '-', "Display this summary"}, 32 {"in", OPT_IN, '<', "Input file"}, 33 {"out", OPT_OUT, '>', "Output file"}, 34 {"key", OPT_KEY, '<', "Create SPKAC using private key"}, 35 {"keyform", OPT_KEYFORM, 'f', "Private key file format - default PEM (PEM, DER, or ENGINE)"}, 36 {"passin", OPT_PASSIN, 's', "Input file pass phrase source"}, 37 {"challenge", OPT_CHALLENGE, 's', "Challenge string"}, 38 {"spkac", OPT_SPKAC, 's', "Alternative SPKAC name"}, 39 {"noout", OPT_NOOUT, '-', "Don't print SPKAC"}, 40 {"pubkey", OPT_PUBKEY, '-', "Output public key"}, 41 {"verify", OPT_VERIFY, '-', "Verify SPKAC signature"}, 42 {"spksect", OPT_SPKSECT, 's', 43 "Specify the name of an SPKAC-dedicated section of configuration"}, 44 #ifndef OPENSSL_NO_ENGINE 45 {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, 46 #endif 47 {NULL} 48 }; 49 50 int spkac_main(int argc, char **argv) 51 { 52 BIO *out = NULL; 53 CONF *conf = NULL; 54 ENGINE *e = NULL; 55 EVP_PKEY *pkey = NULL; 56 NETSCAPE_SPKI *spki = NULL; 57 char *challenge = NULL, *keyfile = NULL; 58 char *infile = NULL, *outfile = NULL, *passinarg = NULL, *passin = NULL; 59 char *spkstr = NULL, *prog; 60 const char *spkac = "SPKAC", *spksect = "default"; 61 int i, ret = 1, verify = 0, noout = 0, pubkey = 0; 62 int keyformat = FORMAT_PEM; 63 OPTION_CHOICE o; 64 65 prog = opt_init(argc, argv, spkac_options); 66 while ((o = opt_next()) != OPT_EOF) { 67 switch (o) { 68 case OPT_EOF: 69 case OPT_ERR: 70 opthelp: 71 BIO_printf(bio_err, "%s: Use -help for summary.\n", prog); 72 goto end; 73 case OPT_HELP: 74 opt_help(spkac_options); 75 ret = 0; 76 goto end; 77 case OPT_IN: 78 infile = opt_arg(); 79 break; 80 case OPT_OUT: 81 outfile = opt_arg(); 82 break; 83 case OPT_NOOUT: 84 noout = 1; 85 break; 86 case OPT_PUBKEY: 87 pubkey = 1; 88 break; 89 case OPT_VERIFY: 90 verify = 1; 91 break; 92 case OPT_PASSIN: 93 passinarg = opt_arg(); 94 break; 95 case OPT_KEY: 96 keyfile = opt_arg(); 97 break; 98 case OPT_KEYFORM: 99 if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyformat)) 100 goto opthelp; 101 break; 102 case OPT_CHALLENGE: 103 challenge = opt_arg(); 104 break; 105 case OPT_SPKAC: 106 spkac = opt_arg(); 107 break; 108 case OPT_SPKSECT: 109 spksect = opt_arg(); 110 break; 111 case OPT_ENGINE: 112 e = setup_engine(opt_arg(), 0); 113 break; 114 } 115 } 116 argc = opt_num_rest(); 117 if (argc != 0) 118 goto opthelp; 119 120 if (!app_passwd(passinarg, NULL, &passin, NULL)) { 121 BIO_printf(bio_err, "Error getting password\n"); 122 goto end; 123 } 124 125 if (keyfile != NULL) { 126 pkey = load_key(strcmp(keyfile, "-") ? keyfile : NULL, 127 keyformat, 1, passin, e, "private key"); 128 if (pkey == NULL) 129 goto end; 130 spki = NETSCAPE_SPKI_new(); 131 if (spki == NULL) 132 goto end; 133 if (challenge != NULL) 134 ASN1_STRING_set(spki->spkac->challenge, 135 challenge, (int)strlen(challenge)); 136 NETSCAPE_SPKI_set_pubkey(spki, pkey); 137 NETSCAPE_SPKI_sign(spki, pkey, EVP_md5()); 138 spkstr = NETSCAPE_SPKI_b64_encode(spki); 139 if (spkstr == NULL) 140 goto end; 141 142 out = bio_open_default(outfile, 'w', FORMAT_TEXT); 143 if (out == NULL) { 144 OPENSSL_free(spkstr); 145 goto end; 146 } 147 BIO_printf(out, "SPKAC=%s\n", spkstr); 148 OPENSSL_free(spkstr); 149 ret = 0; 150 goto end; 151 } 152 153 if ((conf = app_load_config(infile)) == NULL) 154 goto end; 155 156 spkstr = NCONF_get_string(conf, spksect, spkac); 157 158 if (spkstr == NULL) { 159 BIO_printf(bio_err, "Can't find SPKAC called \"%s\"\n", spkac); 160 ERR_print_errors(bio_err); 161 goto end; 162 } 163 164 spki = NETSCAPE_SPKI_b64_decode(spkstr, -1); 165 166 if (spki == NULL) { 167 BIO_printf(bio_err, "Error loading SPKAC\n"); 168 ERR_print_errors(bio_err); 169 goto end; 170 } 171 172 out = bio_open_default(outfile, 'w', FORMAT_TEXT); 173 if (out == NULL) 174 goto end; 175 176 if (!noout) 177 NETSCAPE_SPKI_print(out, spki); 178 pkey = NETSCAPE_SPKI_get_pubkey(spki); 179 if (verify) { 180 i = NETSCAPE_SPKI_verify(spki, pkey); 181 if (i > 0) { 182 BIO_printf(bio_err, "Signature OK\n"); 183 } else { 184 BIO_printf(bio_err, "Signature Failure\n"); 185 ERR_print_errors(bio_err); 186 goto end; 187 } 188 } 189 if (pubkey) 190 PEM_write_bio_PUBKEY(out, pkey); 191 192 ret = 0; 193 194 end: 195 NCONF_free(conf); 196 NETSCAPE_SPKI_free(spki); 197 BIO_free_all(out); 198 EVP_PKEY_free(pkey); 199 release_engine(e); 200 OPENSSL_free(passin); 201 return ret; 202 } 203