/* apps/crl.c */
-/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
#include <stdlib.h>
#include <string.h>
#include "apps.h"
-#include "bio.h"
-#include "err.h"
-#include "x509.h"
-#include "pem.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+#include <openssl/pem.h>
#undef PROG
#define PROG crl_main
#undef POSTFIX
#define POSTFIX ".rvk"
-#define FORMAT_UNDEF 0
-#define FORMAT_ASN1 1
-#define FORMAT_TEXT 2
-#define FORMAT_PEM 3
-
static char *crl_usage[]={
"usage: crl args\n",
"\n",
-" -inform arg - input format - default PEM (one of DER, TXT or PEM)\n",
+" -inform arg - input format - default PEM (DER or PEM)\n",
" -outform arg - output format - default PEM\n",
" -text - print out a text format version\n",
" -in arg - input file - default stdin\n",
" -lastupdate - lastUpdate field\n",
" -nextupdate - nextUpdate field\n",
" -noout - no CRL output\n",
+" -CAfile name - verify CRL using certificates in file \"name\"\n",
+" -CApath dir - verify CRL using certificates in \"dir\"\n",
NULL
};
-#ifndef NOPROTO
static X509_CRL *load_crl(char *file, int format);
-#else
-static X509_CRL *load_crl();
-#endif
-
static BIO *bio_out=NULL;
-int MAIN(argc, argv)
-int argc;
-char **argv;
+int MAIN(int, char **);
+
+int MAIN(int argc, char **argv)
{
X509_CRL *x=NULL;
+ char *CAfile = NULL, *CApath = NULL;
int ret=1,i,num,badops=0;
BIO *out=NULL;
int informat,outformat;
char *infile=NULL,*outfile=NULL;
- char *str=NULL;
- int hash=0,issuer=0,lastupdate=0,nextupdate=0,noout=0;
+ int hash=0,issuer=0,lastupdate=0,nextupdate=0,noout=0,text=0;
+ int fingerprint = 0;
char **pp,buf[256];
+ X509_STORE *store = NULL;
+ X509_STORE_CTX ctx;
+ X509_LOOKUP *lookup = NULL;
+ X509_OBJECT xobj;
+ EVP_PKEY *pkey;
+ int do_ver = 0;
+ const EVP_MD *md_alg,*digest=EVP_md5();
apps_startup();
if (bio_err == NULL)
if ((bio_err=BIO_new(BIO_s_file())) != NULL)
- BIO_set_fp(bio_err,stderr,BIO_NOCLOSE);
+ BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
if (bio_out == NULL)
if ((bio_out=BIO_new(BIO_s_file())) != NULL)
if (--argc < 1) goto bad;
outformat=str2fmt(*(++argv));
}
- else if (strcmp(*argv,"-text") == 0)
- {
- outformat=FORMAT_TEXT;
- }
else if (strcmp(*argv,"-in") == 0)
{
if (--argc < 1) goto bad;
if (--argc < 1) goto bad;
outfile= *(++argv);
}
+ else if (strcmp(*argv,"-CApath") == 0)
+ {
+ if (--argc < 1) goto bad;
+ CApath = *(++argv);
+ do_ver = 1;
+ }
+ else if (strcmp(*argv,"-CAfile") == 0)
+ {
+ if (--argc < 1) goto bad;
+ CAfile = *(++argv);
+ do_ver = 1;
+ }
+ else if (strcmp(*argv,"-verify") == 0)
+ do_ver = 1;
+ else if (strcmp(*argv,"-text") == 0)
+ text = 1;
else if (strcmp(*argv,"-hash") == 0)
hash= ++num;
else if (strcmp(*argv,"-issuer") == 0)
nextupdate= ++num;
else if (strcmp(*argv,"-noout") == 0)
noout= ++num;
+ else if (strcmp(*argv,"-fingerprint") == 0)
+ fingerprint= ++num;
+ else if ((md_alg=EVP_get_digestbyname(*argv + 1)))
+ {
+ /* ok */
+ digest=md_alg;
+ }
else
{
BIO_printf(bio_err,"unknown option %s\n",*argv);
argv++;
}
- if (outformat == FORMAT_TEXT)
- {
- num=0;
- issuer= ++num;
- lastupdate= ++num;
- nextupdate= ++num;
- }
-
if (badops)
{
bad:
x=load_crl(infile,informat);
if (x == NULL) { goto end; }
+ if(do_ver) {
+ store = X509_STORE_new();
+ lookup=X509_STORE_add_lookup(store,X509_LOOKUP_file());
+ if (lookup == NULL) goto end;
+ if (!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM))
+ X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
+
+ lookup=X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir());
+ if (lookup == NULL) goto end;
+ if (!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM))
+ X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
+ ERR_clear_error();
+
+ X509_STORE_CTX_init(&ctx, store, NULL, NULL);
+
+ i = X509_STORE_get_by_subject(&ctx, X509_LU_X509,
+ X509_CRL_get_issuer(x), &xobj);
+ if(i <= 0) {
+ BIO_printf(bio_err,
+ "Error getting CRL issuer certificate\n");
+ goto end;
+ }
+ pkey = X509_get_pubkey(xobj.data.x509);
+ X509_OBJECT_free_contents(&xobj);
+ if(!pkey) {
+ BIO_printf(bio_err,
+ "Error getting CRL issuer public key\n");
+ goto end;
+ }
+ i = X509_CRL_verify(x, pkey);
+ EVP_PKEY_free(pkey);
+ if(i < 0) goto end;
+ if(i == 0) BIO_printf(bio_err, "verify failure\n");
+ else BIO_printf(bio_err, "verify OK\n");
+ }
+
if (num)
{
for (i=1; i<=num; i++)
{
if (issuer == i)
{
- X509_NAME_oneline(x->crl->issuer,buf,256);
- fprintf(stdout,"issuer= %s\n",str);
+ X509_NAME_oneline(X509_CRL_get_issuer(x),
+ buf,256);
+ BIO_printf(bio_out,"issuer= %s\n",buf);
}
if (hash == i)
{
- fprintf(stdout,"%08lx\n",
- X509_NAME_hash(x->crl->issuer));
+ BIO_printf(bio_out,"%08lx\n",
+ X509_NAME_hash(X509_CRL_get_issuer(x)));
}
if (lastupdate == i)
{
- fprintf(stdout,"lastUpdate=");
- ASN1_UTCTIME_print(bio_out,x->crl->lastUpdate);
- fprintf(stdout,"\n");
+ BIO_printf(bio_out,"lastUpdate=");
+ ASN1_TIME_print(bio_out,
+ X509_CRL_get_lastUpdate(x));
+ BIO_printf(bio_out,"\n");
}
if (nextupdate == i)
{
- fprintf(stdout,"nextUpdate=");
- ASN1_UTCTIME_print(bio_out,x->crl->nextUpdate);
- fprintf(stdout,"\n");
+ BIO_printf(bio_out,"nextUpdate=");
+ if (X509_CRL_get_nextUpdate(x))
+ ASN1_TIME_print(bio_out,
+ X509_CRL_get_nextUpdate(x));
+ else
+ BIO_printf(bio_out,"NONE");
+ BIO_printf(bio_out,"\n");
+ }
+ if (fingerprint == i)
+ {
+ int j;
+ unsigned int n;
+ unsigned char md[EVP_MAX_MD_SIZE];
+
+ if (!X509_CRL_digest(x,digest,md,&n))
+ {
+ BIO_printf(bio_err,"out of memory\n");
+ goto end;
+ }
+ BIO_printf(bio_out,"%s Fingerprint=",
+ OBJ_nid2sn(EVP_MD_type(digest)));
+ for (j=0; j<(int)n; j++)
+ {
+ BIO_printf(bio_out,"%02X%c",md[j],
+ (j+1 == (int)n)
+ ?'\n':':');
+ }
}
}
}
- if (noout) goto end;
-
out=BIO_new(BIO_s_file());
if (out == NULL)
{
}
}
+ if (text) X509_CRL_print(out, x);
+
+ if (noout) goto end;
+
if (outformat == FORMAT_ASN1)
i=(int)i2d_X509_CRL_bio(out,x);
else if (outformat == FORMAT_PEM)
i=PEM_write_bio_X509_CRL(out,x);
- else if (outformat == FORMAT_TEXT)
- {
- X509_REVOKED *r;
-
- while ((r=(X509_REVOKED *)sk_pop(x->crl->revoked)) != NULL)
- {
- fprintf(stdout,"revoked: serialNumber=");
- i2a_ASN1_INTEGER(out,r->serialNumber);
- fprintf(stdout," revocationDate=");
- ASN1_UTCTIME_print(bio_out,r->revocationDate);
- fprintf(stdout,"\n");
- }
- i=1;
- }
else
{
BIO_printf(bio_err,"bad output format specified for outfile\n");
if (!i) { BIO_printf(bio_err,"unable to write CRL\n"); goto end; }
ret=0;
end:
- if (out != NULL) BIO_free(out);
- if (bio_out != NULL) BIO_free(bio_out);
- if (x != NULL) X509_CRL_free(x);
+ BIO_free(out);
+ BIO_free(bio_out);
+ bio_out=NULL;
+ X509_CRL_free(x);
+ if(store) {
+ X509_STORE_CTX_cleanup(&ctx);
+ X509_STORE_free(store);
+ }
EXIT(ret);
}
-static X509_CRL *load_crl(infile, format)
-char *infile;
-int format;
+static X509_CRL *load_crl(char *infile, int format)
{
X509_CRL *x=NULL;
BIO *in=NULL;
if (format == FORMAT_ASN1)
x=d2i_X509_CRL_bio(in,NULL);
else if (format == FORMAT_PEM)
- x=PEM_read_bio_X509_CRL(in,NULL,NULL);
+ x=PEM_read_bio_X509_CRL(in,NULL,NULL,NULL);
else {
BIO_printf(bio_err,"bad input format specified for input crl\n");
goto end;
}
end:
- if (in != NULL) BIO_free(in);
+ BIO_free(in);
return(x);
}
projects / openssl.git / blobdiff