- STACK_OF(X509_INFO) *sk=NULL;
- STACK_OF(X509) *stack=NULL, *ret=NULL;
- BIO *in=NULL;
- X509_INFO *xi;
-
- if(!(stack = sk_X509_new_null())) {
- BIO_printf(bio_err,"memory allocation failure\n");
- goto end;
- }
-
- if(!(in=BIO_new_file(certfile, "r"))) {
- BIO_printf(bio_err,"error opening the file, %s\n",certfile);
- goto end;
- }
-
- /* This loads from a file, a stack of x509/crl/pkey sets */
- if(!(sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL))) {
- BIO_printf(bio_err,"error reading the file, %s\n",certfile);
- goto end;
- }
-
- /* scan over it and pull out the certs */
- while (sk_X509_INFO_num(sk))
- {
- xi=sk_X509_INFO_shift(sk);
- if (xi->x509 != NULL)
- {
- sk_X509_push(stack,xi->x509);
- xi->x509=NULL;
- }
- X509_INFO_free(xi);
- }
- if(!sk_X509_num(stack)) {
- BIO_printf(bio_err,"no certificates in file, %s\n",certfile);
- sk_X509_free(stack);
- goto end;
- }
- ret=stack;
-end:
- BIO_free(in);
- sk_X509_INFO_free(sk);
- return(ret);
- }
-
-static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx)
- {
- int cert_error = X509_STORE_CTX_get_error(ctx);
- X509 *current_cert = X509_STORE_CTX_get_current_cert(ctx);
-
- if (!ok)
- {
- if (current_cert)
- {
- X509_NAME_print_ex_fp(stdout,
- X509_get_subject_name(current_cert),
- 0, XN_FLAG_ONELINE);
- printf("\n");
- }
- printf("error %d at %d depth lookup:%s\n",cert_error,
- X509_STORE_CTX_get_error_depth(ctx),
- X509_verify_cert_error_string(cert_error));
- switch(cert_error)
- {
- case X509_V_ERR_NO_EXPLICIT_POLICY:
- policies_print(NULL, ctx);
- case X509_V_ERR_CERT_HAS_EXPIRED:
-
- /* since we are just checking the certificates, it is
- * ok if they are self signed. But we should still warn
- * the user.
- */
-
- case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
- /* Continue after extension errors too */
- case X509_V_ERR_INVALID_CA:
- case X509_V_ERR_INVALID_NON_CA:
- case X509_V_ERR_PATH_LENGTH_EXCEEDED:
- case X509_V_ERR_INVALID_PURPOSE:
- case X509_V_ERR_CRL_HAS_EXPIRED:
- case X509_V_ERR_CRL_NOT_YET_VALID:
- case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
- ok = 1;
-
- }
-
- return ok;
-
- }
- if (cert_error == X509_V_OK && ok == 2)
- policies_print(NULL, ctx);
- if (!v_verbose)
- ERR_clear_error();
- return(ok);
- }
+ ENGINE *e = NULL;
+ STACK_OF(X509) *untrusted = NULL, *trusted = NULL;
+ STACK_OF(X509_CRL) *crls = NULL;
+ X509_STORE *store = NULL;
+ X509_VERIFY_PARAM *vpm = NULL;
+ char *prog, *CApath = NULL, *CAfile = NULL;
+ char *untfile = NULL, *trustfile = NULL, *crlfile = NULL;
+ int vpmtouched = 0, crl_download = 0, show_chain = 0, i = 0, ret = 1;
+ OPTION_CHOICE o;
+
+ if ((vpm = X509_VERIFY_PARAM_new()) == NULL)
+ goto end;
+
+ prog = opt_init(argc, argv, verify_options);
+ while ((o = opt_next()) != OPT_EOF) {
+ switch (o) {
+ case OPT_EOF:
+ case OPT_ERR:
+ BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
+ goto end;
+ case OPT_HELP:
+ opt_help(verify_options);
+ BIO_printf(bio_err, "Recognized usages:\n");
+ for (i = 0; i < X509_PURPOSE_get_count(); i++) {
+ X509_PURPOSE *ptmp;
+ ptmp = X509_PURPOSE_get0(i);
+ BIO_printf(bio_err, "\t%-10s\t%s\n",
+ X509_PURPOSE_get0_sname(ptmp),
+ X509_PURPOSE_get0_name(ptmp));
+ }
+
+ BIO_printf(bio_err, "Recognized verify names:\n");
+ for (i = 0; i < X509_VERIFY_PARAM_get_count(); i++) {
+ const X509_VERIFY_PARAM *vptmp;
+ vptmp = X509_VERIFY_PARAM_get0(i);
+ BIO_printf(bio_err, "\t%-10s\n",
+ X509_VERIFY_PARAM_get0_name(vptmp));
+ }
+ ret = 0;
+ goto end;
+ case OPT_V_CASES:
+ if (!opt_verify(o, vpm))
+ goto end;
+ vpmtouched++;
+ break;
+ case OPT_CAPATH:
+ CApath = opt_arg();
+ break;
+ case OPT_CAFILE:
+ CAfile = opt_arg();
+ break;
+ case OPT_UNTRUSTED:
+ untfile = opt_arg();
+ break;
+ case OPT_TRUSTED:
+ trustfile = opt_arg();
+ break;
+ case OPT_CRLFILE:
+ crlfile = opt_arg();
+ break;
+ case OPT_CRL_DOWNLOAD:
+ crl_download = 1;
+ break;
+ case OPT_SHOW_CHAIN:
+ show_chain = 1;
+ break;
+ case OPT_ENGINE:
+ e = setup_engine(opt_arg(), 0);
+ break;
+ case OPT_VERBOSE:
+ v_verbose = 1;
+ break;
+ }
+ }
+ argc = opt_num_rest();
+ argv = opt_rest();
+
+ if (!app_load_modules(NULL))
+ goto end;
+
+ if ((store = setup_verify(CAfile, CApath)) == NULL)
+ goto end;
+ X509_STORE_set_verify_cb(store, cb);
+
+ if (vpmtouched)
+ X509_STORE_set1_param(store, vpm);
+
+ ERR_clear_error();
+
+ if (untfile) {
+ untrusted = load_certs(untfile, FORMAT_PEM,
+ NULL, e, "untrusted certificates");
+ if (!untrusted)
+ goto end;
+ }
+
+ if (trustfile) {
+ trusted = load_certs(trustfile, FORMAT_PEM,
+ NULL, e, "trusted certificates");
+ if (!trusted)
+ goto end;
+ }
+
+ if (crlfile) {
+ crls = load_crls(crlfile, FORMAT_PEM, NULL, e, "other CRLs");
+ if (!crls)
+ goto end;
+ }
+
+ if (crl_download)
+ store_setup_crl_download(store);
+
+ ret = 0;
+ if (argc < 1) {
+ if (check(store, NULL, untrusted, trusted, crls, e, show_chain) != 1)
+ ret = -1;
+ } else {
+ for (i = 0; i < argc; i++)
+ if (check(store, argv[i], untrusted, trusted, crls, e,
+ show_chain) != 1)
+ ret = -1;
+ }
+
+ end:
+ X509_VERIFY_PARAM_free(vpm);
+ X509_STORE_free(store);
+ sk_X509_pop_free(untrusted, X509_free);
+ sk_X509_pop_free(trusted, X509_free);
+ sk_X509_CRL_pop_free(crls, X509_CRL_free);
+ return (ret < 0 ? 2 : ret);
+}
+
+static int check(X509_STORE *ctx, char *file,
+ STACK_OF(X509) *uchain, STACK_OF(X509) *tchain,
+ STACK_OF(X509_CRL) *crls, ENGINE *e, int show_chain)
+{
+ X509 *x = NULL;
+ int i = 0, ret = 0;
+ X509_STORE_CTX *csc;
+ STACK_OF(X509) *chain = NULL;
+
+ x = load_cert(file, FORMAT_PEM, NULL, e, "certificate file");
+ if (x == NULL)
+ goto end;
+ printf("%s: ", (file == NULL) ? "stdin" : file);
+
+ csc = X509_STORE_CTX_new();
+ if (csc == NULL) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ X509_STORE_set_flags(ctx, vflags);
+ if (!X509_STORE_CTX_init(csc, ctx, x, uchain)) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (tchain)
+ X509_STORE_CTX_trusted_stack(csc, tchain);
+ if (crls)
+ X509_STORE_CTX_set0_crls(csc, crls);
+ i = X509_verify_cert(csc);
+ if (i > 0 && show_chain)
+ chain = X509_STORE_CTX_get1_chain(csc);
+ X509_STORE_CTX_free(csc);
+
+ ret = 0;
+ end:
+ if (i > 0) {
+ printf("OK\n");
+ ret = 1;
+ } else
+ ERR_print_errors(bio_err);
+ if (chain) {
+ printf("Chain:\n");
+ for (i = 0; i < sk_X509_num(chain); i++) {
+ X509 *cert = sk_X509_value(chain, i);
+ printf("depth=%d: ", i);
+ X509_NAME_print_ex_fp(stdout,
+ X509_get_subject_name(cert),
+ 0, XN_FLAG_ONELINE);
+ printf("\n");
+ }
+ sk_X509_pop_free(chain, X509_free);
+ }
+ X509_free(x);
+
+ return (ret);
+}
+
+static int cb(int ok, X509_STORE_CTX *ctx)
+{
+ int cert_error = X509_STORE_CTX_get_error(ctx);
+ X509 *current_cert = X509_STORE_CTX_get_current_cert(ctx);
+
+ if (!ok) {
+ if (current_cert) {
+ X509_NAME_print_ex(bio_err,
+ X509_get_subject_name(current_cert),
+ 0, XN_FLAG_ONELINE);
+ BIO_printf(bio_err, "\n");
+ }
+ BIO_printf(bio_err, "%serror %d at %d depth lookup:%s\n",
+ X509_STORE_CTX_get0_parent_ctx(ctx) ? "[CRL path]" : "",
+ cert_error,
+ X509_STORE_CTX_get_error_depth(ctx),
+ X509_verify_cert_error_string(cert_error));
+ switch (cert_error) {
+ case X509_V_ERR_NO_EXPLICIT_POLICY:
+ policies_print(ctx);
+ case X509_V_ERR_CERT_HAS_EXPIRED:
+
+ /*
+ * since we are just checking the certificates, it is ok if they
+ * are self signed. But we should still warn the user.
+ */
+ case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
+ /* Continue after extension errors too */
+ case X509_V_ERR_INVALID_CA:
+ case X509_V_ERR_INVALID_NON_CA:
+ case X509_V_ERR_PATH_LENGTH_EXCEEDED:
+ case X509_V_ERR_INVALID_PURPOSE:
+ case X509_V_ERR_CRL_HAS_EXPIRED:
+ case X509_V_ERR_CRL_NOT_YET_VALID:
+ case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
+ ok = 1;
+ }
+
+ return ok;
+
+ }
+ if (cert_error == X509_V_OK && ok == 2)
+ policies_print(ctx);
+ if (!v_verbose)
+ ERR_clear_error();
+ return (ok);
+}