add option to get a certificate or CRL from a URL
[openssl.git] / apps / crl.c
index 9bab031..888cf7f 100644 (file)
 #undef POSTFIX
 #define        POSTFIX ".rvk"
 
-static char *crl_usage[]={
+static const char *crl_usage[]={
 "usage: crl args\n",
 "\n",
-" -inform arg     - input format - default PEM (one of DER, TXT or PEM)\n",
+" -inform arg     - input format - default PEM (DER or PEM)\n",
 " -outform arg    - output format - default PEM\n",
 " -text           - print out a text format version\n",
 " -in arg         - input file - default stdin\n",
 " -out arg        - output file - default stdout\n",
 " -hash           - print hash value\n",
+" -fingerprint    - print the crl fingerprint\n",
 " -issuer         - print issuer DN\n",
 " -lastupdate     - lastUpdate field\n",
 " -nextupdate     - nextUpdate field\n",
+" -crlnumber      - print CRL number\n",
 " -noout          - no CRL output\n",
 " -CAfile  name   - verify CRL using certificates in file \"name\"\n",
 " -CApath  dir    - verify CRL using certificates in \"dir\"\n",
+" -nameopt arg    - various certificate name options\n",
 NULL
 };
 
 static X509_CRL *load_crl(char *file, int format);
 static BIO *bio_out=NULL;
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
        {
+       unsigned long nmflag = 0;
        X509_CRL *x=NULL;
        char *CAfile = NULL, *CApath = NULL;
        int ret=1,i,num,badops=0;
@@ -102,13 +108,15 @@ int MAIN(int argc, char **argv)
        int informat,outformat;
        char *infile=NULL,*outfile=NULL;
        int hash=0,issuer=0,lastupdate=0,nextupdate=0,noout=0,text=0;
-       char **pp,buf[256];
+       int fingerprint = 0, crlnumber = 0;
+       const char **pp;
        X509_STORE *store = NULL;
        X509_STORE_CTX ctx;
        X509_LOOKUP *lookup = NULL;
        X509_OBJECT xobj;
        EVP_PKEY *pkey;
        int do_ver = 0;
+       const EVP_MD *md_alg,*digest=EVP_sha1();
 
        apps_startup();
 
@@ -116,9 +124,20 @@ int MAIN(int argc, char **argv)
                if ((bio_err=BIO_new(BIO_s_file())) != NULL)
                        BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 
+       if (!load_config(bio_err, NULL))
+               goto end;
+
        if (bio_out == NULL)
                if ((bio_out=BIO_new(BIO_s_file())) != NULL)
+                       {
                        BIO_set_fp(bio_out,stdout,BIO_NOCLOSE);
+#ifdef OPENSSL_SYS_VMS
+                       {
+                       BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+                       bio_out = BIO_push(tmpbio, bio_out);
+                       }
+#endif
+                       }
 
        informat=FORMAT_PEM;
        outformat=FORMAT_PEM;
@@ -173,6 +192,11 @@ int MAIN(int argc, char **argv)
                        text = 1;
                else if (strcmp(*argv,"-hash") == 0)
                        hash= ++num;
+               else if (strcmp(*argv,"-nameopt") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       if (!set_name_ex(&nmflag, *(++argv))) goto bad;
+                       }
                else if (strcmp(*argv,"-issuer") == 0)
                        issuer= ++num;
                else if (strcmp(*argv,"-lastupdate") == 0)
@@ -181,6 +205,15 @@ int MAIN(int argc, char **argv)
                        nextupdate= ++num;
                else if (strcmp(*argv,"-noout") == 0)
                        noout= ++num;
+               else if (strcmp(*argv,"-fingerprint") == 0)
+                       fingerprint= ++num;
+               else if (strcmp(*argv,"-crlnumber") == 0)
+                       crlnumber= ++num;
+               else if ((md_alg=EVP_get_digestbyname(*argv + 1)))
+                       {
+                       /* ok */
+                       digest=md_alg;
+                       }
                else
                        {
                        BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -195,12 +228,11 @@ int MAIN(int argc, char **argv)
                {
 bad:
                for (pp=crl_usage; (*pp != NULL); pp++)
-                       BIO_printf(bio_err,*pp);
+                       BIO_printf(bio_err,"%s",*pp);
                goto end;
                }
 
        ERR_load_crypto_strings();
-       X509V3_add_standard_extensions();
        x=load_crl(infile,informat);
        if (x == NULL) { goto end; }
 
@@ -217,7 +249,11 @@ bad:
                        X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
                ERR_clear_error();
 
-               X509_STORE_CTX_init(&ctx, store, NULL, NULL);
+               if(!X509_STORE_CTX_init(&ctx, store, NULL, NULL)) {
+                       BIO_printf(bio_err,
+                               "Error initialising X509 store\n");
+                       goto end;
+               }
 
                i = X509_STORE_get_by_subject(&ctx, X509_LU_X509, 
                                        X509_CRL_get_issuer(x), &xobj);
@@ -246,11 +282,23 @@ bad:
                        {
                        if (issuer == i)
                                {
-                               X509_NAME_oneline(X509_CRL_get_issuer(x),
-                                                               buf,256);
-                               BIO_printf(bio_out,"issuer= %s\n",buf);
+                               print_name(bio_out, "issuer=", X509_CRL_get_issuer(x), nmflag);
+                               }
+                       if (crlnumber == i)
+                               {
+                               ASN1_INTEGER *crlnum;
+                               crlnum = X509_CRL_get_ext_d2i(x, NID_crl_number,
+                                                             NULL, NULL);
+                               BIO_printf(bio_out,"crlNumber=");
+                               if (crlnum)
+                                       {
+                                       i2a_ASN1_INTEGER(bio_out, crlnum);
+                                       ASN1_INTEGER_free(crlnum);
+                                       }
+                               else
+                                       BIO_puts(bio_out, "<NONE>");
+                               BIO_printf(bio_out,"\n");
                                }
-
                        if (hash == i)
                                {
                                BIO_printf(bio_out,"%08lx\n",
@@ -273,6 +321,26 @@ bad:
                                        BIO_printf(bio_out,"NONE");
                                BIO_printf(bio_out,"\n");
                                }
+                       if (fingerprint == i)
+                               {
+                               int j;
+                               unsigned int n;
+                               unsigned char md[EVP_MAX_MD_SIZE];
+
+                               if (!X509_CRL_digest(x,digest,md,&n))
+                                       {
+                                       BIO_printf(bio_err,"out of memory\n");
+                                       goto end;
+                                       }
+                               BIO_printf(bio_out,"%s Fingerprint=",
+                                               OBJ_nid2sn(EVP_MD_type(digest)));
+                               for (j=0; j<(int)n; j++)
+                                       {
+                                       BIO_printf(bio_out,"%02X%c",md[j],
+                                               (j+1 == (int)n)
+                                               ?'\n':':');
+                                       }
+                               }
                        }
                }
 
@@ -284,7 +352,15 @@ bad:
                }
 
        if (outfile == NULL)
+               {
                BIO_set_fp(out,stdout,BIO_NOCLOSE);
+#ifdef OPENSSL_SYS_VMS
+               {
+               BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+               out = BIO_push(tmpbio, out);
+               }
+#endif
+               }
        else
                {
                if (BIO_write_filename(out,outfile) <= 0)
@@ -296,7 +372,11 @@ bad:
 
        if (text) X509_CRL_print(out, x);
 
-       if (noout) goto end;
+       if (noout) 
+               {
+               ret = 0;
+               goto end;
+               }
 
        if      (outformat == FORMAT_ASN1)
                i=(int)i2d_X509_CRL_bio(out,x);
@@ -310,16 +390,16 @@ bad:
        if (!i) { BIO_printf(bio_err,"unable to write CRL\n"); goto end; }
        ret=0;
 end:
-       BIO_free(out);
-       BIO_free(bio_out);
+       BIO_free_all(out);
+       BIO_free_all(bio_out);
        bio_out=NULL;
        X509_CRL_free(x);
        if(store) {
                X509_STORE_CTX_cleanup(&ctx);
                X509_STORE_free(store);
        }
-       X509V3_EXT_cleanup();
-       EXIT(ret);
+       apps_shutdown();
+       OPENSSL_EXIT(ret);
        }
 
 static X509_CRL *load_crl(char *infile, int format)
@@ -327,6 +407,12 @@ static X509_CRL *load_crl(char *infile, int format)
        X509_CRL *x=NULL;
        BIO *in=NULL;
 
+       if (format == FORMAT_HTTP)
+               {
+               load_cert_crl_http(infile, bio_err, NULL, &x);
+               return x;
+               }
+
        in=BIO_new(BIO_s_file());
        if (in == NULL)
                {