+int pkeyutl_main(int argc, char **argv)
+{
+ BIO *in = NULL, *out = NULL;
+ ENGINE *e = NULL;
+ EVP_PKEY_CTX *ctx = NULL;
+ EVP_PKEY *pkey = NULL;
+ char *infile = NULL, *outfile = NULL, *sigfile = NULL, *passinarg = NULL;
+ char hexdump = 0, asn1parse = 0, rev = 0, *prog;
+ unsigned char *buf_in = NULL, *buf_out = NULL, *sig = NULL;
+ OPTION_CHOICE o;
+ int buf_inlen = 0, siglen = -1, keyform = FORMAT_PEM, peerform = FORMAT_PEM;
+ int keysize = -1, pkey_op = EVP_PKEY_OP_SIGN, key_type = KEY_PRIVKEY;
+ int engine_impl = 0;
+ int ret = 1, rv = -1;
+ size_t buf_outlen;
+ const char *inkey = NULL;
+ const char *peerkey = NULL;
+ const char *kdfalg = NULL;
+ int kdflen = 0;
+ STACK_OF(OPENSSL_STRING) *pkeyopts = NULL;
+ STACK_OF(OPENSSL_STRING) *pkeyopts_passin = NULL;
+ int rawin = 0;
+ const EVP_MD *md = NULL;
+
+ prog = opt_init(argc, argv, pkeyutl_options);
+ while ((o = opt_next()) != OPT_EOF) {
+ switch (o) {
+ case OPT_EOF:
+ case OPT_ERR:
+ opthelp:
+ BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
+ goto end;
+ case OPT_HELP:
+ opt_help(pkeyutl_options);
+ ret = 0;
+ goto end;
+ case OPT_IN:
+ infile = opt_arg();
+ break;
+ case OPT_OUT:
+ outfile = opt_arg();
+ break;
+ case OPT_SIGFILE:
+ sigfile = opt_arg();
+ break;
+ case OPT_ENGINE_IMPL:
+ engine_impl = 1;
+ break;
+ case OPT_INKEY:
+ inkey = opt_arg();
+ break;
+ case OPT_PEERKEY:
+ peerkey = opt_arg();
+ break;
+ case OPT_PASSIN:
+ passinarg = opt_arg();
+ break;
+ case OPT_PEERFORM:
+ if (!opt_format(opt_arg(), OPT_FMT_PDE, &peerform))
+ goto opthelp;
+ break;
+ case OPT_KEYFORM:
+ if (!opt_format(opt_arg(), OPT_FMT_PDE, &keyform))
+ goto opthelp;
+ break;
+ case OPT_R_CASES:
+ if (!opt_rand(o))
+ goto end;
+ break;
+ case OPT_ENGINE:
+ e = setup_engine(opt_arg(), 0);
+ break;
+ case OPT_PUBIN:
+ key_type = KEY_PUBKEY;
+ break;
+ case OPT_CERTIN:
+ key_type = KEY_CERT;
+ break;
+ case OPT_ASN1PARSE:
+ asn1parse = 1;
+ break;
+ case OPT_HEXDUMP:
+ hexdump = 1;
+ break;
+ case OPT_SIGN:
+ pkey_op = EVP_PKEY_OP_SIGN;
+ break;
+ case OPT_VERIFY:
+ pkey_op = EVP_PKEY_OP_VERIFY;
+ break;
+ case OPT_VERIFYRECOVER:
+ pkey_op = EVP_PKEY_OP_VERIFYRECOVER;
+ break;
+ case OPT_ENCRYPT:
+ pkey_op = EVP_PKEY_OP_ENCRYPT;
+ break;
+ case OPT_DECRYPT:
+ pkey_op = EVP_PKEY_OP_DECRYPT;
+ break;
+ case OPT_DERIVE:
+ pkey_op = EVP_PKEY_OP_DERIVE;
+ break;
+ case OPT_KDF:
+ pkey_op = EVP_PKEY_OP_DERIVE;
+ key_type = KEY_NONE;
+ kdfalg = opt_arg();
+ break;
+ case OPT_KDFLEN:
+ kdflen = atoi(opt_arg());
+ break;
+ case OPT_REV:
+ rev = 1;
+ break;
+ case OPT_PKEYOPT:
+ if ((pkeyopts == NULL &&
+ (pkeyopts = sk_OPENSSL_STRING_new_null()) == NULL) ||
+ sk_OPENSSL_STRING_push(pkeyopts, opt_arg()) == 0) {
+ BIO_puts(bio_err, "out of memory\n");
+ goto end;
+ }
+ break;
+ case OPT_PKEYOPT_PASSIN:
+ if ((pkeyopts_passin == NULL &&
+ (pkeyopts_passin = sk_OPENSSL_STRING_new_null()) == NULL) ||
+ sk_OPENSSL_STRING_push(pkeyopts_passin, opt_arg()) == 0) {
+ BIO_puts(bio_err, "out of memory\n");
+ goto end;
+ }
+ break;
+ case OPT_RAWIN:
+ rawin = 1;
+ break;
+ case OPT_DIGEST:
+ if (!opt_md(opt_arg(), &md))
+ goto end;
+ break;
+ }
+ }
+ argc = opt_num_rest();
+ if (argc != 0)
+ goto opthelp;
+
+ if (rawin && pkey_op != EVP_PKEY_OP_SIGN && pkey_op != EVP_PKEY_OP_VERIFY) {
+ BIO_printf(bio_err,
+ "%s: -rawin can only be used with -sign or -verify\n",
+ prog);
+ goto opthelp;
+ }
+
+ if (md != NULL && !rawin) {
+ BIO_printf(bio_err,
+ "%s: -digest can only be used with -rawin\n",
+ prog);
+ goto opthelp;
+ }
+
+ if (rawin && rev) {
+ BIO_printf(bio_err, "%s: -rev cannot be used with raw input\n",
+ prog);
+ goto opthelp;
+ }
+
+ if (kdfalg != NULL) {
+ if (kdflen == 0) {
+ BIO_printf(bio_err,
+ "%s: no KDF length given (-kdflen parameter).\n", prog);
+ goto opthelp;
+ }
+ } else if (inkey == NULL) {
+ BIO_printf(bio_err,
+ "%s: no private key given (-inkey parameter).\n", prog);
+ goto opthelp;
+ } else if (peerkey != NULL && pkey_op != EVP_PKEY_OP_DERIVE) {
+ BIO_printf(bio_err,
+ "%s: no peer key given (-peerkey parameter).\n", prog);
+ goto opthelp;
+ }
+ ctx = init_ctx(kdfalg, &keysize, inkey, keyform, key_type,
+ passinarg, pkey_op, e, engine_impl, &pkey);
+ if (ctx == NULL) {
+ BIO_printf(bio_err, "%s: Error initializing context\n", prog);
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (peerkey != NULL && !setup_peer(ctx, peerform, peerkey, e)) {
+ BIO_printf(bio_err, "%s: Error setting up peer key\n", prog);
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (pkeyopts != NULL) {
+ int num = sk_OPENSSL_STRING_num(pkeyopts);
+ int i;
+
+ for (i = 0; i < num; ++i) {
+ const char *opt = sk_OPENSSL_STRING_value(pkeyopts, i);
+
+ if (pkey_ctrl_string(ctx, opt) <= 0) {
+ BIO_printf(bio_err, "%s: Can't set parameter \"%s\":\n",
+ prog, opt);
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+ }
+ if (pkeyopts_passin != NULL) {
+ int num = sk_OPENSSL_STRING_num(pkeyopts_passin);
+ int i;
+
+ for (i = 0; i < num; i++) {
+ char *opt = sk_OPENSSL_STRING_value(pkeyopts_passin, i);
+ char *passin = strchr(opt, ':');
+ char *passwd;
+
+ if (passin == NULL) {
+ /* Get password interactively */
+ char passwd_buf[4096];
+ BIO_snprintf(passwd_buf, sizeof(passwd_buf), "Enter %s: ", opt);
+ EVP_read_pw_string(passwd_buf, sizeof(passwd_buf) - 1,
+ passwd_buf, 0);
+ passwd = OPENSSL_strdup(passwd_buf);
+ if (passwd == NULL) {
+ BIO_puts(bio_err, "out of memory\n");
+ goto end;
+ }
+ } else {
+ /* Get password as a passin argument: First split option name
+ * and passphrase argument into two strings */
+ *passin = 0;
+ passin++;
+ if (app_passwd(passin, NULL, &passwd, NULL) == 0) {
+ BIO_printf(bio_err, "failed to get '%s'\n", opt);
+ goto end;
+ }
+ }
+
+ if (EVP_PKEY_CTX_ctrl_str(ctx, opt, passwd) <= 0) {
+ BIO_printf(bio_err, "%s: Can't set parameter \"%s\":\n",
+ prog, opt);
+ goto end;
+ }
+ OPENSSL_free(passwd);
+ }
+ }
+
+ if (sigfile != NULL && (pkey_op != EVP_PKEY_OP_VERIFY)) {
+ BIO_printf(bio_err,
+ "%s: Signature file specified for non verify\n", prog);
+ goto end;
+ }
+
+ if (sigfile == NULL && (pkey_op == EVP_PKEY_OP_VERIFY)) {
+ BIO_printf(bio_err,
+ "%s: No signature file specified for verify\n", prog);
+ goto end;
+ }
+
+ if (pkey_op != EVP_PKEY_OP_DERIVE) {
+ in = bio_open_default(infile, 'r', FORMAT_BINARY);
+ if (in == NULL)
+ goto end;
+ }
+ out = bio_open_default(outfile, 'w', FORMAT_BINARY);
+ if (out == NULL)
+ goto end;
+
+ if (sigfile != NULL) {
+ BIO *sigbio = BIO_new_file(sigfile, "rb");
+
+ if (sigbio == NULL) {
+ BIO_printf(bio_err, "Can't open signature file %s\n", sigfile);
+ goto end;
+ }
+ siglen = bio_to_mem(&sig, keysize * 10, sigbio);
+ BIO_free(sigbio);
+ if (siglen < 0) {
+ BIO_printf(bio_err, "Error reading signature data\n");
+ goto end;
+ }
+ }
+
+ /* Raw input data is handled elsewhere */
+ if (in != NULL && !rawin) {
+ /* Read the input data */
+ buf_inlen = bio_to_mem(&buf_in, keysize * 10, in);
+ if (buf_inlen < 0) {
+ BIO_printf(bio_err, "Error reading input Data\n");
+ goto end;
+ }
+ if (rev) {
+ size_t i;
+ unsigned char ctmp;
+ size_t l = (size_t)buf_inlen;
+ for (i = 0; i < l / 2; i++) {
+ ctmp = buf_in[i];
+ buf_in[i] = buf_in[l - 1 - i];
+ buf_in[l - 1 - i] = ctmp;
+ }
+ }
+ }
+
+ /* Sanity check the input if the input is not raw */
+ if (!rawin
+ && buf_inlen > EVP_MAX_MD_SIZE
+ && (pkey_op == EVP_PKEY_OP_SIGN
+ || pkey_op == EVP_PKEY_OP_VERIFY
+ || pkey_op == EVP_PKEY_OP_VERIFYRECOVER)) {
+ BIO_printf(bio_err,
+ "Error: The input data looks too long to be a hash\n");
+ goto end;
+ }
+
+ if (pkey_op == EVP_PKEY_OP_VERIFY) {
+ if (rawin) {
+ rv = do_raw_keyop(pkey_op, ctx, md, pkey, in, sig, siglen,
+ NULL, 0);
+ } else {
+ rv = EVP_PKEY_verify(ctx, sig, (size_t)siglen,
+ buf_in, (size_t)buf_inlen);
+ }
+ if (rv == 1) {
+ BIO_puts(out, "Signature Verified Successfully\n");
+ ret = 0;
+ } else {
+ BIO_puts(out, "Signature Verification Failure\n");
+ }
+ goto end;
+ }
+ if (kdflen != 0) {
+ buf_outlen = kdflen;
+ rv = 1;
+ } else {
+ if (rawin) {
+ /* rawin allocates the buffer in do_raw_keyop() */
+ rv = do_raw_keyop(pkey_op, ctx, md, pkey, in, NULL, 0,
+ &buf_out, (size_t *)&buf_outlen);
+ } else {
+ rv = do_keyop(ctx, pkey_op, NULL, (size_t *)&buf_outlen,
+ buf_in, (size_t)buf_inlen);
+ if (rv > 0 && buf_outlen != 0) {
+ buf_out = app_malloc(buf_outlen, "buffer output");
+ rv = do_keyop(ctx, pkey_op,
+ buf_out, (size_t *)&buf_outlen,
+ buf_in, (size_t)buf_inlen);
+ }
+ }
+ }
+ if (rv <= 0) {
+ if (pkey_op != EVP_PKEY_OP_DERIVE) {
+ BIO_puts(bio_err, "Public Key operation error\n");
+ } else {
+ BIO_puts(bio_err, "Key derivation failed\n");
+ }
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ ret = 0;
+
+ if (asn1parse) {
+ if (!ASN1_parse_dump(out, buf_out, buf_outlen, 1, -1))
+ ERR_print_errors(bio_err);
+ } else if (hexdump) {
+ BIO_dump(out, (char *)buf_out, buf_outlen);
+ } else {
+ BIO_write(out, buf_out, buf_outlen);
+ }
+
+ end:
+ EVP_PKEY_CTX_free(ctx);
+ release_engine(e);
+ BIO_free(in);
+ BIO_free_all(out);
+ OPENSSL_free(buf_in);
+ OPENSSL_free(buf_out);
+ OPENSSL_free(sig);
+ sk_OPENSSL_STRING_free(pkeyopts);
+ sk_OPENSSL_STRING_free(pkeyopts_passin);
+ return ret;
+}