X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=apps%2Fcrl.c;h=5ea59d0169aabbdd047b366474d774eceb1c9618;hp=0c03f5fb6c77157f59bfea56ad7ac317bf34a027;hb=6ca487992bc63d45f9780c6b83eecf025830e34b;hpb=6b691a5c85ddc4e407e32781841fee5c029506cd diff --git a/apps/crl.c b/apps/crl.c index 0c03f5fb6c..5ea59d0169 100644 --- a/apps/crl.c +++ b/apps/crl.c @@ -60,11 +60,11 @@ #include #include #include "apps.h" -#include "bio.h" -#include "err.h" -#include "x509.h" -#include "x509v3.h" -#include "pem.h" +#include +#include +#include +#include +#include #undef PROG #define PROG crl_main @@ -75,7 +75,7 @@ static char *crl_usage[]={ "usage: crl args\n", "\n", -" -inform arg - input format - default PEM (one of DER, TXT or PEM)\n", +" -inform arg - input format - default PEM (DER or PEM)\n", " -outform arg - output format - default PEM\n", " -text - print out a text format version\n", " -in arg - input file - default stdin\n", @@ -85,26 +85,34 @@ static char *crl_usage[]={ " -lastupdate - lastUpdate field\n", " -nextupdate - nextUpdate field\n", " -noout - no CRL output\n", +" -CAfile name - verify CRL using certificates in file \"name\"\n", +" -CApath dir - verify CRL using certificates in \"dir\"\n", NULL }; -#ifndef NOPROTO static X509_CRL *load_crl(char *file, int format); -#else -static X509_CRL *load_crl(); -#endif - static BIO *bio_out=NULL; +int MAIN(int, char **); + int MAIN(int argc, char **argv) { X509_CRL *x=NULL; + char *CAfile = NULL, *CApath = NULL; int ret=1,i,num,badops=0; BIO *out=NULL; int informat,outformat; char *infile=NULL,*outfile=NULL; int hash=0,issuer=0,lastupdate=0,nextupdate=0,noout=0,text=0; + int fingerprint = 0; char **pp,buf[256]; + X509_STORE *store = NULL; + X509_STORE_CTX ctx; + X509_LOOKUP *lookup = NULL; + X509_OBJECT xobj; + EVP_PKEY *pkey; + int do_ver = 0; + const EVP_MD *md_alg,*digest=EVP_md5(); apps_startup(); @@ -114,7 +122,15 @@ int MAIN(int argc, char **argv) if (bio_out == NULL) if ((bio_out=BIO_new(BIO_s_file())) != NULL) + { BIO_set_fp(bio_out,stdout,BIO_NOCLOSE); +#ifdef OPENSSL_SYS_VMS + { + BIO *tmpbio = BIO_new(BIO_f_linebuffer()); + bio_out = BIO_push(tmpbio, bio_out); + } +#endif + } informat=FORMAT_PEM; outformat=FORMAT_PEM; @@ -151,6 +167,20 @@ int MAIN(int argc, char **argv) if (--argc < 1) goto bad; outfile= *(++argv); } + else if (strcmp(*argv,"-CApath") == 0) + { + if (--argc < 1) goto bad; + CApath = *(++argv); + do_ver = 1; + } + else if (strcmp(*argv,"-CAfile") == 0) + { + if (--argc < 1) goto bad; + CAfile = *(++argv); + do_ver = 1; + } + else if (strcmp(*argv,"-verify") == 0) + do_ver = 1; else if (strcmp(*argv,"-text") == 0) text = 1; else if (strcmp(*argv,"-hash") == 0) @@ -163,6 +193,13 @@ int MAIN(int argc, char **argv) nextupdate= ++num; else if (strcmp(*argv,"-noout") == 0) noout= ++num; + else if (strcmp(*argv,"-fingerprint") == 0) + fingerprint= ++num; + else if ((md_alg=EVP_get_digestbyname(*argv + 1))) + { + /* ok */ + digest=md_alg; + } else { BIO_printf(bio_err,"unknown option %s\n",*argv); @@ -177,45 +214,107 @@ int MAIN(int argc, char **argv) { bad: for (pp=crl_usage; (*pp != NULL); pp++) - BIO_printf(bio_err,*pp); + BIO_printf(bio_err,"%s",*pp); goto end; } ERR_load_crypto_strings(); - X509V3_add_standard_extensions(); x=load_crl(infile,informat); if (x == NULL) { goto end; } + if(do_ver) { + store = X509_STORE_new(); + lookup=X509_STORE_add_lookup(store,X509_LOOKUP_file()); + if (lookup == NULL) goto end; + if (!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM)) + X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT); + + lookup=X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir()); + if (lookup == NULL) goto end; + if (!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM)) + X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT); + ERR_clear_error(); + + if(!X509_STORE_CTX_init(&ctx, store, NULL, NULL)) { + BIO_printf(bio_err, + "Error initialising X509 store\n"); + goto end; + } + + i = X509_STORE_get_by_subject(&ctx, X509_LU_X509, + X509_CRL_get_issuer(x), &xobj); + if(i <= 0) { + BIO_printf(bio_err, + "Error getting CRL issuer certificate\n"); + goto end; + } + pkey = X509_get_pubkey(xobj.data.x509); + X509_OBJECT_free_contents(&xobj); + if(!pkey) { + BIO_printf(bio_err, + "Error getting CRL issuer public key\n"); + goto end; + } + i = X509_CRL_verify(x, pkey); + EVP_PKEY_free(pkey); + if(i < 0) goto end; + if(i == 0) BIO_printf(bio_err, "verify failure\n"); + else BIO_printf(bio_err, "verify OK\n"); + } + if (num) { for (i=1; i<=num; i++) { if (issuer == i) { - X509_NAME_oneline(x->crl->issuer,buf,256); + X509_NAME_oneline(X509_CRL_get_issuer(x), + buf,256); BIO_printf(bio_out,"issuer= %s\n",buf); } if (hash == i) { BIO_printf(bio_out,"%08lx\n", - X509_NAME_hash(x->crl->issuer)); + X509_NAME_hash(X509_CRL_get_issuer(x))); } if (lastupdate == i) { BIO_printf(bio_out,"lastUpdate="); - ASN1_TIME_print(bio_out,x->crl->lastUpdate); + ASN1_TIME_print(bio_out, + X509_CRL_get_lastUpdate(x)); BIO_printf(bio_out,"\n"); } if (nextupdate == i) { BIO_printf(bio_out,"nextUpdate="); - if (x->crl->nextUpdate != NULL) - ASN1_TIME_print(bio_out,x->crl->nextUpdate); + if (X509_CRL_get_nextUpdate(x)) + ASN1_TIME_print(bio_out, + X509_CRL_get_nextUpdate(x)); else BIO_printf(bio_out,"NONE"); BIO_printf(bio_out,"\n"); } + if (fingerprint == i) + { + int j; + unsigned int n; + unsigned char md[EVP_MAX_MD_SIZE]; + + if (!X509_CRL_digest(x,digest,md,&n)) + { + BIO_printf(bio_err,"out of memory\n"); + goto end; + } + BIO_printf(bio_out,"%s Fingerprint=", + OBJ_nid2sn(EVP_MD_type(digest))); + for (j=0; j<(int)n; j++) + { + BIO_printf(bio_out,"%02X%c",md[j], + (j+1 == (int)n) + ?'\n':':'); + } + } } } @@ -227,7 +326,15 @@ bad: } if (outfile == NULL) + { BIO_set_fp(out,stdout,BIO_NOCLOSE); +#ifdef OPENSSL_SYS_VMS + { + BIO *tmpbio = BIO_new(BIO_f_linebuffer()); + out = BIO_push(tmpbio, out); + } +#endif + } else { if (BIO_write_filename(out,outfile) <= 0) @@ -253,10 +360,15 @@ bad: if (!i) { BIO_printf(bio_err,"unable to write CRL\n"); goto end; } ret=0; end: - BIO_free(out); - BIO_free(bio_out); + BIO_free_all(out); + BIO_free_all(bio_out); + bio_out=NULL; X509_CRL_free(x); - X509V3_EXT_cleanup(); + if(store) { + X509_STORE_CTX_cleanup(&ctx); + X509_STORE_free(store); + } + apps_shutdown(); EXIT(ret); } @@ -285,7 +397,7 @@ static X509_CRL *load_crl(char *infile, int format) if (format == FORMAT_ASN1) x=d2i_X509_CRL_bio(in,NULL); else if (format == FORMAT_PEM) - x=PEM_read_bio_X509_CRL(in,NULL,NULL); + x=PEM_read_bio_X509_CRL(in,NULL,NULL,NULL); else { BIO_printf(bio_err,"bad input format specified for input crl\n"); goto end;