X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=apps%2Fsmime.c;h=90fe026f567781d86445d240c0e3be6e63eebe4e;hp=0eee74077bb96fb9197cf52301075a63cca2ce0a;hb=e9a182fa30e4e19b330415956f1a31da0dfbd11b;hpb=95874603b08b4a28c7c01b590af7bb6278cca119 diff --git a/apps/smime.c b/apps/smime.c index 0eee74077b..90fe026f56 100644 --- a/apps/smime.c +++ b/apps/smime.c @@ -64,7 +64,6 @@ #include #include #include -#include #undef PROG #define PROG smime_main @@ -97,7 +96,7 @@ int MAIN(int argc, char **argv) STACK_OF(X509) *encerts = NULL, *other = NULL; BIO *in = NULL, *out = NULL, *indata = NULL; int badarg = 0; - int flags = PKCS7_DETACHED; + int flags = PKCS7_DETACHED, store_flags = 0; char *to = NULL, *from = NULL, *subject = NULL; char *CAfile = NULL, *CApath = NULL; char *passargin = NULL, *passin = NULL; @@ -110,6 +109,15 @@ int MAIN(int argc, char **argv) args = argv + 1; ret = 1; + apps_startup(); + + if (bio_err == NULL) + if ((bio_err = BIO_new(BIO_s_file())) != NULL) + BIO_set_fp(bio_err, stderr, BIO_NOCLOSE|BIO_FP_TEXT); + + if (!load_config(bio_err, NULL)) + goto end; + while (!badarg && *args && *args[0] == '-') { if (!strcmp (*args, "-encrypt")) operation = SMIME_ENCRYPT; else if (!strcmp (*args, "-decrypt")) operation = SMIME_DECRYPT; @@ -129,6 +137,14 @@ int MAIN(int argc, char **argv) cipher = EVP_rc2_cbc(); else if (!strcmp (*args, "-rc2-64")) cipher = EVP_rc2_64_cbc(); +#endif +#ifndef OPENSSL_NO_AES + else if (!strcmp(*args,"-aes128")) + cipher = EVP_aes_128_cbc(); + else if (!strcmp(*args,"-aes192")) + cipher = EVP_aes_192_cbc(); + else if (!strcmp(*args,"-aes256")) + cipher = EVP_aes_256_cbc(); #endif else if (!strcmp (*args, "-text")) flags |= PKCS7_TEXT; @@ -150,6 +166,10 @@ int MAIN(int argc, char **argv) flags |= PKCS7_BINARY; else if (!strcmp (*args, "-nosigs")) flags |= PKCS7_NOSIGS; + else if (!strcmp (*args, "-crl_check")) + store_flags |= X509_V_FLAG_CRL_CHECK; + else if (!strcmp (*args, "-crl_check_all")) + store_flags |= X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL; else if (!strcmp(*args,"-rand")) { if (args[1]) { args++; @@ -280,6 +300,10 @@ int MAIN(int argc, char **argv) BIO_printf (bio_err, "-rc2-40 encrypt with RC2-40 (default)\n"); BIO_printf (bio_err, "-rc2-64 encrypt with RC2-64\n"); BIO_printf (bio_err, "-rc2-128 encrypt with RC2-128\n"); +#endif +#ifndef OPENSSL_NO_AES + BIO_printf (bio_err, "-aes128, -aes192, -aes256\n"); + BIO_printf (bio_err, " encrypt PEM output with cbc aes\n"); #endif BIO_printf (bio_err, "-nointern don't search certificates in message for signer\n"); BIO_printf (bio_err, "-nosigs don't verify message signature\n"); @@ -304,6 +328,8 @@ int MAIN(int argc, char **argv) BIO_printf (bio_err, "-text include or delete text MIME headers\n"); BIO_printf (bio_err, "-CApath dir trusted certificates directory\n"); BIO_printf (bio_err, "-CAfile file trusted certificates file\n"); + BIO_printf (bio_err, "-crl_check check revocation status of signer's certificate using CRLs\n"); + BIO_printf (bio_err, "-crl_check_all check revocation status of signer's certificate chain using CRLs\n"); BIO_printf (bio_err, "-engine e use engine e, possibly a hardware device.\n"); BIO_printf (bio_err, "-passin arg input file pass phrase source\n"); BIO_printf(bio_err, "-rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR); @@ -313,23 +339,7 @@ int MAIN(int argc, char **argv) goto end; } - if (engine != NULL) - { - if((e = ENGINE_by_id(engine)) == NULL) - { - BIO_printf(bio_err,"invalid engine \"%s\"\n", - engine); - goto end; - } - if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) - { - BIO_printf(bio_err,"can't use that engine\n"); - goto end; - } - BIO_printf(bio_err,"engine \"%s\" set.\n", engine); - /* Free our "structural" reference. */ - ENGINE_free(e); - } + e = setup_engine(bio_err, engine, 0); if(!app_passwd(bio_err, passargin, NULL, &passin, NULL)) { BIO_printf(bio_err, "Error getting password\n"); @@ -366,8 +376,11 @@ int MAIN(int argc, char **argv) } encerts = sk_X509_new_null(); while (*args) { - if(!(cert = load_cert(bio_err,*args,FORMAT_PEM))) { + if(!(cert = load_cert(bio_err,*args,FORMAT_PEM, + NULL, e, "recipient certificate file"))) { +#if 0 /* An appropriate message is already printed */ BIO_printf(bio_err, "Can't read recipient certificate file %s\n", *args); +#endif goto end; } sk_X509_push(encerts, cert); @@ -377,23 +390,32 @@ int MAIN(int argc, char **argv) } if(signerfile && (operation == SMIME_SIGN)) { - if(!(signer = load_cert(bio_err,signerfile,FORMAT_PEM))) { + if(!(signer = load_cert(bio_err,signerfile,FORMAT_PEM, NULL, + e, "signer certificate"))) { +#if 0 /* An appropri message has already been printed */ BIO_printf(bio_err, "Can't read signer certificate file %s\n", signerfile); +#endif goto end; } } if(certfile) { - if(!(other = load_certs(bio_err,certfile,FORMAT_PEM))) { + if(!(other = load_certs(bio_err,certfile,FORMAT_PEM, NULL, + e, "certificate file"))) { +#if 0 /* An appropriate message has already been printed */ BIO_printf(bio_err, "Can't read certificate file %s\n", certfile); +#endif ERR_print_errors(bio_err); goto end; } } if(recipfile && (operation == SMIME_DECRYPT)) { - if(!(recip = load_cert(bio_err,recipfile,FORMAT_PEM))) { + if(!(recip = load_cert(bio_err,recipfile,FORMAT_PEM,NULL, + e, "recipient certificate file"))) { +#if 0 /* An appropriate message has alrady been printed */ BIO_printf(bio_err, "Can't read recipient certificate file %s\n", recipfile); +#endif ERR_print_errors(bio_err); goto end; } @@ -406,18 +428,10 @@ int MAIN(int argc, char **argv) } else keyfile = NULL; if(keyfile) { - if (keyform == FORMAT_ENGINE) { - if (!e) { - BIO_printf(bio_err,"no engine specified\n"); - goto err; - } - key = ENGINE_load_private_key(e, keyfile, passin); - } else { - if(!(key = load_key(bio_err,keyfile, FORMAT_PEM, passin, NULL))) { - BIO_printf(bio_err, "Can't read recipient certificate file %s\n", keyfile); - ERR_print_errors(bio_err); - goto end; - } + key = load_key(bio_err, keyfile, keyform, passin, e, + "signing key file"); + if (!key) { + goto end; } } @@ -447,15 +461,20 @@ int MAIN(int argc, char **argv) if(operation == SMIME_VERIFY) { if(!(store = setup_verify(bio_err, CAfile, CApath))) goto end; + X509_STORE_set_flags(store, store_flags); } + ret = 3; if(operation == SMIME_ENCRYPT) { p7 = PKCS7_encrypt(encerts, in, cipher, flags); } else if(operation == SMIME_SIGN) { p7 = PKCS7_sign(signer, key, other, in, flags); - BIO_reset(in); + if (BIO_reset(in) != 0 && (flags & PKCS7_DETACHED)) { + BIO_printf(bio_err, "Can't rewind input file\n"); + goto end; + } } else { if(informat == FORMAT_SMIME) p7 = SMIME_read_PKCS7(in, &indata); @@ -495,9 +514,9 @@ int MAIN(int argc, char **argv) } else if(operation == SMIME_VERIFY) { STACK_OF(X509) *signers; if(PKCS7_verify(p7, other, store, indata, out, flags)) { - BIO_printf(bio_err, "Verification Successful\n"); + BIO_printf(bio_err, "Verification successful\n"); } else { - BIO_printf(bio_err, "Verification Failure\n"); + BIO_printf(bio_err, "Verification failure\n"); goto end; } signers = PKCS7_get0_signers(p7, other, flags);