X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=apps%2Fverify.c;h=267ee4ecd7853fc53c1e5ab7683e24d6c72010cd;hp=2179110d37b0f0064962d5aaf5e8ba6555068727;hb=6d0d5431d4e3e5d8a29166be3ba9362fb988a312;hpb=31b8d8684441e6cd5138832bb1b2ddb10acd6ba6 diff --git a/apps/verify.c b/apps/verify.c index 2179110d37..267ee4ecd7 100644 --- a/apps/verify.c +++ b/apps/verify.c @@ -60,30 +60,29 @@ #include #include #include "apps.h" -#include "bio.h" -#include "err.h" -#include "x509.h" -#include "pem.h" +#include +#include +#include +#include +#include #undef PROG #define PROG verify_main -#ifndef NOPROTO static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx); -static int check(X509_STORE *ctx,char *file); -#else -static int MS_CALLBACK cb(); -static int check(); -#endif - +static int check(X509_STORE *ctx,char *file, STACK_OF(X509)*other, int purpose); +static STACK_OF(X509) *load_untrusted(char *file); static int v_verbose=0; -int MAIN(argc, argv) -int argc; -char **argv; +int MAIN(int, char **); + +int MAIN(int argc, char **argv) { int i,ret=1; + int purpose = -1; char *CApath=NULL,*CAfile=NULL; + char *untfile = NULL; + STACK_OF(X509) *untrusted = NULL; X509_STORE *cert_ctx=NULL; X509_LOOKUP *lookup=NULL; @@ -115,6 +114,24 @@ char **argv; if (argc-- < 1) goto end; CAfile= *(++argv); } + else if (strcmp(*argv,"-purpose") == 0) + { + X509_PURPOSE *xptmp; + if (argc-- < 1) goto end; + i = X509_PURPOSE_get_by_sname(*(++argv)); + if(i < 0) + { + BIO_printf(bio_err, "unrecognized purpose\n"); + goto end; + } + xptmp = X509_PURPOSE_get0(i); + purpose = X509_PURPOSE_get_id(xptmp); + } + else if (strcmp(*argv,"-untrusted") == 0) + { + if (argc-- < 1) goto end; + untfile= *(++argv); + } else if (strcmp(*argv,"-help") == 0) goto end; else if (strcmp(*argv,"-verbose") == 0) @@ -132,36 +149,63 @@ char **argv; lookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_file()); if (lookup == NULL) abort(); - if (!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM)) - X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT); + if (CAfile) { + i=X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM); + if(!i) { + BIO_printf(bio_err, "Error loading file %s\n", CAfile); + ERR_print_errors(bio_err); + goto end; + } + } else X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT); lookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_hash_dir()); if (lookup == NULL) abort(); - if (!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM)) - X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT); - + if (CApath) { + i=X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM); + if(!i) { + BIO_printf(bio_err, "Error loading directory %s\n", CApath); + ERR_print_errors(bio_err); + goto end; + } + } else X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT); ERR_clear_error(); - if (argc < 1) check(cert_ctx,NULL); + + if(untfile) { + if(!(untrusted = load_untrusted(untfile))) { + BIO_printf(bio_err, "Error loading untrusted file %s\n", untfile); + ERR_print_errors(bio_err); + goto end; + } + } + + if (argc < 1) check(cert_ctx, NULL, untrusted, purpose); else for (i=0; i= 0) X509_STORE_CTX_set_purpose(csc, purpose); + i=X509_verify_cert(csc); + X509_STORE_CTX_free(csc); ret=0; end: @@ -210,29 +261,75 @@ end: return(ret); } -static int MS_CALLBACK cb(ok,ctx) -int ok; -X509_STORE_CTX *ctx; +static STACK_OF(X509) *load_untrusted(char *certfile) +{ + STACK_OF(X509_INFO) *sk=NULL; + STACK_OF(X509) *stack=NULL, *ret=NULL; + BIO *in=NULL; + X509_INFO *xi; + + if(!(stack = sk_X509_new_null())) { + BIO_printf(bio_err,"memory allocation failure\n"); + goto end; + } + + if(!(in=BIO_new_file(certfile, "r"))) { + BIO_printf(bio_err,"error opening the file, %s\n",certfile); + goto end; + } + + /* This loads from a file, a stack of x509/crl/pkey sets */ + if(!(sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL))) { + BIO_printf(bio_err,"error reading the file, %s\n",certfile); + goto end; + } + + /* scan over it and pull out the certs */ + while (sk_X509_INFO_num(sk)) + { + xi=sk_X509_INFO_shift(sk); + if (xi->x509 != NULL) + { + sk_X509_push(stack,xi->x509); + xi->x509=NULL; + } + X509_INFO_free(xi); + } + if(!sk_X509_num(stack)) { + BIO_printf(bio_err,"no certificates in file, %s\n",certfile); + sk_X509_free(stack); + goto end; + } + ret=stack; +end: + BIO_free(in); + sk_X509_INFO_free(sk); + return(ret); + } + +static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx) { char buf[256]; if (!ok) { - /* since we are just checking the certificates, it is - * ok if they are self signed. */ - if (ctx->error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) - ok=1; - else - { - X509_NAME_oneline( + X509_NAME_oneline( X509_get_subject_name(ctx->current_cert),buf,256); - printf("%s\n",buf); - printf("error %d at %d depth lookup:%s\n",ctx->error, - ctx->error_depth, - X509_verify_cert_error_string(ctx->error)); - if (ctx->error == X509_V_ERR_CERT_HAS_EXPIRED) - ok=1; - } + printf("%s\n",buf); + printf("error %d at %d depth lookup:%s\n",ctx->error, + ctx->error_depth, + X509_verify_cert_error_string(ctx->error)); + if (ctx->error == X509_V_ERR_CERT_HAS_EXPIRED) ok=1; + /* since we are just checking the certificates, it is + * ok if they are self signed. But we should still warn + * the user. + */ + if (ctx->error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ok=1; + /* Continue after extension errors too */ + if (ctx->error == X509_V_ERR_INVALID_CA) ok=1; + if (ctx->error == X509_V_ERR_PATH_LENGTH_EXCEEDED) ok=1; + if (ctx->error == X509_V_ERR_INVALID_PURPOSE) ok=1; + if (ctx->error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ok=1; } if (!v_verbose) ERR_clear_error();