diff options
author | simon <simon@FreeBSD.org> | 2006-07-29 19:10:21 +0000 |
---|---|---|
committer | simon <simon@FreeBSD.org> | 2006-07-29 19:10:21 +0000 |
commit | fb3c70eda88d3175627edc6a3316b4508b3d29c5 (patch) | |
tree | 213a0c4d5ba3869f66ecf970819532048fed4a9d /crypto/openssl/apps/smime.c | |
parent | 3c8d7d9993705e30bc69e55cd19d8a298e582292 (diff) | |
download | FreeBSD-src-fb3c70eda88d3175627edc6a3316b4508b3d29c5.zip FreeBSD-src-fb3c70eda88d3175627edc6a3316b4508b3d29c5.tar.gz |
Vendor import of OpenSSL 0.9.8b
Diffstat (limited to 'crypto/openssl/apps/smime.c')
-rw-r--r-- | crypto/openssl/apps/smime.c | 551 |
1 files changed, 374 insertions, 177 deletions
diff --git a/crypto/openssl/apps/smime.c b/crypto/openssl/apps/smime.c index 51bc893..250fd69 100644 --- a/crypto/openssl/apps/smime.c +++ b/crypto/openssl/apps/smime.c @@ -1,9 +1,9 @@ /* smime.c */ /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL - * project 1999. + * project. */ /* ==================================================================== - * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * Copyright (c) 1999-2004 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -64,10 +64,13 @@ #include <openssl/crypto.h> #include <openssl/pem.h> #include <openssl/err.h> +#include <openssl/x509_vfy.h> +#include <openssl/x509v3.h> #undef PROG #define PROG smime_main static int save_certs(char *signerfile, STACK_OF(X509) *signers); +static int smime_cb(int ok, X509_STORE_CTX *ctx); #define SMIME_OP 0x10 #define SMIME_ENCRYPT (1 | SMIME_OP) @@ -79,12 +82,12 @@ static int save_certs(char *signerfile, STACK_OF(X509) *signers); int MAIN(int, char **); int MAIN(int argc, char **argv) -{ + { ENGINE *e = NULL; int operation = 0; int ret = 0; char **args; - char *inmode = "r", *outmode = "w"; + const char *inmode = "r", *outmode = "w"; char *infile = NULL, *outfile = NULL; char *signerfile = NULL, *recipfile = NULL; char *certfile = NULL, *keyfile = NULL, *contfile=NULL; @@ -96,7 +99,7 @@ int MAIN(int argc, char **argv) STACK_OF(X509) *encerts = NULL, *other = NULL; BIO *in = NULL, *out = NULL, *indata = NULL; int badarg = 0; - int flags = PKCS7_DETACHED, store_flags = 0; + int flags = PKCS7_DETACHED; char *to = NULL, *from = NULL, *subject = NULL; char *CAfile = NULL, *CApath = NULL; char *passargin = NULL, *passin = NULL; @@ -108,24 +111,34 @@ int MAIN(int argc, char **argv) char *engine=NULL; #endif + X509_VERIFY_PARAM *vpm = NULL; + args = argv + 1; ret = 1; apps_startup(); if (bio_err == NULL) + { if ((bio_err = BIO_new(BIO_s_file())) != NULL) BIO_set_fp(bio_err, stderr, BIO_NOCLOSE|BIO_FP_TEXT); + } if (!load_config(bio_err, NULL)) goto end; - while (!badarg && *args && *args[0] == '-') { - if (!strcmp (*args, "-encrypt")) operation = SMIME_ENCRYPT; - else if (!strcmp (*args, "-decrypt")) operation = SMIME_DECRYPT; - else if (!strcmp (*args, "-sign")) operation = SMIME_SIGN; - else if (!strcmp (*args, "-verify")) operation = SMIME_VERIFY; - else if (!strcmp (*args, "-pk7out")) operation = SMIME_PK7OUT; + while (!badarg && *args && *args[0] == '-') + { + if (!strcmp (*args, "-encrypt")) + operation = SMIME_ENCRYPT; + else if (!strcmp (*args, "-decrypt")) + operation = SMIME_DECRYPT; + else if (!strcmp (*args, "-sign")) + operation = SMIME_SIGN; + else if (!strcmp (*args, "-verify")) + operation = SMIME_VERIFY; + else if (!strcmp (*args, "-pk7out")) + operation = SMIME_PK7OUT; #ifndef OPENSSL_NO_DES else if (!strcmp (*args, "-des3")) cipher = EVP_des_ede3_cbc(); @@ -172,127 +185,225 @@ int MAIN(int argc, char **argv) flags |= PKCS7_NOOLDMIMETYPE; else if (!strcmp (*args, "-crlfeol")) flags |= PKCS7_CRLFEOL; - else if (!strcmp (*args, "-crl_check")) - store_flags |= X509_V_FLAG_CRL_CHECK; - else if (!strcmp (*args, "-crl_check_all")) - store_flags |= X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL; - else if (!strcmp(*args,"-rand")) { - if (args[1]) { + else if (!strcmp(*args,"-rand")) + { + if (args[1]) + { args++; inrand = *args; - } else badarg = 1; + } + else + badarg = 1; need_rand = 1; + } #ifndef OPENSSL_NO_ENGINE - } else if (!strcmp(*args,"-engine")) { - if (args[1]) { + else if (!strcmp(*args,"-engine")) + { + if (args[1]) + { args++; engine = *args; - } else badarg = 1; + } + else badarg = 1; + } #endif - } else if (!strcmp(*args,"-passin")) { - if (args[1]) { + else if (!strcmp(*args,"-passin")) + { + if (args[1]) + { args++; passargin = *args; - } else badarg = 1; - } else if (!strcmp (*args, "-to")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-to")) + { + if (args[1]) + { args++; to = *args; - } else badarg = 1; - } else if (!strcmp (*args, "-from")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-from")) + { + if (args[1]) + { args++; from = *args; - } else badarg = 1; - } else if (!strcmp (*args, "-subject")) { - if (args[1]) { + } + else badarg = 1; + } + else if (!strcmp (*args, "-subject")) + { + if (args[1]) + { args++; subject = *args; - } else badarg = 1; - } else if (!strcmp (*args, "-signer")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-signer")) + { + if (args[1]) + { args++; signerfile = *args; - } else badarg = 1; - } else if (!strcmp (*args, "-recip")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-recip")) + { + if (args[1]) + { args++; recipfile = *args; - } else badarg = 1; - } else if (!strcmp (*args, "-inkey")) { - if (args[1]) { + } + else badarg = 1; + } + else if (!strcmp (*args, "-inkey")) + { + if (args[1]) + { args++; keyfile = *args; - } else badarg = 1; - } else if (!strcmp (*args, "-keyform")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-keyform")) + { + if (args[1]) + { args++; keyform = str2fmt(*args); - } else badarg = 1; - } else if (!strcmp (*args, "-certfile")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-certfile")) + { + if (args[1]) + { args++; certfile = *args; - } else badarg = 1; - } else if (!strcmp (*args, "-CAfile")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-CAfile")) + { + if (args[1]) + { args++; CAfile = *args; - } else badarg = 1; - } else if (!strcmp (*args, "-CApath")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-CApath")) + { + if (args[1]) + { args++; CApath = *args; - } else badarg = 1; - } else if (!strcmp (*args, "-in")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-in")) + { + if (args[1]) + { args++; infile = *args; - } else badarg = 1; - } else if (!strcmp (*args, "-inform")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-inform")) + { + if (args[1]) + { args++; informat = str2fmt(*args); - } else badarg = 1; - } else if (!strcmp (*args, "-outform")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-outform")) + { + if (args[1]) + { args++; outformat = str2fmt(*args); - } else badarg = 1; - } else if (!strcmp (*args, "-out")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-out")) + { + if (args[1]) + { args++; outfile = *args; - } else badarg = 1; - } else if (!strcmp (*args, "-content")) { - if (args[1]) { + } + else + badarg = 1; + } + else if (!strcmp (*args, "-content")) + { + if (args[1]) + { args++; contfile = *args; - } else badarg = 1; - } else badarg = 1; + } + else + badarg = 1; + } + else if (args_verify(&args, NULL, &badarg, bio_err, &vpm)) + continue; + else + badarg = 1; args++; - } + } - if(operation == SMIME_SIGN) { - if(!signerfile) { + + if (operation == SMIME_SIGN) + { + if (!signerfile) + { BIO_printf(bio_err, "No signer certificate specified\n"); badarg = 1; - } + } need_rand = 1; - } else if(operation == SMIME_DECRYPT) { - if(!recipfile) { - BIO_printf(bio_err, "No recipient certificate and key specified\n"); + } + else if (operation == SMIME_DECRYPT) + { + if (!recipfile && !keyfile) + { + BIO_printf(bio_err, "No recipient certificate or key specified\n"); badarg = 1; + } } - } else if(operation == SMIME_ENCRYPT) { - if(!*args) { + else if (operation == SMIME_ENCRYPT) + { + if (!*args) + { BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n"); badarg = 1; - } + } need_rand = 1; - } else if(!operation) badarg = 1; + } + else if (!operation) + badarg = 1; - if (badarg) { + if (badarg) + { BIO_printf (bio_err, "Usage smime [options] cert.pem ...\n"); BIO_printf (bio_err, "where options are\n"); BIO_printf (bio_err, "-encrypt encrypt message\n"); @@ -347,121 +458,155 @@ int MAIN(int argc, char **argv) BIO_printf(bio_err, " the random number generator\n"); BIO_printf (bio_err, "cert.pem recipient certificate(s) for encryption\n"); goto end; - } + } #ifndef OPENSSL_NO_ENGINE e = setup_engine(bio_err, engine, 0); #endif - if(!app_passwd(bio_err, passargin, NULL, &passin, NULL)) { + if (!app_passwd(bio_err, passargin, NULL, &passin, NULL)) + { BIO_printf(bio_err, "Error getting password\n"); goto end; - } + } - if (need_rand) { + if (need_rand) + { app_RAND_load_file(NULL, bio_err, (inrand != NULL)); if (inrand != NULL) BIO_printf(bio_err,"%ld semi-random bytes loaded\n", app_RAND_load_files(inrand)); - } + } ret = 2; - if(operation != SMIME_SIGN) flags &= ~PKCS7_DETACHED; + if (operation != SMIME_SIGN) + flags &= ~PKCS7_DETACHED; - if(operation & SMIME_OP) { - if(flags & PKCS7_BINARY) inmode = "rb"; - if(outformat == FORMAT_ASN1) outmode = "wb"; - } else { - if(flags & PKCS7_BINARY) outmode = "wb"; - if(informat == FORMAT_ASN1) inmode = "rb"; - } + if (operation & SMIME_OP) + { + if (flags & PKCS7_BINARY) + inmode = "rb"; + if (outformat == FORMAT_ASN1) + outmode = "wb"; + } + else + { + if (flags & PKCS7_BINARY) + outmode = "wb"; + if (informat == FORMAT_ASN1) + inmode = "rb"; + } - if(operation == SMIME_ENCRYPT) { - if (!cipher) { + if (operation == SMIME_ENCRYPT) + { + if (!cipher) + { #ifndef OPENSSL_NO_RC2 cipher = EVP_rc2_40_cbc(); #else BIO_printf(bio_err, "No cipher selected\n"); goto end; #endif - } + } encerts = sk_X509_new_null(); - while (*args) { - if(!(cert = load_cert(bio_err,*args,FORMAT_PEM, - NULL, e, "recipient certificate file"))) { + while (*args) + { + if (!(cert = load_cert(bio_err,*args,FORMAT_PEM, + NULL, e, "recipient certificate file"))) + { #if 0 /* An appropriate message is already printed */ BIO_printf(bio_err, "Can't read recipient certificate file %s\n", *args); #endif goto end; - } + } sk_X509_push(encerts, cert); cert = NULL; args++; + } } - } - if(signerfile && (operation == SMIME_SIGN)) { - if(!(signer = load_cert(bio_err,signerfile,FORMAT_PEM, NULL, - e, "signer certificate"))) { + if (signerfile && (operation == SMIME_SIGN)) + { + if (!(signer = load_cert(bio_err,signerfile,FORMAT_PEM, NULL, + e, "signer certificate"))) + { #if 0 /* An appropri message has already been printed */ BIO_printf(bio_err, "Can't read signer certificate file %s\n", signerfile); #endif goto end; + } } - } - if(certfile) { - if(!(other = load_certs(bio_err,certfile,FORMAT_PEM, NULL, - e, "certificate file"))) { + if (certfile) + { + if (!(other = load_certs(bio_err,certfile,FORMAT_PEM, NULL, + e, "certificate file"))) + { #if 0 /* An appropriate message has already been printed */ BIO_printf(bio_err, "Can't read certificate file %s\n", certfile); #endif ERR_print_errors(bio_err); goto end; + } } - } - if(recipfile && (operation == SMIME_DECRYPT)) { - if(!(recip = load_cert(bio_err,recipfile,FORMAT_PEM,NULL, - e, "recipient certificate file"))) { + if (recipfile && (operation == SMIME_DECRYPT)) + { + if (!(recip = load_cert(bio_err,recipfile,FORMAT_PEM,NULL, + e, "recipient certificate file"))) + { #if 0 /* An appropriate message has alrady been printed */ BIO_printf(bio_err, "Can't read recipient certificate file %s\n", recipfile); #endif ERR_print_errors(bio_err); goto end; + } } - } - if(operation == SMIME_DECRYPT) { - if(!keyfile) keyfile = recipfile; - } else if(operation == SMIME_SIGN) { - if(!keyfile) keyfile = signerfile; - } else keyfile = NULL; + if (operation == SMIME_DECRYPT) + { + if (!keyfile) + keyfile = recipfile; + } + else if (operation == SMIME_SIGN) + { + if (!keyfile) + keyfile = signerfile; + } + else keyfile = NULL; - if(keyfile) { + if (keyfile) + { key = load_key(bio_err, keyfile, keyform, 0, passin, e, "signing key file"); - if (!key) { + if (!key) goto end; - } - } + } - if (infile) { - if (!(in = BIO_new_file(infile, inmode))) { + if (infile) + { + if (!(in = BIO_new_file(infile, inmode))) + { BIO_printf (bio_err, "Can't open input file %s\n", infile); goto end; + } } - } else in = BIO_new_fp(stdin, BIO_NOCLOSE); + else + in = BIO_new_fp(stdin, BIO_NOCLOSE); - if (outfile) { - if (!(out = BIO_new_file(outfile, outmode))) { + if (outfile) + { + if (!(out = BIO_new_file(outfile, outmode))) + { BIO_printf (bio_err, "Can't open output file %s\n", outfile); goto end; + } } - } else { + else + { out = BIO_new_fp(stdout, BIO_NOCLOSE); #ifdef OPENSSL_SYS_VMS { @@ -469,100 +614,133 @@ int MAIN(int argc, char **argv) out = BIO_push(tmpbio, out); } #endif - } + } - if(operation == SMIME_VERIFY) { - if(!(store = setup_verify(bio_err, CAfile, CApath))) goto end; - X509_STORE_set_flags(store, store_flags); - } + if (operation == SMIME_VERIFY) + { + if (!(store = setup_verify(bio_err, CAfile, CApath))) + goto end; + X509_STORE_set_verify_cb_func(store, smime_cb); + if (vpm) + X509_STORE_set1_param(store, vpm); + } ret = 3; - if(operation == SMIME_ENCRYPT) { + if (operation == SMIME_ENCRYPT) p7 = PKCS7_encrypt(encerts, in, cipher, flags); - } else if(operation == SMIME_SIGN) { + else if (operation == SMIME_SIGN) + { + /* If detached data and SMIME output enable partial + * signing. + */ + if ((flags & PKCS7_DETACHED) && (outformat == FORMAT_SMIME)) + flags |= PKCS7_STREAM; p7 = PKCS7_sign(signer, key, other, in, flags); - if (BIO_reset(in) != 0 && (flags & PKCS7_DETACHED)) { - BIO_printf(bio_err, "Can't rewind input file\n"); - goto end; + /* Don't need to rewind for partial signing */ + if (!(flags & PKCS7_STREAM) && (BIO_reset(in) != 0)) + { + BIO_printf(bio_err, "Can't rewind input file\n"); + goto end; + } } - } else { - if(informat == FORMAT_SMIME) + else + { + if (informat == FORMAT_SMIME) p7 = SMIME_read_PKCS7(in, &indata); - else if(informat == FORMAT_PEM) + else if (informat == FORMAT_PEM) p7 = PEM_read_bio_PKCS7(in, NULL, NULL, NULL); - else if(informat == FORMAT_ASN1) + else if (informat == FORMAT_ASN1) p7 = d2i_PKCS7_bio(in, NULL); - else { + else + { BIO_printf(bio_err, "Bad input format for PKCS#7 file\n"); goto end; - } + } - if(!p7) { + if (!p7) + { BIO_printf(bio_err, "Error reading S/MIME message\n"); goto end; - } - if(contfile) { + } + if (contfile) + { BIO_free(indata); - if(!(indata = BIO_new_file(contfile, "rb"))) { + if (!(indata = BIO_new_file(contfile, "rb"))) + { BIO_printf(bio_err, "Can't read content file %s\n", contfile); goto end; + } } } - } - if(!p7) { + if (!p7) + { BIO_printf(bio_err, "Error creating PKCS#7 structure\n"); goto end; - } + } ret = 4; - if(operation == SMIME_DECRYPT) { - if(!PKCS7_decrypt(p7, key, recip, out, flags)) { + if (operation == SMIME_DECRYPT) + { + if (!PKCS7_decrypt(p7, key, recip, out, flags)) + { BIO_printf(bio_err, "Error decrypting PKCS#7 structure\n"); goto end; + } } - } else if(operation == SMIME_VERIFY) { + else if (operation == SMIME_VERIFY) + { STACK_OF(X509) *signers; - if(PKCS7_verify(p7, other, store, indata, out, flags)) { + if (PKCS7_verify(p7, other, store, indata, out, flags)) BIO_printf(bio_err, "Verification successful\n"); - } else { + else + { BIO_printf(bio_err, "Verification failure\n"); goto end; - } + } signers = PKCS7_get0_signers(p7, other, flags); - if(!save_certs(signerfile, signers)) { + if (!save_certs(signerfile, signers)) + { BIO_printf(bio_err, "Error writing signers to %s\n", signerfile); ret = 5; goto end; - } + } sk_X509_free(signers); - } else if(operation == SMIME_PK7OUT) { + } + else if (operation == SMIME_PK7OUT) PEM_write_bio_PKCS7(out, p7); - } else { - if(to) BIO_printf(out, "To: %s\n", to); - if(from) BIO_printf(out, "From: %s\n", from); - if(subject) BIO_printf(out, "Subject: %s\n", subject); - if(outformat == FORMAT_SMIME) + else + { + if (to) + BIO_printf(out, "To: %s\n", to); + if (from) + BIO_printf(out, "From: %s\n", from); + if (subject) + BIO_printf(out, "Subject: %s\n", subject); + if (outformat == FORMAT_SMIME) SMIME_write_PKCS7(out, p7, in, flags); - else if(outformat == FORMAT_PEM) + else if (outformat == FORMAT_PEM) PEM_write_bio_PKCS7(out,p7); - else if(outformat == FORMAT_ASN1) + else if (outformat == FORMAT_ASN1) i2d_PKCS7_bio(out,p7); - else { + else + { BIO_printf(bio_err, "Bad output format for PKCS#7 file\n"); goto end; + } } - } ret = 0; end: if (need_rand) app_RAND_write_file(NULL, bio_err); - if(ret) ERR_print_errors(bio_err); + if (ret) ERR_print_errors(bio_err); sk_X509_pop_free(encerts, X509_free); sk_X509_pop_free(other, X509_free); + if (vpm) + X509_VERIFY_PARAM_free(vpm); X509_STORE_free(store); X509_free(cert); X509_free(recip); @@ -572,20 +750,39 @@ end: BIO_free(in); BIO_free(indata); BIO_free_all(out); - if(passin) OPENSSL_free(passin); + if (passin) OPENSSL_free(passin); return (ret); } static int save_certs(char *signerfile, STACK_OF(X509) *signers) -{ + { int i; BIO *tmp; - if(!signerfile) return 1; + if (!signerfile) + return 1; tmp = BIO_new_file(signerfile, "w"); - if(!tmp) return 0; + if (!tmp) return 0; for(i = 0; i < sk_X509_num(signers); i++) PEM_write_bio_X509(tmp, sk_X509_value(signers, i)); BIO_free(tmp); return 1; -} + } + +/* Minimal callback just to output policy info (if any) */ + +static int smime_cb(int ok, X509_STORE_CTX *ctx) + { + int error; + + error = X509_STORE_CTX_get_error(ctx); + + if ((error != X509_V_ERR_NO_EXPLICIT_POLICY) + && ((error != X509_V_OK) || (ok != 2))) + return ok; + + policies_print(NULL, ctx); + + return ok; + + } |