apps/cms.c

   1 /* apps/cms.c */
   2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
   3  * project.
   4  */
   5 /* ====================================================================
   6  * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * 3. All advertising materials mentioning features or use of this
  21  *    software must display the following acknowledgment:
  22  *    "This product includes software developed by the OpenSSL Project
  23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24  *
  25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26  *    endorse or promote products derived from this software without
  27  *    prior written permission. For written permission, please contact
  28  *    licensing@OpenSSL.org.
  29  *
  30  * 5. Products derived from this software may not be called "OpenSSL"
  31  *    nor may "OpenSSL" appear in their names without prior written
  32  *    permission of the OpenSSL Project.
  33  *
  34  * 6. Redistributions of any form whatsoever must retain the following
  35  *    acknowledgment:
  36  *    "This product includes software developed by the OpenSSL Project
  37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38  *
  39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50  * OF THE POSSIBILITY OF SUCH DAMAGE.
  51  * ====================================================================
  52  */
  53
  54 /* CMS utility function */
  55
  56 #include <stdio.h>
  57 #include <string.h>
  58 #include "apps.h"
  59
  60 #ifndef OPENSSL_NO_CMS
  61
  62 #include <openssl/crypto.h>
  63 #include <openssl/pem.h>
  64 #include <openssl/err.h>
  65 #include <openssl/x509_vfy.h>
  66 #include <openssl/x509v3.h>
  67 #include <openssl/cms.h>
  68
  69 #undef PROG
  70 #define PROG cms_main
  71 static int save_certs(char *signerfile, STACK_OF(X509) *signers);
  72 static int cms_cb(int ok, X509_STORE_CTX *ctx);
  73 static void receipt_request_print(BIO *out, CMS_ContentInfo *cms);
  74 static CMS_ReceiptRequest *make_receipt_request(STACK *rr_to, int rr_allorfirst,
  75                                                                 STACK *rr_from);
  76
  77 #define SMIME_OP        0x10
  78 #define SMIME_IP        0x20
  79 #define SMIME_SIGNERS   0x40
  80 #define SMIME_ENCRYPT           (1 | SMIME_OP)
  81 #define SMIME_DECRYPT           (2 | SMIME_IP)
  82 #define SMIME_SIGN              (3 | SMIME_OP | SMIME_SIGNERS)
  83 #define SMIME_VERIFY            (4 | SMIME_IP)
  84 #define SMIME_CMSOUT            (5 | SMIME_IP | SMIME_OP)
  85 #define SMIME_RESIGN            (6 | SMIME_IP | SMIME_OP | SMIME_SIGNERS)
  86 #define SMIME_DATAOUT           (7 | SMIME_IP)
  87 #define SMIME_DATA_CREATE       (8 | SMIME_OP)
  88 #define SMIME_DIGEST_VERIFY     (9 | SMIME_IP)
  89 #define SMIME_DIGEST_CREATE     (10 | SMIME_OP)
  90 #define SMIME_UNCOMPRESS        (11 | SMIME_IP)
  91 #define SMIME_COMPRESS          (12 | SMIME_OP)
  92 #define SMIME_ENCRYPTED_DECRYPT (13 | SMIME_IP)
  93 #define SMIME_ENCRYPTED_ENCRYPT (14 | SMIME_OP)
  94 #define SMIME_SIGN_RECEIPT      (15 | SMIME_IP | SMIME_OP)
  95 #define SMIME_VERIFY_RECEIPT    (16 | SMIME_IP)
  96
  97 int MAIN(int, char **);
  98
  99 int MAIN(int argc, char **argv)
 100         {
 101         ENGINE *e = NULL;
 102         int operation = 0;
 103         int ret = 0;
 104         char **args;
 105         const char *inmode = "r", *outmode = "w";
 106         char *infile = NULL, *outfile = NULL, *rctfile = NULL;
 107         char *signerfile = NULL, *recipfile = NULL;
 108         STACK *sksigners = NULL, *skkeys = NULL;
 109         char *certfile = NULL, *keyfile = NULL, *contfile=NULL;
 110         const EVP_CIPHER *cipher = NULL;
 111         CMS_ContentInfo *cms = NULL, *rcms = NULL;
 112         X509_STORE *store = NULL;
 113         X509 *cert = NULL, *recip = NULL, *signer = NULL;
 114         EVP_PKEY *key = NULL;
 115         STACK_OF(X509) *encerts = NULL, *other = NULL;
 116         BIO *in = NULL, *out = NULL, *indata = NULL, *rctin = NULL;
 117         int badarg = 0;
 118         int flags = CMS_DETACHED, noout = 0, print = 0;
 119         int rr_print = 0, rr_allorfirst = -1;
 120         STACK *rr_to = NULL, *rr_from = NULL;
 121         CMS_ReceiptRequest *rr = NULL;
 122         char *to = NULL, *from = NULL, *subject = NULL;
 123         char *CAfile = NULL, *CApath = NULL;
 124         char *passargin = NULL, *passin = NULL;
 125         char *inrand = NULL;
 126         int need_rand = 0;
 127         const EVP_MD *sign_md = NULL;
 128         int informat = FORMAT_SMIME, outformat = FORMAT_SMIME;
 129         int rctformat = FORMAT_SMIME, keyform = FORMAT_PEM;
 130 #ifndef OPENSSL_NO_ENGINE
 131         char *engine=NULL;
 132 #endif
 133         unsigned char *secret_key = NULL, *secret_keyid = NULL;
 134         size_t secret_keylen = 0, secret_keyidlen = 0;
 135
 136         ASN1_OBJECT *econtent_type = NULL;
 137
 138         X509_VERIFY_PARAM *vpm = NULL;
 139
 140         args = argv + 1;
 141         ret = 1;
 142
 143         apps_startup();
 144
 145         if (bio_err == NULL)
 146                 {
 147                 if ((bio_err = BIO_new(BIO_s_file())) != NULL)
 148                         BIO_set_fp(bio_err, stderr, BIO_NOCLOSE|BIO_FP_TEXT);
 149                 }
 150
 151         if (!load_config(bio_err, NULL))
 152                 goto end;
 153
 154         while (!badarg && *args && *args[0] == '-')
 155                 {
 156                 if (!strcmp (*args, "-encrypt"))
 157                         operation = SMIME_ENCRYPT;
 158                 else if (!strcmp (*args, "-decrypt"))
 159                         operation = SMIME_DECRYPT;
 160                 else if (!strcmp (*args, "-sign"))
 161                         operation = SMIME_SIGN;
 162                 else if (!strcmp (*args, "-sign_receipt"))
 163                         operation = SMIME_SIGN_RECEIPT;
 164                 else if (!strcmp (*args, "-resign"))
 165                         operation = SMIME_RESIGN;
 166                 else if (!strcmp (*args, "-verify"))
 167                         operation = SMIME_VERIFY;
 168                 else if (!strcmp(*args,"-verify_receipt"))
 169                         {
 170                         operation = SMIME_VERIFY_RECEIPT;
 171                         if (!args[1])
 172                                 goto argerr;
 173                         args++;
 174                         rctfile = *args;
 175                         }
 176                 else if (!strcmp (*args, "-cmsout"))
 177                         operation = SMIME_CMSOUT;
 178                 else if (!strcmp (*args, "-data_out"))
 179                         operation = SMIME_DATAOUT;
 180                 else if (!strcmp (*args, "-data_create"))
 181                         operation = SMIME_DATA_CREATE;
 182                 else if (!strcmp (*args, "-digest_verify"))
 183                         operation = SMIME_DIGEST_VERIFY;
 184                 else if (!strcmp (*args, "-digest_create"))
 185                         operation = SMIME_DIGEST_CREATE;
 186                 else if (!strcmp (*args, "-compress"))
 187                         operation = SMIME_COMPRESS;
 188                 else if (!strcmp (*args, "-uncompress"))
 189                         operation = SMIME_UNCOMPRESS;
 190                 else if (!strcmp (*args, "-EncryptedData_decrypt"))
 191                         operation = SMIME_ENCRYPTED_DECRYPT;
 192                 else if (!strcmp (*args, "-EncryptedData_encrypt"))
 193                         operation = SMIME_ENCRYPTED_ENCRYPT;
 194 #ifndef OPENSSL_NO_DES
 195                 else if (!strcmp (*args, "-des3"))
 196                                 cipher = EVP_des_ede3_cbc();
 197                 else if (!strcmp (*args, "-des"))
 198                                 cipher = EVP_des_cbc();
 199 #endif
 200 #ifndef OPENSSL_NO_SEED
 201                 else if (!strcmp (*args, "-seed"))
 202                                 cipher = EVP_seed_cbc();
 203 #endif
 204 #ifndef OPENSSL_NO_RC2
 205                 else if (!strcmp (*args, "-rc2-40"))
 206                                 cipher = EVP_rc2_40_cbc();
 207                 else if (!strcmp (*args, "-rc2-128"))
 208                                 cipher = EVP_rc2_cbc();
 209                 else if (!strcmp (*args, "-rc2-64"))
 210                                 cipher = EVP_rc2_64_cbc();
 211 #endif
 212 #ifndef OPENSSL_NO_AES
 213                 else if (!strcmp(*args,"-aes128"))
 214                                 cipher = EVP_aes_128_cbc();
 215                 else if (!strcmp(*args,"-aes192"))
 216                                 cipher = EVP_aes_192_cbc();
 217                 else if (!strcmp(*args,"-aes256"))
 218                                 cipher = EVP_aes_256_cbc();
 219 #endif
 220 #ifndef OPENSSL_NO_CAMELLIA
 221                 else if (!strcmp(*args,"-camellia128"))
 222                                 cipher = EVP_camellia_128_cbc();
 223                 else if (!strcmp(*args,"-camellia192"))
 224                                 cipher = EVP_camellia_192_cbc();
 225                 else if (!strcmp(*args,"-camellia256"))
 226                                 cipher = EVP_camellia_256_cbc();
 227 #endif
 228                 else if (!strcmp (*args, "-text"))
 229                                 flags |= CMS_TEXT;
 230                 else if (!strcmp (*args, "-nointern"))
 231                                 flags |= CMS_NOINTERN;
 232                 else if (!strcmp (*args, "-noverify")
 233                         || !strcmp (*args, "-no_signer_cert_verify"))
 234                                 flags |= CMS_NO_SIGNER_CERT_VERIFY;
 235                 else if (!strcmp (*args, "-nocerts"))
 236                                 flags |= CMS_NOCERTS;
 237                 else if (!strcmp (*args, "-noattr"))
 238                                 flags |= CMS_NOATTR;
 239                 else if (!strcmp (*args, "-nodetach"))
 240                                 flags &= ~CMS_DETACHED;
 241                 else if (!strcmp (*args, "-nosmimecap"))
 242                                 flags |= CMS_NOSMIMECAP;
 243                 else if (!strcmp (*args, "-binary"))
 244                                 flags |= CMS_BINARY;
 245                 else if (!strcmp (*args, "-keyid"))
 246                                 flags |= CMS_USE_KEYID;
 247                 else if (!strcmp (*args, "-nosigs"))
 248                                 flags |= CMS_NOSIGS;
 249                 else if (!strcmp (*args, "-no_content_verify"))
 250                                 flags |= CMS_NO_CONTENT_VERIFY;
 251                 else if (!strcmp (*args, "-no_attr_verify"))
 252                                 flags |= CMS_NO_ATTR_VERIFY;
 253                 else if (!strcmp (*args, "-stream"))
 254                                 flags |= CMS_STREAM;
 255                 else if (!strcmp (*args, "-indef"))
 256                                 flags |= CMS_STREAM;
 257                 else if (!strcmp (*args, "-noindef"))
 258                                 flags &= ~CMS_STREAM;
 259                 else if (!strcmp (*args, "-nooldmime"))
 260                                 flags |= CMS_NOOLDMIMETYPE;
 261                 else if (!strcmp (*args, "-crlfeol"))
 262                                 flags |= CMS_CRLFEOL;
 263                 else if (!strcmp (*args, "-noout"))
 264                                 noout = 1;
 265                 else if (!strcmp (*args, "-receipt_request_print"))
 266                                 rr_print = 1;
 267                 else if (!strcmp (*args, "-receipt_request_all"))
 268                                 rr_allorfirst = 0;
 269                 else if (!strcmp (*args, "-receipt_request_first"))
 270                                 rr_allorfirst = 1;
 271                 else if (!strcmp(*args,"-receipt_request_from"))
 272                         {
 273                         if (!args[1])
 274                                 goto argerr;
 275                         args++;
 276                         if (!rr_from)
 277                                 rr_from = sk_new_null();
 278                         sk_push(rr_from, *args);
 279                         }
 280                 else if (!strcmp(*args,"-receipt_request_to"))
 281                         {
 282                         if (!args[1])
 283                                 goto argerr;
 284                         args++;
 285                         if (!rr_to)
 286                                 rr_to = sk_new_null();
 287                         sk_push(rr_to, *args);
 288                         }
 289                 else if (!strcmp (*args, "-print"))
 290                                 {
 291                                 noout = 1;
 292                                 print = 1;
 293                                 }
 294                 else if (!strcmp(*args,"-secretkey"))
 295                         {
 296                         long ltmp;
 297                         if (!args[1])
 298                                 goto argerr;
 299                         args++;
 300                         secret_key = string_to_hex(*args, &ltmp);
 301                         if (!secret_key)
 302                                 {
 303                                 BIO_printf(bio_err, "Invalid key %s\n", *args);
 304                                 goto argerr;
 305                                 }
 306                         secret_keylen = (size_t)ltmp;
 307                         }
 308                 else if (!strcmp(*args,"-secretkeyid"))
 309                         {
 310                         long ltmp;
 311                         if (!args[1])
 312                                 goto argerr;
 313                         args++;
 314                         secret_keyid = string_to_hex(*args, &ltmp);
 315                         if (!secret_keyid)
 316                                 {
 317                                 BIO_printf(bio_err, "Invalid id %s\n", *args);
 318                                 goto argerr;
 319                                 }
 320                         secret_keyidlen = (size_t)ltmp;
 321                         }
 322                 else if (!strcmp(*args,"-econtent_type"))
 323                         {
 324                         if (!args[1])
 325                                 goto argerr;
 326                         args++;
 327                         econtent_type = OBJ_txt2obj(*args, 0);
 328                         if (!econtent_type)
 329                                 {
 330                                 BIO_printf(bio_err, "Invalid OID %s\n", *args);
 331                                 goto argerr;
 332                                 }
 333                         }
 334                 else if (!strcmp(*args,"-rand"))
 335                         {
 336                         if (!args[1])
 337                                 goto argerr;
 338                         args++;
 339                         inrand = *args;
 340                         need_rand = 1;
 341                         }
 342 #ifndef OPENSSL_NO_ENGINE
 343                 else if (!strcmp(*args,"-engine"))
 344                         {
 345                         if (!args[1])
 346                                 goto argerr;
 347                         engine = *++args;
 348                         }
 349 #endif
 350                 else if (!strcmp(*args,"-passin"))
 351                         {
 352                         if (!args[1])
 353                                 goto argerr;
 354                         passargin = *++args;
 355                         }
 356                 else if (!strcmp (*args, "-to"))
 357                         {
 358                         if (!args[1])
 359                                 goto argerr;
 360                         to = *++args;
 361                         }
 362                 else if (!strcmp (*args, "-from"))
 363                         {
 364                         if (!args[1])
 365                                 goto argerr;
 366                         from = *++args;
 367                         }
 368                 else if (!strcmp (*args, "-subject"))
 369                         {
 370                         if (!args[1])
 371                                 goto argerr;
 372                         subject = *++args;
 373                         }
 374                 else if (!strcmp (*args, "-signer"))
 375                         {
 376                         if (!args[1])
 377                                 goto argerr;
 378                         /* If previous -signer argument add signer to list */
 379
 380                         if (signerfile)
 381                                 {
 382                                 if (!sksigners)
 383                                         sksigners = sk_new_null();
 384                                 sk_push(sksigners, signerfile);
 385                                 if (!keyfile)
 386                                         keyfile = signerfile;
 387                                 if (!skkeys)
 388                                         skkeys = sk_new_null();
 389                                 sk_push(skkeys, keyfile);
 390                                 keyfile = NULL;
 391                                 }
 392                         signerfile = *++args;
 393                         }
 394                 else if (!strcmp (*args, "-recip"))
 395                         {
 396                         if (!args[1])
 397                                 goto argerr;
 398                         recipfile = *++args;
 399                         }
 400                 else if (!strcmp (*args, "-md"))
 401                         {
 402                         if (!args[1])
 403                                 goto argerr;
 404                         sign_md = EVP_get_digestbyname(*++args);
 405                         if (sign_md == NULL)
 406                                 {
 407                                 BIO_printf(bio_err, "Unknown digest %s\n",
 408                                                         *args);
 409                                 goto argerr;
 410                                 }
 411                         }
 412                 else if (!strcmp (*args, "-inkey"))
 413                         {
 414                         if (!args[1])
 415                                 goto argerr;
 416                         /* If previous -inkey arument add signer to list */
 417                         if (keyfile)
 418                                 {
 419                                 if (!signerfile)
 420                                         {
 421                                         BIO_puts(bio_err, "Illegal -inkey without -signer\n");
 422                                         goto argerr;
 423                                         }
 424                                 if (!sksigners)
 425                                         sksigners = sk_new_null();
 426                                 sk_push(sksigners, signerfile);
 427                                 signerfile = NULL;
 428                                 if (!skkeys)
 429                                         skkeys = sk_new_null();
 430                                 sk_push(skkeys, keyfile);
 431                                 }
 432                         keyfile = *++args;
 433                         }
 434                 else if (!strcmp (*args, "-keyform"))
 435                         {
 436                         if (!args[1])
 437                                 goto argerr;
 438                         keyform = str2fmt(*++args);
 439                         }
 440                 else if (!strcmp (*args, "-rctform"))
 441                         {
 442                         if (!args[1])
 443                                 goto argerr;
 444                         rctformat = str2fmt(*++args);
 445                         }
 446                 else if (!strcmp (*args, "-certfile"))
 447                         {
 448                         if (!args[1])
 449                                 goto argerr;
 450                         certfile = *++args;
 451                         }
 452                 else if (!strcmp (*args, "-CAfile"))
 453                         {
 454                         if (!args[1])
 455                                 goto argerr;
 456                         CAfile = *++args;
 457                         }
 458                 else if (!strcmp (*args, "-CApath"))
 459                         {
 460                         if (!args[1])
 461                                 goto argerr;
 462                         CApath = *++args;
 463                         }
 464                 else if (!strcmp (*args, "-in"))
 465                         {
 466                         if (!args[1])
 467                                 goto argerr;
 468                         infile = *++args;
 469                         }
 470                 else if (!strcmp (*args, "-inform"))
 471                         {
 472                         if (!args[1])
 473                                 goto argerr;
 474                         informat = str2fmt(*++args);
 475                         }
 476                 else if (!strcmp (*args, "-outform"))
 477                         {
 478                         if (!args[1])
 479                                 goto argerr;
 480                         outformat = str2fmt(*++args);
 481                         }
 482                 else if (!strcmp (*args, "-out"))
 483                         {
 484                         if (!args[1])
 485                                 goto argerr;
 486                         outfile = *++args;
 487                         }
 488                 else if (!strcmp (*args, "-content"))
 489                         {
 490                         if (!args[1])
 491                                 goto argerr;
 492                         contfile = *++args;
 493                         }
 494                 else if (args_verify(&args, NULL, &badarg, bio_err, &vpm))
 495                         continue;
 496                 else if ((cipher = EVP_get_cipherbyname(*args + 1)) == NULL)
 497                         badarg = 1;
 498                 args++;
 499                 }
 500
 501         if (((rr_allorfirst != -1) || rr_from) && !rr_to)
 502                 {
 503                 BIO_puts(bio_err, "No Signed Receipts Recipients\n");
 504                 goto argerr;
 505                 }
 506
 507         if (!(operation & SMIME_SIGNERS)  && (rr_to || rr_from))
 508                 {
 509                 BIO_puts(bio_err, "Signed receipts only allowed with -sign\n");
 510                 goto argerr;
 511                 }
 512         if (!(operation & SMIME_SIGNERS) && (skkeys || sksigners))
 513                 {
 514                 BIO_puts(bio_err, "Multiple signers or keys not allowed\n");
 515                 goto argerr;
 516                 }
 517
 518         if (operation & SMIME_SIGNERS)
 519                 {
 520                 if (keyfile && !signerfile)
 521                         {
 522                         BIO_puts(bio_err, "Illegal -inkey without -signer\n");
 523                         goto argerr;
 524                         }
 525                 /* Check to see if any final signer needs to be appended */
 526                 if (signerfile)
 527                         {
 528                         if (!sksigners)
 529                                 sksigners = sk_new_null();
 530                         sk_push(sksigners, signerfile);
 531                         if (!skkeys)
 532                                 skkeys = sk_new_null();
 533                         if (!keyfile)
 534                                 keyfile = signerfile;
 535                         sk_push(skkeys, keyfile);
 536                         }
 537                 if (!sksigners)
 538                         {
 539                         BIO_printf(bio_err, "No signer certificate specified\n");
 540                         badarg = 1;
 541                         }
 542                 signerfile = NULL;
 543                 keyfile = NULL;
 544                 need_rand = 1;
 545                 }
 546
 547         else if (operation == SMIME_DECRYPT)
 548                 {
 549                 if (!recipfile && !keyfile && !secret_key)
 550                         {
 551                         BIO_printf(bio_err, "No recipient certificate or key specified\n");
 552                         badarg = 1;
 553                         }
 554                 }
 555         else if (operation == SMIME_ENCRYPT)
 556                 {
 557                 if (!*args && !secret_key)
 558                         {
 559                         BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n");
 560                         badarg = 1;
 561                         }
 562                 need_rand = 1;
 563                 }
 564         else if (!operation)
 565                 badarg = 1;
 566
 567         if (badarg)
 568                 {
 569                 argerr:
 570                 BIO_printf (bio_err, "Usage cms [options] cert.pem ...\n");
 571                 BIO_printf (bio_err, "where options are\n");
 572                 BIO_printf (bio_err, "-encrypt       encrypt message\n");
 573                 BIO_printf (bio_err, "-decrypt       decrypt encrypted message\n");
 574                 BIO_printf (bio_err, "-sign          sign message\n");
 575                 BIO_printf (bio_err, "-verify        verify signed message\n");
 576                 BIO_printf (bio_err, "-cmsout        output CMS structure\n");
 577 #ifndef OPENSSL_NO_DES
 578                 BIO_printf (bio_err, "-des3          encrypt with triple DES\n");
 579                 BIO_printf (bio_err, "-des           encrypt with DES\n");
 580 #endif
 581 #ifndef OPENSSL_NO_SEED
 582                 BIO_printf (bio_err, "-seed          encrypt with SEED\n");
 583 #endif
 584 #ifndef OPENSSL_NO_RC2
 585                 BIO_printf (bio_err, "-rc2-40        encrypt with RC2-40 (default)\n");
 586                 BIO_printf (bio_err, "-rc2-64        encrypt with RC2-64\n");
 587                 BIO_printf (bio_err, "-rc2-128       encrypt with RC2-128\n");
 588 #endif
 589 #ifndef OPENSSL_NO_AES
 590                 BIO_printf (bio_err, "-aes128, -aes192, -aes256\n");
 591                 BIO_printf (bio_err, "               encrypt PEM output with cbc aes\n");
 592 #endif
 593 #ifndef OPENSSL_NO_CAMELLIA
 594                 BIO_printf (bio_err, "-camellia128, -camellia192, -camellia256\n");
 595                 BIO_printf (bio_err, "               encrypt PEM output with cbc camellia\n");
 596 #endif
 597                 BIO_printf (bio_err, "-nointern      don't search certificates in message for signer\n");
 598                 BIO_printf (bio_err, "-nosigs        don't verify message signature\n");
 599                 BIO_printf (bio_err, "-noverify      don't verify signers certificate\n");
 600                 BIO_printf (bio_err, "-nocerts       don't include signers certificate when signing\n");
 601                 BIO_printf (bio_err, "-nodetach      use opaque signing\n");
 602                 BIO_printf (bio_err, "-noattr        don't include any signed attributes\n");
 603                 BIO_printf (bio_err, "-binary        don't translate message to text\n");
 604                 BIO_printf (bio_err, "-certfile file other certificates file\n");
 605                 BIO_printf (bio_err, "-signer file   signer certificate file\n");
 606                 BIO_printf (bio_err, "-recip  file   recipient certificate file for decryption\n");
 607                 BIO_printf (bio_err, "-skeyid        use subject key identifier\n");
 608                 BIO_printf (bio_err, "-in file       input file\n");
 609                 BIO_printf (bio_err, "-inform arg    input format SMIME (default), PEM or DER\n");
 610                 BIO_printf (bio_err, "-inkey file    input private key (if not signer or recipient)\n");
 611                 BIO_printf (bio_err, "-keyform arg   input private key format (PEM or ENGINE)\n");
 612                 BIO_printf (bio_err, "-out file      output file\n");
 613                 BIO_printf (bio_err, "-outform arg   output format SMIME (default), PEM or DER\n");
 614                 BIO_printf (bio_err, "-content file  supply or override content for detached signature\n");
 615                 BIO_printf (bio_err, "-to addr       to address\n");
 616                 BIO_printf (bio_err, "-from ad       from address\n");
 617                 BIO_printf (bio_err, "-subject s     subject\n");
 618                 BIO_printf (bio_err, "-text          include or delete text MIME headers\n");
 619                 BIO_printf (bio_err, "-CApath dir    trusted certificates directory\n");
 620                 BIO_printf (bio_err, "-CAfile file   trusted certificates file\n");
 621                 BIO_printf (bio_err, "-crl_check     check revocation status of signer's certificate using CRLs\n");
 622                 BIO_printf (bio_err, "-crl_check_all check revocation status of signer's certificate chain using CRLs\n");
 623 #ifndef OPENSSL_NO_ENGINE
 624                 BIO_printf (bio_err, "-engine e      use engine e, possibly a hardware device.\n");
 625 #endif
 626                 BIO_printf (bio_err, "-passin arg    input file pass phrase source\n");
 627                 BIO_printf(bio_err,  "-rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
 628                 BIO_printf(bio_err,  "               load the file (or the files in the directory) into\n");
 629                 BIO_printf(bio_err,  "               the random number generator\n");
 630                 BIO_printf (bio_err, "cert.pem       recipient certificate(s) for encryption\n");
 631                 goto end;
 632                 }
 633
 634 #ifndef OPENSSL_NO_ENGINE
 635         e = setup_engine(bio_err, engine, 0);
 636 #endif
 637
 638         if (!app_passwd(bio_err, passargin, NULL, &passin, NULL))
 639                 {
 640                 BIO_printf(bio_err, "Error getting password\n");
 641                 goto end;
 642                 }
 643
 644         if (need_rand)
 645                 {
 646                 app_RAND_load_file(NULL, bio_err, (inrand != NULL));
 647                 if (inrand != NULL)
 648                         BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
 649                                 app_RAND_load_files(inrand));
 650                 }
 651
 652         ret = 2;
 653
 654         if (!(operation & SMIME_SIGNERS))
 655                 flags &= ~CMS_DETACHED;
 656
 657         if (operation & SMIME_OP)
 658                 {
 659                 if (outformat == FORMAT_ASN1)
 660                         outmode = "wb";
 661                 }
 662         else
 663                 {
 664                 if (flags & CMS_BINARY)
 665                         outmode = "wb";
 666                 }
 667
 668         if (operation & SMIME_IP)
 669                 {
 670                 if (informat == FORMAT_ASN1)
 671                         inmode = "rb";
 672                 }
 673         else
 674                 {
 675                 if (flags & CMS_BINARY)
 676                         inmode = "rb";
 677                 }
 678
 679         if (operation == SMIME_ENCRYPT)
 680                 {
 681                 if (!cipher)
 682                         {
 683 #ifndef OPENSSL_NO_DES
 684                         cipher = EVP_des_ede3_cbc();
 685 #else
 686                         BIO_printf(bio_err, "No cipher selected\n");
 687                         goto end;
 688 #endif
 689                         }
 690
 691                 if (secret_key && !secret_keyid)
 692                         {
 693                         BIO_printf(bio_err, "No sectre key id\n");
 694                         goto end;
 695                         }
 696
 697                 if (*args)
 698                         encerts = sk_X509_new_null();
 699                 while (*args)
 700                         {
 701                         if (!(cert = load_cert(bio_err,*args,FORMAT_PEM,
 702                                 NULL, e, "recipient certificate file")))
 703                                 goto end;
 704                         sk_X509_push(encerts, cert);
 705                         cert = NULL;
 706                         args++;
 707                         }
 708                 }
 709
 710         if (certfile)
 711                 {
 712                 if (!(other = load_certs(bio_err,certfile,FORMAT_PEM, NULL,
 713                         e, "certificate file")))
 714                         {
 715                         ERR_print_errors(bio_err);
 716                         goto end;
 717                         }
 718                 }
 719
 720         if (recipfile && (operation == SMIME_DECRYPT))
 721                 {
 722                 if (!(recip = load_cert(bio_err,recipfile,FORMAT_PEM,NULL,
 723                         e, "recipient certificate file")))
 724                         {
 725                         ERR_print_errors(bio_err);
 726                         goto end;
 727                         }
 728                 }
 729
 730         if (operation == SMIME_SIGN_RECEIPT)
 731                 {
 732                 if (!(signer = load_cert(bio_err,signerfile,FORMAT_PEM,NULL,
 733                         e, "receipt signer certificate file")))
 734                         {
 735                         ERR_print_errors(bio_err);
 736                         goto end;
 737                         }
 738                 }
 739
 740         if (operation == SMIME_DECRYPT)
 741                 {
 742                 if (!keyfile)
 743                         keyfile = recipfile;
 744                 }
 745         else if ((operation == SMIME_SIGN) || (operation == SMIME_SIGN_RECEIPT))
 746                 {
 747                 if (!keyfile)
 748                         keyfile = signerfile;
 749                 }
 750         else keyfile = NULL;
 751
 752         if (keyfile)
 753                 {
 754                 key = load_key(bio_err, keyfile, keyform, 0, passin, e,
 755                                "signing key file");
 756                 if (!key)
 757                         goto end;
 758                 }
 759
 760         if (infile)
 761                 {
 762                 if (!(in = BIO_new_file(infile, inmode)))
 763                         {
 764                         BIO_printf (bio_err,
 765                                  "Can't open input file %s\n", infile);
 766                         goto end;
 767                         }
 768                 }
 769         else
 770                 in = BIO_new_fp(stdin, BIO_NOCLOSE);
 771
 772         if (operation & SMIME_IP)
 773                 {
 774                 if (informat == FORMAT_SMIME)
 775                         cms = SMIME_read_CMS(in, &indata);
 776                 else if (informat == FORMAT_PEM)
 777                         cms = PEM_read_bio_CMS(in, NULL, NULL, NULL);
 778                 else if (informat == FORMAT_ASN1)
 779                         cms = d2i_CMS_bio(in, NULL);
 780                 else
 781                         {
 782                         BIO_printf(bio_err, "Bad input format for CMS file\n");
 783                         goto end;
 784                         }
 785
 786                 if (!cms)
 787                         {
 788                         BIO_printf(bio_err, "Error reading S/MIME message\n");
 789                         goto end;
 790                         }
 791                 if (contfile)
 792                         {
 793                         BIO_free(indata);
 794                         if (!(indata = BIO_new_file(contfile, "rb")))
 795                                 {
 796                                 BIO_printf(bio_err, "Can't read content file %s\n", contfile);
 797                                 goto end;
 798                                 }
 799                         }
 800                 }
 801
 802         if (rctfile)
 803                 {
 804                 char *rctmode = (rctformat == FORMAT_ASN1) ? "rb" : "r";
 805                 if (!(rctin = BIO_new_file(rctfile, rctmode)))
 806                         {
 807                         BIO_printf (bio_err,
 808                                  "Can't open receipt file %s\n", rctfile);
 809                         goto end;
 810                         }
 811
 812                 if (rctformat == FORMAT_SMIME)
 813                         rcms = SMIME_read_CMS(rctin, NULL);
 814                 else if (rctformat == FORMAT_PEM)
 815                         rcms = PEM_read_bio_CMS(rctin, NULL, NULL, NULL);
 816                 else if (rctformat == FORMAT_ASN1)
 817                         rcms = d2i_CMS_bio(rctin, NULL);
 818                 else
 819                         {
 820                         BIO_printf(bio_err, "Bad input format for receipt\n");
 821                         goto end;
 822                         }
 823
 824                 if (!rcms)
 825                         {
 826                         BIO_printf(bio_err, "Error reading receipt\n");
 827                         goto end;
 828                         }
 829                 }
 830
 831         if (outfile)
 832                 {
 833                 if (!(out = BIO_new_file(outfile, outmode)))
 834                         {
 835                         BIO_printf (bio_err,
 836                                  "Can't open output file %s\n", outfile);
 837                         goto end;
 838                         }
 839                 }
 840         else
 841                 {
 842                 out = BIO_new_fp(stdout, BIO_NOCLOSE);
 843 #ifdef OPENSSL_SYS_VMS
 844                 {
 845                     BIO *tmpbio = BIO_new(BIO_f_linebuffer());
 846                     out = BIO_push(tmpbio, out);
 847                 }
 848 #endif
 849                 }
 850
 851         if ((operation == SMIME_VERIFY) || (operation == SMIME_VERIFY_RECEIPT))
 852                 {
 853                 if (!(store = setup_verify(bio_err, CAfile, CApath)))
 854                         goto end;
 855                 X509_STORE_set_verify_cb_func(store, cms_cb);
 856                 if (vpm)
 857                         X509_STORE_set1_param(store, vpm);
 858                 }
 859
 860
 861         ret = 3;
 862
 863         if (operation == SMIME_DATA_CREATE)
 864                 {
 865                 cms = CMS_data_create(in, flags);
 866                 }
 867         else if (operation == SMIME_DIGEST_CREATE)
 868                 {
 869                 cms = CMS_digest_create(in, sign_md, flags);
 870                 }
 871         else if (operation == SMIME_COMPRESS)
 872                 {
 873                 cms = CMS_compress(in, -1, flags);
 874                 }
 875         else if (operation == SMIME_ENCRYPT)
 876                 {
 877                 flags |= CMS_PARTIAL;
 878                 cms = CMS_encrypt(encerts, in, cipher, flags);
 879                 if (!cms)
 880                         goto end;
 881                 if (secret_key)
 882                         {
 883                         if (!CMS_add0_recipient_key(cms, NID_undef,
 884                                                 secret_key, secret_keylen,
 885                                                 secret_keyid, secret_keyidlen,
 886                                                 NULL, NULL, NULL))
 887                                 goto end;
 888                         /* NULL these because call absorbs them */
 889                         secret_key = NULL;
 890                         secret_keyid = NULL;
 891                         }
 892                 if (!(flags & CMS_STREAM))
 893                         {
 894                         if (!CMS_final(cms, in, NULL, flags))
 895                                 goto end;
 896                         }
 897                 }
 898         else if (operation == SMIME_ENCRYPTED_ENCRYPT)
 899                 {
 900                 cms = CMS_EncryptedData_encrypt(in, cipher,
 901                                                 secret_key, secret_keylen,
 902                                                 flags);
 903
 904                 }
 905         else if (operation == SMIME_SIGN_RECEIPT)
 906                 {
 907                 CMS_ContentInfo *srcms = NULL;
 908                 STACK_OF(CMS_SignerInfo) *sis;
 909                 CMS_SignerInfo *si;
 910                 sis = CMS_get0_SignerInfos(cms);
 911                 if (!sis)
 912                         goto end;
 913                 si = sk_CMS_SignerInfo_value(sis, 0);
 914                 srcms = CMS_sign_receipt(si, signer, key, other, flags);
 915                 if (!srcms)
 916                         goto end;
 917                 CMS_ContentInfo_free(cms);
 918                 cms = srcms;
 919                 }
 920         else if (operation & SMIME_SIGNERS)
 921                 {
 922                 int i;
 923                 /* If detached data content we enable streaming if
 924                  * S/MIME output format.
 925                  */
 926                 if (operation == SMIME_SIGN)
 927                         {
 928
 929                         if (flags & CMS_DETACHED)
 930                                 {
 931                                 if (outformat == FORMAT_SMIME)
 932                                         flags |= CMS_STREAM;
 933                                 }
 934                         flags |= CMS_PARTIAL;
 935                         cms = CMS_sign(NULL, NULL, other, in, flags);
 936                         if (!cms)
 937                                 goto end;
 938                         if (econtent_type)
 939                                 CMS_set1_eContentType(cms, econtent_type);
 940
 941                         if (rr_to)
 942                                 {
 943                                 rr = make_receipt_request(rr_to, rr_allorfirst,
 944                                                                 rr_from);
 945                                 if (!rr)
 946                                         {
 947                                         BIO_puts(bio_err,
 948                                 "Signed Receipt Request Creation Error\n");
 949                                         goto end;
 950                                         }
 951                                 }
 952                         }
 953                 else
 954                         flags |= CMS_REUSE_DIGEST;
 955                 for (i = 0; i < sk_num(sksigners); i++)
 956                         {
 957                         CMS_SignerInfo *si;
 958                         signerfile = sk_value(sksigners, i);
 959                         keyfile = sk_value(skkeys, i);
 960                         signer = load_cert(bio_err, signerfile,FORMAT_PEM, NULL,
 961                                         e, "signer certificate");
 962                         if (!signer)
 963                                 goto end;
 964                         key = load_key(bio_err, keyfile, keyform, 0, passin, e,
 965                                "signing key file");
 966                         if (!key)
 967                                 goto end;
 968                         si = CMS_add1_signer(cms, signer, key, sign_md, flags);
 969                         if (!si)
 970                                 goto end;
 971                         if (rr && !CMS_add1_ReceiptRequest(si, rr))
 972                                 goto end;
 973                         X509_free(signer);
 974                         signer = NULL;
 975                         EVP_PKEY_free(key);
 976                         key = NULL;
 977                         }
 978                 /* If not streaming or resigning finalize structure */
 979                 if ((operation == SMIME_SIGN) && !(flags & CMS_STREAM))
 980                         {
 981                         if (!CMS_final(cms, in, NULL, flags))
 982                                 goto end;
 983                         }
 984                 }
 985
 986         if (!cms)
 987                 {
 988                 BIO_printf(bio_err, "Error creating CMS structure\n");
 989                 goto end;
 990                 }
 991
 992         ret = 4;
 993         if (operation == SMIME_DECRYPT)
 994                 {
 995
 996                 if (secret_key)
 997                         {
 998                         if (!CMS_decrypt_set1_key(cms,
 999                                                 secret_key, secret_keylen,
1000                                                 secret_keyid, secret_keyidlen))
1001                                 {
1002                                 BIO_puts(bio_err,
1003                                         "Error decrypting CMS using secret key\n");
1004                                 goto end;
1005                                 }
1006                         }
1007
1008                 if (key)
1009                         {
1010                         if (!CMS_decrypt_set1_pkey(cms, key, recip))
1011                                 {
1012                                 BIO_puts(bio_err,
1013                                         "Error decrypting CMS using private key\n");
1014                                 goto end;
1015                                 }
1016                         }
1017
1018                 if (!CMS_decrypt(cms, NULL, NULL, indata, out, flags))
1019                         {
1020                         BIO_printf(bio_err, "Error decrypting CMS structure\n");
1021                         goto end;
1022                         }
1023                 }
1024         else if (operation == SMIME_DATAOUT)
1025                 {
1026                 if (!CMS_data(cms, out, flags))
1027                         goto end;
1028                 }
1029         else if (operation == SMIME_UNCOMPRESS)
1030                 {
1031                 if (!CMS_uncompress(cms, indata, out, flags))
1032                         goto end;
1033                 }
1034         else if (operation == SMIME_DIGEST_VERIFY)
1035                 {
1036                 if (CMS_digest_verify(cms, indata, out, flags) > 0)
1037                         BIO_printf(bio_err, "Verification successful\n");
1038                 else
1039                         {
1040                         BIO_printf(bio_err, "Verification failure\n");
1041                         goto end;
1042                         }
1043                 }
1044         else if (operation == SMIME_ENCRYPTED_DECRYPT)
1045                 {
1046                 if (!CMS_EncryptedData_decrypt(cms, secret_key, secret_keylen,
1047                                                 indata, out, flags))
1048                         goto end;
1049                 }
1050         else if (operation == SMIME_VERIFY)
1051                 {
1052                 if (CMS_verify(cms, other, store, indata, out, flags) > 0)
1053                         BIO_printf(bio_err, "Verification successful\n");
1054                 else
1055                         {
1056                         BIO_printf(bio_err, "Verification failure\n");
1057                         goto end;
1058                         }
1059                 if (signerfile)
1060                         {
1061                         STACK_OF(X509) *signers;
1062                         signers = CMS_get0_signers(cms);
1063                         if (!save_certs(signerfile, signers))
1064                                 {
1065                                 BIO_printf(bio_err,
1066                                                 "Error writing signers to %s\n",
1067                                                                 signerfile);
1068                                 ret = 5;
1069                                 goto end;
1070                                 }
1071                         sk_X509_free(signers);
1072                         }
1073                 if (rr_print)
1074                         receipt_request_print(bio_err, cms);
1075
1076                 }
1077         else if (operation == SMIME_VERIFY_RECEIPT)
1078                 {
1079                 if (CMS_verify_receipt(rcms, cms, other, store, flags) > 0)
1080                         BIO_printf(bio_err, "Verification successful\n");
1081                 else
1082                         {
1083                         BIO_printf(bio_err, "Verification failure\n");
1084                         goto end;
1085                         }
1086                 }
1087         else
1088                 {
1089                 if (noout)
1090                         {
1091                         if (print)
1092                                 CMS_ContentInfo_print_ctx(out, cms, 0, NULL);
1093                         }
1094                 else if (outformat == FORMAT_SMIME)
1095                         {
1096                         if (to)
1097                                 BIO_printf(out, "To: %s\n", to);
1098                         if (from)
1099                                 BIO_printf(out, "From: %s\n", from);
1100                         if (subject)
1101                                 BIO_printf(out, "Subject: %s\n", subject);
1102                         if (operation == SMIME_RESIGN)
1103                                 ret = SMIME_write_CMS(out, cms, indata, flags);
1104                         else
1105                                 ret = SMIME_write_CMS(out, cms, in, flags);
1106                         }
1107                 else if (outformat == FORMAT_PEM)
1108                         ret = PEM_write_bio_CMS_stream(out, cms, in, flags);
1109                 else if (outformat == FORMAT_ASN1)
1110                         ret = i2d_CMS_bio_stream(out,cms, in, flags);
1111                 else
1112                         {
1113                         BIO_printf(bio_err, "Bad output format for CMS file\n");
1114                         goto end;
1115                         }
1116                 if (ret <= 0)
1117                         {
1118                         ret = 6;
1119                         goto end;
1120                         }
1121                 }
1122         ret = 0;
1123 end:
1124         if (ret)
1125                 ERR_print_errors(bio_err);
1126         if (need_rand)
1127                 app_RAND_write_file(NULL, bio_err);
1128         sk_X509_pop_free(encerts, X509_free);
1129         sk_X509_pop_free(other, X509_free);
1130         if (vpm)
1131                 X509_VERIFY_PARAM_free(vpm);
1132         if (sksigners)
1133                 sk_free(sksigners);
1134         if (skkeys)
1135                 sk_free(skkeys);
1136         if (secret_key)
1137                 OPENSSL_free(secret_key);
1138         if (secret_keyid)
1139                 OPENSSL_free(secret_keyid);
1140         if (econtent_type)
1141                 ASN1_OBJECT_free(econtent_type);
1142         if (rr)
1143                 CMS_ReceiptRequest_free(rr);
1144         if (rr_to)
1145                 sk_free(rr_to);
1146         if (rr_from)
1147                 sk_free(rr_from);
1148         X509_STORE_free(store);
1149         X509_free(cert);
1150         X509_free(recip);
1151         X509_free(signer);
1152         EVP_PKEY_free(key);
1153         CMS_ContentInfo_free(cms);
1154         CMS_ContentInfo_free(rcms);
1155         BIO_free(rctin);
1156         BIO_free(in);
1157         BIO_free(indata);
1158         BIO_free_all(out);
1159         if (passin) OPENSSL_free(passin);
1160         return (ret);
1161 }
1162
1163 static int save_certs(char *signerfile, STACK_OF(X509) *signers)
1164         {
1165         int i;
1166         BIO *tmp;
1167         if (!signerfile)
1168                 return 1;
1169         tmp = BIO_new_file(signerfile, "w");
1170         if (!tmp) return 0;
1171         for(i = 0; i < sk_X509_num(signers); i++)
1172                 PEM_write_bio_X509(tmp, sk_X509_value(signers, i));
1173         BIO_free(tmp);
1174         return 1;
1175         }
1176
1177
1178 /* Minimal callback just to output policy info (if any) */
1179
1180 static int cms_cb(int ok, X509_STORE_CTX *ctx)
1181         {
1182         int error;
1183
1184         error = X509_STORE_CTX_get_error(ctx);
1185
1186         if ((error != X509_V_ERR_NO_EXPLICIT_POLICY)
1187                 && ((error != X509_V_OK) || (ok != 2)))
1188                 return ok;
1189
1190         policies_print(NULL, ctx);
1191
1192         return ok;
1193
1194         }
1195
1196 static void gnames_stack_print(BIO *out, STACK_OF(GENERAL_NAMES) *gns)
1197         {
1198         STACK_OF(GENERAL_NAME) *gens;
1199         GENERAL_NAME *gen;
1200         int i, j;
1201         for (i = 0; i < sk_GENERAL_NAMES_num(gns); i++)
1202                 {
1203                 gens = sk_GENERAL_NAMES_value(gns, i);
1204                 for (j = 0; j < sk_GENERAL_NAME_num(gens); j++)
1205                         {
1206                         gen = sk_GENERAL_NAME_value(gens, j);
1207                         BIO_puts(out, "    ");
1208                         GENERAL_NAME_print(out, gen);
1209                         BIO_puts(out, "\n");
1210                         }
1211                 }
1212         return;
1213         }
1214
1215 static void receipt_request_print(BIO *out, CMS_ContentInfo *cms)
1216         {
1217         STACK_OF(CMS_SignerInfo) *sis;
1218         CMS_SignerInfo *si;
1219         CMS_ReceiptRequest *rr;
1220         int allorfirst;
1221         STACK_OF(GENERAL_NAMES) *rto, *rlist;
1222         ASN1_STRING *scid;
1223         int i, rv;
1224         sis = CMS_get0_SignerInfos(cms);
1225         for (i = 0; i < sk_CMS_SignerInfo_num(sis); i++)
1226                 {
1227                 si = sk_CMS_SignerInfo_value(sis, i);
1228                 rv = CMS_get1_ReceiptRequest(si, &rr);
1229                 BIO_printf(bio_err, "Signer %d:\n", i + 1);
1230                 if (rv == 0)
1231                         BIO_puts(bio_err, "  No Receipt Request\n");
1232                 else if (rv < 0)
1233                         {
1234                         BIO_puts(bio_err, "  Receipt Request Parse Error\n");
1235                         ERR_print_errors(bio_err);
1236                         }
1237                 else
1238                         {
1239                         char *id;
1240                         int idlen;
1241                         CMS_ReceiptRequest_get0_values(rr, &scid, &allorfirst,
1242                                                         &rlist, &rto);
1243                         BIO_puts(out, "  Signed Content ID:\n");
1244                         idlen = ASN1_STRING_length(scid);
1245                         id = (char *)ASN1_STRING_data(scid);
1246                         BIO_dump_indent(out, id, idlen, 4);
1247                         BIO_puts(out, "  Receipts From");
1248                         if (rlist)
1249                                 {
1250                                 BIO_puts(out, " List:\n");
1251                                 gnames_stack_print(out, rlist);
1252                                 }
1253                         else if (allorfirst == 1)
1254                                 BIO_puts(out, ": First Tier\n");
1255                         else if (allorfirst == 0)
1256                                 BIO_puts(out, ": All\n");
1257                         else
1258                                 BIO_printf(out, " Unknown (%d)\n", allorfirst);
1259                         BIO_puts(out, "  Receipts To:\n");
1260                         gnames_stack_print(out, rto);
1261                         }
1262                 if (rr)
1263                         CMS_ReceiptRequest_free(rr);
1264                 }
1265         }
1266
1267 static STACK_OF(GENERAL_NAMES) *make_names_stack(STACK *ns)
1268         {
1269         int i;
1270         STACK_OF(GENERAL_NAMES) *ret;
1271         GENERAL_NAMES *gens = NULL;
1272         GENERAL_NAME *gen = NULL;
1273         ret = sk_GENERAL_NAMES_new_null();
1274         if (!ret)
1275                 goto err;
1276         for (i = 0; i < sk_num(ns); i++)
1277                 {
1278                 char *str = sk_value(ns, i);
1279                 gen = a2i_GENERAL_NAME(NULL, NULL, NULL, GEN_EMAIL, str, 0);
1280                 if (!gen)
1281                         goto err;
1282                 gens = GENERAL_NAMES_new();
1283                 if (!gens)
1284                         goto err;
1285                 if (!sk_GENERAL_NAME_push(gens, gen))
1286                         goto err;
1287                 gen = NULL;
1288                 if (!sk_GENERAL_NAMES_push(ret, gens))
1289                         goto err;
1290                 gens = NULL;
1291                 }
1292
1293         return ret;
1294
1295         err:
1296         if (ret)
1297                 sk_GENERAL_NAMES_pop_free(ret, GENERAL_NAMES_free);
1298         if (gens)
1299                 GENERAL_NAMES_free(gens);
1300         if (gen)
1301                 GENERAL_NAME_free(gen);
1302         return NULL;
1303         }
1304
1305
1306 static CMS_ReceiptRequest *make_receipt_request(STACK *rr_to, int rr_allorfirst,
1307                                                                 STACK *rr_from)
1308         {
1309         STACK_OF(GENERAL_NAMES) *rct_to, *rct_from;
1310         CMS_ReceiptRequest *rr;
1311         rct_to = make_names_stack(rr_to);
1312         if (!rct_to)
1313                 goto err;
1314         if (rr_from)
1315                 {
1316                 rct_from = make_names_stack(rr_from);
1317                 if (!rct_from)
1318                         goto err;
1319                 }
1320         else
1321                 rct_from = NULL;
1322         rr = CMS_ReceiptRequest_create0(NULL, -1, rr_allorfirst, rct_from,
1323                                                 rct_to);
1324         return rr;
1325         err:
1326         return NULL;
1327         }
1328
1329 #endif