[thirdparty/openssl.git] / apps / dgst.c

/*
 * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include "apps.h"
#include "progs.h"
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/objects.h>
#include <openssl/x509.h>
#include <openssl/pem.h>
#include <openssl/hmac.h>

#undef BUFSIZE
#define BUFSIZE 1024*8

int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
          EVP_PKEY *key, unsigned char *sigin, int siglen,
          const char *sig_name, const char *md_name,
          const char *file);

typedef enum OPTION_choice {
    OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
    OPT_C, OPT_R, OPT_OUT, OPT_SIGN, OPT_PASSIN, OPT_VERIFY,
    OPT_PRVERIFY, OPT_SIGNATURE, OPT_KEYFORM, OPT_ENGINE, OPT_ENGINE_IMPL,
    OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT,
    OPT_HMAC, OPT_MAC, OPT_SIGOPT, OPT_MACOPT,
    OPT_DIGEST,
    OPT_R_ENUM
} OPTION_CHOICE;

const OPTIONS dgst_options[] = {
    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [file...]\n"},
    {OPT_HELP_STR, 1, '-',
        "  file... files to digest (default is stdin)\n"},
    {"help", OPT_HELP, '-', "Display this summary"},
    {"c", OPT_C, '-', "Print the digest with separating colons"},
    {"r", OPT_R, '-', "Print the digest in coreutils format"},
    {"out", OPT_OUT, '>', "Output to filename rather than stdout"},
    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
    {"sign", OPT_SIGN, 's', "Sign digest using private key"},
    {"verify", OPT_VERIFY, 's',
     "Verify a signature using public key"},
    {"prverify", OPT_PRVERIFY, 's',
     "Verify a signature using private key"},
    {"signature", OPT_SIGNATURE, '<', "File with signature to verify"},
    {"keyform", OPT_KEYFORM, 'f', "Key file format (PEM or ENGINE)"},
    {"hex", OPT_HEX, '-', "Print as hex dump"},
    {"binary", OPT_BINARY, '-', "Print in binary form"},
    {"d", OPT_DEBUG, '-', "Print debug info"},
    {"debug", OPT_DEBUG, '-', "Print debug info"},
    {"fips-fingerprint", OPT_FIPS_FINGERPRINT, '-',
     "Compute HMAC with the key used in OpenSSL-FIPS fingerprint"},
    {"hmac", OPT_HMAC, 's', "Create hashed MAC with key"},
    {"mac", OPT_MAC, 's', "Create MAC (not necessarily HMAC)"},
    {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
    {"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form or key"},
    {"", OPT_DIGEST, '-', "Any supported digest"},
    OPT_R_OPTIONS,
#ifndef OPENSSL_NO_ENGINE
    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
    {"engine_impl", OPT_ENGINE_IMPL, '-',
     "Also use engine given by -engine for digest operations"},
#endif
    {NULL}
};

int dgst_main(int argc, char **argv)
{
    BIO *in = NULL, *inp, *bmd = NULL, *out = NULL;
    ENGINE *e = NULL, *impl = NULL;
    EVP_PKEY *sigkey = NULL;
    STACK_OF(OPENSSL_STRING) *sigopts = NULL, *macopts = NULL;
    char *hmac_key = NULL;
    char *mac_name = NULL;
    char *passinarg = NULL, *passin = NULL;
    const EVP_MD *md = NULL, *m;
    const char *outfile = NULL, *keyfile = NULL, *prog = NULL;
    const char *sigfile = NULL;
    OPTION_CHOICE o;
    int separator = 0, debug = 0, keyform = FORMAT_PEM, siglen = 0;
    int i, ret = 1, out_bin = -1, want_pub = 0, do_verify = 0;
    unsigned char *buf = NULL, *sigbuf = NULL;
    int engine_impl = 0;

    prog = opt_progname(argv[0]);
    buf = app_malloc(BUFSIZE, "I/O buffer");
    md = EVP_get_digestbyname(prog);

    prog = opt_init(argc, argv, dgst_options);
    while ((o = opt_next()) != OPT_EOF) {
        switch (o) {
        case OPT_EOF:
        case OPT_ERR:
 opthelp:
            BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
            goto end;
        case OPT_HELP:
            opt_help(dgst_options);
            ret = 0;
            goto end;
        case OPT_C:
            separator = 1;
            break;
        case OPT_R:
            separator = 2;
            break;
        case OPT_R_CASES:
            if (!opt_rand(o))
                goto end;
            break;
        case OPT_OUT:
            outfile = opt_arg();
            break;
        case OPT_SIGN:
            keyfile = opt_arg();
            break;
        case OPT_PASSIN:
            passinarg = opt_arg();
            break;
        case OPT_VERIFY:
            keyfile = opt_arg();
            want_pub = do_verify = 1;
            break;
        case OPT_PRVERIFY:
            keyfile = opt_arg();
            do_verify = 1;
            break;
        case OPT_SIGNATURE:
            sigfile = opt_arg();
            break;
        case OPT_KEYFORM:
            if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform))
                goto opthelp;
            break;
        case OPT_ENGINE:
            e = setup_engine(opt_arg(), 0);
            break;
        case OPT_ENGINE_IMPL:
            engine_impl = 1;
            break;
        case OPT_HEX:
            out_bin = 0;
            break;
        case OPT_BINARY:
            out_bin = 1;
            break;
        case OPT_DEBUG:
            debug = 1;
            break;
        case OPT_FIPS_FINGERPRINT:
            hmac_key = "etaonrishdlcupfm";
            break;
        case OPT_HMAC:
            hmac_key = opt_arg();
            break;
        case OPT_MAC:
            mac_name = opt_arg();
            break;
        case OPT_SIGOPT:
            if (!sigopts)
                sigopts = sk_OPENSSL_STRING_new_null();
            if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, opt_arg()))
                goto opthelp;
            break;
        case OPT_MACOPT:
            if (!macopts)
                macopts = sk_OPENSSL_STRING_new_null();
            if (!macopts || !sk_OPENSSL_STRING_push(macopts, opt_arg()))
                goto opthelp;
            break;
        case OPT_DIGEST:
            if (!opt_md(opt_unknown(), &m))
                goto opthelp;
            md = m;
            break;
        }
    }
    argc = opt_num_rest();
    argv = opt_rest();
    if (keyfile != NULL && argc > 1) {
        BIO_printf(bio_err, "%s: Can only sign or verify one file.\n", prog);
        goto end;
    }

    if (do_verify && sigfile == NULL) {
        BIO_printf(bio_err,
                   "No signature to verify: use the -signature option\n");
        goto end;
    }
    if (engine_impl)
        impl = e;

    in = BIO_new(BIO_s_file());
    bmd = BIO_new(BIO_f_md());
    if ((in == NULL) || (bmd == NULL)) {
        ERR_print_errors(bio_err);
        goto end;
    }

    if (debug) {
        BIO_set_callback(in, BIO_debug_callback);
        /* needed for windows 3.1 */
        BIO_set_callback_arg(in, (char *)bio_err);
    }

    if (!app_passwd(passinarg, NULL, &passin, NULL)) {
        BIO_printf(bio_err, "Error getting password\n");
        goto end;
    }

    if (out_bin == -1) {
        if (keyfile != NULL)
            out_bin = 1;
        else
            out_bin = 0;
    }

    out = bio_open_default(outfile, 'w', out_bin ? FORMAT_BINARY : FORMAT_TEXT);
    if (out == NULL)
        goto end;

    if ((!(mac_name == NULL) + !(keyfile == NULL) + !(hmac_key == NULL)) > 1) {
        BIO_printf(bio_err, "MAC and Signing key cannot both be specified\n");
        goto end;
    }

    if (keyfile != NULL) {
        if (want_pub)
            sigkey = load_pubkey(keyfile, keyform, 0, NULL, e, "key file");
        else
            sigkey = load_key(keyfile, keyform, 0, passin, e, "key file");
        if (sigkey == NULL) {
            /*
             * load_[pub]key() has already printed an appropriate message
             */
            goto end;
        }
    }

    if (mac_name != NULL) {
        EVP_PKEY_CTX *mac_ctx = NULL;
        int r = 0;
        if (!init_gen_str(&mac_ctx, mac_name, impl, 0))
            goto mac_end;
        if (macopts != NULL) {
            char *macopt;
            for (i = 0; i < sk_OPENSSL_STRING_num(macopts); i++) {
                macopt = sk_OPENSSL_STRING_value(macopts, i);
                if (pkey_ctrl_string(mac_ctx, macopt) <= 0) {
                    BIO_printf(bio_err,
                               "MAC parameter error \"%s\"\n", macopt);
                    ERR_print_errors(bio_err);
                    goto mac_end;
                }
            }
        }
        if (EVP_PKEY_keygen(mac_ctx, &sigkey) <= 0) {
            BIO_puts(bio_err, "Error generating key\n");
            ERR_print_errors(bio_err);
            goto mac_end;
        }
        r = 1;
 mac_end:
        EVP_PKEY_CTX_free(mac_ctx);
        if (r == 0)
            goto end;
    }

    if (hmac_key != NULL) {
        sigkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, impl,
                                      (unsigned char *)hmac_key, -1);
        if (sigkey == NULL)
            goto end;
    }

    if (sigkey != NULL) {
        EVP_MD_CTX *mctx = NULL;
        EVP_PKEY_CTX *pctx = NULL;
        int r;
        if (!BIO_get_md_ctx(bmd, &mctx)) {
            BIO_printf(bio_err, "Error getting context\n");
            ERR_print_errors(bio_err);
            goto end;
        }
        if (do_verify)
            r = EVP_DigestVerifyInit(mctx, &pctx, md, impl, sigkey);
        else
            r = EVP_DigestSignInit(mctx, &pctx, md, impl, sigkey);
        if (!r) {
            BIO_printf(bio_err, "Error setting context\n");
            ERR_print_errors(bio_err);
            goto end;
        }
        if (sigopts != NULL) {
            char *sigopt;
            for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {
                sigopt = sk_OPENSSL_STRING_value(sigopts, i);
                if (pkey_ctrl_string(pctx, sigopt) <= 0) {
                    BIO_printf(bio_err, "parameter error \"%s\"\n", sigopt);
                    ERR_print_errors(bio_err);
                    goto end;
                }
            }
        }
    }
    /* we use md as a filter, reading from 'in' */
    else {
        EVP_MD_CTX *mctx = NULL;
        if (!BIO_get_md_ctx(bmd, &mctx)) {
            BIO_printf(bio_err, "Error getting context\n");
            ERR_print_errors(bio_err);
            goto end;
        }
        if (md == NULL)
            md = EVP_sha256();
        if (!EVP_DigestInit_ex(mctx, md, impl)) {
            BIO_printf(bio_err, "Error setting digest\n");
            ERR_print_errors(bio_err);
            goto end;
        }
    }

    if (sigfile != NULL && sigkey != NULL) {
        BIO *sigbio = BIO_new_file(sigfile, "rb");
        if (sigbio == NULL) {
            BIO_printf(bio_err, "Error opening signature file %s\n", sigfile);
            ERR_print_errors(bio_err);
            goto end;
        }
        siglen = EVP_PKEY_size(sigkey);
        sigbuf = app_malloc(siglen, "signature buffer");
        siglen = BIO_read(sigbio, sigbuf, siglen);
        BIO_free(sigbio);
        if (siglen <= 0) {
            BIO_printf(bio_err, "Error reading signature file %s\n", sigfile);
            ERR_print_errors(bio_err);
            goto end;
        }
    }
    inp = BIO_push(bmd, in);

    if (md == NULL) {
        EVP_MD_CTX *tctx;
        BIO_get_md_ctx(bmd, &tctx);
        md = EVP_MD_CTX_md(tctx);
    }

    if (argc == 0) {
        BIO_set_fp(in, stdin, BIO_NOCLOSE);
        ret = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
                    siglen, NULL, NULL, "stdin");
    } else {
        const char *md_name = NULL, *sig_name = NULL;
        if (!out_bin) {
            if (sigkey != NULL) {
                const EVP_PKEY_ASN1_METHOD *ameth;
                ameth = EVP_PKEY_get0_asn1(sigkey);
                if (ameth)
                    EVP_PKEY_asn1_get0_info(NULL, NULL,
                                            NULL, NULL, &sig_name, ameth);
            }
            if (md != NULL)
                md_name = EVP_MD_name(md);
        }
        ret = 0;
        for (i = 0; i < argc; i++) {
            int r;
            if (BIO_read_filename(in, argv[i]) <= 0) {
                perror(argv[i]);
                ret++;
                continue;
            } else {
                r = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
                          siglen, sig_name, md_name, argv[i]);
            }
            if (r)
                ret = r;
            (void)BIO_reset(bmd);
        }
    }
 end:
    OPENSSL_clear_free(buf, BUFSIZE);
    BIO_free(in);
    OPENSSL_free(passin);
    BIO_free_all(out);
    EVP_PKEY_free(sigkey);
    sk_OPENSSL_STRING_free(sigopts);
    sk_OPENSSL_STRING_free(macopts);
    OPENSSL_free(sigbuf);
    BIO_free(bmd);
    release_engine(e);
    return ret;
}

int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
          EVP_PKEY *key, unsigned char *sigin, int siglen,
          const char *sig_name, const char *md_name,
          const char *file)
{
    size_t len;
    int i;

    for (;;) {
        i = BIO_read(bp, (char *)buf, BUFSIZE);
        if (i < 0) {
            BIO_printf(bio_err, "Read Error in %s\n", file);
            ERR_print_errors(bio_err);
            return 1;
        }
        if (i == 0)
            break;
    }
    if (sigin != NULL) {
        EVP_MD_CTX *ctx;
        BIO_get_md_ctx(bp, &ctx);
        i = EVP_DigestVerifyFinal(ctx, sigin, (unsigned int)siglen);
        if (i > 0) {
            BIO_printf(out, "Verified OK\n");
        } else if (i == 0) {
            BIO_printf(out, "Verification Failure\n");
            return 1;
        } else {
            BIO_printf(bio_err, "Error Verifying Data\n");
            ERR_print_errors(bio_err);
            return 1;
        }
        return 0;
    }
    if (key != NULL) {
        EVP_MD_CTX *ctx;
        BIO_get_md_ctx(bp, &ctx);
        len = BUFSIZE;
        if (!EVP_DigestSignFinal(ctx, buf, &len)) {
            BIO_printf(bio_err, "Error Signing Data\n");
            ERR_print_errors(bio_err);
            return 1;
        }
    } else {
        len = BIO_gets(bp, (char *)buf, BUFSIZE);
        if ((int)len < 0) {
            ERR_print_errors(bio_err);
            return 1;
        }
    }

    if (binout) {
        BIO_write(out, buf, len);
    } else if (sep == 2) {
        for (i = 0; i < (int)len; i++)
            BIO_printf(out, "%02x", buf[i]);
        BIO_printf(out, " *%s\n", file);
    } else {
        if (sig_name != NULL) {
            BIO_puts(out, sig_name);
            if (md_name != NULL)
                BIO_printf(out, "-%s", md_name);
            BIO_printf(out, "(%s)= ", file);
        } else if (md_name != NULL) {
            BIO_printf(out, "%s(%s)= ", md_name, file);
        } else {
            BIO_printf(out, "(%s)= ", file);
        }
        for (i = 0; i < (int)len; i++) {
            if (sep && (i != 0))
                BIO_printf(out, ":");
            BIO_printf(out, "%02x", buf[i]);
        }
        BIO_printf(out, "\n");
    }
    return 0;
}
Commit	Line	Data
846e33c7	1	/*
6738bf14	2	* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
d02b48c6	3	*
846e33c7 RS	4	* Licensed under the OpenSSL license (the "License"). You may not use
	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
d02b48c6 RE	8	*/
	9
	10	#include <stdio.h>
	11	#include <string.h>
	12	#include <stdlib.h>
	13	#include "apps.h"
dab2cd68	14	#include "progs.h"
ec577822 BM	15	#include <openssl/bio.h>
	16	#include <openssl/err.h>
	17	#include <openssl/evp.h>
	18	#include <openssl/objects.h>
	19	#include <openssl/x509.h>
	20	#include <openssl/pem.h>
52cfa397	21	#include <openssl/hmac.h>
d02b48c6 RE	22
d02b48c6 RE	23	#undef BUFSIZE
0f113f3e	24	#define BUFSIZE 1024*8
d02b48c6	25
d15711ef	26	int do_fp(BIO out, unsigned char buf, BIO *bp, int sep, int binout,
0f113f3e MC	27	EVP_PKEY key, unsigned char sigin, int siglen,
0f113f3e MC	28	const char sig_name, const char md_name,
a773b52a	29	const char *file);
667ac4ec	30
7e1b7485 RS	31	typedef enum OPTION_choice {
7e1b7485 RS	32	OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
3ee1eac2	33	OPT_C, OPT_R, OPT_OUT, OPT_SIGN, OPT_PASSIN, OPT_VERIFY,
7e1b7485 RS	34	OPT_PRVERIFY, OPT_SIGNATURE, OPT_KEYFORM, OPT_ENGINE, OPT_ENGINE_IMPL,
7e1b7485 RS	35	OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT,
700b4a4a	36	OPT_HMAC, OPT_MAC, OPT_SIGOPT, OPT_MACOPT,
3ee1eac2	37	OPT_DIGEST,
f1b8b001	38	OPT_R_ENUM
7e1b7485 RS	39	} OPTION_CHOICE;
7e1b7485 RS	40
44c83ebd	41	const OPTIONS dgst_options[] = {
7e1b7485 RS	42	{OPT_HELP_STR, 1, '-', "Usage: %s [options] [file...]\n"},
	43	{OPT_HELP_STR, 1, '-',
	44	" file... files to digest (default is stdin)\n"},
	45	{"help", OPT_HELP, '-', "Display this summary"},
	46	{"c", OPT_C, '-', "Print the digest with separating colons"},
	47	{"r", OPT_R, '-', "Print the digest in coreutils format"},
7e1b7485	48	{"out", OPT_OUT, '>', "Output to filename rather than stdout"},
a173a7ee	49	{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
dd958974 DSH	50	{"sign", OPT_SIGN, 's', "Sign digest using private key"},
	51	{"verify", OPT_VERIFY, 's',
	52	"Verify a signature using public key"},
	53	{"prverify", OPT_PRVERIFY, 's',
	54	"Verify a signature using private key"},
7e1b7485 RS	55	{"signature", OPT_SIGNATURE, '<', "File with signature to verify"},
7e1b7485 RS	56	{"keyform", OPT_KEYFORM, 'f', "Key file format (PEM or ENGINE)"},
7e1b7485 RS	57	{"hex", OPT_HEX, '-', "Print as hex dump"},
	58	{"binary", OPT_BINARY, '-', "Print in binary form"},
	59	{"d", OPT_DEBUG, '-', "Print debug info"},
a173a7ee RS	60	{"debug", OPT_DEBUG, '-', "Print debug info"},
	61	{"fips-fingerprint", OPT_FIPS_FINGERPRINT, '-',
	62	"Compute HMAC with the key used in OpenSSL-FIPS fingerprint"},
7e1b7485	63	{"hmac", OPT_HMAC, 's', "Create hashed MAC with key"},
0d4fb843	64	{"mac", OPT_MAC, 's', "Create MAC (not necessarily HMAC)"},
d175e8a6 MC	65	{"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
d175e8a6 MC	66	{"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form or key"},
9c3bcfa0	67	{"", OPT_DIGEST, '-', "Any supported digest"},
3ee1eac2	68	OPT_R_OPTIONS,
333b070e RS	69	#ifndef OPENSSL_NO_ENGINE
333b070e RS	70	{"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
a173a7ee RS	71	{"engine_impl", OPT_ENGINE_IMPL, '-',
a173a7ee RS	72	"Also use engine given by -engine for digest operations"},
333b070e	73	#endif
7e1b7485 RS	74	{NULL}
	75	};
	76
	77	int dgst_main(int argc, char **argv)
0f113f3e	78	{
7e1b7485	79	BIO in = NULL, inp, bmd = NULL, out = NULL;
0f113f3e	80	ENGINE e = NULL, impl = NULL;
7e1b7485 RS	81	EVP_PKEY *sigkey = NULL;
	82	STACK_OF(OPENSSL_STRING) sigopts = NULL, macopts = NULL;
	83	char *hmac_key = NULL;
	84	char *mac_name = NULL;
	85	char passinarg = NULL, passin = NULL;
0f113f3e	86	const EVP_MD md = NULL, m;
7e1b7485	87	const char outfile = NULL, keyfile = NULL, *prog = NULL;
3ee1eac2	88	const char *sigfile = NULL;
7e1b7485 RS	89	OPTION_CHOICE o;
7e1b7485 RS	90	int separator = 0, debug = 0, keyform = FORMAT_PEM, siglen = 0;
700b4a4a	91	int i, ret = 1, out_bin = -1, want_pub = 0, do_verify = 0;
7e1b7485	92	unsigned char buf = NULL, sigbuf = NULL;
0f113f3e	93	int engine_impl = 0;
0f113f3e	94
7e1b7485	95	prog = opt_progname(argv[0]);
68dc6824	96	buf = app_malloc(BUFSIZE, "I/O buffer");
7e1b7485 RS	97	md = EVP_get_digestbyname(prog);
	98
	99	prog = opt_init(argc, argv, dgst_options);
	100	while ((o = opt_next()) != OPT_EOF) {
	101	switch (o) {
	102	case OPT_EOF:
	103	case OPT_ERR:
	104	opthelp:
	105	BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
	106	goto end;
	107	case OPT_HELP:
	108	opt_help(dgst_options);
	109	ret = 0;
	110	goto end;
	111	case OPT_C:
0f113f3e	112	separator = 1;
7e1b7485 RS	113	break;
7e1b7485 RS	114	case OPT_R:
0f113f3e	115	separator = 2;
7e1b7485	116	break;
3ee1eac2 RS	117	case OPT_R_CASES:
	118	if (!opt_rand(o))
	119	goto end;
7e1b7485 RS	120	break;
	121	case OPT_OUT:
	122	outfile = opt_arg();
	123	break;
	124	case OPT_SIGN:
	125	keyfile = opt_arg();
	126	break;
	127	case OPT_PASSIN:
	128	passinarg = opt_arg();
	129	break;
	130	case OPT_VERIFY:
	131	keyfile = opt_arg();
	132	want_pub = do_verify = 1;
	133	break;
	134	case OPT_PRVERIFY:
	135	keyfile = opt_arg();
0f113f3e	136	do_verify = 1;
7e1b7485 RS	137	break;
	138	case OPT_SIGNATURE:
	139	sigfile = opt_arg();
	140	break;
	141	case OPT_KEYFORM:
	142	if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform))
	143	goto opthelp;
	144	break;
7e1b7485	145	case OPT_ENGINE:
333b070e	146	e = setup_engine(opt_arg(), 0);
7e1b7485 RS	147	break;
7e1b7485 RS	148	case OPT_ENGINE_IMPL:
0f113f3e	149	engine_impl = 1;
7e1b7485	150	break;
7e1b7485	151	case OPT_HEX:
0f113f3e	152	out_bin = 0;
7e1b7485 RS	153	break;
7e1b7485 RS	154	case OPT_BINARY:
0f113f3e	155	out_bin = 1;
7e1b7485 RS	156	break;
7e1b7485 RS	157	case OPT_DEBUG:
0f113f3e	158	debug = 1;
7e1b7485 RS	159	break;
7e1b7485 RS	160	case OPT_FIPS_FINGERPRINT:
0f113f3e	161	hmac_key = "etaonrishdlcupfm";
7e1b7485	162	break;
7e1b7485 RS	163	case OPT_HMAC:
	164	hmac_key = opt_arg();
	165	break;
	166	case OPT_MAC:
	167	mac_name = opt_arg();
	168	break;
	169	case OPT_SIGOPT:
0f113f3e MC	170	if (!sigopts)
0f113f3e MC	171	sigopts = sk_OPENSSL_STRING_new_null();
7e1b7485 RS	172	if (!sigopts \|\| !sk_OPENSSL_STRING_push(sigopts, opt_arg()))
	173	goto opthelp;
	174	break;
	175	case OPT_MACOPT:
0f113f3e MC	176	if (!macopts)
0f113f3e MC	177	macopts = sk_OPENSSL_STRING_new_null();
7e1b7485 RS	178	if (!macopts \|\| !sk_OPENSSL_STRING_push(macopts, opt_arg()))
	179	goto opthelp;
	180	break;
	181	case OPT_DIGEST:
	182	if (!opt_md(opt_unknown(), &m))
	183	goto opthelp;
0f113f3e	184	md = m;
0f113f3e	185	break;
7e1b7485	186	}
0f113f3e	187	}
7e1b7485 RS	188	argc = opt_num_rest();
7e1b7485 RS	189	argv = opt_rest();
13a46183 RS	190	if (keyfile != NULL && argc > 1) {
	191	BIO_printf(bio_err, "%s: Can only sign or verify one file.\n", prog);
	192	goto end;
	193	}
0f113f3e	194
2234212c	195	if (do_verify && sigfile == NULL) {
0f113f3e MC	196	BIO_printf(bio_err,
	197	"No signature to verify: use the -signature option\n");
	198	goto end;
	199	}
0f113f3e MC	200	if (engine_impl)
0f113f3e MC	201	impl = e;
bb845ee0	202
0f113f3e MC	203	in = BIO_new(BIO_s_file());
0f113f3e MC	204	bmd = BIO_new(BIO_f_md());
be1477ad MC	205	if ((in == NULL) \|\| (bmd == NULL)) {
	206	ERR_print_errors(bio_err);
	207	goto end;
	208	}
	209
0f113f3e MC	210	if (debug) {
	211	BIO_set_callback(in, BIO_debug_callback);
	212	/* needed for windows 3.1 */
	213	BIO_set_callback_arg(in, (char *)bio_err);
	214	}
	215
7e1b7485	216	if (!app_passwd(passinarg, NULL, &passin, NULL)) {
0f113f3e MC	217	BIO_printf(bio_err, "Error getting password\n");
	218	goto end;
	219	}
	220
0f113f3e	221	if (out_bin == -1) {
2234212c	222	if (keyfile != NULL)
0f113f3e MC	223	out_bin = 1;
	224	else
	225	out_bin = 0;
	226	}
	227
bdd58d98	228	out = bio_open_default(outfile, 'w', out_bin ? FORMAT_BINARY : FORMAT_TEXT);
7e1b7485	229	if (out == NULL)
0f113f3e	230	goto end;
7e1b7485	231
2234212c	232	if ((!(mac_name == NULL) + !(keyfile == NULL) + !(hmac_key == NULL)) > 1) {
0f113f3e MC	233	BIO_printf(bio_err, "MAC and Signing key cannot both be specified\n");
	234	goto end;
	235	}
	236
2234212c	237	if (keyfile != NULL) {
0f113f3e	238	if (want_pub)
7e1b7485	239	sigkey = load_pubkey(keyfile, keyform, 0, NULL, e, "key file");
0f113f3e	240	else
7e1b7485	241	sigkey = load_key(keyfile, keyform, 0, passin, e, "key file");
2234212c	242	if (sigkey == NULL) {
0f113f3e MC	243	/*
	244	* load_[pub]key() has already printed an appropriate message
	245	*/
	246	goto end;
	247	}
	248	}
	249
2234212c	250	if (mac_name != NULL) {
0f113f3e MC	251	EVP_PKEY_CTX *mac_ctx = NULL;
0f113f3e MC	252	int r = 0;
7e1b7485	253	if (!init_gen_str(&mac_ctx, mac_name, impl, 0))
0f113f3e	254	goto mac_end;
2234212c	255	if (macopts != NULL) {
0f113f3e MC	256	char *macopt;
	257	for (i = 0; i < sk_OPENSSL_STRING_num(macopts); i++) {
	258	macopt = sk_OPENSSL_STRING_value(macopts, i);
	259	if (pkey_ctrl_string(mac_ctx, macopt) <= 0) {
	260	BIO_printf(bio_err,
	261	"MAC parameter error \"%s\"\n", macopt);
	262	ERR_print_errors(bio_err);
	263	goto mac_end;
	264	}
	265	}
	266	}
	267	if (EVP_PKEY_keygen(mac_ctx, &sigkey) <= 0) {
	268	BIO_puts(bio_err, "Error generating key\n");
	269	ERR_print_errors(bio_err);
	270	goto mac_end;
	271	}
	272	r = 1;
	273	mac_end:
c5ba2d99	274	EVP_PKEY_CTX_free(mac_ctx);
0f113f3e MC	275	if (r == 0)
	276	goto end;
	277	}
	278
2234212c	279	if (hmac_key != NULL) {
0f113f3e MC	280	sigkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, impl,
0f113f3e MC	281	(unsigned char *)hmac_key, -1);
2234212c	282	if (sigkey == NULL)
0f113f3e MC	283	goto end;
	284	}
	285
2234212c	286	if (sigkey != NULL) {
0f113f3e MC	287	EVP_MD_CTX *mctx = NULL;
	288	EVP_PKEY_CTX *pctx = NULL;
	289	int r;
	290	if (!BIO_get_md_ctx(bmd, &mctx)) {
	291	BIO_printf(bio_err, "Error getting context\n");
	292	ERR_print_errors(bio_err);
	293	goto end;
	294	}
	295	if (do_verify)
	296	r = EVP_DigestVerifyInit(mctx, &pctx, md, impl, sigkey);
	297	else
	298	r = EVP_DigestSignInit(mctx, &pctx, md, impl, sigkey);
	299	if (!r) {
	300	BIO_printf(bio_err, "Error setting context\n");
	301	ERR_print_errors(bio_err);
	302	goto end;
	303	}
2234212c	304	if (sigopts != NULL) {
0f113f3e MC	305	char *sigopt;
	306	for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {
	307	sigopt = sk_OPENSSL_STRING_value(sigopts, i);
	308	if (pkey_ctrl_string(pctx, sigopt) <= 0) {
	309	BIO_printf(bio_err, "parameter error \"%s\"\n", sigopt);
	310	ERR_print_errors(bio_err);
	311	goto end;
	312	}
	313	}
	314	}
	315	}
	316	/* we use md as a filter, reading from 'in' */
	317	else {
	318	EVP_MD_CTX *mctx = NULL;
	319	if (!BIO_get_md_ctx(bmd, &mctx)) {
	320	BIO_printf(bio_err, "Error getting context\n");
	321	ERR_print_errors(bio_err);
	322	goto end;
	323	}
	324	if (md == NULL)
f8547f62	325	md = EVP_sha256();
0f113f3e	326	if (!EVP_DigestInit_ex(mctx, md, impl)) {
7e1b7485	327	BIO_printf(bio_err, "Error setting digest\n");
0f113f3e MC	328	ERR_print_errors(bio_err);
	329	goto end;
	330	}
	331	}
	332
2234212c	333	if (sigfile != NULL && sigkey != NULL) {
7e1b7485	334	BIO *sigbio = BIO_new_file(sigfile, "rb");
2234212c	335	if (sigbio == NULL) {
0f113f3e MC	336	BIO_printf(bio_err, "Error opening signature file %s\n", sigfile);
	337	ERR_print_errors(bio_err);
	338	goto end;
	339	}
7e1b7485	340	siglen = EVP_PKEY_size(sigkey);
68dc6824	341	sigbuf = app_malloc(siglen, "signature buffer");
0f113f3e MC	342	siglen = BIO_read(sigbio, sigbuf, siglen);
	343	BIO_free(sigbio);
	344	if (siglen <= 0) {
	345	BIO_printf(bio_err, "Error reading signature file %s\n", sigfile);
	346	ERR_print_errors(bio_err);
	347	goto end;
	348	}
	349	}
	350	inp = BIO_push(bmd, in);
	351
	352	if (md == NULL) {
	353	EVP_MD_CTX *tctx;
	354	BIO_get_md_ctx(bmd, &tctx);
	355	md = EVP_MD_CTX_md(tctx);
	356	}
	357
	358	if (argc == 0) {
	359	BIO_set_fp(in, stdin, BIO_NOCLOSE);
7e1b7485	360	ret = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
a773b52a	361	siglen, NULL, NULL, "stdin");
0f113f3e MC	362	} else {
	363	const char md_name = NULL, sig_name = NULL;
	364	if (!out_bin) {
2234212c	365	if (sigkey != NULL) {
0f113f3e MC	366	const EVP_PKEY_ASN1_METHOD *ameth;
	367	ameth = EVP_PKEY_get0_asn1(sigkey);
	368	if (ameth)
	369	EVP_PKEY_asn1_get0_info(NULL, NULL,
	370	NULL, NULL, &sig_name, ameth);
	371	}
2234212c	372	if (md != NULL)
0f113f3e MC	373	md_name = EVP_MD_name(md);
0f113f3e MC	374	}
7e1b7485	375	ret = 0;
0f113f3e MC	376	for (i = 0; i < argc; i++) {
	377	int r;
	378	if (BIO_read_filename(in, argv[i]) <= 0) {
	379	perror(argv[i]);
7e1b7485	380	ret++;
0f113f3e	381	continue;
2234212c	382	} else {
0f113f3e	383	r = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
a773b52a	384	siglen, sig_name, md_name, argv[i]);
2234212c	385	}
0f113f3e	386	if (r)
7e1b7485	387	ret = r;
0f113f3e MC	388	(void)BIO_reset(bmd);
	389	}
	390	}
	391	end:
4b45c6e5	392	OPENSSL_clear_free(buf, BUFSIZE);
ca3a82c3	393	BIO_free(in);
25aaa98a	394	OPENSSL_free(passin);
0f113f3e MC	395	BIO_free_all(out);
0f113f3e MC	396	EVP_PKEY_free(sigkey);
25aaa98a RS	397	sk_OPENSSL_STRING_free(sigopts);
25aaa98a RS	398	sk_OPENSSL_STRING_free(macopts);
b548a1f1	399	OPENSSL_free(sigbuf);
ca3a82c3	400	BIO_free(bmd);
dd1abd44	401	release_engine(e);
26a7d938	402	return ret;
0f113f3e	403	}
d02b48c6	404
d15711ef	405	int do_fp(BIO out, unsigned char buf, BIO *bp, int sep, int binout,
0f113f3e MC	406	EVP_PKEY key, unsigned char sigin, int siglen,
0f113f3e MC	407	const char sig_name, const char md_name,
a773b52a	408	const char *file)
0f113f3e MC	409	{
	410	size_t len;
	411	int i;
	412
	413	for (;;) {
	414	i = BIO_read(bp, (char *)buf, BUFSIZE);
	415	if (i < 0) {
	416	BIO_printf(bio_err, "Read Error in %s\n", file);
	417	ERR_print_errors(bio_err);
	418	return 1;
	419	}
	420	if (i == 0)
	421	break;
	422	}
2234212c	423	if (sigin != NULL) {
0f113f3e MC	424	EVP_MD_CTX *ctx;
	425	BIO_get_md_ctx(bp, &ctx);
	426	i = EVP_DigestVerifyFinal(ctx, sigin, (unsigned int)siglen);
2234212c	427	if (i > 0) {
0f113f3e	428	BIO_printf(out, "Verified OK\n");
2234212c	429	} else if (i == 0) {
0f113f3e MC	430	BIO_printf(out, "Verification Failure\n");
	431	return 1;
	432	} else {
	433	BIO_printf(bio_err, "Error Verifying Data\n");
	434	ERR_print_errors(bio_err);
	435	return 1;
	436	}
	437	return 0;
	438	}
2234212c	439	if (key != NULL) {
0f113f3e MC	440	EVP_MD_CTX *ctx;
	441	BIO_get_md_ctx(bp, &ctx);
	442	len = BUFSIZE;
	443	if (!EVP_DigestSignFinal(ctx, buf, &len)) {
	444	BIO_printf(bio_err, "Error Signing Data\n");
	445	ERR_print_errors(bio_err);
	446	return 1;
	447	}
	448	} else {
	449	len = BIO_gets(bp, (char *)buf, BUFSIZE);
	450	if ((int)len < 0) {
	451	ERR_print_errors(bio_err);
	452	return 1;
	453	}
	454	}
	455
2234212c	456	if (binout) {
0f113f3e	457	BIO_write(out, buf, len);
2234212c	458	} else if (sep == 2) {
0f113f3e MC	459	for (i = 0; i < (int)len; i++)
	460	BIO_printf(out, "%02x", buf[i]);
	461	BIO_printf(out, " *%s\n", file);
	462	} else {
2234212c	463	if (sig_name != NULL) {
0f113f3e	464	BIO_puts(out, sig_name);
2234212c	465	if (md_name != NULL)
0f113f3e MC	466	BIO_printf(out, "-%s", md_name);
0f113f3e MC	467	BIO_printf(out, "(%s)= ", file);
2234212c	468	} else if (md_name != NULL) {
0f113f3e	469	BIO_printf(out, "%s(%s)= ", md_name, file);
2234212c	470	} else {
0f113f3e	471	BIO_printf(out, "(%s)= ", file);
2234212c	472	}
0f113f3e MC	473	for (i = 0; i < (int)len; i++) {
	474	if (sep && (i != 0))
	475	BIO_printf(out, ":");
	476	BIO_printf(out, "%02x", buf[i]);
	477	}
	478	BIO_printf(out, "\n");
	479	}
	480	return 0;
	481	}