]>
Commit | Line | Data |
---|---|---|
c403a1dd | 1 | /* |
fecb3aae | 2 | * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. |
c403a1dd | 3 | * |
dffa7520 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
c403a1dd RL |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
10 | #include <openssl/opensslconf.h> | |
11 | ||
12 | #include "apps.h" | |
dab2cd68 | 13 | #include "progs.h" |
c403a1dd RL |
14 | #include <openssl/err.h> |
15 | #include <openssl/pem.h> | |
16 | #include <openssl/store.h> | |
946ec584 | 17 | #include <openssl/x509v3.h> /* s2i_ASN1_INTEGER */ |
c403a1dd | 18 | |
fb43ddce | 19 | static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata, |
511e4e0d RL |
20 | int expected, int criterion, OSSL_STORE_SEARCH *search, |
21 | int text, int noout, int recursive, int indent, BIO *out, | |
7dc67708 | 22 | const char *prog, OSSL_LIB_CTX *libctx); |
fb43ddce | 23 | |
c403a1dd | 24 | typedef enum OPTION_choice { |
b0f96018 DDO |
25 | OPT_COMMON, |
26 | OPT_ENGINE, OPT_OUT, OPT_PASSIN, | |
9511d973 | 27 | OPT_NOOUT, OPT_TEXT, OPT_RECURSIVE, |
511e4e0d RL |
28 | OPT_SEARCHFOR_CERTS, OPT_SEARCHFOR_KEYS, OPT_SEARCHFOR_CRLS, |
29 | OPT_CRITERION_SUBJECT, OPT_CRITERION_ISSUER, OPT_CRITERION_SERIAL, | |
30 | OPT_CRITERION_FINGERPRINT, OPT_CRITERION_ALIAS, | |
6bd4e3f2 | 31 | OPT_MD, OPT_PROV_ENUM |
c403a1dd RL |
32 | } OPTION_CHOICE; |
33 | ||
34 | const OPTIONS storeutl_options[] = { | |
5388f986 RS |
35 | {OPT_HELP_STR, 1, '-', "Usage: %s [options] uri\n"}, |
36 | ||
37 | OPT_SECTION("General"), | |
c403a1dd | 38 | {"help", OPT_HELP, '-', "Display this summary"}, |
5388f986 RS |
39 | {"", OPT_MD, '-', "Any supported digest"}, |
40 | #ifndef OPENSSL_NO_ENGINE | |
41 | {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, | |
42 | #endif | |
43 | ||
44 | OPT_SECTION("Search"), | |
9511d973 RL |
45 | {"certs", OPT_SEARCHFOR_CERTS, '-', "Search for certificates only"}, |
46 | {"keys", OPT_SEARCHFOR_KEYS, '-', "Search for keys only"}, | |
47 | {"crls", OPT_SEARCHFOR_CRLS, '-', "Search for CRLs only"}, | |
511e4e0d RL |
48 | {"subject", OPT_CRITERION_SUBJECT, 's', "Search by subject"}, |
49 | {"issuer", OPT_CRITERION_ISSUER, 's', "Search by issuer and serial, issuer name"}, | |
50 | {"serial", OPT_CRITERION_SERIAL, 's', "Search by issuer and serial, serial number"}, | |
51 | {"fingerprint", OPT_CRITERION_FINGERPRINT, 's', "Search by public key fingerprint, given in hex"}, | |
52 | {"alias", OPT_CRITERION_ALIAS, 's', "Search by alias"}, | |
fb43ddce | 53 | {"r", OPT_RECURSIVE, '-', "Recurse through names"}, |
5388f986 RS |
54 | |
55 | OPT_SECTION("Input"), | |
56 | {"passin", OPT_PASSIN, 's', "Input file pass phrase source"}, | |
57 | ||
58 | OPT_SECTION("Output"), | |
59 | {"out", OPT_OUT, '>', "Output file - default stdout"}, | |
60 | {"text", OPT_TEXT, '-', "Print a text form of the objects"}, | |
61 | {"noout", OPT_NOOUT, '-', "No PEM output, just status"}, | |
92de469f | 62 | |
6bd4e3f2 P |
63 | OPT_PROV_OPTIONS, |
64 | ||
92de469f RS |
65 | OPT_PARAMETERS(), |
66 | {"uri", 0, 0, "URI of the store object"}, | |
c403a1dd RL |
67 | {NULL} |
68 | }; | |
69 | ||
70 | int storeutl_main(int argc, char *argv[]) | |
71 | { | |
fb43ddce | 72 | int ret = 1, noout = 0, text = 0, recursive = 0; |
c403a1dd RL |
73 | char *outfile = NULL, *passin = NULL, *passinarg = NULL; |
74 | BIO *out = NULL; | |
75 | ENGINE *e = NULL; | |
76 | OPTION_CHOICE o; | |
2c272447 | 77 | char *prog; |
c403a1dd | 78 | PW_CB_DATA pw_cb_data; |
9511d973 | 79 | int expected = 0; |
511e4e0d RL |
80 | int criterion = 0; |
81 | X509_NAME *subject = NULL, *issuer = NULL; | |
82 | ASN1_INTEGER *serial = NULL; | |
83 | unsigned char *fingerprint = NULL; | |
84 | size_t fingerprintlen = 0; | |
d0190e11 | 85 | char *alias = NULL, *digestname = NULL; |
511e4e0d | 86 | OSSL_STORE_SEARCH *search = NULL; |
606a417f | 87 | EVP_MD *digest = NULL; |
b4250010 | 88 | OSSL_LIB_CTX *libctx = app_get0_libctx(); |
c403a1dd | 89 | |
2c272447 DDO |
90 | opt_set_unknown_name("digest"); |
91 | prog = opt_init(argc, argv, storeutl_options); | |
c403a1dd RL |
92 | while ((o = opt_next()) != OPT_EOF) { |
93 | switch (o) { | |
94 | case OPT_EOF: | |
95 | case OPT_ERR: | |
96 | opthelp: | |
97 | BIO_printf(bio_err, "%s: Use -help for summary.\n", prog); | |
98 | goto end; | |
99 | case OPT_HELP: | |
100 | opt_help(storeutl_options); | |
101 | ret = 0; | |
102 | goto end; | |
103 | case OPT_OUT: | |
104 | outfile = opt_arg(); | |
105 | break; | |
106 | case OPT_PASSIN: | |
107 | passinarg = opt_arg(); | |
108 | break; | |
109 | case OPT_NOOUT: | |
110 | noout = 1; | |
111 | break; | |
112 | case OPT_TEXT: | |
113 | text = 1; | |
114 | break; | |
fb43ddce RL |
115 | case OPT_RECURSIVE: |
116 | recursive = 1; | |
117 | break; | |
9511d973 RL |
118 | case OPT_SEARCHFOR_CERTS: |
119 | case OPT_SEARCHFOR_KEYS: | |
120 | case OPT_SEARCHFOR_CRLS: | |
121 | if (expected != 0) { | |
122 | BIO_printf(bio_err, "%s: only one search type can be given.\n", | |
123 | prog); | |
124 | goto end; | |
125 | } | |
126 | { | |
127 | static const struct { | |
128 | enum OPTION_choice choice; | |
129 | int type; | |
130 | } map[] = { | |
131 | {OPT_SEARCHFOR_CERTS, OSSL_STORE_INFO_CERT}, | |
132 | {OPT_SEARCHFOR_KEYS, OSSL_STORE_INFO_PKEY}, | |
133 | {OPT_SEARCHFOR_CRLS, OSSL_STORE_INFO_CRL}, | |
134 | }; | |
135 | size_t i; | |
136 | ||
137 | for (i = 0; i < OSSL_NELEM(map); i++) { | |
138 | if (o == map[i].choice) { | |
139 | expected = map[i].type; | |
140 | break; | |
141 | } | |
142 | } | |
143 | /* | |
144 | * If expected wasn't set at this point, it means the map | |
c2969ff6 | 145 | * isn't synchronised with the possible options leading here. |
9511d973 RL |
146 | */ |
147 | OPENSSL_assert(expected != 0); | |
148 | } | |
149 | break; | |
511e4e0d RL |
150 | case OPT_CRITERION_SUBJECT: |
151 | if (criterion != 0) { | |
152 | BIO_printf(bio_err, "%s: criterion already given.\n", | |
153 | prog); | |
154 | goto end; | |
155 | } | |
156 | criterion = OSSL_STORE_SEARCH_BY_NAME; | |
157 | if (subject != NULL) { | |
158 | BIO_printf(bio_err, "%s: subject already given.\n", | |
159 | prog); | |
160 | goto end; | |
161 | } | |
57c05c57 DDO |
162 | subject = parse_name(opt_arg(), MBSTRING_UTF8, 1, "subject"); |
163 | if (subject == NULL) | |
511e4e0d | 164 | goto end; |
511e4e0d RL |
165 | break; |
166 | case OPT_CRITERION_ISSUER: | |
167 | if (criterion != 0 | |
168 | || (criterion == OSSL_STORE_SEARCH_BY_ISSUER_SERIAL | |
169 | && issuer != NULL)) { | |
170 | BIO_printf(bio_err, "%s: criterion already given.\n", | |
171 | prog); | |
172 | goto end; | |
173 | } | |
174 | criterion = OSSL_STORE_SEARCH_BY_ISSUER_SERIAL; | |
175 | if (issuer != NULL) { | |
176 | BIO_printf(bio_err, "%s: issuer already given.\n", | |
177 | prog); | |
178 | goto end; | |
179 | } | |
57c05c57 DDO |
180 | issuer = parse_name(opt_arg(), MBSTRING_UTF8, 1, "issuer"); |
181 | if (issuer == NULL) | |
511e4e0d | 182 | goto end; |
511e4e0d RL |
183 | break; |
184 | case OPT_CRITERION_SERIAL: | |
185 | if (criterion != 0 | |
186 | || (criterion == OSSL_STORE_SEARCH_BY_ISSUER_SERIAL | |
187 | && serial != NULL)) { | |
188 | BIO_printf(bio_err, "%s: criterion already given.\n", | |
189 | prog); | |
190 | goto end; | |
191 | } | |
192 | criterion = OSSL_STORE_SEARCH_BY_ISSUER_SERIAL; | |
193 | if (serial != NULL) { | |
194 | BIO_printf(bio_err, "%s: serial number already given.\n", | |
195 | prog); | |
196 | goto end; | |
197 | } | |
198 | if ((serial = s2i_ASN1_INTEGER(NULL, opt_arg())) == NULL) { | |
199 | BIO_printf(bio_err, "%s: can't parse serial number argument.\n", | |
200 | prog); | |
201 | goto end; | |
202 | } | |
203 | break; | |
204 | case OPT_CRITERION_FINGERPRINT: | |
205 | if (criterion != 0 | |
206 | || (criterion == OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT | |
207 | && fingerprint != NULL)) { | |
208 | BIO_printf(bio_err, "%s: criterion already given.\n", | |
209 | prog); | |
210 | goto end; | |
211 | } | |
212 | criterion = OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT; | |
213 | if (fingerprint != NULL) { | |
214 | BIO_printf(bio_err, "%s: fingerprint already given.\n", | |
215 | prog); | |
216 | goto end; | |
217 | } | |
218 | { | |
219 | long tmplen = 0; | |
220 | ||
221 | if ((fingerprint = OPENSSL_hexstr2buf(opt_arg(), &tmplen)) | |
222 | == NULL) { | |
223 | BIO_printf(bio_err, | |
224 | "%s: can't parse fingerprint argument.\n", | |
225 | prog); | |
226 | goto end; | |
227 | } | |
228 | fingerprintlen = (size_t)tmplen; | |
229 | } | |
230 | break; | |
231 | case OPT_CRITERION_ALIAS: | |
232 | if (criterion != 0) { | |
233 | BIO_printf(bio_err, "%s: criterion already given.\n", | |
234 | prog); | |
235 | goto end; | |
236 | } | |
237 | criterion = OSSL_STORE_SEARCH_BY_ALIAS; | |
238 | if (alias != NULL) { | |
239 | BIO_printf(bio_err, "%s: alias already given.\n", | |
240 | prog); | |
241 | goto end; | |
242 | } | |
243 | if ((alias = OPENSSL_strdup(opt_arg())) == NULL) { | |
244 | BIO_printf(bio_err, "%s: can't parse alias argument.\n", | |
245 | prog); | |
246 | goto end; | |
247 | } | |
248 | break; | |
c403a1dd RL |
249 | case OPT_ENGINE: |
250 | e = setup_engine(opt_arg(), 0); | |
251 | break; | |
511e4e0d | 252 | case OPT_MD: |
d0190e11 RS |
253 | digestname = opt_unknown(); |
254 | break; | |
6bd4e3f2 P |
255 | case OPT_PROV_CASES: |
256 | if (!opt_provider(o)) | |
257 | goto end; | |
258 | break; | |
c403a1dd RL |
259 | } |
260 | } | |
021410ea RS |
261 | |
262 | /* One argument, the URI */ | |
d9f07357 | 263 | if (!opt_check_rest_arg("URI")) |
c403a1dd | 264 | goto opthelp; |
d9f07357 | 265 | argv = opt_rest(); |
c403a1dd | 266 | |
d9f07357 DDO |
267 | if (!opt_md(digestname, &digest)) |
268 | goto opthelp; | |
d0190e11 | 269 | |
511e4e0d RL |
270 | if (criterion != 0) { |
271 | switch (criterion) { | |
272 | case OSSL_STORE_SEARCH_BY_NAME: | |
273 | if ((search = OSSL_STORE_SEARCH_by_name(subject)) == NULL) { | |
274 | ERR_print_errors(bio_err); | |
275 | goto end; | |
276 | } | |
277 | break; | |
278 | case OSSL_STORE_SEARCH_BY_ISSUER_SERIAL: | |
279 | if (issuer == NULL || serial == NULL) { | |
280 | BIO_printf(bio_err, | |
281 | "%s: both -issuer and -serial must be given.\n", | |
282 | prog); | |
283 | goto end; | |
284 | } | |
285 | if ((search = OSSL_STORE_SEARCH_by_issuer_serial(issuer, serial)) | |
286 | == NULL) { | |
287 | ERR_print_errors(bio_err); | |
288 | goto end; | |
289 | } | |
290 | break; | |
291 | case OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT: | |
292 | if ((search = OSSL_STORE_SEARCH_by_key_fingerprint(digest, | |
293 | fingerprint, | |
294 | fingerprintlen)) | |
295 | == NULL) { | |
296 | ERR_print_errors(bio_err); | |
297 | goto end; | |
298 | } | |
299 | break; | |
300 | case OSSL_STORE_SEARCH_BY_ALIAS: | |
301 | if ((search = OSSL_STORE_SEARCH_by_alias(alias)) == NULL) { | |
302 | ERR_print_errors(bio_err); | |
303 | goto end; | |
304 | } | |
305 | break; | |
306 | } | |
307 | } | |
308 | ||
c403a1dd RL |
309 | if (!app_passwd(passinarg, NULL, &passin, NULL)) { |
310 | BIO_printf(bio_err, "Error getting passwords\n"); | |
311 | goto end; | |
312 | } | |
313 | pw_cb_data.password = passin; | |
314 | pw_cb_data.prompt_info = argv[0]; | |
315 | ||
316 | out = bio_open_default(outfile, 'w', FORMAT_TEXT); | |
317 | if (out == NULL) | |
318 | goto end; | |
319 | ||
9511d973 | 320 | ret = process(argv[0], get_ui_method(), &pw_cb_data, |
511e4e0d | 321 | expected, criterion, search, |
7dc67708 | 322 | text, noout, recursive, 0, out, prog, libctx); |
fb43ddce RL |
323 | |
324 | end: | |
606a417f | 325 | EVP_MD_free(digest); |
28c73b34 | 326 | OPENSSL_free(fingerprint); |
511e4e0d RL |
327 | OPENSSL_free(alias); |
328 | ASN1_INTEGER_free(serial); | |
329 | X509_NAME_free(subject); | |
330 | X509_NAME_free(issuer); | |
331 | OSSL_STORE_SEARCH_free(search); | |
fb43ddce RL |
332 | BIO_free_all(out); |
333 | OPENSSL_free(passin); | |
334 | release_engine(e); | |
335 | return ret; | |
336 | } | |
337 | ||
338 | static int indent_printf(int indent, BIO *bio, const char *format, ...) | |
339 | { | |
340 | va_list args; | |
341 | int ret; | |
342 | ||
343 | va_start(args, format); | |
344 | ||
345 | ret = BIO_printf(bio, "%*s", indent, "") + BIO_vprintf(bio, format, args); | |
346 | ||
347 | va_end(args); | |
348 | return ret; | |
349 | } | |
350 | ||
351 | static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata, | |
511e4e0d RL |
352 | int expected, int criterion, OSSL_STORE_SEARCH *search, |
353 | int text, int noout, int recursive, int indent, BIO *out, | |
7dc67708 | 354 | const char *prog, OSSL_LIB_CTX *libctx) |
fb43ddce RL |
355 | { |
356 | OSSL_STORE_CTX *store_ctx = NULL; | |
357 | int ret = 1, items = 0; | |
358 | ||
7dc67708 | 359 | if ((store_ctx = OSSL_STORE_open_ex(uri, libctx, app_get0_propq(), uimeth, uidata, |
d382e796 | 360 | NULL, NULL, NULL)) |
fb43ddce RL |
361 | == NULL) { |
362 | BIO_printf(bio_err, "Couldn't open file or uri %s\n", uri); | |
c403a1dd | 363 | ERR_print_errors(bio_err); |
fb43ddce | 364 | return ret; |
c403a1dd RL |
365 | } |
366 | ||
9511d973 RL |
367 | if (expected != 0) { |
368 | if (!OSSL_STORE_expect(store_ctx, expected)) { | |
369 | ERR_print_errors(bio_err); | |
370 | goto end2; | |
371 | } | |
372 | } | |
373 | ||
511e4e0d RL |
374 | if (criterion != 0) { |
375 | if (!OSSL_STORE_supports_search(store_ctx, criterion)) { | |
376 | BIO_printf(bio_err, | |
377 | "%s: the store scheme doesn't support the given search criteria.\n", | |
378 | prog); | |
379 | goto end2; | |
380 | } | |
381 | ||
382 | if (!OSSL_STORE_find(store_ctx, search)) { | |
383 | ERR_print_errors(bio_err); | |
384 | goto end2; | |
385 | } | |
386 | } | |
387 | ||
c403a1dd RL |
388 | /* From here on, we count errors, and we'll return the count at the end */ |
389 | ret = 0; | |
390 | ||
391 | for (;;) { | |
392 | OSSL_STORE_INFO *info = OSSL_STORE_load(store_ctx); | |
393 | int type = info == NULL ? 0 : OSSL_STORE_INFO_get_type(info); | |
394 | const char *infostr = | |
395 | info == NULL ? NULL : OSSL_STORE_INFO_type_string(type); | |
396 | ||
397 | if (info == NULL) { | |
c403a1dd | 398 | if (OSSL_STORE_error(store_ctx)) { |
fb43ddce RL |
399 | if (recursive) |
400 | ERR_clear_error(); | |
401 | else | |
402 | ERR_print_errors(bio_err); | |
0c2c560c DDO |
403 | if (OSSL_STORE_eof(store_ctx)) |
404 | break; | |
c403a1dd | 405 | ret++; |
6fc1d33c | 406 | continue; |
c403a1dd RL |
407 | } |
408 | ||
0c2c560c DDO |
409 | if (OSSL_STORE_eof(store_ctx)) |
410 | break; | |
411 | ||
c403a1dd RL |
412 | BIO_printf(bio_err, |
413 | "ERROR: OSSL_STORE_load() returned NULL without " | |
414 | "eof or error indications\n"); | |
415 | BIO_printf(bio_err, " This is an error in the loader\n"); | |
416 | ERR_print_errors(bio_err); | |
417 | ret++; | |
418 | break; | |
419 | } | |
420 | ||
421 | if (type == OSSL_STORE_INFO_NAME) { | |
422 | const char *name = OSSL_STORE_INFO_get0_NAME(info); | |
423 | const char *desc = OSSL_STORE_INFO_get0_NAME_description(info); | |
fb43ddce RL |
424 | indent_printf(indent, bio_out, "%d: %s: %s\n", items, infostr, |
425 | name); | |
c403a1dd | 426 | if (desc != NULL) |
fb43ddce | 427 | indent_printf(indent, bio_out, "%s\n", desc); |
c403a1dd | 428 | } else { |
fb43ddce | 429 | indent_printf(indent, bio_out, "%d: %s\n", items, infostr); |
c403a1dd RL |
430 | } |
431 | ||
432 | /* | |
433 | * Unfortunately, PEM_X509_INFO_write_bio() is sorely lacking in | |
434 | * functionality, so we must figure out how exactly to write things | |
435 | * ourselves... | |
436 | */ | |
437 | switch (type) { | |
438 | case OSSL_STORE_INFO_NAME: | |
fb43ddce RL |
439 | if (recursive) { |
440 | const char *suburi = OSSL_STORE_INFO_get0_NAME(info); | |
9511d973 | 441 | ret += process(suburi, uimeth, uidata, |
511e4e0d | 442 | expected, criterion, search, |
6725682d | 443 | text, noout, recursive, indent + 2, out, prog, |
7dc67708 | 444 | libctx); |
fb43ddce | 445 | } |
c403a1dd RL |
446 | break; |
447 | case OSSL_STORE_INFO_PARAMS: | |
448 | if (text) | |
449 | EVP_PKEY_print_params(out, OSSL_STORE_INFO_get0_PARAMS(info), | |
450 | 0, NULL); | |
451 | if (!noout) | |
452 | PEM_write_bio_Parameters(out, | |
453 | OSSL_STORE_INFO_get0_PARAMS(info)); | |
454 | break; | |
2274d22d RL |
455 | case OSSL_STORE_INFO_PUBKEY: |
456 | if (text) | |
457 | EVP_PKEY_print_public(out, OSSL_STORE_INFO_get0_PUBKEY(info), | |
458 | 0, NULL); | |
459 | if (!noout) | |
460 | PEM_write_bio_PUBKEY(out, OSSL_STORE_INFO_get0_PUBKEY(info)); | |
461 | break; | |
c403a1dd RL |
462 | case OSSL_STORE_INFO_PKEY: |
463 | if (text) | |
464 | EVP_PKEY_print_private(out, OSSL_STORE_INFO_get0_PKEY(info), | |
465 | 0, NULL); | |
466 | if (!noout) | |
467 | PEM_write_bio_PrivateKey(out, OSSL_STORE_INFO_get0_PKEY(info), | |
468 | NULL, NULL, 0, NULL, NULL); | |
469 | break; | |
470 | case OSSL_STORE_INFO_CERT: | |
471 | if (text) | |
472 | X509_print(out, OSSL_STORE_INFO_get0_CERT(info)); | |
473 | if (!noout) | |
474 | PEM_write_bio_X509(out, OSSL_STORE_INFO_get0_CERT(info)); | |
475 | break; | |
476 | case OSSL_STORE_INFO_CRL: | |
477 | if (text) | |
478 | X509_CRL_print(out, OSSL_STORE_INFO_get0_CRL(info)); | |
479 | if (!noout) | |
480 | PEM_write_bio_X509_CRL(out, OSSL_STORE_INFO_get0_CRL(info)); | |
481 | break; | |
482 | default: | |
483 | BIO_printf(bio_err, "!!! Unknown code\n"); | |
484 | ret++; | |
485 | break; | |
486 | } | |
487 | items++; | |
488 | OSSL_STORE_INFO_free(info); | |
489 | } | |
fb43ddce | 490 | indent_printf(indent, out, "Total found: %d\n", items); |
c403a1dd | 491 | |
9511d973 | 492 | end2: |
c403a1dd RL |
493 | if (!OSSL_STORE_close(store_ctx)) { |
494 | ERR_print_errors(bio_err); | |
495 | ret++; | |
c403a1dd RL |
496 | } |
497 | ||
c403a1dd RL |
498 | return ret; |
499 | } |