[thirdparty/openssl.git] / apps / dgst.c

/*
 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include "apps.h"
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/objects.h>
#include <openssl/x509.h>
#include <openssl/pem.h>
#include <openssl/hmac.h>

#undef BUFSIZE
#define BUFSIZE 1024*8

int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
          EVP_PKEY *key, unsigned char *sigin, int siglen,
          const char *sig_name, const char *md_name,
          const char *file);

typedef enum OPTION_choice {
    OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
    OPT_C, OPT_R, OPT_OUT, OPT_SIGN, OPT_PASSIN, OPT_VERIFY,
    OPT_PRVERIFY, OPT_SIGNATURE, OPT_KEYFORM, OPT_ENGINE, OPT_ENGINE_IMPL,
    OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT,
    OPT_HMAC, OPT_MAC, OPT_SIGOPT, OPT_MACOPT,
    OPT_DIGEST,
    OPT_R_ENUM
} OPTION_CHOICE;

const OPTIONS dgst_options[] = {
    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [file...]\n"},
    {OPT_HELP_STR, 1, '-',
        "  file... files to digest (default is stdin)\n"},
    {"help", OPT_HELP, '-', "Display this summary"},
    {"c", OPT_C, '-', "Print the digest with separating colons"},
    {"r", OPT_R, '-', "Print the digest in coreutils format"},
    {"out", OPT_OUT, '>', "Output to filename rather than stdout"},
    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
    {"sign", OPT_SIGN, 's', "Sign digest using private key"},
    {"verify", OPT_VERIFY, 's',
     "Verify a signature using public key"},
    {"prverify", OPT_PRVERIFY, 's',
     "Verify a signature using private key"},
    {"signature", OPT_SIGNATURE, '<', "File with signature to verify"},
    {"keyform", OPT_KEYFORM, 'f', "Key file format (PEM or ENGINE)"},
    {"hex", OPT_HEX, '-', "Print as hex dump"},
    {"binary", OPT_BINARY, '-', "Print in binary form"},
    {"d", OPT_DEBUG, '-', "Print debug info"},
    {"debug", OPT_DEBUG, '-', "Print debug info"},
    {"fips-fingerprint", OPT_FIPS_FINGERPRINT, '-',
     "Compute HMAC with the key used in OpenSSL-FIPS fingerprint"},
    {"hmac", OPT_HMAC, 's', "Create hashed MAC with key"},
    {"mac", OPT_MAC, 's', "Create MAC (not necessarily HMAC)"},
    {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
    {"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form or key"},
    {"", OPT_DIGEST, '-', "Any supported digest"},
    OPT_R_OPTIONS,
#ifndef OPENSSL_NO_ENGINE
    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
    {"engine_impl", OPT_ENGINE_IMPL, '-',
     "Also use engine given by -engine for digest operations"},
#endif
    {NULL}
};

int dgst_main(int argc, char **argv)
{
    BIO *in = NULL, *inp, *bmd = NULL, *out = NULL;
    ENGINE *e = NULL, *impl = NULL;
    EVP_PKEY *sigkey = NULL;
    STACK_OF(OPENSSL_STRING) *sigopts = NULL, *macopts = NULL;
    char *hmac_key = NULL;
    char *mac_name = NULL;
    char *passinarg = NULL, *passin = NULL;
    const EVP_MD *md = NULL, *m;
    const char *outfile = NULL, *keyfile = NULL, *prog = NULL;
    const char *sigfile = NULL;
    OPTION_CHOICE o;
    int separator = 0, debug = 0, keyform = FORMAT_PEM, siglen = 0;
    int i, ret = 1, out_bin = -1, want_pub = 0, do_verify = 0;
    unsigned char *buf = NULL, *sigbuf = NULL;
    int engine_impl = 0;

    prog = opt_progname(argv[0]);
    buf = app_malloc(BUFSIZE, "I/O buffer");
    md = EVP_get_digestbyname(prog);

    prog = opt_init(argc, argv, dgst_options);
    while ((o = opt_next()) != OPT_EOF) {
        switch (o) {
        case OPT_EOF:
        case OPT_ERR:
 opthelp:
            BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
            goto end;
        case OPT_HELP:
            opt_help(dgst_options);
            ret = 0;
            goto end;
        case OPT_C:
            separator = 1;
            break;
        case OPT_R:
            separator = 2;
            break;
        case OPT_R_CASES:
            if (!opt_rand(o))
                goto end;
            break;
        case OPT_OUT:
            outfile = opt_arg();
            break;
        case OPT_SIGN:
            keyfile = opt_arg();
            break;
        case OPT_PASSIN:
            passinarg = opt_arg();
            break;
        case OPT_VERIFY:
            keyfile = opt_arg();
            want_pub = do_verify = 1;
            break;
        case OPT_PRVERIFY:
            keyfile = opt_arg();
            do_verify = 1;
            break;
        case OPT_SIGNATURE:
            sigfile = opt_arg();
            break;
        case OPT_KEYFORM:
            if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform))
                goto opthelp;
            break;
        case OPT_ENGINE:
            e = setup_engine(opt_arg(), 0);
            break;
        case OPT_ENGINE_IMPL:
            engine_impl = 1;
            break;
        case OPT_HEX:
            out_bin = 0;
            break;
        case OPT_BINARY:
            out_bin = 1;
            break;
        case OPT_DEBUG:
            debug = 1;
            break;
        case OPT_FIPS_FINGERPRINT:
            hmac_key = "etaonrishdlcupfm";
            break;
        case OPT_HMAC:
            hmac_key = opt_arg();
            break;
        case OPT_MAC:
            mac_name = opt_arg();
            break;
        case OPT_SIGOPT:
            if (!sigopts)
                sigopts = sk_OPENSSL_STRING_new_null();
            if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, opt_arg()))
                goto opthelp;
            break;
        case OPT_MACOPT:
            if (!macopts)
                macopts = sk_OPENSSL_STRING_new_null();
            if (!macopts || !sk_OPENSSL_STRING_push(macopts, opt_arg()))
                goto opthelp;
            break;
        case OPT_DIGEST:
            if (!opt_md(opt_unknown(), &m))
                goto opthelp;
            md = m;
            break;
        }
    }
    argc = opt_num_rest();
    argv = opt_rest();
    if (keyfile != NULL && argc > 1) {
        BIO_printf(bio_err, "%s: Can only sign or verify one file.\n", prog);
        goto end;
    }

    if (do_verify && sigfile == NULL) {
        BIO_printf(bio_err,
                   "No signature to verify: use the -signature option\n");
        goto end;
    }
    if (engine_impl)
        impl = e;

    in = BIO_new(BIO_s_file());
    bmd = BIO_new(BIO_f_md());
    if ((in == NULL) || (bmd == NULL)) {
        ERR_print_errors(bio_err);
        goto end;
    }

    if (debug) {
        BIO_set_callback(in, BIO_debug_callback);
        /* needed for windows 3.1 */
        BIO_set_callback_arg(in, (char *)bio_err);
    }

    if (!app_passwd(passinarg, NULL, &passin, NULL)) {
        BIO_printf(bio_err, "Error getting password\n");
        goto end;
    }

    if (out_bin == -1) {
        if (keyfile != NULL)
            out_bin = 1;
        else
            out_bin = 0;
    }

    out = bio_open_default(outfile, 'w', out_bin ? FORMAT_BINARY : FORMAT_TEXT);
    if (out == NULL)
        goto end;

    if ((!(mac_name == NULL) + !(keyfile == NULL) + !(hmac_key == NULL)) > 1) {
        BIO_printf(bio_err, "MAC and Signing key cannot both be specified\n");
        goto end;
    }

    if (keyfile != NULL) {
        if (want_pub)
            sigkey = load_pubkey(keyfile, keyform, 0, NULL, e, "key file");
        else
            sigkey = load_key(keyfile, keyform, 0, passin, e, "key file");
        if (sigkey == NULL) {
            /*
             * load_[pub]key() has already printed an appropriate message
             */
            goto end;
        }
    }

    if (mac_name != NULL) {
        EVP_PKEY_CTX *mac_ctx = NULL;
        int r = 0;
        if (!init_gen_str(&mac_ctx, mac_name, impl, 0))
            goto mac_end;
        if (macopts != NULL) {
            char *macopt;
            for (i = 0; i < sk_OPENSSL_STRING_num(macopts); i++) {
                macopt = sk_OPENSSL_STRING_value(macopts, i);
                if (pkey_ctrl_string(mac_ctx, macopt) <= 0) {
                    BIO_printf(bio_err,
                               "MAC parameter error \"%s\"\n", macopt);
                    ERR_print_errors(bio_err);
                    goto mac_end;
                }
            }
        }
        if (EVP_PKEY_keygen(mac_ctx, &sigkey) <= 0) {
            BIO_puts(bio_err, "Error generating key\n");
            ERR_print_errors(bio_err);
            goto mac_end;
        }
        r = 1;
 mac_end:
        EVP_PKEY_CTX_free(mac_ctx);
        if (r == 0)
            goto end;
    }

    if (hmac_key != NULL) {
        sigkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, impl,
                                      (unsigned char *)hmac_key, -1);
        if (sigkey == NULL)
            goto end;
    }

    if (sigkey != NULL) {
        EVP_MD_CTX *mctx = NULL;
        EVP_PKEY_CTX *pctx = NULL;
        int r;
        if (!BIO_get_md_ctx(bmd, &mctx)) {
            BIO_printf(bio_err, "Error getting context\n");
            ERR_print_errors(bio_err);
            goto end;
        }
        if (do_verify)
            r = EVP_DigestVerifyInit(mctx, &pctx, md, impl, sigkey);
        else
            r = EVP_DigestSignInit(mctx, &pctx, md, impl, sigkey);
        if (!r) {
            BIO_printf(bio_err, "Error setting context\n");
            ERR_print_errors(bio_err);
            goto end;
        }
        if (sigopts != NULL) {
            char *sigopt;
            for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {
                sigopt = sk_OPENSSL_STRING_value(sigopts, i);
                if (pkey_ctrl_string(pctx, sigopt) <= 0) {
                    BIO_printf(bio_err, "parameter error \"%s\"\n", sigopt);
                    ERR_print_errors(bio_err);
                    goto end;
                }
            }
        }
    }
    /* we use md as a filter, reading from 'in' */
    else {
        EVP_MD_CTX *mctx = NULL;
        if (!BIO_get_md_ctx(bmd, &mctx)) {
            BIO_printf(bio_err, "Error getting context\n");
            ERR_print_errors(bio_err);
            goto end;
        }
        if (md == NULL)
            md = EVP_sha256();
        if (!EVP_DigestInit_ex(mctx, md, impl)) {
            BIO_printf(bio_err, "Error setting digest\n");
            ERR_print_errors(bio_err);
            goto end;
        }
    }

    if (sigfile != NULL && sigkey != NULL) {
        BIO *sigbio = BIO_new_file(sigfile, "rb");
        if (sigbio == NULL) {
            BIO_printf(bio_err, "Error opening signature file %s\n", sigfile);
            ERR_print_errors(bio_err);
            goto end;
        }
        siglen = EVP_PKEY_size(sigkey);
        sigbuf = app_malloc(siglen, "signature buffer");
        siglen = BIO_read(sigbio, sigbuf, siglen);
        BIO_free(sigbio);
        if (siglen <= 0) {
            BIO_printf(bio_err, "Error reading signature file %s\n", sigfile);
            ERR_print_errors(bio_err);
            goto end;
        }
    }
    inp = BIO_push(bmd, in);

    if (md == NULL) {
        EVP_MD_CTX *tctx;
        BIO_get_md_ctx(bmd, &tctx);
        md = EVP_MD_CTX_md(tctx);
    }

    if (argc == 0) {
        BIO_set_fp(in, stdin, BIO_NOCLOSE);
        ret = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
                    siglen, NULL, NULL, "stdin");
    } else {
        const char *md_name = NULL, *sig_name = NULL;
        if (!out_bin) {
            if (sigkey != NULL) {
                const EVP_PKEY_ASN1_METHOD *ameth;
                ameth = EVP_PKEY_get0_asn1(sigkey);
                if (ameth)
                    EVP_PKEY_asn1_get0_info(NULL, NULL,
                                            NULL, NULL, &sig_name, ameth);
            }
            if (md != NULL)
                md_name = EVP_MD_name(md);
        }
        ret = 0;
        for (i = 0; i < argc; i++) {
            int r;
            if (BIO_read_filename(in, argv[i]) <= 0) {
                perror(argv[i]);
                ret++;
                continue;
            } else {
                r = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
                          siglen, sig_name, md_name, argv[i]);
            }
            if (r)
                ret = r;
            (void)BIO_reset(bmd);
        }
    }
 end:
    OPENSSL_clear_free(buf, BUFSIZE);
    BIO_free(in);
    OPENSSL_free(passin);
    BIO_free_all(out);
    EVP_PKEY_free(sigkey);
    sk_OPENSSL_STRING_free(sigopts);
    sk_OPENSSL_STRING_free(macopts);
    OPENSSL_free(sigbuf);
    BIO_free(bmd);
    release_engine(e);
    return (ret);
}

int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
          EVP_PKEY *key, unsigned char *sigin, int siglen,
          const char *sig_name, const char *md_name,
          const char *file)
{
    size_t len;
    int i;

    for (;;) {
        i = BIO_read(bp, (char *)buf, BUFSIZE);
        if (i < 0) {
            BIO_printf(bio_err, "Read Error in %s\n", file);
            ERR_print_errors(bio_err);
            return 1;
        }
        if (i == 0)
            break;
    }
    if (sigin != NULL) {
        EVP_MD_CTX *ctx;
        BIO_get_md_ctx(bp, &ctx);
        i = EVP_DigestVerifyFinal(ctx, sigin, (unsigned int)siglen);
        if (i > 0) {
            BIO_printf(out, "Verified OK\n");
        } else if (i == 0) {
            BIO_printf(out, "Verification Failure\n");
            return 1;
        } else {
            BIO_printf(bio_err, "Error Verifying Data\n");
            ERR_print_errors(bio_err);
            return 1;
        }
        return 0;
    }
    if (key != NULL) {
        EVP_MD_CTX *ctx;
        BIO_get_md_ctx(bp, &ctx);
        len = BUFSIZE;
        if (!EVP_DigestSignFinal(ctx, buf, &len)) {
            BIO_printf(bio_err, "Error Signing Data\n");
            ERR_print_errors(bio_err);
            return 1;
        }
    } else {
        len = BIO_gets(bp, (char *)buf, BUFSIZE);
        if ((int)len < 0) {
            ERR_print_errors(bio_err);
            return 1;
        }
    }

    if (binout) {
        BIO_write(out, buf, len);
    } else if (sep == 2) {
        for (i = 0; i < (int)len; i++)
            BIO_printf(out, "%02x", buf[i]);
        BIO_printf(out, " *%s\n", file);
    } else {
        if (sig_name != NULL) {
            BIO_puts(out, sig_name);
            if (md_name != NULL)
                BIO_printf(out, "-%s", md_name);
            BIO_printf(out, "(%s)= ", file);
        } else if (md_name != NULL) {
            BIO_printf(out, "%s(%s)= ", md_name, file);
        } else {
            BIO_printf(out, "(%s)= ", file);
        }
        for (i = 0; i < (int)len; i++) {
            if (sep && (i != 0))
                BIO_printf(out, ":");
            BIO_printf(out, "%02x", buf[i]);
        }
        BIO_printf(out, "\n");
    }
    return 0;
}
Commit	Line	Data
846e33c7 RS	1	/*
846e33c7 RS	2	* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
d02b48c6	3	*
846e33c7 RS	4	* Licensed under the OpenSSL license (the "License"). You may not use
	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
d02b48c6 RE	8	*/
	9
	10	#include <stdio.h>
	11	#include <string.h>
	12	#include <stdlib.h>
	13	#include "apps.h"
ec577822 BM	14	#include <openssl/bio.h>
	15	#include <openssl/err.h>
	16	#include <openssl/evp.h>
	17	#include <openssl/objects.h>
	18	#include <openssl/x509.h>
	19	#include <openssl/pem.h>
52cfa397	20	#include <openssl/hmac.h>
d02b48c6 RE	21
d02b48c6 RE	22	#undef BUFSIZE
0f113f3e	23	#define BUFSIZE 1024*8
d02b48c6	24
d15711ef	25	int do_fp(BIO out, unsigned char buf, BIO *bp, int sep, int binout,
0f113f3e MC	26	EVP_PKEY key, unsigned char sigin, int siglen,
0f113f3e MC	27	const char sig_name, const char md_name,
a773b52a	28	const char *file);
667ac4ec	29
7e1b7485 RS	30	typedef enum OPTION_choice {
7e1b7485 RS	31	OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
3ee1eac2	32	OPT_C, OPT_R, OPT_OUT, OPT_SIGN, OPT_PASSIN, OPT_VERIFY,
7e1b7485 RS	33	OPT_PRVERIFY, OPT_SIGNATURE, OPT_KEYFORM, OPT_ENGINE, OPT_ENGINE_IMPL,
7e1b7485 RS	34	OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT,
700b4a4a	35	OPT_HMAC, OPT_MAC, OPT_SIGOPT, OPT_MACOPT,
3ee1eac2	36	OPT_DIGEST,
f1b8b001	37	OPT_R_ENUM
7e1b7485 RS	38	} OPTION_CHOICE;
7e1b7485 RS	39
44c83ebd	40	const OPTIONS dgst_options[] = {
7e1b7485 RS	41	{OPT_HELP_STR, 1, '-', "Usage: %s [options] [file...]\n"},
	42	{OPT_HELP_STR, 1, '-',
	43	" file... files to digest (default is stdin)\n"},
	44	{"help", OPT_HELP, '-', "Display this summary"},
	45	{"c", OPT_C, '-', "Print the digest with separating colons"},
	46	{"r", OPT_R, '-', "Print the digest in coreutils format"},
7e1b7485	47	{"out", OPT_OUT, '>', "Output to filename rather than stdout"},
a173a7ee	48	{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
dd958974 DSH	49	{"sign", OPT_SIGN, 's', "Sign digest using private key"},
	50	{"verify", OPT_VERIFY, 's',
	51	"Verify a signature using public key"},
	52	{"prverify", OPT_PRVERIFY, 's',
	53	"Verify a signature using private key"},
7e1b7485 RS	54	{"signature", OPT_SIGNATURE, '<', "File with signature to verify"},
7e1b7485 RS	55	{"keyform", OPT_KEYFORM, 'f', "Key file format (PEM or ENGINE)"},
7e1b7485 RS	56	{"hex", OPT_HEX, '-', "Print as hex dump"},
	57	{"binary", OPT_BINARY, '-', "Print in binary form"},
	58	{"d", OPT_DEBUG, '-', "Print debug info"},
a173a7ee RS	59	{"debug", OPT_DEBUG, '-', "Print debug info"},
	60	{"fips-fingerprint", OPT_FIPS_FINGERPRINT, '-',
	61	"Compute HMAC with the key used in OpenSSL-FIPS fingerprint"},
7e1b7485	62	{"hmac", OPT_HMAC, 's', "Create hashed MAC with key"},
0d4fb843	63	{"mac", OPT_MAC, 's', "Create MAC (not necessarily HMAC)"},
d175e8a6 MC	64	{"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
d175e8a6 MC	65	{"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form or key"},
9c3bcfa0	66	{"", OPT_DIGEST, '-', "Any supported digest"},
3ee1eac2	67	OPT_R_OPTIONS,
333b070e RS	68	#ifndef OPENSSL_NO_ENGINE
333b070e RS	69	{"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
a173a7ee RS	70	{"engine_impl", OPT_ENGINE_IMPL, '-',
a173a7ee RS	71	"Also use engine given by -engine for digest operations"},
333b070e	72	#endif
7e1b7485 RS	73	{NULL}
	74	};
	75
	76	int dgst_main(int argc, char **argv)
0f113f3e	77	{
7e1b7485	78	BIO in = NULL, inp, bmd = NULL, out = NULL;
0f113f3e	79	ENGINE e = NULL, impl = NULL;
7e1b7485 RS	80	EVP_PKEY *sigkey = NULL;
	81	STACK_OF(OPENSSL_STRING) sigopts = NULL, macopts = NULL;
	82	char *hmac_key = NULL;
	83	char *mac_name = NULL;
	84	char passinarg = NULL, passin = NULL;
0f113f3e	85	const EVP_MD md = NULL, m;
7e1b7485	86	const char outfile = NULL, keyfile = NULL, *prog = NULL;
3ee1eac2	87	const char *sigfile = NULL;
7e1b7485 RS	88	OPTION_CHOICE o;
7e1b7485 RS	89	int separator = 0, debug = 0, keyform = FORMAT_PEM, siglen = 0;
700b4a4a	90	int i, ret = 1, out_bin = -1, want_pub = 0, do_verify = 0;
7e1b7485	91	unsigned char buf = NULL, sigbuf = NULL;
0f113f3e	92	int engine_impl = 0;
0f113f3e	93
7e1b7485	94	prog = opt_progname(argv[0]);
68dc6824	95	buf = app_malloc(BUFSIZE, "I/O buffer");
7e1b7485 RS	96	md = EVP_get_digestbyname(prog);
	97
	98	prog = opt_init(argc, argv, dgst_options);
	99	while ((o = opt_next()) != OPT_EOF) {
	100	switch (o) {
	101	case OPT_EOF:
	102	case OPT_ERR:
	103	opthelp:
	104	BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
	105	goto end;
	106	case OPT_HELP:
	107	opt_help(dgst_options);
	108	ret = 0;
	109	goto end;
	110	case OPT_C:
0f113f3e	111	separator = 1;
7e1b7485 RS	112	break;
7e1b7485 RS	113	case OPT_R:
0f113f3e	114	separator = 2;
7e1b7485	115	break;
3ee1eac2 RS	116	case OPT_R_CASES:
	117	if (!opt_rand(o))
	118	goto end;
7e1b7485 RS	119	break;
	120	case OPT_OUT:
	121	outfile = opt_arg();
	122	break;
	123	case OPT_SIGN:
	124	keyfile = opt_arg();
	125	break;
	126	case OPT_PASSIN:
	127	passinarg = opt_arg();
	128	break;
	129	case OPT_VERIFY:
	130	keyfile = opt_arg();
	131	want_pub = do_verify = 1;
	132	break;
	133	case OPT_PRVERIFY:
	134	keyfile = opt_arg();
0f113f3e	135	do_verify = 1;
7e1b7485 RS	136	break;
	137	case OPT_SIGNATURE:
	138	sigfile = opt_arg();
	139	break;
	140	case OPT_KEYFORM:
	141	if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform))
	142	goto opthelp;
	143	break;
7e1b7485	144	case OPT_ENGINE:
333b070e	145	e = setup_engine(opt_arg(), 0);
7e1b7485 RS	146	break;
7e1b7485 RS	147	case OPT_ENGINE_IMPL:
0f113f3e	148	engine_impl = 1;
7e1b7485	149	break;
7e1b7485	150	case OPT_HEX:
0f113f3e	151	out_bin = 0;
7e1b7485 RS	152	break;
7e1b7485 RS	153	case OPT_BINARY:
0f113f3e	154	out_bin = 1;
7e1b7485 RS	155	break;
7e1b7485 RS	156	case OPT_DEBUG:
0f113f3e	157	debug = 1;
7e1b7485 RS	158	break;
7e1b7485 RS	159	case OPT_FIPS_FINGERPRINT:
0f113f3e	160	hmac_key = "etaonrishdlcupfm";
7e1b7485	161	break;
7e1b7485 RS	162	case OPT_HMAC:
	163	hmac_key = opt_arg();
	164	break;
	165	case OPT_MAC:
	166	mac_name = opt_arg();
	167	break;
	168	case OPT_SIGOPT:
0f113f3e MC	169	if (!sigopts)
0f113f3e MC	170	sigopts = sk_OPENSSL_STRING_new_null();
7e1b7485 RS	171	if (!sigopts \|\| !sk_OPENSSL_STRING_push(sigopts, opt_arg()))
	172	goto opthelp;
	173	break;
	174	case OPT_MACOPT:
0f113f3e MC	175	if (!macopts)
0f113f3e MC	176	macopts = sk_OPENSSL_STRING_new_null();
7e1b7485 RS	177	if (!macopts \|\| !sk_OPENSSL_STRING_push(macopts, opt_arg()))
	178	goto opthelp;
	179	break;
	180	case OPT_DIGEST:
	181	if (!opt_md(opt_unknown(), &m))
	182	goto opthelp;
0f113f3e	183	md = m;
0f113f3e	184	break;
7e1b7485	185	}
0f113f3e	186	}
7e1b7485 RS	187	argc = opt_num_rest();
7e1b7485 RS	188	argv = opt_rest();
13a46183 RS	189	if (keyfile != NULL && argc > 1) {
	190	BIO_printf(bio_err, "%s: Can only sign or verify one file.\n", prog);
	191	goto end;
	192	}
0f113f3e	193
2234212c	194	if (do_verify && sigfile == NULL) {
0f113f3e MC	195	BIO_printf(bio_err,
	196	"No signature to verify: use the -signature option\n");
	197	goto end;
	198	}
0f113f3e MC	199	if (engine_impl)
0f113f3e MC	200	impl = e;
bb845ee0	201
0f113f3e MC	202	in = BIO_new(BIO_s_file());
0f113f3e MC	203	bmd = BIO_new(BIO_f_md());
be1477ad MC	204	if ((in == NULL) \|\| (bmd == NULL)) {
	205	ERR_print_errors(bio_err);
	206	goto end;
	207	}
	208
0f113f3e MC	209	if (debug) {
	210	BIO_set_callback(in, BIO_debug_callback);
	211	/* needed for windows 3.1 */
	212	BIO_set_callback_arg(in, (char *)bio_err);
	213	}
	214
7e1b7485	215	if (!app_passwd(passinarg, NULL, &passin, NULL)) {
0f113f3e MC	216	BIO_printf(bio_err, "Error getting password\n");
	217	goto end;
	218	}
	219
0f113f3e	220	if (out_bin == -1) {
2234212c	221	if (keyfile != NULL)
0f113f3e MC	222	out_bin = 1;
	223	else
	224	out_bin = 0;
	225	}
	226
bdd58d98	227	out = bio_open_default(outfile, 'w', out_bin ? FORMAT_BINARY : FORMAT_TEXT);
7e1b7485	228	if (out == NULL)
0f113f3e	229	goto end;
7e1b7485	230
2234212c	231	if ((!(mac_name == NULL) + !(keyfile == NULL) + !(hmac_key == NULL)) > 1) {
0f113f3e MC	232	BIO_printf(bio_err, "MAC and Signing key cannot both be specified\n");
	233	goto end;
	234	}
	235
2234212c	236	if (keyfile != NULL) {
0f113f3e	237	if (want_pub)
7e1b7485	238	sigkey = load_pubkey(keyfile, keyform, 0, NULL, e, "key file");
0f113f3e	239	else
7e1b7485	240	sigkey = load_key(keyfile, keyform, 0, passin, e, "key file");
2234212c	241	if (sigkey == NULL) {
0f113f3e MC	242	/*
	243	* load_[pub]key() has already printed an appropriate message
	244	*/
	245	goto end;
	246	}
	247	}
	248
2234212c	249	if (mac_name != NULL) {
0f113f3e MC	250	EVP_PKEY_CTX *mac_ctx = NULL;
0f113f3e MC	251	int r = 0;
7e1b7485	252	if (!init_gen_str(&mac_ctx, mac_name, impl, 0))
0f113f3e	253	goto mac_end;
2234212c	254	if (macopts != NULL) {
0f113f3e MC	255	char *macopt;
	256	for (i = 0; i < sk_OPENSSL_STRING_num(macopts); i++) {
	257	macopt = sk_OPENSSL_STRING_value(macopts, i);
	258	if (pkey_ctrl_string(mac_ctx, macopt) <= 0) {
	259	BIO_printf(bio_err,
	260	"MAC parameter error \"%s\"\n", macopt);
	261	ERR_print_errors(bio_err);
	262	goto mac_end;
	263	}
	264	}
	265	}
	266	if (EVP_PKEY_keygen(mac_ctx, &sigkey) <= 0) {
	267	BIO_puts(bio_err, "Error generating key\n");
	268	ERR_print_errors(bio_err);
	269	goto mac_end;
	270	}
	271	r = 1;
	272	mac_end:
c5ba2d99	273	EVP_PKEY_CTX_free(mac_ctx);
0f113f3e MC	274	if (r == 0)
	275	goto end;
	276	}
	277
2234212c	278	if (hmac_key != NULL) {
0f113f3e MC	279	sigkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, impl,
0f113f3e MC	280	(unsigned char *)hmac_key, -1);
2234212c	281	if (sigkey == NULL)
0f113f3e MC	282	goto end;
	283	}
	284
2234212c	285	if (sigkey != NULL) {
0f113f3e MC	286	EVP_MD_CTX *mctx = NULL;
	287	EVP_PKEY_CTX *pctx = NULL;
	288	int r;
	289	if (!BIO_get_md_ctx(bmd, &mctx)) {
	290	BIO_printf(bio_err, "Error getting context\n");
	291	ERR_print_errors(bio_err);
	292	goto end;
	293	}
	294	if (do_verify)
	295	r = EVP_DigestVerifyInit(mctx, &pctx, md, impl, sigkey);
	296	else
	297	r = EVP_DigestSignInit(mctx, &pctx, md, impl, sigkey);
	298	if (!r) {
	299	BIO_printf(bio_err, "Error setting context\n");
	300	ERR_print_errors(bio_err);
	301	goto end;
	302	}
2234212c	303	if (sigopts != NULL) {
0f113f3e MC	304	char *sigopt;
	305	for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {
	306	sigopt = sk_OPENSSL_STRING_value(sigopts, i);
	307	if (pkey_ctrl_string(pctx, sigopt) <= 0) {
	308	BIO_printf(bio_err, "parameter error \"%s\"\n", sigopt);
	309	ERR_print_errors(bio_err);
	310	goto end;
	311	}
	312	}
	313	}
	314	}
	315	/* we use md as a filter, reading from 'in' */
	316	else {
	317	EVP_MD_CTX *mctx = NULL;
	318	if (!BIO_get_md_ctx(bmd, &mctx)) {
	319	BIO_printf(bio_err, "Error getting context\n");
	320	ERR_print_errors(bio_err);
	321	goto end;
	322	}
	323	if (md == NULL)
f8547f62	324	md = EVP_sha256();
0f113f3e	325	if (!EVP_DigestInit_ex(mctx, md, impl)) {
7e1b7485	326	BIO_printf(bio_err, "Error setting digest\n");
0f113f3e MC	327	ERR_print_errors(bio_err);
	328	goto end;
	329	}
	330	}
	331
2234212c	332	if (sigfile != NULL && sigkey != NULL) {
7e1b7485	333	BIO *sigbio = BIO_new_file(sigfile, "rb");
2234212c	334	if (sigbio == NULL) {
0f113f3e MC	335	BIO_printf(bio_err, "Error opening signature file %s\n", sigfile);
	336	ERR_print_errors(bio_err);
	337	goto end;
	338	}
7e1b7485	339	siglen = EVP_PKEY_size(sigkey);
68dc6824	340	sigbuf = app_malloc(siglen, "signature buffer");
0f113f3e MC	341	siglen = BIO_read(sigbio, sigbuf, siglen);
	342	BIO_free(sigbio);
	343	if (siglen <= 0) {
	344	BIO_printf(bio_err, "Error reading signature file %s\n", sigfile);
	345	ERR_print_errors(bio_err);
	346	goto end;
	347	}
	348	}
	349	inp = BIO_push(bmd, in);
	350
	351	if (md == NULL) {
	352	EVP_MD_CTX *tctx;
	353	BIO_get_md_ctx(bmd, &tctx);
	354	md = EVP_MD_CTX_md(tctx);
	355	}
	356
	357	if (argc == 0) {
	358	BIO_set_fp(in, stdin, BIO_NOCLOSE);
7e1b7485	359	ret = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
a773b52a	360	siglen, NULL, NULL, "stdin");
0f113f3e MC	361	} else {
	362	const char md_name = NULL, sig_name = NULL;
	363	if (!out_bin) {
2234212c	364	if (sigkey != NULL) {
0f113f3e MC	365	const EVP_PKEY_ASN1_METHOD *ameth;
	366	ameth = EVP_PKEY_get0_asn1(sigkey);
	367	if (ameth)
	368	EVP_PKEY_asn1_get0_info(NULL, NULL,
	369	NULL, NULL, &sig_name, ameth);
	370	}
2234212c	371	if (md != NULL)
0f113f3e MC	372	md_name = EVP_MD_name(md);
0f113f3e MC	373	}
7e1b7485	374	ret = 0;
0f113f3e MC	375	for (i = 0; i < argc; i++) {
	376	int r;
	377	if (BIO_read_filename(in, argv[i]) <= 0) {
	378	perror(argv[i]);
7e1b7485	379	ret++;
0f113f3e	380	continue;
2234212c	381	} else {
0f113f3e	382	r = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
a773b52a	383	siglen, sig_name, md_name, argv[i]);
2234212c	384	}
0f113f3e	385	if (r)
7e1b7485	386	ret = r;
0f113f3e MC	387	(void)BIO_reset(bmd);
	388	}
	389	}
	390	end:
4b45c6e5	391	OPENSSL_clear_free(buf, BUFSIZE);
ca3a82c3	392	BIO_free(in);
25aaa98a	393	OPENSSL_free(passin);
0f113f3e MC	394	BIO_free_all(out);
0f113f3e MC	395	EVP_PKEY_free(sigkey);
25aaa98a RS	396	sk_OPENSSL_STRING_free(sigopts);
25aaa98a RS	397	sk_OPENSSL_STRING_free(macopts);
b548a1f1	398	OPENSSL_free(sigbuf);
ca3a82c3	399	BIO_free(bmd);
dd1abd44	400	release_engine(e);
7e1b7485	401	return (ret);
0f113f3e	402	}
d02b48c6	403
d15711ef	404	int do_fp(BIO out, unsigned char buf, BIO *bp, int sep, int binout,
0f113f3e MC	405	EVP_PKEY key, unsigned char sigin, int siglen,
0f113f3e MC	406	const char sig_name, const char md_name,
a773b52a	407	const char *file)
0f113f3e MC	408	{
	409	size_t len;
	410	int i;
	411
	412	for (;;) {
	413	i = BIO_read(bp, (char *)buf, BUFSIZE);
	414	if (i < 0) {
	415	BIO_printf(bio_err, "Read Error in %s\n", file);
	416	ERR_print_errors(bio_err);
	417	return 1;
	418	}
	419	if (i == 0)
	420	break;
	421	}
2234212c	422	if (sigin != NULL) {
0f113f3e MC	423	EVP_MD_CTX *ctx;
	424	BIO_get_md_ctx(bp, &ctx);
	425	i = EVP_DigestVerifyFinal(ctx, sigin, (unsigned int)siglen);
2234212c	426	if (i > 0) {
0f113f3e	427	BIO_printf(out, "Verified OK\n");
2234212c	428	} else if (i == 0) {
0f113f3e MC	429	BIO_printf(out, "Verification Failure\n");
	430	return 1;
	431	} else {
	432	BIO_printf(bio_err, "Error Verifying Data\n");
	433	ERR_print_errors(bio_err);
	434	return 1;
	435	}
	436	return 0;
	437	}
2234212c	438	if (key != NULL) {
0f113f3e MC	439	EVP_MD_CTX *ctx;
	440	BIO_get_md_ctx(bp, &ctx);
	441	len = BUFSIZE;
	442	if (!EVP_DigestSignFinal(ctx, buf, &len)) {
	443	BIO_printf(bio_err, "Error Signing Data\n");
	444	ERR_print_errors(bio_err);
	445	return 1;
	446	}
	447	} else {
	448	len = BIO_gets(bp, (char *)buf, BUFSIZE);
	449	if ((int)len < 0) {
	450	ERR_print_errors(bio_err);
	451	return 1;
	452	}
	453	}
	454
2234212c	455	if (binout) {
0f113f3e	456	BIO_write(out, buf, len);
2234212c	457	} else if (sep == 2) {
0f113f3e MC	458	for (i = 0; i < (int)len; i++)
	459	BIO_printf(out, "%02x", buf[i]);
	460	BIO_printf(out, " *%s\n", file);
	461	} else {
2234212c	462	if (sig_name != NULL) {
0f113f3e	463	BIO_puts(out, sig_name);
2234212c	464	if (md_name != NULL)
0f113f3e MC	465	BIO_printf(out, "-%s", md_name);
0f113f3e MC	466	BIO_printf(out, "(%s)= ", file);
2234212c	467	} else if (md_name != NULL) {
0f113f3e	468	BIO_printf(out, "%s(%s)= ", md_name, file);
2234212c	469	} else {
0f113f3e	470	BIO_printf(out, "(%s)= ", file);
2234212c	471	}
0f113f3e MC	472	for (i = 0; i < (int)len; i++) {
	473	if (sep && (i != 0))
	474	BIO_printf(out, ":");
	475	BIO_printf(out, "%02x", buf[i]);
	476	}
	477	BIO_printf(out, "\n");
	478	}
	479	return 0;
	480	}