1 /* crypto/pkcs7/verify.c */

     2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

     3  * All rights reserved.

     4  *

     5  * This package is an SSL implementation written

     6  * by Eric Young (eay@cryptsoft.com).

     7  * The implementation was written so as to conform with Netscapes SSL.

     8  * 

     9  * This library is free for commercial and non-commercial use as long as

    10  * the following conditions are aheared to.  The following conditions

    11  * apply to all code found in this distribution, be it the RC4, RSA,

    12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

    13  * included with this distribution is covered by the same copyright terms

    14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).

    15  * 

    16  * Copyright remains Eric Young's, and as such any Copyright notices in

    17  * the code are not to be removed.

    18  * If this package is used in a product, Eric Young should be given attribution

    19  * as the author of the parts of the library used.

    20  * This can be in the form of a textual message at program startup or

    21  * in documentation (online or textual) provided with the package.

    22  * 

    23  * Redistribution and use in source and binary forms, with or without

    24  * modification, are permitted provided that the following conditions

    25  * are met:

    26  * 1. Redistributions of source code must retain the copyright

    27  *    notice, this list of conditions and the following disclaimer.

    28  * 2. Redistributions in binary form must reproduce the above copyright

    29  *    notice, this list of conditions and the following disclaimer in the

    30  *    documentation and/or other materials provided with the distribution.

    31  * 3. All advertising materials mentioning features or use of this software

    32  *    must display the following acknowledgement:

    33  *    "This product includes cryptographic software written by

    34  *     Eric Young (eay@cryptsoft.com)"

    35  *    The word 'cryptographic' can be left out if the rouines from the library

    36  *    being used are not cryptographic related :-).

    37  * 4. If you include any Windows specific code (or a derivative thereof) from 

    38  *    the apps directory (application code) you must include an acknowledgement:

    39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

    40  * 

    41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

    42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

    43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

    44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

    45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

    46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

    47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

    48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

    49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

    50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

    51  * SUCH DAMAGE.

    52  * 

    53  * The licence and distribution terms for any publically available version or

    54  * derivative of this code cannot be changed.  i.e. this code cannot simply be

    55  * copied and put under another distribution licence

    56  * [including the GNU Public Licence.]

    57  */

    58 #include <stdio.h>

    59 #include <string.h>

    60 #include <openssl/bio.h>

    61 #include <openssl/asn1.h>

    62 #include <openssl/x509.h>

    63 #include <openssl/pem.h>

    64 #include <openssl/err.h>

    65 #include "example.h"

    66 

    67 int verify_callback(int ok, X509_STORE_CTX *ctx);

    68 

    69 BIO *bio_err=NULL;

    70 BIO *bio_out=NULL;

    71 

    72 int main(argc,argv)

    73 int argc;

    74 char *argv[];

    75 	{

    76 	PKCS7 *p7;

    77 	PKCS7_SIGNER_INFO *si;

    78 	X509_STORE_CTX cert_ctx;

    79 	X509_STORE *cert_store=NULL;

    80 	BIO *data,*detached=NULL,*p7bio=NULL;

    81 	char buf[1024*4];

    82 	char *pp;

    83 	int i,printit=0;

    84 	STACK_OF(PKCS7_SIGNER_INFO) *sk;

    85 

    86 	bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);

    87 	bio_out=BIO_new_fp(stdout,BIO_NOCLOSE);

    88 #ifndef OPENSSL_NO_MD2

    89 	EVP_add_digest(EVP_md2());

    90 #endif

    91 #ifndef OPENSSL_NO_MD5

    92 	EVP_add_digest(EVP_md5());

    93 #endif

    94 #ifndef OPENSSL_NO_SHA1

    95 	EVP_add_digest(EVP_sha1());

    96 #endif

    97 #ifndef OPENSSL_NO_MDC2

    98 	EVP_add_digest(EVP_mdc2());

    99 #endif

   100 

   101 	data=BIO_new(BIO_s_file());

   102 

   103 	pp=NULL;

   104 	while (argc > 1)

   105 		{

   106 		argc--;

   107 		argv++;

   108 		if (strcmp(argv[0],"-p") == 0)

   109 			{

   110 			printit=1;

   111 			}

   112 		else if ((strcmp(argv[0],"-d") == 0) && (argc >= 2))

   113 			{

   114 			detached=BIO_new(BIO_s_file());

   115 			if (!BIO_read_filename(detached,argv[1]))

   116 				goto err;

   117 			argc--;

   118 			argv++;

   119 			}

   120 		else

   121 			{

   122 			pp=argv[0];

   123 			if (!BIO_read_filename(data,argv[0]))

   124 				goto err;

   125 			}

   126 		}

   127 

   128 	if (pp == NULL)

   129 		BIO_set_fp(data,stdin,BIO_NOCLOSE);

   130 

   131 

   132 	/* Load the PKCS7 object from a file */

   133 	if ((p7=PEM_read_bio_PKCS7(data,NULL,NULL,NULL)) == NULL) goto err;

   134 

   135 	/* This stuff is being setup for certificate verification.

   136 	 * When using SSL, it could be replaced with a 

   137 	 * cert_stre=SSL_CTX_get_cert_store(ssl_ctx); */

   138 	cert_store=X509_STORE_new();

   139 	X509_STORE_set_default_paths(cert_store);

   140 	X509_STORE_load_locations(cert_store,NULL,"../../certs");

   141 	X509_STORE_set_verify_cb_func(cert_store,verify_callback);

   142 

   143 	ERR_clear_error();

   144 

   145 	/* We need to process the data */

   146 	if ((PKCS7_get_detached(p7) || detached))

   147 		{

   148 		if (detached == NULL)

   149 			{

   150 			printf("no data to verify the signature on\n");

   151 			exit(1);

   152 			}

   153 		else

   154 			p7bio=PKCS7_dataInit(p7,detached);

   155 		}

   156 	else

   157 		{

   158 		p7bio=PKCS7_dataInit(p7,NULL);

   159 		}

   160 

   161 	/* We now have to 'read' from p7bio to calculate digests etc. */

   162 	for (;;)

   163 		{

   164 		i=BIO_read(p7bio,buf,sizeof(buf));

   165 		/* print it? */

   166 		if (i <= 0) break;

   167 		}

   168 

   169 	/* We can now verify signatures */

   170 	sk=PKCS7_get_signer_info(p7);

   171 	if (sk == NULL)

   172 		{

   173 		printf("there are no signatures on this data\n");

   174 		exit(1);

   175 		}

   176 

   177 	/* Ok, first we need to, for each subject entry, see if we can verify */

   178 	for (i=0; i<sk_PKCS7_SIGNER_INFO_num(sk); i++)

   179 		{

   180 		ASN1_UTCTIME *tm;

   181 		char *str1,*str2;

   182 		int rc;

   183 

   184 		si=sk_PKCS7_SIGNER_INFO_value(sk,i);

   185 		rc=PKCS7_dataVerify(cert_store,&cert_ctx,p7bio,p7,si);

   186 		if (rc <= 0)

   187 			goto err;

   188 		printf("signer info\n");

   189 		if ((tm=get_signed_time(si)) != NULL)

   190 			{

   191 			BIO_printf(bio_out,"Signed time:");

   192 			ASN1_UTCTIME_print(bio_out,tm);

   193 			ASN1_UTCTIME_free(tm);

   194 			BIO_printf(bio_out,"\n");

   195 			}

   196 		if (get_signed_seq2string(si,&str1,&str2))

   197 			{

   198 			BIO_printf(bio_out,"String 1 is %s\n",str1);

   199 			BIO_printf(bio_out,"String 2 is %s\n",str2);

   200 			}

   201 

   202 		}

   203 

   204 	X509_STORE_free(cert_store);

   205 

   206 	printf("done\n");

   207 	exit(0);

   208 err:

   209 	ERR_load_crypto_strings();

   210 	ERR_print_errors_fp(stderr);

   211 	exit(1);

   212 	}

   213 

   214 /* should be X509 * but we can just have them as char *. */

   215 int verify_callback(int ok, X509_STORE_CTX *ctx)

   216 	{

   217 	char buf[256];

   218 	X509 *err_cert;

   219 	int err,depth;

   220 

   221 	err_cert=X509_STORE_CTX_get_current_cert(ctx);

   222 	err=	X509_STORE_CTX_get_error(ctx);

   223 	depth=	X509_STORE_CTX_get_error_depth(ctx);

   224 

   225 	X509_NAME_oneline(X509_get_subject_name(err_cert),buf,256);

   226 	BIO_printf(bio_err,"depth=%d %s\n",depth,buf);

   227 	if (!ok)

   228 		{

   229 		BIO_printf(bio_err,"verify error:num=%d:%s\n",err,

   230 			X509_verify_cert_error_string(err));

   231 		if (depth < 6)

   232 			{

   233 			ok=1;

   234 			X509_STORE_CTX_set_error(ctx,X509_V_OK);

   235 			}

   236 		else

   237 			{

   238 			ok=0;

   239 			X509_STORE_CTX_set_error(ctx,X509_V_ERR_CERT_CHAIN_TOO_LONG);

   240 			}

   241 		}

   242 	switch (ctx->error)

   243 		{

   244 	case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:

   245 		X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert),buf,256);

   246 		BIO_printf(bio_err,"issuer= %s\n",buf);

   247 		break;

   248 	case X509_V_ERR_CERT_NOT_YET_VALID:

   249 	case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:

   250 		BIO_printf(bio_err,"notBefore=");

   251 		ASN1_UTCTIME_print(bio_err,X509_get_notBefore(ctx->current_cert));

   252 		BIO_printf(bio_err,"\n");

   253 		break;

   254 	case X509_V_ERR_CERT_HAS_EXPIRED:

   255 	case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:

   256 		BIO_printf(bio_err,"notAfter=");

   257 		ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ctx->current_cert));

   258 		BIO_printf(bio_err,"\n");

   259 		break;

   260 		}

   261 	BIO_printf(bio_err,"verify return:%d\n",ok);

   262 	return(ok);

   263 	}