Add new 'spkac' utility and several SPKAC utility functions. (8ce97163) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

CHANGES

+7 −0

Original line number	Diff line number	Diff line
		@@ -4,6 +4,13 @@

		Changes between 0.9.4 and 0.9.5 [xx XXX 1999]

		*) Add various utility functions to handle SPKACs, these were previously
		handled by poking round in the structure internals. Added new function
		NETSCAPE_SPKI_print() to print out SPKAC and a new utility 'spkac' to
		print, verify and generate SPKACs. Based on an original idea from
		Massimiliano Pala <madwolf@comune.modena.it> but extensively modified.
		[Steve Henson]

		*) RIPEMD160 is operational on all platforms and is back in 'make test'.
		[Andy Polyakov]

apps/Makefile.ssl

+3 −3

Original line number	Diff line number	Diff line
		@@ -37,7 +37,7 @@ E_EXE= verify asn1pars req dgst dh enc gendh errstr ca crl \
		rsa dsa dsaparam \
		x509 genrsa gendsa s_server s_client speed \
		s_time version pkcs7 crl2pkcs7 sess_id ciphers nseq pkcs12 \
		pkcs8
		pkcs8 spkac

		PROGS= $(PROGRAM).c

		@@ -51,7 +51,7 @@ E_OBJ= verify.o asn1pars.o req.o dgst.o dh.o enc.o gendh.o errstr.o ca.o \
		rsa.o dsa.o dsaparam.o \
		x509.o genrsa.o gendsa.o s_server.o s_client.o speed.o \
		s_time.o $(A_OBJ) $(S_OBJ) version.o sess_id.o \
		ciphers.o nseq.o pkcs12.o pkcs8.o
		ciphers.o nseq.o pkcs12.o pkcs8.o spkac.o

		# pem_mail.o

		@@ -60,7 +60,7 @@ E_SRC= verify.c asn1pars.c req.c dgst.c dh.c enc.c gendh.c errstr.c ca.c \
		rsa.c dsa.c dsaparam.c \
		x509.c genrsa.c gendsa.c s_server.c s_client.c speed.c \
		s_time.c $(A_SRC) $(S_SRC) version.c sess_id.c \
		ciphers.c nseq.c pkcs12.c pkcs8.c
		ciphers.c nseq.c pkcs12.c pkcs8.c spkac.o

		# pem_mail.c

apps/ca.c

+2 −22

Original line number	Diff line number	Diff line
		@@ -1941,7 +1941,6 @@ static int certify_spkac(X509 *xret, char infile, EVP_PKEY pkey, X509 x509,
		X509_REQ *req=NULL;
		CONF_VALUE *cv=NULL;
		NETSCAPE_SPKI *spki = NULL;
		unsigned char spki_der = NULL,p;
		X509_REQ_INFO *ri;
		char type,buf;
		EVP_PKEY *pktmp=NULL;
		@@ -2013,25 +2012,7 @@ static int certify_spkac(X509 *xret, char infile, EVP_PKEY pkey, X509 x509,
		{
		if (strcmp(type, "SPKAC") == 0)
		{
		spki_der=(unsigned char *)Malloc(
		strlen(cv->value)+1);
		if (spki_der == NULL)
		{
		BIO_printf(bio_err,"Malloc failure\n");
		goto err;
		}
		j = EVP_DecodeBlock(spki_der, (unsigned char *)cv->value,
		strlen(cv->value));
		if (j <= 0)
		{
		BIO_printf(bio_err, "Can't b64 decode SPKAC structure\n");
		goto err;
		}

		p=spki_der;
		spki = d2i_NETSCAPE_SPKI(&spki, &p, j);
		Free(spki_der);
		spki_der = NULL;
		spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
		if (spki == NULL)
		{
		BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
		@@ -2071,7 +2052,7 @@ static int certify_spkac(X509 *xret, char infile, EVP_PKEY pkey, X509 x509,

		BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");

		if ((pktmp=X509_PUBKEY_get(spki->spkac->pubkey)) == NULL)
		if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
		{
		BIO_printf(bio_err,"error unpacking SPKAC public key\n");
		goto err;
		@@ -2092,7 +2073,6 @@ static int certify_spkac(X509 *xret, char infile, EVP_PKEY pkey, X509 x509,
		err:
		if (req != NULL) X509_REQ_free(req);
		if (parms != NULL) CONF_free(parms);
		if (spki_der != NULL) Free(spki_der);
		if (spki != NULL) NETSCAPE_SPKI_free(spki);
		if (ne != NULL) X509_NAME_ENTRY_free(ne);

apps/progs.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -28,6 +28,7 @@ extern int ciphers_main(int argc,char *argv[]);
		extern int nseq_main(int argc,char *argv[]);
		extern int pkcs12_main(int argc,char *argv[]);
		extern int pkcs8_main(int argc,char *argv[]);
		extern int spkac_main(int argc,char *argv[]);

		#ifdef SSLEAY_SRC /* Defined only in openssl.c. */

		@@ -94,6 +95,7 @@ FUNCTION functions[] = {
		{FUNC_TYPE_GENERAL,"pkcs12",pkcs12_main},
		#endif
		{FUNC_TYPE_GENERAL,"pkcs8",pkcs8_main},
		{FUNC_TYPE_GENERAL,"spkac",spkac_main},
		{FUNC_TYPE_MD,"md2",dgst_main},
		{FUNC_TYPE_MD,"md5",dgst_main},
		{FUNC_TYPE_MD,"sha",dgst_main},

apps/spkac.c

0 → 100644

+255 −0

Original line number	Diff line number	Diff line
		/* apps/spkac.c */

		/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
		* project 1999. Based on an original idea by Massimiliano Pala
		* (madwolf@openca.org).
		*/
		/* ====================================================================
		* Copyright (c) 1999 The OpenSSL Project. All rights reserved.
		*
		* Redistribution and use in source and binary forms, with or without
		* modification, are permitted provided that the following conditions
		* are met:
		*
		* 1. Redistributions of source code must retain the above copyright
		* notice, this list of conditions and the following disclaimer.
		*
		* 2. Redistributions in binary form must reproduce the above copyright
		* notice, this list of conditions and the following disclaimer in
		* the documentation and/or other materials provided with the
		* distribution.
		*
		* 3. All advertising materials mentioning features or use of this
		* software must display the following acknowledgment:
		* "This product includes software developed by the OpenSSL Project
		* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
		*
		* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
		* endorse or promote products derived from this software without
		* prior written permission. For written permission, please contact
		* licensing@OpenSSL.org.
		*
		* 5. Products derived from this software may not be called "OpenSSL"
		* nor may "OpenSSL" appear in their names without prior written
		* permission of the OpenSSL Project.
		*
		* 6. Redistributions of any form whatsoever must retain the following
		* acknowledgment:
		* "This product includes software developed by the OpenSSL Project
		* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
		*
		* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
		* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
		* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
		* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
		* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
		* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
		* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
		* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
		* OF THE POSSIBILITY OF SUCH DAMAGE.
		* ====================================================================
		*
		* This product includes cryptographic software written by Eric Young
		* (eay@cryptsoft.com). This product includes software written by Tim
		* Hudson (tjh@cryptsoft.com).
		*
		*/
		#include <stdio.h>
		#include <stdlib.h>
		#include <string.h>
		#include <time.h>
		#include "apps.h"
		#include <openssl/bio.h>
		#include <openssl/err.h>
		#include <openssl/rsa.h>
		#include <openssl/evp.h>
		#include <openssl/x509.h>
		#include <openssl/pem.h>

		#undef PROG
		#define PROG spkac_main

		/* -in arg - input file - default stdin
		* -out arg - output file - default stdout
		*/

		int MAIN(int argc, char **argv)
		{
		int i,badops=0, ret = 1;
		BIO in = NULL,out = NULL, *key = NULL;
		int verify=0,noout=0;
		char infile = NULL,outfile = NULL,*prog;
		char spkac = "SPKAC", spksect = "default", *spkstr = NULL;
		char challenge = NULL, keyfile = NULL;
		LHASH *conf;
		NETSCAPE_SPKI *spki = NULL;
		EVP_PKEY *pkey = NULL;

		apps_startup();

		if (!bio_err) bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);

		prog=argv[0];
		argc--;
		argv++;
		while (argc >= 1)
		{
		if (strcmp(*argv,"-in") == 0)
		{
		if (--argc < 1) goto bad;
		infile= *(++argv);
		}
		else if (strcmp(*argv,"-out") == 0)
		{
		if (--argc < 1) goto bad;
		outfile= *(++argv);
		}
		else if (strcmp(*argv,"-key") == 0)
		{
		if (--argc < 1) goto bad;
		keyfile= *(++argv);
		}
		else if (strcmp(*argv,"-challenge") == 0)
		{
		if (--argc < 1) goto bad;
		challenge= *(++argv);
		}
		else if (strcmp(*argv,"-spkac") == 0)
		{
		if (--argc < 1) goto bad;
		spkac= *(++argv);
		}
		else if (strcmp(*argv,"-spksect") == 0)
		{
		if (--argc < 1) goto bad;
		spksect= *(++argv);
		}
		else if (strcmp(*argv,"-noout") == 0)
		noout=1;
		else if (strcmp(*argv,"-verify") == 0)
		verify=1;
		else badops = 1;
		argc--;
		argv++;
		}

		if (badops)
		{
		bad:
		BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
		BIO_printf(bio_err,"where options are\n");
		BIO_printf(bio_err," -in arg input file\n");
		BIO_printf(bio_err," -out arg output file\n");
		BIO_printf(bio_err," -spkac arg alternative SPKAC name\n");
		BIO_printf(bio_err," -noout don't print SPKAC\n");
		BIO_printf(bio_err," -verify verify SPKAC signature\n");
		goto end;
		}

		ERR_load_crypto_strings();

		if(keyfile) {
		if(strcmp(keyfile, "-")) key = BIO_new_file(keyfile, "r");
		else key = BIO_new_fp(stdin, BIO_NOCLOSE);
		if(!key) {
		BIO_printf(bio_err, "Error opening key file\n");
		ERR_print_errors(bio_err);
		goto end;
		}
		pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, NULL);
		if(!pkey) {
		BIO_printf(bio_err, "Error reading private key\n");
		ERR_print_errors(bio_err);
		goto end;
		}
		spki = NETSCAPE_SPKI_new();
		if(challenge) ASN1_STRING_set(spki->spkac->challenge,
		challenge, strlen(challenge));
		NETSCAPE_SPKI_set_pubkey(spki, pkey);
		NETSCAPE_SPKI_sign(spki, pkey, EVP_md5());
		spkstr = NETSCAPE_SPKI_b64_encode(spki);

		if (outfile) out = BIO_new_file(outfile, "w");
		else out = BIO_new_fp(stdout, BIO_NOCLOSE);

		if(!out) {
		BIO_printf(bio_err, "Error opening output file\n");
		ERR_print_errors(bio_err);
		goto end;
		}
		BIO_printf(out, "SPKAC=%s\n", spkstr);
		ret = 0;
		goto end;
		}



		if (infile) in = BIO_new_file(infile, "r");
		else in = BIO_new_fp(stdin, BIO_NOCLOSE);

		if(!in) {
		BIO_printf(bio_err, "Error opening input file\n");
		ERR_print_errors(bio_err);
		goto end;
		}

		conf = CONF_load_bio(NULL, in, NULL);

		if(!conf) {
		BIO_printf(bio_err, "Error parsing config file\n");
		ERR_print_errors(bio_err);
		goto end;
		}

		spkstr = CONF_get_string(conf, spksect, spkac);

		if(!spkstr) {
		BIO_printf(bio_err, "Can't find SPKAC called \"%s\"\n", spkac);
		ERR_print_errors(bio_err);
		goto end;
		}

		spki = NETSCAPE_SPKI_b64_decode(spkstr, -1);
		if(!spki) {
		BIO_printf(bio_err, "Error loading SPKAC\n");
		ERR_print_errors(bio_err);
		goto end;
		}

		if (outfile) out = BIO_new_file(outfile, "w");
		else out = BIO_new_fp(stdout, BIO_NOCLOSE);

		if(!out) {
		BIO_printf(bio_err, "Error opening output file\n");
		ERR_print_errors(bio_err);
		goto end;
		}

		if(!noout) NETSCAPE_SPKI_print(out, spki);
		if(verify) {
		EVP_PKEY *pktmp;
		pktmp = NETSCAPE_SPKI_get_pubkey(spki);
		i = NETSCAPE_SPKI_verify(spki, pktmp);
		EVP_PKEY_free(pktmp);
		if(i) BIO_printf(bio_err, "Signature OK\n");
		else {
		BIO_printf(bio_err, "Signature Failure\n");
		ERR_print_errors(bio_err);
		goto end;
		}
		}

		ret = 0;

		end:
		NETSCAPE_SPKI_free(spki);
		BIO_free(in);
		BIO_free(out);
		BIO_free(key);
		EVP_PKEY_free(pkey);
		if(spkstr) Free(spkstr);
		EXIT(ret);
		}