src/certtool.c

   1 /*
   2  * Copyright (C) 2003-2012 Free Software Foundation, Inc.
   3  *
   4  * This file is part of GnuTLS.
   5  *
   6  * GnuTLS is free software: you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation, either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * GnuTLS is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see
  18  * <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include <config.h>
  22
  23 #include <gnutls/gnutls.h>
  24 #include <gnutls/x509.h>
  25 #include <gnutls/openpgp.h>
  26 #include <gnutls/pkcs12.h>
  27 #include <gnutls/pkcs11.h>
  28 #include <gnutls/abstract.h>
  29
  30 #include <stdio.h>
  31 #include <stdlib.h>
  32 #include <string.h>
  33 #include <ctype.h>
  34 #include <time.h>
  35 #include <unistd.h>
  36 #include <errno.h>
  37 #include <sys/types.h>
  38 #include <sys/stat.h>
  39 #include <fcntl.h>
  40 #include <error.h>
  41
  42 /* Gnulib portability files. */
  43 #include <read-file.h>
  44 #include <progname.h>
  45 #include <version-etc.h>
  46
  47 #include <certtool-cfg.h>
  48 #include <p11common.h>
  49 #include "certtool-args.h"
  50 #include "certtool-common.h"
  51
  52 #define SIGN_HASH GNUTLS_DIG_SHA256
  53
  54 static void privkey_info_int (common_info_st*, gnutls_x509_privkey_t key);
  55 static void print_crl_info (gnutls_x509_crl_t crl, FILE * out);
  56 void pkcs7_info (void);
  57 void crq_info (void);
  58 void smime_to_pkcs7 (void);
  59 void pkcs12_info (common_info_st*);
  60 void generate_pkcs12 (common_info_st *);
  61 void generate_pkcs8 (common_info_st *);
  62 static void verify_chain (void);
  63 void verify_crl (common_info_st * cinfo);
  64 void pubkey_info (gnutls_x509_crt_t crt, common_info_st *);
  65 void pgp_privkey_info (void);
  66 void pgp_ring_info (void);
  67 void certificate_info (int, common_info_st *);
  68 void pgp_certificate_info (void);
  69 void crl_info (void);
  70 void privkey_info (common_info_st*);
  71 static void cmd_parser (int argc, char **argv);
  72 void generate_self_signed (common_info_st *);
  73 void generate_request (common_info_st *);
  74 static void print_certificate_info (gnutls_x509_crt_t crt, FILE * out,
  75                                     unsigned int all);
  76 static void verify_certificate (common_info_st * cinfo);
  77
  78 static void print_hex_datum (gnutls_datum_t * dat);
  79
  80 FILE *outfile;
  81 FILE *infile;
  82 static gnutls_digest_algorithm_t default_dig;
  83 static unsigned int incert_format, outcert_format;
  84 static unsigned int req_key_type;
  85
  86 /* non interactive operation if set
  87  */
  88 int batch;
  89
  90
  91 static void
  92 tls_log_func (int level, const char *str)
  93 {
  94   fprintf (stderr, "|<%d>| %s", level, str);
  95 }
  96
  97 int
  98 main (int argc, char **argv)
  99 {
 100   set_program_name (argv[0]);
 101   cfg_init ();
 102   cmd_parser (argc, argv);
 103
 104   return 0;
 105 }
 106
 107 static const char *
 108 raw_to_string (const unsigned char *raw, size_t raw_size)
 109 {
 110   static char buf[1024];
 111   size_t i;
 112   if (raw_size == 0)
 113     return NULL;
 114
 115   if (raw_size * 3 + 1 >= sizeof (buf))
 116     return NULL;
 117
 118   for (i = 0; i < raw_size; i++)
 119     {
 120       sprintf (&(buf[i * 3]), "%02X%s", raw[i],
 121                (i == raw_size - 1) ? "" : ":");
 122     }
 123   buf[sizeof (buf) - 1] = '\0';
 124
 125   return buf;
 126 }
 127
 128 static void
 129 print_dsa_pkey (gnutls_datum_t * x, gnutls_datum_t * y, gnutls_datum_t * p,
 130                 gnutls_datum_t * q, gnutls_datum_t * g)
 131 {
 132   if (x)
 133     {
 134       fprintf (outfile, "private key:");
 135       print_hex_datum (x);
 136     }
 137   fprintf (outfile, "public key:");
 138   print_hex_datum (y);
 139   fprintf (outfile, "p:");
 140   print_hex_datum (p);
 141   fprintf (outfile, "q:");
 142   print_hex_datum (q);
 143   fprintf (outfile, "g:");
 144   print_hex_datum (g);
 145 }
 146
 147 static void
 148 print_ecc_pkey (gnutls_ecc_curve_t curve, gnutls_datum_t* k, gnutls_datum_t * x, gnutls_datum_t * y)
 149 {
 150   fprintf (outfile, "curve:\t%s\n", gnutls_ecc_curve_get_name(curve));
 151   if (k)
 152     {
 153       fprintf (outfile, "private key:");
 154       print_hex_datum (k);
 155     }
 156   fprintf (outfile, "x:");
 157   print_hex_datum (x);
 158   fprintf (outfile, "y:");
 159   print_hex_datum (y);
 160 }
 161
 162 static void
 163 print_rsa_pkey (gnutls_datum_t * m, gnutls_datum_t * e, gnutls_datum_t * d,
 164                 gnutls_datum_t * p, gnutls_datum_t * q, gnutls_datum_t * u,
 165                 gnutls_datum_t * exp1, gnutls_datum_t * exp2)
 166 {
 167   fprintf (outfile, "modulus:");
 168   print_hex_datum (m);
 169   fprintf (outfile, "public exponent:");
 170   print_hex_datum (e);
 171   if (d)
 172     {
 173       fprintf (outfile, "private exponent:");
 174       print_hex_datum (d);
 175       fprintf (outfile, "prime1:");
 176       print_hex_datum (p);
 177       fprintf (outfile, "prime2:");
 178       print_hex_datum (q);
 179       fprintf (outfile, "coefficient:");
 180       print_hex_datum (u);
 181       if (exp1 && exp2)
 182         {
 183           fprintf (outfile, "exp1:");
 184           print_hex_datum (exp1);
 185           fprintf (outfile, "exp2:");
 186           print_hex_datum (exp2);
 187         }
 188     }
 189 }
 190
 191 static gnutls_x509_privkey_t
 192 generate_private_key_int (common_info_st * cinfo)
 193 {
 194   gnutls_x509_privkey_t key;
 195   int ret, key_type, bits;
 196
 197   key_type = req_key_type;
 198
 199   ret = gnutls_x509_privkey_init (&key);
 200   if (ret < 0)
 201     error (EXIT_FAILURE, 0, "privkey_init: %s", gnutls_strerror (ret));
 202
 203   bits = get_bits (key_type, cinfo->bits, cinfo->sec_param);
 204
 205   fprintf (stderr, "Generating a %d bit %s private key...\n",
 206            bits, gnutls_pk_algorithm_get_name (key_type));
 207
 208   if (bits > 1024 && key_type == GNUTLS_PK_DSA)
 209     fprintf (stderr,
 210              "Note that DSA keys with size over 1024 can only be used with TLS 1.2 or later.\n\n");
 211
 212   ret = gnutls_x509_privkey_generate (key, key_type, bits, 0);
 213   if (ret < 0)
 214     error (EXIT_FAILURE, 0, "privkey_generate: %s", gnutls_strerror (ret));
 215
 216   ret = gnutls_x509_privkey_verify_params (key);
 217   if (ret < 0)
 218     error (EXIT_FAILURE, 0, "privkey_verify_params: %s", gnutls_strerror (ret));
 219
 220   return key;
 221 }
 222
 223 static int
 224 cipher_to_flags (const char *cipher)
 225 {
 226   if (cipher == NULL)
 227     {
 228       return GNUTLS_PKCS_USE_PBES2_AES_128;
 229     }
 230   else if (strcasecmp (cipher, "3des") == 0)
 231     {
 232       return GNUTLS_PKCS_USE_PBES2_3DES;
 233     }
 234   else if (strcasecmp (cipher, "3des-pkcs12") == 0)
 235     {
 236       return GNUTLS_PKCS_USE_PKCS12_3DES;
 237     }
 238   else if (strcasecmp (cipher, "arcfour") == 0)
 239     {
 240       return GNUTLS_PKCS_USE_PKCS12_ARCFOUR;
 241     }
 242   else if (strcasecmp (cipher, "aes-128") == 0)
 243     {
 244       return GNUTLS_PKCS_USE_PBES2_AES_128;
 245     }
 246   else if (strcasecmp (cipher, "aes-192") == 0)
 247     {
 248       return GNUTLS_PKCS_USE_PBES2_AES_192;
 249     }
 250   else if (strcasecmp (cipher, "aes-256") == 0)
 251     {
 252       return GNUTLS_PKCS_USE_PBES2_AES_256;
 253     }
 254   else if (strcasecmp (cipher, "rc2-40") == 0)
 255     {
 256       return GNUTLS_PKCS_USE_PKCS12_RC2_40;
 257     }
 258
 259   error (EXIT_FAILURE, 0, "unknown cipher %s\n", cipher);
 260   return -1;
 261 }
 262
 263
 264 static void
 265 print_private_key (common_info_st* cinfo, gnutls_x509_privkey_t key)
 266 {
 267   int ret;
 268   size_t size;
 269
 270   if (!key)
 271     return;
 272
 273   if (outcert_format == GNUTLS_X509_FMT_PEM)
 274     privkey_info_int(cinfo, key);
 275
 276   if (!cinfo->pkcs8)
 277     {
 278       size = buffer_size;
 279       ret = gnutls_x509_privkey_export (key, outcert_format,
 280                                         buffer, &size);
 281       if (ret < 0)
 282         error (EXIT_FAILURE, 0, "privkey_export: %s", gnutls_strerror (ret));
 283     }
 284   else
 285     {
 286       unsigned int flags;
 287       const char *pass;
 288
 289       flags = cipher_to_flags (cinfo->pkcs_cipher);
 290
 291       if ((pass = get_confirmed_pass (true)) == NULL || *pass == '\0')
 292         flags = GNUTLS_PKCS_PLAIN;
 293
 294       size = buffer_size;
 295       ret =
 296         gnutls_x509_privkey_export_pkcs8 (key, outcert_format, pass,
 297                                           flags, buffer, &size);
 298       if (ret < 0)
 299         error (EXIT_FAILURE, 0, "privkey_export_pkcs8: %s",
 300                gnutls_strerror (ret));
 301     }
 302
 303   fwrite (buffer, 1, size, outfile);
 304 }
 305
 306 static void
 307 generate_private_key (common_info_st* cinfo)
 308 {
 309   gnutls_x509_privkey_t key;
 310
 311   key = generate_private_key_int (cinfo);
 312
 313   print_private_key (cinfo, key);
 314
 315   gnutls_x509_privkey_deinit (key);
 316 }
 317
 318
 319 static gnutls_x509_crt_t
 320 generate_certificate (gnutls_privkey_t * ret_key,
 321                       gnutls_x509_crt_t ca_crt, int proxy,
 322                       common_info_st * cinfo)
 323 {
 324   gnutls_x509_crt_t crt;
 325   gnutls_privkey_t key = NULL;
 326   gnutls_pubkey_t pubkey;
 327   size_t size;
 328   int ret;
 329   int client;
 330   int days, result, ca_status = 0, is_ike = 0, path_len;
 331   int vers;
 332   unsigned int usage = 0, server;
 333   gnutls_x509_crq_t crq;        /* request */
 334
 335   ret = gnutls_x509_crt_init (&crt);
 336   if (ret < 0)
 337     error (EXIT_FAILURE, 0, "crt_init: %s", gnutls_strerror (ret));
 338
 339   crq = load_request (cinfo);
 340
 341   if (crq == NULL)
 342     {
 343
 344       key = load_private_key (1, cinfo);
 345
 346       pubkey = load_public_key_or_import (1, key, cinfo);
 347
 348       if (!batch)
 349         fprintf (stderr,
 350                  "Please enter the details of the certificate's distinguished name. "
 351                  "Just press enter to ignore a field.\n");
 352
 353       /* set the DN.
 354        */
 355       if (proxy)
 356         {
 357           result = gnutls_x509_crt_set_proxy_dn (crt, ca_crt, 0, NULL, 0);
 358           if (result < 0)
 359             error (EXIT_FAILURE, 0, "set_proxy_dn: %s",
 360                    gnutls_strerror (result));
 361
 362           get_cn_crt_set (crt);
 363         }
 364       else
 365         {
 366           get_country_crt_set (crt);
 367           get_organization_crt_set (crt);
 368           get_unit_crt_set (crt);
 369           get_locality_crt_set (crt);
 370           get_state_crt_set (crt);
 371           get_cn_crt_set (crt);
 372           get_dc_set (TYPE_CRT, crt);
 373           get_uid_crt_set (crt);
 374           get_oid_crt_set (crt);
 375           get_key_purpose_set (crt);
 376
 377           if (!batch)
 378             fprintf (stderr,
 379                      "This field should not be used in new certificates.\n");
 380
 381           get_pkcs9_email_crt_set (crt);
 382         }
 383
 384       result = gnutls_x509_crt_set_pubkey (crt, pubkey);
 385       if (result < 0)
 386         error (EXIT_FAILURE, 0, "set_key: %s", gnutls_strerror (result));
 387     }
 388   else
 389     {
 390       result = gnutls_x509_crt_set_crq (crt, crq);
 391       if (result < 0)
 392         error (EXIT_FAILURE, 0, "set_crq: %s", gnutls_strerror (result));
 393     }
 394
 395
 396   {
 397     int serial = get_serial ();
 398     char bin_serial[5];
 399
 400     bin_serial[4] = serial & 0xff;
 401     bin_serial[3] = (serial >> 8) & 0xff;
 402     bin_serial[2] = (serial >> 16) & 0xff;
 403     bin_serial[1] = (serial >> 24) & 0xff;
 404     bin_serial[0] = 0;
 405
 406     result = gnutls_x509_crt_set_serial (crt, bin_serial, 5);
 407     if (result < 0)
 408       error (EXIT_FAILURE, 0, "serial: %s", gnutls_strerror (result));
 409   }
 410
 411   if (!batch)
 412     fprintf (stderr, "\n\nActivation/Expiration time.\n");
 413
 414   gnutls_x509_crt_set_activation_time (crt, time (NULL));
 415
 416   days = get_days ();
 417
 418   result =
 419     gnutls_x509_crt_set_expiration_time (crt,
 420                                          time (NULL) + ((time_t) days) * 24 * 60 * 60);
 421   if (result < 0)
 422     error (EXIT_FAILURE, 0, "set_expiration: %s", gnutls_strerror (result));
 423
 424   if (!batch)
 425     fprintf (stderr, "\n\nExtensions.\n");
 426
 427   /* do not allow extensions on a v1 certificate */
 428   if (crq && get_crq_extensions_status () != 0)
 429     {
 430       result = gnutls_x509_crt_set_crq_extensions (crt, crq);
 431       if (result < 0)
 432         error (EXIT_FAILURE, 0, "set_crq: %s", gnutls_strerror (result));
 433     }
 434
 435   /* append additional extensions */
 436   if (cinfo->v1_cert == 0)
 437     {
 438
 439       if (proxy)
 440         {
 441           const char *policylanguage;
 442           char *policy;
 443           size_t policylen;
 444           int proxypathlen = get_path_len ();
 445
 446           if (!batch)
 447             {
 448               printf ("1.3.6.1.5.5.7.21.1 ::= id-ppl-inheritALL\n");
 449               printf ("1.3.6.1.5.5.7.21.2 ::= id-ppl-independent\n");
 450             }
 451
 452           policylanguage = get_proxy_policy (&policy, &policylen);
 453
 454           result =
 455             gnutls_x509_crt_set_proxy (crt, proxypathlen, policylanguage,
 456                                        policy, policylen);
 457           if (result < 0)
 458             error (EXIT_FAILURE, 0, "set_proxy: %s",
 459                    gnutls_strerror (result));
 460         }
 461
 462       if (!proxy)
 463         ca_status = get_ca_status ();
 464       if (ca_status)
 465         path_len = get_path_len ();
 466       else
 467         path_len = -1;
 468
 469       result =
 470         gnutls_x509_crt_set_basic_constraints (crt, ca_status, path_len);
 471       if (result < 0)
 472         error (EXIT_FAILURE, 0, "basic_constraints: %s",
 473                gnutls_strerror (result));
 474
 475       client = get_tls_client_status ();
 476       if (client != 0)
 477         {
 478           result = gnutls_x509_crt_set_key_purpose_oid (crt,
 479                                                         GNUTLS_KP_TLS_WWW_CLIENT,
 480                                                         0);
 481           if (result < 0)
 482             error (EXIT_FAILURE, 0, "key_kp: %s", gnutls_strerror (result));
 483         }
 484
 485       is_ike = get_ipsec_ike_status ();
 486       server = get_tls_server_status ();
 487
 488       get_dns_name_set (TYPE_CRT, crt);
 489       get_uri_set (TYPE_CRT, crt);
 490       get_ip_addr_set (TYPE_CRT, crt);
 491
 492       if (server != 0)
 493         {
 494           result = 0;
 495
 496           result =
 497             gnutls_x509_crt_set_key_purpose_oid (crt,
 498                                                  GNUTLS_KP_TLS_WWW_SERVER, 0);
 499           if (result < 0)
 500             error (EXIT_FAILURE, 0, "key_kp: %s", gnutls_strerror (result));
 501         }
 502       else if (!proxy)
 503         {
 504           get_email_set (TYPE_CRT, crt);
 505         }
 506
 507       if (!ca_status || server)
 508         {
 509           int pk;
 510
 511
 512           pk = gnutls_x509_crt_get_pk_algorithm (crt, NULL);
 513
 514           if (pk != GNUTLS_PK_DSA)
 515             {                   /* DSA keys can only sign.
 516                                  */
 517               result = get_sign_status (server);
 518               if (result)
 519                 usage |= GNUTLS_KEY_DIGITAL_SIGNATURE;
 520
 521               result = get_encrypt_status (server);
 522               if (result)
 523                 usage |= GNUTLS_KEY_KEY_ENCIPHERMENT;
 524             }
 525           else
 526             usage |= GNUTLS_KEY_DIGITAL_SIGNATURE;
 527
 528           if (is_ike)
 529             {
 530               result =
 531                 gnutls_x509_crt_set_key_purpose_oid (crt,
 532                                                      GNUTLS_KP_IPSEC_IKE, 0);
 533               if (result < 0)
 534                 error (EXIT_FAILURE, 0, "key_kp: %s",
 535                        gnutls_strerror (result));
 536             }
 537         }
 538
 539
 540       if (ca_status)
 541         {
 542           result = get_cert_sign_status ();
 543           if (result)
 544             usage |= GNUTLS_KEY_KEY_CERT_SIGN;
 545
 546           result = get_crl_sign_status ();
 547           if (result)
 548             usage |= GNUTLS_KEY_CRL_SIGN;
 549
 550           result = get_code_sign_status ();
 551           if (result)
 552             {
 553               result =
 554                 gnutls_x509_crt_set_key_purpose_oid (crt,
 555                                                      GNUTLS_KP_CODE_SIGNING,
 556                                                      0);
 557               if (result < 0)
 558                 error (EXIT_FAILURE, 0, "key_kp: %s",
 559                        gnutls_strerror (result));
 560             }
 561
 562           result = get_ocsp_sign_status ();
 563           if (result)
 564             {
 565               result =
 566                 gnutls_x509_crt_set_key_purpose_oid (crt,
 567                                                      GNUTLS_KP_OCSP_SIGNING,
 568                                                      0);
 569               if (result < 0)
 570                 error (EXIT_FAILURE, 0, "key_kp: %s",
 571                        gnutls_strerror (result));
 572             }
 573
 574           result = get_time_stamp_status ();
 575           if (result)
 576             {
 577               result =
 578                 gnutls_x509_crt_set_key_purpose_oid (crt,
 579                                                      GNUTLS_KP_TIME_STAMPING,
 580                                                      0);
 581               if (result < 0)
 582                 error (EXIT_FAILURE, 0, "key_kp: %s",
 583                        gnutls_strerror (result));
 584             }
 585         }
 586       get_ocsp_issuer_set(crt);
 587       get_ca_issuers_set(crt);
 588
 589       if (usage != 0)
 590         {
 591           /* http://tools.ietf.org/html/rfc4945#section-5.1.3.2: if any KU is
 592              set, then either digitalSignature or the nonRepudiation bits in the
 593              KeyUsage extension MUST for all IKE certs */
 594           if (is_ike && (get_sign_status (server) != 1))
 595             usage |= GNUTLS_KEY_NON_REPUDIATION;
 596           result = gnutls_x509_crt_set_key_usage (crt, usage);
 597           if (result < 0)
 598             error (EXIT_FAILURE, 0, "key_usage: %s",
 599                    gnutls_strerror (result));
 600         }
 601
 602       /* Subject Key ID.
 603        */
 604       size = buffer_size;
 605       result = gnutls_x509_crt_get_key_id (crt, 0, buffer, &size);
 606       if (result >= 0)
 607         {
 608           result = gnutls_x509_crt_set_subject_key_id (crt, buffer, size);
 609           if (result < 0)
 610             error (EXIT_FAILURE, 0, "set_subject_key_id: %s",
 611                    gnutls_strerror (result));
 612         }
 613
 614       /* Authority Key ID.
 615        */
 616       if (ca_crt != NULL)
 617         {
 618           size = buffer_size;
 619           result = gnutls_x509_crt_get_subject_key_id (ca_crt, buffer,
 620                                                        &size, NULL);
 621           if (result < 0)
 622             {
 623               size = buffer_size;
 624               result = gnutls_x509_crt_get_key_id (ca_crt, 0, buffer, &size);
 625             }
 626           if (result >= 0)
 627             {
 628               result =
 629                 gnutls_x509_crt_set_authority_key_id (crt, buffer, size);
 630               if (result < 0)
 631                 error (EXIT_FAILURE, 0, "set_authority_key_id: %s",
 632                        gnutls_strerror (result));
 633             }
 634         }
 635     }
 636
 637   /* Version.
 638    */
 639   if (cinfo->v1_cert != 0)
 640     vers = 1;
 641   else
 642     vers = 3;
 643   result = gnutls_x509_crt_set_version (crt, vers);
 644   if (result < 0)
 645     error (EXIT_FAILURE, 0, "set_version: %s", gnutls_strerror (result));
 646
 647   *ret_key = key;
 648   return crt;
 649
 650 }
 651
 652 static gnutls_x509_crl_t
 653 generate_crl (gnutls_x509_crt_t ca_crt, common_info_st * cinfo)
 654 {
 655   gnutls_x509_crl_t crl;
 656   gnutls_x509_crt_t *crts;
 657   size_t size;
 658   int days, result;
 659   unsigned int i;
 660   time_t now = time (NULL);
 661
 662   result = gnutls_x509_crl_init (&crl);
 663   if (result < 0)
 664     error (EXIT_FAILURE, 0, "crl_init: %s", gnutls_strerror (result));
 665
 666   crts = load_cert_list (0, &size, cinfo);
 667
 668   for (i = 0; i < size; i++)
 669     {
 670       result = gnutls_x509_crl_set_crt (crl, crts[i], now);
 671       if (result < 0)
 672         error (EXIT_FAILURE, 0, "crl_set_crt: %s", gnutls_strerror (result));
 673     }
 674
 675   result = gnutls_x509_crl_set_this_update (crl, now);
 676   if (result < 0)
 677     error (EXIT_FAILURE, 0, "this_update: %s", gnutls_strerror (result));
 678
 679   fprintf (stderr, "Update times.\n");
 680   days = get_crl_next_update ();
 681
 682   result = gnutls_x509_crl_set_next_update (crl, now + days * 24 * 60 * 60);
 683   if (result < 0)
 684     error (EXIT_FAILURE, 0, "next_update: %s", gnutls_strerror (result));
 685
 686   result = gnutls_x509_crl_set_version (crl, 2);
 687   if (result < 0)
 688     error (EXIT_FAILURE, 0, "set_version: %s", gnutls_strerror (result));
 689
 690   /* Authority Key ID.
 691    */
 692   if (ca_crt != NULL)
 693     {
 694       size = buffer_size;
 695       result = gnutls_x509_crt_get_subject_key_id (ca_crt, buffer,
 696                                                    &size, NULL);
 697       if (result < 0)
 698         {
 699           size = buffer_size;
 700           result = gnutls_x509_crt_get_key_id (ca_crt, 0, buffer, &size);
 701         }
 702       if (result >= 0)
 703         {
 704           result = gnutls_x509_crl_set_authority_key_id (crl, buffer, size);
 705           if (result < 0)
 706             error (EXIT_FAILURE, 0, "set_authority_key_id: %s",
 707                    gnutls_strerror (result));
 708         }
 709     }
 710
 711   {
 712     unsigned int number = get_crl_number ();
 713     char bin_number[5];
 714
 715     bin_number[4] = number & 0xff;
 716     bin_number[3] = (number >> 8) & 0xff;
 717     bin_number[2] = (number >> 16) & 0xff;
 718     bin_number[1] = (number >> 24) & 0xff;
 719     bin_number[0] = 0;
 720
 721     result = gnutls_x509_crl_set_number (crl, bin_number, 5);
 722     if (result < 0)
 723       error (EXIT_FAILURE, 0, "set_number: %s", gnutls_strerror (result));
 724   }
 725
 726   return crl;
 727 }
 728
 729 static gnutls_digest_algorithm_t
 730 get_dig (gnutls_x509_crt_t crt)
 731 {
 732   gnutls_digest_algorithm_t dig;
 733   gnutls_pubkey_t pubkey;
 734   int result;
 735   unsigned int mand;
 736
 737   gnutls_pubkey_init(&pubkey);
 738
 739   result = gnutls_pubkey_import_x509(pubkey, crt, 0);
 740   if (result < 0)
 741     {
 742       error (EXIT_FAILURE, 0, "gnutls_pubkey_import_x509: %s",
 743              gnutls_strerror (result));
 744     }
 745
 746   result = gnutls_pubkey_get_preferred_hash_algorithm (pubkey, &dig, &mand);
 747   if (result < 0)
 748     {
 749       error (EXIT_FAILURE, 0, "crt_get_preferred_hash_algorithm: %s",
 750              gnutls_strerror (result));
 751     }
 752
 753   gnutls_pubkey_deinit(pubkey);
 754
 755   /* if algorithm allows alternatives */
 756   if (mand == 0 && default_dig != GNUTLS_DIG_UNKNOWN)
 757     dig = default_dig;
 758
 759   return dig;
 760 }
 761
 762 void
 763 generate_self_signed (common_info_st * cinfo)
 764 {
 765   gnutls_x509_crt_t crt;
 766   gnutls_privkey_t key;
 767   size_t size;
 768   int result;
 769   const char *uri;
 770
 771   fprintf (stderr, "Generating a self signed certificate...\n");
 772
 773   crt = generate_certificate (&key, NULL, 0, cinfo);
 774
 775   if (!key)
 776     key = load_private_key (1, cinfo);
 777
 778   uri = get_crl_dist_point_url ();
 779   if (uri)
 780     {
 781       result = gnutls_x509_crt_set_crl_dist_points (crt, GNUTLS_SAN_URI,
 782                                                     uri,
 783                                                     0 /* all reasons */ );
 784       if (result < 0)
 785         error (EXIT_FAILURE, 0, "crl_dist_points: %s",
 786                gnutls_strerror (result));
 787     }
 788
 789   print_certificate_info (crt, stderr, 0);
 790
 791   fprintf (stderr, "\n\nSigning certificate...\n");
 792
 793   result = gnutls_x509_crt_privkey_sign (crt, crt, key, get_dig (crt), 0);
 794   if (result < 0)
 795     error (EXIT_FAILURE, 0, "crt_sign: %s", gnutls_strerror (result));
 796
 797   size = buffer_size;
 798   result = gnutls_x509_crt_export (crt, outcert_format, buffer, &size);
 799   if (result < 0)
 800     error (EXIT_FAILURE, 0, "crt_export: %s", gnutls_strerror (result));
 801
 802   fwrite (buffer, 1, size, outfile);
 803
 804   gnutls_x509_crt_deinit (crt);
 805   gnutls_privkey_deinit (key);
 806 }
 807
 808 static void
 809 generate_signed_certificate (common_info_st * cinfo)
 810 {
 811   gnutls_x509_crt_t crt;
 812   gnutls_privkey_t key;
 813   size_t size;
 814   int result;
 815   gnutls_privkey_t ca_key;
 816   gnutls_x509_crt_t ca_crt;
 817
 818   fprintf (stderr, "Generating a signed certificate...\n");
 819
 820   ca_key = load_ca_private_key (cinfo);
 821   ca_crt = load_ca_cert (cinfo);
 822
 823   crt = generate_certificate (&key, ca_crt, 0, cinfo);
 824
 825   /* Copy the CRL distribution points.
 826    */
 827   gnutls_x509_crt_cpy_crl_dist_points (crt, ca_crt);
 828   /* it doesn't matter if we couldn't copy the CRL dist points.
 829    */
 830
 831   print_certificate_info (crt, stderr, 0);
 832
 833   fprintf (stderr, "\n\nSigning certificate...\n");
 834
 835   result = gnutls_x509_crt_privkey_sign (crt, ca_crt, ca_key, get_dig (ca_crt), 0);
 836   if (result < 0)
 837     error (EXIT_FAILURE, 0, "crt_sign: %s", gnutls_strerror (result));
 838
 839   size = buffer_size;
 840   result = gnutls_x509_crt_export (crt, outcert_format, buffer, &size);
 841   if (result < 0)
 842     error (EXIT_FAILURE, 0, "crt_export: %s", gnutls_strerror (result));
 843
 844   fwrite (buffer, 1, size, outfile);
 845
 846   gnutls_x509_crt_deinit (crt);
 847   gnutls_privkey_deinit (key);
 848   gnutls_privkey_deinit(ca_key);
 849 }
 850
 851 static void
 852 generate_proxy_certificate (common_info_st * cinfo)
 853 {
 854   gnutls_x509_crt_t crt, eecrt;
 855   gnutls_privkey_t key, eekey;
 856   size_t size;
 857   int result;
 858
 859   fprintf (stderr, "Generating a proxy certificate...\n");
 860
 861   eekey = load_ca_private_key (cinfo);
 862   eecrt = load_cert (1, cinfo);
 863
 864   crt = generate_certificate (&key, eecrt, 1, cinfo);
 865
 866   print_certificate_info (crt, stderr, 0);
 867
 868   fprintf (stderr, "\n\nSigning certificate...\n");
 869
 870   result = gnutls_x509_crt_privkey_sign (crt, eecrt, eekey, get_dig (eecrt), 0);
 871   if (result < 0)
 872     error (EXIT_FAILURE, 0, "crt_sign: %s", gnutls_strerror (result));
 873
 874   size = buffer_size;
 875   result = gnutls_x509_crt_export (crt, outcert_format, buffer, &size);
 876   if (result < 0)
 877     error (EXIT_FAILURE, 0, "crt_export: %s", gnutls_strerror (result));
 878
 879   fwrite (buffer, 1, size, outfile);
 880
 881   gnutls_x509_crt_deinit (eecrt);
 882   gnutls_x509_crt_deinit (crt);
 883   gnutls_privkey_deinit (key);
 884   gnutls_privkey_deinit (eekey);
 885 }
 886
 887 static void
 888 generate_signed_crl (common_info_st * cinfo)
 889 {
 890   gnutls_x509_crl_t crl;
 891   int result;
 892   gnutls_privkey_t ca_key;
 893   gnutls_x509_crt_t ca_crt;
 894
 895   fprintf (stderr, "Generating a signed CRL...\n");
 896
 897   ca_key = load_ca_private_key (cinfo);
 898   ca_crt = load_ca_cert (cinfo);
 899   crl = generate_crl (ca_crt, cinfo);
 900
 901   fprintf (stderr, "\n");
 902   result = gnutls_x509_crl_privkey_sign(crl, ca_crt, ca_key, SIGN_HASH, 0);
 903   if (result < 0)
 904     error (EXIT_FAILURE, 0, "crl_privkey_sign: %s", gnutls_strerror (result));
 905
 906   print_crl_info (crl, stderr);
 907
 908   gnutls_privkey_deinit( ca_key);
 909   gnutls_x509_crl_deinit (crl);
 910 }
 911
 912 static void
 913 update_signed_certificate (common_info_st * cinfo)
 914 {
 915   gnutls_x509_crt_t crt;
 916   size_t size;
 917   int result;
 918   gnutls_privkey_t ca_key;
 919   gnutls_x509_crt_t ca_crt;
 920   int days;
 921   time_t tim = time (NULL);
 922
 923   fprintf (stderr, "Generating a signed certificate...\n");
 924
 925   ca_key = load_ca_private_key (cinfo);
 926   ca_crt = load_ca_cert (cinfo);
 927   crt = load_cert (1, cinfo);
 928
 929   fprintf (stderr, "Activation/Expiration time.\n");
 930   gnutls_x509_crt_set_activation_time (crt, tim);
 931
 932   days = get_days ();
 933
 934   result =
 935     gnutls_x509_crt_set_expiration_time (crt, tim + ((time_t) days) * 24 * 60 * 60);
 936   if (result < 0)
 937     error (EXIT_FAILURE, 0, "set_expiration: %s", gnutls_strerror (result));
 938
 939   fprintf (stderr, "\n\nSigning certificate...\n");
 940
 941   result = gnutls_x509_crt_privkey_sign (crt, ca_crt, ca_key, get_dig (ca_crt), 0);
 942   if (result < 0)
 943     error (EXIT_FAILURE, 0, "crt_sign: %s", gnutls_strerror (result));
 944
 945   size = buffer_size;
 946   result = gnutls_x509_crt_export (crt, outcert_format, buffer, &size);
 947   if (result < 0)
 948     error (EXIT_FAILURE, 0, "crt_export: %s", gnutls_strerror (result));
 949
 950   fwrite (buffer, 1, size, outfile);
 951
 952   gnutls_x509_crt_deinit (crt);
 953 }
 954
 955 static void
 956 cmd_parser (int argc, char **argv)
 957 {
 958   int ret, privkey_op = 0;
 959   common_info_st cinfo;
 960
 961   optionProcess( &certtoolOptions, argc, argv);
 962
 963   if (HAVE_OPT(GENERATE_PRIVKEY) || HAVE_OPT(GENERATE_REQUEST) ||
 964       HAVE_OPT(KEY_INFO) || HAVE_OPT(PGP_KEY_INFO))
 965     privkey_op = 1;
 966
 967   if (HAVE_OPT(OUTFILE))
 968     {
 969       outfile = safe_open_rw (OPT_ARG(OUTFILE), privkey_op);
 970       if (outfile == NULL)
 971         error (EXIT_FAILURE, errno, "%s", OPT_ARG(OUTFILE));
 972     }
 973   else
 974     outfile = stdout;
 975
 976   if (HAVE_OPT(INFILE))
 977     {
 978       infile = fopen (OPT_ARG(INFILE), "rb");
 979       if (infile == NULL)
 980         error (EXIT_FAILURE, errno, "%s", OPT_ARG(INFILE));
 981     }
 982   else
 983     infile = stdin;
 984
 985   if (HAVE_OPT(INDER) || HAVE_OPT(INRAW))
 986     incert_format = GNUTLS_X509_FMT_DER;
 987   else
 988     incert_format = GNUTLS_X509_FMT_PEM;
 989
 990   if (HAVE_OPT(OUTDER) || HAVE_OPT(OUTRAW))
 991     outcert_format = GNUTLS_X509_FMT_DER;
 992   else
 993     outcert_format = GNUTLS_X509_FMT_PEM;
 994
 995   if (HAVE_OPT(DSA))
 996     req_key_type = GNUTLS_PK_DSA;
 997   else if (HAVE_OPT(ECC))
 998     req_key_type = GNUTLS_PK_ECC;
 999   else
1000     req_key_type = GNUTLS_PK_RSA;
1001
1002   default_dig = GNUTLS_DIG_UNKNOWN;
1003   if (HAVE_OPT(HASH))
1004     {
1005       if (strcasecmp (OPT_ARG(HASH), "md5") == 0)
1006         {
1007           fprintf (stderr,
1008                    "Warning: MD5 is broken, and should not be used any more for digital signatures.\n");
1009           default_dig = GNUTLS_DIG_MD5;
1010         }
1011       else if (strcasecmp (OPT_ARG(HASH), "sha1") == 0)
1012         default_dig = GNUTLS_DIG_SHA1;
1013       else if (strcasecmp (OPT_ARG(HASH), "sha256") == 0)
1014         default_dig = GNUTLS_DIG_SHA256;
1015       else if (strcasecmp (OPT_ARG(HASH), "sha224") == 0)
1016         default_dig = GNUTLS_DIG_SHA224;
1017       else if (strcasecmp (OPT_ARG(HASH), "sha384") == 0)
1018         default_dig = GNUTLS_DIG_SHA384;
1019       else if (strcasecmp (OPT_ARG(HASH), "sha512") == 0)
1020         default_dig = GNUTLS_DIG_SHA512;
1021       else if (strcasecmp (OPT_ARG(HASH), "rmd160") == 0)
1022         default_dig = GNUTLS_DIG_RMD160;
1023       else
1024         error (EXIT_FAILURE, 0, "invalid hash: %s", OPT_ARG(HASH));
1025     }
1026
1027   batch = 0;
1028   if (HAVE_OPT(TEMPLATE))
1029     {
1030       batch = 1;
1031       template_parse (OPT_ARG(TEMPLATE));
1032     }
1033
1034   gnutls_global_set_log_function (tls_log_func);
1035
1036   if (HAVE_OPT(DEBUG))
1037     {
1038       gnutls_global_set_log_level (OPT_VALUE_DEBUG);
1039       printf ("Setting log level to %d\n", (int)OPT_VALUE_DEBUG);
1040     }
1041
1042   if ((ret = gnutls_global_init ()) < 0)
1043     error (EXIT_FAILURE, 0, "global_init: %s", gnutls_strerror (ret));
1044
1045 #ifdef ENABLE_PKCS11
1046   pkcs11_common();
1047 #endif
1048
1049   memset (&cinfo, 0, sizeof (cinfo));
1050
1051   if (HAVE_OPT(LOAD_PRIVKEY))
1052     cinfo.privkey = OPT_ARG(LOAD_PRIVKEY);
1053
1054   cinfo.v1_cert = HAVE_OPT(V1);
1055   if (HAVE_OPT(NO_CRQ_EXTENSIONS))
1056     cinfo.crq_extensions = 0;
1057   else cinfo.crq_extensions = 1;
1058
1059   if (HAVE_OPT(LOAD_PUBKEY))
1060     cinfo.pubkey = OPT_ARG(LOAD_PUBKEY);
1061
1062   cinfo.pkcs8 = HAVE_OPT(PKCS8);
1063   cinfo.incert_format = incert_format;
1064
1065   if (HAVE_OPT(LOAD_CERTIFICATE))
1066     cinfo.cert = OPT_ARG(LOAD_CERTIFICATE);
1067
1068   if (HAVE_OPT(LOAD_REQUEST))
1069     cinfo.request = OPT_ARG(LOAD_REQUEST);
1070
1071   if (HAVE_OPT(LOAD_CA_CERTIFICATE))
1072     cinfo.ca = OPT_ARG(LOAD_CA_CERTIFICATE);
1073
1074   if (HAVE_OPT(LOAD_CA_PRIVKEY))
1075     cinfo.ca_privkey = OPT_ARG(LOAD_CA_PRIVKEY);
1076
1077   if (HAVE_OPT(BITS))
1078     cinfo.bits = OPT_VALUE_BITS;
1079
1080   if (HAVE_OPT(SEC_PARAM))
1081     cinfo.sec_param = OPT_ARG(SEC_PARAM);
1082
1083   if (HAVE_OPT(PKCS_CIPHER))
1084     cinfo.pkcs_cipher = OPT_ARG(PKCS_CIPHER);
1085
1086   if (HAVE_OPT(PASSWORD))
1087     cinfo.password = OPT_ARG(PASSWORD);
1088
1089   if (HAVE_OPT(GENERATE_SELF_SIGNED))
1090     generate_self_signed (&cinfo);
1091   else if (HAVE_OPT(GENERATE_CERTIFICATE))
1092     generate_signed_certificate (&cinfo);
1093   else if (HAVE_OPT(GENERATE_PROXY))
1094     generate_proxy_certificate (&cinfo);
1095   else if (HAVE_OPT(GENERATE_CRL))
1096     generate_signed_crl (&cinfo);
1097   else if (HAVE_OPT(UPDATE_CERTIFICATE))
1098     update_signed_certificate (&cinfo);
1099   else if (HAVE_OPT(GENERATE_PRIVKEY))
1100     generate_private_key (&cinfo);
1101   else if (HAVE_OPT(GENERATE_REQUEST))
1102     generate_request (&cinfo);
1103   else if (HAVE_OPT(VERIFY_CHAIN))
1104     verify_chain ();
1105   else if (HAVE_OPT(VERIFY))
1106     verify_certificate (&cinfo);
1107   else if (HAVE_OPT(VERIFY_CRL))
1108     verify_crl (&cinfo);
1109   else if (HAVE_OPT(CERTIFICATE_INFO))
1110     certificate_info (0, &cinfo);
1111   else if (HAVE_OPT(DH_INFO))
1112     dh_info (&cinfo);
1113   else if (HAVE_OPT(CERTIFICATE_PUBKEY))
1114     certificate_info (1, &cinfo);
1115   else if (HAVE_OPT(KEY_INFO))
1116     privkey_info (&cinfo);
1117   else if (HAVE_OPT(PUBKEY_INFO))
1118     pubkey_info (NULL, &cinfo);
1119   else if (HAVE_OPT(TO_P12))
1120     generate_pkcs12 (&cinfo);
1121   else if (HAVE_OPT(P12_INFO))
1122     pkcs12_info (&cinfo);
1123   else if (HAVE_OPT(GENERATE_DH_PARAMS))
1124     generate_prime (1, &cinfo);
1125   else if (HAVE_OPT(GET_DH_PARAMS))
1126     generate_prime (0, &cinfo);
1127   else if (HAVE_OPT(CRL_INFO))
1128     crl_info ();
1129   else if (HAVE_OPT(P7_INFO))
1130     pkcs7_info ();
1131   else if (HAVE_OPT(SMIME_TO_P7))
1132     smime_to_pkcs7 ();
1133   else if (HAVE_OPT(TO_P8))
1134     generate_pkcs8 (&cinfo);
1135 #ifdef ENABLE_OPENPGP
1136   else if (HAVE_OPT(PGP_CERTIFICATE_INFO))
1137     pgp_certificate_info ();
1138   else if (HAVE_OPT(PGP_KEY_INFO))
1139     pgp_privkey_info ();
1140   else if (HAVE_OPT(PGP_RING_INFO))
1141     pgp_ring_info ();
1142 #endif
1143   else if (HAVE_OPT(CRQ_INFO))
1144     crq_info ();
1145   else
1146     USAGE(1);
1147
1148   fclose (outfile);
1149
1150 #ifdef ENABLE_PKCS11
1151   gnutls_pkcs11_deinit ();
1152 #endif
1153   gnutls_global_deinit ();
1154 }
1155
1156 #define MAX_CRTS 500
1157 void
1158 certificate_info (int pubkey, common_info_st * cinfo)
1159 {
1160   gnutls_x509_crt_t crt[MAX_CRTS];
1161   size_t size;
1162   int ret, i, count;
1163   gnutls_datum_t pem;
1164   unsigned int crt_num;
1165
1166   pem.data = (void*)fread_file (infile, &size);
1167   pem.size = size;
1168
1169   crt_num = MAX_CRTS;
1170   ret =
1171     gnutls_x509_crt_list_import (crt, &crt_num, &pem, incert_format,
1172                                  GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED);
1173   if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER)
1174     {
1175       error (0, 0, "too many certificates (%d); "
1176              "will only read the first %d", crt_num, MAX_CRTS);
1177       crt_num = MAX_CRTS;
1178       ret = gnutls_x509_crt_list_import (crt, &crt_num, &pem,
1179                                          incert_format, 0);
1180     }
1181   if (ret < 0)
1182     error (EXIT_FAILURE, 0, "import error: %s", gnutls_strerror (ret));
1183
1184   free (pem.data);
1185
1186   count = ret;
1187
1188   if (count > 1 && outcert_format == GNUTLS_X509_FMT_DER)
1189     {
1190       error (0, 0, "cannot output multiple certificates in DER format; "
1191              "using PEM instead");
1192       outcert_format = GNUTLS_X509_FMT_PEM;
1193     }
1194
1195   for (i = 0; i < count; i++)
1196     {
1197       if (i > 0)
1198         fprintf (outfile, "\n");
1199
1200       if (outcert_format == GNUTLS_X509_FMT_PEM)
1201         print_certificate_info (crt[i], outfile, 1);
1202
1203       if (pubkey)
1204         pubkey_info (crt[i], cinfo);
1205       else
1206         {
1207           size = buffer_size;
1208           ret = gnutls_x509_crt_export (crt[i], outcert_format, buffer,
1209                                         &size);
1210           if (ret < 0)
1211             error (EXIT_FAILURE, 0, "export error: %s", gnutls_strerror (ret));
1212
1213           fwrite (buffer, 1, size, outfile);
1214         }
1215
1216       gnutls_x509_crt_deinit (crt[i]);
1217     }
1218 }
1219
1220 #ifdef ENABLE_OPENPGP
1221
1222 void
1223 pgp_certificate_info (void)
1224 {
1225   gnutls_openpgp_crt_t crt;
1226   size_t size;
1227   int ret;
1228   gnutls_datum_t pem, out_data;
1229   unsigned int verify_status;
1230
1231   pem.data = (void*)fread_file (infile, &size);
1232   pem.size = size;
1233
1234   ret = gnutls_openpgp_crt_init (&crt);
1235   if (ret < 0)
1236     error (EXIT_FAILURE, 0, "openpgp_crt_init: %s", gnutls_strerror (ret));
1237
1238   ret = gnutls_openpgp_crt_import (crt, &pem, incert_format);
1239
1240   if (ret < 0)
1241     error (EXIT_FAILURE, 0, "import error: %s", gnutls_strerror (ret));
1242
1243   free (pem.data);
1244
1245   if (outcert_format == GNUTLS_OPENPGP_FMT_BASE64)
1246     {
1247       ret = gnutls_openpgp_crt_print (crt, 0, &out_data);
1248
1249       if (ret == 0)
1250         {
1251           fprintf (outfile, "%s\n", out_data.data);
1252           gnutls_free (out_data.data);
1253         }
1254     }
1255
1256
1257   ret = gnutls_openpgp_crt_verify_self (crt, 0, &verify_status);
1258   if (ret < 0)
1259     {
1260       error (EXIT_FAILURE, 0, "verify signature error: %s",
1261              gnutls_strerror (ret));
1262     }
1263
1264   if (verify_status & GNUTLS_CERT_INVALID)
1265     {
1266       fprintf (outfile, "Self Signature verification: failed\n\n");
1267     }
1268   else
1269     {
1270       fprintf (outfile, "Self Signature verification: ok (%x)\n\n",
1271                verify_status);
1272     }
1273
1274   size = buffer_size;
1275   ret = gnutls_openpgp_crt_export (crt, outcert_format, buffer, &size);
1276   if (ret < 0)
1277     {
1278       error (EXIT_FAILURE, 0, "export error: %s", gnutls_strerror (ret));
1279       fwrite (buffer, 1, size, outfile);
1280     }
1281
1282   fprintf (outfile, "%s\n", buffer);
1283   gnutls_openpgp_crt_deinit (crt);
1284 }
1285
1286 void
1287 pgp_privkey_info (void)
1288 {
1289   gnutls_openpgp_privkey_t key;
1290   unsigned char keyid[GNUTLS_OPENPGP_KEYID_SIZE];
1291   size_t size;
1292   int ret, i, subkeys, bits = 0;
1293   gnutls_datum_t pem;
1294   const char *cprint;
1295
1296   size = fread (buffer, 1, buffer_size - 1, infile);
1297   buffer[size] = 0;
1298
1299   gnutls_openpgp_privkey_init (&key);
1300
1301   pem.data = buffer;
1302   pem.size = size;
1303
1304   ret = gnutls_openpgp_privkey_import (key, &pem, incert_format,
1305                                        NULL, 0);
1306
1307   if (ret < 0)
1308     error (EXIT_FAILURE, 0, "import error: %s", gnutls_strerror (ret));
1309
1310   /* Public key algorithm
1311    */
1312   subkeys = gnutls_openpgp_privkey_get_subkey_count (key);
1313   if (subkeys < 0)
1314     error (EXIT_FAILURE, 0, "privkey_get_subkey_count: %s",
1315            gnutls_strerror (subkeys));
1316
1317   for (i = -1; i < subkeys; i++)
1318     {
1319
1320       if (i != -1)
1321         fprintf (outfile, "Subkey[%d]:\n", i);
1322
1323       fprintf (outfile, "Public Key Info:\n");
1324
1325       if (i == -1)
1326         ret = gnutls_openpgp_privkey_get_pk_algorithm (key, NULL);
1327       else
1328         ret = gnutls_openpgp_privkey_get_subkey_pk_algorithm (key, i, NULL);
1329
1330       fprintf (outfile, "\tPublic Key Algorithm: ");
1331       cprint = gnutls_pk_algorithm_get_name (ret);
1332       fprintf (outfile, "%s\n", cprint ? cprint : "Unknown");
1333       fprintf (outfile, "\tKey Security Level: %s\n",
1334                gnutls_sec_param_get_name (gnutls_openpgp_privkey_sec_param
1335                                           (key)));
1336
1337       /* Print the raw public and private keys
1338        */
1339
1340       if (ret == GNUTLS_PK_RSA)
1341         {
1342           gnutls_datum_t m, e, d, p, q, u;
1343
1344           if (i == -1)
1345             ret =
1346               gnutls_openpgp_privkey_export_rsa_raw (key, &m, &e, &d, &p,
1347                                                      &q, &u);
1348           else
1349             ret =
1350               gnutls_openpgp_privkey_export_subkey_rsa_raw (key, i, &m,
1351                                                             &e, &d, &p,
1352                                                             &q, &u);
1353           if (ret < 0)
1354             fprintf (stderr, "Error in key RSA data export: %s\n",
1355                      gnutls_strerror (ret));
1356           else
1357             print_rsa_pkey (&m, &e, &d, &p, &q, &u, NULL, NULL);
1358
1359           bits = m.size * 8;
1360         }
1361       else if (ret == GNUTLS_PK_DSA)
1362         {
1363           gnutls_datum_t p, q, g, y, x;
1364
1365           if (i == -1)
1366             ret =
1367               gnutls_openpgp_privkey_export_dsa_raw (key, &p, &q, &g, &y, &x);
1368           else
1369             ret =
1370               gnutls_openpgp_privkey_export_subkey_dsa_raw (key, i, &p,
1371                                                             &q, &g, &y, &x);
1372           if (ret < 0)
1373             fprintf (stderr, "Error in key DSA data export: %s\n",
1374                      gnutls_strerror (ret));
1375           else
1376             print_dsa_pkey (&x, &y, &p, &q, &g);
1377
1378           bits = y.size * 8;
1379         }
1380
1381       fprintf (outfile, "\n");
1382
1383       size = buffer_size;
1384       if (i == -1)
1385         ret = gnutls_openpgp_privkey_get_key_id (key, keyid);
1386       else
1387         ret = gnutls_openpgp_privkey_get_subkey_id (key, i, keyid);
1388
1389       if (ret < 0)
1390         {
1391           fprintf (stderr, "Error in key id calculation: %s\n",
1392                    gnutls_strerror (ret));
1393         }
1394       else
1395         {
1396           fprintf (outfile, "Public key ID: %s\n", raw_to_string (keyid, 8));
1397         }
1398
1399       size = buffer_size;
1400       if (i == -1)
1401         ret = gnutls_openpgp_privkey_get_fingerprint (key, buffer, &size);
1402       else
1403         ret = gnutls_openpgp_privkey_get_subkey_fingerprint (key, i, buffer, &size);
1404
1405       if (ret < 0)
1406         {
1407           fprintf (stderr, "Error in fingerprint calculation: %s\n",
1408                    gnutls_strerror (ret));
1409         }
1410       else
1411         {
1412           gnutls_datum_t art;
1413
1414           fprintf (outfile, "Fingerprint: %s\n", raw_to_string (buffer, size));
1415
1416           ret = gnutls_random_art(GNUTLS_RANDOM_ART_OPENSSH, cprint, bits, buffer, size, &art);
1417           if (ret >= 0)
1418             {
1419               fprintf (outfile, "Fingerprint's random art:\n%s\n\n", art.data);
1420               gnutls_free(art.data);
1421             }
1422         }
1423     }
1424
1425   size = buffer_size;
1426   ret = gnutls_openpgp_privkey_export (key, GNUTLS_OPENPGP_FMT_BASE64,
1427                                        NULL, 0, buffer, &size);
1428   if (ret < 0)
1429     error (EXIT_FAILURE, 0, "export error: %s", gnutls_strerror (ret));
1430
1431   fprintf (outfile, "\n%s\n", buffer);
1432
1433   gnutls_openpgp_privkey_deinit (key);
1434 }
1435
1436 void
1437 pgp_ring_info (void)
1438 {
1439   gnutls_openpgp_keyring_t ring;
1440   gnutls_openpgp_crt_t crt;
1441   size_t size;
1442   int ret, i, count;
1443   gnutls_datum_t pem;
1444
1445   pem.data = (void*)fread_file (infile, &size);
1446   pem.size = size;
1447
1448   ret = gnutls_openpgp_keyring_init (&ring);
1449   if (ret < 0)
1450     error (EXIT_FAILURE, 0, "openpgp_keyring_init: %s",
1451            gnutls_strerror (ret));
1452
1453   ret = gnutls_openpgp_keyring_import (ring, &pem, incert_format);
1454
1455   if (ret < 0)
1456     error (EXIT_FAILURE, 0, "import error: %s", gnutls_strerror (ret));
1457
1458   free (pem.data);
1459
1460   count = gnutls_openpgp_keyring_get_crt_count (ring);
1461   if (count >= 0)
1462     fprintf (outfile, "Keyring contains %d OpenPGP certificates\n\n", count);
1463   else
1464     error (EXIT_FAILURE, 0, "keyring error: %s", gnutls_strerror (count));
1465
1466   for (i = 0; i < count; i++)
1467     {
1468       ret = gnutls_openpgp_keyring_get_crt (ring, i, &crt);
1469       if (ret < 0)
1470         error (EXIT_FAILURE, 0, "export error: %s", gnutls_strerror (ret));
1471
1472       size = buffer_size;
1473       ret = gnutls_openpgp_crt_export (crt, outcert_format,
1474                                        buffer, &size);
1475       if (ret < 0)
1476         error (EXIT_FAILURE, 0, "export error: %s", gnutls_strerror (ret));
1477
1478       fwrite (buffer, 1, size, outfile);
1479       fprintf (outfile, "\n\n");
1480
1481       gnutls_openpgp_crt_deinit (crt);
1482
1483
1484     }
1485
1486   gnutls_openpgp_keyring_deinit (ring);
1487 }
1488
1489
1490 #endif
1491
1492 static void
1493 print_hex_datum (gnutls_datum_t * dat)
1494 {
1495   unsigned int j;
1496 #define SPACE "\t"
1497   fprintf (outfile, "\n" SPACE);
1498   for (j = 0; j < dat->size; j++)
1499     {
1500       fprintf (outfile, "%.2x:", (unsigned char) dat->data[j]);
1501       if ((j + 1) % 15 == 0)
1502         fprintf (outfile, "\n" SPACE);
1503     }
1504   fprintf (outfile, "\n");
1505 }
1506
1507
1508 static void
1509 print_certificate_info (gnutls_x509_crt_t crt, FILE * out, unsigned int all)
1510 {
1511   gnutls_datum_t data;
1512   int ret;
1513
1514   if (all)
1515     ret = gnutls_x509_crt_print (crt, GNUTLS_CRT_PRINT_FULL, &data);
1516   else
1517     ret = gnutls_x509_crt_print (crt, GNUTLS_CRT_PRINT_UNSIGNED_FULL, &data);
1518   if (ret == 0)
1519     {
1520       fprintf (out, "%s\n", data.data);
1521       gnutls_free (data.data);
1522     }
1523
1524   if (out == stderr && batch == 0)      /* interactive */
1525     if (read_yesno ("Is the above information ok? (y/N): ") == 0)
1526       {
1527         exit (1);
1528       }
1529 }
1530
1531 static void
1532 print_crl_info (gnutls_x509_crl_t crl, FILE * out)
1533 {
1534   gnutls_datum_t data;
1535   int ret;
1536   size_t size;
1537
1538   ret = gnutls_x509_crl_print (crl, GNUTLS_CRT_PRINT_FULL, &data);
1539   if (ret < 0)
1540     error (EXIT_FAILURE, 0, "crl_print: %s", gnutls_strerror (ret));
1541
1542   fprintf (out, "%s\n", data.data);
1543
1544   gnutls_free (data.data);
1545
1546   size = buffer_size;
1547   ret = gnutls_x509_crl_export (crl, GNUTLS_X509_FMT_PEM, buffer, &size);
1548   if (ret < 0)
1549     error (EXIT_FAILURE, 0, "crl_export: %s", gnutls_strerror (ret));
1550
1551   fwrite (buffer, 1, size, outfile);
1552 }
1553
1554 void
1555 crl_info (void)
1556 {
1557   gnutls_x509_crl_t crl;
1558   int ret;
1559   size_t size;
1560   gnutls_datum_t pem;
1561
1562   ret = gnutls_x509_crl_init (&crl);
1563   if (ret < 0)
1564     error (EXIT_FAILURE, 0, "crl_init: %s", gnutls_strerror (ret));
1565
1566   pem.data = (void*)fread_file (infile, &size);
1567   pem.size = size;
1568
1569   if (!pem.data)
1570     error (EXIT_FAILURE, errno, "%s", infile ? "file" :
1571            "standard input");
1572
1573   ret = gnutls_x509_crl_import (crl, &pem, incert_format);
1574
1575   free (pem.data);
1576   if (ret < 0)
1577     error (EXIT_FAILURE, 0, "import error: %s", gnutls_strerror (ret));
1578
1579   print_crl_info (crl, outfile);
1580
1581   gnutls_x509_crl_deinit (crl);
1582 }
1583
1584 static void
1585 print_crq_info (gnutls_x509_crq_t crq, FILE * out)
1586 {
1587   gnutls_datum_t data;
1588   int ret;
1589   size_t size;
1590
1591   if (outcert_format == GNUTLS_X509_FMT_PEM)
1592     {
1593       ret = gnutls_x509_crq_print (crq, GNUTLS_CRT_PRINT_FULL, &data);
1594       if (ret < 0)
1595         error (EXIT_FAILURE, 0, "crq_print: %s", gnutls_strerror (ret));
1596
1597       fprintf (out, "%s\n", data.data);
1598
1599       gnutls_free (data.data);
1600     }
1601
1602   ret = gnutls_x509_crq_verify(crq, 0);
1603   if (ret < 0)
1604     {
1605       fprintf(out, "Self signature: FAILED\n\n");
1606     }
1607   else
1608     {
1609       fprintf(out, "Self signature: verified\n\n");
1610     }
1611
1612   size = buffer_size;
1613   ret = gnutls_x509_crq_export (crq, outcert_format, buffer, &size);
1614   if (ret < 0)
1615     error (EXIT_FAILURE, 0, "crq_export: %s", gnutls_strerror (ret));
1616
1617   fwrite (buffer, 1, size, outfile);
1618 }
1619
1620 void
1621 crq_info (void)
1622 {
1623   gnutls_x509_crq_t crq;
1624   int ret;
1625   size_t size;
1626   gnutls_datum_t pem;
1627
1628   ret = gnutls_x509_crq_init (&crq);
1629   if (ret < 0)
1630     error (EXIT_FAILURE, 0, "crq_init: %s", gnutls_strerror (ret));
1631
1632   pem.data = (void*)fread_file (infile, &size);
1633   pem.size = size;
1634
1635   if (!pem.data)
1636     error (EXIT_FAILURE, errno, "%s", infile ? "file" :
1637            "standard input");
1638
1639   ret = gnutls_x509_crq_import (crq, &pem, incert_format);
1640
1641   free (pem.data);
1642   if (ret < 0)
1643     error (EXIT_FAILURE, 0, "import error: %s", gnutls_strerror (ret));
1644
1645   print_crq_info (crq, outfile);
1646
1647   gnutls_x509_crq_deinit (crq);
1648 }
1649
1650 static void privkey_info_int (common_info_st* cinfo, gnutls_x509_privkey_t key)
1651 {
1652 int ret, key_type, bits = 0;
1653 size_t size;
1654 const char *cprint;
1655
1656   /* Public key algorithm
1657    */
1658   fprintf (outfile, "Public Key Info:\n");
1659   ret = gnutls_x509_privkey_get_pk_algorithm (key);
1660   fprintf (outfile, "\tPublic Key Algorithm: ");
1661
1662   key_type = ret;
1663
1664   cprint = gnutls_pk_algorithm_get_name (key_type);
1665   fprintf (outfile, "%s\n", cprint ? cprint : "Unknown");
1666   fprintf (outfile, "\tKey Security Level: %s\n\n",
1667            gnutls_sec_param_get_name (gnutls_x509_privkey_sec_param (key)));
1668
1669   /* Print the raw public and private keys
1670    */
1671   if (key_type == GNUTLS_PK_RSA)
1672     {
1673       gnutls_datum_t m, e, d, p, q, u, exp1, exp2;
1674
1675       ret =
1676         gnutls_x509_privkey_export_rsa_raw2 (key, &m, &e, &d, &p, &q, &u,
1677                                              &exp1, &exp2);
1678       if (ret < 0)
1679         fprintf (stderr, "Error in key RSA data export: %s\n",
1680                  gnutls_strerror (ret));
1681       else
1682         {
1683           print_rsa_pkey (&m, &e, &d, &p, &q, &u, &exp1, &exp2);
1684           bits = m.size * 8;
1685
1686           gnutls_free (m.data);
1687           gnutls_free (e.data);
1688           gnutls_free (d.data);
1689           gnutls_free (p.data);
1690           gnutls_free (q.data);
1691           gnutls_free (u.data);
1692           gnutls_free (exp1.data);
1693           gnutls_free (exp2.data);
1694         }
1695     }
1696   else if (key_type == GNUTLS_PK_DSA)
1697     {
1698       gnutls_datum_t p, q, g, y, x;
1699
1700       ret = gnutls_x509_privkey_export_dsa_raw (key, &p, &q, &g, &y, &x);
1701       if (ret < 0)
1702         fprintf (stderr, "Error in key DSA data export: %s\n",
1703                  gnutls_strerror (ret));
1704       else
1705         {
1706           print_dsa_pkey (&x, &y, &p, &q, &g);
1707           bits = y.size * 8;
1708
1709           gnutls_free (x.data);
1710           gnutls_free (y.data);
1711           gnutls_free (p.data);
1712           gnutls_free (q.data);
1713           gnutls_free (g.data);
1714         }
1715     }
1716   else if (key_type == GNUTLS_PK_EC)
1717     {
1718       gnutls_datum_t y, x, k;
1719       gnutls_ecc_curve_t curve;
1720
1721       ret = gnutls_x509_privkey_export_ecc_raw (key, &curve, &x, &y, &k);
1722       if (ret < 0)
1723         fprintf (stderr, "Error in key ECC data export: %s\n",
1724                  gnutls_strerror (ret));
1725       else
1726         {
1727           print_ecc_pkey (curve, &k, &x, &y);
1728           bits = gnutls_ecc_curve_get_size(curve) * 8;
1729
1730           gnutls_free (x.data);
1731           gnutls_free (y.data);
1732           gnutls_free (k.data);
1733         }
1734     }
1735
1736   fprintf (outfile, "\n");
1737
1738   size = buffer_size;
1739   if ((ret = gnutls_x509_privkey_get_key_id (key, 0, buffer, &size)) < 0)
1740     {
1741       fprintf (stderr, "Error in key id calculation: %s\n",
1742                gnutls_strerror (ret));
1743     }
1744   else
1745     {
1746       gnutls_datum_t art;
1747
1748       fprintf (outfile, "Public Key ID: %s\n", raw_to_string (buffer, size));
1749
1750       ret = gnutls_random_art(GNUTLS_RANDOM_ART_OPENSSH, cprint, bits, buffer, size, &art);
1751       if (ret >= 0)
1752         {
1753           fprintf (outfile, "Public key's random art:\n%s\n", art.data);
1754           gnutls_free(art.data);
1755         }
1756     }
1757   fprintf (outfile, "\n");
1758
1759 }
1760
1761 void
1762 privkey_info (common_info_st* cinfo)
1763 {
1764   gnutls_x509_privkey_t key;
1765   size_t size;
1766   int ret;
1767   gnutls_datum_t pem;
1768   const char *pass;
1769
1770   size = fread (buffer, 1, buffer_size - 1, infile);
1771   buffer[size] = 0;
1772
1773   gnutls_x509_privkey_init (&key);
1774
1775   pem.data = buffer;
1776   pem.size = size;
1777
1778   ret = 0;
1779   if (!cinfo->pkcs8)
1780     ret = gnutls_x509_privkey_import (key, &pem, incert_format);
1781
1782   /* If we failed to import the certificate previously try PKCS #8 */
1783   if (cinfo->pkcs8 || ret == GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR)
1784     {
1785       if (cinfo->password)
1786         pass = cinfo->password;
1787       else
1788         pass = get_pass ();
1789       ret = gnutls_x509_privkey_import_pkcs8 (key, &pem,
1790                                               incert_format, pass, 0);
1791     }
1792   if (ret < 0)
1793     error (EXIT_FAILURE, 0, "import error: %s", gnutls_strerror (ret));
1794
1795   if (outcert_format == GNUTLS_X509_FMT_PEM)
1796     privkey_info_int (cinfo, key);
1797
1798   ret = gnutls_x509_privkey_verify_params (key);
1799   if (ret < 0)
1800     fprintf (outfile, "\n** Private key parameters validation failed **\n\n");
1801
1802   size = buffer_size;
1803   ret = gnutls_x509_privkey_export (key, outcert_format, buffer, &size);
1804   if (ret < 0)
1805     error (EXIT_FAILURE, 0, "export error: %s", gnutls_strerror (ret));
1806
1807   fwrite (buffer, 1, size, outfile);
1808
1809   gnutls_x509_privkey_deinit (key);
1810 }
1811
1812
1813 /* Generate a PKCS #10 certificate request.
1814  */
1815 void
1816 generate_request (common_info_st * cinfo)
1817 {
1818   gnutls_x509_crq_t crq;
1819   gnutls_x509_privkey_t xkey;
1820   gnutls_pubkey_t pubkey;
1821   gnutls_privkey_t pkey;
1822   int ret, ca_status, path_len;
1823   const char *pass;
1824   unsigned int usage = 0;
1825
1826   fprintf (stderr, "Generating a PKCS #10 certificate request...\n");
1827
1828   ret = gnutls_x509_crq_init (&crq);
1829   if (ret < 0)
1830     error (EXIT_FAILURE, 0, "crq_init: %s", gnutls_strerror (ret));
1831
1832
1833   /* Load the private key.
1834    */
1835   pkey = load_private_key (0, cinfo);
1836   if (!pkey)
1837     {
1838       ret = gnutls_privkey_init (&pkey);
1839       if (ret < 0)
1840         error (EXIT_FAILURE, 0, "privkey_init: %s", gnutls_strerror (ret));
1841
1842       xkey = generate_private_key_int (cinfo);
1843
1844       print_private_key (cinfo, xkey);
1845
1846       ret = gnutls_privkey_import_x509(pkey, xkey, GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE);
1847       if (ret < 0)
1848         error (EXIT_FAILURE, 0, "privkey_import_x509: %s", gnutls_strerror (ret));
1849     }
1850
1851   pubkey = load_public_key_or_import (1, pkey, cinfo);
1852
1853   /* Set the DN.
1854    */
1855   get_country_crq_set (crq);
1856   get_organization_crq_set (crq);
1857   get_unit_crq_set (crq);
1858   get_locality_crq_set (crq);
1859   get_state_crq_set (crq);
1860   get_cn_crq_set (crq);
1861   get_dc_set (TYPE_CRQ, crq);
1862   get_uid_crq_set (crq);
1863   get_oid_crq_set (crq);
1864
1865   get_dns_name_set (TYPE_CRQ, crq);
1866   get_uri_set (TYPE_CRQ, crq);
1867   get_ip_addr_set (TYPE_CRQ, crq);
1868   get_email_set (TYPE_CRQ, crq);
1869
1870   pass = get_challenge_pass ();
1871
1872   if (pass != NULL && pass[0] != 0)
1873     {
1874       ret = gnutls_x509_crq_set_challenge_password (crq, pass);
1875       if (ret < 0)
1876         error (EXIT_FAILURE, 0, "set_pass: %s", gnutls_strerror (ret));
1877     }
1878
1879   if (cinfo->crq_extensions != 0)
1880     {
1881       ca_status = get_ca_status ();
1882       if (ca_status)
1883         path_len = get_path_len ();
1884       else
1885         path_len = -1;
1886
1887       ret = gnutls_x509_crq_set_basic_constraints (crq, ca_status, path_len);
1888       if (ret < 0)
1889         error (EXIT_FAILURE, 0, "set_basic_constraints: %s",
1890                gnutls_strerror (ret));
1891
1892       ret = get_sign_status (1);
1893       if (ret)
1894         usage |= GNUTLS_KEY_DIGITAL_SIGNATURE;
1895
1896       ret = get_encrypt_status (1);
1897       if (ret)
1898         usage |= GNUTLS_KEY_KEY_ENCIPHERMENT;
1899       else
1900         usage |= GNUTLS_KEY_DIGITAL_SIGNATURE;
1901
1902       if (ca_status)
1903         {
1904           ret = get_cert_sign_status ();
1905           if (ret)
1906             usage |= GNUTLS_KEY_KEY_CERT_SIGN;
1907
1908           ret = get_crl_sign_status ();
1909           if (ret)
1910             usage |= GNUTLS_KEY_CRL_SIGN;
1911
1912           ret = get_code_sign_status ();
1913           if (ret)
1914             {
1915               ret = gnutls_x509_crq_set_key_purpose_oid
1916                 (crq, GNUTLS_KP_CODE_SIGNING, 0);
1917               if (ret < 0)
1918                 error (EXIT_FAILURE, 0, "key_kp: %s", gnutls_strerror (ret));
1919             }
1920
1921           ret = get_ocsp_sign_status ();
1922           if (ret)
1923             {
1924               ret = gnutls_x509_crq_set_key_purpose_oid
1925                 (crq, GNUTLS_KP_OCSP_SIGNING, 0);
1926               if (ret < 0)
1927                 error (EXIT_FAILURE, 0, "key_kp: %s", gnutls_strerror (ret));
1928             }
1929
1930           ret = get_time_stamp_status ();
1931           if (ret)
1932             {
1933               ret = gnutls_x509_crq_set_key_purpose_oid
1934                 (crq, GNUTLS_KP_TIME_STAMPING, 0);
1935               if (ret < 0)
1936                 error (EXIT_FAILURE, 0, "key_kp: %s", gnutls_strerror (ret));
1937             }
1938
1939           ret = get_ipsec_ike_status ();
1940           if (ret)
1941             {
1942               ret = gnutls_x509_crq_set_key_purpose_oid
1943                 (crq, GNUTLS_KP_IPSEC_IKE, 0);
1944               if (ret < 0)
1945                 error (EXIT_FAILURE, 0, "key_kp: %s", gnutls_strerror (ret));
1946             }
1947         }
1948
1949       ret = gnutls_x509_crq_set_key_usage (crq, usage);
1950       if (ret < 0)
1951         error (EXIT_FAILURE, 0, "key_usage: %s", gnutls_strerror (ret));
1952
1953       ret = get_tls_client_status ();
1954       if (ret != 0)
1955         {
1956           ret = gnutls_x509_crq_set_key_purpose_oid
1957             (crq, GNUTLS_KP_TLS_WWW_CLIENT, 0);
1958           if (ret < 0)
1959             error (EXIT_FAILURE, 0, "key_kp: %s", gnutls_strerror (ret));
1960         }
1961
1962       ret = get_tls_server_status ();
1963       if (ret != 0)
1964         {
1965           ret = gnutls_x509_crq_set_key_purpose_oid
1966             (crq, GNUTLS_KP_TLS_WWW_SERVER, 0);
1967           if (ret < 0)
1968             error (EXIT_FAILURE, 0, "key_kp: %s", gnutls_strerror (ret));
1969         }
1970     }
1971
1972   ret = gnutls_x509_crq_set_pubkey (crq, pubkey);
1973   if (ret < 0)
1974     error (EXIT_FAILURE, 0, "set_key: %s", gnutls_strerror (ret));
1975
1976   ret = gnutls_x509_crq_privkey_sign (crq, pkey, SIGN_HASH, 0);
1977   if (ret < 0)
1978     error (EXIT_FAILURE, 0, "sign: %s", gnutls_strerror (ret));
1979
1980   print_crq_info (crq, outfile);
1981
1982   gnutls_x509_crq_deinit (crq);
1983   gnutls_privkey_deinit( pkey);
1984   gnutls_pubkey_deinit( pubkey);
1985
1986 }
1987
1988 static void print_verification_res (FILE* outfile, unsigned int output);
1989
1990 static int detailed_verification(gnutls_x509_crt_t cert,
1991     gnutls_x509_crt_t issuer, gnutls_x509_crl_t crl,
1992     unsigned int verification_output)
1993 {
1994   char name[512];
1995   char tmp[255];
1996   char issuer_name[512];
1997   size_t name_size;
1998   size_t issuer_name_size;
1999   int ret;
2000
2001   issuer_name_size = sizeof (issuer_name);
2002   ret =
2003     gnutls_x509_crt_get_issuer_dn (cert, issuer_name, &issuer_name_size);
2004   if (ret < 0)
2005     error (EXIT_FAILURE, 0, "gnutls_x509_crt_get_issuer_dn: %s", gnutls_strerror (ret));
2006
2007   name_size = sizeof (name);
2008   ret =
2009     gnutls_x509_crt_get_dn (cert, name, &name_size);
2010   if (ret < 0)
2011     error (EXIT_FAILURE, 0, "gnutls_x509_crt_get_dn: %s", gnutls_strerror (ret));
2012
2013   fprintf (outfile, "\tSubject: %s\n", name);
2014   fprintf (outfile, "\tIssuer: %s\n", issuer_name);
2015
2016   if (issuer != NULL)
2017     {
2018       issuer_name_size = sizeof (issuer_name);
2019       ret =
2020         gnutls_x509_crt_get_dn (issuer, issuer_name, &issuer_name_size);
2021       if (ret < 0)
2022         error (EXIT_FAILURE, 0, "gnutls_x509_crt_get_issuer_dn: %s", gnutls_strerror (ret));
2023
2024       fprintf (outfile, "\tChecked against: %s\n", issuer_name);
2025     }
2026
2027   if (crl != NULL)
2028     {
2029       gnutls_datum_t data;
2030
2031       issuer_name_size = sizeof (issuer_name);
2032       ret =
2033         gnutls_x509_crl_get_issuer_dn (crl, issuer_name, &issuer_name_size);
2034       if (ret < 0)
2035         error (EXIT_FAILURE, 0, "gnutls_x509_crl_get_issuer_dn: %s", gnutls_strerror (ret));
2036
2037       name_size = sizeof(tmp);
2038       ret = gnutls_x509_crl_get_number(crl, tmp, &name_size, NULL);
2039       if (ret < 0)
2040         strcpy(name, "unnumbered");
2041       else
2042         {
2043           data.data = (void*)tmp;
2044           data.size = name_size;
2045
2046           name_size = sizeof(name);
2047           ret = gnutls_hex_encode(&data, name, &name_size);
2048           if (ret < 0)
2049             error (EXIT_FAILURE, 0, "gnutls_hex_encode: %s", gnutls_strerror (ret));
2050         }
2051       fprintf (outfile, "\tChecked against CRL[%s] of: %s\n", name, issuer_name);
2052     }
2053
2054   fprintf (outfile, "\tOutput: ");
2055   print_verification_res(outfile, verification_output);
2056
2057   fputs(".\n\n", outfile);
2058
2059   return 0;
2060 }
2061
2062 /* Will verify a certificate chain. If no CA certificates
2063  * are provided, then the last certificate in the certificate
2064  * chain is used as a CA.
2065  */
2066 static int
2067 _verify_x509_mem (const void *cert, int cert_size, const void* ca, int ca_size)
2068 {
2069   int ret;
2070   gnutls_datum_t tmp;
2071   gnutls_x509_crt_t *x509_cert_list = NULL;
2072   gnutls_x509_crt_t *x509_ca_list = NULL;
2073   gnutls_x509_crl_t *x509_crl_list = NULL;
2074   unsigned int x509_ncerts, x509_ncrls = 0, x509_ncas = 0;
2075   gnutls_x509_trust_list_t list;
2076   unsigned int output;
2077
2078   ret = gnutls_x509_trust_list_init(&list, 0);
2079   if (ret < 0)
2080      error (EXIT_FAILURE, 0, "gnutls_x509_trust_list_init: %s",
2081                  gnutls_strerror (ret));
2082
2083   if (ca == NULL)
2084     {
2085       tmp.data = (void*)cert;
2086       tmp.size = cert_size;
2087     }
2088   else
2089     {
2090       tmp.data = (void*)ca;
2091       tmp.size = ca_size;
2092
2093       /* Load CAs */
2094       ret = gnutls_x509_crt_list_import2( &x509_ca_list, &x509_ncas, &tmp,
2095         GNUTLS_X509_FMT_PEM, 0);
2096       if (ret < 0 || x509_ncas < 1)
2097          error (EXIT_FAILURE, 0, "error parsing CAs: %s",
2098                      gnutls_strerror (ret));
2099     }
2100
2101   ret = gnutls_x509_crl_list_import2( &x509_crl_list, &x509_ncrls, &tmp,
2102     GNUTLS_X509_FMT_PEM, 0);
2103   if (ret < 0)
2104     {
2105       x509_crl_list = NULL;
2106       x509_ncrls = 0;
2107     }
2108
2109   tmp.data = (void*)cert;
2110   tmp.size = cert_size;
2111
2112   /* ignore errors. CRLs might not be given */
2113   ret = gnutls_x509_crt_list_import2( &x509_cert_list, &x509_ncerts, &tmp,
2114     GNUTLS_X509_FMT_PEM, 0);
2115   if (ret < 0 || x509_ncerts < 1)
2116      error (EXIT_FAILURE, 0, "error parsing CRTs: %s",
2117                  gnutls_strerror (ret));
2118
2119   if (ca == NULL)
2120     {
2121       x509_ca_list = &x509_cert_list[x509_ncerts - 1];
2122       x509_ncas = 1;
2123     }
2124
2125   fprintf(stdout, "Loaded %d certificates, %d CAs and %d CRLs\n\n",
2126     x509_ncerts, x509_ncas, x509_ncrls);
2127
2128   ret = gnutls_x509_trust_list_add_cas(list, x509_ca_list, x509_ncas, 0);
2129   if (ret < 0)
2130      error (EXIT_FAILURE, 0, "gnutls_x509_trust_add_cas: %s",
2131                  gnutls_strerror (ret));
2132
2133   ret = gnutls_x509_trust_list_add_crls(list, x509_crl_list, x509_ncrls, 0, 0);
2134   if (ret < 0)
2135      error (EXIT_FAILURE, 0, "gnutls_x509_trust_add_crls: %s",
2136                  gnutls_strerror (ret));
2137
2138   gnutls_free(x509_crl_list);
2139
2140   ret = gnutls_x509_trust_list_verify_crt (list, x509_cert_list, x509_ncerts,
2141     GNUTLS_VERIFY_DO_NOT_ALLOW_SAME|GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, &output,
2142     detailed_verification);
2143   if (ret < 0)
2144      error (EXIT_FAILURE, 0, "gnutls_x509_trusted_list_verify_crt: %s",
2145                  gnutls_strerror (ret));
2146
2147   fprintf (outfile, "Chain verification output: ");
2148   print_verification_res(outfile, output);
2149
2150   fprintf (outfile, ".\n\n");
2151
2152   gnutls_free(x509_cert_list);
2153   gnutls_x509_trust_list_deinit(list, 1);
2154
2155   if (output != 0)
2156     exit(EXIT_FAILURE);
2157
2158   return 0;
2159 }
2160
2161 static void
2162 print_verification_res (FILE* outfile, unsigned int output)
2163 {
2164   int comma = 0;
2165
2166   if (output & GNUTLS_CERT_INVALID)
2167     {
2168       fprintf (outfile, "Not verified");
2169       comma = 1;
2170     }
2171   else
2172     {
2173       fprintf (outfile, "Verified");
2174       comma = 1;
2175     }
2176
2177   if (output & GNUTLS_CERT_SIGNER_NOT_CA)
2178     {
2179       if (comma)
2180         fprintf (outfile, ", ");
2181       fprintf (outfile, "Issuer is not a CA");
2182       comma = 1;
2183     }
2184
2185   if (output & GNUTLS_CERT_INSECURE_ALGORITHM)
2186     {
2187       if (comma)
2188         fprintf (outfile, ", ");
2189       fprintf (outfile, "Insecure algorithm");
2190       comma = 1;
2191     }
2192
2193   if (output & GNUTLS_CERT_NOT_ACTIVATED)
2194     {
2195       if (comma)
2196         fprintf (outfile, ", ");
2197       fprintf (outfile, "Not activated");
2198       comma = 1;
2199     }
2200
2201   if (output & GNUTLS_CERT_EXPIRED)
2202     {
2203       if (comma)
2204         fprintf (outfile, ", ");
2205       fprintf (outfile, "Expired");
2206       comma = 1;
2207     }
2208
2209   if (output & GNUTLS_CERT_REVOKED)
2210     {
2211       if (comma)
2212         fprintf (outfile, ", ");
2213       fprintf (outfile, "Revoked");
2214       comma = 1;
2215     }
2216 }
2217
2218 static void
2219 verify_chain (void)
2220 {
2221   char *buf;
2222   size_t size;
2223
2224   buf = (void*)fread_file (infile, &size);
2225   if (buf == NULL)
2226     error (EXIT_FAILURE, errno, "reading chain");
2227
2228   buf[size] = 0;
2229
2230   _verify_x509_mem (buf, size, NULL, 0);
2231
2232 }
2233
2234 static void
2235 verify_certificate (common_info_st * cinfo)
2236 {
2237   char *cert;
2238   char *cas;
2239   size_t cert_size, ca_size;
2240   FILE * ca_file = fopen(cinfo->ca, "r");
2241
2242   if (ca_file == NULL)
2243     error (EXIT_FAILURE, errno, "opening CA file");
2244
2245   cert = (void*)fread_file (infile, &cert_size);
2246   if (cert == NULL)
2247     error (EXIT_FAILURE, errno, "reading certificate chain");
2248
2249   cert[cert_size] = 0;
2250
2251   cas = (void*)fread_file (ca_file, &ca_size);
2252   if (cas == NULL)
2253     error (EXIT_FAILURE, errno, "reading CA list");
2254
2255   cas[ca_size] = 0;
2256   fclose(ca_file);
2257
2258   _verify_x509_mem (cert, cert_size, cas, ca_size);
2259
2260
2261 }
2262
2263 void
2264 verify_crl (common_info_st * cinfo)
2265 {
2266   size_t size, dn_size;
2267   char dn[128];
2268   unsigned int output;
2269   int comma = 0;
2270   int ret;
2271   gnutls_datum_t pem;
2272   gnutls_x509_crl_t crl;
2273   time_t now = time (0);
2274   gnutls_x509_crt_t issuer;
2275
2276   issuer = load_ca_cert (cinfo);
2277
2278   fprintf (outfile, "\nCA certificate:\n");
2279
2280   dn_size = sizeof (dn);
2281   ret = gnutls_x509_crt_get_dn (issuer, dn, &dn_size);
2282   if (ret < 0)
2283     error (EXIT_FAILURE, 0, "crt_get_dn: %s", gnutls_strerror (ret));
2284
2285   fprintf (outfile, "\tSubject: %s\n\n", dn);
2286
2287   ret = gnutls_x509_crl_init (&crl);
2288   if (ret < 0)
2289     error (EXIT_FAILURE, 0, "crl_init: %s", gnutls_strerror (ret));
2290
2291   pem.data = (void*)fread_file (infile, &size);
2292   pem.size = size;
2293
2294   ret = gnutls_x509_crl_import (crl, &pem, incert_format);
2295   free (pem.data);
2296   if (ret < 0)
2297     error (EXIT_FAILURE, 0, "import error: %s", gnutls_strerror (ret));
2298
2299   print_crl_info (crl, outfile);
2300
2301   fprintf (outfile, "Verification output: ");
2302   ret = gnutls_x509_crl_verify (crl, &issuer, 1, 0, &output);
2303   if (ret < 0)
2304     error (EXIT_FAILURE, 0, "verification error: %s", gnutls_strerror (ret));
2305
2306   if (output & GNUTLS_CERT_INVALID)
2307     {
2308       fprintf (outfile, "Not verified");
2309       comma = 1;
2310     }
2311   else
2312     {
2313       fprintf (outfile, "Verified");
2314       comma = 1;
2315     }
2316
2317   if (output & GNUTLS_CERT_SIGNER_NOT_CA)
2318     {
2319       if (comma)
2320         fprintf (outfile, ", ");
2321       fprintf (outfile, "Issuer is not a CA");
2322       comma = 1;
2323     }
2324
2325   if (output & GNUTLS_CERT_INSECURE_ALGORITHM)
2326     {
2327       if (comma)
2328         fprintf (outfile, ", ");
2329       fprintf (outfile, "Insecure algorithm");
2330       comma = 1;
2331     }
2332
2333   /* Check expiration dates.
2334    */
2335
2336   if (gnutls_x509_crl_get_this_update (crl) > now)
2337     {
2338       if (comma)
2339         fprintf (outfile, ", ");
2340       comma = 1;
2341       fprintf (outfile, "Issued in the future!");
2342     }
2343
2344   if (gnutls_x509_crl_get_next_update (crl) < now)
2345     {
2346       if (comma)
2347         fprintf (outfile, ", ");
2348       comma = 1;
2349       fprintf (outfile, "CRL is not up to date");
2350     }
2351
2352   fprintf (outfile, "\n");
2353 }
2354
2355
2356 void
2357 generate_pkcs8 (common_info_st * cinfo)
2358 {
2359   gnutls_x509_privkey_t key;
2360   int result;
2361   size_t size;
2362   int flags = 0;
2363   const char *password;
2364
2365   fprintf (stderr, "Generating a PKCS #8 key structure...\n");
2366
2367   key = load_x509_private_key (1, cinfo);
2368
2369   if (cinfo->password)
2370     password = cinfo->password;
2371   else
2372     password = get_pass ();
2373
2374   flags = cipher_to_flags (cinfo->pkcs_cipher);
2375
2376   if (password == NULL || password[0] == 0)
2377     {
2378       flags = GNUTLS_PKCS_PLAIN;
2379     }
2380
2381   size = buffer_size;
2382   result =
2383     gnutls_x509_privkey_export_pkcs8 (key, outcert_format,
2384                                       password, flags, buffer, &size);
2385
2386   if (result < 0)
2387     error (EXIT_FAILURE, 0, "key_export: %s", gnutls_strerror (result));
2388
2389   fwrite (buffer, 1, size, outfile);
2390
2391 }
2392
2393
2394 #include <gnutls/pkcs12.h>
2395 #include <unistd.h>
2396
2397 void
2398 generate_pkcs12 (common_info_st * cinfo)
2399 {
2400   gnutls_pkcs12_t pkcs12;
2401   gnutls_x509_crt_t *crts;
2402   gnutls_x509_privkey_t key;
2403   int result;
2404   size_t size;
2405   gnutls_datum_t data;
2406   const char *pass;
2407   const char *name;
2408   unsigned int flags, i;
2409   gnutls_datum_t key_id;
2410   unsigned char _key_id[32];
2411   int indx;
2412   size_t ncrts;
2413
2414   fprintf (stderr, "Generating a PKCS #12 structure...\n");
2415
2416   key = load_x509_private_key (0, cinfo);
2417   crts = load_cert_list (0, &ncrts, cinfo);
2418
2419   name = get_pkcs12_key_name ();
2420
2421   result = gnutls_pkcs12_init (&pkcs12);
2422   if (result < 0)
2423     error (EXIT_FAILURE, 0, "pkcs12_init: %s", gnutls_strerror (result));
2424
2425   if (cinfo->password)
2426     pass = cinfo->password;
2427   else
2428     pass = get_pass ();
2429
2430   if (pass == NULL)
2431     {
2432       fprintf(stderr, "No password given for PKCS #12. Assuming null password...\n");
2433       pass = "";
2434     }
2435
2436
2437   for (i = 0; i < ncrts; i++)
2438     {
2439       gnutls_pkcs12_bag_t bag;
2440
2441       result = gnutls_pkcs12_bag_init (&bag);
2442       if (result < 0)
2443         error (EXIT_FAILURE, 0, "bag_init: %s", gnutls_strerror (result));
2444
2445       result = gnutls_pkcs12_bag_set_crt (bag, crts[i]);
2446       if (result < 0)
2447         error (EXIT_FAILURE, 0, "set_crt[%d]: %s", i,
2448                gnutls_strerror (result));
2449
2450       indx = result;
2451
2452       result = gnutls_pkcs12_bag_set_friendly_name (bag, indx, name);
2453       if (result < 0)
2454         error (EXIT_FAILURE, 0, "bag_set_friendly_name: %s",
2455                gnutls_strerror (result));
2456
2457       size = sizeof (_key_id);
2458       result = gnutls_x509_crt_get_key_id (crts[i], 0, _key_id, &size);
2459       if (result < 0)
2460         error (EXIT_FAILURE, 0, "key_id[%d]: %s", i,
2461                gnutls_strerror (result));
2462
2463       key_id.data = _key_id;
2464       key_id.size = size;
2465
2466       result = gnutls_pkcs12_bag_set_key_id (bag, indx, &key_id);
2467       if (result < 0)
2468         error (EXIT_FAILURE, 0, "bag_set_key_id: %s",
2469                gnutls_strerror (result));
2470
2471       flags = cipher_to_flags (cinfo->pkcs_cipher);
2472
2473       result = gnutls_pkcs12_bag_encrypt (bag, pass, flags);
2474       if (result < 0)
2475         error (EXIT_FAILURE, 0, "bag_encrypt: %s", gnutls_strerror (result));
2476
2477       result = gnutls_pkcs12_set_bag (pkcs12, bag);
2478       if (result < 0)
2479         error (EXIT_FAILURE, 0, "set_bag: %s", gnutls_strerror (result));
2480     }
2481
2482   if (key)
2483     {
2484       gnutls_pkcs12_bag_t kbag;
2485
2486       result = gnutls_pkcs12_bag_init (&kbag);
2487       if (result < 0)
2488         error (EXIT_FAILURE, 0, "bag_init: %s", gnutls_strerror (result));
2489
2490       flags = cipher_to_flags (cinfo->pkcs_cipher);
2491
2492       size = buffer_size;
2493       result =
2494         gnutls_x509_privkey_export_pkcs8 (key, GNUTLS_X509_FMT_DER,
2495                                           pass, flags, buffer, &size);
2496       if (result < 0)
2497         error (EXIT_FAILURE, 0, "key_export: %s", gnutls_strerror (result));
2498
2499       data.data = buffer;
2500       data.size = size;
2501       result =
2502         gnutls_pkcs12_bag_set_data (kbag,
2503                                     GNUTLS_BAG_PKCS8_ENCRYPTED_KEY, &data);
2504       if (result < 0)
2505         error (EXIT_FAILURE, 0, "bag_set_data: %s", gnutls_strerror (result));
2506
2507       indx = result;
2508
2509       result = gnutls_pkcs12_bag_set_friendly_name (kbag, indx, name);
2510       if (result < 0)
2511         error (EXIT_FAILURE, 0, "bag_set_friendly_name: %s",
2512                gnutls_strerror (result));
2513
2514       size = sizeof (_key_id);
2515       result = gnutls_x509_privkey_get_key_id (key, 0, _key_id, &size);
2516       if (result < 0)
2517         error (EXIT_FAILURE, 0, "key_id: %s", gnutls_strerror (result));
2518
2519       key_id.data = _key_id;
2520       key_id.size = size;
2521
2522       result = gnutls_pkcs12_bag_set_key_id (kbag, indx, &key_id);
2523       if (result < 0)
2524         error (EXIT_FAILURE, 0, "bag_set_key_id: %s",
2525                gnutls_strerror (result));
2526
2527       result = gnutls_pkcs12_set_bag (pkcs12, kbag);
2528       if (result < 0)
2529         error (EXIT_FAILURE, 0, "set_bag: %s", gnutls_strerror (result));
2530     }
2531
2532   result = gnutls_pkcs12_generate_mac (pkcs12, pass);
2533   if (result < 0)
2534     error (EXIT_FAILURE, 0, "generate_mac: %s", gnutls_strerror (result));
2535
2536   size = buffer_size;
2537   result = gnutls_pkcs12_export (pkcs12, outcert_format, buffer, &size);
2538   if (result < 0)
2539     error (EXIT_FAILURE, 0, "pkcs12_export: %s", gnutls_strerror (result));
2540
2541   fwrite (buffer, 1, size, outfile);
2542
2543 }
2544
2545 static const char *
2546 BAGTYPE (gnutls_pkcs12_bag_type_t x)
2547 {
2548   switch (x)
2549     {
2550     case GNUTLS_BAG_PKCS8_ENCRYPTED_KEY:
2551       return "PKCS #8 Encrypted key";
2552     case GNUTLS_BAG_EMPTY:
2553       return "Empty";
2554     case GNUTLS_BAG_PKCS8_KEY:
2555       return "PKCS #8 Key";
2556     case GNUTLS_BAG_CERTIFICATE:
2557       return "Certificate";
2558     case GNUTLS_BAG_ENCRYPTED:
2559       return "Encrypted";
2560     case GNUTLS_BAG_CRL:
2561       return "CRL";
2562     case GNUTLS_BAG_SECRET:
2563       return "Secret";
2564     default:
2565       return "Unknown";
2566     }
2567 }
2568
2569 static void
2570 print_bag_data (gnutls_pkcs12_bag_t bag)
2571 {
2572   int result;
2573   int count, i, type;
2574   gnutls_datum_t cdata, id;
2575   const char *str, *name;
2576   gnutls_datum_t out;
2577
2578   count = gnutls_pkcs12_bag_get_count (bag);
2579   if (count < 0)
2580     error (EXIT_FAILURE, 0, "get_count: %s", gnutls_strerror (count));
2581
2582   fprintf (outfile, "\tElements: %d\n", count);
2583
2584   for (i = 0; i < count; i++)
2585     {
2586       type = gnutls_pkcs12_bag_get_type (bag, i);
2587       if (type < 0)
2588         error (EXIT_FAILURE, 0, "get_type: %s", gnutls_strerror (type));
2589
2590       fprintf (stderr, "\tType: %s\n", BAGTYPE (type));
2591
2592       name = NULL;
2593       result = gnutls_pkcs12_bag_get_friendly_name (bag, i, (char **) &name);
2594       if (result < 0)
2595         error (EXIT_FAILURE, 0, "get_friendly_name: %s",
2596                gnutls_strerror (type));
2597       if (name)
2598         fprintf (outfile, "\tFriendly name: %s\n", name);
2599
2600       id.data = NULL;
2601       id.size = 0;
2602       result = gnutls_pkcs12_bag_get_key_id (bag, i, &id);
2603       if (result < 0)
2604         error (EXIT_FAILURE, 0, "get_key_id: %s", gnutls_strerror (type));
2605       if (id.size > 0)
2606         fprintf (outfile, "\tKey ID: %s\n", raw_to_string (id.data, id.size));
2607
2608       result = gnutls_pkcs12_bag_get_data (bag, i, &cdata);
2609       if (result < 0)
2610         error (EXIT_FAILURE, 0, "get_data: %s", gnutls_strerror (result));
2611
2612       switch (type)
2613         {
2614         case GNUTLS_BAG_PKCS8_ENCRYPTED_KEY:
2615           str = "ENCRYPTED PRIVATE KEY";
2616           break;
2617         case GNUTLS_BAG_PKCS8_KEY:
2618           str = "PRIVATE KEY";
2619           break;
2620         case GNUTLS_BAG_CERTIFICATE:
2621           str = "CERTIFICATE";
2622           break;
2623         case GNUTLS_BAG_CRL:
2624           str = "CRL";
2625           break;
2626         case GNUTLS_BAG_ENCRYPTED:
2627         case GNUTLS_BAG_EMPTY:
2628         default:
2629           str = NULL;
2630         }
2631
2632       if (str != NULL)
2633         {
2634           gnutls_pem_base64_encode_alloc (str, &cdata, &out);
2635           fprintf (outfile, "%s\n", out.data);
2636
2637           gnutls_free (out.data);
2638         }
2639
2640     }
2641 }
2642
2643 void
2644 pkcs12_info (common_info_st* cinfo)
2645 {
2646   gnutls_pkcs12_t pkcs12;
2647   gnutls_pkcs12_bag_t bag;
2648   int result;
2649   size_t size;
2650   gnutls_datum_t data;
2651   const char *pass;
2652   int indx;
2653
2654   result = gnutls_pkcs12_init (&pkcs12);
2655   if (result < 0)
2656     error (EXIT_FAILURE, 0, "p12_init: %s", gnutls_strerror (result));
2657
2658   data.data = (void*)fread_file (infile, &size);
2659   data.size = size;
2660
2661   result = gnutls_pkcs12_import (pkcs12, &data, incert_format, 0);
2662   free (data.data);
2663   if (result < 0)
2664     error (EXIT_FAILURE, 0, "p12_import: %s", gnutls_strerror (result));
2665
2666   if (cinfo->password)
2667     pass = cinfo->password;
2668   else
2669     pass = get_pass ();
2670
2671   result = gnutls_pkcs12_verify_mac (pkcs12, pass);
2672   if (result < 0)
2673     error (0, 0, "verify_mac: %s", gnutls_strerror (result));
2674
2675   for (indx = 0;; indx++)
2676     {
2677       result = gnutls_pkcs12_bag_init (&bag);
2678       if (result < 0)
2679         error (EXIT_FAILURE, 0, "bag_init: %s", gnutls_strerror (result));
2680
2681       result = gnutls_pkcs12_get_bag (pkcs12, indx, bag);
2682       if (result < 0)
2683         break;
2684
2685       result = gnutls_pkcs12_bag_get_count (bag);
2686       if (result < 0)
2687         error (EXIT_FAILURE, 0, "bag_count: %s", gnutls_strerror (result));
2688
2689       fprintf (outfile, "BAG #%d\n", indx);
2690
2691       result = gnutls_pkcs12_bag_get_type (bag, 0);
2692       if (result < 0)
2693         error (EXIT_FAILURE, 0, "bag_init: %s", gnutls_strerror (result));
2694
2695       if (result == GNUTLS_BAG_ENCRYPTED)
2696         {
2697           fprintf (stderr, "\tType: %s\n", BAGTYPE (result));
2698           fprintf (stderr, "\n\tDecrypting...\n");
2699
2700           result = gnutls_pkcs12_bag_decrypt (bag, pass);
2701
2702           if (result < 0)
2703             {
2704               error (0, 0, "bag_decrypt: %s", gnutls_strerror (result));
2705               continue;
2706             }
2707
2708           result = gnutls_pkcs12_bag_get_count (bag);
2709           if (result < 0)
2710             error (EXIT_FAILURE, 0, "encrypted bag_count: %s",
2711                    gnutls_strerror (result));
2712         }
2713
2714       print_bag_data (bag);
2715
2716       gnutls_pkcs12_bag_deinit (bag);
2717     }
2718 }
2719
2720 void
2721 pkcs7_info (void)
2722 {
2723   gnutls_pkcs7_t pkcs7;
2724   int result;
2725   size_t size;
2726   gnutls_datum_t data, b64;
2727   int indx, count;
2728
2729   result = gnutls_pkcs7_init (&pkcs7);
2730   if (result < 0)
2731     error (EXIT_FAILURE, 0, "p7_init: %s", gnutls_strerror (result));
2732
2733   data.data = (void*)fread_file (infile, &size);
2734   data.size = size;
2735
2736   result = gnutls_pkcs7_import (pkcs7, &data, incert_format);
2737   free (data.data);
2738   if (result < 0)
2739     error (EXIT_FAILURE, 0, "import error: %s", gnutls_strerror (result));
2740
2741   /* Read and print the certificates.
2742    */
2743   result = gnutls_pkcs7_get_crt_count (pkcs7);
2744   if (result < 0)
2745     error (EXIT_FAILURE, 0, "p7_crt_count: %s", gnutls_strerror (result));
2746
2747   count = result;
2748
2749   if (count > 0)
2750     fprintf (outfile, "Number of certificates: %u\n", count);
2751
2752   for (indx = 0; indx < count; indx++)
2753     {
2754       fputs ("\n", outfile);
2755
2756       size = buffer_size;
2757       result = gnutls_pkcs7_get_crt_raw (pkcs7, indx, buffer, &size);
2758       if (result < 0)
2759         break;
2760
2761       data.data = buffer;
2762       data.size = size;
2763
2764       result = gnutls_pem_base64_encode_alloc ("CERTIFICATE", &data, &b64);
2765       if (result < 0)
2766         error (EXIT_FAILURE, 0, "encoding: %s", gnutls_strerror (result));
2767
2768       fputs ((void*)b64.data, outfile);
2769       gnutls_free (b64.data);
2770     }
2771
2772   /* Read the CRLs now.
2773    */
2774   result = gnutls_pkcs7_get_crl_count (pkcs7);
2775   if (result < 0)
2776     error (EXIT_FAILURE, 0, "p7_crl_count: %s", gnutls_strerror (result));
2777
2778   count = result;
2779
2780   if (count > 0)
2781     fprintf (outfile, "\nNumber of CRLs: %u\n", count);
2782
2783   for (indx = 0; indx < count; indx++)
2784     {
2785       fputs ("\n", outfile);
2786
2787       size = buffer_size;
2788       result = gnutls_pkcs7_get_crl_raw (pkcs7, indx, buffer, &size);
2789       if (result < 0)
2790         break;
2791
2792       data.data = buffer;
2793       data.size = size;
2794
2795       result = gnutls_pem_base64_encode_alloc ("X509 CRL", &data, &b64);
2796       if (result < 0)
2797         error (EXIT_FAILURE, 0, "encoding: %s", gnutls_strerror (result));
2798
2799       fputs ((void*)b64.data, outfile);
2800       gnutls_free (b64.data);
2801     }
2802 }
2803
2804 void
2805 smime_to_pkcs7 (void)
2806 {
2807   size_t linesize = 0;
2808   char *lineptr = NULL;
2809   ssize_t len;
2810
2811   /* Find body.  FIXME: Handle non-b64 Content-Transfer-Encoding.
2812      Reject non-S/MIME tagged Content-Type's? */
2813   do
2814     {
2815       len = getline (&lineptr, &linesize, infile);
2816       if (len == -1)
2817         error (EXIT_FAILURE, 0, "cannot find RFC 2822 header/body separator");
2818     }
2819   while (strcmp (lineptr, "\r\n") != 0 && strcmp (lineptr, "\n") != 0);
2820
2821   do
2822     {
2823       len = getline (&lineptr, &linesize, infile);
2824       if (len == -1)
2825         error (EXIT_FAILURE, 0, "message has RFC 2822 header but no body");
2826     }
2827   while (strcmp (lineptr, "\r\n") == 0 && strcmp (lineptr, "\n") == 0);
2828
2829   fprintf (outfile, "%s", "-----BEGIN PKCS7-----\n");
2830
2831   do
2832     {
2833       while (len > 0
2834              && (lineptr[len - 1] == '\r' || lineptr[len - 1] == '\n'))
2835         lineptr[--len] = '\0';
2836       if (strcmp (lineptr, "") != 0)
2837         fprintf (outfile, "%s\n", lineptr);
2838       len = getline (&lineptr, &linesize, infile);
2839     }
2840   while (len != -1);
2841
2842   fprintf (outfile, "%s", "-----END PKCS7-----\n");
2843
2844   free (lineptr);
2845 }
2846
2847 void
2848 certtool_version (void)
2849 {
2850   const char *p = PACKAGE_NAME;
2851   if (strcmp (gnutls_check_version (NULL), PACKAGE_VERSION) != 0)
2852     p = PACKAGE_STRING;
2853   version_etc (stdout, program_name, p, gnutls_check_version (NULL),
2854                "Nikos Mavrogiannopoulos", "Simon Josefsson", (char *) NULL);
2855 }
2856
2857 static void
2858 print_key_usage (FILE * outfile, unsigned int usage)
2859 {
2860   if (usage & GNUTLS_KEY_DIGITAL_SIGNATURE)
2861     {
2862       fprintf (outfile, "\tDigital signature.\n");
2863     }
2864
2865   if (usage & GNUTLS_KEY_NON_REPUDIATION)
2866     {
2867       fprintf (outfile, "\tNon repudiation.\n");
2868     }
2869
2870   if (usage & GNUTLS_KEY_KEY_ENCIPHERMENT)
2871     {
2872       fprintf (outfile, "\tKey encipherment.\n");
2873     }
2874
2875   if (usage & GNUTLS_KEY_DATA_ENCIPHERMENT)
2876     {
2877       fprintf (outfile, "\tData encipherment.\n");
2878     }
2879
2880   if (usage & GNUTLS_KEY_KEY_AGREEMENT)
2881     {
2882       fprintf (outfile, "\tKey agreement.\n");
2883     }
2884
2885   if (usage & GNUTLS_KEY_KEY_CERT_SIGN)
2886     {
2887       fprintf (outfile, "\tCertificate signing.\n");
2888     }
2889
2890   if (usage & GNUTLS_KEY_NON_REPUDIATION)
2891     {
2892       fprintf (outfile, "\tCRL signing.\n");
2893     }
2894
2895   if (usage & GNUTLS_KEY_ENCIPHER_ONLY)
2896     {
2897       fprintf (outfile, "\tKey encipher only.\n");
2898     }
2899
2900   if (usage & GNUTLS_KEY_DECIPHER_ONLY)
2901     {
2902       fprintf (outfile, "\tKey decipher only.\n");
2903     }
2904 }
2905
2906 void
2907 pubkey_info (gnutls_x509_crt_t crt, common_info_st * cinfo)
2908 {
2909   gnutls_pubkey_t pubkey;
2910   unsigned int bits, usage;
2911   int ret;
2912   size_t size;
2913   const char *cprint;
2914
2915   ret = gnutls_pubkey_init (&pubkey);
2916   if (ret < 0)
2917     {
2918       error (EXIT_FAILURE, 0, "pubkey_init: %s", gnutls_strerror (ret));
2919     }
2920
2921   if (crt == NULL)
2922     {
2923       crt = load_cert (0, cinfo);
2924     }
2925
2926   if (crt != NULL)
2927     {
2928       ret = gnutls_pubkey_import_x509 (pubkey, crt, 0);
2929       if (ret < 0)
2930         {
2931           error (EXIT_FAILURE, 0, "pubkey_import_x509: %s",
2932                  gnutls_strerror (ret));
2933         }
2934     }
2935   else
2936     {
2937       pubkey = load_pubkey (1, cinfo);
2938     }
2939
2940   if (outcert_format == GNUTLS_X509_FMT_DER)
2941     {
2942       size = buffer_size;
2943       ret = gnutls_pubkey_export (pubkey, outcert_format, buffer, &size);
2944       if (ret < 0)
2945         error (EXIT_FAILURE, 0, "export error: %s", gnutls_strerror (ret));
2946
2947       fwrite (buffer, 1, size, outfile);
2948
2949       gnutls_pubkey_deinit (pubkey);
2950
2951       return;
2952     }
2953
2954   /* PEM */
2955
2956   fprintf (outfile, "Public Key Info:\n\n");
2957   ret = gnutls_pubkey_get_pk_algorithm (pubkey, &bits);
2958   fprintf (outfile, "Public Key Algorithm: ");
2959
2960   cprint = gnutls_pk_algorithm_get_name (ret);
2961   fprintf (outfile, "%s (%u bits)\n", cprint ? cprint : "Unknown", bits);
2962
2963
2964   /* Print the raw public and private keys
2965    */
2966   if (ret == GNUTLS_PK_RSA)
2967     {
2968       gnutls_datum_t m, e;
2969
2970       ret = gnutls_pubkey_get_pk_rsa_raw (pubkey, &m, &e);
2971       if (ret < 0)
2972         fprintf (stderr, "Error in key RSA data export: %s\n",
2973                  gnutls_strerror (ret));
2974       else
2975         {
2976           print_rsa_pkey (&m, &e, NULL, NULL, NULL, NULL, NULL, NULL);
2977           gnutls_free (m.data);
2978           gnutls_free (e.data);
2979         }
2980     }
2981   else if (ret == GNUTLS_PK_DSA)
2982     {
2983       gnutls_datum_t p, q, g, y;
2984
2985       ret = gnutls_pubkey_get_pk_dsa_raw (pubkey, &p, &q, &g, &y);
2986       if (ret < 0)
2987         fprintf (stderr, "Error in key DSA data export: %s\n",
2988                  gnutls_strerror (ret));
2989       else
2990         {
2991           print_dsa_pkey (NULL, &y, &p, &q, &g);
2992           gnutls_free (y.data);
2993           gnutls_free (p.data);
2994           gnutls_free (q.data);
2995           gnutls_free (g.data);
2996         }
2997     }
2998   else if (ret == GNUTLS_PK_EC)
2999     {
3000       gnutls_datum_t x, y;
3001       gnutls_ecc_curve_t curve;
3002
3003       ret = gnutls_pubkey_get_pk_ecc_raw (pubkey, &curve, &x, &y);
3004       if (ret < 0)
3005         fprintf (stderr, "Error in key ECC data export: %s\n",
3006                  gnutls_strerror (ret));
3007       else
3008         {
3009           print_ecc_pkey (curve, NULL, &y, &x);
3010           gnutls_free (y.data);
3011           gnutls_free (x.data);
3012         }
3013     }
3014
3015   ret = gnutls_pubkey_get_key_usage (pubkey, &usage);
3016   if (ret < 0)
3017     {
3018       error (EXIT_FAILURE, 0, "pubkey_get_key_usage: %s",
3019              gnutls_strerror (ret));
3020     }
3021
3022   fprintf (outfile, "Public Key Usage:\n");
3023   print_key_usage (outfile, usage);
3024
3025   fprintf (outfile, "\n");
3026
3027   size = buffer_size;
3028   if ((ret = gnutls_pubkey_get_key_id (pubkey, 0, buffer, &size)) < 0)
3029     {
3030       fprintf (stderr, "Error in key id calculation: %s\n",
3031                gnutls_strerror (ret));
3032     }
3033   else
3034     {
3035       fprintf (outfile, "Public Key ID: %s\n", raw_to_string (buffer, size));
3036     }
3037
3038   size = buffer_size;
3039   ret = gnutls_pubkey_export (pubkey, GNUTLS_X509_FMT_PEM, buffer, &size);
3040   if (ret < 0)
3041     error (EXIT_FAILURE, 0, "export error: %s", gnutls_strerror (ret));
3042
3043   fprintf (outfile, "\n%s\n", buffer);
3044
3045   gnutls_pubkey_deinit (pubkey);
3046 }