openssl.c

   1 /*@ S-nail - a mail user agent derived from Berkeley Mail.
   2  *@ OpenSSL functions. TODO this needs an overhaul -- there _are_ stack leaks!?
   3  *
   4  * Copyright (c) 2000-2004 Gunnar Ritter, Freiburg i. Br., Germany.
   5  * Copyright (c) 2012 - 2014 Steffen (Daode) Nurpmeso <sdaoden@users.sf.net>.
   6  */
   7 /*
   8  * Copyright (c) 2002
   9  * Gunnar Ritter.  All rights reserved.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  * 3. All advertising materials mentioning features or use of this software
  20  *    must display the following acknowledgement:
  21  *    This product includes software developed by Gunnar Ritter
  22  *    and his contributors.
  23  * 4. Neither the name of Gunnar Ritter nor the names of his contributors
  24  *    may be used to endorse or promote products derived from this software
  25  *    without specific prior written permission.
  26  *
  27  * THIS SOFTWARE IS PROVIDED BY GUNNAR RITTER AND CONTRIBUTORS ``AS IS'' AND
  28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  29  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  30  * ARE DISCLAIMED.  IN NO EVENT SHALL GUNNAR RITTER OR CONTRIBUTORS BE LIABLE
  31  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  32  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  33  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  34  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  35  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  36  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  37  * SUCH DAMAGE.
  38  */
  39
  40 #ifndef HAVE_AMALGAMATION
  41 # include "nail.h"
  42 #endif
  43
  44 EMPTY_FILE(openssl)
  45 #ifdef HAVE_OPENSSL
  46 #include <sys/socket.h>
  47
  48 #include <dirent.h>
  49 #include <netdb.h>
  50
  51 #include <netinet/in.h>
  52
  53 #include <openssl/crypto.h>
  54 #include <openssl/ssl.h>
  55 #include <openssl/err.h>
  56 #include <openssl/x509v3.h>
  57 #include <openssl/x509.h>
  58 #include <openssl/pem.h>
  59 #include <openssl/rand.h>
  60
  61 #ifdef HAVE_ARPA_INET_H
  62 # include <arpa/inet.h>
  63 #endif
  64
  65 /*
  66  * OpenSSL client implementation according to: John Viega, Matt Messier,
  67  * Pravir Chandra: Network Security with OpenSSL. Sebastopol, CA 2002.
  68  */
  69
  70 #ifdef HAVE_STACK_OF
  71 # define _STACKOF(X)    STACK_OF(X)
  72 #else
  73 # define _STACKOF(X)    /*X*/STACK
  74 #endif
  75
  76 struct ssl_method {
  77    char const           sm_name[8];
  78    SSL_METHOD const *   (*sm_fun)(void);
  79 };
  80
  81 struct smime_cipher {
  82    char const           sc_name[8];
  83    EVP_CIPHER const *   (*sc_fun)(void);
  84 };
  85
  86 /* Supported SSL/TLS methods: update manual on change! */
  87 static struct ssl_method const   _ssl_methods[] = {
  88    {"auto", &SSLv23_client_method},
  89 #define _SSL_DEFAULT_METHOD      SSLv23_client_method
  90 #ifndef OPENSSL_NO_TLS1
  91 # ifdef TLS1_2_VERSION
  92    {"tls1.2", &TLSv1_2_client_method},
  93 # endif
  94 # ifdef TLS1_1_VERSION
  95    {"tls1.1", &TLSv1_1_client_method},
  96 # endif
  97    {"tls1", &TLSv1_client_method},
  98 #endif
  99 #ifndef OPENSSL_NO_SSL3
 100    {"ssl3", &SSLv3_client_method},
 101 #endif
 102 #ifndef OPENSSL_NO_SSL2
 103    {"ssl2", &SSLv2_client_method}
 104 #endif
 105 };
 106
 107 /* Supported S/MIME cipher algorithms: update manual on change! */
 108 static struct smime_cipher const _smime_ciphers[] = {
 109 #ifndef OPENSSL_NO_AES
 110 # define _SMIME_DEFAULT_CIPHER   EVP_aes_128_cbc   /* According to RFC 5751 */
 111    {"aes-128", &EVP_aes_128_cbc},
 112    {"aes-256", &EVP_aes_256_cbc},
 113    {"aes-192", &EVP_aes_192_cbc},
 114 #endif
 115 #ifndef OPENSSL_NO_DES
 116 # ifndef _SMIME_DEFAULT_CIPHER
 117 #  define _SMIME_DEFAULT_CIPHER   EVP_des_ede3_cbc
 118 # endif
 119    {"des3", &EVP_des_ede3_cbc},
 120    {"des", &EVP_des_cbc},
 121 #endif
 122 #ifndef OPENSSL_NO_RC2
 123    {"rc2-40", &EVP_rc2_40_cbc},
 124    {"rc2-64", &EVP_rc2_64_cbc},
 125 #endif
 126 };
 127 #ifndef _SMIME_DEFAULT_CIPHER
 128 # error Your OpenSSL library does not include the necessary
 129 # error cipher algorithms that are required to support S/MIME
 130 #endif
 131
 132 static int        initialized;
 133 static int        rand_init;
 134 static int        message_number;
 135 static int        verify_error_found;
 136
 137 static int        ssl_rand_init(void);
 138 static void       ssl_init(void);
 139 static int        ssl_verify_cb(int success, X509_STORE_CTX *store);
 140 static const SSL_METHOD *ssl_select_method(char const *uhp);
 141 static void       ssl_load_verifications(struct sock *sp);
 142 static void       ssl_certificate(struct sock *sp, char const *uhp);
 143 static enum okay  ssl_check_host(char const *server, struct sock *sp);
 144 static int        smime_verify(struct message *m, int n, _STACKOF(X509) *chain,
 145                         X509_STORE *store);
 146 static EVP_CIPHER const * _smime_cipher(char const *name);
 147 static int        ssl_password_cb(char *buf, int size, int rwflag,
 148                      void *userdata);
 149 static FILE *     smime_sign_cert(char const *xname, char const *xname2,
 150                      bool_t dowarn);
 151 static char *     smime_sign_include_certs(char const *name);
 152 static int        smime_sign_include_chain_creat(_STACKOF(X509) **chain,
 153                      char const *cfiles);
 154 #if defined X509_V_FLAG_CRL_CHECK && defined X509_V_FLAG_CRL_CHECK_ALL
 155 static enum okay  load_crl1(X509_STORE *store, char const *name);
 156 #endif
 157 static enum okay  load_crls(X509_STORE *store, enum okeys fok, enum okeys dok);
 158
 159 static int
 160 ssl_rand_init(void)
 161 {
 162    char *cp, *x;
 163    int state = 0;
 164    NYD_ENTER;
 165
 166    if ((cp = ok_vlook(ssl_rand_egd)) != NULL) {
 167       if ((x = file_expand(cp)) == NULL || RAND_egd(cp = x) == -1)
 168          fprintf(stderr, tr(245, "entropy daemon at \"%s\" not available\n"),
 169             cp);
 170       else
 171          state = 1;
 172    } else if ((cp = ok_vlook(ssl_rand_file)) != NULL) {
 173       if ((x = file_expand(cp)) == NULL || RAND_load_file(cp = x, 1024) == -1)
 174          fprintf(stderr, tr(246, "entropy file at \"%s\" not available\n"), cp);
 175       else {
 176          struct stat st;
 177
 178          if (!stat(cp, &st) && S_ISREG(st.st_mode) && !access(cp, W_OK)) {
 179             if (RAND_write_file(cp) == -1) {
 180                fprintf(stderr, tr(247,
 181                   "writing entropy data to \"%s\" failed\n"), cp);
 182             }
 183          }
 184          state = 1;
 185       }
 186    }
 187    NYD_LEAVE;
 188    return state;
 189 }
 190
 191 static void
 192 ssl_init(void)
 193 {
 194    NYD_ENTER;
 195    if (initialized == 0) {
 196       SSL_library_init();
 197       initialized = 1;
 198    }
 199    if (rand_init == 0)
 200       rand_init = ssl_rand_init();
 201    NYD_LEAVE;
 202 }
 203
 204 static int
 205 ssl_verify_cb(int success, X509_STORE_CTX *store)
 206 {
 207    int rv = TRU1;
 208    NYD_ENTER;
 209
 210    if (success == 0) {
 211       char data[256];
 212       X509 *cert = X509_STORE_CTX_get_current_cert(store);
 213       int depth = X509_STORE_CTX_get_error_depth(store);
 214       int err = X509_STORE_CTX_get_error(store);
 215
 216       verify_error_found = 1;
 217       if (message_number)
 218          fprintf(stderr, "Message %d: ", message_number);
 219       fprintf(stderr, tr(229, "Error with certificate at depth: %i\n"), depth);
 220       X509_NAME_oneline(X509_get_issuer_name(cert), data, sizeof data);
 221       fprintf(stderr, tr(230, " issuer = %s\n"), data);
 222       X509_NAME_oneline(X509_get_subject_name(cert), data, sizeof data);
 223       fprintf(stderr, tr(231, " subject = %s\n"), data);
 224       fprintf(stderr, tr(232, " err %i: %s\n"),
 225          err, X509_verify_cert_error_string(err));
 226       if (ssl_verify_decide() != OKAY)
 227          rv = FAL0;
 228    }
 229    NYD_LEAVE;
 230    return rv;
 231 }
 232
 233 static SSL_METHOD const *
 234 ssl_select_method(char const *uhp)
 235 {
 236    SSL_METHOD const *method;
 237    char *cp;
 238    size_t i;
 239    NYD_ENTER;
 240
 241    if ((cp = ssl_method_string(uhp)) != NULL) {
 242       method = NULL;
 243       for (i = 0; i < NELEM(_ssl_methods); ++i)
 244          if (!strcmp(_ssl_methods[i].sm_name, cp)) {
 245             method = (*_ssl_methods[i].sm_fun)();
 246             goto jleave;
 247          }
 248       fprintf(stderr, tr(244, "Invalid SSL method \"%s\"\n"), cp);
 249    }
 250    method = _SSL_DEFAULT_METHOD();
 251 jleave:
 252    NYD_LEAVE;
 253    return method;
 254 }
 255
 256 static void
 257 ssl_load_verifications(struct sock *sp)
 258 {
 259    char *ca_dir, *ca_file;
 260    X509_STORE *store;
 261    NYD_ENTER;
 262
 263    if (ssl_verify_level == SSL_VERIFY_IGNORE)
 264       goto jleave;
 265
 266    if ((ca_dir = ok_vlook(ssl_ca_dir)) != NULL)
 267       ca_dir = file_expand(ca_dir);
 268    if ((ca_file = ok_vlook(ssl_ca_file)) != NULL)
 269       ca_file = file_expand(ca_file);
 270
 271    if (ca_dir != NULL || ca_file != NULL) {
 272       if (SSL_CTX_load_verify_locations(sp->s_ctx, ca_file, ca_dir) != 1) {
 273          fprintf(stderr, tr(233, "Error loading "));
 274          if (ca_dir) {
 275             fputs(ca_dir, stderr);
 276             if (ca_file)
 277                fputs(tr(234, " or "), stderr);
 278          }
 279          if (ca_file)
 280             fputs(ca_file, stderr);
 281          fputs("\n", stderr);
 282       }
 283    }
 284
 285    if (!ok_blook(ssl_no_default_ca)) {
 286       if (SSL_CTX_set_default_verify_paths(sp->s_ctx) != 1)
 287          fprintf(stderr, tr(243, "Error loading default CA locations\n"));
 288    }
 289
 290    verify_error_found = 0;
 291    message_number = 0;
 292    SSL_CTX_set_verify(sp->s_ctx, SSL_VERIFY_PEER, ssl_verify_cb);
 293    store = SSL_CTX_get_cert_store(sp->s_ctx);
 294    load_crls(store, ok_v_ssl_crl_file, ok_v_ssl_crl_dir);
 295 jleave:
 296    NYD_LEAVE;
 297 }
 298
 299 static void
 300 ssl_certificate(struct sock *sp, char const *uhp)
 301 {
 302    size_t i;
 303    char *certvar, *keyvar, *cert, *key, *x;
 304    NYD_ENTER;
 305
 306    i = strlen(uhp);
 307    certvar = ac_alloc(i + 9 +1);
 308    memcpy(certvar, "ssl-cert-", 9);
 309    memcpy(certvar + 9, uhp, i +1);
 310
 311    if ((cert = vok_vlook(certvar)) != NULL ||
 312          (cert = ok_vlook(ssl_cert)) != NULL) {
 313       x = cert;
 314       if ((cert = file_expand(cert)) == NULL) {
 315          cert = x;
 316          goto jbcert;
 317       } else if (SSL_CTX_use_certificate_chain_file(sp->s_ctx, cert) == 1) {
 318          keyvar = ac_alloc(strlen(uhp) + 8 +1);
 319          memcpy(keyvar, "ssl-key-", 8);
 320          memcpy(keyvar + 8, uhp, i +1);
 321          if ((key = vok_vlook(keyvar)) == NULL &&
 322                (key = ok_vlook(ssl_key)) == NULL)
 323             key = cert;
 324          else if ((x = key, key = file_expand(key)) == NULL) {
 325             key = x;
 326             goto jbkey;
 327          }
 328          if (SSL_CTX_use_PrivateKey_file(sp->s_ctx, key, SSL_FILETYPE_PEM) != 1)
 329 jbkey:
 330             fprintf(stderr, tr(238, "cannot load private key from file %s\n"),
 331                key);
 332          ac_free(keyvar);
 333       } else
 334 jbcert:
 335          fprintf(stderr, tr(239, "cannot load certificate from file %s\n"),
 336             cert);
 337    }
 338    ac_free(certvar);
 339    NYD_LEAVE;
 340 }
 341
 342 static enum okay
 343 ssl_check_host(char const *server, struct sock *sp)
 344 {
 345    char data[256];
 346    X509 *cert;
 347    X509_NAME *subj;
 348    _STACKOF(GENERAL_NAME) *gens;
 349    GENERAL_NAME *gen;
 350    int i;
 351    enum okay rv = STOP;
 352    NYD_ENTER;
 353
 354    if ((cert = SSL_get_peer_certificate(sp->s_ssl)) == NULL) {
 355       fprintf(stderr, tr(248, "no certificate from \"%s\"\n"), server);
 356       goto jleave;
 357    }
 358
 359    gens = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
 360    if (gens != NULL) {
 361       for (i = 0; i < sk_GENERAL_NAME_num(gens); ++i) {
 362          gen = sk_GENERAL_NAME_value(gens, i);
 363          if (gen->type == GEN_DNS) {
 364             if (options & OPT_VERBOSE)
 365                fprintf(stderr, "Comparing DNS name: \"%s\"\n",
 366                   gen->d.ia5->data);
 367             rv = rfc2595_hostname_match(server, (char*)gen->d.ia5->data);
 368             if (rv == OKAY)
 369                goto jdone;
 370          }
 371       }
 372    }
 373
 374    if ((subj = X509_get_subject_name(cert)) != NULL &&
 375          X509_NAME_get_text_by_NID(subj, NID_commonName, data, sizeof data)
 376             > 0) {
 377       data[sizeof data - 1] = '\0';
 378       if (options & OPT_VERBOSE)
 379          fprintf(stderr, "Comparing common name: \"%s\"\n", data);
 380       rv = rfc2595_hostname_match(server, data);
 381    }
 382 jdone:
 383    X509_free(cert);
 384 jleave:
 385    NYD_LEAVE;
 386    return rv;
 387 }
 388
 389 static int
 390 smime_verify(struct message *m, int n, _STACKOF(X509) *chain, X509_STORE *store)
 391 {
 392    char data[LINESIZE], *sender, *to, *cc, *cnttype;
 393    int rv, c, i, j;
 394    struct message *x;
 395    FILE *fp, *ip;
 396    off_t size;
 397    BIO *fb, *pb;
 398    PKCS7 *pkcs7;
 399    _STACKOF(X509) *certs;
 400    _STACKOF(GENERAL_NAME) *gens;
 401    X509 *cert;
 402    X509_NAME *subj;
 403    GENERAL_NAME *gen;
 404    NYD_ENTER;
 405
 406    rv = 1;
 407    fp = NULL;
 408    fb = NULL;
 409    verify_error_found = 0;
 410    message_number = n;
 411
 412    for (;;) {
 413       sender = getsender(m);
 414       to = hfield1("to", m);
 415       cc = hfield1("cc", m);
 416       cnttype = hfield1("content-type", m);
 417       if ((ip = setinput(&mb, m, NEED_BODY)) == NULL)
 418          goto jleave;
 419       if (cnttype && !strncmp(cnttype, "application/x-pkcs7-mime", 24)) {
 420          if ((x = smime_decrypt(m, to, cc, 1)) == NULL)
 421             goto jleave;
 422          if (x != (struct message*)-1) {
 423             m = x;
 424             continue;
 425          }
 426       }
 427       size = m->m_size;
 428       break;
 429    }
 430
 431    if ((fp = Ftmp(NULL, "smimever", OF_RDWR | OF_UNLINK | OF_REGISTER, 0600)) ==
 432          NULL) {
 433       perror("tempfile");
 434       goto jleave;
 435    }
 436    while (size-- > 0) {
 437       c = getc(ip);
 438       putc(c, fp);
 439    }
 440    fflush_rewind(fp);
 441
 442    if ((fb = BIO_new_fp(fp, BIO_NOCLOSE)) == NULL) {
 443       ssl_gen_err(tr(537,
 444          "Error creating BIO verification object for message %d"), n);
 445       goto jleave;
 446    }
 447
 448    if ((pkcs7 = SMIME_read_PKCS7(fb, &pb)) == NULL) {
 449       ssl_gen_err(tr(538, "Error reading PKCS#7 object for message %d"), n);
 450       goto jleave;
 451    }
 452    if (PKCS7_verify(pkcs7, chain, store, pb, NULL, 0) != 1) {
 453       ssl_gen_err(tr(539, "Error verifying message %d"), n);
 454       goto jleave;
 455    }
 456
 457    if (sender == NULL) {
 458       fprintf(stderr, tr(540, "Warning: Message %d has no sender.\n"), n);
 459       rv = 0;
 460       goto jleave;
 461    }
 462
 463    certs = PKCS7_get0_signers(pkcs7, chain, 0);
 464    if (certs == NULL) {
 465       fprintf(stderr, tr(541, "No certificates found in message %d.\n"), n);
 466       goto jleave;
 467    }
 468
 469    for (i = 0; i < sk_X509_num(certs); ++i) {
 470       cert = sk_X509_value(certs, i);
 471       gens = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
 472       if (gens != NULL) {
 473          for (j = 0; j < sk_GENERAL_NAME_num(gens); ++j) {
 474             gen = sk_GENERAL_NAME_value(gens, j);
 475             if (gen->type == GEN_EMAIL) {
 476                if (options & OPT_VERBOSE)
 477                   fprintf(stderr, "Comparing alt. address: %s\"\n", data);
 478                if (!asccasecmp((char*)gen->d.ia5->data, sender))
 479                   goto jfound;
 480             }
 481          }
 482       }
 483
 484       if ((subj = X509_get_subject_name(cert)) != NULL &&
 485             X509_NAME_get_text_by_NID(subj, NID_pkcs9_emailAddress,
 486                data, sizeof data) > 0) {
 487          data[sizeof data -1] = '\0';
 488          if (options & OPT_VERBOSE)
 489             fprintf(stderr, "Comparing address: \"%s\"\n", data);
 490          if (!asccasecmp(data, sender))
 491             goto jfound;
 492       }
 493    }
 494    fprintf(stderr, tr(542, "Message %d: certificate does not match <%s>\n"),
 495       n, sender);
 496    goto jleave;
 497 jfound:
 498    if (verify_error_found == 0)
 499       printf(tr(543, "Message %d was verified successfully.\n"), n);
 500    rv = verify_error_found;
 501 jleave:
 502    if (fb != NULL)
 503       BIO_free(fb);
 504    if (fp != NULL)
 505       Fclose(fp);
 506    NYD_LEAVE;
 507    return rv;
 508 }
 509
 510 static EVP_CIPHER const *
 511 _smime_cipher(char const *name)
 512 {
 513    EVP_CIPHER const *cipher;
 514    char *vn, *cp;
 515    size_t i;
 516    NYD_ENTER;
 517
 518    vn = ac_alloc(i = strlen(name) + 13 +1);
 519    snprintf(vn, (int)i, "smime-cipher-%s", name);
 520    cp = vok_vlook(vn);
 521    ac_free(vn);
 522
 523    if (cp != NULL) {
 524       cipher = NULL;
 525       for (i = 0; i < NELEM(_smime_ciphers); ++i)
 526          if (!strcmp(_smime_ciphers[i].sc_name, cp)) {
 527             cipher = (*_smime_ciphers[i].sc_fun)();
 528             goto jleave;
 529          }
 530       fprintf(stderr, tr(240, "Invalid cipher(s): %s\n"), cp);
 531    } else
 532       cipher = _SMIME_DEFAULT_CIPHER();
 533 jleave:
 534    NYD_LEAVE;
 535    return cipher;
 536 }
 537
 538 static int
 539 ssl_password_cb(char *buf, int size, int rwflag, void *userdata)
 540 {
 541    char *pass;
 542    size_t len;
 543    NYD_ENTER;
 544    UNUSED(rwflag);
 545    UNUSED(userdata);
 546
 547    if ((pass = getpassword("PEM pass phrase:")) != NULL) {
 548       len = strlen(pass);
 549       if (UICMP(z, len, >=, size))
 550          len = size -1;
 551       memcpy(buf, pass, len);
 552       buf[len] = '\0';
 553    } else
 554       len = 0;
 555    NYD_LEAVE;
 556    return (int)len;
 557 }
 558
 559 static FILE *
 560 smime_sign_cert(char const *xname, char const *xname2, bool_t dowarn)
 561 {
 562    char *vn, *cp;
 563    int vs;
 564    struct name *np;
 565    char const *name = xname, *name2 = xname2;
 566    FILE *fp = NULL;
 567    NYD_ENTER;
 568
 569 jloop:
 570    if (name) {
 571       np = lextract(name, GTO | GSKIN);
 572       while (np != NULL) {
 573          /* This needs to be more intelligent since it will currently take the
 574           * first name for which a private key is available regardless of
 575           * whether it is the right one for the message */
 576          vn = ac_alloc(vs = strlen(np->n_name) + 30);
 577          snprintf(vn, vs, "smime-sign-cert-%s", np->n_name);
 578          cp = vok_vlook(vn);
 579          ac_free(vn);
 580          if (cp != NULL)
 581             goto jopen;
 582          np = np->n_flink;
 583       }
 584       if (name2 != NULL) {
 585          name = name2;
 586          name2 = NULL;
 587          goto jloop;
 588       }
 589    }
 590
 591    if ((cp = ok_vlook(smime_sign_cert)) == NULL)
 592       goto jerr;
 593 jopen:
 594    if ((cp = file_expand(cp)) == NULL)
 595       goto jleave;
 596    if ((fp = Fopen(cp, "r")) == NULL)
 597       perror(cp);
 598 jleave:
 599    NYD_LEAVE;
 600    return fp;
 601 jerr:
 602    if (dowarn) {
 603       fprintf(stderr, tr(558, "Could not find a certificate for %s"), xname);
 604       if (xname2)
 605          fprintf(stderr, tr(559, "or %s"), xname2);
 606       fputc('\n', stderr);
 607    }
 608    goto jleave;
 609 }
 610
 611 static char *
 612 smime_sign_include_certs(char const *name)
 613 {
 614    char *rv;
 615    NYD_ENTER;
 616
 617    /* See comments in smime_sign_cert() for algorithm pitfalls */
 618    if (name != NULL) {
 619       struct name *np;
 620
 621       for (np = lextract(name, GTO | GSKIN); np != NULL; np = np->n_flink) {
 622          int vs;
 623          char *vn = ac_alloc(vs = strlen(np->n_name) + 30);
 624          snprintf(vn, vs, "smime-sign-include-certs-%s", np->n_name);
 625          rv = vok_vlook(vn);
 626          ac_free(vn);
 627          if (rv != NULL)
 628             goto jleave;
 629       }
 630    }
 631    rv = ok_vlook(smime_sign_include_certs);
 632 jleave:
 633    NYD_LEAVE;
 634    return rv;
 635 }
 636
 637 static int
 638 smime_sign_include_chain_creat(_STACKOF(X509) **chain, char const *cfiles)
 639 {
 640    X509 *tmp;
 641    FILE *fp;
 642    char *rest, *x, *ncf;
 643    NYD_ENTER;
 644
 645    *chain = sk_X509_new_null();
 646
 647    for (rest = savestr(cfiles);;) {
 648       ncf = strchr(rest, ',');/* FIXME use n_strsep(): this FIXES behaviour! */
 649       if (ncf != NULL)
 650          *ncf++ = '\0';
 651       /* This fails for '=,file' constructs, but those are sick */
 652       if (*rest == '\0')
 653          break;
 654
 655       if ((x = file_expand(rest)) == NULL ||
 656             (fp = Fopen(rest = x, "r")) == NULL) {
 657          perror(cfiles);
 658          goto jerr;
 659       }
 660       if ((tmp = PEM_read_X509(fp, NULL, &ssl_password_cb, NULL)) == NULL) {
 661          ssl_gen_err(tr(560, "Error reading certificate from \"%s\""), rest);
 662          Fclose(fp);
 663          goto jerr;
 664       }
 665       sk_X509_push(*chain, tmp);
 666       Fclose(fp);
 667
 668       if (ncf == NULL)
 669          break;
 670       rest = ncf;
 671    }
 672
 673    if (sk_X509_num(*chain) == 0) {
 674       fprintf(stderr, tr(561, "smime-sign-include-certs defined but empty\n"));
 675       goto jerr;
 676    }
 677 jleave:
 678    NYD_LEAVE;
 679    return (*chain != NULL);
 680 jerr:
 681    sk_X509_pop_free(*chain, X509_free);
 682    *chain = NULL;
 683    goto jleave;
 684 }
 685
 686 #if defined X509_V_FLAG_CRL_CHECK && defined X509_V_FLAG_CRL_CHECK_ALL
 687 static enum okay
 688 load_crl1(X509_STORE *store, char const *name)
 689 {
 690    X509_LOOKUP *lookup;
 691    enum okay rv = STOP;
 692    NYD_ENTER;
 693
 694    if (options & OPT_VERBOSE)
 695       printf("Loading CRL from \"%s\".\n", name);
 696    if ((lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file())) == NULL) {
 697       ssl_gen_err(tr(565, "Error creating X509 lookup object"));
 698       goto jleave;
 699    }
 700    if (X509_load_crl_file(lookup, name, X509_FILETYPE_PEM) != 1) {
 701       ssl_gen_err(tr(566, "Error loading CRL from \"%s\""), name);
 702       goto jleave;
 703    }
 704    rv = OKAY;
 705 jleave:
 706    NYD_LEAVE;
 707    return rv;
 708 }
 709 #endif /* new OpenSSL */
 710
 711 static enum okay
 712 load_crls(X509_STORE *store, enum okeys fok, enum okeys dok)
 713 {
 714    char *crl_file, *crl_dir;
 715 #if defined X509_V_FLAG_CRL_CHECK && defined X509_V_FLAG_CRL_CHECK_ALL
 716    DIR *dirp;
 717    struct dirent *dp;
 718    char *fn = NULL;
 719    int fs = 0, ds, es;
 720 #endif
 721    enum okay rv = STOP;
 722    NYD_ENTER;
 723
 724    if ((crl_file = _var_oklook(fok)) != NULL) {
 725 #if defined X509_V_FLAG_CRL_CHECK && defined X509_V_FLAG_CRL_CHECK_ALL
 726       if ((crl_file = file_expand(crl_file)) == NULL ||
 727             load_crl1(store, crl_file) != OKAY)
 728          goto jleave;
 729 #else
 730       fprintf(stderr, tr(567,
 731          "This OpenSSL version is too old to use CRLs.\n"));
 732       goto jleave;
 733 #endif
 734    }
 735
 736    if ((crl_dir = _var_oklook(dok)) != NULL) {
 737 #if defined X509_V_FLAG_CRL_CHECK && defined X509_V_FLAG_CRL_CHECK_ALL
 738       char *x;
 739       if ((x = file_expand(crl_dir)) == NULL ||
 740             (dirp = opendir(crl_dir = x)) == NULL) {
 741          perror(crl_dir);
 742          goto jleave;
 743       }
 744
 745       ds = strlen(crl_dir);
 746       fn = smalloc(fs = ds + 20);
 747       memcpy(fn, crl_dir, ds);
 748       fn[ds] = '/';
 749       while ((dp = readdir(dirp)) != NULL) {
 750          if (dp->d_name[0] == '.' && (dp->d_name[1] == '\0' ||
 751                (dp->d_name[1] == '.' && dp->d_name[2] == '\0')))
 752             continue;
 753          if (dp->d_name[0] == '.')
 754             continue;
 755          if (ds + (es = strlen(dp->d_name)) + 2 < fs)
 756             fn = srealloc(fn, fs = ds + es + 20);
 757          memcpy(fn + ds + 1, dp->d_name, es + 1);
 758          if (load_crl1(store, fn) != OKAY) {
 759             closedir(dirp);
 760             free(fn);
 761             goto jleave;
 762          }
 763       }
 764       closedir(dirp);
 765       free(fn);
 766 #else /* old OpenSSL */
 767       fprintf(stderr, tr(567,
 768          "This OpenSSL version is too old to use CRLs.\n"));
 769       goto jleave;
 770 #endif
 771    }
 772 #if defined X509_V_FLAG_CRL_CHECK && defined X509_V_FLAG_CRL_CHECK_ALL
 773    if (crl_file || crl_dir)
 774       X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK |
 775          X509_V_FLAG_CRL_CHECK_ALL);
 776 #endif
 777    rv = OKAY;
 778 jleave:
 779    NYD_LEAVE;
 780    return rv;
 781 }
 782
 783 FL enum okay
 784 ssl_open(char const *server, struct sock *sp, char const *uhp)
 785 {
 786    char *cp;
 787    long opts;
 788    enum okay rv = STOP;
 789    NYD_ENTER;
 790
 791    ssl_init();
 792    ssl_set_verify_level(uhp);
 793    if ((sp->s_ctx = SSL_CTX_new(UNCONST(ssl_select_method(uhp)))) == NULL) {
 794       ssl_gen_err(tr(261, "SSL_CTX_new() failed"));
 795       goto jleave;
 796    }
 797
 798 #ifdef SSL_MODE_AUTO_RETRY
 799    /* available with OpenSSL 0.9.6 or later */
 800    SSL_CTX_set_mode(sp->s_ctx, SSL_MODE_AUTO_RETRY);
 801 #endif /* SSL_MODE_AUTO_RETRY */
 802    opts = SSL_OP_ALL;
 803    if (!ok_blook(ssl_v2_allow))
 804       opts |= SSL_OP_NO_SSLv2;
 805    SSL_CTX_set_options(sp->s_ctx, opts);
 806    ssl_load_verifications(sp);
 807    ssl_certificate(sp, uhp);
 808    if ((cp = ok_vlook(ssl_cipher_list)) != NULL) {
 809       if (SSL_CTX_set_cipher_list(sp->s_ctx, cp) != 1)
 810          fprintf(stderr, tr(240, "Invalid cipher(s): %s\n"), cp);
 811    }
 812
 813    if ((sp->s_ssl = SSL_new(sp->s_ctx)) == NULL) {
 814       ssl_gen_err(tr(262, "SSL_new() failed"));
 815       goto jleave;
 816    }
 817    SSL_set_fd(sp->s_ssl, sp->s_fd);
 818    if (SSL_connect(sp->s_ssl) < 0) {
 819       ssl_gen_err(tr(263, "could not initiate SSL/TLS connection"));
 820       goto jleave;
 821    }
 822    if (ssl_verify_level != SSL_VERIFY_IGNORE) {
 823       if (ssl_check_host(server, sp) != OKAY) {
 824          fprintf(stderr, tr(249, "host certificate does not match \"%s\"\n"),
 825             server);
 826          if (ssl_verify_decide() != OKAY)
 827             goto jleave;
 828       }
 829    }
 830    sp->s_use_ssl = 1;
 831    rv = OKAY;
 832 jleave:
 833    NYD_LEAVE;
 834    return rv;
 835 }
 836
 837 FL void
 838 ssl_gen_err(char const *fmt, ...)
 839 {
 840    va_list ap;
 841    NYD_ENTER;
 842
 843    va_start(ap, fmt);
 844    vfprintf(stderr, fmt, ap);
 845    va_end(ap);
 846    SSL_load_error_strings();
 847    fprintf(stderr, ": %s\n", ERR_error_string(ERR_get_error(), NULL));
 848    NYD_LEAVE;
 849 }
 850
 851 FL int
 852 c_verify(void *vp)
 853 {
 854    int *msgvec = vp, *ip, ec = 0, rv = 1;
 855    _STACKOF(X509) *chain = NULL;
 856    X509_STORE *store;
 857    char *ca_dir, *ca_file;
 858    NYD_ENTER;
 859
 860    ssl_init();
 861
 862    ssl_verify_level = SSL_VERIFY_STRICT;
 863    if ((store = X509_STORE_new()) == NULL) {
 864       ssl_gen_err(tr(544, "Error creating X509 store"));
 865       goto jleave;
 866    }
 867    X509_STORE_set_verify_cb_func(store, ssl_verify_cb);
 868
 869    if ((ca_dir = ok_vlook(smime_ca_dir)) != NULL)
 870       ca_dir = file_expand(ca_dir);
 871    if ((ca_file = ok_vlook(smime_ca_file)) != NULL)
 872       ca_file = file_expand(ca_file);
 873
 874    if (ca_dir != NULL || ca_file != NULL) {
 875       if (X509_STORE_load_locations(store, ca_file, ca_dir) != 1) {
 876          ssl_gen_err(tr(545, "Error loading %s"),
 877             (ca_file != NULL) ? ca_file : ca_dir);
 878          goto jleave;
 879       }
 880    }
 881    if (!ok_blook(smime_no_default_ca)) {
 882       if (X509_STORE_set_default_paths(store) != 1) {
 883          ssl_gen_err(tr(546, "Error loading default CA locations"));
 884          goto jleave;
 885       }
 886    }
 887
 888    if (load_crls(store, ok_v_smime_crl_file, ok_v_smime_crl_dir) != OKAY)
 889       goto jleave;
 890    for (ip = msgvec; *ip != 0; ++ip) {
 891       struct message *mp = message + *ip - 1;
 892       setdot(mp);
 893       ec |= smime_verify(mp, *ip, chain, store);
 894    }
 895    if ((rv = ec) != 0)
 896       exit_status |= EXIT_ERR;
 897 jleave:
 898    NYD_LEAVE;
 899    return rv;
 900 }
 901
 902 FL FILE *
 903 smime_sign(FILE *ip, char const *addr)
 904 {
 905    FILE *rv = NULL, *sp = NULL, *fp = NULL, *bp, *hp;
 906    X509 *cert = NULL;
 907    _STACKOF(X509) *chain = NULL;
 908    PKCS7 *pkcs7;
 909    EVP_PKEY *pkey = NULL;
 910    BIO *bb, *sb;
 911    bool_t bail = FAL0;
 912    NYD_ENTER;
 913
 914    ssl_init();
 915
 916    if (addr == NULL) {
 917       fprintf(stderr, tr(531, "No \"from\" address for signing specified\n"));
 918       goto jleave;
 919    }
 920    if ((fp = smime_sign_cert(addr, NULL, 1)) == NULL)
 921       goto jleave;
 922
 923    if ((pkey = PEM_read_PrivateKey(fp, NULL, &ssl_password_cb, NULL)) == NULL) {
 924       ssl_gen_err(tr(532, "Error reading private key from"));
 925       goto jleave;
 926    }
 927
 928    rewind(fp);
 929    if ((cert = PEM_read_X509(fp, NULL, &ssl_password_cb, NULL)) == NULL) {
 930       ssl_gen_err(tr(533, "Error reading signer certificate from"));
 931       goto jleave;
 932    }
 933    Fclose(fp);
 934    fp = NULL;
 935
 936    if ((addr = smime_sign_include_certs(addr)) != NULL &&
 937          !smime_sign_include_chain_creat(&chain, addr))
 938       goto jleave;
 939
 940    if ((sp = Ftmp(NULL, "smimesign", OF_RDWR | OF_UNLINK | OF_REGISTER, 0600))
 941          == NULL) {
 942       perror("tempfile");
 943       goto jleave;
 944    }
 945
 946    rewind(ip);
 947    if (smime_split(ip, &hp, &bp, -1, 0) == STOP) {
 948       bail = TRU1;
 949       goto jerr1;
 950    }
 951
 952    sb = NULL;
 953    if ((bb = BIO_new_fp(bp, BIO_NOCLOSE)) == NULL ||
 954          (sb = BIO_new_fp(sp, BIO_NOCLOSE)) == NULL) {
 955       ssl_gen_err(tr(534, "Error creating BIO signing objects"));
 956       bail = TRU1;
 957       goto jerr;
 958    }
 959
 960    if ((pkcs7 = PKCS7_sign(cert, pkey, chain, bb,
 961          PKCS7_DETACHED)) == NULL) {
 962       ssl_gen_err(tr(535, "Error creating the PKCS#7 signing object"));
 963       bail = TRU1;
 964       goto jerr;
 965    }
 966    if (PEM_write_bio_PKCS7(sb, pkcs7) == 0) {
 967       ssl_gen_err(tr(536, "Error writing signed S/MIME data"));
 968       bail = TRU1;
 969       /*goto jerr*/
 970    }
 971 jerr:
 972    if (sb != NULL)
 973       BIO_free(sb);
 974    if (bb != NULL)
 975       BIO_free(bb);
 976    if (!bail) {
 977       rewind(bp);
 978       fflush_rewind(sp);
 979       rv = smime_sign_assemble(hp, bp, sp);
 980    } else
 981 jerr1:
 982       Fclose(sp);
 983
 984 jleave:
 985    if (chain != NULL)
 986       sk_X509_pop_free(chain, X509_free);
 987    if (cert != NULL)
 988       X509_free(cert);
 989    if (pkey != NULL)
 990       EVP_PKEY_free(pkey);
 991    if (fp != NULL)
 992       Fclose(fp);
 993    NYD_LEAVE;
 994    return rv;
 995 }
 996
 997 FL FILE *
 998 smime_encrypt(FILE *ip, char const *xcertfile, char const *to)
 999 {
1000    char *certfile = UNCONST(xcertfile);
1001    FILE *rv = NULL, *yp, *fp, *bp, *hp;
1002    X509 *cert;
1003    PKCS7 *pkcs7;
1004    BIO *bb, *yb;
1005    _STACKOF(X509) *certs;
1006    EVP_CIPHER const *cipher;
1007    bool_t bail = FAL0;
1008    NYD_ENTER;
1009
1010    if ((certfile = file_expand(certfile)) == NULL)
1011       goto jleave;
1012
1013    ssl_init();
1014    if ((cipher = _smime_cipher(to)) == NULL)
1015       goto jleave;
1016    if ((fp = Fopen(certfile, "r")) == NULL) {
1017       perror(certfile);
1018       goto jleave;
1019    }
1020
1021    if ((cert = PEM_read_X509(fp, NULL, &ssl_password_cb, NULL)) == NULL) {
1022       ssl_gen_err(tr(547, "Error reading encryption certificate from \"%s\""),
1023          certfile);
1024       bail = TRU1;
1025    }
1026    Fclose(fp);
1027    if (bail)
1028       goto jleave;
1029    bail = FAL0;
1030
1031    certs = sk_X509_new_null();
1032    sk_X509_push(certs, cert);
1033
1034    if ((yp = Ftmp(NULL, "smimeenc", OF_RDWR | OF_UNLINK | OF_REGISTER, 0600)) ==
1035          NULL) {
1036       perror("tempfile");
1037       goto jleave;
1038    }
1039
1040    rewind(ip);
1041    if (smime_split(ip, &hp, &bp, -1, 0) == STOP) {
1042       Fclose(yp);
1043       goto jleave;
1044    }
1045
1046    yb = NULL;
1047    if ((bb = BIO_new_fp(bp, BIO_NOCLOSE)) == NULL ||
1048          (yb = BIO_new_fp(yp, BIO_NOCLOSE)) == NULL) {
1049       ssl_gen_err(tr(548, "Error creating BIO encryption objects"));
1050       bail = TRU1;
1051       goto jerr;
1052    }
1053    if ((pkcs7 = PKCS7_encrypt(certs, bb, cipher, 0)) == NULL) {
1054       ssl_gen_err(tr(549, "Error creating the PKCS#7 encryption object"));
1055       bail = TRU1;
1056       goto jerr;
1057    }
1058    if (PEM_write_bio_PKCS7(yb, pkcs7) == 0) {
1059       ssl_gen_err(tr(550, "Error writing encrypted S/MIME data"));
1060       bail = TRU1;
1061       /* goto jerr */
1062    }
1063 jerr:
1064    if (bb != NULL)
1065       BIO_free(bb);
1066    if (yb != NULL)
1067       BIO_free(yb);
1068    Fclose(bp);
1069    if (bail)
1070       Fclose(yp);
1071    else {
1072       fflush_rewind(yp);
1073       rv = smime_encrypt_assemble(hp, yp);
1074    }
1075 jleave:
1076    NYD_LEAVE;
1077    return rv;
1078 }
1079
1080 FL struct message *
1081 smime_decrypt(struct message *m, char const *to, char const *cc, int signcall)
1082 {
1083    struct message *rv;
1084    FILE *fp, *bp, *hp, *op;
1085    X509 *cert;
1086    PKCS7 *pkcs7;
1087    EVP_PKEY *pkey;
1088    BIO *bb, *pb, *ob;
1089    long size;
1090    FILE *yp;
1091    NYD_ENTER;
1092
1093    rv = NULL;
1094    cert = NULL;
1095    pkey = NULL;
1096    size = m->m_size;
1097
1098    if ((yp = setinput(&mb, m, NEED_BODY)) == NULL)
1099       goto jleave;
1100
1101    ssl_init();
1102    if ((fp = smime_sign_cert(to, cc, 0)) != NULL) {
1103       pkey = PEM_read_PrivateKey(fp, NULL, &ssl_password_cb, NULL);
1104       if (pkey == NULL) {
1105          ssl_gen_err(tr(551, "Error reading private key"));
1106          Fclose(fp);
1107          goto jleave;
1108       }
1109       rewind(fp);
1110
1111       if ((cert = PEM_read_X509(fp, NULL, &ssl_password_cb, NULL)) == NULL) {
1112          ssl_gen_err(tr(552, "Error reading decryption certificate"));
1113          Fclose(fp);
1114          EVP_PKEY_free(pkey);
1115          goto jleave;
1116       }
1117       Fclose(fp);
1118    }
1119
1120    if ((op = Ftmp(NULL, "smimedec", OF_RDWR | OF_UNLINK | OF_REGISTER, 0600)) ==
1121          NULL) {
1122       perror("tempfile");
1123       goto j_ferr;
1124    }
1125
1126    if (smime_split(yp, &hp, &bp, size, 1) == STOP)
1127       goto jferr;
1128
1129    if ((ob = BIO_new_fp(op, BIO_NOCLOSE)) == NULL ||
1130          (bb = BIO_new_fp(bp, BIO_NOCLOSE)) == NULL) {
1131       ssl_gen_err(tr(553, "Error creating BIO decryption objects"));
1132       goto jferr;
1133    }
1134    if ((pkcs7 = SMIME_read_PKCS7(bb, &pb)) == NULL) {
1135       ssl_gen_err(tr(554, "Error reading PKCS#7 object"));
1136 jferr:
1137       Fclose(op);
1138 j_ferr:
1139       if (cert)
1140          X509_free(cert);
1141       if (pkey)
1142          EVP_PKEY_free(pkey);
1143       goto jleave;
1144    }
1145
1146    if (PKCS7_type_is_signed(pkcs7)) {
1147       if (signcall) {
1148          setinput(&mb, m, NEED_BODY);
1149          rv = (struct message*)-1;
1150          goto jerr2;
1151       }
1152       if (PKCS7_verify(pkcs7, NULL, NULL, NULL, ob,
1153             PKCS7_NOVERIFY | PKCS7_NOSIGS) != 1)
1154          goto jerr;
1155       fseek(hp, 0L, SEEK_END);
1156       fprintf(hp, "X-Encryption-Cipher: none\n");
1157       fflush(hp);
1158       rewind(hp);
1159    } else if (pkey == NULL) {
1160       fprintf(stderr, tr(555, "No appropriate private key found.\n"));
1161       goto jerr2;
1162    } else if (cert == NULL) {
1163       fprintf(stderr, tr(556, "No appropriate certificate found.\n"));
1164       goto jerr2;
1165    } else if (PKCS7_decrypt(pkcs7, pkey, cert, ob, 0) != 1) {
1166 jerr:
1167       ssl_gen_err(tr(557, "Error decrypting PKCS#7 object"));
1168 jerr2:
1169       BIO_free(bb);
1170       BIO_free(ob);
1171       Fclose(op);
1172       Fclose(bp);
1173       Fclose(hp);
1174       if (cert != NULL)
1175          X509_free(cert);
1176       if (pkey != NULL)
1177          EVP_PKEY_free(pkey);
1178       goto jleave;
1179    }
1180    BIO_free(bb);
1181    BIO_free(ob);
1182    if (cert)
1183       X509_free(cert);
1184    if (pkey)
1185       EVP_PKEY_free(pkey);
1186    fflush_rewind(op);
1187    Fclose(bp);
1188
1189    rv = smime_decrypt_assemble(m, hp, op);
1190 jleave:
1191    NYD_LEAVE;
1192    return rv;
1193 }
1194
1195 FL enum okay
1196 smime_certsave(struct message *m, int n, FILE *op)
1197 {
1198    struct message *x;
1199    char *to, *cc, *cnttype;
1200    int c, i;
1201    FILE *fp, *ip;
1202    off_t size;
1203    BIO *fb, *pb;
1204    PKCS7 *pkcs7;
1205    _STACKOF(X509) *certs, *chain = NULL;
1206    X509 *cert;
1207    enum okay rv = STOP;
1208    NYD_ENTER;
1209
1210    message_number = n;
1211 jloop:
1212    to = hfield1("to", m);
1213    cc = hfield1("cc", m);
1214    cnttype = hfield1("content-type", m);
1215    if ((ip = setinput(&mb, m, NEED_BODY)) == NULL)
1216       goto jleave;
1217    if (cnttype && !strncmp(cnttype, "application/x-pkcs7-mime", 24)) {
1218       if ((x = smime_decrypt(m, to, cc, 1)) == NULL)
1219          goto jleave;
1220       if (x != (struct message*)-1) {
1221          m = x;
1222          goto jloop;
1223       }
1224    }
1225    size = m->m_size;
1226
1227    if ((fp = Ftmp(NULL, "smimecert", OF_RDWR | OF_UNLINK | OF_REGISTER, 0600))
1228          == NULL) {
1229       perror("tempfile");
1230       goto jleave;
1231    }
1232
1233    while (size-- > 0) {
1234       c = getc(ip);
1235       putc(c, fp);
1236    }
1237    fflush(fp);
1238
1239    rewind(fp);
1240    if ((fb = BIO_new_fp(fp, BIO_NOCLOSE)) == NULL) {
1241       ssl_gen_err("Error creating BIO object for message %d", n);
1242       Fclose(fp);
1243       goto jleave;
1244    }
1245
1246    if ((pkcs7 = SMIME_read_PKCS7(fb, &pb)) == NULL) {
1247       ssl_gen_err(tr(562, "Error reading PKCS#7 object for message %d"), n);
1248       BIO_free(fb);
1249       Fclose(fp);
1250       goto jleave;
1251    }
1252    BIO_free(fb);
1253    Fclose(fp);
1254    certs = PKCS7_get0_signers(pkcs7, chain, 0);
1255    if (certs == NULL) {
1256       fprintf(stderr, tr(563, "No certificates found in message %d\n"), n);
1257       goto jleave;
1258    }
1259
1260    for (i = 0; i < sk_X509_num(certs); ++i) {
1261       cert = sk_X509_value(certs, i);
1262       if (X509_print_fp(op, cert) == 0 || PEM_write_X509(op, cert) == 0) {
1263          ssl_gen_err(tr(564, "Error writing certificate %d from message %d"),
1264             i, n);
1265          goto jleave;
1266       }
1267    }
1268    rv = OKAY;
1269 jleave:
1270    NYD_LEAVE;
1271    return rv;
1272 }
1273 #endif /* HAVE_OPENSSL */
1274
1275 /* vim:set fenc=utf-8:s-it-mode */