790656c62bef76623f74123c881d56bef817f772
[strongswan.git] / src / pki / commands / pkcs7.c
1 /*
2 * Copyright (C) 2012 Martin Willi
3 * Copyright (C) 2012 revosec AG
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "pki.h"
17
18 #include <asn1/oid.h>
19 #include <asn1/asn1.h>
20 #include <credentials/containers/pkcs7.h>
21 #include <credentials/sets/mem_cred.h>
22
23 /**
24 * Read input data as chunk
25 */
26 static chunk_t read_from_stream(FILE *stream)
27 {
28 char buf[8096];
29 size_t len, total = 0;
30
31 while (TRUE)
32 {
33 len = fread(buf + total, 1, sizeof(buf) - total, stream);
34 if (len < (sizeof(buf) - total))
35 {
36 if (ferror(stream))
37 {
38 return chunk_empty;
39 }
40 if (feof(stream))
41 {
42 return chunk_clone(chunk_create(buf, total + len));
43 }
44 }
45 total += len;
46 if (total == sizeof(buf))
47 {
48 fprintf(stderr, "buffer too small to read input!\n");
49 return chunk_empty;
50 }
51 }
52 }
53
54 /**
55 * Write output data from chunk to stream
56 */
57 static bool write_to_stream(FILE *stream, chunk_t data)
58 {
59 size_t len, total = 0;
60
61 while (total < data.len)
62 {
63 len = fwrite(data.ptr + total, 1, data.len - total, stream);
64 if (len <= 0)
65 {
66 return FALSE;
67 }
68 total += len;
69 }
70 return TRUE;
71 }
72
73 /**
74 * Verify PKCS#7 signed-data
75 */
76 static int verify(chunk_t chunk)
77 {
78 container_t *container;
79 pkcs7_t *pkcs7;
80 enumerator_t *enumerator;
81 certificate_t *cert;
82 auth_cfg_t *auth;
83 chunk_t data;
84 time_t t;
85 bool verified = FALSE;
86
87 container = lib->creds->create(lib->creds, CRED_CONTAINER, CONTAINER_PKCS7,
88 BUILD_BLOB_ASN1_DER, chunk, BUILD_END);
89 if (!container)
90 {
91 return 1;
92 }
93
94 if (container->get_type(container) != CONTAINER_PKCS7_SIGNED_DATA)
95 {
96 fprintf(stderr, "verification failed, container is %N\n",
97 container_type_names, container->get_type(container));
98 container->destroy(container);
99 return 1;
100 }
101
102 pkcs7 = (pkcs7_t*)container;
103 enumerator = container->create_signature_enumerator(container);
104 while (enumerator->enumerate(enumerator, &auth))
105 {
106 verified = TRUE;
107 cert = auth->get(auth, AUTH_RULE_SUBJECT_CERT);
108 if (cert)
109 {
110 fprintf(stderr, "signed by '%Y'", cert->get_subject(cert));
111
112 if (pkcs7->get_attribute(pkcs7, OID_PKCS9_SIGNING_TIME,
113 enumerator, &data))
114 {
115 t = asn1_to_time(&data, ASN1_UTCTIME);
116 if (t != UNDEFINED_TIME)
117 {
118 fprintf(stderr, " at %T", &t, FALSE);
119 }
120 free(data.ptr);
121 }
122 fprintf(stderr, "\n");
123 }
124 }
125 enumerator->destroy(enumerator);
126
127 if (!verified)
128 {
129 fprintf(stderr, "no trusted signature found\n");
130 }
131
132 if (verified)
133 {
134 if (container->get_data(container, &data))
135 {
136 write_to_stream(stdout, data);
137 free(data.ptr);
138 }
139 else
140 {
141 verified = FALSE;
142 }
143 }
144 container->destroy(container);
145
146 return verified ? 0 : 1;
147 }
148
149 /**
150 * Sign data into PKCS#7 signed-data
151 */
152 static int sign(chunk_t chunk, certificate_t *cert, private_key_t *key)
153 {
154 container_t *container;
155 chunk_t encoding;
156 int res = 1;
157
158 container = lib->creds->create(lib->creds,
159 CRED_CONTAINER, CONTAINER_PKCS7_SIGNED_DATA,
160 BUILD_BLOB, chunk,
161 BUILD_SIGNING_CERT, cert,
162 BUILD_SIGNING_KEY, key,
163 BUILD_END);
164 if (container)
165 {
166 if (container->get_encoding(container, &encoding))
167 {
168 write_to_stream(stdout, encoding);
169 free(encoding.ptr);
170 }
171 container->destroy(container);
172 }
173 return res;
174 }
175
176 /**
177 * Encrypt data to a PKCS#7 enveloped-data
178 */
179 static int encrypt(chunk_t chunk, certificate_t *cert)
180 {
181 container_t *container;
182 chunk_t encoding;
183 int res = 1;
184
185 container = lib->creds->create(lib->creds,
186 CRED_CONTAINER, CONTAINER_PKCS7_ENVELOPED_DATA,
187 BUILD_BLOB, chunk, BUILD_CERT, cert,
188 BUILD_END);
189 if (container)
190 {
191 if (container->get_encoding(container, &encoding))
192 {
193 write_to_stream(stdout, encoding);
194 free(encoding.ptr);
195 }
196 container->destroy(container);
197 }
198 return res;
199 }
200
201 /**
202 * Decrypt PKCS#7 enveloped-data
203 */
204 static int decrypt(chunk_t chunk)
205 {
206 container_t *container;
207 chunk_t data;
208
209 container = lib->creds->create(lib->creds, CRED_CONTAINER, CONTAINER_PKCS7,
210 BUILD_BLOB_ASN1_DER, chunk, BUILD_END);
211 if (!container)
212 {
213 return 1;
214 }
215 if (container->get_type(container) != CONTAINER_PKCS7_ENVELOPED_DATA)
216 {
217 fprintf(stderr, "decryption failed, container is %N\n",
218 container_type_names, container->get_type(container));
219 container->destroy(container);
220 return 1;
221 }
222 if (!container->get_data(container, &data))
223 {
224 fprintf(stderr, "PKCS#7 decryption failed\n");
225 container->destroy(container);
226 return 1;
227 }
228 container->destroy(container);
229
230 write_to_stream(stdout, data);
231 free(data.ptr);
232
233 return 0;
234 }
235
236 /**
237 * Show info about PKCS#7 container
238 */
239 static int show(chunk_t chunk)
240 {
241 container_t *container;
242 pkcs7_t *pkcs7;
243 enumerator_t *enumerator;
244 certificate_t *cert;
245 chunk_t data;
246
247 container = lib->creds->create(lib->creds, CRED_CONTAINER, CONTAINER_PKCS7,
248 BUILD_BLOB_ASN1_DER, chunk, BUILD_END);
249 if (!container)
250 {
251 return 1;
252 }
253 fprintf(stderr, "%N\n", container_type_names, container->get_type(container));
254
255 if (container->get_type(container) == CONTAINER_PKCS7_SIGNED_DATA)
256 {
257 pkcs7 = (pkcs7_t*)container;
258 enumerator = pkcs7->create_cert_enumerator(pkcs7);
259 while (enumerator->enumerate(enumerator, &cert))
260 {
261 if (cert->get_encoding(cert, CERT_PEM, &data))
262 {
263 printf("%.*s", (int)data.len, data.ptr);
264 free(data.ptr);
265 }
266 }
267 enumerator->destroy(enumerator);
268 }
269 container->destroy(container);
270 return 0;
271 }
272
273 /**
274 * Wrap/Unwrap PKCs#7 containers
275 */
276 static int pkcs7()
277 {
278 char *arg, *file = NULL;
279 private_key_t *key = NULL;
280 certificate_t *cert = NULL;
281 chunk_t data = chunk_empty;
282 mem_cred_t *creds;
283 int res = 1;
284 FILE *in;
285 enum {
286 OP_NONE,
287 OP_SIGN,
288 OP_VERIFY,
289 OP_ENCRYPT,
290 OP_DECRYPT,
291 OP_SHOW,
292 } op = OP_NONE;
293
294 creds = mem_cred_create();
295
296 while (TRUE)
297 {
298 switch (command_getopt(&arg))
299 {
300 case 'h':
301 creds->destroy(creds);
302 return command_usage(NULL);
303 case 'i':
304 file = arg;
305 continue;
306 case 's':
307 if (op != OP_NONE)
308 {
309 goto invalid;
310 }
311 op = OP_SIGN;
312 continue;
313 case 'u':
314 if (op != OP_NONE)
315 {
316 goto invalid;
317 }
318 op = OP_VERIFY;
319 continue;
320 case 'e':
321 if (op != OP_NONE)
322 {
323 goto invalid;
324 }
325 op = OP_ENCRYPT;
326 continue;
327 case 'd':
328 if (op != OP_NONE)
329 {
330 goto invalid;
331 }
332 op = OP_DECRYPT;
333 continue;
334 case 'p':
335 if (op != OP_NONE)
336 {
337 goto invalid;
338 }
339 op = OP_SHOW;
340 continue;
341 case 'k':
342 key = lib->creds->create(lib->creds,
343 CRED_PRIVATE_KEY, KEY_RSA,
344 BUILD_FROM_FILE, arg, BUILD_END);
345 if (!key)
346 {
347 fprintf(stderr, "parsing private key failed\n");
348 goto end;
349 }
350 creds->add_key(creds, key);
351 continue;
352 case 'c':
353 cert = lib->creds->create(lib->creds,
354 CRED_CERTIFICATE, CERT_X509,
355 BUILD_FROM_FILE, arg, BUILD_END);
356 if (!cert)
357 {
358 fprintf(stderr, "parsing certificate failed\n");
359 goto end;
360 }
361 creds->add_cert(creds, TRUE, cert);
362 continue;
363 case EOF:
364 break;
365 default:
366 invalid:
367 creds->destroy(creds);
368 return command_usage("invalid --pkcs7 option");
369 }
370 break;
371 }
372
373 if (file)
374 {
375 in = fopen(file, "r");
376 if (in)
377 {
378 data = read_from_stream(in);
379 fclose(in);
380 }
381 }
382 else
383 {
384 data = read_from_stream(stdin);
385 }
386
387 if (!data.len)
388 {
389 fprintf(stderr, "reading input failed!\n");
390 goto end;
391 }
392 if (op != OP_SHOW && !cert)
393 {
394 fprintf(stderr, "requiring a certificate!\n");
395 goto end;
396 }
397
398 lib->credmgr->add_local_set(lib->credmgr, &creds->set, FALSE);
399
400 switch (op)
401 {
402 case OP_SIGN:
403 if (!key)
404 {
405 fprintf(stderr, "signing requires a private key\n");
406 res = 1;
407 break;
408 }
409 res = sign(data, cert, key);
410 break;
411 case OP_VERIFY:
412 res = verify(data);
413 break;
414 case OP_ENCRYPT:
415 res = encrypt(data, cert);
416 break;
417 case OP_DECRYPT:
418 if (!key)
419 {
420 fprintf(stderr, "decryption requires a private key\n");
421 res = 1;
422 break;
423 }
424 res = decrypt(data);
425 break;
426 case OP_SHOW:
427 res = show(data);
428 break;
429 default:
430 res = 1;
431 break;
432 }
433 lib->credmgr->remove_local_set(lib->credmgr, &creds->set);
434
435 end:
436 creds->destroy(creds);
437 free(data.ptr);
438 return res;
439 }
440
441 /**
442 * Register the command.
443 */
444 static void __attribute__ ((constructor))reg()
445 {
446 command_register((command_t) {
447 pkcs7, '7', "pkcs7", "PKCS#7 wrap/unwrap functions",
448 {"--sign | --verify | --encrypt | --decrypt",
449 "--certificate+ [--key]"},
450 {
451 {"help", 'h', 0, "show usage information"},
452 {"sign", 's', 0, "create PKCS#7 signed-data"},
453 {"verify", 'u', 0, "verify PKCS#7 signed-data"},
454 {"encrypt", 'e', 0, "create PKCS#7 enveloped-data"},
455 {"decrypt", 'd', 0, "decrypt PKCS#7 enveloped-data"},
456 {"show", 'p', 0, "show info about PKCS#7, print certificates"},
457 {"in", 'i', 1, "input file, default: stdin"},
458 {"key", 'k', 1, "path to private key for sign/decryp"},
459 {"cert", 'c', 1, "path to certificate for sign/verify/encryp"},
460 }
461 });
462 }