lib/hx509/hxtool.c

41 static hx509_context context;
194 	hx509_context_set_missing_revoke(context, 1);
196     hx509_lock_init(context, &lock);
199     ret = hx509_verify_init_ctx(context, &ctx);
201 	hx509_err(context, 1, ret, "hx509_verify_init_ctx");
203     ret = hx509_certs_init(context, "MEMORY:cms-anchors", 0, NULL, &anchors);
205 	hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
206     ret = hx509_certs_init(context, "MEMORY:cert-store", 0, NULL, &store);
208 	hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
210     certs_strings(context, "anchors", anchors, lock, &opt->anchors_strings);
211     certs_strings(context, "store", store, lock, &opt->certificate_strings);
224 	ret = hx509_pem_read(context, f, pem_reader, &pd);
288     ret = hx509_cms_verify_signed(context, ctx, flags, co.data, co.length, sd,
295 	hx509_err(context, 1, ret, "hx509_cms_verify_signed");
308 	hx509_certs_iter_f(context, signers, hx509_ci_print_names, stdout);
382     hx509_lock_init(context, &lock);
385     ret = hx509_certs_init(context, "MEMORY:cert-store", 0, NULL, &store);
386     if (ret) hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
387     ret = hx509_certs_init(context, "MEMORY:cert-pool", 0, NULL, &pool);
388     if (ret) hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
390     certs_strings(context, "store", store, lock, &opt->certificate_strings);
391     certs_strings(context, "pool", pool, lock, &opt->pool_strings);
394 	ret = hx509_certs_init(context, "MEMORY:cert-anchors",
396 	if (ret) hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
397 	certs_strings(context, "anchors", anchors, lock, &opt->anchors_strings);
411 	ret = hx509_query_alloc(context, &q);
421 	ret = hx509_certs_filter(context, store, q, &signer);
422 	hx509_query_free(context, q);
424 	    hx509_err(context, 1, ret, "hx509_certs_find");
436 	peer_strings(context, &peer, &opt->peer_alg_strings);
440     ret = hx509_cms_create_signed(context,
452 	hx509_err(context, 1, ret, "hx509_cms_create_signed: %d", ret);
481 	    ret = hx509_certs_iter_f(context, signer, print_signer, header);
483 		hx509_err(context, 1, ret, "print signer");
490 	ret = hx509_pem_write(context, "CMS SIGNEDDATA", header, f,
521     hx509_lock_init(context, &lock);
546     ret = hx509_certs_init(context, "MEMORY:cert-store", 0, NULL, &certs);
550     certs_strings(context, "store", certs, lock, &opt->certificate_strings);
555     ret = hx509_cms_unenvelope(context, certs, flags, co.data, co.length,
560 	hx509_err(context, 1, ret, "hx509_cms_unenvelope");
593     hx509_lock_init(context, &lock);
600     ret = hx509_certs_init(context, "MEMORY:cert-store", 0, NULL, &certs);
601     if (ret) hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
603     certs_strings(context, "store", certs, lock, &opt->certificate_strings);
615     ret = hx509_query_alloc(context, &q);
621     ret = hx509_certs_find(context, certs, q, &cert);
622     hx509_query_free(context, q);
628     ret = hx509_cms_envelope_1(context, flags, cert, p, sz, enctype,
702     print_certificate(context, cert, s->verbose);
717     hx509_lock_init(context, &lock);
722 	ret = hx509_certs_init(context, argv[0], 0, lock, &certs);
728 	    hx509_err(context, 1, ret, "hx509_certs_init");
731 	    hx509_certs_info(context, certs, NULL, NULL);
732 	hx509_certs_iter_f(context, certs, print_f, &s);
757     hx509_lock_init(context, &lock);
760     hx509_validate_ctx_init(context, &ctx);
766 	ret = hx509_certs_init(context, argv[0], 0, lock, &certs);
769 	hx509_certs_iter_f(context, certs, validate_f, ctx);
787     hx509_lock_init(context, &inlock);
791 	hx509_lock_init(context, &outlock);
798     ret = hx509_certs_init(context, argv[argc - 1],
801 	hx509_err(context, 1, ret, "hx509_certs_init");
805 	retx = hx509_certs_append(context, certs, inlock, argv[0]);
807 	    hx509_err(context, 1, retx, "hx509_certs_append");
811     ret = hx509_certs_store(context, certs, 0, outlock);
813 	    hx509_err(context, 1, ret, "hx509_certs_store");
871 	hx509_context_set_missing_revoke(context, 1);
873     ret = hx509_verify_init_ctx(context, &ctx);
875 	hx509_err(context, 1, ret, "hx509_verify_init_ctx");
876     ret = hx509_certs_init(context, "MEMORY:anchors", 0, NULL, &anchors);
878 	hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
879     ret = hx509_certs_init(context, "MEMORY:chain", 0, NULL, &chain);
881 	hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
882     ret = hx509_certs_init(context, "MEMORY:certs", 0, NULL, &certs);
884 	hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
911     ret = hx509_revoke_init(context, &revoke_ctx);
921 	    ret = hx509_certs_append(context, chain, NULL, s);
923 		hx509_err(context, 1, ret, "hx509_certs_append: chain: %s: %d", s, ret);
928 	    ret = hx509_certs_append(context, anchors, NULL, s);
930 		hx509_err(context, 1, ret, "hx509_certs_append: anchor: %s: %d", s, ret);
935 	    ret = hx509_certs_append(context, certs, NULL, s);
937 		hx509_err(context, 1, ret, "hx509_certs_append: certs: %s: %d",
943 	    ret = hx509_revoke_add_crl(context, revoke_ctx, s);
950 	    ret = hx509_revoke_add_ocsp(context, revoke_ctx, s);
965     hx509_certs_iter_f(context, certs, verify_f, &v);
998     ret = hx509_query_alloc(context, &q);
1002     hx509_lock_init(context, &lock);
1005     ret = hx509_certs_init(context, "MEMORY:cert-store", 0, NULL, &certs);
1006     if (ret) hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
1010 	ret = hx509_certs_append(context, certs, lock, argv[0]);
1042 	hx509_query_match_expr(context, q, opt->expr_string);
1044     ret = hx509_certs_find(context, certs, q, &c);
1045     hx509_query_free(context, q);
1051 	    print_certificate(context, c, 0);
1074     hx509_lock_init(context, &lock);
1084     ret = hx509_certs_init(context, "MEMORY:ocsp-pool", 0, NULL, &pool);
1085     if (ret) hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
1087     certs_strings(context, "ocsp-pool", pool, lock, &opt->pool_strings);
1091     ret = hx509_certs_init(context, "MEMORY:ocsp-req", 0, NULL, &reqcerts);
1092     if (ret) hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
1095 	ret = hx509_certs_append(context, reqcerts, lock, argv[i]);
1100     ret = hx509_ocsp_request(context, reqcerts, pool, NULL, NULL, &req, nonce);
1134     hx509_revoke_ocsp_print(context, argv[0], stdout);
1149     ret = hx509_ocsp_verify(context, 0, c, 0,
1170     hx509_lock_init(context, &lock);
1179     ret = hx509_certs_init(context, "MEMORY:test-certs", 0, NULL, &certs);
1180     if (ret) hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
1183 	ret = hx509_certs_append(context, certs, lock, argv[i]);
1185 	    hx509_err(context, 1, ret, "hx509_certs_append: %s", argv[i]);
1188     ret = hx509_certs_iter_f(context, certs, verify_o, &os);
1206     ret = hx509_certs_init(context, fn, 0, NULL, &certs);
1208 	hx509_err(context, 1, ret, "hx509_certs_init: %s", fn);
1210     ret = _hx509_certs_keys_get(context, certs, &keys);
1213 	hx509_err(context, 1, ret, "hx509_certs_keys_get");
1218     _hx509_certs_keys_free(context, keys);
1297     hx509_request_init(context, &req);
1302 	ret = hx509_parse_name(context, opt->subject_string, &name);
1305 	hx509_request_set_name(context, req, name);
1316 	ret = _hx509_request_add_email(context, req,
1319 	    hx509_err(context, 1, ret, "hx509_request_add_email");
1323 	ret = _hx509_request_add_dns_name(context, req,
1326 	    hx509_err(context, 1, ret, "hx509_request_add_dns_name");
1330     ret = hx509_private_key2SPKI(context, signer, &key);
1334     ret = hx509_request_set_SubjectPublicKeyInfo(context,
1339 	hx509_err(context, 1, ret, "hx509_request_set_SubjectPublicKeyInfo");
1341     ret = _hx509_request_to_pkcs10(context,
1346 	hx509_err(context, 1, ret, "_hx509_request_to_pkcs10");
1368 	ret = _hx509_request_parse(context, argv[i], &req);
1370 	    hx509_err(context, 1, ret, "parse_request: %s", argv[i]);
1372 	ret = _hx509_request_print(context, req, stdout);
1375 	    hx509_err(context, 1, ret, "Failed to print file %s", argv[i]);
1467     ret = hx509_crypto_available(context, type, NULL, &val, &len);
1503 	peer_strings(context, &peer, &opt->peer_cmstype_strings);
1505     ret = hx509_crypto_select(context, type, NULL, peer, &selected);
1594     ret = hx509_ca_tbs_add_eku(context, tbs, &asn1_oid_id_ms_client_authentication);
1598     return hx509_ca_tbs_add_eku(context, tbs, &asn1_oid_id_pkinit_ms_eku);
1781 	ret = hx509_certs_init(context, opt->ca_certificate_string, 0,
1784 	    hx509_err(context, 1, ret,
1787 	ret = hx509_query_alloc(context, &q);
1795 	ret = hx509_certs_find(context, cacerts, q, &signer);
1796 	hx509_query_free(context, q);
1799 	    hx509_err(context, 1, ret, "no CA certificate found");
1816 	ret = hx509_private_key2SPKI(context, private_key, &spki);
1827 	ret = _hx509_request_parse(context, opt->req_string, &req);
1829 	    hx509_err(context, 1, ret, "parse_request: %s", opt->req_string);
1830 	ret = hx509_request_get_name(context, req, &subject);
1832 	    hx509_err(context, 1, ret, "get name");
1833 	ret = hx509_request_get_SubjectPublicKeyInfo(context, req, &spki);
1835 	    hx509_err(context, 1, ret, "get spki");
1842 	ret = _hx509_generate_private_key_init(context,
1846 	    hx509_err(context, 1, ret, "generate private key");
1849 	    _hx509_generate_private_key_is_ca(context, keyctx);
1852 	    _hx509_generate_private_key_bits(context, keyctx,
1855 	ret = _hx509_generate_private_key(context, keyctx,
1859 	    hx509_err(context, 1, ret, "generate private key");
1861 	ret = hx509_private_key2SPKI(context, cert_key, &spki);
1878 	ret = hx509_parse_name(context, opt->subject_string, &subject);
1880 	    hx509_err(context, 1, ret, "hx509_parse_name");
1887     ret = hx509_ca_tbs_init(context, &tbs);
1889 	hx509_err(context, 1, ret, "hx509_ca_tbs_init");
1896 	ret = hx509_certs_init(context, opt->template_certificate_string, 0,
1899 	    hx509_err(context, 1, ret,
1902 	ret = hx509_get_one_cert(context, tcerts, &template);
1906 	    hx509_err(context, 1, ret, "no template certificate found");
1911 	ret = hx509_ca_tbs_set_template(context, tbs, flags, template);
1913 	    hx509_err(context, 1, ret, "hx509_ca_tbs_set_template");
1925 	ret = hx509_ca_tbs_set_serialnumber(context, tbs, &serialNumber);
1927 	    hx509_err(context, 1, ret, "hx509_ca_tbs_init");
1932 	ret = hx509_ca_tbs_set_spki(context, tbs, &spki);
1934 	    hx509_err(context, 1, ret, "hx509_ca_tbs_set_spki");
1938 	ret = hx509_ca_tbs_set_subject(context, tbs, subject);
1940 	    hx509_err(context, 1, ret, "hx509_ca_tbs_set_subject");
1944 	ret = hx509_ca_tbs_add_crl_dp_uri(context, tbs,
1947 	    hx509_err(context, 1, ret, "hx509_ca_tbs_add_crl_dp_uri");
1950     eval_types(context, tbs, opt);
1953 	ret = hx509_ca_tbs_set_ca(context, tbs, opt->path_length_integer);
1955 	    hx509_err(context, 1, ret, "hx509_ca_tbs_set_ca");
1958 	ret = hx509_ca_tbs_set_proxy(context, tbs, opt->path_length_integer);
1960 	    hx509_err(context, 1, ret, "hx509_ca_tbs_set_proxy");
1963 	hx509_ca_tbs_set_domaincontroller(context, tbs);
1965 	    hx509_err(context, 1, ret, "hx509_ca_tbs_set_domaincontroller");
1969 	ret = hx509_ca_tbs_set_notAfter_lifetime(context, tbs, delta);
1971 	    hx509_err(context, 1, ret, "hx509_ca_tbs_set_notAfter_lifetime");
1975 	ret = hx509_ca_sign_self(context, tbs, private_key, &cert);
1977 	    hx509_err(context, 1, ret, "hx509_ca_sign_self");
1979 	ret = hx509_ca_sign(context, tbs, signer, &cert);
1981 	    hx509_err(context, 1, ret, "hx509_ca_sign");
1987 	    hx509_err(context, 1, ret, "_hx509_cert_assign_key");
1993 	ret = hx509_certs_init(context, opt->certificate_string,
1996 	    hx509_err(context, 1, ret, "hx509_certs_init");
1998 	ret = hx509_certs_add(context, certs, cert);
2000 	    hx509_err(context, 1, ret, "hx509_certs_add");
2002 	ret = hx509_certs_store(context, certs, 0, NULL);
2004 	    hx509_err(context, 1, ret, "hx509_certs_store");
2037     ret = hx509_cms_create_signed_1(context, 0, NULL, NULL, 0,
2042     ret = hx509_cms_verify_signed(context, vctx, 0, sd.data, sd.length,
2046 	hx509_err(context, 1, ret, "hx509_cms_verify_signed");
2063     hx509_lock_init(context, &lock);
2066     ret = hx509_certs_init(context, "MEMORY:test-crypto", 0, NULL, &certs);
2067     if (ret) hx509_err(context, 1, ret, "hx509_certs_init: MEMORY");
2070 	ret = hx509_certs_append(context, certs, lock, argv[i]);
2072 	    hx509_err(context, 1, ret, "hx509_certs_append");
2075     ret = hx509_verify_init_ctx(context, &vctx);
2077 	hx509_err(context, 1, ret, "hx509_verify_init_ctx");
2081     ret = hx509_certs_iter_f(context, certs, test_one_cert, vctx);
2083 	hx509_err(context, 1, ret, "hx509_cert_iter");
2101     hx509_query_unparse_stats(context, type, stdout);
2118     hx509_lock_init(context, &lock);
2121     ret = hx509_crl_alloc(context, &crl);
2132 	ret = hx509_certs_init(context, opt->signer_string, 0,
2135 	    hx509_err(context, 1, ret,
2138 	ret = hx509_query_alloc(context, &q);
2140 	    hx509_err(context, 1, ret, "hx509_query_alloc: %d", ret);
2144 	ret = hx509_certs_find(context, certs, q, &signer);
2145 	hx509_query_free(context, q);
2148 	    hx509_err(context, 1, ret, "no signer certificate found");
2158 	hx509_crl_lifetime(context, crl, delta);
2165 	ret = hx509_certs_init(context, "MEMORY:revoked-certs", 0,
2168 	    hx509_err(context, 1, ret,
2172 	    ret = hx509_certs_append(context, revoked, lock, argv[i]);
2174 		hx509_err(context, 1, ret, "hx509_certs_append: %s", argv[i]);
2177 	hx509_crl_add_revoked_certs(context, crl, revoked);
2181     hx509_crl_sign(context, signer, crl, &os);
2188     hx509_crl_free(context, &crl);
2227     ret = hx509_context_init(&context);
2232 	hx509_query_statistic_file(context, stat_file_string);
2238     hx509_context_free(&context);