1/* 2 curlx.c Authors: Peter Sylvester, Jean-Paul Merlin 3 4 This is a little program to demonstrate the usage of 5 6 - an ssl initialisation callback setting a user key and trustbases 7 coming from a pkcs12 file 8 - using an ssl application callback to find a URI in the 9 certificate presented during ssl session establishment. 10 11*/ 12 13 14/* 15 * Copyright (c) 2003 The OpenEvidence Project. All rights reserved. 16 * 17 * Redistribution and use in source and binary forms, with or without 18 * modification, are permitted provided that the following conditions 19 * are met: 20 * 21 * 1. Redistributions of source code must retain the above copyright 22 * notice, this list of conditions, the following disclaimer, 23 * and the original OpenSSL and SSLeay Licences below. 24 * 25 * 2. Redistributions in binary form must reproduce the above copyright 26 * notice, this list of conditions, the following disclaimer 27 * and the original OpenSSL and SSLeay Licences below in 28 * the documentation and/or other materials provided with the 29 * distribution. 30 * 31 * 3. All advertising materials mentioning features or use of this 32 * software must display the following acknowledgments: 33 * "This product includes software developed by the Openevidence Project 34 * for use in the OpenEvidence Toolkit. (http://www.openevidence.org/)" 35 * This product includes software developed by the OpenSSL Project 36 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 37 * This product includes cryptographic software written by Eric Young 38 * (eay@cryptsoft.com). This product includes software written by Tim 39 * Hudson (tjh@cryptsoft.com)." 40 * 41 * 4. The names "OpenEvidence Toolkit" and "OpenEvidence Project" must not be 42 * used to endorse or promote products derived from this software without 43 * prior written permission. For written permission, please contact 44 * openevidence-core@openevidence.org. 45 * 46 * 5. Products derived from this software may not be called "OpenEvidence" 47 * nor may "OpenEvidence" appear in their names without prior written 48 * permission of the OpenEvidence Project. 49 * 50 * 6. Redistributions of any form whatsoever must retain the following 51 * acknowledgments: 52 * "This product includes software developed by the OpenEvidence Project 53 * for use in the OpenEvidence Toolkit (http://www.openevidence.org/) 54 * This product includes software developed by the OpenSSL Project 55 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 56 * This product includes cryptographic software written by Eric Young 57 * (eay@cryptsoft.com). This product includes software written by Tim 58 * Hudson (tjh@cryptsoft.com)." 59 * 60 * THIS SOFTWARE IS PROVIDED BY THE OpenEvidence PROJECT ``AS IS'' AND ANY 61 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 62 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 63 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenEvidence PROJECT OR 64 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 65 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 66 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 67 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 68 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 69 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 70 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 71 * OF THE POSSIBILITY OF SUCH DAMAGE. 72 * ==================================================================== 73 * 74 * This product includes software developed by the OpenSSL Project 75 * for use in the OpenSSL Toolkit (http://www.openssl.org/) 76 * This product includes cryptographic software written by Eric Young 77 * (eay@cryptsoft.com). This product includes software written by Tim 78 * Hudson (tjh@cryptsoft.com). 79 * 80 */ 81 82#include <stdio.h> 83#include <stdlib.h> 84#include <string.h> 85#include <curl/curl.h> 86#include <openssl/x509v3.h> 87#include <openssl/x509_vfy.h> 88#include <openssl/crypto.h> 89#include <openssl/lhash.h> 90#include <openssl/objects.h> 91#include <openssl/err.h> 92#include <openssl/evp.h> 93#include <openssl/x509.h> 94#include <openssl/pkcs12.h> 95#include <openssl/bio.h> 96#include <openssl/ssl.h> 97 98static const char *curlx_usage[]={ 99 "usage: curlx args\n", 100 " -p12 arg - tia file ", 101 " -envpass arg - environement variable which content the tia private key password", 102 " -out arg - output file (response)- default stdout", 103 " -in arg - input file (request)- default stdin", 104 " -connect arg - URL of the server for the connection ex: www.openevidence.org", 105 " -mimetype arg - MIME type for data in ex : application/timestamp-query or application/dvcs -default application/timestamp-query", 106 " -acceptmime arg - MIME type acceptable for the response ex : application/timestamp-response or application/dvcs -default none", 107 " -accesstype arg - an Object identifier in an AIA/SIA method, e.g. AD_DVCS or ad_timestamping", 108 NULL 109}; 110 111/* 112 113./curlx -p12 psy.p12 -envpass XX -in request -verbose -accesstype AD_DVCS 114-mimetype application/dvcs -acceptmime application/dvcs -out response 115 116*/ 117 118/* 119 * We use this ZERO_NULL to avoid picky compiler warnings, 120 * when assigning a NULL pointer to a function pointer var. 121 */ 122 123#define ZERO_NULL 0 124 125/* This is a context that we pass to all callbacks */ 126 127typedef struct sslctxparm_st { 128 unsigned char * p12file ; 129 const char * pst ; 130 PKCS12 * p12 ; 131 EVP_PKEY * pkey ; 132 X509 * usercert ; 133 STACK_OF(X509) * ca ; 134 CURL * curl; 135 BIO * errorbio; 136 int accesstype ; 137 int verbose; 138 139} sslctxparm; 140 141/* some helper function. */ 142 143static char *i2s_ASN1_IA5STRING( ASN1_IA5STRING *ia5) 144{ 145 char *tmp; 146 if(!ia5 || !ia5->length) 147 return NULL; 148 tmp = OPENSSL_malloc(ia5->length + 1); 149 memcpy(tmp, ia5->data, ia5->length); 150 tmp[ia5->length] = 0; 151 return tmp; 152} 153 154/* A conveniance routine to get an access URI. */ 155 156static unsigned char *my_get_ext(X509 * cert, const int type, int extensiontype) { 157 158 int i; 159 STACK_OF(ACCESS_DESCRIPTION) * accessinfo ; 160 accessinfo = X509_get_ext_d2i(cert, extensiontype, NULL, NULL) ; 161 162 if (!sk_ACCESS_DESCRIPTION_num(accessinfo)) 163 return NULL; 164 for (i = 0; i < sk_ACCESS_DESCRIPTION_num(accessinfo); i++) { 165 ACCESS_DESCRIPTION * ad = sk_ACCESS_DESCRIPTION_value(accessinfo, i); 166 if (OBJ_obj2nid(ad->method) == type) { 167 if (ad->location->type == GEN_URI) { 168 return i2s_ASN1_IA5STRING(ad->location->d.ia5); 169 } 170 return NULL; 171 } 172 } 173 return NULL; 174} 175 176/* This is an application verification call back, it does not 177 perform any addition verification but tries to find a URL 178 in the presented certificat. If found, this will become 179 the URL to be used in the POST. 180*/ 181 182static int ssl_app_verify_callback(X509_STORE_CTX *ctx, void *arg) 183{ 184 sslctxparm * p = (sslctxparm *) arg; 185 int ok; 186 187 if (p->verbose > 2) 188 BIO_printf(p->errorbio,"entering ssl_app_verify_callback\n"); 189 190 if ((ok= X509_verify_cert(ctx)) && ctx->cert) { 191 unsigned char * accessinfo ; 192 if (p->verbose > 1) 193 X509_print_ex(p->errorbio,ctx->cert,0,0); 194 195 if (accessinfo = my_get_ext(ctx->cert,p->accesstype ,NID_sinfo_access)) { 196 if (p->verbose) 197 BIO_printf(p->errorbio,"Setting URL from SIA to: %s\n", accessinfo); 198 199 curl_easy_setopt(p->curl, CURLOPT_URL,accessinfo); 200 } 201 else if (accessinfo = my_get_ext(ctx->cert,p->accesstype, 202 NID_info_access)) { 203 if (p->verbose) 204 BIO_printf(p->errorbio,"Setting URL from AIA to: %s\n", accessinfo); 205 206 curl_easy_setopt(p->curl, CURLOPT_URL,accessinfo); 207 } 208 } 209 if (p->verbose > 2) 210 BIO_printf(p->errorbio,"leaving ssl_app_verify_callback with %d\n", ok); 211 return(ok); 212} 213 214 215/* This is an example of an curl SSL initialisation call back. The callback sets: 216 - a private key and certificate 217 - a trusted ca certificate 218 - a preferred cipherlist 219 - an application verification callback (the function above) 220*/ 221 222static CURLcode sslctxfun(CURL * curl, void * sslctx, void * parm) { 223 224 sslctxparm * p = (sslctxparm *) parm; 225 SSL_CTX * ctx = (SSL_CTX *) sslctx ; 226 227 if (!SSL_CTX_use_certificate(ctx,p->usercert)) { 228 BIO_printf(p->errorbio, "SSL_CTX_use_certificate problem\n"); goto err; 229 } 230 if (!SSL_CTX_use_PrivateKey(ctx,p->pkey)) { 231 BIO_printf(p->errorbio, "SSL_CTX_use_PrivateKey\n"); goto err; 232 } 233 234 if (!SSL_CTX_check_private_key(ctx)) { 235 BIO_printf(p->errorbio, "SSL_CTX_check_private_key\n"); goto err; 236 } 237 238 SSL_CTX_set_quiet_shutdown(ctx,1); 239 SSL_CTX_set_cipher_list(ctx,"RC4-MD5"); 240 SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY); 241 242 X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx), sk_X509_value(p->ca, sk_X509_num(p->ca)-1)); 243 244 SSL_CTX_set_verify_depth(ctx,2); 245 246 SSL_CTX_set_verify(ctx,SSL_VERIFY_PEER,ZERO_NULL); 247 248 SSL_CTX_set_cert_verify_callback(ctx, ssl_app_verify_callback, parm); 249 250 251 return CURLE_OK ; 252 err: 253 ERR_print_errors(p->errorbio); 254 return CURLE_SSL_CERTPROBLEM; 255 256} 257 258int main(int argc, char **argv) { 259 260 BIO* in=NULL; 261 BIO* out=NULL; 262 263 char * outfile = NULL; 264 char * infile = NULL ; 265 266 int tabLength=100; 267 char *binaryptr; 268 char* mimetype; 269 char* mimetypeaccept=NULL; 270 char* contenttype; 271 const char** pp; 272 unsigned char* hostporturl = NULL; 273 BIO * p12bio ; 274 char **args = argv + 1; 275 unsigned char * serverurl; 276 sslctxparm p; 277 char *response; 278 279 CURLcode res; 280 struct curl_slist * headers=NULL; 281 int badarg=0; 282 283 binaryptr = malloc(tabLength); 284 285 p.verbose = 0; 286 p.errorbio = BIO_new_fp (stderr, BIO_NOCLOSE); 287 288 curl_global_init(CURL_GLOBAL_DEFAULT); 289 290 /* we need some more for the P12 decoding */ 291 292 OpenSSL_add_all_ciphers(); 293 OpenSSL_add_all_digests(); 294 ERR_load_crypto_strings(); 295 296 297 298 while (*args && *args[0] == '-') { 299 if (!strcmp (*args, "-in")) { 300 if (args[1]) { 301 infile=*(++args); 302 } else badarg=1; 303 } else if (!strcmp (*args, "-out")) { 304 if (args[1]) { 305 outfile=*(++args); 306 } else badarg=1; 307 } else if (!strcmp (*args, "-p12")) { 308 if (args[1]) { 309 p.p12file = *(++args); 310 } else badarg=1; 311 } else if (strcmp(*args,"-envpass") == 0) { 312 if (args[1]) { 313 p.pst = getenv(*(++args)); 314 } else badarg=1; 315 } else if (strcmp(*args,"-connect") == 0) { 316 if (args[1]) { 317 hostporturl = *(++args); 318 } else badarg=1; 319 } else if (strcmp(*args,"-mimetype") == 0) { 320 if (args[1]) { 321 mimetype = *(++args); 322 } else badarg=1; 323 } else if (strcmp(*args,"-acceptmime") == 0) { 324 if (args[1]) { 325 mimetypeaccept = *(++args); 326 } else badarg=1; 327 } else if (strcmp(*args,"-accesstype") == 0) { 328 if (args[1]) { 329 if ((p.accesstype = OBJ_obj2nid(OBJ_txt2obj(*++args,0))) == 0) badarg=1; 330 } else badarg=1; 331 } else if (strcmp(*args,"-verbose") == 0) { 332 p.verbose++; 333 } else badarg=1; 334 args++; 335 } 336 337 if (mimetype==NULL || mimetypeaccept == NULL) badarg = 1; 338 339 if (badarg) { 340 for (pp=curlx_usage; (*pp != NULL); pp++) 341 BIO_printf(p.errorbio,"%s\n",*pp); 342 BIO_printf(p.errorbio,"\n"); 343 goto err; 344 } 345 346 347 348 /* set input */ 349 350 if ((in=BIO_new(BIO_s_file())) == NULL) { 351 BIO_printf(p.errorbio, "Error setting input bio\n"); 352 goto err; 353 } else if (infile == NULL) 354 BIO_set_fp(in,stdin,BIO_NOCLOSE|BIO_FP_TEXT); 355 else if (BIO_read_filename(in,infile) <= 0) { 356 BIO_printf(p.errorbio, "Error opening input file %s\n", infile); 357 BIO_free(in); 358 goto err; 359 } 360 361 /* set output */ 362 363 if ((out=BIO_new(BIO_s_file())) == NULL) { 364 BIO_printf(p.errorbio, "Error setting output bio.\n"); 365 goto err; 366 } else if (outfile == NULL) 367 BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); 368 else if (BIO_write_filename(out,outfile) <= 0) { 369 BIO_printf(p.errorbio, "Error opening output file %s\n", outfile); 370 BIO_free(out); 371 goto err; 372 } 373 374 375 p.errorbio = BIO_new_fp (stderr, BIO_NOCLOSE); 376 377 if (!(p.curl = curl_easy_init())) { 378 BIO_printf(p.errorbio, "Cannot init curl lib\n"); 379 goto err; 380 } 381 382 383 384 if (!(p12bio = BIO_new_file(p.p12file , "rb"))) { 385 BIO_printf(p.errorbio, "Error opening P12 file %s\n", p.p12file); goto err; 386 } 387 if (!(p.p12 = d2i_PKCS12_bio (p12bio, NULL))) { 388 BIO_printf(p.errorbio, "Cannot decode P12 structure %s\n", p.p12file); goto err; 389 } 390 391 p.ca= NULL; 392 if (!(PKCS12_parse (p.p12, p.pst, &(p.pkey), &(p.usercert), &(p.ca) ) )) { 393 BIO_printf(p.errorbio,"Invalid P12 structure in %s\n", p.p12file); goto err; 394 } 395 396 if (sk_X509_num(p.ca) <= 0) { 397 BIO_printf(p.errorbio,"No trustworthy CA given.%s\n", p.p12file); goto err; 398 } 399 400 if (p.verbose > 1) 401 X509_print_ex(p.errorbio,p.usercert,0,0); 402 403 /* determine URL to go */ 404 405 if (hostporturl) { 406 serverurl = malloc(9+strlen(hostporturl)); 407 sprintf(serverurl,"https://%s",hostporturl); 408 } 409 else if (p.accesstype != 0) { /* see whether we can find an AIA or SIA for a given access type */ 410 if (!(serverurl = my_get_ext(p.usercert,p.accesstype,NID_info_access))) { 411 int j=0; 412 BIO_printf(p.errorbio,"no service URL in user cert " 413 "cherching in others certificats\n"); 414 for (j=0;j<sk_X509_num(p.ca);j++) { 415 if ((serverurl = my_get_ext(sk_X509_value(p.ca,j),p.accesstype, 416 NID_info_access))) 417 break; 418 if ((serverurl = my_get_ext(sk_X509_value(p.ca,j),p.accesstype, 419 NID_sinfo_access))) 420 break; 421 } 422 } 423 } 424 425 if (!serverurl) { 426 BIO_printf(p.errorbio, "no service URL in certificats," 427 " check '-accesstype (AD_DVCS | ad_timestamping)'" 428 " or use '-connect'\n"); 429 goto err; 430 } 431 432 if (p.verbose) 433 BIO_printf(p.errorbio, "Service URL: <%s>\n", serverurl); 434 435 curl_easy_setopt(p.curl, CURLOPT_URL, serverurl); 436 437 /* Now specify the POST binary data */ 438 439 curl_easy_setopt(p.curl, CURLOPT_POSTFIELDS, binaryptr); 440 curl_easy_setopt(p.curl, CURLOPT_POSTFIELDSIZE,(long)tabLength); 441 442 /* pass our list of custom made headers */ 443 444 contenttype = malloc(15+strlen(mimetype)); 445 sprintf(contenttype,"Content-type: %s",mimetype); 446 headers = curl_slist_append(headers,contenttype); 447 curl_easy_setopt(p.curl, CURLOPT_HTTPHEADER, headers); 448 449 if (p.verbose) 450 BIO_printf(p.errorbio, "Service URL: <%s>\n", serverurl); 451 452 { 453 FILE *outfp; 454 BIO_get_fp(out,&outfp); 455 curl_easy_setopt(p.curl, CURLOPT_WRITEDATA, outfp); 456 } 457 458 res = curl_easy_setopt(p.curl, CURLOPT_SSL_CTX_FUNCTION, sslctxfun) ; 459 460 if (res != CURLE_OK) 461 BIO_printf(p.errorbio,"%d %s=%d %d\n", __LINE__, "CURLOPT_SSL_CTX_FUNCTION",CURLOPT_SSL_CTX_FUNCTION,res); 462 463 curl_easy_setopt(p.curl, CURLOPT_SSL_CTX_DATA, &p); 464 465 { 466 int lu; int i=0; 467 while ((lu = BIO_read (in,&binaryptr[i],tabLength-i)) >0 ) { 468 i+=lu; 469 if (i== tabLength) { 470 tabLength+=100; 471 binaryptr=realloc(binaryptr,tabLength); /* should be more careful */ 472 } 473 } 474 tabLength = i; 475 } 476 /* Now specify the POST binary data */ 477 478 curl_easy_setopt(p.curl, CURLOPT_POSTFIELDS, binaryptr); 479 curl_easy_setopt(p.curl, CURLOPT_POSTFIELDSIZE,(long)tabLength); 480 481 482 /* Perform the request, res will get the return code */ 483 484 BIO_printf(p.errorbio,"%d %s %d\n", __LINE__, "curl_easy_perform", 485 res = curl_easy_perform(p.curl)); 486 { 487 int result =curl_easy_getinfo(p.curl,CURLINFO_CONTENT_TYPE,&response); 488 if( mimetypeaccept && p.verbose) 489 if(!strcmp(mimetypeaccept,response)) 490 BIO_printf(p.errorbio,"the response has a correct mimetype : %s\n", 491 response); 492 else 493 BIO_printf(p.errorbio,"the reponse doesn\'t has an acceptable " 494 "mime type, it is %s instead of %s\n", 495 response,mimetypeaccept); 496 } 497 498 /*** code d'erreur si accept mime ***, egalement code return HTTP != 200 ***/ 499 500/* free the header list*/ 501 502 curl_slist_free_all(headers); 503 504 /* always cleanup */ 505 curl_easy_cleanup(p.curl); 506 507 BIO_free(in); 508 BIO_free(out); 509 return (EXIT_SUCCESS); 510 511 err: BIO_printf(p.errorbio,"error"); 512 exit(1); 513} 514