1 /*
2 curlx.c Authors: Peter Sylvester, Jean-Paul Merlin
3
4 This is a little program to demonstrate the usage of
5
6 - an ssl initialisation callback setting a user key and trustbases
7 coming from a pkcs12 file
8 - using an ssl application callback to find a URI in the
9 certificate presented during ssl session establishment.
10
11 */
12
13
14 /*
15 * Copyright (c) 2003 The OpenEvidence Project. All rights reserved.
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
19 * are met:
20 *
21 * 1. Redistributions of source code must retain the above copyright
22 * notice, this list of conditions, the following disclaimer,
23 * and the original OpenSSL and SSLeay Licences below.
24 *
25 * 2. Redistributions in binary form must reproduce the above copyright
26 * notice, this list of conditions, the following disclaimer
27 * and the original OpenSSL and SSLeay Licences below in
28 * the documentation and/or other materials provided with the
29 * distribution.
30 *
31 * 3. All advertising materials mentioning features or use of this
32 * software must display the following acknowledgments:
33 * "This product includes software developed by the Openevidence Project
34 * for use in the OpenEvidence Toolkit. (http://www.openevidence.org/)"
35 * This product includes software developed by the OpenSSL Project
36 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37 * This product includes cryptographic software written by Eric Young
38 * (eay@cryptsoft.com). This product includes software written by Tim
39 * Hudson (tjh@cryptsoft.com)."
40 *
41 * 4. The names "OpenEvidence Toolkit" and "OpenEvidence Project" must not be
42 * used to endorse or promote products derived from this software without
43 * prior written permission. For written permission, please contact
44 * openevidence-core@openevidence.org.
45 *
46 * 5. Products derived from this software may not be called "OpenEvidence"
47 * nor may "OpenEvidence" appear in their names without prior written
48 * permission of the OpenEvidence Project.
49 *
50 * 6. Redistributions of any form whatsoever must retain the following
51 * acknowledgments:
52 * "This product includes software developed by the OpenEvidence Project
53 * for use in the OpenEvidence Toolkit (http://www.openevidence.org/)
54 * This product includes software developed by the OpenSSL Project
55 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
56 * This product includes cryptographic software written by Eric Young
57 * (eay@cryptsoft.com). This product includes software written by Tim
58 * Hudson (tjh@cryptsoft.com)."
59 *
60 * THIS SOFTWARE IS PROVIDED BY THE OpenEvidence PROJECT ``AS IS'' AND ANY
61 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
62 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
63 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenEvidence PROJECT OR
64 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
65 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
66 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
67 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
68 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
69 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
70 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
71 * OF THE POSSIBILITY OF SUCH DAMAGE.
72 * ====================================================================
73 *
74 * This product includes software developed by the OpenSSL Project
75 * for use in the OpenSSL Toolkit (http://www.openssl.org/)
76 * This product includes cryptographic software written by Eric Young
77 * (eay@cryptsoft.com). This product includes software written by Tim
78 * Hudson (tjh@cryptsoft.com).
79 *
80 */
81
82 #include <stdio.h>
83 #include <stdlib.h>
84 #include <string.h>
85 #include <curl/curl.h>
86 #include <openssl/x509v3.h>
87 #include <openssl/x509_vfy.h>
88 #include <openssl/crypto.h>
89 #include <openssl/lhash.h>
90 #include <openssl/objects.h>
91 #include <openssl/err.h>
92 #include <openssl/evp.h>
93 #include <openssl/x509.h>
94 #include <openssl/pkcs12.h>
95 #include <openssl/bio.h>
96 #include <openssl/ssl.h>
97
98 static const char *curlx_usage[]={
99 "usage: curlx args\n",
100 " -p12 arg - tia file ",
101 " -envpass arg - environement variable which content the tia private key password",
102 " -out arg - output file (response)- default stdout",
103 " -in arg - input file (request)- default stdin",
104 " -connect arg - URL of the server for the connection ex: www.openevidence.org",
105 " -mimetype arg - MIME type for data in ex : application/timestamp-query or application/dvcs -default application/timestamp-query",
106 " -acceptmime arg - MIME type acceptable for the response ex : application/timestamp-response or application/dvcs -default none",
107 " -accesstype arg - an Object identifier in an AIA/SIA method, e.g. AD_DVCS or ad_timestamping",
108 NULL
109 };
110
111 /*
112
113 ./curlx -p12 psy.p12 -envpass XX -in request -verbose -accesstype AD_DVCS
114 -mimetype application/dvcs -acceptmime application/dvcs -out response
115
116 */
117
118 /*
119 * We use this ZERO_NULL to avoid picky compiler warnings,
120 * when assigning a NULL pointer to a function pointer var.
121 */
122
123 #define ZERO_NULL 0
124
125 /* This is a context that we pass to all callbacks */
126
127 typedef struct sslctxparm_st {
128 unsigned char * p12file ;
129 const char * pst ;
130 PKCS12 * p12 ;
131 EVP_PKEY * pkey ;
132 X509 * usercert ;
133 STACK_OF(X509) * ca ;
134 CURL * curl;
135 BIO * errorbio;
136 int accesstype ;
137 int verbose;
138
139 } sslctxparm;
140
141 /* some helper function. */
142
i2s_ASN1_IA5STRING(ASN1_IA5STRING * ia5)143 static char *i2s_ASN1_IA5STRING( ASN1_IA5STRING *ia5)
144 {
145 char *tmp;
146 if(!ia5 || !ia5->length)
147 return NULL;
148 tmp = OPENSSL_malloc(ia5->length + 1);
149 memcpy(tmp, ia5->data, ia5->length);
150 tmp[ia5->length] = 0;
151 return tmp;
152 }
153
154 /* A conveniance routine to get an access URI. */
155
my_get_ext(X509 * cert,const int type,int extensiontype)156 static unsigned char *my_get_ext(X509 * cert, const int type, int extensiontype) {
157
158 int i;
159 STACK_OF(ACCESS_DESCRIPTION) * accessinfo ;
160 accessinfo = X509_get_ext_d2i(cert, extensiontype, NULL, NULL) ;
161
162 if (!sk_ACCESS_DESCRIPTION_num(accessinfo))
163 return NULL;
164 for (i = 0; i < sk_ACCESS_DESCRIPTION_num(accessinfo); i++) {
165 ACCESS_DESCRIPTION * ad = sk_ACCESS_DESCRIPTION_value(accessinfo, i);
166 if (OBJ_obj2nid(ad->method) == type) {
167 if (ad->location->type == GEN_URI) {
168 return i2s_ASN1_IA5STRING(ad->location->d.ia5);
169 }
170 return NULL;
171 }
172 }
173 return NULL;
174 }
175
176 /* This is an application verification call back, it does not
177 perform any addition verification but tries to find a URL
178 in the presented certificat. If found, this will become
179 the URL to be used in the POST.
180 */
181
ssl_app_verify_callback(X509_STORE_CTX * ctx,void * arg)182 static int ssl_app_verify_callback(X509_STORE_CTX *ctx, void *arg)
183 {
184 sslctxparm * p = (sslctxparm *) arg;
185 int ok;
186
187 if (p->verbose > 2)
188 BIO_printf(p->errorbio,"entering ssl_app_verify_callback\n");
189
190 if ((ok= X509_verify_cert(ctx)) && ctx->cert) {
191 unsigned char * accessinfo ;
192 if (p->verbose > 1)
193 X509_print_ex(p->errorbio,ctx->cert,0,0);
194
195 if (accessinfo = my_get_ext(ctx->cert,p->accesstype ,NID_sinfo_access)) {
196 if (p->verbose)
197 BIO_printf(p->errorbio,"Setting URL from SIA to: %s\n", accessinfo);
198
199 curl_easy_setopt(p->curl, CURLOPT_URL,accessinfo);
200 }
201 else if (accessinfo = my_get_ext(ctx->cert,p->accesstype,
202 NID_info_access)) {
203 if (p->verbose)
204 BIO_printf(p->errorbio,"Setting URL from AIA to: %s\n", accessinfo);
205
206 curl_easy_setopt(p->curl, CURLOPT_URL,accessinfo);
207 }
208 }
209 if (p->verbose > 2)
210 BIO_printf(p->errorbio,"leaving ssl_app_verify_callback with %d\n", ok);
211 return(ok);
212 }
213
214
215 /* This is an example of an curl SSL initialisation call back. The callback sets:
216 - a private key and certificate
217 - a trusted ca certificate
218 - a preferred cipherlist
219 - an application verification callback (the function above)
220 */
221
sslctxfun(CURL * curl,void * sslctx,void * parm)222 static CURLcode sslctxfun(CURL * curl, void * sslctx, void * parm) {
223
224 sslctxparm * p = (sslctxparm *) parm;
225 SSL_CTX * ctx = (SSL_CTX *) sslctx ;
226
227 if (!SSL_CTX_use_certificate(ctx,p->usercert)) {
228 BIO_printf(p->errorbio, "SSL_CTX_use_certificate problem\n"); goto err;
229 }
230 if (!SSL_CTX_use_PrivateKey(ctx,p->pkey)) {
231 BIO_printf(p->errorbio, "SSL_CTX_use_PrivateKey\n"); goto err;
232 }
233
234 if (!SSL_CTX_check_private_key(ctx)) {
235 BIO_printf(p->errorbio, "SSL_CTX_check_private_key\n"); goto err;
236 }
237
238 SSL_CTX_set_quiet_shutdown(ctx,1);
239 SSL_CTX_set_cipher_list(ctx,"RC4-MD5");
240 SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
241
242 X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx), sk_X509_value(p->ca, sk_X509_num(p->ca)-1));
243
244 SSL_CTX_set_verify_depth(ctx,2);
245
246 SSL_CTX_set_verify(ctx,SSL_VERIFY_PEER,ZERO_NULL);
247
248 SSL_CTX_set_cert_verify_callback(ctx, ssl_app_verify_callback, parm);
249
250
251 return CURLE_OK ;
252 err:
253 ERR_print_errors(p->errorbio);
254 return CURLE_SSL_CERTPROBLEM;
255
256 }
257
main(int argc,char ** argv)258 int main(int argc, char **argv) {
259
260 BIO* in=NULL;
261 BIO* out=NULL;
262
263 char * outfile = NULL;
264 char * infile = NULL ;
265
266 int tabLength=100;
267 char *binaryptr;
268 char* mimetype;
269 char* mimetypeaccept=NULL;
270 char* contenttype;
271 const char** pp;
272 unsigned char* hostporturl = NULL;
273 BIO * p12bio ;
274 char **args = argv + 1;
275 unsigned char * serverurl;
276 sslctxparm p;
277 char *response;
278
279 CURLcode res;
280 struct curl_slist * headers=NULL;
281 int badarg=0;
282
283 binaryptr = malloc(tabLength);
284
285 p.verbose = 0;
286 p.errorbio = BIO_new_fp (stderr, BIO_NOCLOSE);
287
288 curl_global_init(CURL_GLOBAL_DEFAULT);
289
290 /* we need some more for the P12 decoding */
291
292 OpenSSL_add_all_ciphers();
293 OpenSSL_add_all_digests();
294 ERR_load_crypto_strings();
295
296
297
298 while (*args && *args[0] == '-') {
299 if (!strcmp (*args, "-in")) {
300 if (args[1]) {
301 infile=*(++args);
302 } else badarg=1;
303 } else if (!strcmp (*args, "-out")) {
304 if (args[1]) {
305 outfile=*(++args);
306 } else badarg=1;
307 } else if (!strcmp (*args, "-p12")) {
308 if (args[1]) {
309 p.p12file = *(++args);
310 } else badarg=1;
311 } else if (strcmp(*args,"-envpass") == 0) {
312 if (args[1]) {
313 p.pst = getenv(*(++args));
314 } else badarg=1;
315 } else if (strcmp(*args,"-connect") == 0) {
316 if (args[1]) {
317 hostporturl = *(++args);
318 } else badarg=1;
319 } else if (strcmp(*args,"-mimetype") == 0) {
320 if (args[1]) {
321 mimetype = *(++args);
322 } else badarg=1;
323 } else if (strcmp(*args,"-acceptmime") == 0) {
324 if (args[1]) {
325 mimetypeaccept = *(++args);
326 } else badarg=1;
327 } else if (strcmp(*args,"-accesstype") == 0) {
328 if (args[1]) {
329 if ((p.accesstype = OBJ_obj2nid(OBJ_txt2obj(*++args,0))) == 0) badarg=1;
330 } else badarg=1;
331 } else if (strcmp(*args,"-verbose") == 0) {
332 p.verbose++;
333 } else badarg=1;
334 args++;
335 }
336
337 if (mimetype==NULL || mimetypeaccept == NULL) badarg = 1;
338
339 if (badarg) {
340 for (pp=curlx_usage; (*pp != NULL); pp++)
341 BIO_printf(p.errorbio,"%s\n",*pp);
342 BIO_printf(p.errorbio,"\n");
343 goto err;
344 }
345
346
347
348 /* set input */
349
350 if ((in=BIO_new(BIO_s_file())) == NULL) {
351 BIO_printf(p.errorbio, "Error setting input bio\n");
352 goto err;
353 } else if (infile == NULL)
354 BIO_set_fp(in,stdin,BIO_NOCLOSE|BIO_FP_TEXT);
355 else if (BIO_read_filename(in,infile) <= 0) {
356 BIO_printf(p.errorbio, "Error opening input file %s\n", infile);
357 BIO_free(in);
358 goto err;
359 }
360
361 /* set output */
362
363 if ((out=BIO_new(BIO_s_file())) == NULL) {
364 BIO_printf(p.errorbio, "Error setting output bio.\n");
365 goto err;
366 } else if (outfile == NULL)
367 BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
368 else if (BIO_write_filename(out,outfile) <= 0) {
369 BIO_printf(p.errorbio, "Error opening output file %s\n", outfile);
370 BIO_free(out);
371 goto err;
372 }
373
374
375 p.errorbio = BIO_new_fp (stderr, BIO_NOCLOSE);
376
377 if (!(p.curl = curl_easy_init())) {
378 BIO_printf(p.errorbio, "Cannot init curl lib\n");
379 goto err;
380 }
381
382
383
384 if (!(p12bio = BIO_new_file(p.p12file , "rb"))) {
385 BIO_printf(p.errorbio, "Error opening P12 file %s\n", p.p12file); goto err;
386 }
387 if (!(p.p12 = d2i_PKCS12_bio (p12bio, NULL))) {
388 BIO_printf(p.errorbio, "Cannot decode P12 structure %s\n", p.p12file); goto err;
389 }
390
391 p.ca= NULL;
392 if (!(PKCS12_parse (p.p12, p.pst, &(p.pkey), &(p.usercert), &(p.ca) ) )) {
393 BIO_printf(p.errorbio,"Invalid P12 structure in %s\n", p.p12file); goto err;
394 }
395
396 if (sk_X509_num(p.ca) <= 0) {
397 BIO_printf(p.errorbio,"No trustworthy CA given.%s\n", p.p12file); goto err;
398 }
399
400 if (p.verbose > 1)
401 X509_print_ex(p.errorbio,p.usercert,0,0);
402
403 /* determine URL to go */
404
405 if (hostporturl) {
406 serverurl = malloc(9+strlen(hostporturl));
407 sprintf(serverurl,"https://%s",hostporturl);
408 }
409 else if (p.accesstype != 0) { /* see whether we can find an AIA or SIA for a given access type */
410 if (!(serverurl = my_get_ext(p.usercert,p.accesstype,NID_info_access))) {
411 int j=0;
412 BIO_printf(p.errorbio,"no service URL in user cert "
413 "cherching in others certificats\n");
414 for (j=0;j<sk_X509_num(p.ca);j++) {
415 if ((serverurl = my_get_ext(sk_X509_value(p.ca,j),p.accesstype,
416 NID_info_access)))
417 break;
418 if ((serverurl = my_get_ext(sk_X509_value(p.ca,j),p.accesstype,
419 NID_sinfo_access)))
420 break;
421 }
422 }
423 }
424
425 if (!serverurl) {
426 BIO_printf(p.errorbio, "no service URL in certificats,"
427 " check '-accesstype (AD_DVCS | ad_timestamping)'"
428 " or use '-connect'\n");
429 goto err;
430 }
431
432 if (p.verbose)
433 BIO_printf(p.errorbio, "Service URL: <%s>\n", serverurl);
434
435 curl_easy_setopt(p.curl, CURLOPT_URL, serverurl);
436
437 /* Now specify the POST binary data */
438
439 curl_easy_setopt(p.curl, CURLOPT_POSTFIELDS, binaryptr);
440 curl_easy_setopt(p.curl, CURLOPT_POSTFIELDSIZE,(long)tabLength);
441
442 /* pass our list of custom made headers */
443
444 contenttype = malloc(15+strlen(mimetype));
445 sprintf(contenttype,"Content-type: %s",mimetype);
446 headers = curl_slist_append(headers,contenttype);
447 curl_easy_setopt(p.curl, CURLOPT_HTTPHEADER, headers);
448
449 if (p.verbose)
450 BIO_printf(p.errorbio, "Service URL: <%s>\n", serverurl);
451
452 {
453 FILE *outfp;
454 BIO_get_fp(out,&outfp);
455 curl_easy_setopt(p.curl, CURLOPT_WRITEDATA, outfp);
456 }
457
458 res = curl_easy_setopt(p.curl, CURLOPT_SSL_CTX_FUNCTION, sslctxfun) ;
459
460 if (res != CURLE_OK)
461 BIO_printf(p.errorbio,"%d %s=%d %d\n", __LINE__, "CURLOPT_SSL_CTX_FUNCTION",CURLOPT_SSL_CTX_FUNCTION,res);
462
463 curl_easy_setopt(p.curl, CURLOPT_SSL_CTX_DATA, &p);
464
465 {
466 int lu; int i=0;
467 while ((lu = BIO_read (in,&binaryptr[i],tabLength-i)) >0 ) {
468 i+=lu;
469 if (i== tabLength) {
470 tabLength+=100;
471 binaryptr=realloc(binaryptr,tabLength); /* should be more careful */
472 }
473 }
474 tabLength = i;
475 }
476 /* Now specify the POST binary data */
477
478 curl_easy_setopt(p.curl, CURLOPT_POSTFIELDS, binaryptr);
479 curl_easy_setopt(p.curl, CURLOPT_POSTFIELDSIZE,(long)tabLength);
480
481
482 /* Perform the request, res will get the return code */
483
484 BIO_printf(p.errorbio,"%d %s %d\n", __LINE__, "curl_easy_perform",
485 res = curl_easy_perform(p.curl));
486 {
487 int result =curl_easy_getinfo(p.curl,CURLINFO_CONTENT_TYPE,&response);
488 if( mimetypeaccept && p.verbose)
489 if(!strcmp(mimetypeaccept,response))
490 BIO_printf(p.errorbio,"the response has a correct mimetype : %s\n",
491 response);
492 else
493 BIO_printf(p.errorbio,"the response doesn\'t have an acceptable "
494 "mime type, it is %s instead of %s\n",
495 response,mimetypeaccept);
496 }
497
498 /*** code d'erreur si accept mime ***, egalement code return HTTP != 200 ***/
499
500 /* free the header list*/
501
502 curl_slist_free_all(headers);
503
504 /* always cleanup */
505 curl_easy_cleanup(p.curl);
506
507 BIO_free(in);
508 BIO_free(out);
509 return (EXIT_SUCCESS);
510
511 err: BIO_printf(p.errorbio,"error");
512 exit(1);
513 }
514