the-tree/certs/extract-cert.c

0001 /* Extract X.509 certificate in DER form from PKCS#11 or PEM.
0002  *
0003  * Copyright © 2014-2015 Red Hat, Inc. All Rights Reserved.
0004  * Copyright © 2015      Intel Corporation.
0005  *
0006  * Authors: David Howells <dhowells@redhat.com>
0007  *          David Woodhouse <dwmw2@infradead.org>
0008  *
0009  * This program is free software; you can redistribute it and/or
0010  * modify it under the terms of the GNU Lesser General Public License
0011  * as published by the Free Software Foundation; either version 2.1
0012  * of the licence, or (at your option) any later version.
0013  */
0014 #define _GNU_SOURCE
0015 #include <stdio.h>
0016 #include <stdlib.h>
0017 #include <stdint.h>
0018 #include <stdbool.h>
0019 #include <string.h>
0020 #include <err.h>
0021 #include <openssl/bio.h>
0022 #include <openssl/pem.h>
0023 #include <openssl/err.h>
0024 #include <openssl/engine.h>
0025
0026 /*
0027  * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
0028  *
0029  * Remove this if/when that API is no longer used
0030  */
0031 #pragma GCC diagnostic ignored "-Wdeprecated-declarations"
0032
0033 #define PKEY_ID_PKCS7 2
0034
0035 static __attribute__((noreturn))
0036 void format(void)
0037 {
0038     fprintf(stderr,
0039         "Usage: extract-cert <source> <dest>\n");
0040     exit(2);
0041 }
0042
0043 static void display_openssl_errors(int l)
0044 {
0045     const char *file;
0046     char buf[120];
0047     int e, line;
0048
0049     if (ERR_peek_error() == 0)
0050         return;
0051     fprintf(stderr, "At main.c:%d:\n", l);
0052
0053     while ((e = ERR_get_error_line(&file, &line))) {
0054         ERR_error_string(e, buf);
0055         fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
0056     }
0057 }
0058
0059 static void drain_openssl_errors(void)
0060 {
0061     const char *file;
0062     int line;
0063
0064     if (ERR_peek_error() == 0)
0065         return;
0066     while (ERR_get_error_line(&file, &line)) {}
0067 }
0068
0069 #define ERR(cond, fmt, ...)             \
0070     do {                        \
0071         bool __cond = (cond);           \
0072         display_openssl_errors(__LINE__);   \
0073         if (__cond) {               \
0074             err(1, fmt, ## __VA_ARGS__);    \
0075         }                   \
0076     } while(0)
0077
0078 static const char *key_pass;
0079 static BIO *wb;
0080 static char *cert_dst;
0081 static int kbuild_verbose;
0082
0083 static void write_cert(X509 *x509)
0084 {
0085     char buf[200];
0086
0087     if (!wb) {
0088         wb = BIO_new_file(cert_dst, "wb");
0089         ERR(!wb, "%s", cert_dst);
0090     }
0091     X509_NAME_oneline(X509_get_subject_name(x509), buf, sizeof(buf));
0092     ERR(!i2d_X509_bio(wb, x509), "%s", cert_dst);
0093     if (kbuild_verbose)
0094         fprintf(stderr, "Extracted cert: %s\n", buf);
0095 }
0096
0097 int main(int argc, char **argv)
0098 {
0099     char *cert_src;
0100
0101     OpenSSL_add_all_algorithms();
0102     ERR_load_crypto_strings();
0103     ERR_clear_error();
0104
0105     kbuild_verbose = atoi(getenv("KBUILD_VERBOSE")?:"0");
0106
0107         key_pass = getenv("KBUILD_SIGN_PIN");
0108
0109     if (argc != 3)
0110         format();
0111
0112     cert_src = argv[1];
0113     cert_dst = argv[2];
0114
0115     if (!cert_src[0]) {
0116         /* Invoked with no input; create empty file */
0117         FILE *f = fopen(cert_dst, "wb");
0118         ERR(!f, "%s", cert_dst);
0119         fclose(f);
0120         exit(0);
0121     } else if (!strncmp(cert_src, "pkcs11:", 7)) {
0122         ENGINE *e;
0123         struct {
0124             const char *cert_id;
0125             X509 *cert;
0126         } parms;
0127
0128         parms.cert_id = cert_src;
0129         parms.cert = NULL;
0130
0131         ENGINE_load_builtin_engines();
0132         drain_openssl_errors();
0133         e = ENGINE_by_id("pkcs11");
0134         ERR(!e, "Load PKCS#11 ENGINE");
0135         if (ENGINE_init(e))
0136             drain_openssl_errors();
0137         else
0138             ERR(1, "ENGINE_init");
0139         if (key_pass)
0140             ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
0141         ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
0142         ERR(!parms.cert, "Get X.509 from PKCS#11");
0143         write_cert(parms.cert);
0144     } else {
0145         BIO *b;
0146         X509 *x509;
0147
0148         b = BIO_new_file(cert_src, "rb");
0149         ERR(!b, "%s", cert_src);
0150
0151         while (1) {
0152             x509 = PEM_read_bio_X509(b, NULL, NULL, NULL);
0153             if (wb && !x509) {
0154                 unsigned long err = ERR_peek_last_error();
0155                 if (ERR_GET_LIB(err) == ERR_LIB_PEM &&
0156                     ERR_GET_REASON(err) == PEM_R_NO_START_LINE) {
0157                     ERR_clear_error();
0158                     break;
0159                 }
0160             }
0161             ERR(!x509, "%s", cert_src);
0162             write_cert(x509);
0163         }
0164     }
0165
0166     BIO_free(wb);
0167
0168     return 0;
0169 }