Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	usr.bin/openssl/certhash.c	Lines:	0	308	0.0 %
Date:	2016-12-06	Branches:	0	218	0.0 %


/*
 * Copyright (c) 2014, 2015 Joel Sing <jsing@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include <sys/types.h>
#include <sys/stat.h>

#include <errno.h>
#include <dirent.h>
#include <fcntl.h>
#include <limits.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

#include <openssl/bio.h>
#include <openssl/evp.h>
#include <openssl/pem.h>
#include <openssl/x509.h>

#include "apps.h"

static struct {
	int dryrun;
	int verbose;
} certhash_config;

struct option certhash_options[] = {
	{
		.name = "n",
		.desc = "Perform a dry-run - do not make any changes",
		.type = OPTION_FLAG,
		.opt.flag = &certhash_config.dryrun,
	},
	{
		.name = "v",
		.desc = "Verbose",
		.type = OPTION_FLAG,
		.opt.flag = &certhash_config.verbose,
	},
	{ NULL },
};

struct hashinfo {
	char *filename;
	char *target;
	unsigned long hash;
	unsigned int index;
	unsigned char fingerprint[EVP_MAX_MD_SIZE];
	int is_crl;
	int is_dup;
	int exists;
	int changed;
	struct hashinfo *reference;
	struct hashinfo *next;
};

static struct hashinfo *
hashinfo(const char *filename, unsigned long hash, unsigned char *fingerprint)
{
	struct hashinfo *hi;

	if ((hi = calloc(1, sizeof(*hi))) == NULL)
		return (NULL);
	if (filename != NULL) {
		if ((hi->filename = strdup(filename)) == NULL) {
			free(hi);
			return (NULL);
		}
	}
	hi->hash = hash;
	if (fingerprint != NULL)
		memcpy(hi->fingerprint, fingerprint, sizeof(hi->fingerprint));

	return (hi);
}

static void
hashinfo_free(struct hashinfo *hi)
{
	if (hi == NULL)
		return;

	free(hi->filename);
	free(hi->target);
	free(hi);
}

#ifdef DEBUG
static void
hashinfo_print(struct hashinfo *hi)
{
	int i;

	printf("hashinfo %s %08lx %u %i\n", hi->filename, hi->hash,
	    hi->index, hi->is_crl);
	for (i = 0; i < (int)EVP_MAX_MD_SIZE; i++) {
		printf("%02X%c", hi->fingerprint[i],
		    (i + 1 == (int)EVP_MAX_MD_SIZE) ? '\n' : ':');
	}
}
#endif

static int
hashinfo_compare(const void *a, const void *b)
{
	struct hashinfo *hia = *(struct hashinfo **)a;
	struct hashinfo *hib = *(struct hashinfo **)b;
	int rv;

	rv = hia->hash < hib->hash ? -1 : hia->hash > hib->hash;
	if (rv != 0)
		return (rv);
	rv = memcmp(hia->fingerprint, hib->fingerprint,
	    sizeof(hia->fingerprint));
	if (rv != 0)
		return (rv);
	return strcmp(hia->filename, hib->filename);
}

static struct hashinfo *
hashinfo_chain(struct hashinfo *head, struct hashinfo *entry)
{
	struct hashinfo *hi = head;

	if (hi == NULL)
		return (entry);
	while (hi->next != NULL)
		hi = hi->next;
	hi->next = entry;

	return (head);
}

static void
hashinfo_chain_free(struct hashinfo *hi)
{
	struct hashinfo *next;

	while (hi != NULL) {
		next = hi->next;
		hashinfo_free(hi);
		hi = next;
	}
}

static size_t
hashinfo_chain_length(struct hashinfo *hi)
{
	int len = 0;

	while (hi != NULL) {
		len++;
		hi = hi->next;
	}
	return (len);
}

static int
hashinfo_chain_sort(struct hashinfo **head)
{
	struct hashinfo **list, *entry;
	size_t len;
	int i;

	if (*head == NULL)
		return (0);

	len = hashinfo_chain_length(*head);
	if ((list = reallocarray(NULL, len, sizeof(struct hashinfo *))) == NULL)
		return (-1);

	for (entry = *head, i = 0; entry != NULL; entry = entry->next, i++)
		list[i] = entry;
	qsort(list, len, sizeof(struct hashinfo *), hashinfo_compare);

	*head = entry = list[0];
	for (i = 1; i < len; i++) {
		entry->next = list[i];
		entry = list[i];
	}
	entry->next = NULL;

	free(list);
	return (0);
}

static char *
hashinfo_linkname(struct hashinfo *hi)
{
	char *filename;

	if (asprintf(&filename, "%08lx.%s%u", hi->hash,
	    (hi->is_crl ? "r" : ""), hi->index) == -1)
		return (NULL);

	return (filename);
}

static int
filename_is_hash(const char *filename)
{
	const char *p = filename;

	while ((*p >= '0' && *p <= '9') || (*p >= 'a' && *p <= 'f'))
		p++;
	if (*p++ != '.')
		return (0);
	if (*p == 'r')		/* CRL format. */
		p++;
	while (*p >= '0' && *p <= '9')
		p++;
	if (*p != '\0')
		return (0);

	return (1);
}

static int
filename_is_pem(const char *filename)
{
	const char *q, *p = filename;

	if ((q = strchr(p, '\0')) == NULL)
		return (0);
	if ((q - p) < 4)
		return (0);
	if (strncmp((q - 4), ".pem", 4) != 0)
		return (0);

	return (1);
}

static struct hashinfo *
hashinfo_from_linkname(const char *linkname, const char *target)
{
	struct hashinfo *hi = NULL;
	const char *errstr;
	char *l, *p, *ep;
	long long val;

	if ((l = strdup(linkname)) == NULL)
		goto err;
	if ((p = strchr(l, '.')) == NULL)
		goto err;
	*p++ = '\0';

	if ((hi = hashinfo(linkname, 0, NULL)) == NULL)
		goto err;
	if ((hi->target = strdup(target)) == NULL)
		goto err;

	errno = 0;
	val = strtoll(l, &ep, 16);
	if (l[0] == '\0' || *ep != '\0')
		goto err;
	if (errno == ERANGE && (val == LLONG_MAX || val == LLONG_MIN))
		goto err;
	if (val < 0 || val > ULONG_MAX)
		goto err;
	hi->hash = (unsigned long)val;

	if (*p == 'r') {
		hi->is_crl = 1;
		p++;
	}

	val = strtonum(p, 0, 0xffffffff, &errstr);
	if (errstr != NULL)
		goto err;

	hi->index = (unsigned int)val;

	goto done;

err:
	hashinfo_free(hi);
	hi = NULL;

done:
	free(l);

	return (hi);
}

static struct hashinfo *
certhash_cert(BIO *bio, const char *filename)
{
	unsigned char fingerprint[EVP_MAX_MD_SIZE];
	struct hashinfo *hi = NULL;
	const EVP_MD *digest;
	X509 *cert = NULL;
	unsigned long hash;
	unsigned int len;

	if ((cert = PEM_read_bio_X509(bio, NULL, NULL, NULL)) == NULL)
		goto err;

	hash = X509_subject_name_hash(cert);

	digest = EVP_sha256();
	if (X509_digest(cert, digest, fingerprint, &len) != 1) {
		fprintf(stderr, "out of memory\n");
		goto err;
	}

	hi = hashinfo(filename, hash, fingerprint);

err:
	X509_free(cert);

	return (hi);
}

static struct hashinfo *
certhash_crl(BIO *bio, const char *filename)
{
	unsigned char fingerprint[EVP_MAX_MD_SIZE];
	struct hashinfo *hi = NULL;
	const EVP_MD *digest;
	X509_CRL *crl = NULL;
	unsigned long hash;
	unsigned int len;

	if ((crl = PEM_read_bio_X509_CRL(bio, NULL, NULL, NULL)) == NULL)
		return (NULL);

	hash = X509_NAME_hash(X509_CRL_get_issuer(crl));

	digest = EVP_sha256();
	if (X509_CRL_digest(crl, digest, fingerprint, &len) != 1) {
		fprintf(stderr, "out of memory\n");
		goto err;
	}

	hi = hashinfo(filename, hash, fingerprint);

err:
	X509_CRL_free(crl);

	return (hi);
}

static int
certhash_addlink(struct hashinfo **links, struct hashinfo *hi)
{
	struct hashinfo *link = NULL;

	if ((link = hashinfo(NULL, hi->hash, hi->fingerprint)) == NULL)
		goto err;

	if ((link->filename = hashinfo_linkname(hi)) == NULL)
		goto err;

	link->reference = hi;
	link->changed = 1;
	*links = hashinfo_chain(*links, link);
	hi->reference = link;

	return (0);

err:
	hashinfo_free(link);
	return (-1);
}

static void
certhash_findlink(struct hashinfo *links, struct hashinfo *hi)
{
	struct hashinfo *link;

	for (link = links; link != NULL; link = link->next) {
		if (link->is_crl == hi->is_crl &&
		    link->hash == hi->hash &&
		    link->index == hi->index &&
		    link->reference == NULL) {
			link->reference = hi;
			if (link->target == NULL ||
			    strcmp(link->target, hi->filename) != 0)
				link->changed = 1;
			hi->reference = link;
			break;
		}
	}
}

static void
certhash_index(struct hashinfo *head, const char *name)
{
	struct hashinfo *last, *entry;
	int index = 0;

	last = NULL;
	for (entry = head; entry != NULL; entry = entry->next) {
		if (last != NULL) {
			if (entry->hash == last->hash) {
				if (memcmp(entry->fingerprint,
				    last->fingerprint,
				    sizeof(entry->fingerprint)) == 0) {
					fprintf(stderr, "WARNING: duplicate %s "
					    "in %s (using %s), ignoring...\n",
					    name, entry->filename,
					    last->filename);
					entry->is_dup = 1;
					continue;
				}
				index++;
			} else {
				index = 0;
			}
		}
		entry->index = index;
		last = entry;
	}
}

static int
certhash_merge(struct hashinfo **links, struct hashinfo **certs,
    struct hashinfo **crls)
{
	struct hashinfo *cert, *crl;

	/* Pass 1 - sort and index entries. */
	if (hashinfo_chain_sort(certs) == -1)
		return (-1);
	if (hashinfo_chain_sort(crls) == -1)
		return (-1);
	certhash_index(*certs, "certificate");
	certhash_index(*crls, "CRL");

	/* Pass 2 - map to existing links. */
	for (cert = *certs; cert != NULL; cert = cert->next) {
		if (cert->is_dup == 1)
			continue;
		certhash_findlink(*links, cert);
	}
	for (crl = *crls; crl != NULL; crl = crl->next) {
		if (crl->is_dup == 1)
			continue;
		certhash_findlink(*links, crl);
	}

	/* Pass 3 - determine missing links. */
	for (cert = *certs; cert != NULL; cert = cert->next) {
		if (cert->is_dup == 1 || cert->reference != NULL)
			continue;
		if (certhash_addlink(links, cert) == -1)
			return (-1);
	}
	for (crl = *crls; crl != NULL; crl = crl->next) {
		if (crl->is_dup == 1 || crl->reference != NULL)
			continue;
		if (certhash_addlink(links, crl) == -1)
			return (-1);
	}

	return (0);
}

static int
certhash_link(struct dirent *dep, struct hashinfo **links)
{
	struct hashinfo *hi = NULL;
	char target[PATH_MAX];
	struct stat sb;
	int n;

	if (lstat(dep->d_name, &sb) == -1) {
		fprintf(stderr, "failed to stat %s\n", dep->d_name);
		return (-1);
	}
	if (!S_ISLNK(sb.st_mode))
		return (0);

	n = readlink(dep->d_name, target, sizeof(target) - 1);
	if (n == -1) {
		fprintf(stderr, "failed to readlink %s\n", dep->d_name);
		return (-1);
	}
	target[n] = '\0';

	hi = hashinfo_from_linkname(dep->d_name, target);
	if (hi == NULL) {
		fprintf(stderr, "failed to get hash info %s\n", dep->d_name);
		return (-1);
	}
	hi->exists = 1;
	*links = hashinfo_chain(*links, hi);

	return (0);
}

static int
certhash_file(struct dirent *dep, struct hashinfo **certs,
    struct hashinfo **crls)
{
	struct hashinfo *hi = NULL;
	int has_cert, has_crl;
	int ret = -1;
	BIO *bio = NULL;
	FILE *f;

	has_cert = has_crl = 0;

	if ((f = fopen(dep->d_name, "r")) == NULL) {
		fprintf(stderr, "failed to fopen %s\n", dep->d_name);
		goto err;
	}
	if ((bio = BIO_new_fp(f, BIO_CLOSE)) == NULL) {
		fprintf(stderr, "failed to create bio\n");
		fclose(f);
		goto err;
	}

	if ((hi = certhash_cert(bio, dep->d_name)) != NULL) {
		has_cert = 1;
		*certs = hashinfo_chain(*certs, hi);
	}

	if (BIO_reset(bio) != 0) {
		fprintf(stderr, "BIO_reset failed\n");
		goto err;
	}

	if ((hi = certhash_crl(bio, dep->d_name)) != NULL) {
		has_crl = hi->is_crl = 1;
		*crls = hashinfo_chain(*crls, hi);
	}

	if (!has_cert && !has_crl)
		fprintf(stderr, "PEM file %s does not contain a certificate "
		    "or CRL, ignoring...\n", dep->d_name);

	ret = 0;

err:
	BIO_free(bio);

	return (ret);
}

static int
certhash_directory(const char *path)
{
	struct hashinfo *links = NULL, *certs = NULL, *crls = NULL, *link;
	int ret = 0;
	struct dirent *dep;
	DIR *dip = NULL;

	if ((dip = opendir(".")) == NULL) {
		fprintf(stderr, "failed to open directory %s\n", path);
		goto err;
	}

	if (certhash_config.verbose)
		fprintf(stdout, "scanning directory %s\n", path);

	/* Create lists of existing hash links, certs and CRLs. */
	while ((dep = readdir(dip)) != NULL) {
		if (filename_is_hash(dep->d_name)) {
			if (certhash_link(dep, &links) == -1)
				goto err;
		}
		if (filename_is_pem(dep->d_name)) {
			if (certhash_file(dep, &certs, &crls) == -1)
				goto err;
		}
	}

	if (certhash_merge(&links, &certs, &crls) == -1) {
		fprintf(stderr, "certhash merge failed\n");
		goto err;
	}

	/* Remove spurious links. */
	for (link = links; link != NULL; link = link->next) {
		if (link->exists == 0 ||
		    (link->reference != NULL && link->changed == 0))
			continue;
		if (certhash_config.verbose)
			fprintf(stdout, "%s link %s -> %s\n",
			    (certhash_config.dryrun ? "would remove" :
				"removing"), link->filename, link->target);
		if (certhash_config.dryrun)
			continue;
		if (unlink(link->filename) == -1) {
			fprintf(stderr, "failed to remove link %s\n",
			    link->filename);
			goto err;
		}
	}

	/* Create missing links. */
	for (link = links; link != NULL; link = link->next) {
		if (link->exists == 1 && link->changed == 0)
			continue;
		if (certhash_config.verbose)
			fprintf(stdout, "%s link %s -> %s\n",
			    (certhash_config.dryrun ? "would create" :
				"creating"), link->filename,
			    link->reference->filename);
		if (certhash_config.dryrun)
			continue;
		if (symlink(link->reference->filename, link->filename) == -1) {
			fprintf(stderr, "failed to create link %s -> %s\n",
			    link->filename, link->reference->filename);
			goto err;
		}
	}

	goto done;

err:
	ret = 1;

done:
	hashinfo_chain_free(certs);
	hashinfo_chain_free(crls);
	hashinfo_chain_free(links);

	if (dip != NULL)
		closedir(dip);
	return (ret);
}

static void
certhash_usage(void)
{
	fprintf(stderr, "usage: certhash [-nv] dir ...\n");
	options_usage(certhash_options);
}

int
certhash_main(int argc, char **argv)
{
	int argsused;
	int i, cwdfd, ret = 0;

	if (single_execution) {
		if (pledge("stdio rpath wpath cpath", NULL) == -1) {
			perror("pledge");
			exit(1);
		}
	}

	memset(&certhash_config, 0, sizeof(certhash_config));

	if (options_parse(argc, argv, certhash_options, NULL, &argsused) != 0) {
                certhash_usage();
                return (1);
        }

	if ((cwdfd = open(".", O_RDONLY)) == -1) {
		perror("failed to open current directory");
		return (1);
	}

	for (i = argsused; i < argc; i++) {
		if (chdir(argv[i]) == -1) {
			fprintf(stderr,
			    "failed to change to directory %s: %s\n",
			    argv[i], strerror(errno));
			ret = 1;
			continue;
		}
		ret |= certhash_directory(argv[i]);
		if (fchdir(cwdfd) == -1) {
			perror("failed to restore current directory");
			ret = 1;
			break;		/* can't continue safely */
		}
	}
	close(cwdfd);

	return (ret);
}


Generated by: GCOVR (Version 3.3)

Line	Branch	Exec	Source
1			/*
2			* Copyright (c) 2014, 2015 Joel Sing <jsing@openbsd.org>
3			*
4			* Permission to use, copy, modify, and distribute this software for any
5			* purpose with or without fee is hereby granted, provided that the above
6			* copyright notice and this permission notice appear in all copies.
7			*
8			* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9			* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10			* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11			* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12			* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13			* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14			* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15			*/
16
17			#include <sys/types.h>
18			#include <sys/stat.h>
19
20			#include <errno.h>
21			#include <dirent.h>
22			#include <fcntl.h>
23			#include <limits.h>
24			#include <stdio.h>
25			#include <string.h>
26			#include <unistd.h>
27
28			#include <openssl/bio.h>
29			#include <openssl/evp.h>
30			#include <openssl/pem.h>
31			#include <openssl/x509.h>
32
33			#include "apps.h"
34
35			static struct {
36			int dryrun;
37			int verbose;
38			} certhash_config;
39
40			struct option certhash_options[] = {
41			{
42			.name = "n",
43			.desc = "Perform a dry-run - do not make any changes",
44			.type = OPTION_FLAG,
45			.opt.flag = &certhash_config.dryrun,
46			},
47			{
48			.name = "v",
49			.desc = "Verbose",
50			.type = OPTION_FLAG,
51			.opt.flag = &certhash_config.verbose,
52			},
53			{ NULL },
54			};
55
56			struct hashinfo {
57			char *filename;
58			char *target;
59			unsigned long hash;
60			unsigned int index;
61			unsigned char fingerprint[EVP_MAX_MD_SIZE];
62			int is_crl;
63			int is_dup;
64			int exists;
65			int changed;
66			struct hashinfo *reference;
67			struct hashinfo *next;
68			};
69
70			static struct hashinfo *
71			hashinfo(const char filename, unsigned long hash, unsigned char fingerprint)
72			{
73			struct hashinfo *hi;
74
75			if ((hi = calloc(1, sizeof(*hi))) == NULL)
76			return (NULL);
77			if (filename != NULL) {
78			if ((hi->filename = strdup(filename)) == NULL) {
79			free(hi);
80			return (NULL);
81			}
82			}
83			hi->hash = hash;
84			if (fingerprint != NULL)
85			memcpy(hi->fingerprint, fingerprint, sizeof(hi->fingerprint));
86
87			return (hi);
88			}
89
90			static void
91			hashinfo_free(struct hashinfo *hi)
92			{
93			if (hi == NULL)
94			return;
95
96			free(hi->filename);
97			free(hi->target);
98			free(hi);
99			}
100
101			#ifdef DEBUG
102			static void
103			hashinfo_print(struct hashinfo *hi)
104			{
105			int i;
106
107			printf("hashinfo %s %08lx %u %i\n", hi->filename, hi->hash,
108			hi->index, hi->is_crl);
109			for (i = 0; i < (int)EVP_MAX_MD_SIZE; i++) {
110			printf("%02X%c", hi->fingerprint[i],
111			(i + 1 == (int)EVP_MAX_MD_SIZE) ? '\n' : ':');
112			}
113			}
114			#endif
115
116			static int
117			hashinfo_compare(const void a, const void b)
118			{
119			struct hashinfo hia = (struct hashinfo **)a;
120			struct hashinfo hib = (struct hashinfo **)b;
121			int rv;
122
123			rv = hia->hash < hib->hash ? -1 : hia->hash > hib->hash;
124			if (rv != 0)
125			return (rv);
126			rv = memcmp(hia->fingerprint, hib->fingerprint,
127			sizeof(hia->fingerprint));
128			if (rv != 0)
129			return (rv);
130			return strcmp(hia->filename, hib->filename);
131			}
132
133			static struct hashinfo *
134			hashinfo_chain(struct hashinfo head, struct hashinfo entry)
135			{
136			struct hashinfo *hi = head;
137
138			if (hi == NULL)
139			return (entry);
140			while (hi->next != NULL)
141			hi = hi->next;
142			hi->next = entry;
143
144			return (head);
145			}
146
147			static void
148			hashinfo_chain_free(struct hashinfo *hi)
149			{
150			struct hashinfo *next;
151
152			while (hi != NULL) {
153			next = hi->next;
154			hashinfo_free(hi);
155			hi = next;
156			}
157			}
158
159			static size_t
160			hashinfo_chain_length(struct hashinfo *hi)
161			{
162			int len = 0;
163
164			while (hi != NULL) {
165			len++;
166			hi = hi->next;
167			}
168			return (len);
169			}
170
171			static int
172			hashinfo_chain_sort(struct hashinfo **head)
173			{
174			struct hashinfo *list, entry;
175			size_t len;
176			int i;
177
178			if (*head == NULL)
179			return (0);
180
181			len = hashinfo_chain_length(*head);
182			if ((list = reallocarray(NULL, len, sizeof(struct hashinfo *))) == NULL)
183			return (-1);
184
185			for (entry = *head, i = 0; entry != NULL; entry = entry->next, i++)
186			list[i] = entry;
187			qsort(list, len, sizeof(struct hashinfo *), hashinfo_compare);
188
189			*head = entry = list[0];
190			for (i = 1; i < len; i++) {
191			entry->next = list[i];
192			entry = list[i];
193			}
194			entry->next = NULL;
195
196			free(list);
197			return (0);
198			}
199
200			static char *
201			hashinfo_linkname(struct hashinfo *hi)
202			{
203			char *filename;
204
205			if (asprintf(&filename, "%08lx.%s%u", hi->hash,
206			(hi->is_crl ? "r" : ""), hi->index) == -1)
207			return (NULL);
208
209			return (filename);
210			}
211
212			static int
213			filename_is_hash(const char *filename)
214			{
215			const char *p = filename;
216
217			while ((p >= '0' && p <= '9') \|\| (p >= 'a' && p <= 'f'))
218			p++;
219			if (*p++ != '.')
220			return (0);
221			if (p == 'r') / CRL format. */
222			p++;
223			while (p >= '0' && p <= '9')
224			p++;
225			if (*p != '\0')
226			return (0);
227
228			return (1);
229			}
230
231			static int
232			filename_is_pem(const char *filename)
233			{
234			const char q, p = filename;
235
236			if ((q = strchr(p, '\0')) == NULL)
237			return (0);
238			if ((q - p) < 4)
239			return (0);
240			if (strncmp((q - 4), ".pem", 4) != 0)
241			return (0);
242
243			return (1);
244			}
245
246			static struct hashinfo *
247			hashinfo_from_linkname(const char linkname, const char target)
248			{
249			struct hashinfo *hi = NULL;
250			const char *errstr;
251			char l, p, *ep;
252			long long val;
253
254			if ((l = strdup(linkname)) == NULL)
255			goto err;
256			if ((p = strchr(l, '.')) == NULL)
257			goto err;
258			*p++ = '\0';
259
260			if ((hi = hashinfo(linkname, 0, NULL)) == NULL)
261			goto err;
262			if ((hi->target = strdup(target)) == NULL)
263			goto err;
264
265			errno = 0;
266			val = strtoll(l, &ep, 16);
267			if (l[0] == '\0' \|\| *ep != '\0')
268			goto err;
269			if (errno == ERANGE && (val == LLONG_MAX \|\| val == LLONG_MIN))
270			goto err;
271			if (val < 0 \|\| val > ULONG_MAX)
272			goto err;
273			hi->hash = (unsigned long)val;
274
275			if (*p == 'r') {
276			hi->is_crl = 1;
277			p++;
278			}
279
280			val = strtonum(p, 0, 0xffffffff, &errstr);
281			if (errstr != NULL)
282			goto err;
283
284			hi->index = (unsigned int)val;
285
286			goto done;
287
288			err:
289			hashinfo_free(hi);
290			hi = NULL;
291
292			done:
293			free(l);
294
295			return (hi);
296			}
297
298			static struct hashinfo *
299			certhash_cert(BIO bio, const char filename)
300			{
301			unsigned char fingerprint[EVP_MAX_MD_SIZE];
302			struct hashinfo *hi = NULL;
303			const EVP_MD *digest;
304			X509 *cert = NULL;
305			unsigned long hash;
306			unsigned int len;
307
308			if ((cert = PEM_read_bio_X509(bio, NULL, NULL, NULL)) == NULL)
309			goto err;
310
311			hash = X509_subject_name_hash(cert);
312
313			digest = EVP_sha256();
314			if (X509_digest(cert, digest, fingerprint, &len) != 1) {
315			fprintf(stderr, "out of memory\n");
316			goto err;
317			}
318
319			hi = hashinfo(filename, hash, fingerprint);
320
321			err:
322			X509_free(cert);
323
324			return (hi);
325			}
326
327			static struct hashinfo *
328			certhash_crl(BIO bio, const char filename)
329			{
330			unsigned char fingerprint[EVP_MAX_MD_SIZE];
331			struct hashinfo *hi = NULL;
332			const EVP_MD *digest;
333			X509_CRL *crl = NULL;
334			unsigned long hash;
335			unsigned int len;
336
337			if ((crl = PEM_read_bio_X509_CRL(bio, NULL, NULL, NULL)) == NULL)
338			return (NULL);
339
340			hash = X509_NAME_hash(X509_CRL_get_issuer(crl));
341
342			digest = EVP_sha256();
343			if (X509_CRL_digest(crl, digest, fingerprint, &len) != 1) {
344			fprintf(stderr, "out of memory\n");
345			goto err;
346			}
347
348			hi = hashinfo(filename, hash, fingerprint);
349
350			err:
351			X509_CRL_free(crl);
352
353			return (hi);
354			}
355
356			static int
357			certhash_addlink(struct hashinfo *links, struct hashinfo hi)
358			{
359			struct hashinfo *link = NULL;
360
361			if ((link = hashinfo(NULL, hi->hash, hi->fingerprint)) == NULL)
362			goto err;
363
364			if ((link->filename = hashinfo_linkname(hi)) == NULL)
365			goto err;
366
367			link->reference = hi;
368			link->changed = 1;
369			links = hashinfo_chain(links, link);
370			hi->reference = link;
371
372			return (0);
373
374			err:
375			hashinfo_free(link);
376			return (-1);
377			}
378
379			static void
380			certhash_findlink(struct hashinfo links, struct hashinfo hi)
381			{
382			struct hashinfo *link;
383
384			for (link = links; link != NULL; link = link->next) {
385			if (link->is_crl == hi->is_crl &&
386			link->hash == hi->hash &&
387			link->index == hi->index &&
388			link->reference == NULL) {
389			link->reference = hi;
390			if (link->target == NULL \|\|
391			strcmp(link->target, hi->filename) != 0)
392			link->changed = 1;
393			hi->reference = link;
394			break;
395			}
396			}
397			}
398
399			static void
400			certhash_index(struct hashinfo head, const char name)
401			{
402			struct hashinfo last, entry;
403			int index = 0;
404
405			last = NULL;
406			for (entry = head; entry != NULL; entry = entry->next) {
407			if (last != NULL) {
408			if (entry->hash == last->hash) {
409			if (memcmp(entry->fingerprint,
410			last->fingerprint,
411			sizeof(entry->fingerprint)) == 0) {
412			fprintf(stderr, "WARNING: duplicate %s "
413			"in %s (using %s), ignoring...\n",
414			name, entry->filename,
415			last->filename);
416			entry->is_dup = 1;
417			continue;
418			}
419			index++;
420			} else {
421			index = 0;
422			}
423			}
424			entry->index = index;
425			last = entry;
426			}
427			}
428
429			static int
430			certhash_merge(struct hashinfo links, struct hashinfo certs,
431			struct hashinfo **crls)
432			{
433			struct hashinfo cert, crl;
434
435			/* Pass 1 - sort and index entries. */
436			if (hashinfo_chain_sort(certs) == -1)
437			return (-1);
438			if (hashinfo_chain_sort(crls) == -1)
439			return (-1);
440			certhash_index(*certs, "certificate");
441			certhash_index(*crls, "CRL");
442
443			/* Pass 2 - map to existing links. */
444			for (cert = *certs; cert != NULL; cert = cert->next) {
445			if (cert->is_dup == 1)
446			continue;
447			certhash_findlink(*links, cert);
448			}
449			for (crl = *crls; crl != NULL; crl = crl->next) {
450			if (crl->is_dup == 1)
451			continue;
452			certhash_findlink(*links, crl);
453			}
454
455			/* Pass 3 - determine missing links. */
456			for (cert = *certs; cert != NULL; cert = cert->next) {
457			if (cert->is_dup == 1 \|\| cert->reference != NULL)
458			continue;
459			if (certhash_addlink(links, cert) == -1)
460			return (-1);
461			}
462			for (crl = *crls; crl != NULL; crl = crl->next) {
463			if (crl->is_dup == 1 \|\| crl->reference != NULL)
464			continue;
465			if (certhash_addlink(links, crl) == -1)
466			return (-1);
467			}
468
469			return (0);
470			}
471
472			static int
473			certhash_link(struct dirent dep, struct hashinfo *links)
474			{
475			struct hashinfo *hi = NULL;
476			char target[PATH_MAX];
477			struct stat sb;
478			int n;
479
480			if (lstat(dep->d_name, &sb) == -1) {
481			fprintf(stderr, "failed to stat %s\n", dep->d_name);
482			return (-1);
483			}
484			if (!S_ISLNK(sb.st_mode))
485			return (0);
486
487			n = readlink(dep->d_name, target, sizeof(target) - 1);
488			if (n == -1) {
489			fprintf(stderr, "failed to readlink %s\n", dep->d_name);
490			return (-1);
491			}
492			target[n] = '\0';
493
494			hi = hashinfo_from_linkname(dep->d_name, target);
495			if (hi == NULL) {
496			fprintf(stderr, "failed to get hash info %s\n", dep->d_name);
497			return (-1);
498			}
499			hi->exists = 1;
500			links = hashinfo_chain(links, hi);
501
502			return (0);
503			}
504
505			static int
506			certhash_file(struct dirent dep, struct hashinfo *certs,
507			struct hashinfo **crls)
508			{
509			struct hashinfo *hi = NULL;
510			int has_cert, has_crl;
511			int ret = -1;
512			BIO *bio = NULL;
513			FILE *f;
514
515			has_cert = has_crl = 0;
516
517			if ((f = fopen(dep->d_name, "r")) == NULL) {
518			fprintf(stderr, "failed to fopen %s\n", dep->d_name);
519			goto err;
520			}
521			if ((bio = BIO_new_fp(f, BIO_CLOSE)) == NULL) {
522			fprintf(stderr, "failed to create bio\n");
523			fclose(f);
524			goto err;
525			}
526
527			if ((hi = certhash_cert(bio, dep->d_name)) != NULL) {
528			has_cert = 1;
529			certs = hashinfo_chain(certs, hi);
530			}
531
532			if (BIO_reset(bio) != 0) {
533			fprintf(stderr, "BIO_reset failed\n");
534			goto err;
535			}
536
537			if ((hi = certhash_crl(bio, dep->d_name)) != NULL) {
538			has_crl = hi->is_crl = 1;
539			crls = hashinfo_chain(crls, hi);
540			}
541
542			if (!has_cert && !has_crl)
543			fprintf(stderr, "PEM file %s does not contain a certificate "
544			"or CRL, ignoring...\n", dep->d_name);
545
546			ret = 0;
547
548			err:
549			BIO_free(bio);
550
551			return (ret);
552			}
553
554			static int
555			certhash_directory(const char *path)
556			{
557			struct hashinfo links = NULL, certs = NULL, crls = NULL, link;
558			int ret = 0;
559			struct dirent *dep;
560			DIR *dip = NULL;
561
562			if ((dip = opendir(".")) == NULL) {
563			fprintf(stderr, "failed to open directory %s\n", path);
564			goto err;
565			}
566
567			if (certhash_config.verbose)
568			fprintf(stdout, "scanning directory %s\n", path);
569
570			/* Create lists of existing hash links, certs and CRLs. */
571			while ((dep = readdir(dip)) != NULL) {
572			if (filename_is_hash(dep->d_name)) {
573			if (certhash_link(dep, &links) == -1)
574			goto err;
575			}
576			if (filename_is_pem(dep->d_name)) {
577			if (certhash_file(dep, &certs, &crls) == -1)
578			goto err;
579			}
580			}
581
582			if (certhash_merge(&links, &certs, &crls) == -1) {
583			fprintf(stderr, "certhash merge failed\n");
584			goto err;
585			}
586
587			/* Remove spurious links. */
588			for (link = links; link != NULL; link = link->next) {
589			if (link->exists == 0 \|\|
590			(link->reference != NULL && link->changed == 0))
591			continue;
592			if (certhash_config.verbose)
593			fprintf(stdout, "%s link %s -> %s\n",
594			(certhash_config.dryrun ? "would remove" :
595			"removing"), link->filename, link->target);
596			if (certhash_config.dryrun)
597			continue;
598			if (unlink(link->filename) == -1) {
599			fprintf(stderr, "failed to remove link %s\n",
600			link->filename);
601			goto err;
602			}
603			}
604
605			/* Create missing links. */
606			for (link = links; link != NULL; link = link->next) {
607			if (link->exists == 1 && link->changed == 0)
608			continue;
609			if (certhash_config.verbose)
610			fprintf(stdout, "%s link %s -> %s\n",
611			(certhash_config.dryrun ? "would create" :
612			"creating"), link->filename,
613			link->reference->filename);
614			if (certhash_config.dryrun)
615			continue;
616			if (symlink(link->reference->filename, link->filename) == -1) {
617			fprintf(stderr, "failed to create link %s -> %s\n",
618			link->filename, link->reference->filename);
619			goto err;
620			}
621			}
622
623			goto done;
624
625			err:
626			ret = 1;
627
628			done:
629			hashinfo_chain_free(certs);
630			hashinfo_chain_free(crls);
631			hashinfo_chain_free(links);
632
633			if (dip != NULL)
634			closedir(dip);
635			return (ret);
636			}
637
638			static void
639			certhash_usage(void)
640			{
641			fprintf(stderr, "usage: certhash [-nv] dir ...\n");
642			options_usage(certhash_options);
643			}
644
645			int
646			certhash_main(int argc, char **argv)
647			{
648			int argsused;
649			int i, cwdfd, ret = 0;
650
651			if (single_execution) {
652			if (pledge("stdio rpath wpath cpath", NULL) == -1) {
653			perror("pledge");
654			exit(1);
655			}
656			}
657
658			memset(&certhash_config, 0, sizeof(certhash_config));
659
660			if (options_parse(argc, argv, certhash_options, NULL, &argsused) != 0) {
661			certhash_usage();
662			return (1);
663			}
664
665			if ((cwdfd = open(".", O_RDONLY)) == -1) {
666			perror("failed to open current directory");
667			return (1);
668			}
669
670			for (i = argsused; i < argc; i++) {
671			if (chdir(argv[i]) == -1) {
672			fprintf(stderr,
673			"failed to change to directory %s: %s\n",
674			argv[i], strerror(errno));
675			ret = 1;
676			continue;
677			}
678			ret \|= certhash_directory(argv[i]);
679			if (fchdir(cwdfd) == -1) {
680			perror("failed to restore current directory");
681			ret = 1;
682			break; /* can't continue safely */
683			}
684			}
685			close(cwdfd);
686
687			return (ret);
688			}