Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	usr.bin/openssl/crl.c	Lines:	72	162	44.4 %
Date:	2017-11-13	Branches:	41	99	41.4 %


/* $OpenBSD: crl.c,v 1.10 2017/01/20 08:57:11 deraadt Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 *
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 *
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 *
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "apps.h"

#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/pem.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>

static struct {
	char *cafile;
	char *capath;
	int crlnumber;
	int fingerprint;
	int hash;
	int hash_old;
	char *infile;
	int informat;
	int issuer;
	int lastupdate;
	char *nameopt;
	int nextupdate;
	int noout;
	char *outfile;
	int outformat;
	int text;
	int verify;
} crl_config;

static struct option crl_options[] = {
	{
		.name = "CAfile",
		.argname = "file",
		.desc = "Verify the CRL using certificates in the given file",
		.type = OPTION_ARG,
		.opt.arg = &crl_config.cafile,
	},
	{
		.name = "CApath",
		.argname = "path",
		.desc = "Verify the CRL using certificates in the given path",
		.type = OPTION_ARG,
		.opt.arg = &crl_config.capath,
	},
	{
		.name = "crlnumber",
		.desc = "Print the CRL number",
		.type = OPTION_FLAG_ORD,
		.opt.flag = &crl_config.crlnumber,
	},
	{
		.name = "fingerprint",
		.desc = "Print the CRL fingerprint",
		.type = OPTION_FLAG_ORD,
		.opt.flag = &crl_config.fingerprint,
	},
	{
		.name = "hash",
		.desc = "Print the hash of the issuer name",
		.type = OPTION_FLAG_ORD,
		.opt.flag = &crl_config.hash,
	},
	{
		.name = "hash_old",
		.desc = "Print an old-style (MD5) hash of the issuer name",
		.type = OPTION_FLAG_ORD,
		.opt.flag = &crl_config.hash_old,
	},
	{
		.name = "in",
		.argname = "file",
		.desc = "Input file to read from (stdin if unspecified)",
		.type = OPTION_ARG,
		.opt.arg = &crl_config.infile,
	},
	{
		.name = "inform",
		.argname = "format",
		.desc = "Input format (DER or PEM)",
		.type = OPTION_ARG_FORMAT,
		.opt.value = &crl_config.informat,
	},
	{
		.name = "issuer",
		.desc = "Print the issuer name",
		.type = OPTION_FLAG_ORD,
		.opt.flag = &crl_config.issuer,
	},
	{
		.name = "lastupdate",
		.desc = "Print the lastUpdate field",
		.type = OPTION_FLAG_ORD,
		.opt.flag = &crl_config.lastupdate,
	},
	{
		.name = "nameopt",
		.argname = "options",
		.desc = "Specify certificate name options",
		.type = OPTION_ARG,
		.opt.arg = &crl_config.nameopt,
	},
	{
		.name = "nextupdate",
		.desc = "Print the nextUpdate field",
		.type = OPTION_FLAG_ORD,
		.opt.flag = &crl_config.nextupdate,
	},
	{
		.name = "noout",
		.desc = "Do not output the encoded version of the CRL",
		.type = OPTION_FLAG,
		.opt.flag = &crl_config.noout,
	},
	{
		.name = "out",
		.argname = "file",
		.desc = "Output file to write to (stdout if unspecified)",
		.type = OPTION_ARG,
		.opt.arg = &crl_config.outfile,
	},
	{
		.name = "outform",
		.argname = "format",
		.desc = "Output format (DER or PEM)",
		.type = OPTION_ARG_FORMAT,
		.opt.value = &crl_config.outformat,
	},
	{
		.name = "text",
		.desc = "Print out the CRL in text form",
		.type = OPTION_FLAG,
		.opt.flag = &crl_config.text,
	},
	{
		.name = "verify",
		.desc = "Verify the signature on the CRL",
		.type = OPTION_FLAG,
		.opt.flag = &crl_config.verify,
	},
	{NULL},
};

static void
crl_usage(void)
{
	fprintf(stderr,
	    "usage: crl [-CAfile file] [-CApath dir] [-fingerprint] [-hash]\n"
	    "    [-in file] [-inform DER | PEM] [-issuer] [-lastupdate]\n"
	    "    [-nextupdate] [-noout] [-out file] [-outform DER | PEM]\n"
	    "    [-text]\n\n");
	options_usage(crl_options);
}

static X509_CRL *load_crl(char *file, int format);
static BIO *bio_out = NULL;

int
crl_main(int argc, char **argv)
{
	unsigned long nmflag = 0;
	X509_CRL *x = NULL;
	int ret = 1, i;
	BIO *out = NULL;
	X509_STORE *store = NULL;
	X509_STORE_CTX ctx;
	X509_LOOKUP *lookup = NULL;
	X509_OBJECT xobj;
	EVP_PKEY *pkey;
	const EVP_MD *digest;
	char *digest_name = NULL;

	if (single_execution) {
		if (pledge("stdio cpath wpath rpath flock", NULL) == -1) {
			perror("pledge");
			exit(1);
		}
	}

	if (bio_out == NULL) {
		if ((bio_out = BIO_new(BIO_s_file())) != NULL) {
			BIO_set_fp(bio_out, stdout, BIO_NOCLOSE);
		}
	}

	digest = EVP_sha1();

	memset(&crl_config, 0, sizeof(crl_config));
	crl_config.informat = FORMAT_PEM;
	crl_config.outformat = FORMAT_PEM;

	if (options_parse(argc, argv, crl_options, &digest_name, NULL) != 0) {
		crl_usage();
		goto end;
	}

	if (crl_config.cafile != NULL || crl_config.capath != NULL)
		crl_config.verify = 1;

	if (crl_config.nameopt != NULL) {
		if (set_name_ex(&nmflag, crl_config.nameopt) != 1) {
			fprintf(stderr,
			    "Invalid -nameopt argument '%s'\n",
			    crl_config.nameopt);
			goto end;
		}
	}

	if (digest_name != NULL) {
		if ((digest = EVP_get_digestbyname(digest_name)) == NULL) {
			fprintf(stderr,
			    "Unknown message digest algorithm '%s'\n",
			    digest_name);
			goto end;
		}
	}

	x = load_crl(crl_config.infile, crl_config.informat);
	if (x == NULL)
		goto end;

	if (crl_config.verify) {
		store = X509_STORE_new();
		lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
		if (lookup == NULL)
			goto end;
		if (!X509_LOOKUP_load_file(lookup, crl_config.cafile,
		    X509_FILETYPE_PEM))
			X509_LOOKUP_load_file(lookup, NULL,
			    X509_FILETYPE_DEFAULT);

		lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
		if (lookup == NULL)
			goto end;
		if (!X509_LOOKUP_add_dir(lookup, crl_config.capath,
		    X509_FILETYPE_PEM))
			X509_LOOKUP_add_dir(lookup, NULL,
			    X509_FILETYPE_DEFAULT);
		ERR_clear_error();

		if (!X509_STORE_CTX_init(&ctx, store, NULL, NULL)) {
			BIO_printf(bio_err,
			    "Error initialising X509 store\n");
			goto end;
		}
		i = X509_STORE_get_by_subject(&ctx, X509_LU_X509,
		    X509_CRL_get_issuer(x), &xobj);
		if (i <= 0) {
			BIO_printf(bio_err,
			    "Error getting CRL issuer certificate\n");
			goto end;
		}
		pkey = X509_get_pubkey(xobj.data.x509);
		X509_OBJECT_free_contents(&xobj);
		if (!pkey) {
			BIO_printf(bio_err,
			    "Error getting CRL issuer public key\n");
			goto end;
		}
		i = X509_CRL_verify(x, pkey);
		EVP_PKEY_free(pkey);
		if (i < 0)
			goto end;
		if (i == 0)
			BIO_printf(bio_err, "verify failure\n");
		else
			BIO_printf(bio_err, "verify OK\n");
	}

	/* Print requested information the order that the flags were given. */
	for (i = 1; i <= argc; i++) {
		if (crl_config.issuer == i) {
			print_name(bio_out, "issuer=",
			    X509_CRL_get_issuer(x), nmflag);
		}
		if (crl_config.crlnumber == i) {
			ASN1_INTEGER *crlnum;
			crlnum = X509_CRL_get_ext_d2i(x,
			    NID_crl_number, NULL, NULL);
			BIO_printf(bio_out, "crlNumber=");
			if (crlnum) {
				i2a_ASN1_INTEGER(bio_out, crlnum);
				ASN1_INTEGER_free(crlnum);
			} else
				BIO_puts(bio_out, "<NONE>");
			BIO_printf(bio_out, "\n");
		}
		if (crl_config.hash == i) {
			BIO_printf(bio_out, "%08lx\n",
			    X509_NAME_hash(X509_CRL_get_issuer(x)));
		}
#ifndef OPENSSL_NO_MD5
		if (crl_config.hash_old == i) {
			BIO_printf(bio_out, "%08lx\n",
			    X509_NAME_hash_old(X509_CRL_get_issuer(x)));
		}
#endif
		if (crl_config.lastupdate == i) {
			BIO_printf(bio_out, "lastUpdate=");
			ASN1_TIME_print(bio_out,
			    X509_CRL_get_lastUpdate(x));
			BIO_printf(bio_out, "\n");
		}
		if (crl_config.nextupdate == i) {
			BIO_printf(bio_out, "nextUpdate=");
			if (X509_CRL_get_nextUpdate(x))
				ASN1_TIME_print(bio_out,
				    X509_CRL_get_nextUpdate(x));
			else
				BIO_printf(bio_out, "NONE");
			BIO_printf(bio_out, "\n");
		}
		if (crl_config.fingerprint == i) {
			int j;
			unsigned int n;
			unsigned char md[EVP_MAX_MD_SIZE];

			if (!X509_CRL_digest(x, digest, md, &n)) {
				BIO_printf(bio_err, "out of memory\n");
				goto end;
			}
			BIO_printf(bio_out, "%s Fingerprint=",
			    OBJ_nid2sn(EVP_MD_type(digest)));
			for (j = 0; j < (int) n; j++) {
				BIO_printf(bio_out, "%02X%c", md[j],
				    (j + 1 == (int)n) ? '\n' : ':');
			}
		}
	}

	out = BIO_new(BIO_s_file());
	if (out == NULL) {
		ERR_print_errors(bio_err);
		goto end;
	}
	if (crl_config.outfile == NULL) {
		BIO_set_fp(out, stdout, BIO_NOCLOSE);
	} else {
		if (BIO_write_filename(out, crl_config.outfile) <= 0) {
			perror(crl_config.outfile);
			goto end;
		}
	}

	if (crl_config.text)
		X509_CRL_print(out, x);

	if (crl_config.noout) {
		ret = 0;
		goto end;
	}
	if (crl_config.outformat == FORMAT_ASN1)
		i = (int) i2d_X509_CRL_bio(out, x);
	else if (crl_config.outformat == FORMAT_PEM)
		i = PEM_write_bio_X509_CRL(out, x);
	else {
		BIO_printf(bio_err,
		    "bad output format specified for outfile\n");
		goto end;
	}
	if (!i) {
		BIO_printf(bio_err, "unable to write CRL\n");
		goto end;
	}
	ret = 0;

end:
	BIO_free_all(out);
	BIO_free_all(bio_out);
	bio_out = NULL;
	X509_CRL_free(x);
	if (store) {
		X509_STORE_CTX_cleanup(&ctx);
		X509_STORE_free(store);
	}

	return (ret);
}

static X509_CRL *
load_crl(char *infile, int format)
{
	X509_CRL *x = NULL;
	BIO *in = NULL;

	in = BIO_new(BIO_s_file());
	if (in == NULL) {
		ERR_print_errors(bio_err);
		goto end;
	}
	if (infile == NULL)
		BIO_set_fp(in, stdin, BIO_NOCLOSE);
	else {
		if (BIO_read_filename(in, infile) <= 0) {
			perror(infile);
			goto end;
		}
	}
	if (format == FORMAT_ASN1)
		x = d2i_X509_CRL_bio(in, NULL);
	else if (format == FORMAT_PEM)
		x = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
	else {
		BIO_printf(bio_err,
		    "bad input format specified for input crl\n");
		goto end;
	}
	if (x == NULL) {
		BIO_printf(bio_err, "unable to load CRL\n");
		ERR_print_errors(bio_err);
		goto end;
	}

end:
	BIO_free(in);
	return (x);
}


Generated by: GCOVR (Version 3.3)

Line	Branch	Exec	Source
1			/* $OpenBSD: crl.c,v 1.10 2017/01/20 08:57:11 deraadt Exp $ */
2			/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3			* All rights reserved.
4			*
5			* This package is an SSL implementation written
6			* by Eric Young (eay@cryptsoft.com).
7			* The implementation was written so as to conform with Netscapes SSL.
8			*
9			* This library is free for commercial and non-commercial use as long as
10			* the following conditions are aheared to. The following conditions
11			* apply to all code found in this distribution, be it the RC4, RSA,
12			* lhash, DES, etc., code; not just the SSL code. The SSL documentation
13			* included with this distribution is covered by the same copyright terms
14			* except that the holder is Tim Hudson (tjh@cryptsoft.com).
15			*
16			* Copyright remains Eric Young's, and as such any Copyright notices in
17			* the code are not to be removed.
18			* If this package is used in a product, Eric Young should be given attribution
19			* as the author of the parts of the library used.
20			* This can be in the form of a textual message at program startup or
21			* in documentation (online or textual) provided with the package.
22			*
23			* Redistribution and use in source and binary forms, with or without
24			* modification, are permitted provided that the following conditions
25			* are met:
26			* 1. Redistributions of source code must retain the copyright
27			* notice, this list of conditions and the following disclaimer.
28			* 2. Redistributions in binary form must reproduce the above copyright
29			* notice, this list of conditions and the following disclaimer in the
30			* documentation and/or other materials provided with the distribution.
31			* 3. All advertising materials mentioning features or use of this software
32			* must display the following acknowledgement:
33			* "This product includes cryptographic software written by
34			* Eric Young (eay@cryptsoft.com)"
35			* The word 'cryptographic' can be left out if the rouines from the library
36			* being used are not cryptographic related :-).
37			* 4. If you include any Windows specific code (or a derivative thereof) from
38			* the apps directory (application code) you must include an acknowledgement:
39			* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40			*
41			* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42			* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43			* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44			* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45			* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46			* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47			* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48			* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49			* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50			* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51			* SUCH DAMAGE.
52			*
53			* The licence and distribution terms for any publically available version or
54			* derivative of this code cannot be changed. i.e. this code cannot simply be
55			* copied and put under another distribution licence
56			* [including the GNU Public Licence.]
57			*/
58
59			#include <stdio.h>
60			#include <stdlib.h>
61			#include <string.h>
62
63			#include "apps.h"
64
65			#include <openssl/bio.h>
66			#include <openssl/err.h>
67			#include <openssl/pem.h>
68			#include <openssl/x509.h>
69			#include <openssl/x509v3.h>
70
71			static struct {
72			char *cafile;
73			char *capath;
74			int crlnumber;
75			int fingerprint;
76			int hash;
77			int hash_old;
78			char *infile;
79			int informat;
80			int issuer;
81			int lastupdate;
82			char *nameopt;
83			int nextupdate;
84			int noout;
85			char *outfile;
86			int outformat;
87			int text;
88			int verify;
89			} crl_config;
90
91			static struct option crl_options[] = {
92			{
93			.name = "CAfile",
94			.argname = "file",
95			.desc = "Verify the CRL using certificates in the given file",
96			.type = OPTION_ARG,
97			.opt.arg = &crl_config.cafile,
98			},
99			{
100			.name = "CApath",
101			.argname = "path",
102			.desc = "Verify the CRL using certificates in the given path",
103			.type = OPTION_ARG,
104			.opt.arg = &crl_config.capath,
105			},
106			{
107			.name = "crlnumber",
108			.desc = "Print the CRL number",
109			.type = OPTION_FLAG_ORD,
110			.opt.flag = &crl_config.crlnumber,
111			},
112			{
113			.name = "fingerprint",
114			.desc = "Print the CRL fingerprint",
115			.type = OPTION_FLAG_ORD,
116			.opt.flag = &crl_config.fingerprint,
117			},
118			{
119			.name = "hash",
120			.desc = "Print the hash of the issuer name",
121			.type = OPTION_FLAG_ORD,
122			.opt.flag = &crl_config.hash,
123			},
124			{
125			.name = "hash_old",
126			.desc = "Print an old-style (MD5) hash of the issuer name",
127			.type = OPTION_FLAG_ORD,
128			.opt.flag = &crl_config.hash_old,
129			},
130			{
131			.name = "in",
132			.argname = "file",
133			.desc = "Input file to read from (stdin if unspecified)",
134			.type = OPTION_ARG,
135			.opt.arg = &crl_config.infile,
136			},
137			{
138			.name = "inform",
139			.argname = "format",
140			.desc = "Input format (DER or PEM)",
141			.type = OPTION_ARG_FORMAT,
142			.opt.value = &crl_config.informat,
143			},
144			{
145			.name = "issuer",
146			.desc = "Print the issuer name",
147			.type = OPTION_FLAG_ORD,
148			.opt.flag = &crl_config.issuer,
149			},
150			{
151			.name = "lastupdate",
152			.desc = "Print the lastUpdate field",
153			.type = OPTION_FLAG_ORD,
154			.opt.flag = &crl_config.lastupdate,
155			},
156			{
157			.name = "nameopt",
158			.argname = "options",
159			.desc = "Specify certificate name options",
160			.type = OPTION_ARG,
161			.opt.arg = &crl_config.nameopt,
162			},
163			{
164			.name = "nextupdate",
165			.desc = "Print the nextUpdate field",
166			.type = OPTION_FLAG_ORD,
167			.opt.flag = &crl_config.nextupdate,
168			},
169			{
170			.name = "noout",
171			.desc = "Do not output the encoded version of the CRL",
172			.type = OPTION_FLAG,
173			.opt.flag = &crl_config.noout,
174			},
175			{
176			.name = "out",
177			.argname = "file",
178			.desc = "Output file to write to (stdout if unspecified)",
179			.type = OPTION_ARG,
180			.opt.arg = &crl_config.outfile,
181			},
182			{
183			.name = "outform",
184			.argname = "format",
185			.desc = "Output format (DER or PEM)",
186			.type = OPTION_ARG_FORMAT,
187			.opt.value = &crl_config.outformat,
188			},
189			{
190			.name = "text",
191			.desc = "Print out the CRL in text form",
192			.type = OPTION_FLAG,
193			.opt.flag = &crl_config.text,
194			},
195			{
196			.name = "verify",
197			.desc = "Verify the signature on the CRL",
198			.type = OPTION_FLAG,
199			.opt.flag = &crl_config.verify,
200			},
201			{NULL},
202			};
203
204			static void
205			crl_usage(void)
206			{
207		8	fprintf(stderr,
208			"usage: crl [-CAfile file] [-CApath dir] [-fingerprint] [-hash]\n"
209			" [-in file] [-inform DER \| PEM] [-issuer] [-lastupdate]\n"
210			" [-nextupdate] [-noout] [-out file] [-outform DER \| PEM]\n"
211			" [-text]\n\n");
212		4	options_usage(crl_options);
213		4	}
214
215			static X509_CRL load_crl(char file, int format);
216			static BIO *bio_out = NULL;
217
218			int
219			crl_main(int argc, char **argv)
220			{
221		16	unsigned long nmflag = 0;
222			X509_CRL *x = NULL;
223			int ret = 1, i;
224			BIO *out = NULL;
225			X509_STORE *store = NULL;
226		8	X509_STORE_CTX ctx;
227			X509_LOOKUP *lookup = NULL;
228		8	X509_OBJECT xobj;
229			EVP_PKEY *pkey;
230			const EVP_MD *digest;
231		8	char *digest_name = NULL;
232
233	✓✗	8	if (single_execution) {
234	✗✓	8	if (pledge("stdio cpath wpath rpath flock", NULL) == -1) {
235			perror("pledge");
236			exit(1);
237			}
238			}
239
240	✓✗	8	if (bio_out == NULL) {
241	✓✗	8	if ((bio_out = BIO_new(BIO_s_file())) != NULL) {
242		8	BIO_set_fp(bio_out, stdout, BIO_NOCLOSE);
243		8	}
244			}
245
246		8	digest = EVP_sha1();
247
248		8	memset(&crl_config, 0, sizeof(crl_config));
249		8	crl_config.informat = FORMAT_PEM;
250		8	crl_config.outformat = FORMAT_PEM;
251
252	✓✓	8	if (options_parse(argc, argv, crl_options, &digest_name, NULL) != 0) {
253		4	crl_usage();
254		4	goto end;
255			}
256
257	✗✓	4	if (crl_config.cafile != NULL \|\| crl_config.capath != NULL)
258			crl_config.verify = 1;
259
260	✗✓	4	if (crl_config.nameopt != NULL) {
261			if (set_name_ex(&nmflag, crl_config.nameopt) != 1) {
262			fprintf(stderr,
263			"Invalid -nameopt argument '%s'\n",
264			crl_config.nameopt);
265			goto end;
266			}
267			}
268
269	✗✓	4	if (digest_name != NULL) {
270			if ((digest = EVP_get_digestbyname(digest_name)) == NULL) {
271			fprintf(stderr,
272			"Unknown message digest algorithm '%s'\n",
273			digest_name);
274			goto end;
275			}
276			}
277
278		4	x = load_crl(crl_config.infile, crl_config.informat);
279	✓✗	4	if (x == NULL)
280			goto end;
281
282	✗✓	4	if (crl_config.verify) {
283			store = X509_STORE_new();
284			lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
285			if (lookup == NULL)
286			goto end;
287			if (!X509_LOOKUP_load_file(lookup, crl_config.cafile,
288			X509_FILETYPE_PEM))
289			X509_LOOKUP_load_file(lookup, NULL,
290			X509_FILETYPE_DEFAULT);
291
292			lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
293			if (lookup == NULL)
294			goto end;
295			if (!X509_LOOKUP_add_dir(lookup, crl_config.capath,
296			X509_FILETYPE_PEM))
297			X509_LOOKUP_add_dir(lookup, NULL,
298			X509_FILETYPE_DEFAULT);
299			ERR_clear_error();
300
301			if (!X509_STORE_CTX_init(&ctx, store, NULL, NULL)) {
302			BIO_printf(bio_err,
303			"Error initialising X509 store\n");
304			goto end;
305			}
306			i = X509_STORE_get_by_subject(&ctx, X509_LU_X509,
307			X509_CRL_get_issuer(x), &xobj);
308			if (i <= 0) {
309			BIO_printf(bio_err,
310			"Error getting CRL issuer certificate\n");
311			goto end;
312			}
313			pkey = X509_get_pubkey(xobj.data.x509);
314			X509_OBJECT_free_contents(&xobj);
315			if (!pkey) {
316			BIO_printf(bio_err,
317			"Error getting CRL issuer public key\n");
318			goto end;
319			}
320			i = X509_CRL_verify(x, pkey);
321			EVP_PKEY_free(pkey);
322			if (i < 0)
323			goto end;
324			if (i == 0)
325			BIO_printf(bio_err, "verify failure\n");
326			else
327			BIO_printf(bio_err, "verify OK\n");
328			}
329
330			/* Print requested information the order that the flags were given. */
331	✓✓	40	for (i = 1; i <= argc; i++) {
332	✗✓	16	if (crl_config.issuer == i) {
333			print_name(bio_out, "issuer=",
334			X509_CRL_get_issuer(x), nmflag);
335			}
336	✗✓	16	if (crl_config.crlnumber == i) {
337			ASN1_INTEGER *crlnum;
338			crlnum = X509_CRL_get_ext_d2i(x,
339			NID_crl_number, NULL, NULL);
340			BIO_printf(bio_out, "crlNumber=");
341			if (crlnum) {
342			i2a_ASN1_INTEGER(bio_out, crlnum);
343			ASN1_INTEGER_free(crlnum);
344			} else
345			BIO_puts(bio_out, "<NONE>");
346			BIO_printf(bio_out, "\n");
347			}
348	✗✓	16	if (crl_config.hash == i) {
349			BIO_printf(bio_out, "%08lx\n",
350			X509_NAME_hash(X509_CRL_get_issuer(x)));
351			}
352			#ifndef OPENSSL_NO_MD5
353	✗✓	16	if (crl_config.hash_old == i) {
354			BIO_printf(bio_out, "%08lx\n",
355			X509_NAME_hash_old(X509_CRL_get_issuer(x)));
356			}
357			#endif
358	✗✓	16	if (crl_config.lastupdate == i) {
359			BIO_printf(bio_out, "lastUpdate=");
360			ASN1_TIME_print(bio_out,
361			X509_CRL_get_lastUpdate(x));
362			BIO_printf(bio_out, "\n");
363			}
364	✗✓	16	if (crl_config.nextupdate == i) {
365			BIO_printf(bio_out, "nextUpdate=");
366			if (X509_CRL_get_nextUpdate(x))
367			ASN1_TIME_print(bio_out,
368			X509_CRL_get_nextUpdate(x));
369			else
370			BIO_printf(bio_out, "NONE");
371			BIO_printf(bio_out, "\n");
372			}
373	✓✓	16	if (crl_config.fingerprint == i) {
374			int j;
375		4	unsigned int n;
376		4	unsigned char md[EVP_MAX_MD_SIZE];
377
378	✗✓	4	if (!X509_CRL_digest(x, digest, md, &n)) {
379			BIO_printf(bio_err, "out of memory\n");
380			goto end;
381			}
382		8	BIO_printf(bio_out, "%s Fingerprint=",
383		4	OBJ_nid2sn(EVP_MD_type(digest)));
384	✓✓	168	for (j = 0; j < (int) n; j++) {
385		160	BIO_printf(bio_out, "%02X%c", md[j],
386		80	(j + 1 == (int)n) ? '\n' : ':');
387			}
388	✓✓✓	28	}
389			}
390
391		4	out = BIO_new(BIO_s_file());
392	✗✓	4	if (out == NULL) {
393			ERR_print_errors(bio_err);
394			goto end;
395			}
396	✓✗	4	if (crl_config.outfile == NULL) {
397		4	BIO_set_fp(out, stdout, BIO_NOCLOSE);
398		4	} else {
399			if (BIO_write_filename(out, crl_config.outfile) <= 0) {
400			perror(crl_config.outfile);
401			goto end;
402			}
403			}
404
405	✗✓	4	if (crl_config.text)
406			X509_CRL_print(out, x);
407
408	✗✓	4	if (crl_config.noout) {
409			ret = 0;
410			goto end;
411			}
412	✗✓	4	if (crl_config.outformat == FORMAT_ASN1)
413			i = (int) i2d_X509_CRL_bio(out, x);
414	✓✗	4	else if (crl_config.outformat == FORMAT_PEM)
415		4	i = PEM_write_bio_X509_CRL(out, x);
416			else {
417			BIO_printf(bio_err,
418			"bad output format specified for outfile\n");
419			goto end;
420			}
421	✗✓	4	if (!i) {
422			BIO_printf(bio_err, "unable to write CRL\n");
423			goto end;
424			}
425		4	ret = 0;
426
427			end:
428		8	BIO_free_all(out);
429		8	BIO_free_all(bio_out);
430		8	bio_out = NULL;
431		8	X509_CRL_free(x);
432	✗✓	8	if (store) {
433			X509_STORE_CTX_cleanup(&ctx);
434			X509_STORE_free(store);
435			}
436
437		8	return (ret);
438		8	}
439
440			static X509_CRL *
441			load_crl(char *infile, int format)
442			{
443			X509_CRL *x = NULL;
444			BIO *in = NULL;
445
446		8	in = BIO_new(BIO_s_file());
447	✗✓	4	if (in == NULL) {
448			ERR_print_errors(bio_err);
449			goto end;
450			}
451	✗✓	4	if (infile == NULL)
452			BIO_set_fp(in, stdin, BIO_NOCLOSE);
453			else {
454	✗✓	4	if (BIO_read_filename(in, infile) <= 0) {
455			perror(infile);
456			goto end;
457			}
458			}
459	✗✓	4	if (format == FORMAT_ASN1)
460			x = d2i_X509_CRL_bio(in, NULL);
461	✓✗	4	else if (format == FORMAT_PEM)
462		4	x = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
463			else {
464			BIO_printf(bio_err,
465			"bad input format specified for input crl\n");
466			goto end;
467			}
468	✗✓	4	if (x == NULL) {
469			BIO_printf(bio_err, "unable to load CRL\n");
470			ERR_print_errors(bio_err);
471			goto end;
472			}
473
474			end:
475		4	BIO_free(in);
476		4	return (x);
477			}