1 /* This Source Code Form is subject to the terms of the Mozilla Public
2 * License, v. 2.0. If a copy of the MPL was not distributed with this
3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
4
5 /*
6 * p7verify -- A command to do a verification of a *detached* pkcs7 signature.
7 */
8
9 #include "nspr.h"
10 #include "secutil.h"
11 #include "plgetopt.h"
12 #include "secpkcs7.h"
13 #include "cert.h"
14 #include "certdb.h"
15 #include "secoid.h"
16 #include "sechash.h" /* for HASH_GetHashObject() */
17 #include "nss.h"
18
19 #if defined(XP_UNIX)
20 #include <unistd.h>
21 #endif
22
23 #include <stdio.h>
24 #include <string.h>
25
26 #if (defined(XP_WIN) && !defined(WIN32)) || (defined(__sun) && !defined(SVR4))
27 extern int fread(char *, size_t, size_t, FILE *);
28 extern int fprintf(FILE *, char *, ...);
29 #endif
30
31 static HASH_HashType
AlgorithmToHashType(SECAlgorithmID * digestAlgorithms)32 AlgorithmToHashType(SECAlgorithmID *digestAlgorithms)
33 {
34
35 SECOidTag tag;
36
37 tag = SECOID_GetAlgorithmTag(digestAlgorithms);
38
39 switch (tag) {
40 case SEC_OID_MD2:
41 return HASH_AlgMD2;
42 case SEC_OID_MD5:
43 return HASH_AlgMD5;
44 case SEC_OID_SHA1:
45 return HASH_AlgSHA1;
46 default:
47 fprintf(stderr, "should never get here\n");
48 return HASH_AlgNULL;
49 }
50 }
51
52 static int
DigestFile(unsigned char * digest,unsigned int * len,unsigned int maxLen,FILE * inFile,HASH_HashType hashType)53 DigestFile(unsigned char *digest, unsigned int *len, unsigned int maxLen,
54 FILE *inFile, HASH_HashType hashType)
55 {
56 int nb;
57 unsigned char ibuf[4096];
58 const SECHashObject *hashObj;
59 void *hashcx;
60
61 hashObj = HASH_GetHashObject(hashType);
62
63 hashcx = (*hashObj->create)();
64 if (hashcx == NULL)
65 return -1;
66
67 (*hashObj->begin)(hashcx);
68
69 for (;;) {
70 if (feof(inFile))
71 break;
72 nb = fread(ibuf, 1, sizeof(ibuf), inFile);
73 if (nb != sizeof(ibuf)) {
74 if (nb == 0) {
75 if (ferror(inFile)) {
76 PORT_SetError(SEC_ERROR_IO);
77 (*hashObj->destroy)(hashcx, PR_TRUE);
78 return -1;
79 }
80 /* eof */
81 break;
82 }
83 }
84 (*hashObj->update)(hashcx, ibuf, nb);
85 }
86
87 (*hashObj->end)(hashcx, digest, len, maxLen);
88 (*hashObj->destroy)(hashcx, PR_TRUE);
89
90 return 0;
91 }
92
93 static void
Usage(char * progName)94 Usage(char *progName)
95 {
96 fprintf(stderr,
97 "Usage: %s -c content -s signature [-d dbdir] [-u certusage]\n",
98 progName);
99 fprintf(stderr, "%-20s content file that was signed\n",
100 "-c content");
101 fprintf(stderr, "%-20s file containing signature for that content\n",
102 "-s signature");
103 fprintf(stderr,
104 "%-20s Key/Cert database directory (default is ~/.netscape)\n",
105 "-d dbdir");
106 fprintf(stderr, "%-20s Define the type of certificate usage (default is certUsageEmailSigner)\n",
107 "-u certusage");
108 fprintf(stderr, "%-25s 0 - certUsageSSLClient\n", " ");
109 fprintf(stderr, "%-25s 1 - certUsageSSLServer\n", " ");
110 fprintf(stderr, "%-25s 2 - certUsageSSLServerWithStepUp\n", " ");
111 fprintf(stderr, "%-25s 3 - certUsageSSLCA\n", " ");
112 fprintf(stderr, "%-25s 4 - certUsageEmailSigner\n", " ");
113 fprintf(stderr, "%-25s 5 - certUsageEmailRecipient\n", " ");
114 fprintf(stderr, "%-25s 6 - certUsageObjectSigner\n", " ");
115 fprintf(stderr, "%-25s 7 - certUsageUserCertImport\n", " ");
116 fprintf(stderr, "%-25s 8 - certUsageVerifyCA\n", " ");
117 fprintf(stderr, "%-25s 9 - certUsageProtectedObjectSigner\n", " ");
118 fprintf(stderr, "%-25s 10 - certUsageStatusResponder\n", " ");
119 fprintf(stderr, "%-25s 11 - certUsageAnyCA\n", " ");
120 fprintf(stderr, "%-25s 12 - certUsageIPsec\n", " ");
121
122 exit(-1);
123 }
124
125 static int
HashDecodeAndVerify(FILE * out,FILE * content,PRFileDesc * signature,SECCertUsage usage,char * progName)126 HashDecodeAndVerify(FILE *out, FILE *content, PRFileDesc *signature,
127 SECCertUsage usage, char *progName)
128 {
129 SECItem derdata;
130 SEC_PKCS7ContentInfo *cinfo;
131 SEC_PKCS7SignedData *signedData;
132 HASH_HashType digestType;
133 SECItem digest;
134 unsigned char buffer[32];
135
136 if (SECU_ReadDERFromFile(&derdata, signature, PR_FALSE,
137 PR_FALSE) != SECSuccess) {
138 SECU_PrintError(progName, "error reading signature file");
139 return -1;
140 }
141
142 cinfo = SEC_PKCS7DecodeItem(&derdata, NULL, NULL, NULL, NULL,
143 NULL, NULL, NULL);
144 if (cinfo == NULL)
145 return -1;
146
147 if (!SEC_PKCS7ContentIsSigned(cinfo)) {
148 fprintf(out, "Signature file is pkcs7 data, but not signed.\n");
149 return -1;
150 }
151
152 signedData = cinfo->content.signedData;
153
154 /* assume that there is only one digest algorithm for now */
155 digestType = AlgorithmToHashType(signedData->digestAlgorithms[0]);
156 if (digestType == HASH_AlgNULL) {
157 fprintf(out, "Invalid hash algorithmID\n");
158 return -1;
159 }
160
161 digest.data = buffer;
162 if (DigestFile(digest.data, &digest.len, 32, content, digestType)) {
163 SECU_PrintError(progName, "problem computing message digest");
164 return -1;
165 }
166
167 fprintf(out, "Signature is ");
168 if (SEC_PKCS7VerifyDetachedSignature(cinfo, usage, &digest, digestType,
169 PR_FALSE))
170 fprintf(out, "valid.\n");
171 else
172 fprintf(out, "invalid (Reason: %s).\n",
173 SECU_Strerror(PORT_GetError()));
174
175 SECITEM_FreeItem(&derdata, PR_FALSE);
176 SEC_PKCS7DestroyContentInfo(cinfo);
177 return 0;
178 }
179
180 int
main(int argc,char ** argv)181 main(int argc, char **argv)
182 {
183 char *progName;
184 FILE *contentFile, *outFile;
185 PRFileDesc *signatureFile;
186 SECCertUsage certUsage = certUsageEmailSigner;
187 PLOptState *optstate;
188 PLOptStatus status;
189 SECStatus rv;
190
191 progName = strrchr(argv[0], '/');
192 progName = progName ? progName + 1 : argv[0];
193
194 contentFile = NULL;
195 signatureFile = NULL;
196 outFile = NULL;
197
198 /*
199 * Parse command line arguments
200 */
201 optstate = PL_CreateOptState(argc, argv, "c:d:o:s:u:");
202 while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
203 switch (optstate->option) {
204 case '?':
205 Usage(progName);
206 break;
207
208 case 'c':
209 contentFile = fopen(optstate->value, "r");
210 if (!contentFile) {
211 fprintf(stderr, "%s: unable to open \"%s\" for reading\n",
212 progName, optstate->value);
213 return -1;
214 }
215 break;
216
217 case 'd':
218 SECU_ConfigDirectory(optstate->value);
219 break;
220
221 case 'o':
222 outFile = fopen(optstate->value, "w");
223 if (!outFile) {
224 fprintf(stderr, "%s: unable to open \"%s\" for writing\n",
225 progName, optstate->value);
226 return -1;
227 }
228 break;
229
230 case 's':
231 signatureFile = PR_Open(optstate->value, PR_RDONLY, 0);
232 if (!signatureFile) {
233 fprintf(stderr, "%s: unable to open \"%s\" for reading\n",
234 progName, optstate->value);
235 return -1;
236 }
237 break;
238
239 case 'u': {
240 int usageType;
241
242 usageType = atoi(strdup(optstate->value));
243 if (usageType < certUsageSSLClient || usageType > certUsageAnyCA)
244 return -1;
245 certUsage = (SECCertUsage)usageType;
246 break;
247 }
248 }
249 }
250 PL_DestroyOptState(optstate);
251
252 if (!contentFile)
253 Usage(progName);
254 if (!signatureFile)
255 Usage(progName);
256 if (!outFile)
257 outFile = stdout;
258
259 /* Call the NSS initialization routines */
260 PR_Init(PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 1);
261 rv = NSS_Init(SECU_ConfigDirectory(NULL));
262 if (rv != SECSuccess) {
263 SECU_PrintPRandOSError(progName);
264 return -1;
265 }
266
267 if (HashDecodeAndVerify(outFile, contentFile, signatureFile,
268 certUsage, progName)) {
269 SECU_PrintError(progName, "problem decoding/verifying signature");
270 return -1;
271 }
272
273 fclose(contentFile);
274 PR_Close(signatureFile);
275 if (outFile && outFile != stdout) {
276 fclose(outFile);
277 }
278
279 if (NSS_Shutdown() != SECSuccess) {
280 exit(1);
281 }
282
283 return 0;
284 }
285