1: /*
2: curlx.c Authors: Peter Sylvester, Jean-Paul Merlin
3:
4: This is a little program to demonstrate the usage of
5:
6: - an ssl initialisation callback setting a user key and trustbases
7: coming from a pkcs12 file
8: - using an ssl application callback to find a URI in the
9: certificate presented during ssl session establishment.
10:
11: */
12: /* <DESC>
13: * demonstrates use of SSL context callback, requires OpenSSL
14: * </DESC>
15: */
16:
17: /*
18: * Copyright (c) 2003 - 2019 The OpenEvidence Project. All rights reserved.
19: *
20: * Redistribution and use in source and binary forms, with or without
21: * modification, are permitted provided that the following conditions
22: * are met:
23: *
24: * 1. Redistributions of source code must retain the above copyright
25: * notice, this list of conditions, the following disclaimer,
26: * and the original OpenSSL and SSLeay Licences below.
27: *
28: * 2. Redistributions in binary form must reproduce the above copyright
29: * notice, this list of conditions, the following disclaimer
30: * and the original OpenSSL and SSLeay Licences below in
31: * the documentation and/or other materials provided with the
32: * distribution.
33: *
34: * 3. All advertising materials mentioning features or use of this
35: * software must display the following acknowledgments:
36: * "This product includes software developed by the Openevidence Project
37: * for use in the OpenEvidence Toolkit. (http://www.openevidence.org/)"
38: * This product includes software developed by the OpenSSL Project
39: * for use in the OpenSSL Toolkit (https://www.openssl.org/)"
40: * This product includes cryptographic software written by Eric Young
41: * (eay@cryptsoft.com). This product includes software written by Tim
42: * Hudson (tjh@cryptsoft.com)."
43: *
44: * 4. The names "OpenEvidence Toolkit" and "OpenEvidence Project" must not be
45: * used to endorse or promote products derived from this software without
46: * prior written permission. For written permission, please contact
47: * openevidence-core@openevidence.org.
48: *
49: * 5. Products derived from this software may not be called "OpenEvidence"
50: * nor may "OpenEvidence" appear in their names without prior written
51: * permission of the OpenEvidence Project.
52: *
53: * 6. Redistributions of any form whatsoever must retain the following
54: * acknowledgments:
55: * "This product includes software developed by the OpenEvidence Project
56: * for use in the OpenEvidence Toolkit (http://www.openevidence.org/)
57: * This product includes software developed by the OpenSSL Project
58: * for use in the OpenSSL Toolkit (https://www.openssl.org/)"
59: * This product includes cryptographic software written by Eric Young
60: * (eay@cryptsoft.com). This product includes software written by Tim
61: * Hudson (tjh@cryptsoft.com)."
62: *
63: * THIS SOFTWARE IS PROVIDED BY THE OpenEvidence PROJECT ``AS IS'' AND ANY
64: * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
65: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
66: * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenEvidence PROJECT OR
67: * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
68: * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
69: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
70: * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
71: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
72: * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
73: * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
74: * OF THE POSSIBILITY OF SUCH DAMAGE.
75: * ====================================================================
76: *
77: * This product includes software developed by the OpenSSL Project
78: * for use in the OpenSSL Toolkit (https://www.openssl.org/)
79: * This product includes cryptographic software written by Eric Young
80: * (eay@cryptsoft.com). This product includes software written by Tim
81: * Hudson (tjh@cryptsoft.com).
82: *
83: */
84:
85: #include <stdio.h>
86: #include <stdlib.h>
87: #include <string.h>
88: #include <curl/curl.h>
89: #include <openssl/x509v3.h>
90: #include <openssl/x509_vfy.h>
91: #include <openssl/crypto.h>
92: #include <openssl/lhash.h>
93: #include <openssl/objects.h>
94: #include <openssl/err.h>
95: #include <openssl/evp.h>
96: #include <openssl/x509.h>
97: #include <openssl/pkcs12.h>
98: #include <openssl/bio.h>
99: #include <openssl/ssl.h>
100:
101: static const char *curlx_usage[]={
102: "usage: curlx args\n",
103: " -p12 arg - tia file ",
104: " -envpass arg - environment variable which content the tia private"
105: " key password",
106: " -out arg - output file (response)- default stdout",
107: " -in arg - input file (request)- default stdin",
108: " -connect arg - URL of the server for the connection ex:"
109: " www.openevidence.org",
110: " -mimetype arg - MIME type for data in ex : application/timestamp-query"
111: " or application/dvcs -default application/timestamp-query",
112: " -acceptmime arg - MIME type acceptable for the response ex : "
113: "application/timestamp-response or application/dvcs -default none",
114: " -accesstype arg - an Object identifier in an AIA/SIA method, e.g."
115: " AD_DVCS or ad_timestamping",
116: NULL
117: };
118:
119: /*
120:
121: ./curlx -p12 psy.p12 -envpass XX -in request -verbose -accesstype AD_DVCS
122: -mimetype application/dvcs -acceptmime application/dvcs -out response
123:
124: */
125:
126: /*
127: * We use this ZERO_NULL to avoid picky compiler warnings,
128: * when assigning a NULL pointer to a function pointer var.
129: */
130:
131: #define ZERO_NULL 0
132:
133: /* This is a context that we pass to all callbacks */
134:
135: typedef struct sslctxparm_st {
136: unsigned char *p12file;
137: const char *pst;
138: PKCS12 *p12;
139: EVP_PKEY *pkey;
140: X509 *usercert;
141: STACK_OF(X509) * ca;
142: CURL *curl;
143: BIO *errorbio;
144: int accesstype;
145: int verbose;
146:
147: } sslctxparm;
148:
149: /* some helper function. */
150:
151: static char *ia5string(ASN1_IA5STRING *ia5)
152: {
153: char *tmp;
154: if(!ia5 || !ia5->length)
155: return NULL;
156: tmp = OPENSSL_malloc(ia5->length + 1);
157: memcpy(tmp, ia5->data, ia5->length);
158: tmp[ia5->length] = 0;
159: return tmp;
160: }
161:
162: /* A convenience routine to get an access URI. */
163: static unsigned char *my_get_ext(X509 *cert, const int type,
164: int extensiontype)
165: {
166: int i;
167: STACK_OF(ACCESS_DESCRIPTION) * accessinfo;
168: accessinfo = X509_get_ext_d2i(cert, extensiontype, NULL, NULL);
169:
170: if(!sk_ACCESS_DESCRIPTION_num(accessinfo))
171: return NULL;
172: for(i = 0; i < sk_ACCESS_DESCRIPTION_num(accessinfo); i++) {
173: ACCESS_DESCRIPTION * ad = sk_ACCESS_DESCRIPTION_value(accessinfo, i);
174: if(OBJ_obj2nid(ad->method) == type) {
175: if(ad->location->type == GEN_URI) {
176: return ia5string(ad->location->d.ia5);
177: }
178: return NULL;
179: }
180: }
181: return NULL;
182: }
183:
184: /* This is an application verification call back, it does not
185: perform any addition verification but tries to find a URL
186: in the presented certificate. If found, this will become
187: the URL to be used in the POST.
188: */
189:
190: static int ssl_app_verify_callback(X509_STORE_CTX *ctx, void *arg)
191: {
192: sslctxparm * p = (sslctxparm *) arg;
193: int ok;
194:
195: if(p->verbose > 2)
196: BIO_printf(p->errorbio, "entering ssl_app_verify_callback\n");
197:
198: ok = X509_verify_cert(ctx);
199: if(ok && ctx->cert) {
200: unsigned char *accessinfo;
201: if(p->verbose > 1)
202: X509_print_ex(p->errorbio, ctx->cert, 0, 0);
203:
204: accessinfo = my_get_ext(ctx->cert, p->accesstype, NID_sinfo_access);
205: if(accessinfo) {
206: if(p->verbose)
207: BIO_printf(p->errorbio, "Setting URL from SIA to: %s\n", accessinfo);
208:
209: curl_easy_setopt(p->curl, CURLOPT_URL, accessinfo);
210: }
211: else if(accessinfo = my_get_ext(ctx->cert, p->accesstype,
212: NID_info_access)) {
213: if(p->verbose)
214: BIO_printf(p->errorbio, "Setting URL from AIA to: %s\n", accessinfo);
215:
216: curl_easy_setopt(p->curl, CURLOPT_URL, accessinfo);
217: }
218: }
219: if(p->verbose > 2)
220: BIO_printf(p->errorbio, "leaving ssl_app_verify_callback with %d\n", ok);
221:
222: return ok;
223: }
224:
225:
226: /* The SSL initialisation callback. The callback sets:
227: - a private key and certificate
228: - a trusted ca certificate
229: - a preferred cipherlist
230: - an application verification callback (the function above)
231: */
232:
233: static CURLcode sslctxfun(CURL *curl, void *sslctx, void *parm)
234: {
235: sslctxparm *p = (sslctxparm *) parm;
236: SSL_CTX *ctx = (SSL_CTX *) sslctx;
237:
238: if(!SSL_CTX_use_certificate(ctx, p->usercert)) {
239: BIO_printf(p->errorbio, "SSL_CTX_use_certificate problem\n");
240: goto err;
241: }
242: if(!SSL_CTX_use_PrivateKey(ctx, p->pkey)) {
243: BIO_printf(p->errorbio, "SSL_CTX_use_PrivateKey\n");
244: goto err;
245: }
246:
247: if(!SSL_CTX_check_private_key(ctx)) {
248: BIO_printf(p->errorbio, "SSL_CTX_check_private_key\n");
249: goto err;
250: }
251:
252: SSL_CTX_set_quiet_shutdown(ctx, 1);
253: SSL_CTX_set_cipher_list(ctx, "RC4-MD5");
254: SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
255:
256: X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx),
257: sk_X509_value(p->ca, sk_X509_num(p->ca)-1));
258:
259: SSL_CTX_set_verify_depth(ctx, 2);
260: SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, ZERO_NULL);
261: SSL_CTX_set_cert_verify_callback(ctx, ssl_app_verify_callback, parm);
262:
263: return CURLE_OK;
264: err:
265: ERR_print_errors(p->errorbio);
266: return CURLE_SSL_CERTPROBLEM;
267:
268: }
269:
270: int main(int argc, char **argv)
271: {
272: BIO* in = NULL;
273: BIO* out = NULL;
274:
275: char *outfile = NULL;
276: char *infile = NULL;
277:
278: int tabLength = 100;
279: char *binaryptr;
280: char *mimetype = NULL;
281: char *mimetypeaccept = NULL;
282: char *contenttype;
283: const char **pp;
284: unsigned char *hostporturl = NULL;
285: BIO *p12bio;
286: char **args = argv + 1;
287: unsigned char *serverurl;
288: sslctxparm p;
289: char *response;
290:
291: CURLcode res;
292: struct curl_slist *headers = NULL;
293: int badarg = 0;
294:
295: binaryptr = malloc(tabLength);
296:
297: memset(&p, '\0', sizeof(p));
298: p.errorbio = BIO_new_fp(stderr, BIO_NOCLOSE);
299:
300: curl_global_init(CURL_GLOBAL_DEFAULT);
301:
302: /* we need some more for the P12 decoding */
303:
304: OpenSSL_add_all_ciphers();
305: OpenSSL_add_all_digests();
306: ERR_load_crypto_strings();
307:
308: while(*args && *args[0] == '-') {
309: if(!strcmp (*args, "-in")) {
310: if(args[1]) {
311: infile = *(++args);
312: }
313: else
314: badarg = 1;
315: }
316: else if(!strcmp (*args, "-out")) {
317: if(args[1]) {
318: outfile = *(++args);
319: }
320: else
321: badarg = 1;
322: }
323: else if(!strcmp (*args, "-p12")) {
324: if(args[1]) {
325: p.p12file = *(++args);
326: }
327: else
328: badarg = 1;
329: }
330: else if(strcmp(*args, "-envpass") == 0) {
331: if(args[1]) {
332: p.pst = getenv(*(++args));
333: }
334: else
335: badarg = 1;
336: }
337: else if(strcmp(*args, "-connect") == 0) {
338: if(args[1]) {
339: hostporturl = *(++args);
340: }
341: else
342: badarg = 1;
343: }
344: else if(strcmp(*args, "-mimetype") == 0) {
345: if(args[1]) {
346: mimetype = *(++args);
347: }
348: else
349: badarg = 1;
350: }
351: else if(strcmp(*args, "-acceptmime") == 0) {
352: if(args[1]) {
353: mimetypeaccept = *(++args);
354: }
355: else
356: badarg = 1;
357: }
358: else if(strcmp(*args, "-accesstype") == 0) {
359: if(args[1]) {
360: p.accesstype = OBJ_obj2nid(OBJ_txt2obj(*++args, 0));
361: if(p.accesstype == 0)
362: badarg = 1;
363: }
364: else
365: badarg = 1;
366: }
367: else if(strcmp(*args, "-verbose") == 0) {
368: p.verbose++;
369: }
370: else
371: badarg = 1;
372: args++;
373: }
374:
375: if(mimetype == NULL || mimetypeaccept == NULL || p.p12file == NULL)
376: badarg = 1;
377:
378: if(badarg) {
379: for(pp = curlx_usage; (*pp != NULL); pp++)
380: BIO_printf(p.errorbio, "%s\n", *pp);
381: BIO_printf(p.errorbio, "\n");
382: goto err;
383: }
384:
385: /* set input */
386:
387: in = BIO_new(BIO_s_file());
388: if(in == NULL) {
389: BIO_printf(p.errorbio, "Error setting input bio\n");
390: goto err;
391: }
392: else if(infile == NULL)
393: BIO_set_fp(in, stdin, BIO_NOCLOSE|BIO_FP_TEXT);
394: else if(BIO_read_filename(in, infile) <= 0) {
395: BIO_printf(p.errorbio, "Error opening input file %s\n", infile);
396: BIO_free(in);
397: goto err;
398: }
399:
400: /* set output */
401:
402: out = BIO_new(BIO_s_file());
403: if(out == NULL) {
404: BIO_printf(p.errorbio, "Error setting output bio.\n");
405: goto err;
406: }
407: else if(outfile == NULL)
408: BIO_set_fp(out, stdout, BIO_NOCLOSE|BIO_FP_TEXT);
409: else if(BIO_write_filename(out, outfile) <= 0) {
410: BIO_printf(p.errorbio, "Error opening output file %s\n", outfile);
411: BIO_free(out);
412: goto err;
413: }
414:
415:
416: p.errorbio = BIO_new_fp(stderr, BIO_NOCLOSE);
417:
418: p.curl = curl_easy_init();
419: if(!p.curl) {
420: BIO_printf(p.errorbio, "Cannot init curl lib\n");
421: goto err;
422: }
423:
424: p12bio = BIO_new_file(p.p12file, "rb");
425: if(!p12bio) {
426: BIO_printf(p.errorbio, "Error opening P12 file %s\n", p.p12file);
427: goto err;
428: }
429: p.p12 = d2i_PKCS12_bio(p12bio, NULL);
430: if(!p.p12) {
431: BIO_printf(p.errorbio, "Cannot decode P12 structure %s\n", p.p12file);
432: goto err;
433: }
434:
435: p.ca = NULL;
436: if(!(PKCS12_parse (p.p12, p.pst, &(p.pkey), &(p.usercert), &(p.ca) ) )) {
437: BIO_printf(p.errorbio, "Invalid P12 structure in %s\n", p.p12file);
438: goto err;
439: }
440:
441: if(sk_X509_num(p.ca) <= 0) {
442: BIO_printf(p.errorbio, "No trustworthy CA given.%s\n", p.p12file);
443: goto err;
444: }
445:
446: if(p.verbose > 1)
447: X509_print_ex(p.errorbio, p.usercert, 0, 0);
448:
449: /* determine URL to go */
450:
451: if(hostporturl) {
452: size_t len = strlen(hostporturl) + 9;
453: serverurl = malloc(len);
454: snprintf(serverurl, len, "https://%s", hostporturl);
455: }
456: else if(p.accesstype != 0) { /* see whether we can find an AIA or SIA for a
457: given access type */
458: serverurl = my_get_ext(p.usercert, p.accesstype, NID_info_access);
459: if(!serverurl) {
460: int j = 0;
461: BIO_printf(p.errorbio, "no service URL in user cert "
462: "cherching in others certificats\n");
463: for(j = 0; j<sk_X509_num(p.ca); j++) {
464: serverurl = my_get_ext(sk_X509_value(p.ca, j), p.accesstype,
465: NID_info_access);
466: if(serverurl)
467: break;
468: serverurl = my_get_ext(sk_X509_value(p.ca, j), p.accesstype,
469: NID_sinfo_access);
470: if(serverurl)
471: break;
472: }
473: }
474: }
475:
476: if(!serverurl) {
477: BIO_printf(p.errorbio, "no service URL in certificats,"
478: " check '-accesstype (AD_DVCS | ad_timestamping)'"
479: " or use '-connect'\n");
480: goto err;
481: }
482:
483: if(p.verbose)
484: BIO_printf(p.errorbio, "Service URL: <%s>\n", serverurl);
485:
486: curl_easy_setopt(p.curl, CURLOPT_URL, serverurl);
487:
488: /* Now specify the POST binary data */
489:
490: curl_easy_setopt(p.curl, CURLOPT_POSTFIELDS, binaryptr);
491: curl_easy_setopt(p.curl, CURLOPT_POSTFIELDSIZE, (long)tabLength);
492:
493: /* pass our list of custom made headers */
494:
495: contenttype = malloc(15 + strlen(mimetype));
496: snprintf(contenttype, 15 + strlen(mimetype), "Content-type: %s", mimetype);
497: headers = curl_slist_append(headers, contenttype);
498: curl_easy_setopt(p.curl, CURLOPT_HTTPHEADER, headers);
499:
500: if(p.verbose)
501: BIO_printf(p.errorbio, "Service URL: <%s>\n", serverurl);
502:
503: {
504: FILE *outfp;
505: BIO_get_fp(out, &outfp);
506: curl_easy_setopt(p.curl, CURLOPT_WRITEDATA, outfp);
507: }
508:
509: res = curl_easy_setopt(p.curl, CURLOPT_SSL_CTX_FUNCTION, sslctxfun);
510:
511: if(res != CURLE_OK)
512: BIO_printf(p.errorbio, "%d %s=%d %d\n", __LINE__,
513: "CURLOPT_SSL_CTX_FUNCTION", CURLOPT_SSL_CTX_FUNCTION, res);
514:
515: curl_easy_setopt(p.curl, CURLOPT_SSL_CTX_DATA, &p);
516:
517: {
518: char *ptr;
519: int lu; int i = 0;
520: while((lu = BIO_read(in, &binaryptr[i], tabLength-i)) >0) {
521: i += lu;
522: if(i == tabLength) {
523: tabLength += 100;
524: ptr = realloc(binaryptr, tabLength); /* should be more careful */
525: if(!ptr) {
526: /* out of memory */
527: BIO_printf(p.errorbio, "out of memory (realloc returned NULL)\n");
528: goto fail;
529: }
530: binaryptr = ptr;
531: ptr = NULL;
532: }
533: }
534: tabLength = i;
535: }
536: /* Now specify the POST binary data */
537:
538: curl_easy_setopt(p.curl, CURLOPT_POSTFIELDS, binaryptr);
539: curl_easy_setopt(p.curl, CURLOPT_POSTFIELDSIZE, (long)tabLength);
540:
541:
542: /* Perform the request, res will get the return code */
543:
544: BIO_printf(p.errorbio, "%d %s %d\n", __LINE__, "curl_easy_perform",
545: res = curl_easy_perform(p.curl));
546: {
547: curl_easy_getinfo(p.curl, CURLINFO_CONTENT_TYPE, &response);
548: if(mimetypeaccept && p.verbose) {
549: if(!strcmp(mimetypeaccept, response))
550: BIO_printf(p.errorbio, "the response has a correct mimetype : %s\n",
551: response);
552: else
553: BIO_printf(p.errorbio, "the response doesn\'t have an acceptable "
554: "mime type, it is %s instead of %s\n",
555: response, mimetypeaccept);
556: }
557: }
558:
559: /*** code d'erreur si accept mime ***, egalement code return HTTP != 200 ***/
560:
561: /* free the header list*/
562: fail:
563: curl_slist_free_all(headers);
564:
565: /* always cleanup */
566: curl_easy_cleanup(p.curl);
567:
568: BIO_free(in);
569: BIO_free(out);
570: return (EXIT_SUCCESS);
571:
572: err: BIO_printf(p.errorbio, "error");
573: exit(1);
574: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to curlx.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / curl / docs / examples