extract-cert.c 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169
  1. /* Extract X.509 certificate in DER form from PKCS#11 or PEM.
  2. *
  3. * Copyright © 2014-2015 Red Hat, Inc. All Rights Reserved.
  4. * Copyright © 2015 Intel Corporation.
  5. *
  6. * Authors: David Howells <dhowells@redhat.com>
  7. * David Woodhouse <dwmw2@infradead.org>
  8. *
  9. * This program is free software; you can redistribute it and/or
  10. * modify it under the terms of the GNU Lesser General Public License
  11. * as published by the Free Software Foundation; either version 2.1
  12. * of the licence, or (at your option) any later version.
  13. */
  14. #define _GNU_SOURCE
  15. #include <stdio.h>
  16. #include <stdlib.h>
  17. #include <stdint.h>
  18. #include <stdbool.h>
  19. #include <string.h>
  20. #include <err.h>
  21. #include <openssl/bio.h>
  22. #include <openssl/pem.h>
  23. #include <openssl/err.h>
  24. #include <openssl/engine.h>
  25. #define PKEY_ID_PKCS7 2
  26. static __attribute__((noreturn))
  27. void format(void)
  28. {
  29. fprintf(stderr,
  30. "Usage: scripts/extract-cert <source> <dest>\n");
  31. exit(2);
  32. }
  33. static void display_openssl_errors(int l)
  34. {
  35. const char *file;
  36. char buf[120];
  37. int e, line;
  38. if (ERR_peek_error() == 0)
  39. return;
  40. fprintf(stderr, "At main.c:%d:\n", l);
  41. while ((e = ERR_get_error_line(&file, &line))) {
  42. ERR_error_string(e, buf);
  43. fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
  44. }
  45. }
  46. #ifndef OPENSSL_IS_BORINGSSL
  47. static void drain_openssl_errors(void)
  48. {
  49. const char *file;
  50. int line;
  51. if (ERR_peek_error() == 0)
  52. return;
  53. while (ERR_get_error_line(&file, &line)) {}
  54. }
  55. #endif
  56. #define ERR(cond, fmt, ...) \
  57. do { \
  58. bool __cond = (cond); \
  59. display_openssl_errors(__LINE__); \
  60. if (__cond) { \
  61. err(1, fmt, ## __VA_ARGS__); \
  62. } \
  63. } while(0)
  64. static const char *key_pass;
  65. static BIO *wb;
  66. static char *cert_dst;
  67. static int kbuild_verbose;
  68. static void write_cert(X509 *x509)
  69. {
  70. char buf[200];
  71. if (!wb) {
  72. wb = BIO_new_file(cert_dst, "wb");
  73. ERR(!wb, "%s", cert_dst);
  74. }
  75. X509_NAME_oneline(X509_get_subject_name(x509), buf, sizeof(buf));
  76. ERR(!i2d_X509_bio(wb, x509), "%s", cert_dst);
  77. if (kbuild_verbose)
  78. fprintf(stderr, "Extracted cert: %s\n", buf);
  79. }
  80. int main(int argc, char **argv)
  81. {
  82. char *cert_src;
  83. OpenSSL_add_all_algorithms();
  84. ERR_load_crypto_strings();
  85. ERR_clear_error();
  86. kbuild_verbose = atoi(getenv("KBUILD_VERBOSE")?:"0");
  87. key_pass = getenv("KBUILD_SIGN_PIN");
  88. if (argc != 3)
  89. format();
  90. cert_src = argv[1];
  91. cert_dst = argv[2];
  92. if (!cert_src[0]) {
  93. /* Invoked with no input; create empty file */
  94. FILE *f = fopen(cert_dst, "wb");
  95. ERR(!f, "%s", cert_dst);
  96. fclose(f);
  97. exit(0);
  98. } else if (!strncmp(cert_src, "pkcs11:", 7)) {
  99. #ifdef OPENSSL_IS_BORINGSSL
  100. ERR(1, "BoringSSL does not support extracting from PKCS#11");
  101. exit(1);
  102. #else
  103. ENGINE *e;
  104. struct {
  105. const char *cert_id;
  106. X509 *cert;
  107. } parms;
  108. parms.cert_id = cert_src;
  109. parms.cert = NULL;
  110. ENGINE_load_builtin_engines();
  111. drain_openssl_errors();
  112. e = ENGINE_by_id("pkcs11");
  113. ERR(!e, "Load PKCS#11 ENGINE");
  114. if (ENGINE_init(e))
  115. drain_openssl_errors();
  116. else
  117. ERR(1, "ENGINE_init");
  118. if (key_pass)
  119. ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
  120. ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
  121. ERR(!parms.cert, "Get X.509 from PKCS#11");
  122. write_cert(parms.cert);
  123. #endif
  124. } else {
  125. BIO *b;
  126. X509 *x509;
  127. b = BIO_new_file(cert_src, "rb");
  128. ERR(!b, "%s", cert_src);
  129. while (1) {
  130. x509 = PEM_read_bio_X509(b, NULL, NULL, NULL);
  131. if (wb && !x509) {
  132. unsigned long err = ERR_peek_last_error();
  133. if (ERR_GET_LIB(err) == ERR_LIB_PEM &&
  134. ERR_GET_REASON(err) == PEM_R_NO_START_LINE) {
  135. ERR_clear_error();
  136. break;
  137. }
  138. }
  139. ERR(!x509, "%s", cert_src);
  140. write_cert(x509);
  141. }
  142. }
  143. BIO_free(wb);
  144. return 0;
  145. }