C++ PEM_read_X509函数代码示例

void
read_ca_cert(void) {
	/* Read CA cert file */
	if (!c_flag || !(cafile = fopen(c_char, "r"))) {
		fprintf(stderr, "%s: cannot open CA cert file\n", pname);
		exit (SCEP_PKISTATUS_FILE);
	}
	if (!PEM_read_X509(cafile, &cacert, NULL, NULL)) {
		fprintf(stderr, "%s: error while reading CA cert\n", pname);
		ERR_print_errors_fp(stderr);
		exit (SCEP_PKISTATUS_FILE);
	}
	fclose(cafile);

	/* Read enc CA cert */ 
	if (e_flag) {
		if (!(cafile = fopen(e_char, "r"))) {
			fprintf(stderr, "%s: cannot open enc CA cert file\n",
				pname);
			exit (SCEP_PKISTATUS_FILE);
		}
		if (!PEM_read_X509(cafile, &encert, NULL, NULL)) {
			fprintf(stderr,"%s: error while reading enc CA cert\n",
				pname);
			ERR_print_errors_fp(stderr);
			exit (SCEP_PKISTATUS_FILE);
		}
		fclose(cafile);
	}
}

/* Make sure the certificate exists and extract the public key from it.
 *
 * returns: true if it can get the public key, false otherwise */
static bool get_pubkey(void)
{
	fp_pubkey = fopen(CERTNAME, "re");
	if (!fp_pubkey) {
		fprintf(stderr, "Failed fopen %s\n", CERTNAME);
		goto error;
	}

	cert = PEM_read_X509(fp_pubkey, NULL, NULL, NULL);
	if (!cert) {
		fprintf(stderr, "Failed PEM_read_X509() for %s\n", CERTNAME);
		goto error;
	}

	pkey = X509_get_pubkey(cert);
	if (!pkey) {
		fprintf(stderr, "Failed X509_get_pubkey() for %s\n", CERTNAME);
		X509_free(cert);
		goto error;
	}
	return true;
error:
	ERR_print_errors_fp(stderr);
	return false;
}

void read_public_key(drown_ctx * dctx, char *filename)
{
    // Read file
    FILE * fp = fopen(filename, "r");
    MY_ASSERT(fp != NULL, "can't open certificate file");

    // Read cert
    X509 *cert = PEM_read_X509(fp, NULL, NULL, NULL);
    MY_ASSERT(cert != NULL, "file is not a certificate");

    // Read public key
    EVP_PKEY * pkey = X509_get_pubkey(cert);
    MY_ASSERT(pkey != NULL, "can't get public key from certificate");

    // Check RSA key
    MY_ASSERT(pkey->type == EVP_PKEY_RSA, "public key is not RSA");
    MY_ASSERT(EVP_PKEY_bits(pkey) == 2048, "only RSA-2048 is supported for now");

    // Read RSA key
    RSA *rsa = EVP_PKEY_get1_RSA(pkey);

    // Copy the public key
    BN_copy(dctx->n, rsa->n);
    BN_copy(dctx->e, rsa->e);

    RSA_free(rsa);
    EVP_PKEY_free(pkey);
    X509_free(cert);
    fclose(fp);
}

static int certificate_verify_callback(int preverify_ok, X509_STORE_CTX * ctx) {
    char fnm[FILE_PATH_SIZE];
    DIR * dir = NULL;
    int err = 0;
    int found = 0;

    snprintf(fnm, sizeof(fnm), "%s/ssl", tcf_dir);
    if (!err && (dir = opendir(fnm)) == NULL) err = errno;
    while (!err && !found) {
        int l = 0;
        X509 * cert = NULL;
        FILE * fp = NULL;
        struct dirent * ent = readdir(dir);
        if (ent == NULL) break;
        l = strlen(ent->d_name);
        if (l < 5 || strcmp(ent->d_name + l -5 , ".cert") != 0) continue;
        snprintf(fnm, sizeof(fnm), "%s/ssl/%s", tcf_dir, ent->d_name);
        if (!err && (fp = fopen(fnm, "r")) == NULL) err = errno;
        if (!err && (cert = PEM_read_X509(fp, NULL, NULL, NULL)) == NULL) err = set_ssl_errno();
        if (!err && fclose(fp) != 0) err = errno;
        if (!err && X509_cmp(X509_STORE_CTX_get_current_cert(ctx), cert) == 0) found = 1;
    }
    if (dir != NULL && closedir(dir) < 0 && !err) err = errno;
    if (err) trace(LOG_ALWAYS, "Cannot read certificate %s: %s", fnm, errno_to_str(err));
    else if (!found) trace(LOG_ALWAYS, "Authentication failure: invalid certificate");
    return err == 0 && found;
}

void test1()
{
  char *       filename = "server/server.crt";
  X509 *       x509 = NULL;
  X509 *       rc = NULL;
  FILE *       fp = NULL;
  X509_NAME *  name = NULL;
  char         buf[1024];
  int          nid = NID_undef;
  size_t       name_len = 0;
  char         cnbuf[1024];

  assert( (fp = fopen(filename,"rb")) != NULL );
  assert( (rc = PEM_read_X509(fp, &x509, (pem_password_cb *)0, NULL)) != NULL );
  assert( (name = X509_get_subject_name(x509)) != NULL );

  X509_NAME_oneline(X509_get_subject_name(x509), buf, sizeof(buf));
  assert( strcmp(buf,"/C=HU/ST=Hungary/L=Budapest/O=BeckGround Ltd./[email protected]/[email protected]") == 0 );
  printf("%s\n",buf);

  assert( (nid = OBJ_txt2nid("commonName")) != NID_undef );
  assert( (name_len = X509_NAME_get_text_by_NID(name, nid, cnbuf, sizeof(cnbuf))) > 0 );
  assert( strcmp(cnbuf,"[email protected]") == 0 );
  printf("%s\n",cnbuf);

  X509_free(x509);
  rc = x509 = NULL;
  fclose( fp );
}

gchar *
CertKey_ComputeCertPemFileHash(const gchar *certPemFile) // IN
{
   FILE *file;
   gchar *hash = NULL;
   X509 *cert = NULL;
   gchar *err = NULL;

   file = fopen(certPemFile, "r");
   if (!file) {
      Error("Failed to open %s: %s.\n", certPemFile, strerror(errno));
      goto exit;
   }

   cert = PEM_read_X509(file, NULL, NULL, NULL);
   if (!cert) {
      Error("Error reading certificate file %s: %s.\n",
            certPemFile, GetSSLError(&err));
      goto exit;
   }

   hash = g_strdup_printf("%08lx", X509_subject_name_hash(cert));

exit:
   if (file) {
      fclose(file);
   }
   X509_free(cert);
   g_free(err);

   return hash;
}

int main(int argc, char* args[]) {
	if(argc == 1) {
		printf("Usage: %s [OPTIONS] [FILE]\n\n", args[0]);
		printf("Options:\n\t-u\t Print UNIX timestamp\n\n");
		return 1;
	}

	FILE *pemFile = fopen(args[argc-1], "r");
	if(!pemFile) {
		fprintf(stderr, "Could not open file \"%s\"\n", args[argc-1]);
		return 1;
	}

	X509 *cert = PEM_read_X509(pemFile, NULL, NULL, NULL);
	if(!cert) {
		fprintf(stderr, "Could not read PEM format\n");
		return 1;
	}

	char notAfterStr[BUFLEN];

	ASN1_TIME *notAfter = X509_get_notAfter(cert);

	if(strcmp(args[1], "-u") == 0) {
		convertAsn1ToTimestamp(notAfter, notAfterStr);
	} else {
		convertAsn1ToString(notAfter, notAfterStr);
	}

	printf("%s\n", notAfterStr);

	return 0;
}

int main(int argc, char **argv)
{
	X509 *cert;
	FILE *inf;
	int i, count;
	X509_EXTENSION *ext;
	X509V3_add_standard_extensions();
	ERR_load_crypto_strings();
	if(!argv[1]) {
		fprintf(stderr, "Usage v3prin cert.pem\n");
		exit(1);
	}
	if(!(inf = fopen(argv[1], "r"))) {
		fprintf(stderr, "Can't open %s\n", argv[1]);
		exit(1);
	}
	if(!(cert = PEM_read_X509(inf, NULL, NULL))) {
		fprintf(stderr, "Can't read certificate %s\n", argv[1]);
		ERR_print_errors_fp(stderr);
		exit(1);
	}
	fclose(inf);
	count = X509_get_ext_count(cert);
	printf("%d extensions\n", count);
	for(i = 0; i < count; i++) {
		ext = X509_get_ext(cert, i);
		printf("%s\n", OBJ_nid2ln(OBJ_obj2nid(ext->object)));
		if(!X509V3_EXT_print_fp(stdout, ext, 0, 0)) ERR_print_errors_fp(stderr);
		printf("\n");
		
	}
	return 0;
}

static void load_cacert(X509** cacert, const char* certpem)
{
	FILE* f = fopen(certpem, "r");
	assert(f != NULL);
	PEM_read_X509(f, cacert, NULL, NULL);
	fclose(f);
}

wi_x509_t * wi_x509_init_with_pem_file(wi_x509_t *x509, wi_string_t *path) {
	FILE		*fp;
	
	fp = fopen(wi_string_cstring(path), "r");
	
	if(!fp) {
		wi_error_set_errno(errno);
		
		wi_release(x509);
		
		return NULL;
	}
	
	x509->x509 = PEM_read_X509(fp, NULL, NULL, NULL);
	
	fclose(fp);
	
	if(!x509->x509) {
		wi_error_set_openssl_error();
		
		wi_release(x509);
		
		return NULL;
	}
	
	return x509;
}

static int
SSL_CTX_use_certificate_file_with_check(
	SSL_CTX *ctx, 
	char *file, 
	int type)
{
	FILE *fp;
	X509 *x509;
	X509_STORE_CTX *sctx;
	int ret;
	ret = SSL_CTX_use_certificate_file(ctx, file, type);
	if(!ret) return ret;
	if(!(fp = fopen(file, "r"))) {
		return -1;
	}
	x509 = PEM_read_X509(fp, NULL, NULL, NULL);
	if(!x509){
		rewind(fp);
		x509 = d2i_X509_fp(fp, NULL);
	}
	fclose(fp);
	if(!x509) return -1;
	X509_STORE_add_cert(ctx->cert_store, x509);
	sctx = X509_STORE_CTX_new();
	X509_STORE_CTX_init(sctx, ctx->cert_store, x509, NULL);
	X509_STORE_CTX_set_verify_cb(sctx, LocalVerifyCallBack);
	X509_verify_cert(sctx);
	X509_STORE_CTX_free(sctx);
	CheckValidPeriod(x509);
	return ret;
}

/*
 * Load CA certificate and private key from current dir
 */
static int load_ca(char * ca_name, identity * ca)
{
    FILE * f ;
    RSA  * rsa ;
    char filename[FIELD_SZ+1] ;

    sprintf(filename, "%s.crt", ca_name);
    if ((f=fopen(filename, "r"))==NULL) {
        fprintf(stderr, "Cannot find: %s\n", filename);
        return -1 ; 
    }
    ca->cert = PEM_read_X509(f, NULL, NULL, NULL);
    fclose(f);

    sprintf(filename, "%s.key", ca_name);
    if ((f=fopen(filename, "r"))==NULL) {
        return -1 ; 
    }
    rsa = PEM_read_RSAPrivateKey(f, NULL, NULL, NULL);
    fclose(f);

    ca->key = EVP_PKEY_new();
    EVP_PKEY_assign_RSA(ca->key, rsa);

    if (!X509_check_private_key(ca->cert, ca->key)) {
        fprintf(stderr, "CA certificate and private key do not match\n");
        return -1 ;
    }
    return 0;
}

int main(int argc, char *argv[]) {
    X509 *cert;
    X509_STORE *store;
    X509_LOOKUP *lookup;
    X509_STORE_CTX *verify_ctx;
    FILE *fp;

    OpenSSL_add_all_algorithms();
    ERR_load_crypto_strings();

    /* frist read the client certificate */
    if (!(fp = fopen(CLIENT_CERT, "r"))) {
        int_error("Error reading client certificate file");
    }
    if (!(cert = PEM_read_X509(fp, NULL, NULL, NULL))) {
        int_error("Error reading client certificate in file");
    }
    fclose(fp);

    /* create the cert store and set the verify callback */
    if (!(store = X509_STORE_new())) {
        int_error("Error creating X509_STORE_CTX object");
    }
    X509_STORE_set_verify_cb_func(store, verify_callback);

    /* load the CA certificates and CRLs */
    if (X509_STORE_load_locations(store, CA_FILE, CA_DIR) != 1) {
        int_error("Error loading the CA file or directory");
    }
    if (X509_STORE_set_default_paths(store) != 1) {
        int_error("Error loading the system-wide CA certificates");
    }
    if (!(lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()))) {
        int_error("Error creating X509_LOOKUP object");
    }
    if (X509_load_crl_file(lookup, CRL_FILE, X509_FILETYPE_PEM) != 1) {
        int_error("Error reading the CRL file");
    }

    /* set the flags of the store so that the CRLs are consulted */
    X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);

    /* create a verification context and initialize it */
    if (!(verify_ctx = X509_STORE_CTX_new())) {
        int_error("Error creating X509_STORE_CTX object");
    }
    if (X509_STORE_CTX_init(verify_ctx, store, cert, NULL) != 1) {
        int_error("Error initializing verification context");
    }

    /* verify the certificate */
    if (X509_verify_cert(verify_ctx) != 1) {
        int_error("Error verifying the certificate");
    }
    else {
        printf("Certificate verified correctly!\n");
    }
    return 0;
}

static X509 *get_cert_from_file(char *filename) {
    X509 *c;
    FILE *f = fopen(filename, "r");
    if (! f )
      return NULL;
    c = PEM_read_X509(f, NULL, NULL, NULL);
    fclose(f);
    return c;
}

/*
 * Check if the SSL/TLS certificate exists in the certificates file.
 */
int
check_cert(X509 *pcert, unsigned char *pmd, unsigned int *pmdlen)
{
	int n, r;
	FILE *fd;
	char b;
	char *certf;
	X509 *cert;
	unsigned char md[EVP_MAX_MD_SIZE];
	unsigned int mdlen;

	r = 0;
	cert = NULL;

	n = snprintf(&b, 1, "%s/%s", env.home, PATHNAME_CERTS);

	if (env.pathmax != -1 && n > env.pathmax)
		fatal(ERROR_PATHNAME,
		    "pathname limit %ld exceeded: %d\n", env.pathmax, n);

	certf = (char *)xmalloc((n + 1) * sizeof(char));
	snprintf(certf, n + 1, "%s/%s", env.home, PATHNAME_CERTS);

	if (!exists_file(certf)) {
		xfree(certf);
		return 0;
	}

	fd = fopen(certf, "r");

	xfree(certf);

	if (fd == NULL)
		return -1;

	while ((cert = PEM_read_X509(fd, &cert, NULL, NULL)) != NULL) {
		if (X509_subject_name_cmp(cert, pcert) != 0 ||
		    X509_issuer_name_cmp(cert, pcert) != 0)
			continue;

		if (!X509_digest(cert, EVP_md5(), md, &mdlen) ||
		    *pmdlen != mdlen)
			continue;

		if (memcmp(pmd, md, mdlen) != 0) {
			r = -1;
			break;
		}
		r = 1;
		break;
	}

	fclose(fd);
	X509_free(cert);

	return r;
}