Source code
Revision control
Copy as Markdown
Other Tools
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
/*
* cmsutil -- A command to work with CMS data
*/
#include "nspr.h"
#include "secutil.h"
#include "plgetopt.h"
#include "secpkcs7.h"
#include "cert.h"
#include "certdb.h"
#include "secoid.h"
#include "cms.h"
#include "nss.h"
#include "smime.h"
#include "pk11func.h"
#include "sechash.h"
#if defined(XP_UNIX)
#include <unistd.h>
#endif
#if defined(_WIN32)
#include "fcntl.h"
#include "io.h"
#endif
#include <stdio.h>
#include <string.h>
char *progName = NULL;
static int cms_verbose = 0;
static secuPWData pwdata = { PW_NONE, 0 };
static PK11PasswordFunc pwcb = NULL;
static void *pwcb_arg = NULL;
/* XXX stolen from cmsarray.c
* nss_CMSArray_Count - count number of elements in array
*/
int
nss_CMSArray_Count(void **array)
{
int n = 0;
if (array == NULL)
return 0;
while (*array++ != NULL)
n++;
return n;
}
static SECStatus
DigestFile(PLArenaPool *poolp, SECItem ***digests, SECItem *input,
SECAlgorithmID **algids)
{
NSSCMSDigestContext *digcx;
SECStatus rv;
digcx = NSS_CMSDigestContext_StartMultiple(algids);
if (digcx == NULL)
return SECFailure;
NSS_CMSDigestContext_Update(digcx, input->data, input->len);
rv = NSS_CMSDigestContext_FinishMultiple(digcx, poolp, digests);
return rv;
}
static void
Usage(void)
{
fprintf(stderr,
"Usage: %s [-C|-D|-E|-O|-S] [<options>] [-d dbdir] [-u certusage]\n"
" -C create a CMS encrypted data message\n"
" -D decode a CMS message\n"
" -b decode a batch of files named in infile\n"
" -c content use this detached content\n"
" -n suppress output of content\n"
" -h num display num levels of CMS message info as email headers\n"
" -k keep decoded encryption certs in perm cert db\n"
" -E create a CMS enveloped data message\n"
" -r id,... create envelope for these recipients,\n"
" where id can be a certificate nickname or email address\n"
" -S create a CMS signed data message\n"
" -G include a signing time attribute\n"
" -H hash use hash (default:SHA256)\n"
" -N nick use certificate named \"nick\" for signing\n"
" -P include a SMIMECapabilities attribute\n"
" -T do not include content in CMS message\n"
" -Y nick include a EncryptionKeyPreference attribute with cert\n"
" (use \"NONE\" to omit)\n"
" -O create a CMS signed message containing only certificates\n"
" General Options:\n"
" -d dbdir key/cert database directory (default: ~/.netscape)\n"
" -e envelope enveloped data message in this file is used for bulk key\n"
" -i infile use infile as source of data (default: stdin)\n"
" -o outfile use outfile as destination of data (default: stdout)\n"
" -p password use password as key db password (default: prompt)\n"
" -f pwfile use password file to set password on all PKCS#11 tokens)\n"
" -u certusage set type of certificate usage (default: certUsageEmailSigner)\n"
" -v print debugging information\n"
"\n"
"Cert usage codes:\n",
progName);
fprintf(stderr, "%-25s 0 - certUsageSSLClient\n", " ");
fprintf(stderr, "%-25s 1 - certUsageSSLServer\n", " ");
fprintf(stderr, "%-25s 2 - certUsageSSLServerWithStepUp\n", " ");
fprintf(stderr, "%-25s 3 - certUsageSSLCA\n", " ");
fprintf(stderr, "%-25s 4 - certUsageEmailSigner\n", " ");
fprintf(stderr, "%-25s 5 - certUsageEmailRecipient\n", " ");
fprintf(stderr, "%-25s 6 - certUsageObjectSigner\n", " ");
fprintf(stderr, "%-25s 7 - certUsageUserCertImport\n", " ");
fprintf(stderr, "%-25s 8 - certUsageVerifyCA\n", " ");
fprintf(stderr, "%-25s 9 - certUsageProtectedObjectSigner\n", " ");
fprintf(stderr, "%-25s 10 - certUsageStatusResponder\n", " ");
fprintf(stderr, "%-25s 11 - certUsageAnyCA\n", " ");
fprintf(stderr, "%-25s 12 - certUsageIPsec\n", " ");
exit(-1);
}
struct optionsStr {
char *pwfile;
char *password;
SECCertUsage certUsage;
CERTCertDBHandle *certHandle;
};
struct decodeOptionsStr {
struct optionsStr *options;
SECItem content;
int headerLevel;
PRBool suppressContent;
NSSCMSGetDecryptKeyCallback dkcb;
PK11SymKey *bulkkey;
PRBool keepCerts;
};
struct signOptionsStr {
struct optionsStr *options;
char *nickname;
char *encryptionKeyPreferenceNick;
PRBool signingTime;
PRBool smimeProfile;
PRBool detached;
SECOidTag hashAlgTag;
};
struct envelopeOptionsStr {
struct optionsStr *options;
char **recipients;
};
struct certsonlyOptionsStr {
struct optionsStr *options;
char **recipients;
};
struct encryptOptionsStr {
struct optionsStr *options;
char **recipients;
NSSCMSMessage *envmsg;
SECItem *input;
FILE *outfile;
PRFileDesc *envFile;
PK11SymKey *bulkkey;
SECOidTag bulkalgtag;
int keysize;
};
static NSSCMSMessage *
decode(FILE *out, SECItem *input, const struct decodeOptionsStr *decodeOptions)
{
NSSCMSDecoderContext *dcx;
SECStatus rv;
NSSCMSMessage *cmsg;
int nlevels, i;
SECItem sitem = { 0, 0, 0 };
PORT_SetError(0);
dcx = NSS_CMSDecoder_Start(NULL,
NULL, NULL, /* content callback */
pwcb, pwcb_arg, /* password callback */
decodeOptions->dkcb, /* decrypt key callback */
decodeOptions->bulkkey);
if (dcx == NULL) {
fprintf(stderr, "%s: failed to set up message decoder.\n", progName);
return NULL;
}
rv = NSS_CMSDecoder_Update(dcx, (char *)input->data, input->len);
if (rv != SECSuccess) {
fprintf(stderr, "%s: failed to decode message.\n", progName);
NSS_CMSDecoder_Cancel(dcx);
return NULL;
}
cmsg = NSS_CMSDecoder_Finish(dcx);
if (cmsg == NULL) {
fprintf(stderr, "%s: failed to decode message.\n", progName);
return NULL;
}
if (decodeOptions->headerLevel >= 0) {
/*fprintf(out, "SMIME: ", decodeOptions->headerLevel, i);*/
fprintf(out, "SMIME: ");
}
nlevels = NSS_CMSMessage_ContentLevelCount(cmsg);
for (i = 0; i < nlevels; i++) {
NSSCMSContentInfo *cinfo;
SECOidTag typetag;
cinfo = NSS_CMSMessage_ContentLevel(cmsg, i);
typetag = NSS_CMSContentInfo_GetContentTypeTag(cinfo);
if (decodeOptions->headerLevel >= 0)
fprintf(out, "\tlevel=%d.%d; ", decodeOptions->headerLevel, nlevels - i);
switch (typetag) {
case SEC_OID_PKCS7_SIGNED_DATA: {
NSSCMSSignedData *sigd = NULL;
SECItem **digests = NULL;
int nsigners;
int j;
if (decodeOptions->headerLevel >= 0)
fprintf(out, "type=signedData; ");
sigd = (NSSCMSSignedData *)NSS_CMSContentInfo_GetContent(cinfo);
if (sigd == NULL) {
SECU_PrintError(progName, "signedData component missing");
goto loser;
}
/* if we have a content file, but no digests for this signedData */
if (decodeOptions->content.data != NULL &&
!NSS_CMSSignedData_HasDigests(sigd)) {
PLArenaPool *poolp;
SECAlgorithmID **digestalgs;
/* detached content: grab content file */
sitem = decodeOptions->content;
if ((poolp = PORT_NewArena(1024)) == NULL) {
fprintf(stderr, "cmsutil: Out of memory.\n");
goto loser;
}
digestalgs = NSS_CMSSignedData_GetDigestAlgs(sigd);
if (DigestFile(poolp, &digests, &sitem, digestalgs) !=
SECSuccess) {
SECU_PrintError(progName,
"problem computing message digest");
PORT_FreeArena(poolp, PR_FALSE);
goto loser;
}
if (NSS_CMSSignedData_SetDigests(sigd, digestalgs, digests) !=
SECSuccess) {
SECU_PrintError(progName,
"problem setting message digests");
PORT_FreeArena(poolp, PR_FALSE);
goto loser;
}
PORT_FreeArena(poolp, PR_FALSE);
}
/* import the certificates */
if (NSS_CMSSignedData_ImportCerts(sigd,
decodeOptions->options->certHandle,
decodeOptions->options->certUsage,
decodeOptions->keepCerts) !=
SECSuccess) {
SECU_PrintError(progName, "cert import failed");
goto loser;
}
/* find out about signers */
nsigners = NSS_CMSSignedData_SignerInfoCount(sigd);
if (decodeOptions->headerLevel >= 0)
fprintf(out, "nsigners=%d; ", nsigners);
if (nsigners == 0) {
/* Might be a cert transport message
** or might be an invalid message, such as a QA test message
** or a message from an attacker.
*/
rv = NSS_CMSSignedData_VerifyCertsOnly(sigd,
decodeOptions->options->certHandle,
decodeOptions->options->certUsage);
if (rv != SECSuccess) {
fprintf(stderr, "cmsutil: Verify certs-only failed!\n");
goto loser;
}
return cmsg;
}
/* still no digests? */
if (!NSS_CMSSignedData_HasDigests(sigd)) {
SECU_PrintError(progName, "no message digests");
goto loser;
}
for (j = 0; j < nsigners; j++) {
const char *svs;
NSSCMSSignerInfo *si;
NSSCMSVerificationStatus vs;
SECStatus bad;
si = NSS_CMSSignedData_GetSignerInfo(sigd, j);
if (decodeOptions->headerLevel >= 0) {
char *signercn;
static char empty[] = { "" };
signercn = NSS_CMSSignerInfo_GetSignerCommonName(si);
if (signercn == NULL)
signercn = empty;
fprintf(out, "\n\t\tsigner%d.id=\"%s\"; ", j, signercn);
if (signercn != empty)
PORT_Free(signercn);
}
bad = NSS_CMSSignedData_VerifySignerInfo(sigd, j,
decodeOptions->options->certHandle,
decodeOptions->options->certUsage);
vs = NSS_CMSSignerInfo_GetVerificationStatus(si);
svs = NSS_CMSUtil_VerificationStatusToString(vs);
if (decodeOptions->headerLevel >= 0) {
fprintf(out, "signer%d.status=%s; ", j, svs);
/* goto loser ? */
} else if (bad && out) {
fprintf(stderr, "signer %d status = %s\n", j, svs);
goto loser;
}
/* if the signatures validate and we asked to keep
* the certs, save the profiles */
if (decodeOptions->keepCerts) {
rv = NSS_SMIMESignerInfo_SaveSMIMEProfile(si);
if (rv != SECSuccess) {
SECU_PrintError(progName, "SMIME profile import failed");
goto loser;
}
}
}
} break;
case SEC_OID_PKCS7_ENVELOPED_DATA: {
NSSCMSEnvelopedData *envd;
if (decodeOptions->headerLevel >= 0)
fprintf(out, "type=envelopedData; ");
envd = (NSSCMSEnvelopedData *)NSS_CMSContentInfo_GetContent(cinfo);
if (envd == NULL) {
SECU_PrintError(progName, "envelopedData component missing");
goto loser;
}
} break;
case SEC_OID_PKCS7_ENCRYPTED_DATA: {
NSSCMSEncryptedData *encd;
if (decodeOptions->headerLevel >= 0)
fprintf(out, "type=encryptedData; ");
encd = (NSSCMSEncryptedData *)NSS_CMSContentInfo_GetContent(cinfo);
if (encd == NULL) {
SECU_PrintError(progName, "encryptedData component missing");
goto loser;
}
} break;
case SEC_OID_PKCS7_DATA:
if (decodeOptions->headerLevel >= 0)
fprintf(out, "type=data; ");
break;
default:
break;
}
if (decodeOptions->headerLevel >= 0)
fprintf(out, "\n");
}
if (!decodeOptions->suppressContent && out) {
SECItem *item = (sitem.data ? &sitem
: NSS_CMSMessage_GetContent(cmsg));
if (item && item->data && item->len) {
fwrite(item->data, item->len, 1, out);
}
}
return cmsg;
loser:
if (cmsg)
NSS_CMSMessage_Destroy(cmsg);
return NULL;
}
/* example of a callback function to use with encoder */
/*
static void
writeout(void *arg, const char *buf, unsigned long len)
{
FILE *f = (FILE *)arg;
if (f != NULL && buf != NULL)
(void)fwrite(buf, len, 1, f);
}
*/
static NSSCMSMessage *
signed_data(struct signOptionsStr *signOptions)
{
NSSCMSMessage *cmsg = NULL;
NSSCMSContentInfo *cinfo;
NSSCMSSignedData *sigd;
NSSCMSSignerInfo *signerinfo = NULL;
CERTCertificate *cert = NULL, *ekpcert = NULL;
if (cms_verbose) {
fprintf(stderr, "Input to signed_data:\n");
if (signOptions->options->password)
fprintf(stderr, "password [%s]\n", signOptions->options->password);
else if (signOptions->options->pwfile)
fprintf(stderr, "password file [%s]\n", signOptions->options->pwfile);
else
fprintf(stderr, "password [NULL]\n");
fprintf(stderr, "certUsage [%d]\n", signOptions->options->certUsage);
if (signOptions->options->certHandle)
fprintf(stderr, "certdb [%p]\n", signOptions->options->certHandle);
else
fprintf(stderr, "certdb [NULL]\n");
if (signOptions->nickname)
fprintf(stderr, "nickname [%s]\n", signOptions->nickname);
else
fprintf(stderr, "nickname [NULL]\n");
}
if (signOptions->nickname == NULL) {
fprintf(stderr,
"ERROR: please indicate the nickname of a certificate to sign with.\n");
return NULL;
}
if ((cert = CERT_FindUserCertByUsage(signOptions->options->certHandle,
signOptions->nickname,
signOptions->options->certUsage,
PR_FALSE,
&pwdata)) == NULL) {
SECU_PrintError(progName,
"the corresponding cert for key \"%s\" does not exist",
signOptions->nickname);
return NULL;
}
if (cms_verbose) {
fprintf(stderr, "Found certificate for %s\n", signOptions->nickname);
}
/*
* create the message object
*/
cmsg = NSS_CMSMessage_Create(NULL); /* create a message on its own pool */
if (cmsg == NULL) {
fprintf(stderr, "ERROR: cannot create CMS message.\n");
return NULL;
}
/*
* build chain of objects: message->signedData->data
*/
if ((sigd = NSS_CMSSignedData_Create(cmsg)) == NULL) {
fprintf(stderr, "ERROR: cannot create CMS signedData object.\n");
goto loser;
}
cinfo = NSS_CMSMessage_GetContentInfo(cmsg);
if (NSS_CMSContentInfo_SetContent_SignedData(cmsg, cinfo, sigd) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot attach CMS signedData object.\n");
goto loser;
}
cinfo = NSS_CMSSignedData_GetContentInfo(sigd);
/* we're always passing data in and detaching optionally */
if (NSS_CMSContentInfo_SetContent_Data(cmsg, cinfo, NULL,
signOptions->detached) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot attach CMS data object.\n");
goto loser;
}
/*
* create & attach signer information
*/
signerinfo = NSS_CMSSignerInfo_Create(cmsg, cert, signOptions->hashAlgTag);
if (signerinfo == NULL) {
fprintf(stderr, "ERROR: cannot create CMS signerInfo object.\n");
goto loser;
}
if (cms_verbose) {
fprintf(stderr,
"Created CMS message, added signed data w/ signerinfo\n");
}
signerinfo->cmsg->pwfn_arg = pwcb_arg;
/* we want the cert chain included for this one */
if (NSS_CMSSignerInfo_IncludeCerts(signerinfo, NSSCMSCM_CertChain,
signOptions->options->certUsage) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot find cert chain.\n");
goto loser;
}
if (cms_verbose) {
fprintf(stderr, "imported certificate\n");
}
if (signOptions->signingTime) {
if (NSS_CMSSignerInfo_AddSigningTime(signerinfo, PR_Now()) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot add signingTime attribute.\n");
goto loser;
}
}
if (signOptions->smimeProfile) {
if (NSS_CMSSignerInfo_AddSMIMECaps(signerinfo) != SECSuccess) {
fprintf(stderr, "ERROR: cannot add SMIMECaps attribute.\n");
goto loser;
}
}
if (!signOptions->encryptionKeyPreferenceNick) {
/* check signing cert for fitness as encryption cert */
SECStatus FitForEncrypt = CERT_CheckCertUsage(cert,
certUsageEmailRecipient);
if (SECSuccess == FitForEncrypt) {
/* if yes, add signing cert as EncryptionKeyPreference */
if (NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs(signerinfo, cert,
signOptions->options->certHandle) !=
SECSuccess) {
fprintf(stderr,
"ERROR: cannot add default SMIMEEncKeyPrefs attribute.\n");
goto loser;
}
if (NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs(signerinfo, cert,
signOptions->options->certHandle) !=
SECSuccess) {
fprintf(stderr,
"ERROR: cannot add default MS SMIMEEncKeyPrefs attribute.\n");
goto loser;
}
} else {
/* this is a dual-key cert case, we need to look for the encryption
certificate under the same nickname as the signing cert */
/* get the cert, add it to the message */
if ((ekpcert = CERT_FindUserCertByUsage(
signOptions->options->certHandle,
signOptions->nickname,
certUsageEmailRecipient,
PR_FALSE,
&pwdata)) == NULL) {
SECU_PrintError(progName,
"the corresponding cert for key \"%s\" does not exist",
signOptions->encryptionKeyPreferenceNick);
goto loser;
}
if (NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs(signerinfo, ekpcert,
signOptions->options->certHandle) !=
SECSuccess) {
fprintf(stderr,
"ERROR: cannot add SMIMEEncKeyPrefs attribute.\n");
goto loser;
}
if (NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs(signerinfo, ekpcert,
signOptions->options->certHandle) !=
SECSuccess) {
fprintf(stderr,
"ERROR: cannot add MS SMIMEEncKeyPrefs attribute.\n");
goto loser;
}
if (NSS_CMSSignedData_AddCertificate(sigd, ekpcert) != SECSuccess) {
fprintf(stderr, "ERROR: cannot add encryption certificate.\n");
goto loser;
}
}
} else if (PL_strcmp(signOptions->encryptionKeyPreferenceNick, "NONE") == 0) {
/* No action */
} else {
/* get the cert, add it to the message */
if ((ekpcert = CERT_FindUserCertByUsage(
signOptions->options->certHandle,
signOptions->encryptionKeyPreferenceNick,
certUsageEmailRecipient, PR_FALSE, &pwdata)) ==
NULL) {
SECU_PrintError(progName,
"the corresponding cert for key \"%s\" does not exist",
signOptions->encryptionKeyPreferenceNick);
goto loser;
}
if (NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs(signerinfo, ekpcert,
signOptions->options->certHandle) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot add SMIMEEncKeyPrefs attribute.\n");
goto loser;
}
if (NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs(signerinfo, ekpcert,
signOptions->options->certHandle) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot add MS SMIMEEncKeyPrefs attribute.\n");
goto loser;
}
if (NSS_CMSSignedData_AddCertificate(sigd, ekpcert) != SECSuccess) {
fprintf(stderr, "ERROR: cannot add encryption certificate.\n");
goto loser;
}
}
if (NSS_CMSSignedData_AddSignerInfo(sigd, signerinfo) != SECSuccess) {
fprintf(stderr, "ERROR: cannot add CMS signerInfo object.\n");
goto loser;
}
signerinfo = NULL; /* sigd has adopted signerinfo */
if (cms_verbose) {
fprintf(stderr, "created signed-data message\n");
}
if (ekpcert) {
CERT_DestroyCertificate(ekpcert);
}
if (cert) {
CERT_DestroyCertificate(cert);
}
return cmsg;
loser:
if (ekpcert) {
CERT_DestroyCertificate(ekpcert);
}
if (cert) {
CERT_DestroyCertificate(cert);
}
if (signerinfo) {
NSS_CMSSignerInfo_Destroy(signerinfo);
}
NSS_CMSMessage_Destroy(cmsg);
return NULL;
}
static NSSCMSMessage *
enveloped_data(struct envelopeOptionsStr *envelopeOptions)
{
NSSCMSMessage *cmsg = NULL;
NSSCMSContentInfo *cinfo;
NSSCMSEnvelopedData *envd;
NSSCMSRecipientInfo *recipientinfo;
CERTCertificate **recipientcerts = NULL;
CERTCertDBHandle *dbhandle;
PLArenaPool *tmppoolp = NULL;
SECOidTag bulkalgtag;
int keysize, i = 0;
int cnt;
dbhandle = envelopeOptions->options->certHandle;
/* count the recipients */
if ((cnt = nss_CMSArray_Count((void **)envelopeOptions->recipients)) == 0) {
fprintf(stderr, "ERROR: please name at least one recipient.\n");
goto loser;
}
if ((tmppoolp = PORT_NewArena(1024)) == NULL) {
fprintf(stderr, "ERROR: out of memory.\n");
goto loser;
}
/* XXX find the recipient's certs by email address or nickname */
if ((recipientcerts =
(CERTCertificate **)PORT_ArenaZAlloc(tmppoolp,
(cnt + 1) * sizeof(CERTCertificate *))) ==
NULL) {
fprintf(stderr, "ERROR: out of memory.\n");
goto loser;
}
for (i = 0; envelopeOptions->recipients[i] != NULL; i++) {
if ((recipientcerts[i] =
CERT_FindCertByNicknameOrEmailAddr(dbhandle,
envelopeOptions->recipients[i])) ==
NULL) {
SECU_PrintError(progName, "cannot find certificate for \"%s\"",
envelopeOptions->recipients[i]);
i = 0;
goto loser;
}
}
recipientcerts[i] = NULL;
i = 0;
/* find a nice bulk algorithm */
if (NSS_SMIMEUtil_FindBulkAlgForRecipients(recipientcerts, &bulkalgtag,
&keysize) != SECSuccess) {
fprintf(stderr, "ERROR: cannot find common bulk algorithm.\n");
goto loser;
}
/*
* create the message object
*/
cmsg = NSS_CMSMessage_Create(NULL); /* create a message on its own pool */
if (cmsg == NULL) {
fprintf(stderr, "ERROR: cannot create CMS message.\n");
goto loser;
}
/*
* build chain of objects: message->envelopedData->data
*/
if ((envd = NSS_CMSEnvelopedData_Create(cmsg, bulkalgtag, keysize)) ==
NULL) {
fprintf(stderr, "ERROR: cannot create CMS envelopedData object.\n");
goto loser;
}
cinfo = NSS_CMSMessage_GetContentInfo(cmsg);
if (NSS_CMSContentInfo_SetContent_EnvelopedData(cmsg, cinfo, envd) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot attach CMS envelopedData object.\n");
goto loser;
}
cinfo = NSS_CMSEnvelopedData_GetContentInfo(envd);
/* we're always passing data in, so the content is NULL */
if (NSS_CMSContentInfo_SetContent_Data(cmsg, cinfo, NULL, PR_FALSE) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot attach CMS data object.\n");
goto loser;
}
/*
* create & attach recipient information
*/
for (i = 0; recipientcerts[i] != NULL; i++) {
if ((recipientinfo = NSS_CMSRecipientInfo_Create(cmsg,
recipientcerts[i])) ==
NULL) {
fprintf(stderr, "ERROR: cannot create CMS recipientInfo object.\n");
goto loser;
}
if (NSS_CMSEnvelopedData_AddRecipient(envd, recipientinfo) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot add CMS recipientInfo object.\n");
goto loser;
}
CERT_DestroyCertificate(recipientcerts[i]);
}
if (tmppoolp)
PORT_FreeArena(tmppoolp, PR_FALSE);
return cmsg;
loser:
if (recipientcerts) {
for (; recipientcerts[i] != NULL; i++) {
CERT_DestroyCertificate(recipientcerts[i]);
}
}
if (cmsg)
NSS_CMSMessage_Destroy(cmsg);
if (tmppoolp)
PORT_FreeArena(tmppoolp, PR_FALSE);
return NULL;
}
PK11SymKey *
dkcb(void *arg, SECAlgorithmID *algid)
{
return (PK11SymKey *)arg;
}
static SECStatus
get_enc_params(struct encryptOptionsStr *encryptOptions)
{
struct envelopeOptionsStr envelopeOptions;
SECStatus rv = SECFailure;
NSSCMSMessage *env_cmsg;
NSSCMSContentInfo *cinfo;
int i, nlevels;
/*
* construct an enveloped data message to obtain bulk keys
*/
if (encryptOptions->envmsg) {
env_cmsg = encryptOptions->envmsg; /* get it from an old message */
} else {
SECItem dummyOut = { 0, 0, 0 };
SECItem dummyIn = { 0, 0, 0 };
char str[] = "Hello!";
PLArenaPool *tmparena = PORT_NewArena(1024);
dummyIn.data = (unsigned char *)str;
dummyIn.len = strlen(str);
envelopeOptions.options = encryptOptions->options;
envelopeOptions.recipients = encryptOptions->recipients;
env_cmsg = enveloped_data(&envelopeOptions);
NSS_CMSDEREncode(env_cmsg, &dummyIn, &dummyOut, tmparena);
PR_Write(encryptOptions->envFile, dummyOut.data, dummyOut.len);
PORT_FreeArena(tmparena, PR_FALSE);
}
/*
* get the content info for the enveloped data
*/
nlevels = NSS_CMSMessage_ContentLevelCount(env_cmsg);
for (i = 0; i < nlevels; i++) {
SECOidTag typetag;
cinfo = NSS_CMSMessage_ContentLevel(env_cmsg, i);
typetag = NSS_CMSContentInfo_GetContentTypeTag(cinfo);
if (typetag == SEC_OID_PKCS7_DATA) {
/*
* get the symmetric key
*/
encryptOptions->bulkalgtag = NSS_CMSContentInfo_GetContentEncAlgTag(cinfo);
encryptOptions->keysize = NSS_CMSContentInfo_GetBulkKeySize(cinfo);
encryptOptions->bulkkey = NSS_CMSContentInfo_GetBulkKey(cinfo);
rv = SECSuccess;
break;
}
}
if (i == nlevels) {
fprintf(stderr, "%s: could not retrieve enveloped data.", progName);
}
if (env_cmsg)
NSS_CMSMessage_Destroy(env_cmsg);
return rv;
}
static NSSCMSMessage *
encrypted_data(struct encryptOptionsStr *encryptOptions)
{
SECStatus rv = SECFailure;
NSSCMSMessage *cmsg = NULL;
NSSCMSContentInfo *cinfo;
NSSCMSEncryptedData *encd;
NSSCMSEncoderContext *ecx = NULL;
PLArenaPool *tmppoolp = NULL;
SECItem derOut = { 0, 0, 0 };
/* arena for output */
tmppoolp = PORT_NewArena(1024);
if (!tmppoolp) {
fprintf(stderr, "%s: out of memory.\n", progName);
return NULL;
}
/*
* create the message object
*/
cmsg = NSS_CMSMessage_Create(NULL);
if (cmsg == NULL) {
fprintf(stderr, "ERROR: cannot create CMS message.\n");
goto loser;
}
/*
* build chain of objects: message->encryptedData->data
*/
if ((encd = NSS_CMSEncryptedData_Create(cmsg, encryptOptions->bulkalgtag,
encryptOptions->keysize)) ==
NULL) {
fprintf(stderr, "ERROR: cannot create CMS encryptedData object.\n");
goto loser;
}
cinfo = NSS_CMSMessage_GetContentInfo(cmsg);
if (NSS_CMSContentInfo_SetContent_EncryptedData(cmsg, cinfo, encd) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot attach CMS encryptedData object.\n");
goto loser;
}
cinfo = NSS_CMSEncryptedData_GetContentInfo(encd);
/* we're always passing data in, so the content is NULL */
if (NSS_CMSContentInfo_SetContent_Data(cmsg, cinfo, NULL, PR_FALSE) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot attach CMS data object.\n");
goto loser;
}
ecx = NSS_CMSEncoder_Start(cmsg, NULL, NULL, &derOut, tmppoolp, NULL, NULL,
dkcb, encryptOptions->bulkkey, NULL, NULL);
if (!ecx) {
fprintf(stderr, "%s: cannot create encoder context.\n", progName);
goto loser;
}
rv = NSS_CMSEncoder_Update(ecx, (char *)encryptOptions->input->data,
encryptOptions->input->len);
if (rv) {
fprintf(stderr, "%s: failed to add data to encoder.\n", progName);
goto loser;
}
rv = NSS_CMSEncoder_Finish(ecx);
if (rv) {
fprintf(stderr, "%s: failed to encrypt data.\n", progName);
goto loser;
}
fwrite(derOut.data, derOut.len, 1, encryptOptions->outfile);
/*
if (bulkkey)
PK11_FreeSymKey(bulkkey);
*/
if (tmppoolp)
PORT_FreeArena(tmppoolp, PR_FALSE);
return cmsg;
loser:
/*
if (bulkkey)
PK11_FreeSymKey(bulkkey);
*/
if (tmppoolp)
PORT_FreeArena(tmppoolp, PR_FALSE);
if (cmsg)
NSS_CMSMessage_Destroy(cmsg);
return NULL;
}
static NSSCMSMessage *
signed_data_certsonly(struct certsonlyOptionsStr *certsonlyOptions)
{
NSSCMSMessage *cmsg = NULL;
NSSCMSContentInfo *cinfo;
NSSCMSSignedData *sigd;
CERTCertificate **certs = NULL;
CERTCertDBHandle *dbhandle;
PLArenaPool *tmppoolp = NULL;
int i = 0, cnt;
dbhandle = certsonlyOptions->options->certHandle;
if ((cnt = nss_CMSArray_Count((void **)certsonlyOptions->recipients)) == 0) {
fprintf(stderr,
"ERROR: please indicate the nickname of a certificate to sign with.\n");
goto loser;
}
if (!(tmppoolp = PORT_NewArena(1024))) {
fprintf(stderr, "ERROR: out of memory.\n");
goto loser;
}
if (!(certs = PORT_ArenaZNewArray(tmppoolp, CERTCertificate *, cnt + 1))) {
fprintf(stderr, "ERROR: out of memory.\n");
goto loser;
}
for (i = 0; certsonlyOptions->recipients[i] != NULL; i++) {
if ((certs[i] =
CERT_FindCertByNicknameOrEmailAddr(dbhandle,
certsonlyOptions->recipients[i])) ==
NULL) {
SECU_PrintError(progName, "cannot find certificate for \"%s\"",
certsonlyOptions->recipients[i]);
i = 0;
goto loser;
}
}
certs[i] = NULL;
i = 0;
/*
* create the message object
*/
cmsg = NSS_CMSMessage_Create(NULL);
if (cmsg == NULL) {
fprintf(stderr, "ERROR: cannot create CMS message.\n");
goto loser;
}
/*
* build chain of objects: message->signedData->data
*/
if ((sigd = NSS_CMSSignedData_CreateCertsOnly(cmsg, certs[0], PR_TRUE)) ==
NULL) {
fprintf(stderr, "ERROR: cannot create CMS signedData object.\n");
goto loser;
}
CERT_DestroyCertificate(certs[0]);
for (i = 1; i < cnt; i++) {
if (NSS_CMSSignedData_AddCertChain(sigd, certs[i])) {
fprintf(stderr, "ERROR: cannot add cert chain for \"%s\".\n",
certsonlyOptions->recipients[i]);
goto loser;
}
CERT_DestroyCertificate(certs[i]);
}
cinfo = NSS_CMSMessage_GetContentInfo(cmsg);
if (NSS_CMSContentInfo_SetContent_SignedData(cmsg, cinfo, sigd) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot attach CMS signedData object.\n");
goto loser;
}
cinfo = NSS_CMSSignedData_GetContentInfo(sigd);
if (NSS_CMSContentInfo_SetContent_Data(cmsg, cinfo, NULL, PR_FALSE) !=
SECSuccess) {
fprintf(stderr, "ERROR: cannot attach CMS data object.\n");
goto loser;
}
if (tmppoolp)
PORT_FreeArena(tmppoolp, PR_FALSE);
return cmsg;
loser:
if (certs) {
for (; i < cnt; i++) {
CERT_DestroyCertificate(certs[i]);
}
}
if (cmsg)
NSS_CMSMessage_Destroy(cmsg);
if (tmppoolp)
PORT_FreeArena(tmppoolp, PR_FALSE);
return NULL;
}
static char *
pl_fgets(char *buf, int size, PRFileDesc *fd)
{
char *bp = buf;
int nb = 0;
;
while (size > 1) {
nb = PR_Read(fd, bp, 1);
if (nb < 0) {
/* deal with error */
return NULL;
} else if (nb == 0) {
/* deal with EOF */
return NULL;
} else if (*bp == '\n') {
/* deal with EOL */
++bp; /* keep EOL character */
break;
} else {
/* ordinary character */
++bp;
--size;
}
}
*bp = '\0';
return buf;
}
typedef enum { UNKNOWN,
DECODE,
SIGN,
ENCRYPT,
ENVELOPE,
CERTSONLY } Mode;
static int
doBatchDecode(FILE *outFile, PRFileDesc *batchFile,
const struct decodeOptionsStr *decodeOptions)
{
char *str;
int exitStatus = 0;
char batchLine[512];
while (NULL != (str = pl_fgets(batchLine, sizeof batchLine, batchFile))) {
NSSCMSMessage *cmsg = NULL;
PRFileDesc *inFile;
int len = strlen(str);
SECStatus rv;
SECItem input = { 0, 0, 0 };
char cc;
while (len > 0 &&
((cc = str[len - 1]) == '\n' || cc == '\r')) {
str[--len] = '\0';
}
if (!len) /* skip empty line */
continue;
if (str[0] == '#')
continue; /* skip comment line */
fprintf(outFile, "========== %s ==========\n", str);
inFile = PR_Open(str, PR_RDONLY, 00660);
if (inFile == NULL) {
fprintf(outFile, "%s: unable to open \"%s\" for reading\n",
progName, str);
exitStatus = 1;
continue;
}
rv = SECU_FileToItem(&input, inFile);
PR_Close(inFile);
if (rv != SECSuccess) {
SECU_PrintError(progName, "unable to read infile");
exitStatus = 1;
continue;
}
cmsg = decode(outFile, &input, decodeOptions);
SECITEM_FreeItem(&input, PR_FALSE);
if (cmsg)
NSS_CMSMessage_Destroy(cmsg);
else {
SECU_PrintError(progName, "problem decoding");
exitStatus = 1;
}
}
return exitStatus;
}
/* legacy SHA2 table...
* cmsutil took hash values of SHA256, SHA244, etc., the the
* oid table has values of SHA-256, SHA-224. Use the follow
* table to handle the old values. NOTE: no need to add new
* hashes to this table, just use the actual oid table
* values */
typedef struct LegacyHashNameStr {
char *name;
SECOidTag tag;
} LegacyHashName;
LegacyHashName legacyHashNamesTable[] = {
{ "SHA1", SEC_OID_SHA1 },
{ "SHA224", SEC_OID_SHA224 },
{ "SHA256", SEC_OID_SHA256 },
{ "SHA384", SEC_OID_SHA384 },
{ "SHA512", SEC_OID_SHA512 },
};
size_t legacyHashNamesTableSize = PR_ARRAY_SIZE(legacyHashNamesTable);
SECOidTag
CMSU_FindTagFromString(const char *cipherString)
{
SECOidTag tag;
SECOidData *oid;
size_t slen;
/* future enhancement: accept dotted oid spec? */
for (tag = 1; (oid = SECOID_FindOIDByTag(tag)) != NULL; tag++) {
/* only interested in oids that we actually understand */
if (oid->mechanism == CKM_INVALID_MECHANISM) {
continue;
}
if (PORT_Strcasecmp(oid->desc, cipherString) != 0) {
continue;
}
return tag;
}
slen = PORT_Strlen(cipherString);
if ((slen > 3) && (PORT_Strncasecmp(cipherString, "SHA", 3) == 0) &&
(cipherString[3] != '-')) {
int i;
for (i = 0; i < legacyHashNamesTableSize; i++) {
if (PORT_Strcasecmp(legacyHashNamesTable[i].name, cipherString) == 0) {
return legacyHashNamesTable[i].tag;
}
}
/* not on any table, must be invalid */
}
return SEC_OID_UNKNOWN;
}
int
main(int argc, char **argv)
{
FILE *outFile;
NSSCMSMessage *cmsg = NULL;
PRFileDesc *inFile;
PLOptState *optstate;
PLOptStatus status;
Mode mode = UNKNOWN;
struct decodeOptionsStr decodeOptions = { 0 };
struct signOptionsStr signOptions = { 0 };
struct envelopeOptionsStr envelopeOptions = { 0 };
struct certsonlyOptionsStr certsonlyOptions = { 0 };
struct encryptOptionsStr encryptOptions = { 0 };
struct optionsStr options = { 0 };
int exitstatus;
static char *ptrarray[128] = { 0 };
int nrecipients = 0;
char *str, *tok;
char *envFileName;
SECItem input = { 0, 0, 0 };
SECItem envmsg = { 0, 0, 0 };
SECStatus rv;
PRFileDesc *contentFile = NULL;
PRBool batch = PR_FALSE;
#ifdef NISCC_TEST
const char *ev = PR_GetEnvSecure("NSS_DISABLE_ARENA_FREE_LIST");
PORT_Assert(ev);
ev = PR_GetEnvSecure("NSS_STRICT_SHUTDOWN");
PORT_Assert(ev);
#endif
SECOID_Init();
progName = strrchr(argv[0], '/');
if (!progName)
progName = strrchr(argv[0], '\\');
progName = progName ? progName + 1 : argv[0];
inFile = PR_STDIN;
outFile = stdout;
envFileName = NULL;
mode = UNKNOWN;
decodeOptions.content.data = NULL;
decodeOptions.content.len = 0;
decodeOptions.suppressContent = PR_FALSE;
decodeOptions.headerLevel = -1;
decodeOptions.keepCerts = PR_FALSE;
options.certUsage = certUsageEmailSigner;
options.password = NULL;
options.pwfile = NULL;
signOptions.nickname = NULL;
signOptions.detached = PR_FALSE;
signOptions.signingTime = PR_FALSE;
signOptions.smimeProfile = PR_FALSE;
signOptions.encryptionKeyPreferenceNick = NULL;
signOptions.hashAlgTag = SEC_OID_SHA256;
envelopeOptions.recipients = NULL;
encryptOptions.recipients = NULL;
encryptOptions.envmsg = NULL;
encryptOptions.envFile = NULL;
encryptOptions.bulkalgtag = SEC_OID_UNKNOWN;
encryptOptions.bulkkey = NULL;
encryptOptions.keysize = -1;
/*
* Parse command line arguments
*/
optstate = PL_CreateOptState(argc, argv,
"CDEGH:N:OPSTY:bc:d:e:f:h:i:kno:p:r:s:u:v");
while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
switch (optstate->option) {
case 'C':
mode = ENCRYPT;
break;
case 'D':
mode = DECODE;
break;
case 'E':
mode = ENVELOPE;
break;
case 'G':
if (mode != SIGN) {
fprintf(stderr,
"%s: option -G only supported with option -S.\n",
progName);
Usage();
exit(1);
}
signOptions.signingTime = PR_TRUE;
break;
case 'H':
if (mode != SIGN) {
fprintf(stderr,
"%s: option -H only supported with option -S.\n",
progName);
Usage();
exit(1);
}
decodeOptions.suppressContent = PR_TRUE;
/* lookup hash value from our oid table and make sure it's a hash
* using HASH_ functions */
signOptions.hashAlgTag = CMSU_FindTagFromString(optstate->value);
if (HASH_GetHashTypeByOidTag(signOptions.hashAlgTag) == HASH_AlgNULL) {
char *comma = "";
int i;
/* it wasn't, use the HASH_ functions to find the valid values
* and print it as an error */
fprintf(stderr,
"%s: -H requires one of ", progName);
for (i = HASH_AlgNULL + 1; PR_TRUE; i++) {
SECOidTag hashTag = HASH_GetHashOidTagByHashType(i);
if (hashTag == SEC_OID_UNKNOWN) {
fprintf(stderr, "\n");
exit(1);
}
fprintf(stderr, "%s%s", comma, SECOID_FindOIDTagDescription(hashTag));
comma = ",";
}
/* NOT REACHED */
}
break;
case 'N':
if (mode != SIGN) {
fprintf(stderr,
"%s: option -N only supported with option -S.\n",
progName);
Usage();
exit(1);
}
signOptions.nickname = PORT_Strdup(optstate->value);
break;
case 'O':
mode = CERTSONLY;
break;
case 'P':
if (mode != SIGN) {
fprintf(stderr,
"%s: option -P only supported with option -S.\n",
progName);
Usage();
exit(1);
}
signOptions.smimeProfile = PR_TRUE;
break;
case 'S':
mode = SIGN;
break;
case 'T':
if (mode != SIGN) {
fprintf(stderr,
"%s: option -T only supported with option -S.\n",
progName);
Usage();
exit(1);
}
signOptions.detached = PR_TRUE;
break;
case 'Y':
if (mode != SIGN) {
fprintf(stderr,
"%s: option -Y only supported with option -S.\n",
progName);
Usage();
exit(1);
}
signOptions.encryptionKeyPreferenceNick = strdup(optstate->value);
break;
case 'b':
if (mode != DECODE) {
fprintf(stderr,
"%s: option -b only supported with option -D.\n",
progName);
Usage();
exit(1);
}
batch = PR_TRUE;
break;
case 'c':
if (mode != DECODE) {
fprintf(stderr,
"%s: option -c only supported with option -D.\n",
progName);
Usage();
exit(1);
}
contentFile = PR_Open(optstate->value, PR_RDONLY, 006600);
if (contentFile == NULL) {
fprintf(stderr, "%s: unable to open \"%s\" for reading.\n",
progName, optstate->value);
exit(1);
}
rv = SECU_FileToItem(&decodeOptions.content, contentFile);
PR_Close(contentFile);
if (rv != SECSuccess) {
SECU_PrintError(progName, "problem reading content file");
exit(1);
}
if (!decodeOptions.content.data) {
/* file was zero length */
decodeOptions.content.data = (unsigned char *)PORT_Strdup("");
decodeOptions.content.len = 0;
}
break;
case 'd':
SECU_ConfigDirectory(optstate->value);
break;
case 'e':
envFileName = PORT_Strdup(optstate->value);
encryptOptions.envFile = PR_Open(envFileName, PR_RDONLY, 00660);
break;
case 'h':
if (mode != DECODE) {
fprintf(stderr,
"%s: option -h only supported with option -D.\n",
progName);
Usage();
exit(1);
}
decodeOptions.headerLevel = atoi(optstate->value);
if (decodeOptions.headerLevel < 0) {
fprintf(stderr, "option -h cannot have a negative value.\n");
exit(1);
}
break;
case 'i':
if (!optstate->value) {
fprintf(stderr, "-i option requires filename argument\n");
exit(1);
}
inFile = PR_Open(optstate->value, PR_RDONLY, 00660);
if (inFile == NULL) {
fprintf(stderr, "%s: unable to open \"%s\" for reading\n",
progName, optstate->value);
exit(1);
}
break;
case 'k':
if (mode != DECODE) {
fprintf(stderr,
"%s: option -k only supported with option -D.\n",
progName);
Usage();
exit(1);
}
decodeOptions.keepCerts = PR_TRUE;
break;
case 'n':
if (mode != DECODE) {
fprintf(stderr,
"%s: option -n only supported with option -D.\n",
progName);
Usage();
exit(1);
}
decodeOptions.suppressContent = PR_TRUE;
break;
case 'o':
outFile = fopen(optstate->value, "wb");
if (outFile == NULL) {
fprintf(stderr, "%s: unable to open \"%s\" for writing\n",
progName, optstate->value);
exit(1);
}
break;
case 'p':
if (!optstate->value) {
fprintf(stderr, "%s: option -p must have a value.\n", progName);
Usage();
exit(1);
}
options.password = strdup(optstate->value);
break;
case 'f':
if (!optstate->value) {
fprintf(stderr, "%s: option -f must have a value.\n", progName);
Usage();
exit(1);
}
options.pwfile = strdup(optstate->value);
break;
case 'r':
if (!optstate->value) {
fprintf(stderr, "%s: option -r must have a value.\n", progName);
Usage();
exit(1);
}
envelopeOptions.recipients = ptrarray;
str = (char *)optstate->value;
do {
tok = strchr(str, ',');
if (tok)
*tok = '\0';
envelopeOptions.recipients[nrecipients++] = strdup(str);
if (tok)
str = tok + 1;
} while (tok);
envelopeOptions.recipients[nrecipients] = NULL;
encryptOptions.recipients = envelopeOptions.recipients;
certsonlyOptions.recipients = envelopeOptions.recipients;
break;
case 'u': {
int usageType;
usageType = atoi(strdup(optstate->value));
if (usageType < certUsageSSLClient || usageType > certUsageAnyCA)
return -1;
options.certUsage = (SECCertUsage)usageType;
break;
}
case 'v':
cms_verbose = 1;
break;
}
}
if (status == PL_OPT_BAD)
Usage();
PL_DestroyOptState(optstate);
if (mode == UNKNOWN)
Usage();
if (mode != CERTSONLY && !batch) {
rv = SECU_FileToItem(&input, inFile);
if (rv != SECSuccess) {
SECU_PrintError(progName, "unable to read infile");
exit(1);
}
}
if (cms_verbose) {
fprintf(stderr, "received commands\n");
}
/* Call the NSS initialization routines */
PR_Init(PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 1);
rv = NSS_InitReadWrite(SECU_ConfigDirectory(NULL));
if (SECSuccess != rv) {
SECU_PrintError(progName, "NSS_Init failed");
exit(1);
}
if (cms_verbose) {
fprintf(stderr, "NSS has been initialized.\n");
}
options.certHandle = CERT_GetDefaultCertDB();
if (!options.certHandle) {
SECU_PrintError(progName, "No default cert DB");
exit(1);
}
if (cms_verbose) {
fprintf(stderr, "Got default certdb\n");
}
if (options.password) {
pwdata.source = PW_PLAINTEXT;
pwdata.data = options.password;
}
if (options.pwfile) {
pwdata.source = PW_FROMFILE;
pwdata.data = options.pwfile;
}
pwcb = SECU_GetModulePassword;
pwcb_arg = (void *)&pwdata;
PK11_SetPasswordFunc(&SECU_GetModulePassword);
#if defined(_WIN32)
if (outFile == stdout) {
/* If we're going to write binary data to stdout, we must put stdout
** into O_BINARY mode or else outgoing \n's will become \r\n's.
*/
int smrv = _setmode(_fileno(stdout), _O_BINARY);
if (smrv == -1) {
fprintf(stderr,
"%s: Cannot change stdout to binary mode. Use -o option instead.\n",
progName);
return smrv;
}
}
#endif
exitstatus = 0;
switch (mode) {
case DECODE: /* -D */
decodeOptions.options = &options;
if (encryptOptions.envFile) {
/* Decoding encrypted-data, so get the bulkkey from an
* enveloped-data message.
*/
SECU_FileToItem(&envmsg, encryptOptions.envFile);
decodeOptions.options = &options;
encryptOptions.envmsg = decode(NULL, &envmsg, &decodeOptions);
if (!encryptOptions.envmsg) {
SECU_PrintError(progName, "problem decoding env msg");
exitstatus = 1;
break;
}
rv = get_enc_params(&encryptOptions);
decodeOptions.dkcb = dkcb;
decodeOptions.bulkkey = encryptOptions.bulkkey;
}
if (!batch) {
cmsg = decode(outFile, &input, &decodeOptions);
if (!cmsg) {
SECU_PrintError(progName, "problem decoding");
exitstatus = 1;
}
} else {
exitstatus = doBatchDecode(outFile, inFile, &decodeOptions);
}
break;
case SIGN: /* -S */
signOptions.options = &options;
cmsg = signed_data(&signOptions);
if (!cmsg) {
SECU_PrintError(progName, "problem signing");
exitstatus = 1;
}
break;
case ENCRYPT: /* -C */
if (!envFileName) {
fprintf(stderr, "%s: you must specify an envelope file with -e.\n",
progName);
exit(1);
}
encryptOptions.options = &options;
encryptOptions.input = &input;
encryptOptions.outfile = outFile;
/* decode an enveloped-data message to get the bulkkey (create
* a new one if neccessary)
*/
if (!encryptOptions.envFile) {
encryptOptions.envFile = PR_Open(envFileName,
PR_WRONLY | PR_CREATE_FILE, 00660);
if (!encryptOptions.envFile) {
fprintf(stderr, "%s: failed to create file %s.\n", progName,
envFileName);
exit(1);
}
} else {
SECU_FileToItem(&envmsg, encryptOptions.envFile);
decodeOptions.options = &options;
encryptOptions.envmsg = decode(NULL, &envmsg, &decodeOptions);
if (encryptOptions.envmsg == NULL) {
SECU_PrintError(progName, "problem decrypting env msg");
exitstatus = 1;
break;
}
}
rv = get_enc_params(&encryptOptions);
/* create the encrypted-data message */
cmsg = encrypted_data(&encryptOptions);
if (!cmsg) {
SECU_PrintError(progName, "problem encrypting");
exitstatus = 1;
}
if (encryptOptions.bulkkey) {
PK11_FreeSymKey(encryptOptions.bulkkey);
encryptOptions.bulkkey = NULL;
}
break;
case ENVELOPE: /* -E */
envelopeOptions.options = &options;
cmsg = enveloped_data(&envelopeOptions);
if (!cmsg) {
SECU_PrintError(progName, "problem enveloping");
exitstatus = 1;
}
break;
case CERTSONLY: /* -O */
certsonlyOptions.options = &options;
cmsg = signed_data_certsonly(&certsonlyOptions);
if (!cmsg) {
SECU_PrintError(progName, "problem with certs-only");
exitstatus = 1;
}
break;
default:
fprintf(stderr, "One of options -D, -S or -E must be set.\n");
Usage();
exitstatus = 1;
}
if (signOptions.nickname) {
PORT_Free(signOptions.nickname);
}
if ((mode == SIGN || mode == ENVELOPE || mode == CERTSONLY) &&
(!exitstatus)) {
PLArenaPool *arena = PORT_NewArena(1024);
NSSCMSEncoderContext *ecx;
SECItem output = { 0, 0, 0 };
if (!arena) {
fprintf(stderr, "%s: out of memory.\n", progName);
exit(1);
}
if (cms_verbose) {
fprintf(stderr, "cmsg [%p]\n", cmsg);
fprintf(stderr, "arena [%p]\n", arena);
if (pwcb_arg && (PW_PLAINTEXT == ((secuPWData *)pwcb_arg)->source))
fprintf(stderr, "password [%s]\n",
((secuPWData *)pwcb_arg)->data);
else
fprintf(stderr, "password [NULL]\n");
}
ecx = NSS_CMSEncoder_Start(cmsg,
NULL, NULL, /* DER output callback */
&output, arena, /* destination storage */
pwcb, pwcb_arg, /* password callback */
NULL, NULL, /* decrypt key callback */
NULL, NULL); /* detached digests */
if (!ecx) {
fprintf(stderr, "%s: cannot create encoder context.\n", progName);
exit(1);
}
if (cms_verbose) {
fprintf(stderr, "input len [%d]\n", input.len);
{
unsigned int j;
for (j = 0; j < input.len; j++)
fprintf(stderr, "%2x%c", input.data[j], (j > 0 && j % 35 == 0) ? '\n' : ' ');
}
}
if (input.len > 0) { /* skip if certs-only (or other zero content) */
rv = NSS_CMSEncoder_Update(ecx, (char *)input.data, input.len);
if (rv) {
fprintf(stderr,
"%s: failed to add data to encoder.\n", progName);
exit(1);
}
}
rv = NSS_CMSEncoder_Finish(ecx);
if (rv) {
SECU_PrintError(progName, "failed to encode data");
exit(1);
}
if (cms_verbose) {
fprintf(stderr, "encoding passed\n");
}
fwrite(output.data, output.len, 1, outFile);
if (cms_verbose) {
fprintf(stderr, "wrote to file\n");
}
PORT_FreeArena(arena, PR_FALSE);
}
if (cmsg)
NSS_CMSMessage_Destroy(cmsg);
if (outFile != stdout)
fclose(outFile);
if (inFile != PR_STDIN) {
PR_Close(inFile);
}
if (envFileName) {
PORT_Free(envFileName);
}
if (encryptOptions.envFile) {
PR_Close(encryptOptions.envFile);
}
SECITEM_FreeItem(&decodeOptions.content, PR_FALSE);
SECITEM_FreeItem(&envmsg, PR_FALSE);
SECITEM_FreeItem(&input, PR_FALSE);
if (NSS_Shutdown() != SECSuccess) {
SECU_PrintError(progName, "NSS_Shutdown failed");
exitstatus = 1;
}
PR_Cleanup();
return exitstatus;
}