+ ENGINE *e = NULL;
+ int operation = 0;
+ int ret = 0;
+ char **args;
+ const char *inmode = "r", *outmode = "w";
+ char *infile = NULL, *outfile = NULL;
+ char *signerfile = NULL, *recipfile = NULL;
+ STACK_OF(OPENSSL_STRING) *sksigners = NULL, *skkeys = NULL;
+ char *certfile = NULL, *keyfile = NULL, *contfile = NULL;
+ const EVP_CIPHER *cipher = NULL;
+ PKCS7 *p7 = NULL;
+ X509_STORE *store = NULL;
+ X509 *cert = NULL, *recip = NULL, *signer = NULL;
+ EVP_PKEY *key = NULL;
+ STACK_OF(X509) *encerts = NULL, *other = NULL;
+ BIO *in = NULL, *out = NULL, *indata = NULL;
+ int badarg = 0;
+ int flags = PKCS7_DETACHED;
+ char *to = NULL, *from = NULL, *subject = NULL;
+ char *CAfile = NULL, *CApath = NULL;
+ char *passargin = NULL, *passin = NULL;
+ char *inrand = NULL;
+ int need_rand = 0;
+ int indef = 0;
+ const EVP_MD *sign_md = NULL;
+ int informat = FORMAT_SMIME, outformat = FORMAT_SMIME;
+ int keyform = FORMAT_PEM;
+#ifndef OPENSSL_NO_ENGINE
+ char *engine = NULL;
+#endif
+
+ X509_VERIFY_PARAM *vpm = NULL;
+
+ args = argv + 1;
+ ret = 1;
+
+ apps_startup();
+
+ if (bio_err == NULL) {
+ if ((bio_err = BIO_new(BIO_s_file())) != NULL)
+ BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
+ }
+
+ if (!load_config(bio_err, NULL))
+ goto end;
+
+ while (!badarg && *args && *args[0] == '-') {
+ if (!strcmp(*args, "-encrypt"))
+ operation = SMIME_ENCRYPT;
+ else if (!strcmp(*args, "-decrypt"))
+ operation = SMIME_DECRYPT;
+ else if (!strcmp(*args, "-sign"))
+ operation = SMIME_SIGN;
+ else if (!strcmp(*args, "-resign"))
+ operation = SMIME_RESIGN;
+ else if (!strcmp(*args, "-verify"))
+ operation = SMIME_VERIFY;
+ else if (!strcmp(*args, "-pk7out"))
+ operation = SMIME_PK7OUT;
+#ifndef OPENSSL_NO_DES
+ else if (!strcmp(*args, "-des3"))
+ cipher = EVP_des_ede3_cbc();
+ else if (!strcmp(*args, "-des"))
+ cipher = EVP_des_cbc();
+#endif
+#ifndef OPENSSL_NO_SEED
+ else if (!strcmp(*args, "-seed"))
+ cipher = EVP_seed_cbc();
+#endif
+#ifndef OPENSSL_NO_RC2
+ else if (!strcmp(*args, "-rc2-40"))
+ cipher = EVP_rc2_40_cbc();
+ else if (!strcmp(*args, "-rc2-128"))
+ cipher = EVP_rc2_cbc();
+ else if (!strcmp(*args, "-rc2-64"))
+ cipher = EVP_rc2_64_cbc();
+#endif
+#ifndef OPENSSL_NO_AES
+ else if (!strcmp(*args, "-aes128"))
+ cipher = EVP_aes_128_cbc();
+ else if (!strcmp(*args, "-aes192"))
+ cipher = EVP_aes_192_cbc();
+ else if (!strcmp(*args, "-aes256"))
+ cipher = EVP_aes_256_cbc();
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+ else if (!strcmp(*args, "-camellia128"))
+ cipher = EVP_camellia_128_cbc();
+ else if (!strcmp(*args, "-camellia192"))
+ cipher = EVP_camellia_192_cbc();
+ else if (!strcmp(*args, "-camellia256"))
+ cipher = EVP_camellia_256_cbc();
+#endif
+ else if (!strcmp(*args, "-text"))
+ flags |= PKCS7_TEXT;
+ else if (!strcmp(*args, "-nointern"))
+ flags |= PKCS7_NOINTERN;
+ else if (!strcmp(*args, "-noverify"))
+ flags |= PKCS7_NOVERIFY;
+ else if (!strcmp(*args, "-nochain"))
+ flags |= PKCS7_NOCHAIN;
+ else if (!strcmp(*args, "-nocerts"))
+ flags |= PKCS7_NOCERTS;
+ else if (!strcmp(*args, "-noattr"))
+ flags |= PKCS7_NOATTR;
+ else if (!strcmp(*args, "-nodetach"))
+ flags &= ~PKCS7_DETACHED;
+ else if (!strcmp(*args, "-nosmimecap"))
+ flags |= PKCS7_NOSMIMECAP;
+ else if (!strcmp(*args, "-binary"))
+ flags |= PKCS7_BINARY;
+ else if (!strcmp(*args, "-nosigs"))
+ flags |= PKCS7_NOSIGS;
+ else if (!strcmp(*args, "-stream"))
+ indef = 1;
+ else if (!strcmp(*args, "-indef"))
+ indef = 1;
+ else if (!strcmp(*args, "-noindef"))
+ indef = 0;
+ else if (!strcmp(*args, "-nooldmime"))
+ flags |= PKCS7_NOOLDMIMETYPE;
+ else if (!strcmp(*args, "-crlfeol"))
+ flags |= PKCS7_CRLFEOL;
+ else if (!strcmp(*args, "-rand")) {
+ if (!args[1])
+ goto argerr;
+ args++;
+ inrand = *args;
+ need_rand = 1;
+ }
+#ifndef OPENSSL_NO_ENGINE
+ else if (!strcmp(*args, "-engine")) {
+ if (!args[1])
+ goto argerr;
+ engine = *++args;
+ }
+#endif
+ else if (!strcmp(*args, "-passin")) {
+ if (!args[1])
+ goto argerr;
+ passargin = *++args;
+ } else if (!strcmp(*args, "-to")) {
+ if (!args[1])
+ goto argerr;
+ to = *++args;
+ } else if (!strcmp(*args, "-from")) {
+ if (!args[1])
+ goto argerr;
+ from = *++args;
+ } else if (!strcmp(*args, "-subject")) {
+ if (!args[1])
+ goto argerr;
+ subject = *++args;
+ } else if (!strcmp(*args, "-signer")) {
+ if (!args[1])
+ goto argerr;
+ /* If previous -signer argument add signer to list */
+
+ if (signerfile) {
+ if (!sksigners)
+ sksigners = sk_OPENSSL_STRING_new_null();
+ sk_OPENSSL_STRING_push(sksigners, signerfile);
+ if (!keyfile)
+ keyfile = signerfile;
+ if (!skkeys)
+ skkeys = sk_OPENSSL_STRING_new_null();
+ sk_OPENSSL_STRING_push(skkeys, keyfile);
+ keyfile = NULL;
+ }
+ signerfile = *++args;
+ } else if (!strcmp(*args, "-recip")) {
+ if (!args[1])
+ goto argerr;
+ recipfile = *++args;
+ } else if (!strcmp(*args, "-md")) {
+ if (!args[1])
+ goto argerr;
+ sign_md = EVP_get_digestbyname(*++args);
+ if (sign_md == NULL) {
+ BIO_printf(bio_err, "Unknown digest %s\n", *args);
+ goto argerr;
+ }
+ } else if (!strcmp(*args, "-inkey")) {
+ if (!args[1])
+ goto argerr;
+ /* If previous -inkey arument add signer to list */
+ if (keyfile) {
+ if (!signerfile) {
+ BIO_puts(bio_err, "Illegal -inkey without -signer\n");
+ goto argerr;
+ }
+ if (!sksigners)
+ sksigners = sk_OPENSSL_STRING_new_null();
+ sk_OPENSSL_STRING_push(sksigners, signerfile);
+ signerfile = NULL;
+ if (!skkeys)
+ skkeys = sk_OPENSSL_STRING_new_null();
+ sk_OPENSSL_STRING_push(skkeys, keyfile);
+ }
+ keyfile = *++args;
+ } else if (!strcmp(*args, "-keyform")) {
+ if (!args[1])
+ goto argerr;
+ keyform = str2fmt(*++args);
+ } else if (!strcmp(*args, "-certfile")) {
+ if (!args[1])
+ goto argerr;
+ certfile = *++args;
+ } else if (!strcmp(*args, "-CAfile")) {
+ if (!args[1])
+ goto argerr;
+ CAfile = *++args;
+ } else if (!strcmp(*args, "-CApath")) {
+ if (!args[1])
+ goto argerr;
+ CApath = *++args;
+ } else if (!strcmp(*args, "-in")) {
+ if (!args[1])
+ goto argerr;
+ infile = *++args;
+ } else if (!strcmp(*args, "-inform")) {
+ if (!args[1])
+ goto argerr;
+ informat = str2fmt(*++args);
+ } else if (!strcmp(*args, "-outform")) {
+ if (!args[1])
+ goto argerr;
+ outformat = str2fmt(*++args);
+ } else if (!strcmp(*args, "-out")) {
+ if (!args[1])
+ goto argerr;
+ outfile = *++args;
+ } else if (!strcmp(*args, "-content")) {
+ if (!args[1])
+ goto argerr;
+ contfile = *++args;
+ } else if (args_verify(&args, NULL, &badarg, bio_err, &vpm))
+ continue;
+ else if ((cipher = EVP_get_cipherbyname(*args + 1)) == NULL)
+ badarg = 1;
+ args++;
+ }
+
+ if (!(operation & SMIME_SIGNERS) && (skkeys || sksigners)) {
+ BIO_puts(bio_err, "Multiple signers or keys not allowed\n");
+ goto argerr;
+ }
+
+ if (operation & SMIME_SIGNERS) {
+ /* Check to see if any final signer needs to be appended */
+ if (keyfile && !signerfile) {
+ BIO_puts(bio_err, "Illegal -inkey without -signer\n");
+ goto argerr;
+ }
+ if (signerfile) {
+ if (!sksigners)
+ sksigners = sk_OPENSSL_STRING_new_null();
+ sk_OPENSSL_STRING_push(sksigners, signerfile);
+ if (!skkeys)
+ skkeys = sk_OPENSSL_STRING_new_null();
+ if (!keyfile)
+ keyfile = signerfile;
+ sk_OPENSSL_STRING_push(skkeys, keyfile);
+ }
+ if (!sksigners) {
+ BIO_printf(bio_err, "No signer certificate specified\n");
+ badarg = 1;
+ }
+ signerfile = NULL;
+ keyfile = NULL;
+ need_rand = 1;
+ } else if (operation == SMIME_DECRYPT) {
+ if (!recipfile && !keyfile) {
+ BIO_printf(bio_err,
+ "No recipient certificate or key specified\n");
+ badarg = 1;
+ }
+ } else if (operation == SMIME_ENCRYPT) {
+ if (!*args) {
+ BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n");
+ badarg = 1;
+ }
+ need_rand = 1;
+ } else if (!operation)
+ badarg = 1;
+
+ if (badarg) {
+ argerr:
+ BIO_printf(bio_err, "Usage smime [options] cert.pem ...\n");
+ BIO_printf(bio_err, "where options are\n");
+ BIO_printf(bio_err, "-encrypt encrypt message\n");
+ BIO_printf(bio_err, "-decrypt decrypt encrypted message\n");
+ BIO_printf(bio_err, "-sign sign message\n");
+ BIO_printf(bio_err, "-verify verify signed message\n");
+ BIO_printf(bio_err, "-pk7out output PKCS#7 structure\n");
+#ifndef OPENSSL_NO_DES
+ BIO_printf(bio_err, "-des3 encrypt with triple DES\n");
+ BIO_printf(bio_err, "-des encrypt with DES\n");
+#endif
+#ifndef OPENSSL_NO_SEED
+ BIO_printf(bio_err, "-seed encrypt with SEED\n");
+#endif
+#ifndef OPENSSL_NO_RC2
+ BIO_printf(bio_err, "-rc2-40 encrypt with RC2-40 (default)\n");
+ BIO_printf(bio_err, "-rc2-64 encrypt with RC2-64\n");
+ BIO_printf(bio_err, "-rc2-128 encrypt with RC2-128\n");
+#endif
+#ifndef OPENSSL_NO_AES
+ BIO_printf(bio_err, "-aes128, -aes192, -aes256\n");
+ BIO_printf(bio_err,
+ " encrypt PEM output with cbc aes\n");