Mercurial > hgrepos > Python2 > PyMuPDF

comparison mupdf-source/thirdparty/curl/docs/examples/curlx.c @ 2:b50eed0cc0ef upstream

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
ADD: MuPDF v1.26.7: the MuPDF source as downloaded by a default build of PyMuPDF 1.26.4. The directory name has changed: no version number in the expanded directory now.
author Franz Glasner <fzglas.hg@dom66.de>
date Mon, 15 Sep 2025 11:43:07 +0200
parents
children
comparison
equal deleted inserted replaced
1:1d09e1dec1d9 2:b50eed0cc0ef
1 /*
2 curlx.c Authors: Peter Sylvester, Jean-Paul Merlin
3
4 This is a little program to demonstrate the usage of
5
6 - an ssl initialisation callback setting a user key and trustbases
7 coming from a pkcs12 file
8 - using an ssl application callback to find a URI in the
9 certificate presented during ssl session establishment.
10
11 */
12 /* <DESC>
13 * demonstrates use of SSL context callback, requires OpenSSL
14 * </DESC>
15 */
16
17 /*
18 * Copyright (c) 2003 The OpenEvidence Project. All rights reserved.
19 *
20 * Redistribution and use in source and binary forms, with or without
21 * modification, are permitted provided that the following conditions
22 * are met:
23 *
24 * 1. Redistributions of source code must retain the above copyright
25 * notice, this list of conditions, the following disclaimer,
26 * and the original OpenSSL and SSLeay Licences below.
27 *
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions, the following disclaimer
30 * and the original OpenSSL and SSLeay Licences below in
31 * the documentation and/or other materials provided with the
32 * distribution.
33 *
34 * 3. All advertising materials mentioning features or use of this
35 * software must display the following acknowledgments:
36 * "This product includes software developed by the Openevidence Project
37 * for use in the OpenEvidence Toolkit. (http://www.openevidence.org/)"
38 * This product includes software developed by the OpenSSL Project
39 * for use in the OpenSSL Toolkit (https://www.openssl.org/)"
40 * This product includes cryptographic software written by Eric Young
41 * (eay@cryptsoft.com). This product includes software written by Tim
42 * Hudson (tjh@cryptsoft.com)."
43 *
44 * 4. The names "OpenEvidence Toolkit" and "OpenEvidence Project" must not be
45 * used to endorse or promote products derived from this software without
46 * prior written permission. For written permission, please contact
47 * openevidence-core@openevidence.org.
48 *
49 * 5. Products derived from this software may not be called "OpenEvidence"
50 * nor may "OpenEvidence" appear in their names without prior written
51 * permission of the OpenEvidence Project.
52 *
53 * 6. Redistributions of any form whatsoever must retain the following
54 * acknowledgments:
55 * "This product includes software developed by the OpenEvidence Project
56 * for use in the OpenEvidence Toolkit (http://www.openevidence.org/)
57 * This product includes software developed by the OpenSSL Project
58 * for use in the OpenSSL Toolkit (https://www.openssl.org/)"
59 * This product includes cryptographic software written by Eric Young
60 * (eay@cryptsoft.com). This product includes software written by Tim
61 * Hudson (tjh@cryptsoft.com)."
62 *
63 * THIS SOFTWARE IS PROVIDED BY THE OpenEvidence PROJECT ``AS IS'' AND ANY
64 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
65 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
66 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenEvidence PROJECT OR
67 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
68 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
69 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
70 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
71 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
72 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
73 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
74 * OF THE POSSIBILITY OF SUCH DAMAGE.
75 * ====================================================================
76 *
77 * This product includes software developed by the OpenSSL Project
78 * for use in the OpenSSL Toolkit (https://www.openssl.org/)
79 * This product includes cryptographic software written by Eric Young
80 * (eay@cryptsoft.com). This product includes software written by Tim
81 * Hudson (tjh@cryptsoft.com).
82 *
83 */
84
85 #include <stdio.h>
86 #include <stdlib.h>
87 #include <string.h>
88 #include <curl/curl.h>
89 #include <openssl/x509v3.h>
90 #include <openssl/x509_vfy.h>
91 #include <openssl/crypto.h>
92 #include <openssl/lhash.h>
93 #include <openssl/objects.h>
94 #include <openssl/err.h>
95 #include <openssl/evp.h>
96 #include <openssl/x509.h>
97 #include <openssl/pkcs12.h>
98 #include <openssl/bio.h>
99 #include <openssl/ssl.h>
100
101 static const char *curlx_usage[]={
102 "usage: curlx args\n",
103 " -p12 arg - tia file ",
104 " -envpass arg - environment variable which content the tia private"
105 " key password",
106 " -out arg - output file (response)- default stdout",
107 " -in arg - input file (request)- default stdin",
108 " -connect arg - URL of the server for the connection ex:"
109 " www.openevidence.org",
110 " -mimetype arg - MIME type for data in ex : application/timestamp-query"
111 " or application/dvcs -default application/timestamp-query",
112 " -acceptmime arg - MIME type acceptable for the response ex : "
113 "application/timestamp-response or application/dvcs -default none",
114 " -accesstype arg - an Object identifier in an AIA/SIA method, e.g."
115 " AD_DVCS or ad_timestamping",
116 NULL
117 };
118
119 /*
120
121 ./curlx -p12 psy.p12 -envpass XX -in request -verbose -accesstype AD_DVCS
122 -mimetype application/dvcs -acceptmime application/dvcs -out response
123
124 */
125
126 /*
127 * We use this ZERO_NULL to avoid picky compiler warnings,
128 * when assigning a NULL pointer to a function pointer var.
129 */
130
131 #define ZERO_NULL 0
132
133 /* This is a context that we pass to all callbacks */
134
135 typedef struct sslctxparm_st {
136 unsigned char *p12file;
137 const char *pst;
138 PKCS12 *p12;
139 EVP_PKEY *pkey;
140 X509 *usercert;
141 STACK_OF(X509) * ca;
142 CURL *curl;
143 BIO *errorbio;
144 int accesstype;
145 int verbose;
146
147 } sslctxparm;
148
149 /* some helper function. */
150
151 static char *ia5string(ASN1_IA5STRING *ia5)
152 {
153 char *tmp;
154 if(!ia5 || !ia5->length)
155 return NULL;
156 tmp = OPENSSL_malloc(ia5->length + 1);
157 memcpy(tmp, ia5->data, ia5->length);
158 tmp[ia5->length] = 0;
159 return tmp;
160 }
161
162 /* A convenience routine to get an access URI. */
163 static unsigned char *my_get_ext(X509 *cert, const int type,
164 int extensiontype)
165 {
166 int i;
167 STACK_OF(ACCESS_DESCRIPTION) * accessinfo;
168 accessinfo = X509_get_ext_d2i(cert, extensiontype, NULL, NULL);
169
170 if(!sk_ACCESS_DESCRIPTION_num(accessinfo))
171 return NULL;
172 for(i = 0; i < sk_ACCESS_DESCRIPTION_num(accessinfo); i++) {
173 ACCESS_DESCRIPTION * ad = sk_ACCESS_DESCRIPTION_value(accessinfo, i);
174 if(OBJ_obj2nid(ad->method) == type) {
175 if(ad->location->type == GEN_URI) {
176 return ia5string(ad->location->d.ia5);
177 }
178 return NULL;
179 }
180 }
181 return NULL;
182 }
183
184 /* This is an application verification call back, it does not
185 perform any addition verification but tries to find a URL
186 in the presented certificate. If found, this will become
187 the URL to be used in the POST.
188 */
189
190 static int ssl_app_verify_callback(X509_STORE_CTX *ctx, void *arg)
191 {
192 sslctxparm * p = (sslctxparm *) arg;
193 int ok;
194
195 if(p->verbose > 2)
196 BIO_printf(p->errorbio, "entering ssl_app_verify_callback\n");
197
198 ok = X509_verify_cert(ctx);
199 if(ok && ctx->cert) {
200 unsigned char *accessinfo;
201 if(p->verbose > 1)
202 X509_print_ex(p->errorbio, ctx->cert, 0, 0);
203
204 accessinfo = my_get_ext(ctx->cert, p->accesstype, NID_sinfo_access);
205 if(accessinfo) {
206 if(p->verbose)
207 BIO_printf(p->errorbio, "Setting URL from SIA to: %s\n", accessinfo);
208
209 curl_easy_setopt(p->curl, CURLOPT_URL, accessinfo);
210 }
211 else if(accessinfo = my_get_ext(ctx->cert, p->accesstype,
212 NID_info_access)) {
213 if(p->verbose)
214 BIO_printf(p->errorbio, "Setting URL from AIA to: %s\n", accessinfo);
215
216 curl_easy_setopt(p->curl, CURLOPT_URL, accessinfo);
217 }
218 }
219 if(p->verbose > 2)
220 BIO_printf(p->errorbio, "leaving ssl_app_verify_callback with %d\n", ok);
221
222 return ok;
223 }
224
225
226 /* The SSL initialisation callback. The callback sets:
227 - a private key and certificate
228 - a trusted ca certificate
229 - a preferred cipherlist
230 - an application verification callback (the function above)
231 */
232
233 static CURLcode sslctxfun(CURL *curl, void *sslctx, void *parm)
234 {
235 sslctxparm *p = (sslctxparm *) parm;
236 SSL_CTX *ctx = (SSL_CTX *) sslctx;
237
238 if(!SSL_CTX_use_certificate(ctx, p->usercert)) {
239 BIO_printf(p->errorbio, "SSL_CTX_use_certificate problem\n");
240 goto err;
241 }
242 if(!SSL_CTX_use_PrivateKey(ctx, p->pkey)) {
243 BIO_printf(p->errorbio, "SSL_CTX_use_PrivateKey\n");
244 goto err;
245 }
246
247 if(!SSL_CTX_check_private_key(ctx)) {
248 BIO_printf(p->errorbio, "SSL_CTX_check_private_key\n");
249 goto err;
250 }
251
252 SSL_CTX_set_quiet_shutdown(ctx, 1);
253 SSL_CTX_set_cipher_list(ctx, "RC4-MD5");
254 SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
255
256 X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx),
257 sk_X509_value(p->ca, sk_X509_num(p->ca)-1));
258
259 SSL_CTX_set_verify_depth(ctx, 2);
260 SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, ZERO_NULL);
261 SSL_CTX_set_cert_verify_callback(ctx, ssl_app_verify_callback, parm);
262
263 return CURLE_OK;
264 err:
265 ERR_print_errors(p->errorbio);
266 return CURLE_SSL_CERTPROBLEM;
267
268 }
269
270 int main(int argc, char **argv)
271 {
272 BIO* in = NULL;
273 BIO* out = NULL;
274
275 char *outfile = NULL;
276 char *infile = NULL;
277
278 int tabLength = 100;
279 char *binaryptr;
280 char *mimetype = NULL;
281 char *mimetypeaccept = NULL;
282 char *contenttype;
283 const char **pp;
284 unsigned char *hostporturl = NULL;
285 BIO *p12bio;
286 char **args = argv + 1;
287 unsigned char *serverurl;
288 sslctxparm p;
289 char *response;
290
291 CURLcode res;
292 struct curl_slist *headers = NULL;
293 int badarg = 0;
294
295 binaryptr = malloc(tabLength);
296
297 memset(&p, '\0', sizeof(p));
298 p.errorbio = BIO_new_fp(stderr, BIO_NOCLOSE);
299
300 curl_global_init(CURL_GLOBAL_DEFAULT);
301
302 /* we need some more for the P12 decoding */
303
304 OpenSSL_add_all_ciphers();
305 OpenSSL_add_all_digests();
306 ERR_load_crypto_strings();
307
308 while(*args && *args[0] == '-') {
309 if(!strcmp (*args, "-in")) {
310 if(args[1]) {
311 infile = *(++args);
312 }
313 else
314 badarg = 1;
315 }
316 else if(!strcmp (*args, "-out")) {
317 if(args[1]) {
318 outfile = *(++args);
319 }
320 else
321 badarg = 1;
322 }
323 else if(!strcmp (*args, "-p12")) {
324 if(args[1]) {
325 p.p12file = *(++args);
326 }
327 else
328 badarg = 1;
329 }
330 else if(strcmp(*args, "-envpass") == 0) {
331 if(args[1]) {
332 p.pst = getenv(*(++args));
333 }
334 else
335 badarg = 1;
336 }
337 else if(strcmp(*args, "-connect") == 0) {
338 if(args[1]) {
339 hostporturl = *(++args);
340 }
341 else
342 badarg = 1;
343 }
344 else if(strcmp(*args, "-mimetype") == 0) {
345 if(args[1]) {
346 mimetype = *(++args);
347 }
348 else
349 badarg = 1;
350 }
351 else if(strcmp(*args, "-acceptmime") == 0) {
352 if(args[1]) {
353 mimetypeaccept = *(++args);
354 }
355 else
356 badarg = 1;
357 }
358 else if(strcmp(*args, "-accesstype") == 0) {
359 if(args[1]) {
360 p.accesstype = OBJ_obj2nid(OBJ_txt2obj(*++args, 0));
361 if(p.accesstype == 0)
362 badarg = 1;
363 }
364 else
365 badarg = 1;
366 }
367 else if(strcmp(*args, "-verbose") == 0) {
368 p.verbose++;
369 }
370 else
371 badarg = 1;
372 args++;
373 }
374
375 if(mimetype == NULL || mimetypeaccept == NULL || p.p12file == NULL)
376 badarg = 1;
377
378 if(badarg) {
379 for(pp = curlx_usage; (*pp != NULL); pp++)
380 BIO_printf(p.errorbio, "%s\n", *pp);
381 BIO_printf(p.errorbio, "\n");
382 goto err;
383 }
384
385 /* set input */
386
387 in = BIO_new(BIO_s_file());
388 if(in == NULL) {
389 BIO_printf(p.errorbio, "Error setting input bio\n");
390 goto err;
391 }
392 else if(infile == NULL)
393 BIO_set_fp(in, stdin, BIO_NOCLOSE|BIO_FP_TEXT);
394 else if(BIO_read_filename(in, infile) <= 0) {
395 BIO_printf(p.errorbio, "Error opening input file %s\n", infile);
396 BIO_free(in);
397 goto err;
398 }
399
400 /* set output */
401
402 out = BIO_new(BIO_s_file());
403 if(out == NULL) {
404 BIO_printf(p.errorbio, "Error setting output bio.\n");
405 goto err;
406 }
407 else if(outfile == NULL)
408 BIO_set_fp(out, stdout, BIO_NOCLOSE|BIO_FP_TEXT);
409 else if(BIO_write_filename(out, outfile) <= 0) {
410 BIO_printf(p.errorbio, "Error opening output file %s\n", outfile);
411 BIO_free(out);
412 goto err;
413 }
414
415
416 p.errorbio = BIO_new_fp(stderr, BIO_NOCLOSE);
417
418 p.curl = curl_easy_init();
419 if(!p.curl) {
420 BIO_printf(p.errorbio, "Cannot init curl lib\n");
421 goto err;
422 }
423
424 p12bio = BIO_new_file(p.p12file, "rb");
425 if(!p12bio) {
426 BIO_printf(p.errorbio, "Error opening P12 file %s\n", p.p12file);
427 goto err;
428 }
429 p.p12 = d2i_PKCS12_bio(p12bio, NULL);
430 if(!p.p12) {
431 BIO_printf(p.errorbio, "Cannot decode P12 structure %s\n", p.p12file);
432 goto err;
433 }
434
435 p.ca = NULL;
436 if(!(PKCS12_parse (p.p12, p.pst, &(p.pkey), &(p.usercert), &(p.ca) ) )) {
437 BIO_printf(p.errorbio, "Invalid P12 structure in %s\n", p.p12file);
438 goto err;
439 }
440
441 if(sk_X509_num(p.ca) <= 0) {
442 BIO_printf(p.errorbio, "No trustworthy CA given.%s\n", p.p12file);
443 goto err;
444 }
445
446 if(p.verbose > 1)
447 X509_print_ex(p.errorbio, p.usercert, 0, 0);
448
449 /* determine URL to go */
450
451 if(hostporturl) {
452 size_t len = strlen(hostporturl) + 9;
453 serverurl = malloc(len);
454 snprintf(serverurl, len, "https://%s", hostporturl);
455 }
456 else if(p.accesstype != 0) { /* see whether we can find an AIA or SIA for a
457 given access type */
458 serverurl = my_get_ext(p.usercert, p.accesstype, NID_info_access);
459 if(!serverurl) {
460 int j = 0;
461 BIO_printf(p.errorbio, "no service URL in user cert "
462 "cherching in others certificats\n");
463 for(j = 0; j<sk_X509_num(p.ca); j++) {
464 serverurl = my_get_ext(sk_X509_value(p.ca, j), p.accesstype,
465 NID_info_access);
466 if(serverurl)
467 break;
468 serverurl = my_get_ext(sk_X509_value(p.ca, j), p.accesstype,
469 NID_sinfo_access);
470 if(serverurl)
471 break;
472 }
473 }
474 }
475
476 if(!serverurl) {
477 BIO_printf(p.errorbio, "no service URL in certificats,"
478 " check '-accesstype (AD_DVCS | ad_timestamping)'"
479 " or use '-connect'\n");
480 goto err;
481 }
482
483 if(p.verbose)
484 BIO_printf(p.errorbio, "Service URL: <%s>\n", serverurl);
485
486 curl_easy_setopt(p.curl, CURLOPT_URL, serverurl);
487
488 /* Now specify the POST binary data */
489
490 curl_easy_setopt(p.curl, CURLOPT_POSTFIELDS, binaryptr);
491 curl_easy_setopt(p.curl, CURLOPT_POSTFIELDSIZE, (long)tabLength);
492
493 /* pass our list of custom made headers */
494
495 contenttype = malloc(15 + strlen(mimetype));
496 snprintf(contenttype, 15 + strlen(mimetype), "Content-type: %s", mimetype);
497 headers = curl_slist_append(headers, contenttype);
498 curl_easy_setopt(p.curl, CURLOPT_HTTPHEADER, headers);
499
500 if(p.verbose)
501 BIO_printf(p.errorbio, "Service URL: <%s>\n", serverurl);
502
503 {
504 FILE *outfp;
505 BIO_get_fp(out, &outfp);
506 curl_easy_setopt(p.curl, CURLOPT_WRITEDATA, outfp);
507 }
508
509 res = curl_easy_setopt(p.curl, CURLOPT_SSL_CTX_FUNCTION, sslctxfun);
510
511 if(res != CURLE_OK)
512 BIO_printf(p.errorbio, "%d %s=%d %d\n", __LINE__,
513 "CURLOPT_SSL_CTX_FUNCTION", CURLOPT_SSL_CTX_FUNCTION, res);
514
515 curl_easy_setopt(p.curl, CURLOPT_SSL_CTX_DATA, &p);
516
517 {
518 char *ptr;
519 int lu; int i = 0;
520 while((lu = BIO_read(in, &binaryptr[i], tabLength-i)) >0) {
521 i += lu;
522 if(i == tabLength) {
523 tabLength += 100;
524 ptr = realloc(binaryptr, tabLength); /* should be more careful */
525 if(!ptr) {
526 /* out of memory */
527 BIO_printf(p.errorbio, "out of memory (realloc returned NULL)\n");
528 goto fail;
529 }
530 binaryptr = ptr;
531 ptr = NULL;
532 }
533 }
534 tabLength = i;
535 }
536 /* Now specify the POST binary data */
537
538 curl_easy_setopt(p.curl, CURLOPT_POSTFIELDS, binaryptr);
539 curl_easy_setopt(p.curl, CURLOPT_POSTFIELDSIZE, (long)tabLength);
540
541
542 /* Perform the request, res will get the return code */
543
544 BIO_printf(p.errorbio, "%d %s %d\n", __LINE__, "curl_easy_perform",
545 res = curl_easy_perform(p.curl));
546 {
547 curl_easy_getinfo(p.curl, CURLINFO_CONTENT_TYPE, &response);
548 if(mimetypeaccept && p.verbose) {
549 if(!strcmp(mimetypeaccept, response))
550 BIO_printf(p.errorbio, "the response has a correct mimetype : %s\n",
551 response);
552 else
553 BIO_printf(p.errorbio, "the response doesn\'t have an acceptable "
554 "mime type, it is %s instead of %s\n",
555 response, mimetypeaccept);
556 }
557 }
558
559 /*** code d'erreur si accept mime ***, egalement code return HTTP != 200 ***/
560
561 /* free the header list*/
562 fail:
563 curl_slist_free_all(headers);
564
565 /* always cleanup */
566 curl_easy_cleanup(p.curl);
567
568 BIO_free(in);
569 BIO_free(out);
570 return (EXIT_SUCCESS);
571
572 err: BIO_printf(p.errorbio, "error");
573 exit(1);
574 }