]> git.ipfire.org Git - thirdparty/openssl.git/blob - apps/ca.c
projects / thirdparty / openssl.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
LHASH revamp. make depend.
[thirdparty/openssl.git] / apps / ca.c
1 /* apps/ca.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59 /* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
60
61 #include <stdio.h>
62 #include <stdlib.h>
63 #include <string.h>
64 #include <ctype.h>
65 #include <sys/types.h>
66 #include <openssl/conf.h>
67 #include <openssl/bio.h>
68 #include <openssl/err.h>
69 #include <openssl/bn.h>
70 #include <openssl/txt_db.h>
71 #include <openssl/evp.h>
72 #include <openssl/x509.h>
73 #include <openssl/x509v3.h>
74 #include <openssl/objects.h>
75 #include <openssl/ocsp.h>
76 #include <openssl/pem.h>
77
78 #ifndef W_OK
79 # ifdef OPENSSL_SYS_VMS
80 # if defined(__DECC)
81 # include <unistd.h>
82 # else
83 # include <unixlib.h>
84 # endif
85 # elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_NETWARE)
86 # include <sys/file.h>
87 # endif
88 #endif
89
90 #include "apps.h"
91
92 #ifndef W_OK
93 # define F_OK 0
94 # define X_OK 1
95 # define W_OK 2
96 # define R_OK 4
97 #endif
98
99 #undef PROG
100 #define PROG ca_main
101
102 #define BASE_SECTION "ca"
103 #define CONFIG_FILE "openssl.cnf"
104
105 #define ENV_DEFAULT_CA "default_ca"
106
107 #define STRING_MASK "string_mask"
108 #define UTF8_IN "utf8"
109
110 #define ENV_DIR "dir"
111 #define ENV_CERTS "certs"
112 #define ENV_CRL_DIR "crl_dir"
113 #define ENV_CA_DB "CA_DB"
114 #define ENV_NEW_CERTS_DIR "new_certs_dir"
115 #define ENV_CERTIFICATE "certificate"
116 #define ENV_SERIAL "serial"
117 #define ENV_CRLNUMBER "crlnumber"
118 #define ENV_CRL "crl"
119 #define ENV_PRIVATE_KEY "private_key"
120 #define ENV_RANDFILE "RANDFILE"
121 #define ENV_DEFAULT_DAYS "default_days"
122 #define ENV_DEFAULT_STARTDATE "default_startdate"
123 #define ENV_DEFAULT_ENDDATE "default_enddate"
124 #define ENV_DEFAULT_CRL_DAYS "default_crl_days"
125 #define ENV_DEFAULT_CRL_HOURS "default_crl_hours"
126 #define ENV_DEFAULT_MD "default_md"
127 #define ENV_DEFAULT_EMAIL_DN "email_in_dn"
128 #define ENV_PRESERVE "preserve"
129 #define ENV_POLICY "policy"
130 #define ENV_EXTENSIONS "x509_extensions"
131 #define ENV_CRLEXT "crl_extensions"
132 #define ENV_MSIE_HACK "msie_hack"
133 #define ENV_NAMEOPT "name_opt"
134 #define ENV_CERTOPT "cert_opt"
135 #define ENV_EXTCOPY "copy_extensions"
136 #define ENV_UNIQUE_SUBJECT "unique_subject"
137
138 #define ENV_DATABASE "database"
139
140 /* Additional revocation information types */
141
142 #define REV_NONE 0 /* No addditional information */
143 #define REV_CRL_REASON 1 /* Value is CRL reason code */
144 #define REV_HOLD 2 /* Value is hold instruction */
145 #define REV_KEY_COMPROMISE 3 /* Value is cert key compromise time */
146 #define REV_CA_COMPROMISE 4 /* Value is CA key compromise time */
147
148 static const char *ca_usage[]={
149 "usage: ca args\n",
150 "\n",
151 " -verbose - Talk alot while doing things\n",
152 " -config file - A config file\n",
153 " -name arg - The particular CA definition to use\n",
154 " -gencrl - Generate a new CRL\n",
155 " -crldays days - Days is when the next CRL is due\n",
156 " -crlhours hours - Hours is when the next CRL is due\n",
157 " -startdate YYMMDDHHMMSSZ - certificate validity notBefore\n",
158 " -enddate YYMMDDHHMMSSZ - certificate validity notAfter (overrides -days)\n",
159 " -days arg - number of days to certify the certificate for\n",
160 " -md arg - md to use, one of md2, md5, sha or sha1\n",
161 " -policy arg - The CA 'policy' to support\n",
162 " -keyfile arg - private key file\n",
163 " -keyform arg - private key file format (PEM or ENGINE)\n",
164 " -key arg - key to decode the private key if it is encrypted\n",
165 " -cert file - The CA certificate\n",
166 " -selfsign - sign a certificate with the key associated with it\n",
167 " -in file - The input PEM encoded certificate request(s)\n",
168 " -out file - Where to put the output file(s)\n",
169 " -outdir dir - Where to put output certificates\n",
170 " -infiles .... - The last argument, requests to process\n",
171 " -spkac file - File contains DN and signed public key and challenge\n",
172 " -ss_cert file - File contains a self signed cert to sign\n",
173 " -preserveDN - Don't re-order the DN\n",
174 " -noemailDN - Don't add the EMAIL field into certificate' subject\n",
175 " -batch - Don't ask questions\n",
176 " -msie_hack - msie modifications to handle all those universal strings\n",
177 " -revoke file - Revoke a certificate (given in file)\n",
178 " -subj arg - Use arg instead of request's subject\n",
179 " -utf8 - input characters are UTF8 (default ASCII)\n",
180 " -multivalue-rdn - enable support for multivalued RDNs\n",
181 " -extensions .. - Extension section (override value in config file)\n",
182 " -extfile file - Configuration file with X509v3 extentions to add\n",
183 " -crlexts .. - CRL extension section (override value in config file)\n",
184 #ifndef OPENSSL_NO_ENGINE
185 " -engine e - use engine e, possibly a hardware device.\n",
186 #endif
187 " -status serial - Shows certificate status given the serial number\n",
188 " -updatedb - Updates db for expired certificates\n",
189 NULL
190 };
191
192 #ifdef EFENCE
193 extern int EF_PROTECT_FREE;
194 extern int EF_PROTECT_BELOW;
195 extern int EF_ALIGNMENT;
196 #endif
197
198 static void lookup_fail(const char *name, const char *tag);
199 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
200 const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,CA_DB *db,
201 BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate,
202 char *enddate, long days, int batch, char *ext_sect, CONF *conf,
203 int verbose, unsigned long certopt, unsigned long nameopt,
204 int default_op, int ext_copy, int selfsign);
205 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
206 const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
207 CA_DB *db, BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn,
208 char *startdate, char *enddate, long days, int batch,
209 char *ext_sect, CONF *conf,int verbose, unsigned long certopt,
210 unsigned long nameopt, int default_op, int ext_copy,
211 ENGINE *e);
212 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
213 const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
214 CA_DB *db, BIGNUM *serial,char *subj,unsigned long chtype, int multirdn, int email_dn,
215 char *startdate, char *enddate, long days, char *ext_sect,
216 CONF *conf, int verbose, unsigned long certopt,
217 unsigned long nameopt, int default_op, int ext_copy);
218 static int fix_data(int nid, int *type);
219 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
220 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
221 STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,char *subj,unsigned long chtype, int multirdn,
222 int email_dn, char *startdate, char *enddate, long days, int batch,
223 int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
224 unsigned long certopt, unsigned long nameopt, int default_op,
225 int ext_copy, int selfsign);
226 static int do_revoke(X509 *x509, CA_DB *db, int ext, char *extval);
227 static int get_certificate_status(const char *ser_status, CA_DB *db);
228 static int do_updatedb(CA_DB *db);
229 static int check_time_format(const char *str);
230 char *make_revocation_str(int rev_type, char *rev_arg);
231 int make_revoked(X509_REVOKED *rev, const char *str);
232 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
233 static CONF *conf=NULL;
234 static CONF *extconf=NULL;
235 static char *section=NULL;
236
237 static int preserve=0;
238 static int msie_hack=0;
239
240
241 int MAIN(int, char **);
242
243 int MAIN(int argc, char **argv)
244 {
245 ENGINE *e = NULL;
246 char *key=NULL,*passargin=NULL;
247 int create_ser = 0;
248 int free_key = 0;
249 int total=0;
250 int total_done=0;
251 int badops=0;
252 int ret=1;
253 int email_dn=1;
254 int req=0;
255 int verbose=0;
256 int gencrl=0;
257 int dorevoke=0;
258 int doupdatedb=0;
259 long crldays=0;
260 long crlhours=0;
261 long crlsec=0;
262 long errorline= -1;
263 char *configfile=NULL;
264 char *md=NULL;
265 char *policy=NULL;
266 char *keyfile=NULL;
267 char *certfile=NULL;
268 int keyform=FORMAT_PEM;
269 char *infile=NULL;
270 char *spkac_file=NULL;
271 char *ss_cert_file=NULL;
272 char *ser_status=NULL;
273 EVP_PKEY *pkey=NULL;
274 int output_der = 0;
275 char *outfile=NULL;
276 char *outdir=NULL;
277 char *serialfile=NULL;
278 char *crlnumberfile=NULL;
279 char *extensions=NULL;
280 char *extfile=NULL;
281 char *subj=NULL;
282 unsigned long chtype = MBSTRING_ASC;
283 int multirdn = 0;
284 char *tmp_email_dn=NULL;
285 char *crl_ext=NULL;
286 int rev_type = REV_NONE;
287 char *rev_arg = NULL;
288 BIGNUM *serial=NULL;
289 BIGNUM *crlnumber=NULL;
290 char *startdate=NULL;
291 char *enddate=NULL;
292 long days=0;
293 int batch=0;
294 int notext=0;
295 unsigned long nameopt = 0, certopt = 0;
296 int default_op = 1;
297 int ext_copy = EXT_COPY_NONE;
298 int selfsign = 0;
299 X509 *x509=NULL, *x509p = NULL;
300 X509 *x=NULL;
301 BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
302 char *dbfile=NULL;
303 CA_DB *db=NULL;
304 X509_CRL *crl=NULL;
305 X509_REVOKED *r=NULL;
306 ASN1_TIME *tmptm;
307 ASN1_INTEGER *tmpser;
308 char *f;
309 const char *p, **pp;
310 int i,j;
311 const EVP_MD *dgst=NULL;
312 STACK_OF(CONF_VALUE) *attribs=NULL;
313 STACK_OF(X509) *cert_sk=NULL;
314 #undef BSIZE
315 #define BSIZE 256
316 MS_STATIC char buf[3][BSIZE];
317 char *randfile=NULL;
318 #ifndef OPENSSL_NO_ENGINE
319 char *engine = NULL;
320 #endif
321 char *tofree=NULL;
322 DB_ATTR db_attr;
323
324 #ifdef EFENCE
325 EF_PROTECT_FREE=1;
326 EF_PROTECT_BELOW=1;
327 EF_ALIGNMENT=0;
328 #endif
329
330 apps_startup();
331
332 conf = NULL;
333 key = NULL;
334 section = NULL;
335
336 preserve=0;
337 msie_hack=0;
338 if (bio_err == NULL)
339 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
340 BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
341
342 argc--;
343 argv++;
344 while (argc >= 1)
345 {
346 if (strcmp(*argv,"-verbose") == 0)
347 verbose=1;
348 else if (strcmp(*argv,"-config") == 0)
349 {
350 if (--argc < 1) goto bad;
351 configfile= *(++argv);
352 }
353 else if (strcmp(*argv,"-name") == 0)
354 {
355 if (--argc < 1) goto bad;
356 section= *(++argv);
357 }
358 else if (strcmp(*argv,"-subj") == 0)
359 {
360 if (--argc < 1) goto bad;
361 subj= *(++argv);
362 /* preserve=1; */
363 }
364 else if (strcmp(*argv,"-utf8") == 0)
365 chtype = MBSTRING_UTF8;
366 else if (strcmp(*argv,"-create_serial") == 0)
367 create_ser = 1;
368 else if (strcmp(*argv,"-multivalue-rdn") == 0)
369 multirdn=1;
370 else if (strcmp(*argv,"-startdate") == 0)
371 {
372 if (--argc < 1) goto bad;
373 startdate= *(++argv);
374 }
375 else if (strcmp(*argv,"-enddate") == 0)
376 {
377 if (--argc < 1) goto bad;
378 enddate= *(++argv);
379 }
380 else if (strcmp(*argv,"-days") == 0)
381 {
382 if (--argc < 1) goto bad;
383 days=atoi(*(++argv));
384 }
385 else if (strcmp(*argv,"-md") == 0)
386 {
387 if (--argc < 1) goto bad;
388 md= *(++argv);
389 }
390 else if (strcmp(*argv,"-policy") == 0)
391 {
392 if (--argc < 1) goto bad;
393 policy= *(++argv);
394 }
395 else if (strcmp(*argv,"-keyfile") == 0)
396 {
397 if (--argc < 1) goto bad;
398 keyfile= *(++argv);
399 }
400 else if (strcmp(*argv,"-keyform") == 0)
401 {
402 if (--argc < 1) goto bad;
403 keyform=str2fmt(*(++argv));
404 }
405 else if (strcmp(*argv,"-passin") == 0)
406 {
407 if (--argc < 1) goto bad;
408 passargin= *(++argv);
409 }
410 else if (strcmp(*argv,"-key") == 0)
411 {
412 if (--argc < 1) goto bad;
413 key= *(++argv);
414 }
415 else if (strcmp(*argv,"-cert") == 0)
416 {
417 if (--argc < 1) goto bad;
418 certfile= *(++argv);
419 }
420 else if (strcmp(*argv,"-selfsign") == 0)
421 selfsign=1;
422 else if (strcmp(*argv,"-in") == 0)
423 {
424 if (--argc < 1) goto bad;
425 infile= *(++argv);
426 req=1;
427 }
428 else if (strcmp(*argv,"-out") == 0)
429 {
430 if (--argc < 1) goto bad;
431 outfile= *(++argv);
432 }
433 else if (strcmp(*argv,"-outdir") == 0)
434 {
435 if (--argc < 1) goto bad;
436 outdir= *(++argv);
437 }
438 else if (strcmp(*argv,"-notext") == 0)
439 notext=1;
440 else if (strcmp(*argv,"-batch") == 0)
441 batch=1;
442 else if (strcmp(*argv,"-preserveDN") == 0)
443 preserve=1;
444 else if (strcmp(*argv,"-noemailDN") == 0)
445 email_dn=0;
446 else if (strcmp(*argv,"-gencrl") == 0)
447 gencrl=1;
448 else if (strcmp(*argv,"-msie_hack") == 0)
449 msie_hack=1;
450 else if (strcmp(*argv,"-crldays") == 0)
451 {
452 if (--argc < 1) goto bad;
453 crldays= atol(*(++argv));
454 }
455 else if (strcmp(*argv,"-crlhours") == 0)
456 {
457 if (--argc < 1) goto bad;
458 crlhours= atol(*(++argv));
459 }
460 else if (strcmp(*argv,"-crlsec") == 0)
461 {
462 if (--argc < 1) goto bad;
463 crlsec = atol(*(++argv));
464 }
465 else if (strcmp(*argv,"-infiles") == 0)
466 {
467 argc--;
468 argv++;
469 req=1;
470 break;
471 }
472 else if (strcmp(*argv, "-ss_cert") == 0)
473 {
474 if (--argc < 1) goto bad;
475 ss_cert_file = *(++argv);
476 req=1;
477 }
478 else if (strcmp(*argv, "-spkac") == 0)
479 {
480 if (--argc < 1) goto bad;
481 spkac_file = *(++argv);
482 req=1;
483 }
484 else if (strcmp(*argv,"-revoke") == 0)
485 {
486 if (--argc < 1) goto bad;
487 infile= *(++argv);
488 dorevoke=1;
489 }
490 else if (strcmp(*argv,"-extensions") == 0)
491 {
492 if (--argc < 1) goto bad;
493 extensions= *(++argv);
494 }
495 else if (strcmp(*argv,"-extfile") == 0)
496 {
497 if (--argc < 1) goto bad;
498 extfile= *(++argv);
499 }
500 else if (strcmp(*argv,"-status") == 0)
501 {
502 if (--argc < 1) goto bad;
503 ser_status= *(++argv);
504 }
505 else if (strcmp(*argv,"-updatedb") == 0)
506 {
507 doupdatedb=1;
508 }
509 else if (strcmp(*argv,"-crlexts") == 0)
510 {
511 if (--argc < 1) goto bad;
512 crl_ext= *(++argv);
513 }
514 else if (strcmp(*argv,"-crl_reason") == 0)
515 {
516 if (--argc < 1) goto bad;
517 rev_arg = *(++argv);
518 rev_type = REV_CRL_REASON;
519 }
520 else if (strcmp(*argv,"-crl_hold") == 0)
521 {
522 if (--argc < 1) goto bad;
523 rev_arg = *(++argv);
524 rev_type = REV_HOLD;
525 }
526 else if (strcmp(*argv,"-crl_compromise") == 0)
527 {
528 if (--argc < 1) goto bad;
529 rev_arg = *(++argv);
530 rev_type = REV_KEY_COMPROMISE;
531 }
532 else if (strcmp(*argv,"-crl_CA_compromise") == 0)
533 {
534 if (--argc < 1) goto bad;
535 rev_arg = *(++argv);
536 rev_type = REV_CA_COMPROMISE;
537 }
538 #ifndef OPENSSL_NO_ENGINE
539 else if (strcmp(*argv,"-engine") == 0)
540 {
541 if (--argc < 1) goto bad;
542 engine= *(++argv);
543 }
544 #endif
545 else
546 {
547 bad:
548 BIO_printf(bio_err,"unknown option %s\n",*argv);
549 badops=1;
550 break;
551 }
552 argc--;
553 argv++;
554 }
555
556 if (badops)
557 {
558 for (pp=ca_usage; (*pp != NULL); pp++)
559 BIO_printf(bio_err,"%s",*pp);
560 goto err;
561 }
562
563 ERR_load_crypto_strings();
564
565 /*****************************************************************/
566 tofree=NULL;
567 if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
568 if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
569 if (configfile == NULL)
570 {
571 const char *s=X509_get_default_cert_area();
572 size_t len;
573
574 #ifdef OPENSSL_SYS_VMS
575 len = strlen(s)+sizeof(CONFIG_FILE);
576 tofree=OPENSSL_malloc(len);
577 strcpy(tofree,s);
578 #else
579 len = strlen(s)+sizeof(CONFIG_FILE)+1;
580 tofree=OPENSSL_malloc(len);
581 BUF_strlcpy(tofree,s,len);
582 BUF_strlcat(tofree,"/",len);
583 #endif
584 BUF_strlcat(tofree,CONFIG_FILE,len);
585 configfile=tofree;
586 }
587
588 BIO_printf(bio_err,"Using configuration from %s\n",configfile);
589 conf = NCONF_new(NULL);
590 if (NCONF_load(conf,configfile,&errorline) <= 0)
591 {
592 if (errorline <= 0)
593 BIO_printf(bio_err,"error loading the config file '%s'\n",
594 configfile);
595 else
596 BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
597 ,errorline,configfile);
598 goto err;
599 }
600 if(tofree)
601 {
602 OPENSSL_free(tofree);
603 tofree = NULL;
604 }
605
606 if (!load_config(bio_err, conf))
607 goto err;
608
609 #ifndef OPENSSL_NO_ENGINE
610 e = setup_engine(bio_err, engine, 0);
611 #endif
612
613 /* Lets get the config section we are using */
614 if (section == NULL)
615 {
616 section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
617 if (section == NULL)
618 {
619 lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
620 goto err;
621 }
622 }
623
624 if (conf != NULL)
625 {
626 p=NCONF_get_string(conf,NULL,"oid_file");
627 if (p == NULL)
628 ERR_clear_error();
629 if (p != NULL)
630 {
631 BIO *oid_bio;
632
633 oid_bio=BIO_new_file(p,"r");
634 if (oid_bio == NULL)
635 {
636 /*
637 BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
638 ERR_print_errors(bio_err);
639 */
640 ERR_clear_error();
641 }
642 else
643 {
644 OBJ_create_objects(oid_bio);
645 BIO_free(oid_bio);
646 }
647 }
648 if (!add_oid_section(bio_err,conf))
649 {
650 ERR_print_errors(bio_err);
651 goto err;
652 }
653 }
654
655 randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
656 if (randfile == NULL)
657 ERR_clear_error();
658 app_RAND_load_file(randfile, bio_err, 0);
659
660 f = NCONF_get_string(conf, section, STRING_MASK);
661 if (!f)
662 ERR_clear_error();
663
664 if(f && !ASN1_STRING_set_default_mask_asc(f)) {
665 BIO_printf(bio_err, "Invalid global string mask setting %s\n", f);
666 goto err;
667 }
668
669 if (chtype != MBSTRING_UTF8){
670 f = NCONF_get_string(conf, section, UTF8_IN);
671 if (!f)
672 ERR_clear_error();
673 else if (!strcmp(f, "yes"))
674 chtype = MBSTRING_UTF8;
675 }
676
677 db_attr.unique_subject = 1;
678 p = NCONF_get_string(conf, section, ENV_UNIQUE_SUBJECT);
679 if (p)
680 {
681 #ifdef RL_DEBUG
682 BIO_printf(bio_err, "DEBUG: unique_subject = \"%s\"\n", p);
683 #endif
684 db_attr.unique_subject = parse_yesno(p,1);
685 }
686 else
687 ERR_clear_error();
688 #ifdef RL_DEBUG
689 if (!p)
690 BIO_printf(bio_err, "DEBUG: unique_subject undefined\n", p);
691 #endif
692 #ifdef RL_DEBUG
693 BIO_printf(bio_err, "DEBUG: configured unique_subject is %d\n",
694 db_attr.unique_subject);
695 #endif
696
697 in=BIO_new(BIO_s_file());
698 out=BIO_new(BIO_s_file());
699 Sout=BIO_new(BIO_s_file());
700 Cout=BIO_new(BIO_s_file());
701 if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
702 {
703 ERR_print_errors(bio_err);
704 goto err;
705 }
706
707 /*****************************************************************/
708 /* report status of cert with serial number given on command line */
709 if (ser_status)
710 {
711 if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
712 {
713 lookup_fail(section,ENV_DATABASE);
714 goto err;
715 }
716 db = load_index(dbfile,&db_attr);
717 if (db == NULL) goto err;
718
719 if (!index_index(db)) goto err;
720
721 if (get_certificate_status(ser_status,db) != 1)
722 BIO_printf(bio_err,"Error verifying serial %s!\n",
723 ser_status);
724 goto err;
725 }
726
727 /*****************************************************************/
728 /* we definitely need a private key, so let's get it */
729
730 if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
731 section,ENV_PRIVATE_KEY)) == NULL))
732 {
733 lookup_fail(section,ENV_PRIVATE_KEY);
734 goto err;
735 }
736 if (!key)
737 {
738 free_key = 1;
739 if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
740 {
741 BIO_printf(bio_err,"Error getting password\n");
742 goto err;
743 }
744 }
745 pkey = load_key(bio_err, keyfile, keyform, 0, key, e,
746 "CA private key");
747 if (key) OPENSSL_cleanse(key,strlen(key));
748 if (pkey == NULL)
749 {
750 /* load_key() has already printed an appropriate message */
751 goto err;
752 }
753
754 /*****************************************************************/
755 /* we need a certificate */
756 if (!selfsign || spkac_file || ss_cert_file || gencrl)
757 {
758 if ((certfile == NULL)
759 && ((certfile=NCONF_get_string(conf,
760 section,ENV_CERTIFICATE)) == NULL))
761 {
762 lookup_fail(section,ENV_CERTIFICATE);
763 goto err;
764 }
765 x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
766 "CA certificate");
767 if (x509 == NULL)
768 goto err;
769
770 if (!X509_check_private_key(x509,pkey))
771 {
772 BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
773 goto err;
774 }
775 }
776 if (!selfsign) x509p = x509;
777
778 f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
779 if (f == NULL)
780 ERR_clear_error();
781 if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
782 preserve=1;
783 f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
784 if (f == NULL)
785 ERR_clear_error();
786 if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
787 msie_hack=1;
788
789 f=NCONF_get_string(conf,section,ENV_NAMEOPT);
790
791 if (f)
792 {
793 if (!set_name_ex(&nameopt, f))
794 {
795 BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
796 goto err;
797 }
798 default_op = 0;
799 }
800 else
801 ERR_clear_error();
802
803 f=NCONF_get_string(conf,section,ENV_CERTOPT);
804
805 if (f)
806 {
807 if (!set_cert_ex(&certopt, f))
808 {
809 BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
810 goto err;
811 }
812 default_op = 0;
813 }
814 else
815 ERR_clear_error();
816
817 f=NCONF_get_string(conf,section,ENV_EXTCOPY);
818
819 if (f)
820 {
821 if (!set_ext_copy(&ext_copy, f))
822 {
823 BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
824 goto err;
825 }
826 }
827 else
828 ERR_clear_error();
829
830 /*****************************************************************/
831 /* lookup where to write new certificates */
832 if ((outdir == NULL) && (req))
833 {
834
835 if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
836 == NULL)
837 {
838 BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
839 goto err;
840 }
841 #ifndef OPENSSL_SYS_VMS
842 /* outdir is a directory spec, but access() for VMS demands a
843 filename. In any case, stat(), below, will catch the problem
844 if outdir is not a directory spec, and the fopen() or open()
845 will catch an error if there is no write access.
846
847 Presumably, this problem could also be solved by using the DEC
848 C routines to convert the directory syntax to Unixly, and give
849 that to access(). However, time's too short to do that just
850 now.
851 */
852 if (access(outdir,R_OK|W_OK|X_OK) != 0)
853 {
854 BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
855 perror(outdir);
856 goto err;
857 }
858
859 if (app_isdir(outdir)<=0)
860 {
861 BIO_printf(bio_err,"%s need to be a directory\n",outdir);
862 perror(outdir);
863 goto err;
864 }
865 #endif
866 }
867
868 /*****************************************************************/
869 /* we need to load the database file */
870 if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
871 {
872 lookup_fail(section,ENV_DATABASE);
873 goto err;
874 }
875 db = load_index(dbfile, &db_attr);
876 if (db == NULL) goto err;
877
878 /* Lets check some fields */
879 for (i=0; i<sk_num(db->db->data); i++)
880 {
881 pp=(const char **)sk_value(db->db->data,i);
882 if ((pp[DB_type][0] != DB_TYPE_REV) &&
883 (pp[DB_rev_date][0] != '\0'))
884 {
885 BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
886 goto err;
887 }
888 if ((pp[DB_type][0] == DB_TYPE_REV) &&
889 !make_revoked(NULL, pp[DB_rev_date]))
890 {
891 BIO_printf(bio_err," in entry %d\n", i+1);
892 goto err;
893 }
894 if (!check_time_format((char *)pp[DB_exp_date]))
895 {
896 BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
897 goto err;
898 }
899 p=pp[DB_serial];
900 j=strlen(p);
901 if (*p == '-')
902 {
903 p++;
904 j--;
905 }
906 if ((j&1) || (j < 2))
907 {
908 BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
909 goto err;
910 }
911 while (*p)
912 {
913 if (!( ((*p >= '0') && (*p <= '9')) ||
914 ((*p >= 'A') && (*p <= 'F')) ||
915 ((*p >= 'a') && (*p <= 'f'))) )
916 {
917 BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
918 goto err;
919 }
920 p++;
921 }
922 }
923 if (verbose)
924 {
925 BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
926 #ifdef OPENSSL_SYS_VMS
927 {
928 BIO *tmpbio = BIO_new(BIO_f_linebuffer());
929 out = BIO_push(tmpbio, out);
930 }
931 #endif
932 TXT_DB_write(out,db->db);
933 BIO_printf(bio_err,"%d entries loaded from the database\n",
934 db->db->data->num);
935 BIO_printf(bio_err,"generating index\n");
936 }
937
938 if (!index_index(db)) goto err;
939
940 /*****************************************************************/
941 /* Update the db file for expired certificates */
942 if (doupdatedb)
943 {
944 if (verbose)
945 BIO_printf(bio_err, "Updating %s ...\n",
946 dbfile);
947
948 i = do_updatedb(db);
949 if (i == -1)
950 {
951 BIO_printf(bio_err,"Malloc failure\n");
952 goto err;
953 }
954 else if (i == 0)
955 {
956 if (verbose) BIO_printf(bio_err,
957 "No entries found to mark expired\n");
958 }
959 else
960 {
961 if (!save_index(dbfile,"new",db)) goto err;
962
963 if (!rotate_index(dbfile,"new","old")) goto err;
964
965 if (verbose) BIO_printf(bio_err,
966 "Done. %d entries marked as expired\n",i);
967 }
968 }
969
970 /*****************************************************************/
971 /* Read extentions config file */
972 if (extfile)
973 {
974 extconf = NCONF_new(NULL);
975 if (NCONF_load(extconf,extfile,&errorline) <= 0)
976 {
977 if (errorline <= 0)
978 BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
979 extfile);
980 else
981 BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
982 errorline,extfile);
983 ret = 1;
984 goto err;
985 }
986
987 if (verbose)
988 BIO_printf(bio_err, "Successfully loaded extensions file %s\n", extfile);
989
990 /* We can have sections in the ext file */
991 if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
992 extensions = "default";
993 }
994
995 /*****************************************************************/
996 if (req || gencrl)
997 {
998 if (outfile != NULL)
999 {
1000 if (BIO_write_filename(Sout,outfile) <= 0)
1001 {
1002 perror(outfile);
1003 goto err;
1004 }
1005 }
1006 else
1007 {
1008 BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
1009 #ifdef OPENSSL_SYS_VMS
1010 {
1011 BIO *tmpbio = BIO_new(BIO_f_linebuffer());
1012 Sout = BIO_push(tmpbio, Sout);
1013 }
1014 #endif
1015 }
1016 }
1017
1018 if ((md == NULL) && ((md=NCONF_get_string(conf,
1019 section,ENV_DEFAULT_MD)) == NULL))
1020 {
1021 lookup_fail(section,ENV_DEFAULT_MD);
1022 goto err;
1023 }
1024
1025 if (!strcmp(md, "default"))
1026 {
1027 int def_nid;
1028 if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0)
1029 {
1030 BIO_puts(bio_err,"no default digest\n");
1031 goto err;
1032 }
1033 md = (char *)OBJ_nid2sn(def_nid);
1034 }
1035
1036 if ((dgst=EVP_get_digestbyname(md)) == NULL)
1037 {
1038 BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1039 goto err;
1040 }
1041
1042 if (req)
1043 {
1044 if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
1045 section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
1046 {
1047 if(strcmp(tmp_email_dn,"no") == 0)
1048 email_dn=0;
1049 }
1050 if (verbose)
1051 BIO_printf(bio_err,"message digest is %s\n",
1052 OBJ_nid2ln(dgst->type));
1053 if ((policy == NULL) && ((policy=NCONF_get_string(conf,
1054 section,ENV_POLICY)) == NULL))
1055 {
1056 lookup_fail(section,ENV_POLICY);
1057 goto err;
1058 }
1059 if (verbose)
1060 BIO_printf(bio_err,"policy is %s\n",policy);
1061
1062 if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
1063 == NULL)
1064 {
1065 lookup_fail(section,ENV_SERIAL);
1066 goto err;
1067 }
1068
1069 if (!extconf)
1070 {
1071 /* no '-extfile' option, so we look for extensions
1072 * in the main configuration file */
1073 if (!extensions)
1074 {
1075 extensions=NCONF_get_string(conf,section,
1076 ENV_EXTENSIONS);
1077 if (!extensions)
1078 ERR_clear_error();
1079 }
1080 if (extensions)
1081 {
1082 /* Check syntax of file */
1083 X509V3_CTX ctx;
1084 X509V3_set_ctx_test(&ctx);
1085 X509V3_set_nconf(&ctx, conf);
1086 if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
1087 NULL))
1088 {
1089 BIO_printf(bio_err,
1090 "Error Loading extension section %s\n",
1091 extensions);
1092 ret = 1;
1093 goto err;
1094 }
1095 }
1096 }
1097
1098 if (startdate == NULL)
1099 {
1100 startdate=NCONF_get_string(conf,section,
1101 ENV_DEFAULT_STARTDATE);
1102 if (startdate == NULL)
1103 ERR_clear_error();
1104 }
1105 if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))
1106 {
1107 BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");
1108 goto err;
1109 }
1110 if (startdate == NULL) startdate="today";
1111
1112 if (enddate == NULL)
1113 {
1114 enddate=NCONF_get_string(conf,section,
1115 ENV_DEFAULT_ENDDATE);
1116 if (enddate == NULL)
1117 ERR_clear_error();
1118 }
1119 if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))
1120 {
1121 BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");
1122 goto err;
1123 }
1124
1125 if (days == 0)
1126 {
1127 if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
1128 days = 0;
1129 }
1130 if (!enddate && (days == 0))
1131 {
1132 BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
1133 goto err;
1134 }
1135
1136 if ((serial=load_serial(serialfile, create_ser, NULL)) == NULL)
1137 {
1138 BIO_printf(bio_err,"error while loading serial number\n");
1139 goto err;
1140 }
1141 if (verbose)
1142 {
1143 if (BN_is_zero(serial))
1144 BIO_printf(bio_err,"next serial number is 00\n");
1145 else
1146 {
1147 if ((f=BN_bn2hex(serial)) == NULL) goto err;
1148 BIO_printf(bio_err,"next serial number is %s\n",f);
1149 OPENSSL_free(f);
1150 }
1151 }
1152
1153 if ((attribs=NCONF_get_section(conf,policy)) == NULL)
1154 {
1155 BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
1156 goto err;
1157 }
1158
1159 if ((cert_sk=sk_X509_new_null()) == NULL)
1160 {
1161 BIO_printf(bio_err,"Memory allocation failure\n");
1162 goto err;
1163 }
1164 if (spkac_file != NULL)
1165 {
1166 total++;
1167 j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
1168 serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,extensions,
1169 conf,verbose,certopt,nameopt,default_op,ext_copy);
1170 if (j < 0) goto err;
1171 if (j > 0)
1172 {
1173 total_done++;
1174 BIO_printf(bio_err,"\n");
1175 if (!BN_add_word(serial,1)) goto err;
1176 if (!sk_X509_push(cert_sk,x))
1177 {
1178 BIO_printf(bio_err,"Memory allocation failure\n");
1179 goto err;
1180 }
1181 if (outfile)
1182 {
1183 output_der = 1;
1184 batch = 1;
1185 }
1186 }
1187 }
1188 if (ss_cert_file != NULL)
1189 {
1190 total++;
1191 j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
1192 db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
1193 extensions,conf,verbose, certopt, nameopt,
1194 default_op, ext_copy, e);
1195 if (j < 0) goto err;
1196 if (j > 0)
1197 {
1198 total_done++;
1199 BIO_printf(bio_err,"\n");
1200 if (!BN_add_word(serial,1)) goto err;
1201 if (!sk_X509_push(cert_sk,x))
1202 {
1203 BIO_printf(bio_err,"Memory allocation failure\n");
1204 goto err;
1205 }
1206 }
1207 }
1208 if (infile != NULL)
1209 {
1210 total++;
1211 j=certify(&x,infile,pkey,x509p,dgst,attribs,db,
1212 serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
1213 extensions,conf,verbose, certopt, nameopt,
1214 default_op, ext_copy, selfsign);
1215 if (j < 0) goto err;
1216 if (j > 0)
1217 {
1218 total_done++;
1219 BIO_printf(bio_err,"\n");
1220 if (!BN_add_word(serial,1)) goto err;
1221 if (!sk_X509_push(cert_sk,x))
1222 {
1223 BIO_printf(bio_err,"Memory allocation failure\n");
1224 goto err;
1225 }
1226 }
1227 }
1228 for (i=0; i<argc; i++)
1229 {
1230 total++;
1231 j=certify(&x,argv[i],pkey,x509p,dgst,attribs,db,
1232 serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
1233 extensions,conf,verbose, certopt, nameopt,
1234 default_op, ext_copy, selfsign);
1235 if (j < 0) goto err;
1236 if (j > 0)
1237 {
1238 total_done++;
1239 BIO_printf(bio_err,"\n");
1240 if (!BN_add_word(serial,1)) goto err;
1241 if (!sk_X509_push(cert_sk,x))
1242 {
1243 BIO_printf(bio_err,"Memory allocation failure\n");
1244 goto err;
1245 }
1246 }
1247 }
1248 /* we have a stack of newly certified certificates
1249 * and a data base and serial number that need
1250 * updating */
1251
1252 if (sk_X509_num(cert_sk) > 0)
1253 {
1254 if (!batch)
1255 {
1256 BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
1257 (void)BIO_flush(bio_err);
1258 buf[0][0]='\0';
1259 fgets(buf[0],10,stdin);
1260 if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
1261 {
1262 BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
1263 ret=0;
1264 goto err;
1265 }
1266 }
1267
1268 BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
1269
1270 if (!save_serial(serialfile,"new",serial,NULL)) goto err;
1271
1272 if (!save_index(dbfile, "new", db)) goto err;
1273 }
1274
1275 if (verbose)
1276 BIO_printf(bio_err,"writing new certificates\n");
1277 for (i=0; i<sk_X509_num(cert_sk); i++)
1278 {
1279 int k;
1280 char *n;
1281
1282 x=sk_X509_value(cert_sk,i);
1283
1284 j=x->cert_info->serialNumber->length;
1285 p=(const char *)x->cert_info->serialNumber->data;
1286
1287 if(strlen(outdir) >= (size_t)(j ? BSIZE-j*2-6 : BSIZE-8))
1288 {
1289 BIO_printf(bio_err,"certificate file name too long\n");
1290 goto err;
1291 }
1292
1293 strcpy(buf[2],outdir);
1294
1295 #ifndef OPENSSL_SYS_VMS
1296 BUF_strlcat(buf[2],"/",sizeof(buf[2]));
1297 #endif
1298
1299 n=(char *)&(buf[2][strlen(buf[2])]);
1300 if (j > 0)
1301 {
1302 for (k=0; k<j; k++)
1303 {
1304 if (n >= &(buf[2][sizeof(buf[2])]))
1305 break;
1306 BIO_snprintf(n,
1307 &buf[2][0] + sizeof(buf[2]) - n,
1308 "%02X",(unsigned char)*(p++));
1309 n+=2;
1310 }
1311 }
1312 else
1313 {
1314 *(n++)='0';
1315 *(n++)='0';
1316 }
1317 *(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
1318 *n='\0';
1319 if (verbose)
1320 BIO_printf(bio_err,"writing %s\n",buf[2]);
1321
1322 if (BIO_write_filename(Cout,buf[2]) <= 0)
1323 {
1324 perror(buf[2]);
1325 goto err;
1326 }
1327 write_new_certificate(Cout,x, 0, notext);
1328 write_new_certificate(Sout,x, output_der, notext);
1329 }
1330
1331 if (sk_X509_num(cert_sk))
1332 {
1333 /* Rename the database and the serial file */
1334 if (!rotate_serial(serialfile,"new","old")) goto err;
1335
1336 if (!rotate_index(dbfile,"new","old")) goto err;
1337
1338 BIO_printf(bio_err,"Data Base Updated\n");
1339 }
1340 }
1341
1342 /*****************************************************************/
1343 if (gencrl)
1344 {
1345 int crl_v2 = 0;
1346 if (!crl_ext)
1347 {
1348 crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
1349 if (!crl_ext)
1350 ERR_clear_error();
1351 }
1352 if (crl_ext)
1353 {
1354 /* Check syntax of file */
1355 X509V3_CTX ctx;
1356 X509V3_set_ctx_test(&ctx);
1357 X509V3_set_nconf(&ctx, conf);
1358 if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
1359 {
1360 BIO_printf(bio_err,
1361 "Error Loading CRL extension section %s\n",
1362 crl_ext);
1363 ret = 1;
1364 goto err;
1365 }
1366 }
1367
1368 if ((crlnumberfile=NCONF_get_string(conf,section,ENV_CRLNUMBER))
1369 != NULL)
1370 if ((crlnumber=load_serial(crlnumberfile,0,NULL)) == NULL)
1371 {
1372 BIO_printf(bio_err,"error while loading CRL number\n");
1373 goto err;
1374 }
1375
1376 if (!crldays && !crlhours && !crlsec)
1377 {
1378 if (!NCONF_get_number(conf,section,
1379 ENV_DEFAULT_CRL_DAYS, &crldays))
1380 crldays = 0;
1381 if (!NCONF_get_number(conf,section,
1382 ENV_DEFAULT_CRL_HOURS, &crlhours))
1383 crlhours = 0;
1384 }
1385 if ((crldays == 0) && (crlhours == 0) && (crlsec == 0))
1386 {
1387 BIO_printf(bio_err,"cannot lookup how long until the next CRL is issued\n");
1388 goto err;
1389 }
1390
1391 if (verbose) BIO_printf(bio_err,"making CRL\n");
1392 if ((crl=X509_CRL_new()) == NULL) goto err;
1393 if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509))) goto err;
1394
1395 tmptm = ASN1_TIME_new();
1396 if (!tmptm) goto err;
1397 X509_gmtime_adj(tmptm,0);
1398 X509_CRL_set_lastUpdate(crl, tmptm);
1399 X509_gmtime_adj(tmptm,(crldays*24+crlhours)*60*60 + crlsec);
1400 X509_CRL_set_nextUpdate(crl, tmptm);
1401
1402 ASN1_TIME_free(tmptm);
1403
1404 for (i=0; i<sk_num(db->db->data); i++)
1405 {
1406 pp=(const char **)sk_value(db->db->data,i);
1407 if (pp[DB_type][0] == DB_TYPE_REV)
1408 {
1409 if ((r=X509_REVOKED_new()) == NULL) goto err;
1410 j = make_revoked(r, pp[DB_rev_date]);
1411 if (!j) goto err;
1412 if (j == 2) crl_v2 = 1;
1413 if (!BN_hex2bn(&serial, pp[DB_serial]))
1414 goto err;
1415 tmpser = BN_to_ASN1_INTEGER(serial, NULL);
1416 BN_free(serial);
1417 serial = NULL;
1418 if (!tmpser)
1419 goto err;
1420 X509_REVOKED_set_serialNumber(r, tmpser);
1421 ASN1_INTEGER_free(tmpser);
1422 X509_CRL_add0_revoked(crl,r);
1423 }
1424 }
1425
1426 /* sort the data so it will be written in serial
1427 * number order */
1428 X509_CRL_sort(crl);
1429
1430 /* we now have a CRL */
1431 if (verbose) BIO_printf(bio_err,"signing CRL\n");
1432
1433 /* Add any extensions asked for */
1434
1435 if (crl_ext || crlnumberfile != NULL)
1436 {
1437 X509V3_CTX crlctx;
1438 X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
1439 X509V3_set_nconf(&crlctx, conf);
1440
1441 if (crl_ext)
1442 if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
1443 crl_ext, crl)) goto err;
1444 if (crlnumberfile != NULL)
1445 {
1446 tmpser = BN_to_ASN1_INTEGER(crlnumber, NULL);
1447 if (!tmpser) goto err;
1448 X509_CRL_add1_ext_i2d(crl,NID_crl_number,tmpser,0,0);
1449 ASN1_INTEGER_free(tmpser);
1450 crl_v2 = 1;
1451 if (!BN_add_word(crlnumber,1)) goto err;
1452 }
1453 }
1454 if (crl_ext || crl_v2)
1455 {
1456 if (!X509_CRL_set_version(crl, 1))
1457 goto err; /* version 2 CRL */
1458 }
1459
1460
1461 if (crlnumberfile != NULL) /* we have a CRL number that need updating */
1462 if (!save_serial(crlnumberfile,"new",crlnumber,NULL)) goto err;
1463
1464 if (crlnumber)
1465 {
1466 BN_free(crlnumber);
1467 crlnumber = NULL;
1468 }
1469
1470 if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
1471
1472 PEM_write_bio_X509_CRL(Sout,crl);
1473
1474 if (crlnumberfile != NULL) /* Rename the crlnumber file */
1475 if (!rotate_serial(crlnumberfile,"new","old")) goto err;
1476
1477 }
1478 /*****************************************************************/
1479 if (dorevoke)
1480 {
1481 if (infile == NULL)
1482 {
1483 BIO_printf(bio_err,"no input files\n");
1484 goto err;
1485 }
1486 else
1487 {
1488 X509 *revcert;
1489 revcert=load_cert(bio_err, infile, FORMAT_PEM,
1490 NULL, e, infile);
1491 if (revcert == NULL)
1492 goto err;
1493 j=do_revoke(revcert,db, rev_type, rev_arg);
1494 if (j <= 0) goto err;
1495 X509_free(revcert);
1496
1497 if (!save_index(dbfile, "new", db)) goto err;
1498
1499 if (!rotate_index(dbfile, "new", "old")) goto err;
1500
1501 BIO_printf(bio_err,"Data Base Updated\n");
1502 }
1503 }
1504 /*****************************************************************/
1505 ret=0;
1506 err:
1507 if(tofree)
1508 OPENSSL_free(tofree);
1509 BIO_free_all(Cout);
1510 BIO_free_all(Sout);
1511 BIO_free_all(out);
1512 BIO_free_all(in);
1513
1514 if (cert_sk)
1515 sk_X509_pop_free(cert_sk,X509_free);
1516
1517 if (ret) ERR_print_errors(bio_err);
1518 app_RAND_write_file(randfile, bio_err);
1519 if (free_key && key)
1520 OPENSSL_free(key);
1521 BN_free(serial);
1522 BN_free(crlnumber);
1523 free_index(db);
1524 EVP_PKEY_free(pkey);
1525 if (x509) X509_free(x509);
1526 X509_CRL_free(crl);
1527 NCONF_free(conf);
1528 NCONF_free(extconf);
1529 OBJ_cleanup();
1530 apps_shutdown();
1531 OPENSSL_EXIT(ret);
1532 }
1533
1534 static void lookup_fail(const char *name, const char *tag)
1535 {
1536 BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
1537 }
1538
1539 static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1540 const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
1541 BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
1542 long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1543 unsigned long certopt, unsigned long nameopt, int default_op,
1544 int ext_copy, int selfsign)
1545 {
1546 X509_REQ *req=NULL;
1547 BIO *in=NULL;
1548 EVP_PKEY *pktmp=NULL;
1549 int ok= -1,i;
1550
1551 in=BIO_new(BIO_s_file());
1552
1553 if (BIO_read_filename(in,infile) <= 0)
1554 {
1555 perror(infile);
1556 goto err;
1557 }
1558 if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
1559 {
1560 BIO_printf(bio_err,"Error reading certificate request in %s\n",
1561 infile);
1562 goto err;
1563 }
1564 if (verbose)
1565 X509_REQ_print(bio_err,req);
1566
1567 BIO_printf(bio_err,"Check that the request matches the signature\n");
1568
1569 if (selfsign && !X509_REQ_check_private_key(req,pkey))
1570 {
1571 BIO_printf(bio_err,"Certificate request and CA private key do not match\n");
1572 ok=0;
1573 goto err;
1574 }
1575 if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
1576 {
1577 BIO_printf(bio_err,"error unpacking public key\n");
1578 goto err;
1579 }
1580 i=X509_REQ_verify(req,pktmp);
1581 EVP_PKEY_free(pktmp);
1582 if (i < 0)
1583 {
1584 ok=0;
1585 BIO_printf(bio_err,"Signature verification problems....\n");
1586 goto err;
1587 }
1588 if (i == 0)
1589 {
1590 ok=0;
1591 BIO_printf(bio_err,"Signature did not match the certificate request\n");
1592 goto err;
1593 }
1594 else
1595 BIO_printf(bio_err,"Signature ok\n");
1596
1597 ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn, email_dn,
1598 startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
1599 certopt, nameopt, default_op, ext_copy, selfsign);
1600
1601 err:
1602 if (req != NULL) X509_REQ_free(req);
1603 if (in != NULL) BIO_free(in);
1604 return(ok);
1605 }
1606
1607 static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1608 const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
1609 BIGNUM *serial, char *subj, unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
1610 long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1611 unsigned long certopt, unsigned long nameopt, int default_op,
1612 int ext_copy, ENGINE *e)
1613 {
1614 X509 *req=NULL;
1615 X509_REQ *rreq=NULL;
1616 EVP_PKEY *pktmp=NULL;
1617 int ok= -1,i;
1618
1619 if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
1620 goto err;
1621 if (verbose)
1622 X509_print(bio_err,req);
1623
1624 BIO_printf(bio_err,"Check that the request matches the signature\n");
1625
1626 if ((pktmp=X509_get_pubkey(req)) == NULL)
1627 {
1628 BIO_printf(bio_err,"error unpacking public key\n");
1629 goto err;
1630 }
1631 i=X509_verify(req,pktmp);
1632 EVP_PKEY_free(pktmp);
1633 if (i < 0)
1634 {
1635 ok=0;
1636 BIO_printf(bio_err,"Signature verification problems....\n");
1637 goto err;
1638 }
1639 if (i == 0)
1640 {
1641 ok=0;
1642 BIO_printf(bio_err,"Signature did not match the certificate\n");
1643 goto err;
1644 }
1645 else
1646 BIO_printf(bio_err,"Signature ok\n");
1647
1648 if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
1649 goto err;
1650
1651 ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
1652 days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
1653 ext_copy, 0);
1654
1655 err:
1656 if (rreq != NULL) X509_REQ_free(rreq);
1657 if (req != NULL) X509_free(req);
1658 return(ok);
1659 }
1660
1661 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
1662 STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
1663 unsigned long chtype, int multirdn,
1664 int email_dn, char *startdate, char *enddate, long days, int batch,
1665 int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
1666 unsigned long certopt, unsigned long nameopt, int default_op,
1667 int ext_copy, int selfsign)
1668 {
1669 X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
1670 ASN1_UTCTIME *tm,*tmptm;
1671 ASN1_STRING *str,*str2;
1672 ASN1_OBJECT *obj;
1673 X509 *ret=NULL;
1674 X509_CINF *ci;
1675 X509_NAME_ENTRY *ne;
1676 X509_NAME_ENTRY *tne,*push;
1677 EVP_PKEY *pktmp;
1678 int ok= -1,i,j,last,nid;
1679 const char *p;
1680 CONF_VALUE *cv;
1681 STRING row[DB_NUMBER];
1682 STRING *irow=NULL;
1683 STRING *rrow=NULL;
1684 char buf[25];
1685
1686 tmptm=ASN1_UTCTIME_new();
1687 if (tmptm == NULL)
1688 {
1689 BIO_printf(bio_err,"malloc error\n");
1690 return(0);
1691 }
1692
1693 for (i=0; i<DB_NUMBER; i++)
1694 row[i]=NULL;
1695
1696 if (subj)
1697 {
1698 X509_NAME *n = parse_name(subj, chtype, multirdn);
1699
1700 if (!n)
1701 {
1702 ERR_print_errors(bio_err);
1703 goto err;
1704 }
1705 X509_REQ_set_subject_name(req,n);
1706 req->req_info->enc.modified = 1;
1707 X509_NAME_free(n);
1708 }
1709
1710 if (default_op)
1711 BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
1712
1713 name=X509_REQ_get_subject_name(req);
1714 for (i=0; i<X509_NAME_entry_count(name); i++)
1715 {
1716 ne= X509_NAME_get_entry(name,i);
1717 str=X509_NAME_ENTRY_get_data(ne);
1718 obj=X509_NAME_ENTRY_get_object(ne);
1719
1720 if (msie_hack)
1721 {
1722 /* assume all type should be strings */
1723 nid=OBJ_obj2nid(ne->object);
1724
1725 if (str->type == V_ASN1_UNIVERSALSTRING)
1726 ASN1_UNIVERSALSTRING_to_string(str);
1727
1728 if ((str->type == V_ASN1_IA5STRING) &&
1729 (nid != NID_pkcs9_emailAddress))
1730 str->type=V_ASN1_T61STRING;
1731
1732 if ((nid == NID_pkcs9_emailAddress) &&
1733 (str->type == V_ASN1_PRINTABLESTRING))
1734 str->type=V_ASN1_IA5STRING;
1735 }
1736
1737 /* If no EMAIL is wanted in the subject */
1738 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
1739 continue;
1740
1741 /* check some things */
1742 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
1743 (str->type != V_ASN1_IA5STRING))
1744 {
1745 BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
1746 goto err;
1747 }
1748 if ((str->type != V_ASN1_BMPSTRING) && (str->type != V_ASN1_UTF8STRING))
1749 {
1750 j=ASN1_PRINTABLE_type(str->data,str->length);
1751 if ( ((j == V_ASN1_T61STRING) &&
1752 (str->type != V_ASN1_T61STRING)) ||
1753 ((j == V_ASN1_IA5STRING) &&
1754 (str->type == V_ASN1_PRINTABLESTRING)))
1755 {
1756 BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
1757 goto err;
1758 }
1759 }
1760
1761 if (default_op)
1762 old_entry_print(bio_err, obj, str);
1763 }
1764
1765 /* Ok, now we check the 'policy' stuff. */
1766 if ((subject=X509_NAME_new()) == NULL)
1767 {
1768 BIO_printf(bio_err,"Memory allocation failure\n");
1769 goto err;
1770 }
1771
1772 /* take a copy of the issuer name before we mess with it. */
1773 if (selfsign)
1774 CAname=X509_NAME_dup(name);
1775 else
1776 CAname=X509_NAME_dup(x509->cert_info->subject);
1777 if (CAname == NULL) goto err;
1778 str=str2=NULL;
1779
1780 for (i=0; i<sk_CONF_VALUE_num(policy); i++)
1781 {
1782 cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
1783 if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
1784 {
1785 BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
1786 goto err;
1787 }
1788 obj=OBJ_nid2obj(j);
1789
1790 last= -1;
1791 for (;;)
1792 {
1793 /* lookup the object in the supplied name list */
1794 j=X509_NAME_get_index_by_OBJ(name,obj,last);
1795 if (j < 0)
1796 {
1797 if (last != -1) break;
1798 tne=NULL;
1799 }
1800 else
1801 {
1802 tne=X509_NAME_get_entry(name,j);
1803 }
1804 last=j;
1805
1806 /* depending on the 'policy', decide what to do. */
1807 push=NULL;
1808 if (strcmp(cv->value,"optional") == 0)
1809 {
1810 if (tne != NULL)
1811 push=tne;
1812 }
1813 else if (strcmp(cv->value,"supplied") == 0)
1814 {
1815 if (tne == NULL)
1816 {
1817 BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
1818 goto err;
1819 }
1820 else
1821 push=tne;
1822 }
1823 else if (strcmp(cv->value,"match") == 0)
1824 {
1825 int last2;
1826
1827 if (tne == NULL)
1828 {
1829 BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
1830 goto err;
1831 }
1832
1833 last2= -1;
1834
1835 again2:
1836 j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
1837 if ((j < 0) && (last2 == -1))
1838 {
1839 BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
1840 goto err;
1841 }
1842 if (j >= 0)
1843 {
1844 push=X509_NAME_get_entry(CAname,j);
1845 str=X509_NAME_ENTRY_get_data(tne);
1846 str2=X509_NAME_ENTRY_get_data(push);
1847 last2=j;
1848 if (ASN1_STRING_cmp(str,str2) != 0)
1849 goto again2;
1850 }
1851 if (j < 0)
1852 {
1853 BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
1854 goto err;
1855 }
1856 }
1857 else
1858 {
1859 BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
1860 goto err;
1861 }
1862
1863 if (push != NULL)
1864 {
1865 if (!X509_NAME_add_entry(subject,push, -1, 0))
1866 {
1867 if (push != NULL)
1868 X509_NAME_ENTRY_free(push);
1869 BIO_printf(bio_err,"Memory allocation failure\n");
1870 goto err;
1871 }
1872 }
1873 if (j < 0) break;
1874 }
1875 }
1876
1877 if (preserve)
1878 {
1879 X509_NAME_free(subject);
1880 /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
1881 subject=X509_NAME_dup(name);
1882 if (subject == NULL) goto err;
1883 }
1884
1885 if (verbose)
1886 BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
1887
1888 /* Build the correct Subject if no e-mail is wanted in the subject */
1889 /* and add it later on because of the method extensions are added (altName) */
1890
1891 if (email_dn)
1892 dn_subject = subject;
1893 else
1894 {
1895 X509_NAME_ENTRY *tmpne;
1896 /* Its best to dup the subject DN and then delete any email
1897 * addresses because this retains its structure.
1898 */
1899 if (!(dn_subject = X509_NAME_dup(subject)))
1900 {
1901 BIO_printf(bio_err,"Memory allocation failure\n");
1902 goto err;
1903 }
1904 while((i = X509_NAME_get_index_by_NID(dn_subject,
1905 NID_pkcs9_emailAddress, -1)) >= 0)
1906 {
1907 tmpne = X509_NAME_get_entry(dn_subject, i);
1908 X509_NAME_delete_entry(dn_subject, i);
1909 X509_NAME_ENTRY_free(tmpne);
1910 }
1911 }
1912
1913 if (BN_is_zero(serial))
1914 row[DB_serial]=BUF_strdup("00");
1915 else
1916 row[DB_serial]=BN_bn2hex(serial);
1917 if (row[DB_serial] == NULL)
1918 {
1919 BIO_printf(bio_err,"Memory allocation failure\n");
1920 goto err;
1921 }
1922
1923 if (db->attributes.unique_subject)
1924 {
1925 STRING *crow=row;
1926
1927 rrow=TXT_DB_get_by_index(db->db,DB_name,crow);
1928 if (rrow != NULL)
1929 {
1930 BIO_printf(bio_err,
1931 "ERROR:There is already a certificate for %s\n",
1932 row[DB_name]);
1933 }
1934 }
1935 if (rrow == NULL)
1936 {
1937 rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
1938 if (rrow != NULL)
1939 {
1940 BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
1941 row[DB_serial]);
1942 BIO_printf(bio_err," check the database/serial_file for corruption\n");
1943 }
1944 }
1945
1946 if (rrow != NULL)
1947 {
1948 BIO_printf(bio_err,
1949 "The matching entry has the following details\n");
1950 if (rrow[DB_type][0] == 'E')
1951 p="Expired";
1952 else if (rrow[DB_type][0] == 'R')
1953 p="Revoked";
1954 else if (rrow[DB_type][0] == 'V')
1955 p="Valid";
1956 else
1957 p="\ninvalid type, Data base error\n";
1958 BIO_printf(bio_err,"Type :%s\n",p);;
1959 if (rrow[DB_type][0] == 'R')
1960 {
1961 p=rrow[DB_exp_date]; if (p == NULL) p="undef";
1962 BIO_printf(bio_err,"Was revoked on:%s\n",p);
1963 }
1964 p=rrow[DB_exp_date]; if (p == NULL) p="undef";
1965 BIO_printf(bio_err,"Expires on :%s\n",p);
1966 p=rrow[DB_serial]; if (p == NULL) p="undef";
1967 BIO_printf(bio_err,"Serial Number :%s\n",p);
1968 p=rrow[DB_file]; if (p == NULL) p="undef";
1969 BIO_printf(bio_err,"File name :%s\n",p);
1970 p=rrow[DB_name]; if (p == NULL) p="undef";
1971 BIO_printf(bio_err,"Subject Name :%s\n",p);
1972 ok= -1; /* This is now a 'bad' error. */
1973 goto err;
1974 }
1975
1976 /* We are now totally happy, lets make and sign the certificate */
1977 if (verbose)
1978 BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
1979
1980 if ((ret=X509_new()) == NULL) goto err;
1981 ci=ret->cert_info;
1982
1983 #ifdef X509_V3
1984 /* Make it an X509 v3 certificate. */
1985 if (!X509_set_version(ret,2)) goto err;
1986 #endif
1987
1988 if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
1989 goto err;
1990 if (selfsign)
1991 {
1992 if (!X509_set_issuer_name(ret,subject))
1993 goto err;
1994 }
1995 else
1996 {
1997 if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
1998 goto err;
1999 }
2000
2001 if (strcmp(startdate,"today") == 0)
2002 X509_gmtime_adj(X509_get_notBefore(ret),0);
2003 else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);
2004
2005 if (enddate == NULL)
2006 X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);
2007 else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);
2008
2009 if (!X509_set_subject_name(ret,subject)) goto err;
2010
2011 pktmp=X509_REQ_get_pubkey(req);
2012 i = X509_set_pubkey(ret,pktmp);
2013 EVP_PKEY_free(pktmp);
2014 if (!i) goto err;
2015
2016 /* Lets add the extensions, if there are any */
2017 if (ext_sect)
2018 {
2019 X509V3_CTX ctx;
2020 if (ci->version == NULL)
2021 if ((ci->version=ASN1_INTEGER_new()) == NULL)
2022 goto err;
2023 ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
2024
2025 /* Free the current entries if any, there should not
2026 * be any I believe */
2027 if (ci->extensions != NULL)
2028 sk_X509_EXTENSION_pop_free(ci->extensions,
2029 X509_EXTENSION_free);
2030
2031 ci->extensions = NULL;
2032
2033 /* Initialize the context structure */
2034 if (selfsign)
2035 X509V3_set_ctx(&ctx, ret, ret, req, NULL, 0);
2036 else
2037 X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
2038
2039 if (extconf)
2040 {
2041 if (verbose)
2042 BIO_printf(bio_err, "Extra configuration file found\n");
2043
2044 /* Use the extconf configuration db LHASH */
2045 X509V3_set_nconf(&ctx, extconf);
2046
2047 /* Test the structure (needed?) */
2048 /* X509V3_set_ctx_test(&ctx); */
2049
2050 /* Adds exts contained in the configuration file */
2051 if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
2052 {
2053 BIO_printf(bio_err,
2054 "ERROR: adding extensions in section %s\n",
2055 ext_sect);
2056 ERR_print_errors(bio_err);
2057 goto err;
2058 }
2059 if (verbose)
2060 BIO_printf(bio_err, "Successfully added extensions from file.\n");
2061 }
2062 else if (ext_sect)
2063 {
2064 /* We found extensions to be set from config file */
2065 X509V3_set_nconf(&ctx, lconf);
2066
2067 if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
2068 {
2069 BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
2070 ERR_print_errors(bio_err);
2071 goto err;
2072 }
2073
2074 if (verbose)
2075 BIO_printf(bio_err, "Successfully added extensions from config\n");
2076 }
2077 }
2078
2079 /* Copy extensions from request (if any) */
2080
2081 if (!copy_extensions(ret, req, ext_copy))
2082 {
2083 BIO_printf(bio_err, "ERROR: adding extensions from request\n");
2084 ERR_print_errors(bio_err);
2085 goto err;
2086 }
2087
2088 /* Set the right value for the noemailDN option */
2089 if( email_dn == 0 )
2090 {
2091 if (!X509_set_subject_name(ret,dn_subject)) goto err;
2092 }
2093
2094 if (!default_op)
2095 {
2096 BIO_printf(bio_err, "Certificate Details:\n");
2097 /* Never print signature details because signature not present */
2098 certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
2099 X509_print_ex(bio_err, ret, nameopt, certopt);
2100 }
2101
2102 BIO_printf(bio_err,"Certificate is to be certified until ");
2103 ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
2104 if (days) BIO_printf(bio_err," (%ld days)",days);
2105 BIO_printf(bio_err, "\n");
2106
2107 if (!batch)
2108 {
2109
2110 BIO_printf(bio_err,"Sign the certificate? [y/n]:");
2111 (void)BIO_flush(bio_err);
2112 buf[0]='\0';
2113 fgets(buf,sizeof(buf)-1,stdin);
2114 if (!((buf[0] == 'y') || (buf[0] == 'Y')))
2115 {
2116 BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
2117 ok=0;
2118 goto err;
2119 }
2120 }
2121
2122 pktmp=X509_get_pubkey(ret);
2123 if (EVP_PKEY_missing_parameters(pktmp) &&
2124 !EVP_PKEY_missing_parameters(pkey))
2125 EVP_PKEY_copy_parameters(pktmp,pkey);
2126 EVP_PKEY_free(pktmp);
2127
2128 if (!X509_sign(ret,pkey,dgst))
2129 goto err;
2130
2131 /* We now just add it to the database */
2132 row[DB_type]=(char *)OPENSSL_malloc(2);
2133
2134 tm=X509_get_notAfter(ret);
2135 row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2136 memcpy(row[DB_exp_date],tm->data,tm->length);
2137 row[DB_exp_date][tm->length]='\0';
2138
2139 row[DB_rev_date]=NULL;
2140
2141 /* row[DB_serial] done already */
2142 row[DB_file]=(char *)OPENSSL_malloc(8);
2143 row[DB_name]=X509_NAME_oneline(X509_get_subject_name(ret),NULL,0);
2144
2145 if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2146 (row[DB_file] == NULL) || (row[DB_name] == NULL))
2147 {
2148 BIO_printf(bio_err,"Memory allocation failure\n");
2149 goto err;
2150 }
2151 BUF_strlcpy(row[DB_file],"unknown",8);
2152 row[DB_type][0]='V';
2153 row[DB_type][1]='\0';
2154
2155 if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2156 {
2157 BIO_printf(bio_err,"Memory allocation failure\n");
2158 goto err;
2159 }
2160
2161 for (i=0; i<DB_NUMBER; i++)
2162 {
2163 irow[i]=row[i];
2164 row[i]=NULL;
2165 }
2166 irow[DB_NUMBER]=NULL;
2167
2168 if (!TXT_DB_insert(db->db,irow))
2169 {
2170 BIO_printf(bio_err,"failed to update database\n");
2171 BIO_printf(bio_err,"TXT_DB error number %ld\n",db->db->error);
2172 goto err;
2173 }
2174 ok=1;
2175 err:
2176 for (i=0; i<DB_NUMBER; i++)
2177 if (row[i] != NULL) OPENSSL_free(row[i]);
2178
2179 if (CAname != NULL)
2180 X509_NAME_free(CAname);
2181 if (subject != NULL)
2182 X509_NAME_free(subject);
2183 if ((dn_subject != NULL) && !email_dn)
2184 X509_NAME_free(dn_subject);
2185 if (tmptm != NULL)
2186 ASN1_UTCTIME_free(tmptm);
2187 if (ok <= 0)
2188 {
2189 if (ret != NULL) X509_free(ret);
2190 ret=NULL;
2191 }
2192 else
2193 *xret=ret;
2194 return(ok);
2195 }
2196
2197 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
2198 {
2199
2200 if (output_der)
2201 {
2202 (void)i2d_X509_bio(bp,x);
2203 return;
2204 }
2205 #if 0
2206 /* ??? Not needed since X509_print prints all this stuff anyway */
2207 f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
2208 BIO_printf(bp,"issuer :%s\n",f);
2209
2210 f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
2211 BIO_printf(bp,"subject:%s\n",f);
2212
2213 BIO_puts(bp,"serial :");
2214 i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
2215 BIO_puts(bp,"\n\n");
2216 #endif
2217 if (!notext)X509_print(bp,x);
2218 PEM_write_bio_X509(bp,x);
2219 }
2220
2221 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
2222 const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
2223 BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
2224 long days, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
2225 unsigned long nameopt, int default_op, int ext_copy)
2226 {
2227 STACK_OF(CONF_VALUE) *sk=NULL;
2228 LHASH_OF(CONF_VALUE) *parms=NULL;
2229 X509_REQ *req=NULL;
2230 CONF_VALUE *cv=NULL;
2231 NETSCAPE_SPKI *spki = NULL;
2232 X509_REQ_INFO *ri;
2233 char *type,*buf;
2234 EVP_PKEY *pktmp=NULL;
2235 X509_NAME *n=NULL;
2236 X509_NAME_ENTRY *ne=NULL;
2237 int ok= -1,i,j;
2238 long errline;
2239 int nid;
2240
2241 /*
2242 * Load input file into a hash table. (This is just an easy
2243 * way to read and parse the file, then put it into a convenient
2244 * STACK format).
2245 */
2246 parms=CONF_load(NULL,infile,&errline);
2247 if (parms == NULL)
2248 {
2249 BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
2250 ERR_print_errors(bio_err);
2251 goto err;
2252 }
2253
2254 sk=CONF_get_section(parms, "default");
2255 if (sk_CONF_VALUE_num(sk) == 0)
2256 {
2257 BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
2258 CONF_free(parms);
2259 goto err;
2260 }
2261
2262 /*
2263 * Now create a dummy X509 request structure. We don't actually
2264 * have an X509 request, but we have many of the components
2265 * (a public key, various DN components). The idea is that we
2266 * put these components into the right X509 request structure
2267 * and we can use the same code as if you had a real X509 request.
2268 */
2269 req=X509_REQ_new();
2270 if (req == NULL)
2271 {
2272 ERR_print_errors(bio_err);
2273 goto err;
2274 }
2275
2276 /*
2277 * Build up the subject name set.
2278 */
2279 ri=req->req_info;
2280 n = ri->subject;
2281
2282 for (i = 0; ; i++)
2283 {
2284 if (sk_CONF_VALUE_num(sk) <= i) break;
2285
2286 cv=sk_CONF_VALUE_value(sk,i);
2287 type=cv->name;
2288 /* Skip past any leading X. X: X, etc to allow for
2289 * multiple instances
2290 */
2291 for (buf = cv->name; *buf ; buf++)
2292 if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
2293 {
2294 buf++;
2295 if (*buf) type = buf;
2296 break;
2297 }
2298
2299 buf=cv->value;
2300 if ((nid=OBJ_txt2nid(type)) == NID_undef)
2301 {
2302 if (strcmp(type, "SPKAC") == 0)
2303 {
2304 spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
2305 if (spki == NULL)
2306 {
2307 BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
2308 ERR_print_errors(bio_err);
2309 goto err;
2310 }
2311 }
2312 continue;
2313 }
2314
2315 /*
2316 if ((nid == NID_pkcs9_emailAddress) && (email_dn == 0))
2317 continue;
2318 */
2319
2320 j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
2321 if (fix_data(nid, &j) == 0)
2322 {
2323 BIO_printf(bio_err,
2324 "invalid characters in string %s\n",buf);
2325 goto err;
2326 }
2327
2328 if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
2329 (unsigned char *)buf,
2330 strlen(buf))) == NULL)
2331 goto err;
2332
2333 if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
2334 }
2335 if (spki == NULL)
2336 {
2337 BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
2338 infile);
2339 goto err;
2340 }
2341
2342 /*
2343 * Now extract the key from the SPKI structure.
2344 */
2345
2346 BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
2347
2348 if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
2349 {
2350 BIO_printf(bio_err,"error unpacking SPKAC public key\n");
2351 goto err;
2352 }
2353
2354 j = NETSCAPE_SPKI_verify(spki, pktmp);
2355 if (j <= 0)
2356 {
2357 BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
2358 goto err;
2359 }
2360 BIO_printf(bio_err,"Signature ok\n");
2361
2362 X509_REQ_set_pubkey(req,pktmp);
2363 EVP_PKEY_free(pktmp);
2364 ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
2365 days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
2366 ext_copy, 0);
2367 err:
2368 if (req != NULL) X509_REQ_free(req);
2369 if (parms != NULL) CONF_free(parms);
2370 if (spki != NULL) NETSCAPE_SPKI_free(spki);
2371 if (ne != NULL) X509_NAME_ENTRY_free(ne);
2372
2373 return(ok);
2374 }
2375
2376 static int fix_data(int nid, int *type)
2377 {
2378 if (nid == NID_pkcs9_emailAddress)
2379 *type=V_ASN1_IA5STRING;
2380 if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
2381 *type=V_ASN1_T61STRING;
2382 if ((nid == NID_pkcs9_challengePassword) && (*type == V_ASN1_IA5STRING))
2383 *type=V_ASN1_T61STRING;
2384 if ((nid == NID_pkcs9_unstructuredName) && (*type == V_ASN1_T61STRING))
2385 return(0);
2386 if (nid == NID_pkcs9_unstructuredName)
2387 *type=V_ASN1_IA5STRING;
2388 return(1);
2389 }
2390
2391 static int check_time_format(const char *str)
2392 {
2393 ASN1_UTCTIME tm;
2394
2395 tm.data=(unsigned char *)str;
2396 tm.length=strlen(str);
2397 tm.type=V_ASN1_UTCTIME;
2398 return(ASN1_UTCTIME_check(&tm));
2399 }
2400
2401 static int do_revoke(X509 *x509, CA_DB *db, int type, char *value)
2402 {
2403 ASN1_UTCTIME *tm=NULL;
2404 char *row[DB_NUMBER],**rrow,**irow;
2405 char *rev_str = NULL;
2406 BIGNUM *bn = NULL;
2407 int ok=-1,i;
2408
2409 for (i=0; i<DB_NUMBER; i++)
2410 row[i]=NULL;
2411 row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
2412 bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
2413 if (!bn)
2414 goto err;
2415 if (BN_is_zero(bn))
2416 row[DB_serial]=BUF_strdup("00");
2417 else
2418 row[DB_serial]=BN_bn2hex(bn);
2419 BN_free(bn);
2420 if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2421 {
2422 BIO_printf(bio_err,"Memory allocation failure\n");
2423 goto err;
2424 }
2425 /* We have to lookup by serial number because name lookup
2426 * skips revoked certs
2427 */
2428 rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
2429 if (rrow == NULL)
2430 {
2431 BIO_printf(bio_err,"Adding Entry with serial number %s to DB for %s\n", row[DB_serial], row[DB_name]);
2432
2433 /* We now just add it to the database */
2434 row[DB_type]=(char *)OPENSSL_malloc(2);
2435
2436 tm=X509_get_notAfter(x509);
2437 row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2438 memcpy(row[DB_exp_date],tm->data,tm->length);
2439 row[DB_exp_date][tm->length]='\0';
2440
2441 row[DB_rev_date]=NULL;
2442
2443 /* row[DB_serial] done already */
2444 row[DB_file]=(char *)OPENSSL_malloc(8);
2445
2446 /* row[DB_name] done already */
2447
2448 if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2449 (row[DB_file] == NULL))
2450 {
2451 BIO_printf(bio_err,"Memory allocation failure\n");
2452 goto err;
2453 }
2454 BUF_strlcpy(row[DB_file],"unknown",8);
2455 row[DB_type][0]='V';
2456 row[DB_type][1]='\0';
2457
2458 if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2459 {
2460 BIO_printf(bio_err,"Memory allocation failure\n");
2461 goto err;
2462 }
2463
2464 for (i=0; i<DB_NUMBER; i++)
2465 {
2466 irow[i]=row[i];
2467 row[i]=NULL;
2468 }
2469 irow[DB_NUMBER]=NULL;
2470
2471 if (!TXT_DB_insert(db->db,irow))
2472 {
2473 BIO_printf(bio_err,"failed to update database\n");
2474 BIO_printf(bio_err,"TXT_DB error number %ld\n",db->db->error);
2475 goto err;
2476 }
2477
2478 /* Revoke Certificate */
2479 ok = do_revoke(x509,db, type, value);
2480
2481 goto err;
2482
2483 }
2484 else if (index_name_cmp(row,rrow))
2485 {
2486 BIO_printf(bio_err,"ERROR:name does not match %s\n",
2487 row[DB_name]);
2488 goto err;
2489 }
2490 else if (rrow[DB_type][0]=='R')
2491 {
2492 BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
2493 row[DB_serial]);
2494 goto err;
2495 }
2496 else
2497 {
2498 BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
2499 rev_str = make_revocation_str(type, value);
2500 if (!rev_str)
2501 {
2502 BIO_printf(bio_err, "Error in revocation arguments\n");
2503 goto err;
2504 }
2505 rrow[DB_type][0]='R';
2506 rrow[DB_type][1]='\0';
2507 rrow[DB_rev_date] = rev_str;
2508 }
2509 ok=1;
2510 err:
2511 for (i=0; i<DB_NUMBER; i++)
2512 {
2513 if (row[i] != NULL)
2514 OPENSSL_free(row[i]);
2515 }
2516 return(ok);
2517 }
2518
2519 static int get_certificate_status(const char *serial, CA_DB *db)
2520 {
2521 char *row[DB_NUMBER],**rrow;
2522 int ok=-1,i;
2523
2524 /* Free Resources */
2525 for (i=0; i<DB_NUMBER; i++)
2526 row[i]=NULL;
2527
2528 /* Malloc needed char spaces */
2529 row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
2530 if (row[DB_serial] == NULL)
2531 {
2532 BIO_printf(bio_err,"Malloc failure\n");
2533 goto err;
2534 }
2535
2536 if (strlen(serial) % 2)
2537 {
2538 /* Set the first char to 0 */;
2539 row[DB_serial][0]='0';
2540
2541 /* Copy String from serial to row[DB_serial] */
2542 memcpy(row[DB_serial]+1, serial, strlen(serial));
2543 row[DB_serial][strlen(serial)+1]='\0';
2544 }
2545 else
2546 {
2547 /* Copy String from serial to row[DB_serial] */
2548 memcpy(row[DB_serial], serial, strlen(serial));
2549 row[DB_serial][strlen(serial)]='\0';
2550 }
2551
2552 /* Make it Upper Case */
2553 for (i=0; row[DB_serial][i] != '\0'; i++)
2554 row[DB_serial][i] = toupper(row[DB_serial][i]);
2555
2556
2557 ok=1;
2558
2559 /* Search for the certificate */
2560 rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
2561 if (rrow == NULL)
2562 {
2563 BIO_printf(bio_err,"Serial %s not present in db.\n",
2564 row[DB_serial]);
2565 ok=-1;
2566 goto err;
2567 }
2568 else if (rrow[DB_type][0]=='V')
2569 {
2570 BIO_printf(bio_err,"%s=Valid (%c)\n",
2571 row[DB_serial], rrow[DB_type][0]);
2572 goto err;
2573 }
2574 else if (rrow[DB_type][0]=='R')
2575 {
2576 BIO_printf(bio_err,"%s=Revoked (%c)\n",
2577 row[DB_serial], rrow[DB_type][0]);
2578 goto err;
2579 }
2580 else if (rrow[DB_type][0]=='E')
2581 {
2582 BIO_printf(bio_err,"%s=Expired (%c)\n",
2583 row[DB_serial], rrow[DB_type][0]);
2584 goto err;
2585 }
2586 else if (rrow[DB_type][0]=='S')
2587 {
2588 BIO_printf(bio_err,"%s=Suspended (%c)\n",
2589 row[DB_serial], rrow[DB_type][0]);
2590 goto err;
2591 }
2592 else
2593 {
2594 BIO_printf(bio_err,"%s=Unknown (%c).\n",
2595 row[DB_serial], rrow[DB_type][0]);
2596 ok=-1;
2597 }
2598 err:
2599 for (i=0; i<DB_NUMBER; i++)
2600 {
2601 if (row[i] != NULL)
2602 OPENSSL_free(row[i]);
2603 }
2604 return(ok);
2605 }
2606
2607 static int do_updatedb (CA_DB *db)
2608 {
2609 ASN1_UTCTIME *a_tm = NULL;
2610 int i, cnt = 0;
2611 int db_y2k, a_y2k; /* flags = 1 if y >= 2000 */
2612 char **rrow, *a_tm_s;
2613
2614 a_tm = ASN1_UTCTIME_new();
2615
2616 /* get actual time and make a string */
2617 a_tm = X509_gmtime_adj(a_tm, 0);
2618 a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
2619 if (a_tm_s == NULL)
2620 {
2621 cnt = -1;
2622 goto err;
2623 }
2624
2625 memcpy(a_tm_s, a_tm->data, a_tm->length);
2626 a_tm_s[a_tm->length] = '\0';
2627
2628 if (strncmp(a_tm_s, "49", 2) <= 0)
2629 a_y2k = 1;
2630 else
2631 a_y2k = 0;
2632
2633 for (i = 0; i < sk_num(db->db->data); i++)
2634 {
2635 rrow = (char **) sk_value(db->db->data, i);
2636
2637 if (rrow[DB_type][0] == 'V')
2638 {
2639 /* ignore entries that are not valid */
2640 if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
2641 db_y2k = 1;
2642 else
2643 db_y2k = 0;
2644
2645 if (db_y2k == a_y2k)
2646 {
2647 /* all on the same y2k side */
2648 if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
2649 {
2650 rrow[DB_type][0] = 'E';
2651 rrow[DB_type][1] = '\0';
2652 cnt++;
2653
2654 BIO_printf(bio_err, "%s=Expired\n",
2655 rrow[DB_serial]);
2656 }
2657 }
2658 else if (db_y2k < a_y2k)
2659 {
2660 rrow[DB_type][0] = 'E';
2661 rrow[DB_type][1] = '\0';
2662 cnt++;
2663
2664 BIO_printf(bio_err, "%s=Expired\n",
2665 rrow[DB_serial]);
2666 }
2667
2668 }
2669 }
2670
2671 err:
2672
2673 ASN1_UTCTIME_free(a_tm);
2674 OPENSSL_free(a_tm_s);
2675
2676 return (cnt);
2677 }
2678
2679 static const char *crl_reasons[] = {
2680 /* CRL reason strings */
2681 "unspecified",
2682 "keyCompromise",
2683 "CACompromise",
2684 "affiliationChanged",
2685 "superseded",
2686 "cessationOfOperation",
2687 "certificateHold",
2688 "removeFromCRL",
2689 /* Additional pseudo reasons */
2690 "holdInstruction",
2691 "keyTime",
2692 "CAkeyTime"
2693 };
2694
2695 #define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
2696
2697 /* Given revocation information convert to a DB string.
2698 * The format of the string is:
2699 * revtime[,reason,extra]. Where 'revtime' is the
2700 * revocation time (the current time). 'reason' is the
2701 * optional CRL reason and 'extra' is any additional
2702 * argument
2703 */
2704
2705 char *make_revocation_str(int rev_type, char *rev_arg)
2706 {
2707 char *other = NULL, *str;
2708 const char *reason = NULL;
2709 ASN1_OBJECT *otmp;
2710 ASN1_UTCTIME *revtm = NULL;
2711 int i;
2712 switch (rev_type)
2713 {
2714 case REV_NONE:
2715 break;
2716
2717 case REV_CRL_REASON:
2718 for (i = 0; i < 8; i++)
2719 {
2720 if (!strcasecmp(rev_arg, crl_reasons[i]))
2721 {
2722 reason = crl_reasons[i];
2723 break;
2724 }
2725 }
2726 if (reason == NULL)
2727 {
2728 BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
2729 return NULL;
2730 }
2731 break;
2732
2733 case REV_HOLD:
2734 /* Argument is an OID */
2735
2736 otmp = OBJ_txt2obj(rev_arg, 0);
2737 ASN1_OBJECT_free(otmp);
2738
2739 if (otmp == NULL)
2740 {
2741 BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
2742 return NULL;
2743 }
2744
2745 reason = "holdInstruction";
2746 other = rev_arg;
2747 break;
2748
2749 case REV_KEY_COMPROMISE:
2750 case REV_CA_COMPROMISE:
2751
2752 /* Argument is the key compromise time */
2753 if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
2754 {
2755 BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
2756 return NULL;
2757 }
2758 other = rev_arg;
2759 if (rev_type == REV_KEY_COMPROMISE)
2760 reason = "keyTime";
2761 else
2762 reason = "CAkeyTime";
2763
2764 break;
2765
2766 }
2767
2768 revtm = X509_gmtime_adj(NULL, 0);
2769
2770 i = revtm->length + 1;
2771
2772 if (reason) i += strlen(reason) + 1;
2773 if (other) i += strlen(other) + 1;
2774
2775 str = OPENSSL_malloc(i);
2776
2777 if (!str) return NULL;
2778
2779 BUF_strlcpy(str, (char *)revtm->data, i);
2780 if (reason)
2781 {
2782 BUF_strlcat(str, ",", i);
2783 BUF_strlcat(str, reason, i);
2784 }
2785 if (other)
2786 {
2787 BUF_strlcat(str, ",", i);
2788 BUF_strlcat(str, other, i);
2789 }
2790 ASN1_UTCTIME_free(revtm);
2791 return str;
2792 }
2793
2794 /* Convert revocation field to X509_REVOKED entry
2795 * return code:
2796 * 0 error
2797 * 1 OK
2798 * 2 OK and some extensions added (i.e. V2 CRL)
2799 */
2800
2801
2802 int make_revoked(X509_REVOKED *rev, const char *str)
2803 {
2804 char *tmp = NULL;
2805 int reason_code = -1;
2806 int i, ret = 0;
2807 ASN1_OBJECT *hold = NULL;
2808 ASN1_GENERALIZEDTIME *comp_time = NULL;
2809 ASN1_ENUMERATED *rtmp = NULL;
2810
2811 ASN1_TIME *revDate = NULL;
2812
2813 i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
2814
2815 if (i == 0)
2816 goto err;
2817
2818 if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
2819 goto err;
2820
2821 if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
2822 {
2823 rtmp = ASN1_ENUMERATED_new();
2824 if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
2825 goto err;
2826 if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
2827 goto err;
2828 }
2829
2830 if (rev && comp_time)
2831 {
2832 if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
2833 goto err;
2834 }
2835 if (rev && hold)
2836 {
2837 if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
2838 goto err;
2839 }
2840
2841 if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
2842 ret = 2;
2843 else ret = 1;
2844
2845 err:
2846
2847 if (tmp) OPENSSL_free(tmp);
2848 ASN1_OBJECT_free(hold);
2849 ASN1_GENERALIZEDTIME_free(comp_time);
2850 ASN1_ENUMERATED_free(rtmp);
2851 ASN1_TIME_free(revDate);
2852
2853 return ret;
2854 }
2855
2856 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
2857 {
2858 char buf[25],*pbuf, *p;
2859 int j;
2860 j=i2a_ASN1_OBJECT(bp,obj);
2861 pbuf=buf;
2862 for (j=22-j; j>0; j--)
2863 *(pbuf++)=' ';
2864 *(pbuf++)=':';
2865 *(pbuf++)='\0';
2866 BIO_puts(bp,buf);
2867
2868 if (str->type == V_ASN1_PRINTABLESTRING)
2869 BIO_printf(bp,"PRINTABLE:'");
2870 else if (str->type == V_ASN1_T61STRING)
2871 BIO_printf(bp,"T61STRING:'");
2872 else if (str->type == V_ASN1_IA5STRING)
2873 BIO_printf(bp,"IA5STRING:'");
2874 else if (str->type == V_ASN1_UNIVERSALSTRING)
2875 BIO_printf(bp,"UNIVERSALSTRING:'");
2876 else
2877 BIO_printf(bp,"ASN.1 %2d:'",str->type);
2878
2879 p=(char *)str->data;
2880 for (j=str->length; j>0; j--)
2881 {
2882 if ((*p >= ' ') && (*p <= '~'))
2883 BIO_printf(bp,"%c",*p);
2884 else if (*p & 0x80)
2885 BIO_printf(bp,"\\0x%02X",*p);
2886 else if ((unsigned char)*p == 0xf7)
2887 BIO_printf(bp,"^?");
2888 else BIO_printf(bp,"^%c",*p+'@');
2889 p++;
2890 }
2891 BIO_printf(bp,"'\n");
2892 return 1;
2893 }
2894
2895 int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)
2896 {
2897 char *tmp = NULL;
2898 char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2899 int reason_code = -1;
2900 int ret = 0;
2901 unsigned int i;
2902 ASN1_OBJECT *hold = NULL;
2903 ASN1_GENERALIZEDTIME *comp_time = NULL;
2904 tmp = BUF_strdup(str);
2905
2906 p = strchr(tmp, ',');
2907
2908 rtime_str = tmp;
2909
2910 if (p)
2911 {
2912 *p = '\0';
2913 p++;
2914 reason_str = p;
2915 p = strchr(p, ',');
2916 if (p)
2917 {
2918 *p = '\0';
2919 arg_str = p + 1;
2920 }
2921 }
2922
2923 if (prevtm)
2924 {
2925 *prevtm = ASN1_UTCTIME_new();
2926 if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))
2927 {
2928 BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
2929 goto err;
2930 }
2931 }
2932 if (reason_str)
2933 {
2934 for (i = 0; i < NUM_REASONS; i++)
2935 {
2936 if(!strcasecmp(reason_str, crl_reasons[i]))
2937 {
2938 reason_code = i;
2939 break;
2940 }
2941 }
2942 if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
2943 {
2944 BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
2945 goto err;
2946 }
2947
2948 if (reason_code == 7)
2949 reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
2950 else if (reason_code == 8) /* Hold instruction */
2951 {
2952 if (!arg_str)
2953 {
2954 BIO_printf(bio_err, "missing hold instruction\n");
2955 goto err;
2956 }
2957 reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
2958 hold = OBJ_txt2obj(arg_str, 0);
2959
2960 if (!hold)
2961 {
2962 BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
2963 goto err;
2964 }
2965 if (phold) *phold = hold;
2966 }
2967 else if ((reason_code == 9) || (reason_code == 10))
2968 {
2969 if (!arg_str)
2970 {
2971 BIO_printf(bio_err, "missing compromised time\n");
2972 goto err;
2973 }
2974 comp_time = ASN1_GENERALIZEDTIME_new();
2975 if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
2976 {
2977 BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
2978 goto err;
2979 }
2980 if (reason_code == 9)
2981 reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
2982 else
2983 reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
2984 }
2985 }
2986
2987 if (preason) *preason = reason_code;
2988 if (pinvtm) *pinvtm = comp_time;
2989 else ASN1_GENERALIZEDTIME_free(comp_time);
2990
2991 ret = 1;
2992
2993 err:
2994
2995 if (tmp) OPENSSL_free(tmp);
2996 if (!phold) ASN1_OBJECT_free(hold);
2997 if (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);
2998
2999 return ret;
3000 }
A mirror of the official openssl repository