]> git.ipfire.org Git - thirdparty/openssl.git/blob - apps/req.c
projects / thirdparty / openssl.git / blob
? search:


b7342f071d373834ba8ff684b5533b49e8e1177a
[thirdparty/openssl.git] / apps / req.c
1 /* apps/req.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59 #include <stdio.h>
60 #include <stdlib.h>
61 #include <time.h>
62 #include <string.h>
63 #ifdef NO_STDIO
64 #define APPS_WIN16
65 #endif
66 #include "apps.h"
67 #include <openssl/bio.h>
68 #include <openssl/evp.h>
69 #include <openssl/rand.h>
70 #include <openssl/conf.h>
71 #include <openssl/err.h>
72 #include <openssl/asn1.h>
73 #include <openssl/x509.h>
74 #include <openssl/x509v3.h>
75 #include <openssl/objects.h>
76 #include <openssl/pem.h>
77
78 #define SECTION "req"
79
80 #define BITS "default_bits"
81 #define KEYFILE "default_keyfile"
82 #define DISTINGUISHED_NAME "distinguished_name"
83 #define ATTRIBUTES "attributes"
84 #define V3_EXTENSIONS "x509_extensions"
85
86 #define DEFAULT_KEY_LENGTH 512
87 #define MIN_KEY_LENGTH 384
88
89 #undef PROG
90 #define PROG req_main
91
92 /* -inform arg - input format - default PEM (one of DER, TXT or PEM)
93 * -outform arg - output format - default PEM
94 * -in arg - input file - default stdin
95 * -out arg - output file - default stdout
96 * -verify - check request signature
97 * -noout - don't print stuff out.
98 * -text - print out human readable text.
99 * -nodes - no des encryption
100 * -config file - Load configuration file.
101 * -key file - make a request using key in file (or use it for verification).
102 * -keyform - key file format.
103 * -newkey - make a key and a request.
104 * -modulus - print RSA modulus.
105 * -x509 - output a self signed X509 structure instead.
106 * -asn1-kludge - output new certificate request in a format that some CA's
107 * require. This format is wrong
108 */
109
110 static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,int attribs);
111 static int add_attribute_object(STACK *n, char *text, char *def,
112 char *value, int nid,int min,int max);
113 static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
114 int nid,int min,int max);
115 static void MS_CALLBACK req_cb(int p,int n,char *arg);
116 static int req_fix_data(int nid,int *type,int len,int min,int max);
117 static int check_end(char *str, char *end);
118 static int add_oid_section(LHASH *conf);
119 #ifndef MONOLITH
120 static char *default_config_file=NULL;
121 static LHASH *config=NULL;
122 #endif
123 static LHASH *req_conf=NULL;
124
125 #define TYPE_RSA 1
126 #define TYPE_DSA 2
127 #define TYPE_DH 3
128
129 int MAIN(int argc, char **argv)
130 {
131 #ifndef NO_DSA
132 DSA *dsa_params=NULL;
133 #endif
134 int ex=1,x509=0,days=30;
135 X509 *x509ss=NULL;
136 X509_REQ *req=NULL;
137 EVP_PKEY *pkey=NULL;
138 int i,badops=0,newreq=0,newkey= -1,pkey_type=0;
139 BIO *in=NULL,*out=NULL;
140 int informat,outformat,verify=0,noout=0,text=0,keyform=FORMAT_PEM;
141 int nodes=0,kludge=0;
142 char *infile,*outfile,*prog,*keyfile=NULL,*template=NULL,*keyout=NULL;
143 char *extensions = NULL;
144 EVP_CIPHER *cipher=NULL;
145 int modulus=0;
146 char *p;
147 const EVP_MD *md_alg=NULL,*digest=EVP_md5();
148 #ifndef MONOLITH
149 MS_STATIC char config_name[256];
150 #endif
151
152 #ifndef NO_DES
153 cipher=EVP_des_ede3_cbc();
154 #endif
155 apps_startup();
156
157 if (bio_err == NULL)
158 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
159 BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
160
161 infile=NULL;
162 outfile=NULL;
163 informat=FORMAT_PEM;
164 outformat=FORMAT_PEM;
165
166 prog=argv[0];
167 argc--;
168 argv++;
169 while (argc >= 1)
170 {
171 if (strcmp(*argv,"-inform") == 0)
172 {
173 if (--argc < 1) goto bad;
174 informat=str2fmt(*(++argv));
175 }
176 else if (strcmp(*argv,"-outform") == 0)
177 {
178 if (--argc < 1) goto bad;
179 outformat=str2fmt(*(++argv));
180 }
181 else if (strcmp(*argv,"-key") == 0)
182 {
183 if (--argc < 1) goto bad;
184 keyfile= *(++argv);
185 }
186 else if (strcmp(*argv,"-new") == 0)
187 {
188 pkey_type=TYPE_RSA;
189 newreq=1;
190 }
191 else if (strcmp(*argv,"-config") == 0)
192 {
193 if (--argc < 1) goto bad;
194 template= *(++argv);
195 }
196 else if (strcmp(*argv,"-keyform") == 0)
197 {
198 if (--argc < 1) goto bad;
199 keyform=str2fmt(*(++argv));
200 }
201 else if (strcmp(*argv,"-in") == 0)
202 {
203 if (--argc < 1) goto bad;
204 infile= *(++argv);
205 }
206 else if (strcmp(*argv,"-out") == 0)
207 {
208 if (--argc < 1) goto bad;
209 outfile= *(++argv);
210 }
211 else if (strcmp(*argv,"-keyout") == 0)
212 {
213 if (--argc < 1) goto bad;
214 keyout= *(++argv);
215 }
216 else if (strcmp(*argv,"-newkey") == 0)
217 {
218 int is_numeric;
219
220 if (--argc < 1) goto bad;
221 p= *(++argv);
222 is_numeric = p[0] >= '0' && p[0] <= '9';
223 if (strncmp("rsa:",p,4) == 0 || is_numeric)
224 {
225 pkey_type=TYPE_RSA;
226 if(!is_numeric)
227 p+=4;
228 newkey= atoi(p);
229 }
230 else
231 #ifndef NO_DSA
232 if (strncmp("dsa:",p,4) == 0)
233 {
234 X509 *xtmp=NULL;
235 EVP_PKEY *dtmp;
236
237 pkey_type=TYPE_DSA;
238 p+=4;
239 if ((in=BIO_new_file(p,"r")) == NULL)
240 {
241 perror(p);
242 goto end;
243 }
244 if ((dsa_params=PEM_read_bio_DSAparams(in,NULL,NULL)) == NULL)
245 {
246 ERR_clear_error();
247 BIO_reset(in);
248 if ((xtmp=PEM_read_bio_X509(in,NULL,NULL)) == NULL)
249 {
250 BIO_printf(bio_err,"unable to load DSA parameters from file\n");
251 goto end;
252 }
253
254 dtmp=X509_get_pubkey(xtmp);
255 if (dtmp->type == EVP_PKEY_DSA)
256 dsa_params=DSAparams_dup(dtmp->pkey.dsa);
257 EVP_PKEY_free(dtmp);
258 X509_free(xtmp);
259 if (dsa_params == NULL)
260 {
261 BIO_printf(bio_err,"Certificate does not contain DSA parameters\n");
262 goto end;
263 }
264 }
265 BIO_free(in);
266 newkey=BN_num_bits(dsa_params->p);
267 in=NULL;
268 }
269 else
270 #endif
271 #ifndef NO_DH
272 if (strncmp("dh:",p,4) == 0)
273 {
274 pkey_type=TYPE_DH;
275 p+=3;
276 }
277 else
278 #endif
279 pkey_type=TYPE_RSA;
280
281 newreq=1;
282 }
283 else if (strcmp(*argv,"-modulus") == 0)
284 modulus=1;
285 else if (strcmp(*argv,"-verify") == 0)
286 verify=1;
287 else if (strcmp(*argv,"-nodes") == 0)
288 nodes=1;
289 else if (strcmp(*argv,"-noout") == 0)
290 noout=1;
291 else if (strcmp(*argv,"-text") == 0)
292 text=1;
293 else if (strcmp(*argv,"-x509") == 0)
294 x509=1;
295 else if (strcmp(*argv,"-asn1-kludge") == 0)
296 kludge=1;
297 else if (strcmp(*argv,"-no-asn1-kludge") == 0)
298 kludge=0;
299 else if (strcmp(*argv,"-days") == 0)
300 {
301 if (--argc < 1) goto bad;
302 days= atoi(*(++argv));
303 if (days == 0) days=30;
304 }
305 else if ((md_alg=EVP_get_digestbyname(&((*argv)[1]))) != NULL)
306 {
307 /* ok */
308 digest=md_alg;
309 }
310 else
311
312 {
313 BIO_printf(bio_err,"unknown option %s\n",*argv);
314 badops=1;
315 break;
316 }
317 argc--;
318 argv++;
319 }
320
321 if (badops)
322 {
323 bad:
324 BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
325 BIO_printf(bio_err,"where options are\n");
326 BIO_printf(bio_err," -inform arg input format - one of DER TXT PEM\n");
327 BIO_printf(bio_err," -outform arg output format - one of DER TXT PEM\n");
328 BIO_printf(bio_err," -in arg input file\n");
329 BIO_printf(bio_err," -out arg output file\n");
330 BIO_printf(bio_err," -text text form of request\n");
331 BIO_printf(bio_err," -noout do not output REQ\n");
332 BIO_printf(bio_err," -verify verify signature on REQ\n");
333 BIO_printf(bio_err," -modulus RSA modulus\n");
334 BIO_printf(bio_err," -nodes don't encrypt the output key\n");
335 BIO_printf(bio_err," -key file use the private key contained in file\n");
336 BIO_printf(bio_err," -keyform arg key file format\n");
337 BIO_printf(bio_err," -keyout arg file to send the key to\n");
338 BIO_printf(bio_err," -newkey rsa:bits generate a new RSA key of 'bits' in size\n");
339 BIO_printf(bio_err," -newkey dsa:file generate a new DSA key, parameters taken from CA in 'file'\n");
340
341 BIO_printf(bio_err," -[digest] Digest to sign with (md5, sha1, md2, mdc2)\n");
342 BIO_printf(bio_err," -config file request template file.\n");
343 BIO_printf(bio_err," -new new request.\n");
344 BIO_printf(bio_err," -x509 output a x509 structure instead of a cert. req.\n");
345 BIO_printf(bio_err," -days number of days a x509 generated by -x509 is valid for.\n");
346 BIO_printf(bio_err," -asn1-kludge Output the 'request' in a format that is wrong but some CA's\n");
347 BIO_printf(bio_err," have been reported as requiring\n");
348 BIO_printf(bio_err," [ It is now always turned on but can be turned off with -no-asn1-kludge ]\n");
349 goto end;
350 }
351
352 ERR_load_crypto_strings();
353 X509V3_add_standard_extensions();
354
355 #ifndef MONOLITH
356 /* Lets load up our environment a little */
357 p=getenv("OPENSSL_CONF");
358 if (p == NULL)
359 p=getenv("SSLEAY_CONF");
360 if (p == NULL)
361 {
362 strcpy(config_name,X509_get_default_cert_area());
363 strcat(config_name,"/lib/");
364 strcat(config_name,OPENSSL_CONF);
365 p=config_name;
366 }
367 default_config_file=p;
368 config=CONF_load(config,p,NULL);
369 #endif
370
371 if (template != NULL)
372 {
373 long errline;
374
375 BIO_printf(bio_err,"Using configuration from %s\n",template);
376 req_conf=CONF_load(NULL,template,&errline);
377 if (req_conf == NULL)
378 {
379 BIO_printf(bio_err,"error on line %ld of %s\n",errline,template);
380 goto end;
381 }
382 }
383 else
384 {
385 req_conf=config;
386 BIO_printf(bio_err,"Using configuration from %s\n",
387 default_config_file);
388 if (req_conf == NULL)
389 {
390 BIO_printf(bio_err,"Unable to load config info\n");
391 }
392 }
393
394 if (req_conf != NULL)
395 {
396 p=CONF_get_string(req_conf,NULL,"oid_file");
397 if (p != NULL)
398 {
399 BIO *oid_bio;
400
401 oid_bio=BIO_new_file(p,"r");
402 if (oid_bio == NULL)
403 {
404 /*
405 BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
406 ERR_print_errors(bio_err);
407 */
408 }
409 else
410 {
411 OBJ_create_objects(oid_bio);
412 BIO_free(oid_bio);
413 }
414 }
415 }
416 if(!add_oid_section(req_conf)) goto end;
417
418 if ((md_alg == NULL) &&
419 ((p=CONF_get_string(req_conf,SECTION,"default_md")) != NULL))
420 {
421 if ((md_alg=EVP_get_digestbyname(p)) != NULL)
422 digest=md_alg;
423 }
424
425 extensions = CONF_get_string(req_conf, SECTION, V3_EXTENSIONS);
426 if(extensions) {
427 /* Check syntax of file */
428 X509V3_CTX ctx;
429 X509V3_set_ctx_test(&ctx);
430 X509V3_set_conf_lhash(&ctx, req_conf);
431 if(!X509V3_EXT_add_conf(req_conf, &ctx, extensions, NULL)) {
432 BIO_printf(bio_err,
433 "Error Loading extension section %s\n", extensions);
434 goto end;
435 }
436 }
437
438 in=BIO_new(BIO_s_file());
439 out=BIO_new(BIO_s_file());
440 if ((in == NULL) || (out == NULL))
441 goto end;
442
443 if (keyfile != NULL)
444 {
445 if (BIO_read_filename(in,keyfile) <= 0)
446 {
447 perror(keyfile);
448 goto end;
449 }
450
451 /* if (keyform == FORMAT_ASN1)
452 rsa=d2i_RSAPrivateKey_bio(in,NULL);
453 else */
454 if (keyform == FORMAT_PEM)
455 pkey=PEM_read_bio_PrivateKey(in,NULL,NULL);
456 else
457 {
458 BIO_printf(bio_err,"bad input format specified for X509 request\n");
459 goto end;
460 }
461
462 if (pkey == NULL)
463 {
464 BIO_printf(bio_err,"unable to load Private key\n");
465 goto end;
466 }
467 }
468
469 if (newreq && (pkey == NULL))
470 {
471 char *randfile;
472 char buffer[200];
473
474 if ((randfile=CONF_get_string(req_conf,SECTION,"RANDFILE")) == NULL)
475 randfile=RAND_file_name(buffer,200);
476 #ifdef WINDOWS
477 BIO_printf(bio_err,"Loading 'screen' into random state -");
478 BIO_flush(bio_err);
479 RAND_screen();
480 BIO_printf(bio_err," done\n");
481 #endif
482 if ((randfile == NULL) || !RAND_load_file(randfile,1024L*1024L))
483 {
484 BIO_printf(bio_err,"unable to load 'random state'\n");
485 BIO_printf(bio_err,"What this means is that the random number generator has not been seeded\n");
486 BIO_printf(bio_err,"with much random data.\n");
487 BIO_printf(bio_err,"Consider setting the RANDFILE environment variable to point at a file that\n");
488 BIO_printf(bio_err,"'random' data can be kept in.\n");
489 }
490 if (newkey <= 0)
491 {
492 newkey=(int)CONF_get_number(req_conf,SECTION,BITS);
493 if (newkey <= 0)
494 newkey=DEFAULT_KEY_LENGTH;
495 }
496
497 if (newkey < MIN_KEY_LENGTH)
498 {
499 BIO_printf(bio_err,"private key length is too short,\n");
500 BIO_printf(bio_err,"it needs to be at least %d bits, not %d\n",MIN_KEY_LENGTH,newkey);
501 goto end;
502 }
503 BIO_printf(bio_err,"Generating a %d bit %s private key\n",
504 newkey,(pkey_type == TYPE_RSA)?"RSA":"DSA");
505
506 if ((pkey=EVP_PKEY_new()) == NULL) goto end;
507
508 #ifndef NO_RSA
509 if (pkey_type == TYPE_RSA)
510 {
511 if (!EVP_PKEY_assign_RSA(pkey,
512 RSA_generate_key(newkey,0x10001,
513 req_cb,(char *)bio_err)))
514 goto end;
515 }
516 else
517 #endif
518 #ifndef NO_DSA
519 if (pkey_type == TYPE_DSA)
520 {
521 if (!DSA_generate_key(dsa_params)) goto end;
522 if (!EVP_PKEY_assign_DSA(pkey,dsa_params)) goto end;
523 dsa_params=NULL;
524 }
525 #endif
526
527 if ((randfile == NULL) || (RAND_write_file(randfile) == 0))
528 BIO_printf(bio_err,"unable to write 'random state'\n");
529
530 if (pkey == NULL) goto end;
531
532 if (keyout == NULL)
533 keyout=CONF_get_string(req_conf,SECTION,KEYFILE);
534
535 if (keyout == NULL)
536 {
537 BIO_printf(bio_err,"writing new private key to stdout\n");
538 BIO_set_fp(out,stdout,BIO_NOCLOSE);
539 }
540 else
541 {
542 BIO_printf(bio_err,"writing new private key to '%s'\n",keyout);
543 if (BIO_write_filename(out,keyout) <= 0)
544 {
545 perror(keyout);
546 goto end;
547 }
548 }
549
550 p=CONF_get_string(req_conf,SECTION,"encrypt_rsa_key");
551 if (p == NULL)
552 p=CONF_get_string(req_conf,SECTION,"encrypt_key");
553 if ((p != NULL) && (strcmp(p,"no") == 0))
554 cipher=NULL;
555 if (nodes) cipher=NULL;
556
557 i=0;
558 loop:
559 if (!PEM_write_bio_PrivateKey(out,pkey,cipher,
560 NULL,0,NULL))
561 {
562 if ((ERR_GET_REASON(ERR_peek_error()) ==
563 PEM_R_PROBLEMS_GETTING_PASSWORD) && (i < 3))
564 {
565 ERR_clear_error();
566 i++;
567 goto loop;
568 }
569 goto end;
570 }
571 BIO_printf(bio_err,"-----\n");
572 }
573
574 if (!newreq)
575 {
576 /* Since we are using a pre-existing certificate
577 * request, the kludge 'format' info should not be
578 * changed. */
579 kludge= -1;
580 if (infile == NULL)
581 BIO_set_fp(in,stdin,BIO_NOCLOSE);
582 else
583 {
584 if (BIO_read_filename(in,infile) <= 0)
585 {
586 perror(infile);
587 goto end;
588 }
589 }
590
591 if (informat == FORMAT_ASN1)
592 req=d2i_X509_REQ_bio(in,NULL);
593 else if (informat == FORMAT_PEM)
594 req=PEM_read_bio_X509_REQ(in,NULL,NULL);
595 else
596 {
597 BIO_printf(bio_err,"bad input format specified for X509 request\n");
598 goto end;
599 }
600 if (req == NULL)
601 {
602 BIO_printf(bio_err,"unable to load X509 request\n");
603 goto end;
604 }
605 }
606
607 if (newreq || x509)
608 {
609 #ifndef NO_DSA
610 if (pkey->type == EVP_PKEY_DSA)
611 digest=EVP_dss1();
612 #endif
613
614 if (pkey == NULL)
615 {
616 BIO_printf(bio_err,"you need to specify a private key\n");
617 goto end;
618 }
619 if (req == NULL)
620 {
621 req=X509_REQ_new();
622 if (req == NULL)
623 {
624 goto end;
625 }
626
627 i=make_REQ(req,pkey,!x509);
628 if (kludge >= 0)
629 req->req_info->req_kludge=kludge;
630 if (!i)
631 {
632 BIO_printf(bio_err,"problems making Certificate Request\n");
633 goto end;
634 }
635 }
636 if (x509)
637 {
638 EVP_PKEY *tmppkey;
639 X509V3_CTX ext_ctx;
640 if ((x509ss=X509_new()) == NULL) goto end;
641
642 /* Set version to V3 */
643 if(!X509_set_version(x509ss, 2)) goto end;
644 ASN1_INTEGER_set(X509_get_serialNumber(x509ss),0L);
645
646 X509_set_issuer_name(x509ss,
647 X509_REQ_get_subject_name(req));
648 X509_gmtime_adj(X509_get_notBefore(x509ss),0);
649 X509_gmtime_adj(X509_get_notAfter(x509ss),
650 (long)60*60*24*days);
651 X509_set_subject_name(x509ss,
652 X509_REQ_get_subject_name(req));
653 tmppkey = X509_REQ_get_pubkey(req);
654 X509_set_pubkey(x509ss,tmppkey);
655 EVP_PKEY_free(tmppkey);
656
657 /* Set up V3 context struct */
658
659 X509V3_set_ctx(&ext_ctx, x509ss, x509ss, NULL, NULL, 0);
660 X509V3_set_conf_lhash(&ext_ctx, req_conf);
661
662 /* Add extensions */
663 if(extensions && !X509V3_EXT_add_conf(req_conf,
664 &ext_ctx, extensions, x509ss))
665 {
666 BIO_printf(bio_err,
667 "Error Loading extension section %s\n",
668 extensions);
669 goto end;
670 }
671
672 if (!(i=X509_sign(x509ss,pkey,digest)))
673 goto end;
674 }
675 else
676 {
677 if (!(i=X509_REQ_sign(req,pkey,digest)))
678 goto end;
679 }
680 }
681
682 if (verify && !x509)
683 {
684 int tmp=0;
685
686 if (pkey == NULL)
687 {
688 pkey=X509_REQ_get_pubkey(req);
689 tmp=1;
690 if (pkey == NULL) goto end;
691 }
692
693 i=X509_REQ_verify(req,pkey);
694 if (tmp) {
695 EVP_PKEY_free(pkey);
696 pkey=NULL;
697 }
698
699 if (i < 0)
700 {
701 goto end;
702 }
703 else if (i == 0)
704 {
705 BIO_printf(bio_err,"verify failure\n");
706 }
707 else /* if (i > 0) */
708 BIO_printf(bio_err,"verify OK\n");
709 }
710
711 if (noout && !text && !modulus)
712 {
713 ex=0;
714 goto end;
715 }
716
717 if (outfile == NULL)
718 BIO_set_fp(out,stdout,BIO_NOCLOSE);
719 else
720 {
721 if ((keyout != NULL) && (strcmp(outfile,keyout) == 0))
722 i=(int)BIO_append_filename(out,outfile);
723 else
724 i=(int)BIO_write_filename(out,outfile);
725 if (!i)
726 {
727 perror(outfile);
728 goto end;
729 }
730 }
731
732 if (text)
733 {
734 if (x509)
735 X509_print(out,x509ss);
736 else
737 X509_REQ_print(out,req);
738 }
739
740 if (modulus)
741 {
742 EVP_PKEY *pubkey;
743
744 if (x509)
745 pubkey=X509_get_pubkey(x509ss);
746 else
747 pubkey=X509_REQ_get_pubkey(req);
748 if (pubkey == NULL)
749 {
750 fprintf(stdout,"Modulus=unavailable\n");
751 goto end;
752 }
753 fprintf(stdout,"Modulus=");
754 #ifndef NO_RSA
755 if (pubkey->type == EVP_PKEY_RSA)
756 BN_print(out,pubkey->pkey.rsa->n);
757 else
758 #endif
759 fprintf(stdout,"Wrong Algorithm type");
760 fprintf(stdout,"\n");
761 }
762
763 if (!noout && !x509)
764 {
765 if (outformat == FORMAT_ASN1)
766 i=i2d_X509_REQ_bio(out,req);
767 else if (outformat == FORMAT_PEM)
768 i=PEM_write_bio_X509_REQ(out,req);
769 else {
770 BIO_printf(bio_err,"bad output format specified for outfile\n");
771 goto end;
772 }
773 if (!i)
774 {
775 BIO_printf(bio_err,"unable to write X509 request\n");
776 goto end;
777 }
778 }
779 if (!noout && x509 && (x509ss != NULL))
780 {
781 if (outformat == FORMAT_ASN1)
782 i=i2d_X509_bio(out,x509ss);
783 else if (outformat == FORMAT_PEM)
784 i=PEM_write_bio_X509(out,x509ss);
785 else {
786 BIO_printf(bio_err,"bad output format specified for outfile\n");
787 goto end;
788 }
789 if (!i)
790 {
791 BIO_printf(bio_err,"unable to write X509 certificate\n");
792 goto end;
793 }
794 }
795 ex=0;
796 end:
797 if (ex)
798 {
799 ERR_print_errors(bio_err);
800 }
801 if ((req_conf != NULL) && (req_conf != config)) CONF_free(req_conf);
802 BIO_free(in);
803 BIO_free(out);
804 EVP_PKEY_free(pkey);
805 X509_REQ_free(req);
806 X509_free(x509ss);
807 X509V3_EXT_cleanup();
808 OBJ_cleanup();
809 #ifndef NO_DSA
810 if (dsa_params != NULL) DSA_free(dsa_params);
811 #endif
812 EXIT(ex);
813 }
814
815 static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, int attribs)
816 {
817 int ret=0,i;
818 char *p,*q;
819 X509_REQ_INFO *ri;
820 char buf[100];
821 int nid,min,max;
822 char *type,*def,*tmp,*value,*tmp_attr;
823 STACK *sk,*attr=NULL;
824 CONF_VALUE *v;
825
826 tmp=CONF_get_string(req_conf,SECTION,DISTINGUISHED_NAME);
827 if (tmp == NULL)
828 {
829 BIO_printf(bio_err,"unable to find '%s' in config\n",
830 DISTINGUISHED_NAME);
831 goto err;
832 }
833 sk=CONF_get_section(req_conf,tmp);
834 if (sk == NULL)
835 {
836 BIO_printf(bio_err,"unable to get '%s' section\n",tmp);
837 goto err;
838 }
839
840 tmp_attr=CONF_get_string(req_conf,SECTION,ATTRIBUTES);
841 if (tmp_attr == NULL)
842 attr=NULL;
843 else
844 {
845 attr=CONF_get_section(req_conf,tmp_attr);
846 if (attr == NULL)
847 {
848 BIO_printf(bio_err,"unable to get '%s' section\n",tmp_attr);
849 goto err;
850 }
851 }
852
853 ri=req->req_info;
854
855 BIO_printf(bio_err,"You are about to be asked to enter information that will be incorporated\n");
856 BIO_printf(bio_err,"into your certificate request.\n");
857 BIO_printf(bio_err,"What you are about to enter is what is called a Distinguished Name or a DN.\n");
858 BIO_printf(bio_err,"There are quite a few fields but you can leave some blank\n");
859 BIO_printf(bio_err,"For some fields there will be a default value,\n");
860 BIO_printf(bio_err,"If you enter '.', the field will be left blank.\n");
861 BIO_printf(bio_err,"-----\n");
862
863 /* setup version number */
864 if (!ASN1_INTEGER_set(ri->version,0L)) goto err; /* version 1 */
865
866 if (sk_num(sk))
867 {
868 i= -1;
869 start: for (;;)
870 {
871 i++;
872 if ((int)sk_num(sk) <= i) break;
873
874 v=(CONF_VALUE *)sk_value(sk,i);
875 p=q=NULL;
876 type=v->name;
877 if(!check_end(type,"_min") || !check_end(type,"_max") ||
878 !check_end(type,"_default") ||
879 !check_end(type,"_value")) continue;
880 /* Skip past any leading X. X: X, etc to allow for
881 * multiple instances
882 */
883 for(p = v->name; *p ; p++)
884 if ((*p == ':') || (*p == ',') ||
885 (*p == '.')) {
886 p++;
887 if(*p) type = p;
888 break;
889 }
890 /* If OBJ not recognised ignore it */
891 if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start;
892 sprintf(buf,"%s_default",v->name);
893 if ((def=CONF_get_string(req_conf,tmp,buf)) == NULL)
894 def="";
895
896 sprintf(buf,"%s_value",v->name);
897 if ((value=CONF_get_string(req_conf,tmp,buf)) == NULL)
898 value=NULL;
899
900 sprintf(buf,"%s_min",v->name);
901 min=(int)CONF_get_number(req_conf,tmp,buf);
902
903 sprintf(buf,"%s_max",v->name);
904 max=(int)CONF_get_number(req_conf,tmp,buf);
905
906 if (!add_DN_object(ri->subject,v->value,def,value,nid,
907 min,max))
908 goto err;
909 }
910 if (sk_X509_NAME_ENTRY_num(ri->subject->entries) == 0)
911 {
912 BIO_printf(bio_err,"error, no objects specified in config file\n");
913 goto err;
914 }
915
916 if (attribs)
917 {
918 if ((attr != NULL) && (sk_num(attr) > 0))
919 {
920 BIO_printf(bio_err,"\nPlease enter the following 'extra' attributes\n");
921 BIO_printf(bio_err,"to be sent with your certificate request\n");
922 }
923
924 i= -1;
925 start2: for (;;)
926 {
927 i++;
928 if ((attr == NULL) || ((int)sk_num(attr) <= i))
929 break;
930
931 v=(CONF_VALUE *)sk_value(attr,i);
932 type=v->name;
933 if ((nid=OBJ_txt2nid(type)) == NID_undef)
934 goto start2;
935
936 sprintf(buf,"%s_default",type);
937 if ((def=CONF_get_string(req_conf,tmp_attr,buf))
938 == NULL)
939 def="";
940
941 sprintf(buf,"%s_value",type);
942 if ((value=CONF_get_string(req_conf,tmp_attr,buf))
943 == NULL)
944 value=NULL;
945
946 sprintf(buf,"%s_min",type);
947 min=(int)CONF_get_number(req_conf,tmp_attr,buf);
948
949 sprintf(buf,"%s_max",type);
950 max=(int)CONF_get_number(req_conf,tmp_attr,buf);
951
952 if (!add_attribute_object(ri->attributes,
953 v->value,def,value,nid,min,max))
954 goto err;
955 }
956 }
957 }
958 else
959 {
960 BIO_printf(bio_err,"No template, please set one up.\n");
961 goto err;
962 }
963
964 X509_REQ_set_pubkey(req,pkey);
965
966 ret=1;
967 err:
968 return(ret);
969 }
970
971 static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
972 int nid, int min, int max)
973 {
974 int i,j,ret=0;
975 X509_NAME_ENTRY *ne=NULL;
976 MS_STATIC char buf[1024];
977
978 BIO_printf(bio_err,"%s [%s]:",text,def);
979 BIO_flush(bio_err);
980 if (value != NULL)
981 {
982 strcpy(buf,value);
983 strcat(buf,"\n");
984 BIO_printf(bio_err,"%s\n",value);
985 }
986 else
987 {
988 buf[0]='\0';
989 fgets(buf,1024,stdin);
990 }
991
992 if (buf[0] == '\0') return(0);
993 else if (buf[0] == '\n')
994 {
995 if ((def == NULL) || (def[0] == '\0'))
996 return(1);
997 strcpy(buf,def);
998 strcat(buf,"\n");
999 }
1000 else if ((buf[0] == '.') && (buf[1] == '\n')) return(1);
1001
1002 i=strlen(buf);
1003 if (buf[i-1] != '\n')
1004 {
1005 BIO_printf(bio_err,"weird input :-(\n");
1006 return(0);
1007 }
1008 buf[--i]='\0';
1009
1010 j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
1011 if (req_fix_data(nid,&j,i,min,max) == 0)
1012 goto err;
1013 if ((ne=X509_NAME_ENTRY_create_by_NID(NULL,nid,j,(unsigned char *)buf,
1014 strlen(buf)))
1015 == NULL) goto err;
1016 if (!X509_NAME_add_entry(n,ne,X509_NAME_entry_count(n),0))
1017 goto err;
1018
1019 ret=1;
1020 err:
1021 if (ne != NULL) X509_NAME_ENTRY_free(ne);
1022 return(ret);
1023 }
1024
1025 static int add_attribute_object(STACK *n, char *text, char *def, char *value,
1026 int nid, int min, int max)
1027 {
1028 int i,z;
1029 X509_ATTRIBUTE *xa=NULL;
1030 static char buf[1024];
1031 ASN1_BIT_STRING *bs=NULL;
1032 ASN1_TYPE *at=NULL;
1033
1034 start:
1035 BIO_printf(bio_err,"%s [%s]:",text,def);
1036 BIO_flush(bio_err);
1037 if (value != NULL)
1038 {
1039 strcpy(buf,value);
1040 strcat(buf,"\n");
1041 BIO_printf(bio_err,"%s\n",value);
1042 }
1043 else
1044 {
1045 buf[0]='\0';
1046 fgets(buf,1024,stdin);
1047 }
1048
1049 if (buf[0] == '\0') return(0);
1050 else if (buf[0] == '\n')
1051 {
1052 if ((def == NULL) || (def[0] == '\0'))
1053 return(1);
1054 strcpy(buf,def);
1055 strcat(buf,"\n");
1056 }
1057 else if ((buf[0] == '.') && (buf[1] == '\n')) return(1);
1058
1059 i=strlen(buf);
1060 if (buf[i-1] != '\n')
1061 {
1062 BIO_printf(bio_err,"weird input :-(\n");
1063 return(0);
1064 }
1065 buf[--i]='\0';
1066
1067 /* add object plus value */
1068 if ((xa=X509_ATTRIBUTE_new()) == NULL)
1069 goto err;
1070 if ((xa->value.set=sk_new_null()) == NULL)
1071 goto err;
1072 xa->set=1;
1073
1074 if (xa->object != NULL) ASN1_OBJECT_free(xa->object);
1075 xa->object=OBJ_nid2obj(nid);
1076
1077 if ((bs=ASN1_BIT_STRING_new()) == NULL) goto err;
1078
1079 bs->type=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
1080
1081 z=req_fix_data(nid,&bs->type,i,min,max);
1082 if (z == 0)
1083 {
1084 if (value == NULL)
1085 goto start;
1086 else goto err;
1087 }
1088
1089 if (!ASN1_STRING_set(bs,(unsigned char *)buf,i+1))
1090 { BIO_printf(bio_err,"Malloc failure\n"); goto err; }
1091
1092 if ((at=ASN1_TYPE_new()) == NULL)
1093 { BIO_printf(bio_err,"Malloc failure\n"); goto err; }
1094
1095 ASN1_TYPE_set(at,bs->type,(char *)bs);
1096 sk_push(xa->value.set,(char *)at);
1097 bs=NULL;
1098 at=NULL;
1099 /* only one item per attribute */
1100
1101 if (!sk_push(n,(char *)xa)) goto err;
1102 return(1);
1103 err:
1104 if (xa != NULL) X509_ATTRIBUTE_free(xa);
1105 if (at != NULL) ASN1_TYPE_free(at);
1106 if (bs != NULL) ASN1_BIT_STRING_free(bs);
1107 return(0);
1108 }
1109
1110 static void MS_CALLBACK req_cb(int p, int n, char *arg)
1111 {
1112 char c='*';
1113
1114 if (p == 0) c='.';
1115 if (p == 1) c='+';
1116 if (p == 2) c='*';
1117 if (p == 3) c='\n';
1118 BIO_write((BIO *)arg,&c,1);
1119 BIO_flush((BIO *)arg);
1120 #ifdef LINT
1121 p=n;
1122 #endif
1123 }
1124
1125 static int req_fix_data(int nid, int *type, int len, int min, int max)
1126 {
1127 if (nid == NID_pkcs9_emailAddress)
1128 *type=V_ASN1_IA5STRING;
1129 if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
1130 *type=V_ASN1_T61STRING;
1131 if ((nid == NID_pkcs9_challengePassword) &&
1132 (*type == V_ASN1_IA5STRING))
1133 *type=V_ASN1_T61STRING;
1134
1135 if ((nid == NID_pkcs9_unstructuredName) &&
1136 (*type == V_ASN1_T61STRING))
1137 {
1138 BIO_printf(bio_err,"invalid characters in string, please re-enter the string\n");
1139 return(0);
1140 }
1141 if (nid == NID_pkcs9_unstructuredName)
1142 *type=V_ASN1_IA5STRING;
1143
1144 if (len < min)
1145 {
1146 BIO_printf(bio_err,"string is too short, it needs to be at least %d bytes long\n",min);
1147 return(0);
1148 }
1149 if ((max != 0) && (len > max))
1150 {
1151 BIO_printf(bio_err,"string is too long, it needs to be less than %d bytes long\n",max);
1152 return(0);
1153 }
1154 return(1);
1155 }
1156
1157 /* Check if the end of a string matches 'end' */
1158 static int check_end(char *str, char *end)
1159 {
1160 int elen, slen;
1161 char *tmp;
1162 elen = strlen(end);
1163 slen = strlen(str);
1164 if(elen > slen) return 1;
1165 tmp = str + slen - elen;
1166 return strcmp(tmp, end);
1167 }
1168
1169 static int add_oid_section(LHASH *conf)
1170 {
1171 char *p;
1172 STACK *sktmp;
1173 CONF_VALUE *cnf;
1174 int i;
1175 if(!(p=CONF_get_string(conf,NULL,"oid_section"))) return 1;
1176 if(!(sktmp = CONF_get_section(conf, p))) {
1177 BIO_printf(bio_err, "problem loading oid section %s\n", p);
1178 return 0;
1179 }
1180 for(i = 0; i < sk_num(sktmp); i++) {
1181 cnf = (CONF_VALUE *)sk_value(sktmp, i);
1182 if(OBJ_create(cnf->value, cnf->name, cnf->name) == NID_undef) {
1183 BIO_printf(bio_err, "problem creating object %s=%s\n",
1184 cnf->name, cnf->value);
1185 return 0;
1186 }
1187 }
1188 return 1;
1189 }
A mirror of the official openssl repository