crypto/x509/x509_req.c

   1 /*
   2  * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include <openssl/bn.h>
  13 #include <openssl/evp.h>
  14 #include <openssl/asn1.h>
  15 #include <openssl/asn1t.h>
  16 #include <openssl/x509.h>
  17 #include "crypto/x509.h"
  18 #include <openssl/objects.h>
  19 #include <openssl/buffer.h>
  20 #include <openssl/pem.h>
  21
  22 X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
  23 {
  24     X509_REQ *ret;
  25     X509_REQ_INFO *ri;
  26     int i;
  27     EVP_PKEY *pktmp;
  28
  29     ret = X509_REQ_new();
  30     if (ret == NULL) {
  31         ERR_raise(ERR_LIB_X509, ERR_R_MALLOC_FAILURE);
  32         goto err;
  33     }
  34
  35     ri = &ret->req_info;
  36
  37     ri->version->length = 1;
  38     ri->version->data = OPENSSL_malloc(1);
  39     if (ri->version->data == NULL)
  40         goto err;
  41     ri->version->data[0] = 0;   /* version == 0 */
  42
  43     if (!X509_REQ_set_subject_name(ret, X509_get_subject_name(x)))
  44         goto err;
  45
  46     pktmp = X509_get0_pubkey(x);
  47     if (pktmp == NULL)
  48         goto err;
  49     i = X509_REQ_set_pubkey(ret, pktmp);
  50     if (!i)
  51         goto err;
  52
  53     if (pkey != NULL) {
  54         if (!X509_REQ_sign(ret, pkey, md))
  55             goto err;
  56     }
  57     return ret;
  58  err:
  59     X509_REQ_free(ret);
  60     return NULL;
  61 }
  62
  63 EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  64 {
  65     if (req == NULL)
  66         return NULL;
  67     return X509_PUBKEY_get(req->req_info.pubkey);
  68 }
  69
  70 EVP_PKEY *X509_REQ_get0_pubkey(X509_REQ *req)
  71 {
  72     if (req == NULL)
  73         return NULL;
  74     return X509_PUBKEY_get0(req->req_info.pubkey);
  75 }
  76
  77 X509_PUBKEY *X509_REQ_get_X509_PUBKEY(X509_REQ *req)
  78 {
  79     return req->req_info.pubkey;
  80 }
  81
  82 int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
  83 {
  84     EVP_PKEY *xk = NULL;
  85     int ok = 0;
  86
  87     xk = X509_REQ_get_pubkey(x);
  88     switch (EVP_PKEY_eq(xk, k)) {
  89     case 1:
  90         ok = 1;
  91         break;
  92     case 0:
  93         ERR_raise(ERR_LIB_X509, X509_R_KEY_VALUES_MISMATCH);
  94         break;
  95     case -1:
  96         ERR_raise(ERR_LIB_X509, X509_R_KEY_TYPE_MISMATCH);
  97         break;
  98     case -2:
  99 #ifndef OPENSSL_NO_EC
 100         if (EVP_PKEY_id(k) == EVP_PKEY_EC) {
 101             ERR_raise(ERR_LIB_X509, ERR_R_EC_LIB);
 102             break;
 103         }
 104 #endif
 105 #ifndef OPENSSL_NO_DH
 106         if (EVP_PKEY_id(k) == EVP_PKEY_DH) {
 107             /* No idea */
 108             ERR_raise(ERR_LIB_X509, X509_R_CANT_CHECK_DH_KEY);
 109             break;
 110         }
 111 #endif
 112         ERR_raise(ERR_LIB_X509, X509_R_UNKNOWN_KEY_TYPE);
 113     }
 114
 115     EVP_PKEY_free(xk);
 116     return ok;
 117 }
 118
 119 /*
 120  * It seems several organisations had the same idea of including a list of
 121  * extensions in a certificate request. There are at least two OIDs that are
 122  * used and there may be more: so the list is configurable.
 123  */
 124
 125 static int ext_nid_list[] = { NID_ext_req, NID_ms_ext_req, NID_undef };
 126
 127 static int *ext_nids = ext_nid_list;
 128
 129 int X509_REQ_extension_nid(int req_nid)
 130 {
 131     int i, nid;
 132     for (i = 0;; i++) {
 133         nid = ext_nids[i];
 134         if (nid == NID_undef)
 135             return 0;
 136         else if (req_nid == nid)
 137             return 1;
 138     }
 139 }
 140
 141 int *X509_REQ_get_extension_nids(void)
 142 {
 143     return ext_nids;
 144 }
 145
 146 void X509_REQ_set_extension_nids(int *nids)
 147 {
 148     ext_nids = nids;
 149 }
 150
 151 STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
 152 {
 153     X509_ATTRIBUTE *attr;
 154     ASN1_TYPE *ext = NULL;
 155     int idx, *pnid;
 156     const unsigned char *p;
 157
 158     if ((req == NULL) || !ext_nids)
 159         return NULL;
 160     for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
 161         idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
 162         if (idx == -1)
 163             continue;
 164         attr = X509_REQ_get_attr(req, idx);
 165         ext = X509_ATTRIBUTE_get0_type(attr, 0);
 166         break;
 167     }
 168     if (!ext || (ext->type != V_ASN1_SEQUENCE))
 169         return NULL;
 170     p = ext->value.sequence->data;
 171     return (STACK_OF(X509_EXTENSION) *)
 172         ASN1_item_d2i(NULL, &p, ext->value.sequence->length,
 173                       ASN1_ITEM_rptr(X509_EXTENSIONS));
 174 }
 175
 176 /*
 177  * Add a STACK_OF extensions to a certificate request: allow alternative OIDs
 178  * in case we want to create a non standard one.
 179  */
 180
 181 int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
 182                                 int nid)
 183 {
 184     int extlen;
 185     int rv = 0;
 186     unsigned char *ext = NULL;
 187     /* Generate encoding of extensions */
 188     extlen = ASN1_item_i2d((ASN1_VALUE *)exts, &ext,
 189                            ASN1_ITEM_rptr(X509_EXTENSIONS));
 190     if (extlen <= 0)
 191         return 0;
 192     rv = X509_REQ_add1_attr_by_NID(req, nid, V_ASN1_SEQUENCE, ext, extlen);
 193     OPENSSL_free(ext);
 194     return rv;
 195 }
 196
 197 /* This is the normal usage: use the "official" OID */
 198 int X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts)
 199 {
 200     return X509_REQ_add_extensions_nid(req, exts, NID_ext_req);
 201 }
 202
 203 /* Request attribute functions */
 204
 205 int X509_REQ_get_attr_count(const X509_REQ *req)
 206 {
 207     return X509at_get_attr_count(req->req_info.attributes);
 208 }
 209
 210 int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos)
 211 {
 212     return X509at_get_attr_by_NID(req->req_info.attributes, nid, lastpos);
 213 }
 214
 215 int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, const ASN1_OBJECT *obj,
 216                              int lastpos)
 217 {
 218     return X509at_get_attr_by_OBJ(req->req_info.attributes, obj, lastpos);
 219 }
 220
 221 X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
 222 {
 223     return X509at_get_attr(req->req_info.attributes, loc);
 224 }
 225
 226 X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc)
 227 {
 228     return X509at_delete_attr(req->req_info.attributes, loc);
 229 }
 230
 231 int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr)
 232 {
 233     if (X509at_add1_attr(&req->req_info.attributes, attr))
 234         return 1;
 235     return 0;
 236 }
 237
 238 int X509_REQ_add1_attr_by_OBJ(X509_REQ *req,
 239                               const ASN1_OBJECT *obj, int type,
 240                               const unsigned char *bytes, int len)
 241 {
 242     if (X509at_add1_attr_by_OBJ(&req->req_info.attributes, obj,
 243                                 type, bytes, len))
 244         return 1;
 245     return 0;
 246 }
 247
 248 int X509_REQ_add1_attr_by_NID(X509_REQ *req,
 249                               int nid, int type,
 250                               const unsigned char *bytes, int len)
 251 {
 252     if (X509at_add1_attr_by_NID(&req->req_info.attributes, nid,
 253                                 type, bytes, len))
 254         return 1;
 255     return 0;
 256 }
 257
 258 int X509_REQ_add1_attr_by_txt(X509_REQ *req,
 259                               const char *attrname, int type,
 260                               const unsigned char *bytes, int len)
 261 {
 262     if (X509at_add1_attr_by_txt(&req->req_info.attributes, attrname,
 263                                 type, bytes, len))
 264         return 1;
 265     return 0;
 266 }
 267
 268 long X509_REQ_get_version(const X509_REQ *req)
 269 {
 270     return ASN1_INTEGER_get(req->req_info.version);
 271 }
 272
 273 X509_NAME *X509_REQ_get_subject_name(const X509_REQ *req)
 274 {
 275     return req->req_info.subject;
 276 }
 277
 278 void X509_REQ_get0_signature(const X509_REQ *req, const ASN1_BIT_STRING **psig,
 279                              const X509_ALGOR **palg)
 280 {
 281     if (psig != NULL)
 282         *psig = req->signature;
 283     if (palg != NULL)
 284         *palg = &req->sig_alg;
 285 }
 286
 287 void X509_REQ_set0_signature(X509_REQ *req, ASN1_BIT_STRING *psig)
 288 {
 289     if (req->signature)
 290            ASN1_BIT_STRING_free(req->signature);
 291     req->signature = psig;
 292 }
 293
 294 int X509_REQ_set1_signature_algo(X509_REQ *req, X509_ALGOR *palg)
 295 {
 296     return X509_ALGOR_copy(&req->sig_alg, palg);
 297 }
 298
 299 int X509_REQ_get_signature_nid(const X509_REQ *req)
 300 {
 301     return OBJ_obj2nid(req->sig_alg.algorithm);
 302 }
 303
 304 int i2d_re_X509_REQ_tbs(X509_REQ *req, unsigned char **pp)
 305 {
 306     req->req_info.enc.modified = 1;
 307     return i2d_X509_REQ_INFO(&req->req_info, pp);
 308 }