crypto/x509/x509_req.c

   1 /*
   2  * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include <openssl/bn.h>
  13 #include <openssl/evp.h>
  14 #include <openssl/asn1.h>
  15 #include <openssl/asn1t.h>
  16 #include <openssl/x509.h>
  17 #include "crypto/x509.h"
  18 #include <openssl/objects.h>
  19 #include <openssl/buffer.h>
  20 #include <openssl/pem.h>
  21
  22 X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
  23 {
  24     X509_REQ *ret;
  25     X509_REQ_INFO *ri;
  26     int i;
  27     EVP_PKEY *pktmp;
  28
  29     ret = X509_REQ_new_ex(x->libctx, x->propq);
  30     if (ret == NULL) {
  31         ERR_raise(ERR_LIB_X509, ERR_R_MALLOC_FAILURE);
  32         goto err;
  33     }
  34
  35     ri = &ret->req_info;
  36
  37     ri->version->length = 1;
  38     ri->version->data = OPENSSL_malloc(1);
  39     if (ri->version->data == NULL)
  40         goto err;
  41     ri->version->data[0] = 0;   /* version == 0 */
  42
  43     if (!X509_REQ_set_subject_name(ret, X509_get_subject_name(x)))
  44         goto err;
  45
  46     pktmp = X509_get0_pubkey(x);
  47     if (pktmp == NULL)
  48         goto err;
  49     i = X509_REQ_set_pubkey(ret, pktmp);
  50     if (!i)
  51         goto err;
  52
  53     if (pkey != NULL) {
  54         if (!X509_REQ_sign(ret, pkey, md))
  55             goto err;
  56     }
  57     return ret;
  58  err:
  59     X509_REQ_free(ret);
  60     return NULL;
  61 }
  62
  63 EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  64 {
  65     if (req == NULL)
  66         return NULL;
  67     return X509_PUBKEY_get(req->req_info.pubkey);
  68 }
  69
  70 EVP_PKEY *X509_REQ_get0_pubkey(X509_REQ *req)
  71 {
  72     if (req == NULL)
  73         return NULL;
  74     return X509_PUBKEY_get0(req->req_info.pubkey);
  75 }
  76
  77 X509_PUBKEY *X509_REQ_get_X509_PUBKEY(X509_REQ *req)
  78 {
  79     return req->req_info.pubkey;
  80 }
  81
  82 int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
  83 {
  84     EVP_PKEY *xk = NULL;
  85     int ok = 0;
  86
  87     xk = X509_REQ_get_pubkey(x);
  88     switch (EVP_PKEY_eq(xk, k)) {
  89     case 1:
  90         ok = 1;
  91         break;
  92     case 0:
  93         ERR_raise(ERR_LIB_X509, X509_R_KEY_VALUES_MISMATCH);
  94         break;
  95     case -1:
  96         ERR_raise(ERR_LIB_X509, X509_R_KEY_TYPE_MISMATCH);
  97         break;
  98     case -2:
  99         ERR_raise(ERR_LIB_X509, X509_R_UNKNOWN_KEY_TYPE);
 100     }
 101
 102     EVP_PKEY_free(xk);
 103     return ok;
 104 }
 105
 106 /*
 107  * It seems several organisations had the same idea of including a list of
 108  * extensions in a certificate request. There are at least two OIDs that are
 109  * used and there may be more: so the list is configurable.
 110  */
 111
 112 static int ext_nid_list[] = { NID_ext_req, NID_ms_ext_req, NID_undef };
 113
 114 static int *ext_nids = ext_nid_list;
 115
 116 int X509_REQ_extension_nid(int req_nid)
 117 {
 118     int i, nid;
 119     for (i = 0;; i++) {
 120         nid = ext_nids[i];
 121         if (nid == NID_undef)
 122             return 0;
 123         else if (req_nid == nid)
 124             return 1;
 125     }
 126 }
 127
 128 int *X509_REQ_get_extension_nids(void)
 129 {
 130     return ext_nids;
 131 }
 132
 133 void X509_REQ_set_extension_nids(int *nids)
 134 {
 135     ext_nids = nids;
 136 }
 137
 138 STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
 139 {
 140     X509_ATTRIBUTE *attr;
 141     ASN1_TYPE *ext = NULL;
 142     int idx, *pnid;
 143     const unsigned char *p;
 144
 145     if ((req == NULL) || !ext_nids)
 146         return NULL;
 147     for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
 148         idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
 149         if (idx == -1)
 150             continue;
 151         attr = X509_REQ_get_attr(req, idx);
 152         ext = X509_ATTRIBUTE_get0_type(attr, 0);
 153         break;
 154     }
 155     if (ext == NULL) /* no extensions is not an error */
 156         return sk_X509_EXTENSION_new_null();
 157     if (ext->type != V_ASN1_SEQUENCE) {
 158         ERR_raise(ERR_LIB_X509, X509_R_WRONG_TYPE);
 159         return NULL;
 160     }
 161     p = ext->value.sequence->data;
 162     return (STACK_OF(X509_EXTENSION) *)
 163         ASN1_item_d2i(NULL, &p, ext->value.sequence->length,
 164                       ASN1_ITEM_rptr(X509_EXTENSIONS));
 165 }
 166
 167 /*
 168  * Add a STACK_OF extensions to a certificate request: allow alternative OIDs
 169  * in case we want to create a non standard one.
 170  */
 171 int X509_REQ_add_extensions_nid(X509_REQ *req,
 172                                 const STACK_OF(X509_EXTENSION) *exts, int nid)
 173 {
 174     int extlen;
 175     int rv = 0;
 176     unsigned char *ext = NULL;
 177
 178     /* Generate encoding of extensions */
 179     extlen = ASN1_item_i2d((const ASN1_VALUE *)exts, &ext,
 180                            ASN1_ITEM_rptr(X509_EXTENSIONS));
 181     if (extlen <= 0)
 182         return 0;
 183     rv = X509_REQ_add1_attr_by_NID(req, nid, V_ASN1_SEQUENCE, ext, extlen);
 184     OPENSSL_free(ext);
 185     return rv;
 186 }
 187
 188 /* This is the normal usage: use the "official" OID */
 189 int X509_REQ_add_extensions(X509_REQ *req, const STACK_OF(X509_EXTENSION) *exts)
 190 {
 191     return X509_REQ_add_extensions_nid(req, exts, NID_ext_req);
 192 }
 193
 194 /* Request attribute functions */
 195
 196 int X509_REQ_get_attr_count(const X509_REQ *req)
 197 {
 198     return X509at_get_attr_count(req->req_info.attributes);
 199 }
 200
 201 int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos)
 202 {
 203     return X509at_get_attr_by_NID(req->req_info.attributes, nid, lastpos);
 204 }
 205
 206 int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, const ASN1_OBJECT *obj,
 207                              int lastpos)
 208 {
 209     return X509at_get_attr_by_OBJ(req->req_info.attributes, obj, lastpos);
 210 }
 211
 212 X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
 213 {
 214     return X509at_get_attr(req->req_info.attributes, loc);
 215 }
 216
 217 X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc)
 218 {
 219     return X509at_delete_attr(req->req_info.attributes, loc);
 220 }
 221
 222 int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr)
 223 {
 224     if (X509at_add1_attr(&req->req_info.attributes, attr))
 225         return 1;
 226     return 0;
 227 }
 228
 229 int X509_REQ_add1_attr_by_OBJ(X509_REQ *req,
 230                               const ASN1_OBJECT *obj, int type,
 231                               const unsigned char *bytes, int len)
 232 {
 233     if (X509at_add1_attr_by_OBJ(&req->req_info.attributes, obj,
 234                                 type, bytes, len))
 235         return 1;
 236     return 0;
 237 }
 238
 239 int X509_REQ_add1_attr_by_NID(X509_REQ *req,
 240                               int nid, int type,
 241                               const unsigned char *bytes, int len)
 242 {
 243     if (X509at_add1_attr_by_NID(&req->req_info.attributes, nid,
 244                                 type, bytes, len))
 245         return 1;
 246     return 0;
 247 }
 248
 249 int X509_REQ_add1_attr_by_txt(X509_REQ *req,
 250                               const char *attrname, int type,
 251                               const unsigned char *bytes, int len)
 252 {
 253     if (X509at_add1_attr_by_txt(&req->req_info.attributes, attrname,
 254                                 type, bytes, len))
 255         return 1;
 256     return 0;
 257 }
 258
 259 long X509_REQ_get_version(const X509_REQ *req)
 260 {
 261     return ASN1_INTEGER_get(req->req_info.version);
 262 }
 263
 264 X509_NAME *X509_REQ_get_subject_name(const X509_REQ *req)
 265 {
 266     return req->req_info.subject;
 267 }
 268
 269 void X509_REQ_get0_signature(const X509_REQ *req, const ASN1_BIT_STRING **psig,
 270                              const X509_ALGOR **palg)
 271 {
 272     if (psig != NULL)
 273         *psig = req->signature;
 274     if (palg != NULL)
 275         *palg = &req->sig_alg;
 276 }
 277
 278 void X509_REQ_set0_signature(X509_REQ *req, ASN1_BIT_STRING *psig)
 279 {
 280     if (req->signature)
 281            ASN1_BIT_STRING_free(req->signature);
 282     req->signature = psig;
 283 }
 284
 285 int X509_REQ_set1_signature_algo(X509_REQ *req, X509_ALGOR *palg)
 286 {
 287     return X509_ALGOR_copy(&req->sig_alg, palg);
 288 }
 289
 290 int X509_REQ_get_signature_nid(const X509_REQ *req)
 291 {
 292     return OBJ_obj2nid(req->sig_alg.algorithm);
 293 }
 294
 295 int i2d_re_X509_REQ_tbs(X509_REQ *req, unsigned char **pp)
 296 {
 297     req->req_info.enc.modified = 1;
 298     return i2d_X509_REQ_INFO(&req->req_info, pp);
 299 }