crypto/x509/x509_req.c

   1 /*
   2  * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include <openssl/bn.h>
  13 #include <openssl/evp.h>
  14 #include <openssl/asn1.h>
  15 #include <openssl/asn1t.h>
  16 #include <openssl/x509.h>
  17 #include "crypto/x509.h"
  18 #include <openssl/objects.h>
  19 #include <openssl/buffer.h>
  20 #include <openssl/pem.h>
  21
  22 X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
  23 {
  24     X509_REQ *ret;
  25     X509_REQ_INFO *ri;
  26     int i;
  27     EVP_PKEY *pktmp;
  28
  29     ret = X509_REQ_new_ex(x->libctx, x->propq);
  30     if (ret == NULL) {
  31         ERR_raise(ERR_LIB_X509, ERR_R_MALLOC_FAILURE);
  32         goto err;
  33     }
  34
  35     ri = &ret->req_info;
  36
  37     ri->version->length = 1;
  38     ri->version->data = OPENSSL_malloc(1);
  39     if (ri->version->data == NULL)
  40         goto err;
  41     ri->version->data[0] = 0;   /* version == 0 */
  42
  43     if (!X509_REQ_set_subject_name(ret, X509_get_subject_name(x)))
  44         goto err;
  45
  46     pktmp = X509_get0_pubkey(x);
  47     if (pktmp == NULL)
  48         goto err;
  49     i = X509_REQ_set_pubkey(ret, pktmp);
  50     if (!i)
  51         goto err;
  52
  53     if (pkey != NULL) {
  54         if (!X509_REQ_sign(ret, pkey, md))
  55             goto err;
  56     }
  57     return ret;
  58  err:
  59     X509_REQ_free(ret);
  60     return NULL;
  61 }
  62
  63 EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  64 {
  65     if (req == NULL)
  66         return NULL;
  67     return X509_PUBKEY_get(req->req_info.pubkey);
  68 }
  69
  70 EVP_PKEY *X509_REQ_get0_pubkey(X509_REQ *req)
  71 {
  72     if (req == NULL)
  73         return NULL;
  74     return X509_PUBKEY_get0(req->req_info.pubkey);
  75 }
  76
  77 X509_PUBKEY *X509_REQ_get_X509_PUBKEY(X509_REQ *req)
  78 {
  79     return req->req_info.pubkey;
  80 }
  81
  82 int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
  83 {
  84     EVP_PKEY *xk = NULL;
  85     int ok = 0;
  86
  87     xk = X509_REQ_get_pubkey(x);
  88     switch (EVP_PKEY_eq(xk, k)) {
  89     case 1:
  90         ok = 1;
  91         break;
  92     case 0:
  93         ERR_raise(ERR_LIB_X509, X509_R_KEY_VALUES_MISMATCH);
  94         break;
  95     case -1:
  96         ERR_raise(ERR_LIB_X509, X509_R_KEY_TYPE_MISMATCH);
  97         break;
  98     case -2:
  99         ERR_raise(ERR_LIB_X509, X509_R_UNKNOWN_KEY_TYPE);
 100     }
 101
 102     EVP_PKEY_free(xk);
 103     return ok;
 104 }
 105
 106 /*
 107  * It seems several organisations had the same idea of including a list of
 108  * extensions in a certificate request. There are at least two OIDs that are
 109  * used and there may be more: so the list is configurable.
 110  */
 111
 112 static int ext_nid_list[] = { NID_ext_req, NID_ms_ext_req, NID_undef };
 113
 114 static int *ext_nids = ext_nid_list;
 115
 116 int X509_REQ_extension_nid(int req_nid)
 117 {
 118     int i, nid;
 119     for (i = 0;; i++) {
 120         nid = ext_nids[i];
 121         if (nid == NID_undef)
 122             return 0;
 123         else if (req_nid == nid)
 124             return 1;
 125     }
 126 }
 127
 128 int *X509_REQ_get_extension_nids(void)
 129 {
 130     return ext_nids;
 131 }
 132
 133 void X509_REQ_set_extension_nids(int *nids)
 134 {
 135     ext_nids = nids;
 136 }
 137
 138 STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
 139 {
 140     X509_ATTRIBUTE *attr;
 141     ASN1_TYPE *ext = NULL;
 142     int idx, *pnid;
 143     const unsigned char *p;
 144
 145     if ((req == NULL) || !ext_nids)
 146         return NULL;
 147     for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
 148         idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
 149         if (idx == -1)
 150             continue;
 151         attr = X509_REQ_get_attr(req, idx);
 152         ext = X509_ATTRIBUTE_get0_type(attr, 0);
 153         break;
 154     }
 155     if (ext == NULL) /* no extensions is not an error */
 156         return sk_X509_EXTENSION_new_null();
 157     if (ext->type != V_ASN1_SEQUENCE)
 158         return NULL;
 159     p = ext->value.sequence->data;
 160     return (STACK_OF(X509_EXTENSION) *)
 161         ASN1_item_d2i(NULL, &p, ext->value.sequence->length,
 162                       ASN1_ITEM_rptr(X509_EXTENSIONS));
 163 }
 164
 165 /*
 166  * Add a STACK_OF extensions to a certificate request: allow alternative OIDs
 167  * in case we want to create a non standard one.
 168  */
 169 int X509_REQ_add_extensions_nid(X509_REQ *req,
 170                                 const STACK_OF(X509_EXTENSION) *exts, int nid)
 171 {
 172     int extlen;
 173     int rv = 0;
 174     unsigned char *ext = NULL;
 175
 176     /* Generate encoding of extensions */
 177     extlen = ASN1_item_i2d((const ASN1_VALUE *)exts, &ext,
 178                            ASN1_ITEM_rptr(X509_EXTENSIONS));
 179     if (extlen <= 0)
 180         return 0;
 181     rv = X509_REQ_add1_attr_by_NID(req, nid, V_ASN1_SEQUENCE, ext, extlen);
 182     OPENSSL_free(ext);
 183     return rv;
 184 }
 185
 186 /* This is the normal usage: use the "official" OID */
 187 int X509_REQ_add_extensions(X509_REQ *req, const STACK_OF(X509_EXTENSION) *exts)
 188 {
 189     return X509_REQ_add_extensions_nid(req, exts, NID_ext_req);
 190 }
 191
 192 /* Request attribute functions */
 193
 194 int X509_REQ_get_attr_count(const X509_REQ *req)
 195 {
 196     return X509at_get_attr_count(req->req_info.attributes);
 197 }
 198
 199 int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos)
 200 {
 201     return X509at_get_attr_by_NID(req->req_info.attributes, nid, lastpos);
 202 }
 203
 204 int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, const ASN1_OBJECT *obj,
 205                              int lastpos)
 206 {
 207     return X509at_get_attr_by_OBJ(req->req_info.attributes, obj, lastpos);
 208 }
 209
 210 X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
 211 {
 212     return X509at_get_attr(req->req_info.attributes, loc);
 213 }
 214
 215 X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc)
 216 {
 217     return X509at_delete_attr(req->req_info.attributes, loc);
 218 }
 219
 220 int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr)
 221 {
 222     if (X509at_add1_attr(&req->req_info.attributes, attr))
 223         return 1;
 224     return 0;
 225 }
 226
 227 int X509_REQ_add1_attr_by_OBJ(X509_REQ *req,
 228                               const ASN1_OBJECT *obj, int type,
 229                               const unsigned char *bytes, int len)
 230 {
 231     if (X509at_add1_attr_by_OBJ(&req->req_info.attributes, obj,
 232                                 type, bytes, len))
 233         return 1;
 234     return 0;
 235 }
 236
 237 int X509_REQ_add1_attr_by_NID(X509_REQ *req,
 238                               int nid, int type,
 239                               const unsigned char *bytes, int len)
 240 {
 241     if (X509at_add1_attr_by_NID(&req->req_info.attributes, nid,
 242                                 type, bytes, len))
 243         return 1;
 244     return 0;
 245 }
 246
 247 int X509_REQ_add1_attr_by_txt(X509_REQ *req,
 248                               const char *attrname, int type,
 249                               const unsigned char *bytes, int len)
 250 {
 251     if (X509at_add1_attr_by_txt(&req->req_info.attributes, attrname,
 252                                 type, bytes, len))
 253         return 1;
 254     return 0;
 255 }
 256
 257 long X509_REQ_get_version(const X509_REQ *req)
 258 {
 259     return ASN1_INTEGER_get(req->req_info.version);
 260 }
 261
 262 X509_NAME *X509_REQ_get_subject_name(const X509_REQ *req)
 263 {
 264     return req->req_info.subject;
 265 }
 266
 267 void X509_REQ_get0_signature(const X509_REQ *req, const ASN1_BIT_STRING **psig,
 268                              const X509_ALGOR **palg)
 269 {
 270     if (psig != NULL)
 271         *psig = req->signature;
 272     if (palg != NULL)
 273         *palg = &req->sig_alg;
 274 }
 275
 276 void X509_REQ_set0_signature(X509_REQ *req, ASN1_BIT_STRING *psig)
 277 {
 278     if (req->signature)
 279            ASN1_BIT_STRING_free(req->signature);
 280     req->signature = psig;
 281 }
 282
 283 int X509_REQ_set1_signature_algo(X509_REQ *req, X509_ALGOR *palg)
 284 {
 285     return X509_ALGOR_copy(&req->sig_alg, palg);
 286 }
 287
 288 int X509_REQ_get_signature_nid(const X509_REQ *req)
 289 {
 290     return OBJ_obj2nid(req->sig_alg.algorithm);
 291 }
 292
 293 int i2d_re_X509_REQ_tbs(X509_REQ *req, unsigned char **pp)
 294 {
 295     req->req_info.enc.modified = 1;
 296     return i2d_X509_REQ_INFO(&req->req_info, pp);
 297 }