x509_req.c 8.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314
  1. /*
  2. * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "internal/cryptlib.h"
  11. #include <openssl/bn.h>
  12. #include <openssl/evp.h>
  13. #include <openssl/asn1.h>
  14. #include <openssl/asn1t.h>
  15. #include <openssl/x509.h>
  16. #include "crypto/x509.h"
  17. #include <openssl/objects.h>
  18. #include <openssl/buffer.h>
  19. #include <openssl/pem.h>
  20. X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
  21. {
  22. X509_REQ *ret;
  23. X509_REQ_INFO *ri;
  24. int i;
  25. EVP_PKEY *pktmp;
  26. ret = X509_REQ_new_ex(x->libctx, x->propq);
  27. if (ret == NULL) {
  28. ERR_raise(ERR_LIB_X509, ERR_R_ASN1_LIB);
  29. goto err;
  30. }
  31. ri = &ret->req_info;
  32. ri->version->length = 1;
  33. ri->version->data = OPENSSL_malloc(1);
  34. if (ri->version->data == NULL)
  35. goto err;
  36. ri->version->data[0] = 0; /* version == 0 */
  37. if (!X509_REQ_set_subject_name(ret, X509_get_subject_name(x)))
  38. goto err;
  39. pktmp = X509_get0_pubkey(x);
  40. if (pktmp == NULL)
  41. goto err;
  42. i = X509_REQ_set_pubkey(ret, pktmp);
  43. if (!i)
  44. goto err;
  45. if (pkey != NULL) {
  46. if (!X509_REQ_sign(ret, pkey, md))
  47. goto err;
  48. }
  49. return ret;
  50. err:
  51. X509_REQ_free(ret);
  52. return NULL;
  53. }
  54. EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  55. {
  56. if (req == NULL)
  57. return NULL;
  58. return X509_PUBKEY_get(req->req_info.pubkey);
  59. }
  60. EVP_PKEY *X509_REQ_get0_pubkey(const X509_REQ *req)
  61. {
  62. if (req == NULL)
  63. return NULL;
  64. return X509_PUBKEY_get0(req->req_info.pubkey);
  65. }
  66. X509_PUBKEY *X509_REQ_get_X509_PUBKEY(X509_REQ *req)
  67. {
  68. return req->req_info.pubkey;
  69. }
  70. int X509_REQ_check_private_key(const X509_REQ *req, EVP_PKEY *pkey)
  71. {
  72. return ossl_x509_check_private_key(X509_REQ_get0_pubkey(req), pkey);
  73. }
  74. /*
  75. * It seems several organisations had the same idea of including a list of
  76. * extensions in a certificate request. There are at least two OIDs that are
  77. * used and there may be more: so the list is configurable.
  78. */
  79. static int ext_nid_list[] = { NID_ext_req, NID_ms_ext_req, NID_undef };
  80. static int *ext_nids = ext_nid_list;
  81. int X509_REQ_extension_nid(int req_nid)
  82. {
  83. int i, nid;
  84. for (i = 0;; i++) {
  85. nid = ext_nids[i];
  86. if (nid == NID_undef)
  87. return 0;
  88. else if (req_nid == nid)
  89. return 1;
  90. }
  91. }
  92. int *X509_REQ_get_extension_nids(void)
  93. {
  94. return ext_nids;
  95. }
  96. void X509_REQ_set_extension_nids(int *nids)
  97. {
  98. ext_nids = nids;
  99. }
  100. STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
  101. {
  102. X509_ATTRIBUTE *attr;
  103. ASN1_TYPE *ext = NULL;
  104. int idx, *pnid;
  105. const unsigned char *p;
  106. if (req == NULL || !ext_nids)
  107. return NULL;
  108. for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
  109. idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
  110. if (idx < 0)
  111. continue;
  112. attr = X509_REQ_get_attr(req, idx);
  113. ext = X509_ATTRIBUTE_get0_type(attr, 0);
  114. break;
  115. }
  116. if (ext == NULL) /* no extensions is not an error */
  117. return sk_X509_EXTENSION_new_null();
  118. if (ext->type != V_ASN1_SEQUENCE) {
  119. ERR_raise(ERR_LIB_X509, X509_R_WRONG_TYPE);
  120. return NULL;
  121. }
  122. p = ext->value.sequence->data;
  123. return (STACK_OF(X509_EXTENSION) *)
  124. ASN1_item_d2i(NULL, &p, ext->value.sequence->length,
  125. ASN1_ITEM_rptr(X509_EXTENSIONS));
  126. }
  127. /*
  128. * Add a STACK_OF extensions to a certificate request: allow alternative OIDs
  129. * in case we want to create a non standard one.
  130. */
  131. int X509_REQ_add_extensions_nid(X509_REQ *req,
  132. const STACK_OF(X509_EXTENSION) *exts, int nid)
  133. {
  134. int extlen;
  135. int rv = 0;
  136. unsigned char *ext = NULL;
  137. /* Generate encoding of extensions */
  138. extlen = ASN1_item_i2d((const ASN1_VALUE *)exts, &ext,
  139. ASN1_ITEM_rptr(X509_EXTENSIONS));
  140. if (extlen <= 0)
  141. return 0;
  142. rv = X509_REQ_add1_attr_by_NID(req, nid, V_ASN1_SEQUENCE, ext, extlen);
  143. OPENSSL_free(ext);
  144. return rv;
  145. }
  146. /* This is the normal usage: use the "official" OID */
  147. int X509_REQ_add_extensions(X509_REQ *req, const STACK_OF(X509_EXTENSION) *exts)
  148. {
  149. return X509_REQ_add_extensions_nid(req, exts, NID_ext_req);
  150. }
  151. /* Request attribute functions */
  152. int X509_REQ_get_attr_count(const X509_REQ *req)
  153. {
  154. return X509at_get_attr_count(req->req_info.attributes);
  155. }
  156. int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos)
  157. {
  158. return X509at_get_attr_by_NID(req->req_info.attributes, nid, lastpos);
  159. }
  160. int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, const ASN1_OBJECT *obj,
  161. int lastpos)
  162. {
  163. return X509at_get_attr_by_OBJ(req->req_info.attributes, obj, lastpos);
  164. }
  165. X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
  166. {
  167. return X509at_get_attr(req->req_info.attributes, loc);
  168. }
  169. X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc)
  170. {
  171. X509_ATTRIBUTE *attr;
  172. if (req == NULL) {
  173. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  174. return 0;
  175. }
  176. attr = X509at_delete_attr(req->req_info.attributes, loc);
  177. if (attr != NULL)
  178. req->req_info.enc.modified = 1;
  179. return attr;
  180. }
  181. int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr)
  182. {
  183. if (req == NULL) {
  184. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  185. return 0;
  186. }
  187. if (!X509at_add1_attr(&req->req_info.attributes, attr))
  188. return 0;
  189. req->req_info.enc.modified = 1;
  190. return 1;
  191. }
  192. int X509_REQ_add1_attr_by_OBJ(X509_REQ *req,
  193. const ASN1_OBJECT *obj, int type,
  194. const unsigned char *bytes, int len)
  195. {
  196. if (req == NULL) {
  197. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  198. return 0;
  199. }
  200. if (!X509at_add1_attr_by_OBJ(&req->req_info.attributes, obj,
  201. type, bytes, len))
  202. return 0;
  203. req->req_info.enc.modified = 1;
  204. return 1;
  205. }
  206. int X509_REQ_add1_attr_by_NID(X509_REQ *req,
  207. int nid, int type,
  208. const unsigned char *bytes, int len)
  209. {
  210. if (req == NULL) {
  211. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  212. return 0;
  213. }
  214. if (!X509at_add1_attr_by_NID(&req->req_info.attributes, nid,
  215. type, bytes, len))
  216. return 0;
  217. req->req_info.enc.modified = 1;
  218. return 1;
  219. }
  220. int X509_REQ_add1_attr_by_txt(X509_REQ *req,
  221. const char *attrname, int type,
  222. const unsigned char *bytes, int len)
  223. {
  224. if (req == NULL) {
  225. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  226. return 0;
  227. }
  228. if (!X509at_add1_attr_by_txt(&req->req_info.attributes, attrname,
  229. type, bytes, len))
  230. return 0;
  231. req->req_info.enc.modified = 1;
  232. return 1;
  233. }
  234. long X509_REQ_get_version(const X509_REQ *req)
  235. {
  236. return ASN1_INTEGER_get(req->req_info.version);
  237. }
  238. X509_NAME *X509_REQ_get_subject_name(const X509_REQ *req)
  239. {
  240. return req->req_info.subject;
  241. }
  242. void X509_REQ_get0_signature(const X509_REQ *req, const ASN1_BIT_STRING **psig,
  243. const X509_ALGOR **palg)
  244. {
  245. if (psig != NULL)
  246. *psig = req->signature;
  247. if (palg != NULL)
  248. *palg = &req->sig_alg;
  249. }
  250. void X509_REQ_set0_signature(X509_REQ *req, ASN1_BIT_STRING *psig)
  251. {
  252. if (req->signature)
  253. ASN1_BIT_STRING_free(req->signature);
  254. req->signature = psig;
  255. }
  256. int X509_REQ_set1_signature_algo(X509_REQ *req, X509_ALGOR *palg)
  257. {
  258. return X509_ALGOR_copy(&req->sig_alg, palg);
  259. }
  260. int X509_REQ_get_signature_nid(const X509_REQ *req)
  261. {
  262. return OBJ_obj2nid(req->sig_alg.algorithm);
  263. }
  264. int i2d_re_X509_REQ_tbs(X509_REQ *req, unsigned char **pp)
  265. {
  266. if (req == NULL) {
  267. ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
  268. return 0;
  269. }
  270. req->req_info.enc.modified = 1;
  271. return i2d_X509_REQ_INFO(&req->req_info, pp);
  272. }