ca.c 73 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007
  1. /* apps/ca.c */
  2. /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  3. * All rights reserved.
  4. *
  5. * This package is an SSL implementation written
  6. * by Eric Young (eay@cryptsoft.com).
  7. * The implementation was written so as to conform with Netscapes SSL.
  8. *
  9. * This library is free for commercial and non-commercial use as long as
  10. * the following conditions are aheared to. The following conditions
  11. * apply to all code found in this distribution, be it the RC4, RSA,
  12. * lhash, DES, etc., code; not just the SSL code. The SSL documentation
  13. * included with this distribution is covered by the same copyright terms
  14. * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15. *
  16. * Copyright remains Eric Young's, and as such any Copyright notices in
  17. * the code are not to be removed.
  18. * If this package is used in a product, Eric Young should be given attribution
  19. * as the author of the parts of the library used.
  20. * This can be in the form of a textual message at program startup or
  21. * in documentation (online or textual) provided with the package.
  22. *
  23. * Redistribution and use in source and binary forms, with or without
  24. * modification, are permitted provided that the following conditions
  25. * are met:
  26. * 1. Redistributions of source code must retain the copyright
  27. * notice, this list of conditions and the following disclaimer.
  28. * 2. Redistributions in binary form must reproduce the above copyright
  29. * notice, this list of conditions and the following disclaimer in the
  30. * documentation and/or other materials provided with the distribution.
  31. * 3. All advertising materials mentioning features or use of this software
  32. * must display the following acknowledgement:
  33. * "This product includes cryptographic software written by
  34. * Eric Young (eay@cryptsoft.com)"
  35. * The word 'cryptographic' can be left out if the rouines from the library
  36. * being used are not cryptographic related :-).
  37. * 4. If you include any Windows specific code (or a derivative thereof) from
  38. * the apps directory (application code) you must include an acknowledgement:
  39. * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40. *
  41. * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44. * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51. * SUCH DAMAGE.
  52. *
  53. * The licence and distribution terms for any publically available version or
  54. * derivative of this code cannot be changed. i.e. this code cannot simply be
  55. * copied and put under another distribution licence
  56. * [including the GNU Public Licence.]
  57. */
  58. /* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
  59. #include <stdio.h>
  60. #include <stdlib.h>
  61. #include <string.h>
  62. #include <ctype.h>
  63. #include <sys/types.h>
  64. #include <openssl/conf.h>
  65. #include <openssl/bio.h>
  66. #include <openssl/err.h>
  67. #include <openssl/bn.h>
  68. #include <openssl/txt_db.h>
  69. #include <openssl/evp.h>
  70. #include <openssl/x509.h>
  71. #include <openssl/x509v3.h>
  72. #include <openssl/objects.h>
  73. #include <openssl/ocsp.h>
  74. #include <openssl/pem.h>
  75. #ifndef W_OK
  76. # ifdef OPENSSL_SYS_VMS
  77. # if defined(__DECC)
  78. # include <unistd.h>
  79. # else
  80. # include <unixlib.h>
  81. # endif
  82. # elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_NETWARE)
  83. # include <sys/file.h>
  84. # endif
  85. #endif
  86. #include "apps.h"
  87. #ifndef W_OK
  88. # define F_OK 0
  89. # define X_OK 1
  90. # define W_OK 2
  91. # define R_OK 4
  92. #endif
  93. #undef PROG
  94. #define PROG ca_main
  95. #define BASE_SECTION "ca"
  96. #define CONFIG_FILE "openssl.cnf"
  97. #define ENV_DEFAULT_CA "default_ca"
  98. #define STRING_MASK "string_mask"
  99. #define UTF8_IN "utf8"
  100. #define ENV_DIR "dir"
  101. #define ENV_CERTS "certs"
  102. #define ENV_CRL_DIR "crl_dir"
  103. #define ENV_CA_DB "CA_DB"
  104. #define ENV_NEW_CERTS_DIR "new_certs_dir"
  105. #define ENV_CERTIFICATE "certificate"
  106. #define ENV_SERIAL "serial"
  107. #define ENV_CRLNUMBER "crlnumber"
  108. #define ENV_CRL "crl"
  109. #define ENV_PRIVATE_KEY "private_key"
  110. #define ENV_RANDFILE "RANDFILE"
  111. #define ENV_DEFAULT_DAYS "default_days"
  112. #define ENV_DEFAULT_STARTDATE "default_startdate"
  113. #define ENV_DEFAULT_ENDDATE "default_enddate"
  114. #define ENV_DEFAULT_CRL_DAYS "default_crl_days"
  115. #define ENV_DEFAULT_CRL_HOURS "default_crl_hours"
  116. #define ENV_DEFAULT_MD "default_md"
  117. #define ENV_DEFAULT_EMAIL_DN "email_in_dn"
  118. #define ENV_PRESERVE "preserve"
  119. #define ENV_POLICY "policy"
  120. #define ENV_EXTENSIONS "x509_extensions"
  121. #define ENV_CRLEXT "crl_extensions"
  122. #define ENV_MSIE_HACK "msie_hack"
  123. #define ENV_NAMEOPT "name_opt"
  124. #define ENV_CERTOPT "cert_opt"
  125. #define ENV_EXTCOPY "copy_extensions"
  126. #define ENV_UNIQUE_SUBJECT "unique_subject"
  127. #define ENV_DATABASE "database"
  128. /* Additional revocation information types */
  129. #define REV_NONE 0 /* No addditional information */
  130. #define REV_CRL_REASON 1 /* Value is CRL reason code */
  131. #define REV_HOLD 2 /* Value is hold instruction */
  132. #define REV_KEY_COMPROMISE 3 /* Value is cert key compromise time */
  133. #define REV_CA_COMPROMISE 4 /* Value is CA key compromise time */
  134. static const char *ca_usage[]={
  135. "usage: ca args\n",
  136. "\n",
  137. " -verbose - Talk alot while doing things\n",
  138. " -config file - A config file\n",
  139. " -name arg - The particular CA definition to use\n",
  140. " -gencrl - Generate a new CRL\n",
  141. " -crldays days - Days is when the next CRL is due\n",
  142. " -crlhours hours - Hours is when the next CRL is due\n",
  143. " -startdate YYMMDDHHMMSSZ - certificate validity notBefore\n",
  144. " -enddate YYMMDDHHMMSSZ - certificate validity notAfter (overrides -days)\n",
  145. " -days arg - number of days to certify the certificate for\n",
  146. " -md arg - md to use, one of md2, md5, sha or sha1\n",
  147. " -policy arg - The CA 'policy' to support\n",
  148. " -keyfile arg - private key file\n",
  149. " -keyform arg - private key file format (PEM or ENGINE)\n",
  150. " -key arg - key to decode the private key if it is encrypted\n",
  151. " -cert file - The CA certificate\n",
  152. " -selfsign - sign a certificate with the key associated with it\n",
  153. " -in file - The input PEM encoded certificate request(s)\n",
  154. " -out file - Where to put the output file(s)\n",
  155. " -outdir dir - Where to put output certificates\n",
  156. " -infiles .... - The last argument, requests to process\n",
  157. " -spkac file - File contains DN and signed public key and challenge\n",
  158. " -ss_cert file - File contains a self signed cert to sign\n",
  159. " -preserveDN - Don't re-order the DN\n",
  160. " -noemailDN - Don't add the EMAIL field into certificate' subject\n",
  161. " -batch - Don't ask questions\n",
  162. " -msie_hack - msie modifications to handle all those universal strings\n",
  163. " -revoke file - Revoke a certificate (given in file)\n",
  164. " -subj arg - Use arg instead of request's subject\n",
  165. " -utf8 - input characters are UTF8 (default ASCII)\n",
  166. " -multivalue-rdn - enable support for multivalued RDNs\n",
  167. " -extensions .. - Extension section (override value in config file)\n",
  168. " -extfile file - Configuration file with X509v3 extentions to add\n",
  169. " -crlexts .. - CRL extension section (override value in config file)\n",
  170. #ifndef OPENSSL_NO_ENGINE
  171. " -engine e - use engine e, possibly a hardware device.\n",
  172. #endif
  173. " -status serial - Shows certificate status given the serial number\n",
  174. " -updatedb - Updates db for expired certificates\n",
  175. NULL
  176. };
  177. #ifdef EFENCE
  178. extern int EF_PROTECT_FREE;
  179. extern int EF_PROTECT_BELOW;
  180. extern int EF_ALIGNMENT;
  181. #endif
  182. static void lookup_fail(const char *name, const char *tag);
  183. static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
  184. const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,CA_DB *db,
  185. BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate,
  186. char *enddate, long days, int batch, char *ext_sect, CONF *conf,
  187. int verbose, unsigned long certopt, unsigned long nameopt,
  188. int default_op, int ext_copy, int selfsign);
  189. static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
  190. const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
  191. CA_DB *db, BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn,
  192. char *startdate, char *enddate, long days, int batch,
  193. char *ext_sect, CONF *conf,int verbose, unsigned long certopt,
  194. unsigned long nameopt, int default_op, int ext_copy,
  195. ENGINE *e);
  196. static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
  197. const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
  198. CA_DB *db, BIGNUM *serial,char *subj,unsigned long chtype, int multirdn, int email_dn,
  199. char *startdate, char *enddate, long days, char *ext_sect,
  200. CONF *conf, int verbose, unsigned long certopt,
  201. unsigned long nameopt, int default_op, int ext_copy);
  202. static int fix_data(int nid, int *type);
  203. static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
  204. static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
  205. STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,char *subj,unsigned long chtype, int multirdn,
  206. int email_dn, char *startdate, char *enddate, long days, int batch,
  207. int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
  208. unsigned long certopt, unsigned long nameopt, int default_op,
  209. int ext_copy, int selfsign);
  210. static int do_revoke(X509 *x509, CA_DB *db, int ext, char *extval);
  211. static int get_certificate_status(const char *ser_status, CA_DB *db);
  212. static int do_updatedb(CA_DB *db);
  213. static int check_time_format(const char *str);
  214. char *make_revocation_str(int rev_type, char *rev_arg);
  215. int make_revoked(X509_REVOKED *rev, const char *str);
  216. int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
  217. static CONF *conf=NULL;
  218. static CONF *extconf=NULL;
  219. static char *section=NULL;
  220. static int preserve=0;
  221. static int msie_hack=0;
  222. int MAIN(int, char **);
  223. int MAIN(int argc, char **argv)
  224. {
  225. ENGINE *e = NULL;
  226. char *key=NULL,*passargin=NULL;
  227. int create_ser = 0;
  228. int free_key = 0;
  229. int total=0;
  230. int total_done=0;
  231. int badops=0;
  232. int ret=1;
  233. int email_dn=1;
  234. int req=0;
  235. int verbose=0;
  236. int gencrl=0;
  237. int dorevoke=0;
  238. int doupdatedb=0;
  239. long crldays=0;
  240. long crlhours=0;
  241. long crlsec=0;
  242. long errorline= -1;
  243. char *configfile=NULL;
  244. char *md=NULL;
  245. char *policy=NULL;
  246. char *keyfile=NULL;
  247. char *certfile=NULL;
  248. int keyform=FORMAT_PEM;
  249. char *infile=NULL;
  250. char *spkac_file=NULL;
  251. char *ss_cert_file=NULL;
  252. char *ser_status=NULL;
  253. EVP_PKEY *pkey=NULL;
  254. int output_der = 0;
  255. char *outfile=NULL;
  256. char *outdir=NULL;
  257. char *serialfile=NULL;
  258. char *crlnumberfile=NULL;
  259. char *extensions=NULL;
  260. char *extfile=NULL;
  261. char *subj=NULL;
  262. unsigned long chtype = MBSTRING_ASC;
  263. int multirdn = 0;
  264. char *tmp_email_dn=NULL;
  265. char *crl_ext=NULL;
  266. int rev_type = REV_NONE;
  267. char *rev_arg = NULL;
  268. BIGNUM *serial=NULL;
  269. BIGNUM *crlnumber=NULL;
  270. char *startdate=NULL;
  271. char *enddate=NULL;
  272. long days=0;
  273. int batch=0;
  274. int notext=0;
  275. unsigned long nameopt = 0, certopt = 0;
  276. int default_op = 1;
  277. int ext_copy = EXT_COPY_NONE;
  278. int selfsign = 0;
  279. X509 *x509=NULL, *x509p = NULL;
  280. X509 *x=NULL;
  281. BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
  282. char *dbfile=NULL;
  283. CA_DB *db=NULL;
  284. X509_CRL *crl=NULL;
  285. X509_REVOKED *r=NULL;
  286. ASN1_TIME *tmptm;
  287. ASN1_INTEGER *tmpser;
  288. char *f;
  289. const char *p;
  290. char * const *pp;
  291. int i,j;
  292. const EVP_MD *dgst=NULL;
  293. STACK_OF(CONF_VALUE) *attribs=NULL;
  294. STACK_OF(X509) *cert_sk=NULL;
  295. #undef BSIZE
  296. #define BSIZE 256
  297. MS_STATIC char buf[3][BSIZE];
  298. char *randfile=NULL;
  299. #ifndef OPENSSL_NO_ENGINE
  300. char *engine = NULL;
  301. #endif
  302. char *tofree=NULL;
  303. DB_ATTR db_attr;
  304. #ifdef EFENCE
  305. EF_PROTECT_FREE=1;
  306. EF_PROTECT_BELOW=1;
  307. EF_ALIGNMENT=0;
  308. #endif
  309. apps_startup();
  310. conf = NULL;
  311. key = NULL;
  312. section = NULL;
  313. preserve=0;
  314. msie_hack=0;
  315. if (bio_err == NULL)
  316. if ((bio_err=BIO_new(BIO_s_file())) != NULL)
  317. BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
  318. argc--;
  319. argv++;
  320. while (argc >= 1)
  321. {
  322. if (strcmp(*argv,"-verbose") == 0)
  323. verbose=1;
  324. else if (strcmp(*argv,"-config") == 0)
  325. {
  326. if (--argc < 1) goto bad;
  327. configfile= *(++argv);
  328. }
  329. else if (strcmp(*argv,"-name") == 0)
  330. {
  331. if (--argc < 1) goto bad;
  332. section= *(++argv);
  333. }
  334. else if (strcmp(*argv,"-subj") == 0)
  335. {
  336. if (--argc < 1) goto bad;
  337. subj= *(++argv);
  338. /* preserve=1; */
  339. }
  340. else if (strcmp(*argv,"-utf8") == 0)
  341. chtype = MBSTRING_UTF8;
  342. else if (strcmp(*argv,"-create_serial") == 0)
  343. create_ser = 1;
  344. else if (strcmp(*argv,"-multivalue-rdn") == 0)
  345. multirdn=1;
  346. else if (strcmp(*argv,"-startdate") == 0)
  347. {
  348. if (--argc < 1) goto bad;
  349. startdate= *(++argv);
  350. }
  351. else if (strcmp(*argv,"-enddate") == 0)
  352. {
  353. if (--argc < 1) goto bad;
  354. enddate= *(++argv);
  355. }
  356. else if (strcmp(*argv,"-days") == 0)
  357. {
  358. if (--argc < 1) goto bad;
  359. days=atoi(*(++argv));
  360. }
  361. else if (strcmp(*argv,"-md") == 0)
  362. {
  363. if (--argc < 1) goto bad;
  364. md= *(++argv);
  365. }
  366. else if (strcmp(*argv,"-policy") == 0)
  367. {
  368. if (--argc < 1) goto bad;
  369. policy= *(++argv);
  370. }
  371. else if (strcmp(*argv,"-keyfile") == 0)
  372. {
  373. if (--argc < 1) goto bad;
  374. keyfile= *(++argv);
  375. }
  376. else if (strcmp(*argv,"-keyform") == 0)
  377. {
  378. if (--argc < 1) goto bad;
  379. keyform=str2fmt(*(++argv));
  380. }
  381. else if (strcmp(*argv,"-passin") == 0)
  382. {
  383. if (--argc < 1) goto bad;
  384. passargin= *(++argv);
  385. }
  386. else if (strcmp(*argv,"-key") == 0)
  387. {
  388. if (--argc < 1) goto bad;
  389. key= *(++argv);
  390. }
  391. else if (strcmp(*argv,"-cert") == 0)
  392. {
  393. if (--argc < 1) goto bad;
  394. certfile= *(++argv);
  395. }
  396. else if (strcmp(*argv,"-selfsign") == 0)
  397. selfsign=1;
  398. else if (strcmp(*argv,"-in") == 0)
  399. {
  400. if (--argc < 1) goto bad;
  401. infile= *(++argv);
  402. req=1;
  403. }
  404. else if (strcmp(*argv,"-out") == 0)
  405. {
  406. if (--argc < 1) goto bad;
  407. outfile= *(++argv);
  408. }
  409. else if (strcmp(*argv,"-outdir") == 0)
  410. {
  411. if (--argc < 1) goto bad;
  412. outdir= *(++argv);
  413. }
  414. else if (strcmp(*argv,"-notext") == 0)
  415. notext=1;
  416. else if (strcmp(*argv,"-batch") == 0)
  417. batch=1;
  418. else if (strcmp(*argv,"-preserveDN") == 0)
  419. preserve=1;
  420. else if (strcmp(*argv,"-noemailDN") == 0)
  421. email_dn=0;
  422. else if (strcmp(*argv,"-gencrl") == 0)
  423. gencrl=1;
  424. else if (strcmp(*argv,"-msie_hack") == 0)
  425. msie_hack=1;
  426. else if (strcmp(*argv,"-crldays") == 0)
  427. {
  428. if (--argc < 1) goto bad;
  429. crldays= atol(*(++argv));
  430. }
  431. else if (strcmp(*argv,"-crlhours") == 0)
  432. {
  433. if (--argc < 1) goto bad;
  434. crlhours= atol(*(++argv));
  435. }
  436. else if (strcmp(*argv,"-crlsec") == 0)
  437. {
  438. if (--argc < 1) goto bad;
  439. crlsec = atol(*(++argv));
  440. }
  441. else if (strcmp(*argv,"-infiles") == 0)
  442. {
  443. argc--;
  444. argv++;
  445. req=1;
  446. break;
  447. }
  448. else if (strcmp(*argv, "-ss_cert") == 0)
  449. {
  450. if (--argc < 1) goto bad;
  451. ss_cert_file = *(++argv);
  452. req=1;
  453. }
  454. else if (strcmp(*argv, "-spkac") == 0)
  455. {
  456. if (--argc < 1) goto bad;
  457. spkac_file = *(++argv);
  458. req=1;
  459. }
  460. else if (strcmp(*argv,"-revoke") == 0)
  461. {
  462. if (--argc < 1) goto bad;
  463. infile= *(++argv);
  464. dorevoke=1;
  465. }
  466. else if (strcmp(*argv,"-extensions") == 0)
  467. {
  468. if (--argc < 1) goto bad;
  469. extensions= *(++argv);
  470. }
  471. else if (strcmp(*argv,"-extfile") == 0)
  472. {
  473. if (--argc < 1) goto bad;
  474. extfile= *(++argv);
  475. }
  476. else if (strcmp(*argv,"-status") == 0)
  477. {
  478. if (--argc < 1) goto bad;
  479. ser_status= *(++argv);
  480. }
  481. else if (strcmp(*argv,"-updatedb") == 0)
  482. {
  483. doupdatedb=1;
  484. }
  485. else if (strcmp(*argv,"-crlexts") == 0)
  486. {
  487. if (--argc < 1) goto bad;
  488. crl_ext= *(++argv);
  489. }
  490. else if (strcmp(*argv,"-crl_reason") == 0)
  491. {
  492. if (--argc < 1) goto bad;
  493. rev_arg = *(++argv);
  494. rev_type = REV_CRL_REASON;
  495. }
  496. else if (strcmp(*argv,"-crl_hold") == 0)
  497. {
  498. if (--argc < 1) goto bad;
  499. rev_arg = *(++argv);
  500. rev_type = REV_HOLD;
  501. }
  502. else if (strcmp(*argv,"-crl_compromise") == 0)
  503. {
  504. if (--argc < 1) goto bad;
  505. rev_arg = *(++argv);
  506. rev_type = REV_KEY_COMPROMISE;
  507. }
  508. else if (strcmp(*argv,"-crl_CA_compromise") == 0)
  509. {
  510. if (--argc < 1) goto bad;
  511. rev_arg = *(++argv);
  512. rev_type = REV_CA_COMPROMISE;
  513. }
  514. #ifndef OPENSSL_NO_ENGINE
  515. else if (strcmp(*argv,"-engine") == 0)
  516. {
  517. if (--argc < 1) goto bad;
  518. engine= *(++argv);
  519. }
  520. #endif
  521. else
  522. {
  523. bad:
  524. BIO_printf(bio_err,"unknown option %s\n",*argv);
  525. badops=1;
  526. break;
  527. }
  528. argc--;
  529. argv++;
  530. }
  531. if (badops)
  532. {
  533. const char **pp2;
  534. for (pp2=ca_usage; (*pp2 != NULL); pp2++)
  535. BIO_printf(bio_err,"%s",*pp2);
  536. goto err;
  537. }
  538. ERR_load_crypto_strings();
  539. /*****************************************************************/
  540. tofree=NULL;
  541. if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
  542. if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
  543. if (configfile == NULL)
  544. {
  545. const char *s=X509_get_default_cert_area();
  546. size_t len;
  547. #ifdef OPENSSL_SYS_VMS
  548. len = strlen(s)+sizeof(CONFIG_FILE);
  549. tofree=OPENSSL_malloc(len);
  550. strcpy(tofree,s);
  551. #else
  552. len = strlen(s)+sizeof(CONFIG_FILE)+1;
  553. tofree=OPENSSL_malloc(len);
  554. BUF_strlcpy(tofree,s,len);
  555. BUF_strlcat(tofree,"/",len);
  556. #endif
  557. BUF_strlcat(tofree,CONFIG_FILE,len);
  558. configfile=tofree;
  559. }
  560. BIO_printf(bio_err,"Using configuration from %s\n",configfile);
  561. conf = NCONF_new(NULL);
  562. if (NCONF_load(conf,configfile,&errorline) <= 0)
  563. {
  564. if (errorline <= 0)
  565. BIO_printf(bio_err,"error loading the config file '%s'\n",
  566. configfile);
  567. else
  568. BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
  569. ,errorline,configfile);
  570. goto err;
  571. }
  572. if(tofree)
  573. {
  574. OPENSSL_free(tofree);
  575. tofree = NULL;
  576. }
  577. if (!load_config(bio_err, conf))
  578. goto err;
  579. #ifndef OPENSSL_NO_ENGINE
  580. e = setup_engine(bio_err, engine, 0);
  581. #endif
  582. /* Lets get the config section we are using */
  583. if (section == NULL)
  584. {
  585. section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
  586. if (section == NULL)
  587. {
  588. lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
  589. goto err;
  590. }
  591. }
  592. if (conf != NULL)
  593. {
  594. p=NCONF_get_string(conf,NULL,"oid_file");
  595. if (p == NULL)
  596. ERR_clear_error();
  597. if (p != NULL)
  598. {
  599. BIO *oid_bio;
  600. oid_bio=BIO_new_file(p,"r");
  601. if (oid_bio == NULL)
  602. {
  603. /*
  604. BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
  605. ERR_print_errors(bio_err);
  606. */
  607. ERR_clear_error();
  608. }
  609. else
  610. {
  611. OBJ_create_objects(oid_bio);
  612. BIO_free(oid_bio);
  613. }
  614. }
  615. if (!add_oid_section(bio_err,conf))
  616. {
  617. ERR_print_errors(bio_err);
  618. goto err;
  619. }
  620. }
  621. randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
  622. if (randfile == NULL)
  623. ERR_clear_error();
  624. app_RAND_load_file(randfile, bio_err, 0);
  625. f = NCONF_get_string(conf, section, STRING_MASK);
  626. if (!f)
  627. ERR_clear_error();
  628. if(f && !ASN1_STRING_set_default_mask_asc(f)) {
  629. BIO_printf(bio_err, "Invalid global string mask setting %s\n", f);
  630. goto err;
  631. }
  632. if (chtype != MBSTRING_UTF8){
  633. f = NCONF_get_string(conf, section, UTF8_IN);
  634. if (!f)
  635. ERR_clear_error();
  636. else if (!strcmp(f, "yes"))
  637. chtype = MBSTRING_UTF8;
  638. }
  639. db_attr.unique_subject = 1;
  640. p = NCONF_get_string(conf, section, ENV_UNIQUE_SUBJECT);
  641. if (p)
  642. {
  643. #ifdef RL_DEBUG
  644. BIO_printf(bio_err, "DEBUG: unique_subject = \"%s\"\n", p);
  645. #endif
  646. db_attr.unique_subject = parse_yesno(p,1);
  647. }
  648. else
  649. ERR_clear_error();
  650. #ifdef RL_DEBUG
  651. if (!p)
  652. BIO_printf(bio_err, "DEBUG: unique_subject undefined\n", p);
  653. #endif
  654. #ifdef RL_DEBUG
  655. BIO_printf(bio_err, "DEBUG: configured unique_subject is %d\n",
  656. db_attr.unique_subject);
  657. #endif
  658. in=BIO_new(BIO_s_file());
  659. out=BIO_new(BIO_s_file());
  660. Sout=BIO_new(BIO_s_file());
  661. Cout=BIO_new(BIO_s_file());
  662. if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
  663. {
  664. ERR_print_errors(bio_err);
  665. goto err;
  666. }
  667. /*****************************************************************/
  668. /* report status of cert with serial number given on command line */
  669. if (ser_status)
  670. {
  671. if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
  672. {
  673. lookup_fail(section,ENV_DATABASE);
  674. goto err;
  675. }
  676. db = load_index(dbfile,&db_attr);
  677. if (db == NULL) goto err;
  678. if (!index_index(db)) goto err;
  679. if (get_certificate_status(ser_status,db) != 1)
  680. BIO_printf(bio_err,"Error verifying serial %s!\n",
  681. ser_status);
  682. goto err;
  683. }
  684. /*****************************************************************/
  685. /* we definitely need a private key, so let's get it */
  686. if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
  687. section,ENV_PRIVATE_KEY)) == NULL))
  688. {
  689. lookup_fail(section,ENV_PRIVATE_KEY);
  690. goto err;
  691. }
  692. if (!key)
  693. {
  694. free_key = 1;
  695. if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
  696. {
  697. BIO_printf(bio_err,"Error getting password\n");
  698. goto err;
  699. }
  700. }
  701. pkey = load_key(bio_err, keyfile, keyform, 0, key, e,
  702. "CA private key");
  703. if (key) OPENSSL_cleanse(key,strlen(key));
  704. if (pkey == NULL)
  705. {
  706. /* load_key() has already printed an appropriate message */
  707. goto err;
  708. }
  709. /*****************************************************************/
  710. /* we need a certificate */
  711. if (!selfsign || spkac_file || ss_cert_file || gencrl)
  712. {
  713. if ((certfile == NULL)
  714. && ((certfile=NCONF_get_string(conf,
  715. section,ENV_CERTIFICATE)) == NULL))
  716. {
  717. lookup_fail(section,ENV_CERTIFICATE);
  718. goto err;
  719. }
  720. x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
  721. "CA certificate");
  722. if (x509 == NULL)
  723. goto err;
  724. if (!X509_check_private_key(x509,pkey))
  725. {
  726. BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
  727. goto err;
  728. }
  729. }
  730. if (!selfsign) x509p = x509;
  731. f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
  732. if (f == NULL)
  733. ERR_clear_error();
  734. if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
  735. preserve=1;
  736. f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
  737. if (f == NULL)
  738. ERR_clear_error();
  739. if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
  740. msie_hack=1;
  741. f=NCONF_get_string(conf,section,ENV_NAMEOPT);
  742. if (f)
  743. {
  744. if (!set_name_ex(&nameopt, f))
  745. {
  746. BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
  747. goto err;
  748. }
  749. default_op = 0;
  750. }
  751. else
  752. ERR_clear_error();
  753. f=NCONF_get_string(conf,section,ENV_CERTOPT);
  754. if (f)
  755. {
  756. if (!set_cert_ex(&certopt, f))
  757. {
  758. BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
  759. goto err;
  760. }
  761. default_op = 0;
  762. }
  763. else
  764. ERR_clear_error();
  765. f=NCONF_get_string(conf,section,ENV_EXTCOPY);
  766. if (f)
  767. {
  768. if (!set_ext_copy(&ext_copy, f))
  769. {
  770. BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
  771. goto err;
  772. }
  773. }
  774. else
  775. ERR_clear_error();
  776. /*****************************************************************/
  777. /* lookup where to write new certificates */
  778. if ((outdir == NULL) && (req))
  779. {
  780. if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
  781. == NULL)
  782. {
  783. BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
  784. goto err;
  785. }
  786. #ifndef OPENSSL_SYS_VMS
  787. /* outdir is a directory spec, but access() for VMS demands a
  788. filename. In any case, stat(), below, will catch the problem
  789. if outdir is not a directory spec, and the fopen() or open()
  790. will catch an error if there is no write access.
  791. Presumably, this problem could also be solved by using the DEC
  792. C routines to convert the directory syntax to Unixly, and give
  793. that to access(). However, time's too short to do that just
  794. now.
  795. */
  796. #ifndef _WIN32
  797. if (access(outdir,R_OK|W_OK|X_OK) != 0)
  798. #else
  799. if (_access(outdir,R_OK|W_OK|X_OK) != 0)
  800. #endif
  801. {
  802. BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
  803. perror(outdir);
  804. goto err;
  805. }
  806. if (app_isdir(outdir)<=0)
  807. {
  808. BIO_printf(bio_err,"%s need to be a directory\n",outdir);
  809. perror(outdir);
  810. goto err;
  811. }
  812. #endif
  813. }
  814. /*****************************************************************/
  815. /* we need to load the database file */
  816. if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
  817. {
  818. lookup_fail(section,ENV_DATABASE);
  819. goto err;
  820. }
  821. db = load_index(dbfile, &db_attr);
  822. if (db == NULL) goto err;
  823. /* Lets check some fields */
  824. for (i=0; i<sk_OPENSSL_PSTRING_num(db->db->data); i++)
  825. {
  826. pp=sk_OPENSSL_PSTRING_value(db->db->data,i);
  827. if ((pp[DB_type][0] != DB_TYPE_REV) &&
  828. (pp[DB_rev_date][0] != '\0'))
  829. {
  830. BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
  831. goto err;
  832. }
  833. if ((pp[DB_type][0] == DB_TYPE_REV) &&
  834. !make_revoked(NULL, pp[DB_rev_date]))
  835. {
  836. BIO_printf(bio_err," in entry %d\n", i+1);
  837. goto err;
  838. }
  839. if (!check_time_format((char *)pp[DB_exp_date]))
  840. {
  841. BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
  842. goto err;
  843. }
  844. p=pp[DB_serial];
  845. j=strlen(p);
  846. if (*p == '-')
  847. {
  848. p++;
  849. j--;
  850. }
  851. if ((j&1) || (j < 2))
  852. {
  853. BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
  854. goto err;
  855. }
  856. while (*p)
  857. {
  858. if (!( ((*p >= '0') && (*p <= '9')) ||
  859. ((*p >= 'A') && (*p <= 'F')) ||
  860. ((*p >= 'a') && (*p <= 'f'))) )
  861. {
  862. BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
  863. goto err;
  864. }
  865. p++;
  866. }
  867. }
  868. if (verbose)
  869. {
  870. BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
  871. #ifdef OPENSSL_SYS_VMS
  872. {
  873. BIO *tmpbio = BIO_new(BIO_f_linebuffer());
  874. out = BIO_push(tmpbio, out);
  875. }
  876. #endif
  877. TXT_DB_write(out,db->db);
  878. BIO_printf(bio_err,"%d entries loaded from the database\n",
  879. sk_OPENSSL_PSTRING_num(db->db->data));
  880. BIO_printf(bio_err,"generating index\n");
  881. }
  882. if (!index_index(db)) goto err;
  883. /*****************************************************************/
  884. /* Update the db file for expired certificates */
  885. if (doupdatedb)
  886. {
  887. if (verbose)
  888. BIO_printf(bio_err, "Updating %s ...\n",
  889. dbfile);
  890. i = do_updatedb(db);
  891. if (i == -1)
  892. {
  893. BIO_printf(bio_err,"Malloc failure\n");
  894. goto err;
  895. }
  896. else if (i == 0)
  897. {
  898. if (verbose) BIO_printf(bio_err,
  899. "No entries found to mark expired\n");
  900. }
  901. else
  902. {
  903. if (!save_index(dbfile,"new",db)) goto err;
  904. if (!rotate_index(dbfile,"new","old")) goto err;
  905. if (verbose) BIO_printf(bio_err,
  906. "Done. %d entries marked as expired\n",i);
  907. }
  908. }
  909. /*****************************************************************/
  910. /* Read extentions config file */
  911. if (extfile)
  912. {
  913. extconf = NCONF_new(NULL);
  914. if (NCONF_load(extconf,extfile,&errorline) <= 0)
  915. {
  916. if (errorline <= 0)
  917. BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
  918. extfile);
  919. else
  920. BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
  921. errorline,extfile);
  922. ret = 1;
  923. goto err;
  924. }
  925. if (verbose)
  926. BIO_printf(bio_err, "Successfully loaded extensions file %s\n", extfile);
  927. /* We can have sections in the ext file */
  928. if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
  929. extensions = "default";
  930. }
  931. /*****************************************************************/
  932. if (req || gencrl)
  933. {
  934. if (outfile != NULL)
  935. {
  936. if (BIO_write_filename(Sout,outfile) <= 0)
  937. {
  938. perror(outfile);
  939. goto err;
  940. }
  941. }
  942. else
  943. {
  944. BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
  945. #ifdef OPENSSL_SYS_VMS
  946. {
  947. BIO *tmpbio = BIO_new(BIO_f_linebuffer());
  948. Sout = BIO_push(tmpbio, Sout);
  949. }
  950. #endif
  951. }
  952. }
  953. if ((md == NULL) && ((md=NCONF_get_string(conf,
  954. section,ENV_DEFAULT_MD)) == NULL))
  955. {
  956. lookup_fail(section,ENV_DEFAULT_MD);
  957. goto err;
  958. }
  959. if (!strcmp(md, "default"))
  960. {
  961. int def_nid;
  962. if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0)
  963. {
  964. BIO_puts(bio_err,"no default digest\n");
  965. goto err;
  966. }
  967. md = (char *)OBJ_nid2sn(def_nid);
  968. }
  969. if ((dgst=EVP_get_digestbyname(md)) == NULL)
  970. {
  971. BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
  972. goto err;
  973. }
  974. if (req)
  975. {
  976. if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
  977. section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
  978. {
  979. if(strcmp(tmp_email_dn,"no") == 0)
  980. email_dn=0;
  981. }
  982. if (verbose)
  983. BIO_printf(bio_err,"message digest is %s\n",
  984. OBJ_nid2ln(dgst->type));
  985. if ((policy == NULL) && ((policy=NCONF_get_string(conf,
  986. section,ENV_POLICY)) == NULL))
  987. {
  988. lookup_fail(section,ENV_POLICY);
  989. goto err;
  990. }
  991. if (verbose)
  992. BIO_printf(bio_err,"policy is %s\n",policy);
  993. if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
  994. == NULL)
  995. {
  996. lookup_fail(section,ENV_SERIAL);
  997. goto err;
  998. }
  999. if (!extconf)
  1000. {
  1001. /* no '-extfile' option, so we look for extensions
  1002. * in the main configuration file */
  1003. if (!extensions)
  1004. {
  1005. extensions=NCONF_get_string(conf,section,
  1006. ENV_EXTENSIONS);
  1007. if (!extensions)
  1008. ERR_clear_error();
  1009. }
  1010. if (extensions)
  1011. {
  1012. /* Check syntax of file */
  1013. X509V3_CTX ctx;
  1014. X509V3_set_ctx_test(&ctx);
  1015. X509V3_set_nconf(&ctx, conf);
  1016. if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
  1017. NULL))
  1018. {
  1019. BIO_printf(bio_err,
  1020. "Error Loading extension section %s\n",
  1021. extensions);
  1022. ret = 1;
  1023. goto err;
  1024. }
  1025. }
  1026. }
  1027. if (startdate == NULL)
  1028. {
  1029. startdate=NCONF_get_string(conf,section,
  1030. ENV_DEFAULT_STARTDATE);
  1031. if (startdate == NULL)
  1032. ERR_clear_error();
  1033. }
  1034. if (startdate && !ASN1_TIME_set_string(NULL, startdate))
  1035. {
  1036. BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
  1037. goto err;
  1038. }
  1039. if (startdate == NULL) startdate="today";
  1040. if (enddate == NULL)
  1041. {
  1042. enddate=NCONF_get_string(conf,section,
  1043. ENV_DEFAULT_ENDDATE);
  1044. if (enddate == NULL)
  1045. ERR_clear_error();
  1046. }
  1047. if (enddate && !ASN1_TIME_set_string(NULL, enddate))
  1048. {
  1049. BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
  1050. goto err;
  1051. }
  1052. if (days == 0)
  1053. {
  1054. if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
  1055. days = 0;
  1056. }
  1057. if (!enddate && (days == 0))
  1058. {
  1059. BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
  1060. goto err;
  1061. }
  1062. if ((serial=load_serial(serialfile, create_ser, NULL)) == NULL)
  1063. {
  1064. BIO_printf(bio_err,"error while loading serial number\n");
  1065. goto err;
  1066. }
  1067. if (verbose)
  1068. {
  1069. if (BN_is_zero(serial))
  1070. BIO_printf(bio_err,"next serial number is 00\n");
  1071. else
  1072. {
  1073. if ((f=BN_bn2hex(serial)) == NULL) goto err;
  1074. BIO_printf(bio_err,"next serial number is %s\n",f);
  1075. OPENSSL_free(f);
  1076. }
  1077. }
  1078. if ((attribs=NCONF_get_section(conf,policy)) == NULL)
  1079. {
  1080. BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
  1081. goto err;
  1082. }
  1083. if ((cert_sk=sk_X509_new_null()) == NULL)
  1084. {
  1085. BIO_printf(bio_err,"Memory allocation failure\n");
  1086. goto err;
  1087. }
  1088. if (spkac_file != NULL)
  1089. {
  1090. total++;
  1091. j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
  1092. serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,extensions,
  1093. conf,verbose,certopt,nameopt,default_op,ext_copy);
  1094. if (j < 0) goto err;
  1095. if (j > 0)
  1096. {
  1097. total_done++;
  1098. BIO_printf(bio_err,"\n");
  1099. if (!BN_add_word(serial,1)) goto err;
  1100. if (!sk_X509_push(cert_sk,x))
  1101. {
  1102. BIO_printf(bio_err,"Memory allocation failure\n");
  1103. goto err;
  1104. }
  1105. if (outfile)
  1106. {
  1107. output_der = 1;
  1108. batch = 1;
  1109. }
  1110. }
  1111. }
  1112. if (ss_cert_file != NULL)
  1113. {
  1114. total++;
  1115. j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
  1116. db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
  1117. extensions,conf,verbose, certopt, nameopt,
  1118. default_op, ext_copy, e);
  1119. if (j < 0) goto err;
  1120. if (j > 0)
  1121. {
  1122. total_done++;
  1123. BIO_printf(bio_err,"\n");
  1124. if (!BN_add_word(serial,1)) goto err;
  1125. if (!sk_X509_push(cert_sk,x))
  1126. {
  1127. BIO_printf(bio_err,"Memory allocation failure\n");
  1128. goto err;
  1129. }
  1130. }
  1131. }
  1132. if (infile != NULL)
  1133. {
  1134. total++;
  1135. j=certify(&x,infile,pkey,x509p,dgst,attribs,db,
  1136. serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
  1137. extensions,conf,verbose, certopt, nameopt,
  1138. default_op, ext_copy, selfsign);
  1139. if (j < 0) goto err;
  1140. if (j > 0)
  1141. {
  1142. total_done++;
  1143. BIO_printf(bio_err,"\n");
  1144. if (!BN_add_word(serial,1)) goto err;
  1145. if (!sk_X509_push(cert_sk,x))
  1146. {
  1147. BIO_printf(bio_err,"Memory allocation failure\n");
  1148. goto err;
  1149. }
  1150. }
  1151. }
  1152. for (i=0; i<argc; i++)
  1153. {
  1154. total++;
  1155. j=certify(&x,argv[i],pkey,x509p,dgst,attribs,db,
  1156. serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
  1157. extensions,conf,verbose, certopt, nameopt,
  1158. default_op, ext_copy, selfsign);
  1159. if (j < 0) goto err;
  1160. if (j > 0)
  1161. {
  1162. total_done++;
  1163. BIO_printf(bio_err,"\n");
  1164. if (!BN_add_word(serial,1)) goto err;
  1165. if (!sk_X509_push(cert_sk,x))
  1166. {
  1167. BIO_printf(bio_err,"Memory allocation failure\n");
  1168. goto err;
  1169. }
  1170. }
  1171. }
  1172. /* we have a stack of newly certified certificates
  1173. * and a data base and serial number that need
  1174. * updating */
  1175. if (sk_X509_num(cert_sk) > 0)
  1176. {
  1177. if (!batch)
  1178. {
  1179. BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
  1180. (void)BIO_flush(bio_err);
  1181. buf[0][0]='\0';
  1182. fgets(buf[0],10,stdin);
  1183. if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
  1184. {
  1185. BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
  1186. ret=0;
  1187. goto err;
  1188. }
  1189. }
  1190. BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
  1191. if (!save_serial(serialfile,"new",serial,NULL)) goto err;
  1192. if (!save_index(dbfile, "new", db)) goto err;
  1193. }
  1194. if (verbose)
  1195. BIO_printf(bio_err,"writing new certificates\n");
  1196. for (i=0; i<sk_X509_num(cert_sk); i++)
  1197. {
  1198. int k;
  1199. char *n;
  1200. x=sk_X509_value(cert_sk,i);
  1201. j=x->cert_info->serialNumber->length;
  1202. p=(const char *)x->cert_info->serialNumber->data;
  1203. if(strlen(outdir) >= (size_t)(j ? BSIZE-j*2-6 : BSIZE-8))
  1204. {
  1205. BIO_printf(bio_err,"certificate file name too long\n");
  1206. goto err;
  1207. }
  1208. strcpy(buf[2],outdir);
  1209. #ifndef OPENSSL_SYS_VMS
  1210. BUF_strlcat(buf[2],"/",sizeof(buf[2]));
  1211. #endif
  1212. n=(char *)&(buf[2][strlen(buf[2])]);
  1213. if (j > 0)
  1214. {
  1215. for (k=0; k<j; k++)
  1216. {
  1217. if (n >= &(buf[2][sizeof(buf[2])]))
  1218. break;
  1219. BIO_snprintf(n,
  1220. &buf[2][0] + sizeof(buf[2]) - n,
  1221. "%02X",(unsigned char)*(p++));
  1222. n+=2;
  1223. }
  1224. }
  1225. else
  1226. {
  1227. *(n++)='0';
  1228. *(n++)='0';
  1229. }
  1230. *(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
  1231. *n='\0';
  1232. if (verbose)
  1233. BIO_printf(bio_err,"writing %s\n",buf[2]);
  1234. if (BIO_write_filename(Cout,buf[2]) <= 0)
  1235. {
  1236. perror(buf[2]);
  1237. goto err;
  1238. }
  1239. write_new_certificate(Cout,x, 0, notext);
  1240. write_new_certificate(Sout,x, output_der, notext);
  1241. }
  1242. if (sk_X509_num(cert_sk))
  1243. {
  1244. /* Rename the database and the serial file */
  1245. if (!rotate_serial(serialfile,"new","old")) goto err;
  1246. if (!rotate_index(dbfile,"new","old")) goto err;
  1247. BIO_printf(bio_err,"Data Base Updated\n");
  1248. }
  1249. }
  1250. /*****************************************************************/
  1251. if (gencrl)
  1252. {
  1253. int crl_v2 = 0;
  1254. if (!crl_ext)
  1255. {
  1256. crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
  1257. if (!crl_ext)
  1258. ERR_clear_error();
  1259. }
  1260. if (crl_ext)
  1261. {
  1262. /* Check syntax of file */
  1263. X509V3_CTX ctx;
  1264. X509V3_set_ctx_test(&ctx);
  1265. X509V3_set_nconf(&ctx, conf);
  1266. if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
  1267. {
  1268. BIO_printf(bio_err,
  1269. "Error Loading CRL extension section %s\n",
  1270. crl_ext);
  1271. ret = 1;
  1272. goto err;
  1273. }
  1274. }
  1275. if ((crlnumberfile=NCONF_get_string(conf,section,ENV_CRLNUMBER))
  1276. != NULL)
  1277. if ((crlnumber=load_serial(crlnumberfile,0,NULL)) == NULL)
  1278. {
  1279. BIO_printf(bio_err,"error while loading CRL number\n");
  1280. goto err;
  1281. }
  1282. if (!crldays && !crlhours && !crlsec)
  1283. {
  1284. if (!NCONF_get_number(conf,section,
  1285. ENV_DEFAULT_CRL_DAYS, &crldays))
  1286. crldays = 0;
  1287. if (!NCONF_get_number(conf,section,
  1288. ENV_DEFAULT_CRL_HOURS, &crlhours))
  1289. crlhours = 0;
  1290. }
  1291. if ((crldays == 0) && (crlhours == 0) && (crlsec == 0))
  1292. {
  1293. BIO_printf(bio_err,"cannot lookup how long until the next CRL is issued\n");
  1294. goto err;
  1295. }
  1296. if (verbose) BIO_printf(bio_err,"making CRL\n");
  1297. if ((crl=X509_CRL_new()) == NULL) goto err;
  1298. if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509))) goto err;
  1299. tmptm = ASN1_TIME_new();
  1300. if (!tmptm) goto err;
  1301. X509_gmtime_adj(tmptm,0);
  1302. X509_CRL_set_lastUpdate(crl, tmptm);
  1303. if (!X509_time_adj_ex(tmptm, crldays, crlhours*60*60 + crlsec,
  1304. NULL))
  1305. {
  1306. BIO_puts(bio_err, "error setting CRL nextUpdate\n");
  1307. goto err;
  1308. }
  1309. X509_CRL_set_nextUpdate(crl, tmptm);
  1310. ASN1_TIME_free(tmptm);
  1311. for (i=0; i<sk_OPENSSL_PSTRING_num(db->db->data); i++)
  1312. {
  1313. pp=sk_OPENSSL_PSTRING_value(db->db->data,i);
  1314. if (pp[DB_type][0] == DB_TYPE_REV)
  1315. {
  1316. if ((r=X509_REVOKED_new()) == NULL) goto err;
  1317. j = make_revoked(r, pp[DB_rev_date]);
  1318. if (!j) goto err;
  1319. if (j == 2) crl_v2 = 1;
  1320. if (!BN_hex2bn(&serial, pp[DB_serial]))
  1321. goto err;
  1322. tmpser = BN_to_ASN1_INTEGER(serial, NULL);
  1323. BN_free(serial);
  1324. serial = NULL;
  1325. if (!tmpser)
  1326. goto err;
  1327. X509_REVOKED_set_serialNumber(r, tmpser);
  1328. ASN1_INTEGER_free(tmpser);
  1329. X509_CRL_add0_revoked(crl,r);
  1330. }
  1331. }
  1332. /* sort the data so it will be written in serial
  1333. * number order */
  1334. X509_CRL_sort(crl);
  1335. /* we now have a CRL */
  1336. if (verbose) BIO_printf(bio_err,"signing CRL\n");
  1337. /* Add any extensions asked for */
  1338. if (crl_ext || crlnumberfile != NULL)
  1339. {
  1340. X509V3_CTX crlctx;
  1341. X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
  1342. X509V3_set_nconf(&crlctx, conf);
  1343. if (crl_ext)
  1344. if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
  1345. crl_ext, crl)) goto err;
  1346. if (crlnumberfile != NULL)
  1347. {
  1348. tmpser = BN_to_ASN1_INTEGER(crlnumber, NULL);
  1349. if (!tmpser) goto err;
  1350. X509_CRL_add1_ext_i2d(crl,NID_crl_number,tmpser,0,0);
  1351. ASN1_INTEGER_free(tmpser);
  1352. crl_v2 = 1;
  1353. if (!BN_add_word(crlnumber,1)) goto err;
  1354. }
  1355. }
  1356. if (crl_ext || crl_v2)
  1357. {
  1358. if (!X509_CRL_set_version(crl, 1))
  1359. goto err; /* version 2 CRL */
  1360. }
  1361. if (crlnumberfile != NULL) /* we have a CRL number that need updating */
  1362. if (!save_serial(crlnumberfile,"new",crlnumber,NULL)) goto err;
  1363. if (crlnumber)
  1364. {
  1365. BN_free(crlnumber);
  1366. crlnumber = NULL;
  1367. }
  1368. if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
  1369. PEM_write_bio_X509_CRL(Sout,crl);
  1370. if (crlnumberfile != NULL) /* Rename the crlnumber file */
  1371. if (!rotate_serial(crlnumberfile,"new","old")) goto err;
  1372. }
  1373. /*****************************************************************/
  1374. if (dorevoke)
  1375. {
  1376. if (infile == NULL)
  1377. {
  1378. BIO_printf(bio_err,"no input files\n");
  1379. goto err;
  1380. }
  1381. else
  1382. {
  1383. X509 *revcert;
  1384. revcert=load_cert(bio_err, infile, FORMAT_PEM,
  1385. NULL, e, infile);
  1386. if (revcert == NULL)
  1387. goto err;
  1388. j=do_revoke(revcert,db, rev_type, rev_arg);
  1389. if (j <= 0) goto err;
  1390. X509_free(revcert);
  1391. if (!save_index(dbfile, "new", db)) goto err;
  1392. if (!rotate_index(dbfile, "new", "old")) goto err;
  1393. BIO_printf(bio_err,"Data Base Updated\n");
  1394. }
  1395. }
  1396. /*****************************************************************/
  1397. ret=0;
  1398. err:
  1399. if(tofree)
  1400. OPENSSL_free(tofree);
  1401. BIO_free_all(Cout);
  1402. BIO_free_all(Sout);
  1403. BIO_free_all(out);
  1404. BIO_free_all(in);
  1405. if (cert_sk)
  1406. sk_X509_pop_free(cert_sk,X509_free);
  1407. if (ret) ERR_print_errors(bio_err);
  1408. app_RAND_write_file(randfile, bio_err);
  1409. if (free_key && key)
  1410. OPENSSL_free(key);
  1411. BN_free(serial);
  1412. BN_free(crlnumber);
  1413. free_index(db);
  1414. EVP_PKEY_free(pkey);
  1415. if (x509) X509_free(x509);
  1416. X509_CRL_free(crl);
  1417. NCONF_free(conf);
  1418. NCONF_free(extconf);
  1419. OBJ_cleanup();
  1420. apps_shutdown();
  1421. OPENSSL_EXIT(ret);
  1422. }
  1423. static void lookup_fail(const char *name, const char *tag)
  1424. {
  1425. BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
  1426. }
  1427. static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
  1428. const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  1429. BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
  1430. long days, int batch, char *ext_sect, CONF *lconf, int verbose,
  1431. unsigned long certopt, unsigned long nameopt, int default_op,
  1432. int ext_copy, int selfsign)
  1433. {
  1434. X509_REQ *req=NULL;
  1435. BIO *in=NULL;
  1436. EVP_PKEY *pktmp=NULL;
  1437. int ok= -1,i;
  1438. in=BIO_new(BIO_s_file());
  1439. if (BIO_read_filename(in,infile) <= 0)
  1440. {
  1441. perror(infile);
  1442. goto err;
  1443. }
  1444. if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
  1445. {
  1446. BIO_printf(bio_err,"Error reading certificate request in %s\n",
  1447. infile);
  1448. goto err;
  1449. }
  1450. if (verbose)
  1451. X509_REQ_print(bio_err,req);
  1452. BIO_printf(bio_err,"Check that the request matches the signature\n");
  1453. if (selfsign && !X509_REQ_check_private_key(req,pkey))
  1454. {
  1455. BIO_printf(bio_err,"Certificate request and CA private key do not match\n");
  1456. ok=0;
  1457. goto err;
  1458. }
  1459. if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
  1460. {
  1461. BIO_printf(bio_err,"error unpacking public key\n");
  1462. goto err;
  1463. }
  1464. i=X509_REQ_verify(req,pktmp);
  1465. EVP_PKEY_free(pktmp);
  1466. if (i < 0)
  1467. {
  1468. ok=0;
  1469. BIO_printf(bio_err,"Signature verification problems....\n");
  1470. goto err;
  1471. }
  1472. if (i == 0)
  1473. {
  1474. ok=0;
  1475. BIO_printf(bio_err,"Signature did not match the certificate request\n");
  1476. goto err;
  1477. }
  1478. else
  1479. BIO_printf(bio_err,"Signature ok\n");
  1480. ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn, email_dn,
  1481. startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
  1482. certopt, nameopt, default_op, ext_copy, selfsign);
  1483. err:
  1484. if (req != NULL) X509_REQ_free(req);
  1485. if (in != NULL) BIO_free(in);
  1486. return(ok);
  1487. }
  1488. static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
  1489. const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  1490. BIGNUM *serial, char *subj, unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
  1491. long days, int batch, char *ext_sect, CONF *lconf, int verbose,
  1492. unsigned long certopt, unsigned long nameopt, int default_op,
  1493. int ext_copy, ENGINE *e)
  1494. {
  1495. X509 *req=NULL;
  1496. X509_REQ *rreq=NULL;
  1497. EVP_PKEY *pktmp=NULL;
  1498. int ok= -1,i;
  1499. if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
  1500. goto err;
  1501. if (verbose)
  1502. X509_print(bio_err,req);
  1503. BIO_printf(bio_err,"Check that the request matches the signature\n");
  1504. if ((pktmp=X509_get_pubkey(req)) == NULL)
  1505. {
  1506. BIO_printf(bio_err,"error unpacking public key\n");
  1507. goto err;
  1508. }
  1509. i=X509_verify(req,pktmp);
  1510. EVP_PKEY_free(pktmp);
  1511. if (i < 0)
  1512. {
  1513. ok=0;
  1514. BIO_printf(bio_err,"Signature verification problems....\n");
  1515. goto err;
  1516. }
  1517. if (i == 0)
  1518. {
  1519. ok=0;
  1520. BIO_printf(bio_err,"Signature did not match the certificate\n");
  1521. goto err;
  1522. }
  1523. else
  1524. BIO_printf(bio_err,"Signature ok\n");
  1525. if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
  1526. goto err;
  1527. ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
  1528. days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
  1529. ext_copy, 0);
  1530. err:
  1531. if (rreq != NULL) X509_REQ_free(rreq);
  1532. if (req != NULL) X509_free(req);
  1533. return(ok);
  1534. }
  1535. static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
  1536. STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
  1537. unsigned long chtype, int multirdn,
  1538. int email_dn, char *startdate, char *enddate, long days, int batch,
  1539. int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
  1540. unsigned long certopt, unsigned long nameopt, int default_op,
  1541. int ext_copy, int selfsign)
  1542. {
  1543. X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
  1544. ASN1_UTCTIME *tm,*tmptm;
  1545. ASN1_STRING *str,*str2;
  1546. ASN1_OBJECT *obj;
  1547. X509 *ret=NULL;
  1548. X509_CINF *ci;
  1549. X509_NAME_ENTRY *ne;
  1550. X509_NAME_ENTRY *tne,*push;
  1551. EVP_PKEY *pktmp;
  1552. int ok= -1,i,j,last,nid;
  1553. const char *p;
  1554. CONF_VALUE *cv;
  1555. OPENSSL_STRING row[DB_NUMBER];
  1556. OPENSSL_STRING *irow=NULL;
  1557. OPENSSL_STRING *rrow=NULL;
  1558. char buf[25];
  1559. tmptm=ASN1_UTCTIME_new();
  1560. if (tmptm == NULL)
  1561. {
  1562. BIO_printf(bio_err,"malloc error\n");
  1563. return(0);
  1564. }
  1565. for (i=0; i<DB_NUMBER; i++)
  1566. row[i]=NULL;
  1567. if (subj)
  1568. {
  1569. X509_NAME *n = parse_name(subj, chtype, multirdn);
  1570. if (!n)
  1571. {
  1572. ERR_print_errors(bio_err);
  1573. goto err;
  1574. }
  1575. X509_REQ_set_subject_name(req,n);
  1576. req->req_info->enc.modified = 1;
  1577. X509_NAME_free(n);
  1578. }
  1579. if (default_op)
  1580. BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
  1581. name=X509_REQ_get_subject_name(req);
  1582. for (i=0; i<X509_NAME_entry_count(name); i++)
  1583. {
  1584. ne= X509_NAME_get_entry(name,i);
  1585. str=X509_NAME_ENTRY_get_data(ne);
  1586. obj=X509_NAME_ENTRY_get_object(ne);
  1587. if (msie_hack)
  1588. {
  1589. /* assume all type should be strings */
  1590. nid=OBJ_obj2nid(ne->object);
  1591. if (str->type == V_ASN1_UNIVERSALSTRING)
  1592. ASN1_UNIVERSALSTRING_to_string(str);
  1593. if ((str->type == V_ASN1_IA5STRING) &&
  1594. (nid != NID_pkcs9_emailAddress))
  1595. str->type=V_ASN1_T61STRING;
  1596. if ((nid == NID_pkcs9_emailAddress) &&
  1597. (str->type == V_ASN1_PRINTABLESTRING))
  1598. str->type=V_ASN1_IA5STRING;
  1599. }
  1600. /* If no EMAIL is wanted in the subject */
  1601. if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
  1602. continue;
  1603. /* check some things */
  1604. if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
  1605. (str->type != V_ASN1_IA5STRING))
  1606. {
  1607. BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
  1608. goto err;
  1609. }
  1610. if ((str->type != V_ASN1_BMPSTRING) && (str->type != V_ASN1_UTF8STRING))
  1611. {
  1612. j=ASN1_PRINTABLE_type(str->data,str->length);
  1613. if ( ((j == V_ASN1_T61STRING) &&
  1614. (str->type != V_ASN1_T61STRING)) ||
  1615. ((j == V_ASN1_IA5STRING) &&
  1616. (str->type == V_ASN1_PRINTABLESTRING)))
  1617. {
  1618. BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
  1619. goto err;
  1620. }
  1621. }
  1622. if (default_op)
  1623. old_entry_print(bio_err, obj, str);
  1624. }
  1625. /* Ok, now we check the 'policy' stuff. */
  1626. if ((subject=X509_NAME_new()) == NULL)
  1627. {
  1628. BIO_printf(bio_err,"Memory allocation failure\n");
  1629. goto err;
  1630. }
  1631. /* take a copy of the issuer name before we mess with it. */
  1632. if (selfsign)
  1633. CAname=X509_NAME_dup(name);
  1634. else
  1635. CAname=X509_NAME_dup(x509->cert_info->subject);
  1636. if (CAname == NULL) goto err;
  1637. str=str2=NULL;
  1638. for (i=0; i<sk_CONF_VALUE_num(policy); i++)
  1639. {
  1640. cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
  1641. if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
  1642. {
  1643. BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
  1644. goto err;
  1645. }
  1646. obj=OBJ_nid2obj(j);
  1647. last= -1;
  1648. for (;;)
  1649. {
  1650. /* lookup the object in the supplied name list */
  1651. j=X509_NAME_get_index_by_OBJ(name,obj,last);
  1652. if (j < 0)
  1653. {
  1654. if (last != -1) break;
  1655. tne=NULL;
  1656. }
  1657. else
  1658. {
  1659. tne=X509_NAME_get_entry(name,j);
  1660. }
  1661. last=j;
  1662. /* depending on the 'policy', decide what to do. */
  1663. push=NULL;
  1664. if (strcmp(cv->value,"optional") == 0)
  1665. {
  1666. if (tne != NULL)
  1667. push=tne;
  1668. }
  1669. else if (strcmp(cv->value,"supplied") == 0)
  1670. {
  1671. if (tne == NULL)
  1672. {
  1673. BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
  1674. goto err;
  1675. }
  1676. else
  1677. push=tne;
  1678. }
  1679. else if (strcmp(cv->value,"match") == 0)
  1680. {
  1681. int last2;
  1682. if (tne == NULL)
  1683. {
  1684. BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
  1685. goto err;
  1686. }
  1687. last2= -1;
  1688. again2:
  1689. j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
  1690. if ((j < 0) && (last2 == -1))
  1691. {
  1692. BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
  1693. goto err;
  1694. }
  1695. if (j >= 0)
  1696. {
  1697. push=X509_NAME_get_entry(CAname,j);
  1698. str=X509_NAME_ENTRY_get_data(tne);
  1699. str2=X509_NAME_ENTRY_get_data(push);
  1700. last2=j;
  1701. if (ASN1_STRING_cmp(str,str2) != 0)
  1702. goto again2;
  1703. }
  1704. if (j < 0)
  1705. {
  1706. BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
  1707. goto err;
  1708. }
  1709. }
  1710. else
  1711. {
  1712. BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
  1713. goto err;
  1714. }
  1715. if (push != NULL)
  1716. {
  1717. if (!X509_NAME_add_entry(subject,push, -1, 0))
  1718. {
  1719. if (push != NULL)
  1720. X509_NAME_ENTRY_free(push);
  1721. BIO_printf(bio_err,"Memory allocation failure\n");
  1722. goto err;
  1723. }
  1724. }
  1725. if (j < 0) break;
  1726. }
  1727. }
  1728. if (preserve)
  1729. {
  1730. X509_NAME_free(subject);
  1731. /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
  1732. subject=X509_NAME_dup(name);
  1733. if (subject == NULL) goto err;
  1734. }
  1735. if (verbose)
  1736. BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
  1737. /* Build the correct Subject if no e-mail is wanted in the subject */
  1738. /* and add it later on because of the method extensions are added (altName) */
  1739. if (email_dn)
  1740. dn_subject = subject;
  1741. else
  1742. {
  1743. X509_NAME_ENTRY *tmpne;
  1744. /* Its best to dup the subject DN and then delete any email
  1745. * addresses because this retains its structure.
  1746. */
  1747. if (!(dn_subject = X509_NAME_dup(subject)))
  1748. {
  1749. BIO_printf(bio_err,"Memory allocation failure\n");
  1750. goto err;
  1751. }
  1752. while((i = X509_NAME_get_index_by_NID(dn_subject,
  1753. NID_pkcs9_emailAddress, -1)) >= 0)
  1754. {
  1755. tmpne = X509_NAME_get_entry(dn_subject, i);
  1756. X509_NAME_delete_entry(dn_subject, i);
  1757. X509_NAME_ENTRY_free(tmpne);
  1758. }
  1759. }
  1760. if (BN_is_zero(serial))
  1761. row[DB_serial]=BUF_strdup("00");
  1762. else
  1763. row[DB_serial]=BN_bn2hex(serial);
  1764. if (row[DB_serial] == NULL)
  1765. {
  1766. BIO_printf(bio_err,"Memory allocation failure\n");
  1767. goto err;
  1768. }
  1769. if (db->attributes.unique_subject)
  1770. {
  1771. OPENSSL_STRING *crow=row;
  1772. rrow=TXT_DB_get_by_index(db->db,DB_name,crow);
  1773. if (rrow != NULL)
  1774. {
  1775. BIO_printf(bio_err,
  1776. "ERROR:There is already a certificate for %s\n",
  1777. row[DB_name]);
  1778. }
  1779. }
  1780. if (rrow == NULL)
  1781. {
  1782. rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
  1783. if (rrow != NULL)
  1784. {
  1785. BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
  1786. row[DB_serial]);
  1787. BIO_printf(bio_err," check the database/serial_file for corruption\n");
  1788. }
  1789. }
  1790. if (rrow != NULL)
  1791. {
  1792. BIO_printf(bio_err,
  1793. "The matching entry has the following details\n");
  1794. if (rrow[DB_type][0] == 'E')
  1795. p="Expired";
  1796. else if (rrow[DB_type][0] == 'R')
  1797. p="Revoked";
  1798. else if (rrow[DB_type][0] == 'V')
  1799. p="Valid";
  1800. else
  1801. p="\ninvalid type, Data base error\n";
  1802. BIO_printf(bio_err,"Type :%s\n",p);;
  1803. if (rrow[DB_type][0] == 'R')
  1804. {
  1805. p=rrow[DB_exp_date]; if (p == NULL) p="undef";
  1806. BIO_printf(bio_err,"Was revoked on:%s\n",p);
  1807. }
  1808. p=rrow[DB_exp_date]; if (p == NULL) p="undef";
  1809. BIO_printf(bio_err,"Expires on :%s\n",p);
  1810. p=rrow[DB_serial]; if (p == NULL) p="undef";
  1811. BIO_printf(bio_err,"Serial Number :%s\n",p);
  1812. p=rrow[DB_file]; if (p == NULL) p="undef";
  1813. BIO_printf(bio_err,"File name :%s\n",p);
  1814. p=rrow[DB_name]; if (p == NULL) p="undef";
  1815. BIO_printf(bio_err,"Subject Name :%s\n",p);
  1816. ok= -1; /* This is now a 'bad' error. */
  1817. goto err;
  1818. }
  1819. /* We are now totally happy, lets make and sign the certificate */
  1820. if (verbose)
  1821. BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
  1822. if ((ret=X509_new()) == NULL) goto err;
  1823. ci=ret->cert_info;
  1824. #ifdef X509_V3
  1825. /* Make it an X509 v3 certificate. */
  1826. if (!X509_set_version(ret,2)) goto err;
  1827. #endif
  1828. if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
  1829. goto err;
  1830. if (selfsign)
  1831. {
  1832. if (!X509_set_issuer_name(ret,subject))
  1833. goto err;
  1834. }
  1835. else
  1836. {
  1837. if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
  1838. goto err;
  1839. }
  1840. if (strcmp(startdate,"today") == 0)
  1841. X509_gmtime_adj(X509_get_notBefore(ret),0);
  1842. else ASN1_TIME_set_string(X509_get_notBefore(ret),startdate);
  1843. if (enddate == NULL)
  1844. X509_time_adj_ex(X509_get_notAfter(ret),days, 0, NULL);
  1845. else ASN1_TIME_set_string(X509_get_notAfter(ret),enddate);
  1846. if (!X509_set_subject_name(ret,subject)) goto err;
  1847. pktmp=X509_REQ_get_pubkey(req);
  1848. i = X509_set_pubkey(ret,pktmp);
  1849. EVP_PKEY_free(pktmp);
  1850. if (!i) goto err;
  1851. /* Lets add the extensions, if there are any */
  1852. if (ext_sect)
  1853. {
  1854. X509V3_CTX ctx;
  1855. if (ci->version == NULL)
  1856. if ((ci->version=ASN1_INTEGER_new()) == NULL)
  1857. goto err;
  1858. ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
  1859. /* Free the current entries if any, there should not
  1860. * be any I believe */
  1861. if (ci->extensions != NULL)
  1862. sk_X509_EXTENSION_pop_free(ci->extensions,
  1863. X509_EXTENSION_free);
  1864. ci->extensions = NULL;
  1865. /* Initialize the context structure */
  1866. if (selfsign)
  1867. X509V3_set_ctx(&ctx, ret, ret, req, NULL, 0);
  1868. else
  1869. X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
  1870. if (extconf)
  1871. {
  1872. if (verbose)
  1873. BIO_printf(bio_err, "Extra configuration file found\n");
  1874. /* Use the extconf configuration db LHASH */
  1875. X509V3_set_nconf(&ctx, extconf);
  1876. /* Test the structure (needed?) */
  1877. /* X509V3_set_ctx_test(&ctx); */
  1878. /* Adds exts contained in the configuration file */
  1879. if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
  1880. {
  1881. BIO_printf(bio_err,
  1882. "ERROR: adding extensions in section %s\n",
  1883. ext_sect);
  1884. ERR_print_errors(bio_err);
  1885. goto err;
  1886. }
  1887. if (verbose)
  1888. BIO_printf(bio_err, "Successfully added extensions from file.\n");
  1889. }
  1890. else if (ext_sect)
  1891. {
  1892. /* We found extensions to be set from config file */
  1893. X509V3_set_nconf(&ctx, lconf);
  1894. if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
  1895. {
  1896. BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
  1897. ERR_print_errors(bio_err);
  1898. goto err;
  1899. }
  1900. if (verbose)
  1901. BIO_printf(bio_err, "Successfully added extensions from config\n");
  1902. }
  1903. }
  1904. /* Copy extensions from request (if any) */
  1905. if (!copy_extensions(ret, req, ext_copy))
  1906. {
  1907. BIO_printf(bio_err, "ERROR: adding extensions from request\n");
  1908. ERR_print_errors(bio_err);
  1909. goto err;
  1910. }
  1911. /* Set the right value for the noemailDN option */
  1912. if( email_dn == 0 )
  1913. {
  1914. if (!X509_set_subject_name(ret,dn_subject)) goto err;
  1915. }
  1916. if (!default_op)
  1917. {
  1918. BIO_printf(bio_err, "Certificate Details:\n");
  1919. /* Never print signature details because signature not present */
  1920. certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
  1921. X509_print_ex(bio_err, ret, nameopt, certopt);
  1922. }
  1923. BIO_printf(bio_err,"Certificate is to be certified until ");
  1924. ASN1_TIME_print(bio_err,X509_get_notAfter(ret));
  1925. if (days) BIO_printf(bio_err," (%ld days)",days);
  1926. BIO_printf(bio_err, "\n");
  1927. if (!batch)
  1928. {
  1929. BIO_printf(bio_err,"Sign the certificate? [y/n]:");
  1930. (void)BIO_flush(bio_err);
  1931. buf[0]='\0';
  1932. fgets(buf,sizeof(buf)-1,stdin);
  1933. if (!((buf[0] == 'y') || (buf[0] == 'Y')))
  1934. {
  1935. BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
  1936. ok=0;
  1937. goto err;
  1938. }
  1939. }
  1940. pktmp=X509_get_pubkey(ret);
  1941. if (EVP_PKEY_missing_parameters(pktmp) &&
  1942. !EVP_PKEY_missing_parameters(pkey))
  1943. EVP_PKEY_copy_parameters(pktmp,pkey);
  1944. EVP_PKEY_free(pktmp);
  1945. if (!X509_sign(ret,pkey,dgst))
  1946. goto err;
  1947. /* We now just add it to the database */
  1948. row[DB_type]=(char *)OPENSSL_malloc(2);
  1949. tm=X509_get_notAfter(ret);
  1950. row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
  1951. memcpy(row[DB_exp_date],tm->data,tm->length);
  1952. row[DB_exp_date][tm->length]='\0';
  1953. row[DB_rev_date]=NULL;
  1954. /* row[DB_serial] done already */
  1955. row[DB_file]=(char *)OPENSSL_malloc(8);
  1956. row[DB_name]=X509_NAME_oneline(X509_get_subject_name(ret),NULL,0);
  1957. if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
  1958. (row[DB_file] == NULL) || (row[DB_name] == NULL))
  1959. {
  1960. BIO_printf(bio_err,"Memory allocation failure\n");
  1961. goto err;
  1962. }
  1963. BUF_strlcpy(row[DB_file],"unknown",8);
  1964. row[DB_type][0]='V';
  1965. row[DB_type][1]='\0';
  1966. if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
  1967. {
  1968. BIO_printf(bio_err,"Memory allocation failure\n");
  1969. goto err;
  1970. }
  1971. for (i=0; i<DB_NUMBER; i++)
  1972. {
  1973. irow[i]=row[i];
  1974. row[i]=NULL;
  1975. }
  1976. irow[DB_NUMBER]=NULL;
  1977. if (!TXT_DB_insert(db->db,irow))
  1978. {
  1979. BIO_printf(bio_err,"failed to update database\n");
  1980. BIO_printf(bio_err,"TXT_DB error number %ld\n",db->db->error);
  1981. goto err;
  1982. }
  1983. ok=1;
  1984. err:
  1985. for (i=0; i<DB_NUMBER; i++)
  1986. if (row[i] != NULL) OPENSSL_free(row[i]);
  1987. if (CAname != NULL)
  1988. X509_NAME_free(CAname);
  1989. if (subject != NULL)
  1990. X509_NAME_free(subject);
  1991. if ((dn_subject != NULL) && !email_dn)
  1992. X509_NAME_free(dn_subject);
  1993. if (tmptm != NULL)
  1994. ASN1_UTCTIME_free(tmptm);
  1995. if (ok <= 0)
  1996. {
  1997. if (ret != NULL) X509_free(ret);
  1998. ret=NULL;
  1999. }
  2000. else
  2001. *xret=ret;
  2002. return(ok);
  2003. }
  2004. static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
  2005. {
  2006. if (output_der)
  2007. {
  2008. (void)i2d_X509_bio(bp,x);
  2009. return;
  2010. }
  2011. #if 0
  2012. /* ??? Not needed since X509_print prints all this stuff anyway */
  2013. f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
  2014. BIO_printf(bp,"issuer :%s\n",f);
  2015. f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
  2016. BIO_printf(bp,"subject:%s\n",f);
  2017. BIO_puts(bp,"serial :");
  2018. i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
  2019. BIO_puts(bp,"\n\n");
  2020. #endif
  2021. if (!notext)X509_print(bp,x);
  2022. PEM_write_bio_X509(bp,x);
  2023. }
  2024. static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
  2025. const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  2026. BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
  2027. long days, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
  2028. unsigned long nameopt, int default_op, int ext_copy)
  2029. {
  2030. STACK_OF(CONF_VALUE) *sk=NULL;
  2031. LHASH_OF(CONF_VALUE) *parms=NULL;
  2032. X509_REQ *req=NULL;
  2033. CONF_VALUE *cv=NULL;
  2034. NETSCAPE_SPKI *spki = NULL;
  2035. X509_REQ_INFO *ri;
  2036. char *type,*buf;
  2037. EVP_PKEY *pktmp=NULL;
  2038. X509_NAME *n=NULL;
  2039. X509_NAME_ENTRY *ne=NULL;
  2040. int ok= -1,i,j;
  2041. long errline;
  2042. int nid;
  2043. /*
  2044. * Load input file into a hash table. (This is just an easy
  2045. * way to read and parse the file, then put it into a convenient
  2046. * STACK format).
  2047. */
  2048. parms=CONF_load(NULL,infile,&errline);
  2049. if (parms == NULL)
  2050. {
  2051. BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
  2052. ERR_print_errors(bio_err);
  2053. goto err;
  2054. }
  2055. sk=CONF_get_section(parms, "default");
  2056. if (sk_CONF_VALUE_num(sk) == 0)
  2057. {
  2058. BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
  2059. CONF_free(parms);
  2060. goto err;
  2061. }
  2062. /*
  2063. * Now create a dummy X509 request structure. We don't actually
  2064. * have an X509 request, but we have many of the components
  2065. * (a public key, various DN components). The idea is that we
  2066. * put these components into the right X509 request structure
  2067. * and we can use the same code as if you had a real X509 request.
  2068. */
  2069. req=X509_REQ_new();
  2070. if (req == NULL)
  2071. {
  2072. ERR_print_errors(bio_err);
  2073. goto err;
  2074. }
  2075. /*
  2076. * Build up the subject name set.
  2077. */
  2078. ri=req->req_info;
  2079. n = ri->subject;
  2080. for (i = 0; ; i++)
  2081. {
  2082. if (sk_CONF_VALUE_num(sk) <= i) break;
  2083. cv=sk_CONF_VALUE_value(sk,i);
  2084. type=cv->name;
  2085. /* Skip past any leading X. X: X, etc to allow for
  2086. * multiple instances
  2087. */
  2088. for (buf = cv->name; *buf ; buf++)
  2089. if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
  2090. {
  2091. buf++;
  2092. if (*buf) type = buf;
  2093. break;
  2094. }
  2095. buf=cv->value;
  2096. if ((nid=OBJ_txt2nid(type)) == NID_undef)
  2097. {
  2098. if (strcmp(type, "SPKAC") == 0)
  2099. {
  2100. spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
  2101. if (spki == NULL)
  2102. {
  2103. BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
  2104. ERR_print_errors(bio_err);
  2105. goto err;
  2106. }
  2107. }
  2108. continue;
  2109. }
  2110. /*
  2111. if ((nid == NID_pkcs9_emailAddress) && (email_dn == 0))
  2112. continue;
  2113. */
  2114. j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
  2115. if (fix_data(nid, &j) == 0)
  2116. {
  2117. BIO_printf(bio_err,
  2118. "invalid characters in string %s\n",buf);
  2119. goto err;
  2120. }
  2121. if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
  2122. (unsigned char *)buf,
  2123. strlen(buf))) == NULL)
  2124. goto err;
  2125. if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
  2126. }
  2127. if (spki == NULL)
  2128. {
  2129. BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
  2130. infile);
  2131. goto err;
  2132. }
  2133. /*
  2134. * Now extract the key from the SPKI structure.
  2135. */
  2136. BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
  2137. if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
  2138. {
  2139. BIO_printf(bio_err,"error unpacking SPKAC public key\n");
  2140. goto err;
  2141. }
  2142. j = NETSCAPE_SPKI_verify(spki, pktmp);
  2143. if (j <= 0)
  2144. {
  2145. BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
  2146. goto err;
  2147. }
  2148. BIO_printf(bio_err,"Signature ok\n");
  2149. X509_REQ_set_pubkey(req,pktmp);
  2150. EVP_PKEY_free(pktmp);
  2151. ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
  2152. days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
  2153. ext_copy, 0);
  2154. err:
  2155. if (req != NULL) X509_REQ_free(req);
  2156. if (parms != NULL) CONF_free(parms);
  2157. if (spki != NULL) NETSCAPE_SPKI_free(spki);
  2158. if (ne != NULL) X509_NAME_ENTRY_free(ne);
  2159. return(ok);
  2160. }
  2161. static int fix_data(int nid, int *type)
  2162. {
  2163. if (nid == NID_pkcs9_emailAddress)
  2164. *type=V_ASN1_IA5STRING;
  2165. if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
  2166. *type=V_ASN1_T61STRING;
  2167. if ((nid == NID_pkcs9_challengePassword) && (*type == V_ASN1_IA5STRING))
  2168. *type=V_ASN1_T61STRING;
  2169. if ((nid == NID_pkcs9_unstructuredName) && (*type == V_ASN1_T61STRING))
  2170. return(0);
  2171. if (nid == NID_pkcs9_unstructuredName)
  2172. *type=V_ASN1_IA5STRING;
  2173. return(1);
  2174. }
  2175. static int check_time_format(const char *str)
  2176. {
  2177. return ASN1_TIME_set_string(NULL, str);
  2178. }
  2179. static int do_revoke(X509 *x509, CA_DB *db, int type, char *value)
  2180. {
  2181. ASN1_UTCTIME *tm=NULL;
  2182. char *row[DB_NUMBER],**rrow,**irow;
  2183. char *rev_str = NULL;
  2184. BIGNUM *bn = NULL;
  2185. int ok=-1,i;
  2186. for (i=0; i<DB_NUMBER; i++)
  2187. row[i]=NULL;
  2188. row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
  2189. bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
  2190. if (!bn)
  2191. goto err;
  2192. if (BN_is_zero(bn))
  2193. row[DB_serial]=BUF_strdup("00");
  2194. else
  2195. row[DB_serial]=BN_bn2hex(bn);
  2196. BN_free(bn);
  2197. if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
  2198. {
  2199. BIO_printf(bio_err,"Memory allocation failure\n");
  2200. goto err;
  2201. }
  2202. /* We have to lookup by serial number because name lookup
  2203. * skips revoked certs
  2204. */
  2205. rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
  2206. if (rrow == NULL)
  2207. {
  2208. BIO_printf(bio_err,"Adding Entry with serial number %s to DB for %s\n", row[DB_serial], row[DB_name]);
  2209. /* We now just add it to the database */
  2210. row[DB_type]=(char *)OPENSSL_malloc(2);
  2211. tm=X509_get_notAfter(x509);
  2212. row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
  2213. memcpy(row[DB_exp_date],tm->data,tm->length);
  2214. row[DB_exp_date][tm->length]='\0';
  2215. row[DB_rev_date]=NULL;
  2216. /* row[DB_serial] done already */
  2217. row[DB_file]=(char *)OPENSSL_malloc(8);
  2218. /* row[DB_name] done already */
  2219. if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
  2220. (row[DB_file] == NULL))
  2221. {
  2222. BIO_printf(bio_err,"Memory allocation failure\n");
  2223. goto err;
  2224. }
  2225. BUF_strlcpy(row[DB_file],"unknown",8);
  2226. row[DB_type][0]='V';
  2227. row[DB_type][1]='\0';
  2228. if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
  2229. {
  2230. BIO_printf(bio_err,"Memory allocation failure\n");
  2231. goto err;
  2232. }
  2233. for (i=0; i<DB_NUMBER; i++)
  2234. {
  2235. irow[i]=row[i];
  2236. row[i]=NULL;
  2237. }
  2238. irow[DB_NUMBER]=NULL;
  2239. if (!TXT_DB_insert(db->db,irow))
  2240. {
  2241. BIO_printf(bio_err,"failed to update database\n");
  2242. BIO_printf(bio_err,"TXT_DB error number %ld\n",db->db->error);
  2243. goto err;
  2244. }
  2245. /* Revoke Certificate */
  2246. ok = do_revoke(x509,db, type, value);
  2247. goto err;
  2248. }
  2249. else if (index_name_cmp_noconst(row, rrow))
  2250. {
  2251. BIO_printf(bio_err,"ERROR:name does not match %s\n",
  2252. row[DB_name]);
  2253. goto err;
  2254. }
  2255. else if (rrow[DB_type][0]=='R')
  2256. {
  2257. BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
  2258. row[DB_serial]);
  2259. goto err;
  2260. }
  2261. else
  2262. {
  2263. BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
  2264. rev_str = make_revocation_str(type, value);
  2265. if (!rev_str)
  2266. {
  2267. BIO_printf(bio_err, "Error in revocation arguments\n");
  2268. goto err;
  2269. }
  2270. rrow[DB_type][0]='R';
  2271. rrow[DB_type][1]='\0';
  2272. rrow[DB_rev_date] = rev_str;
  2273. }
  2274. ok=1;
  2275. err:
  2276. for (i=0; i<DB_NUMBER; i++)
  2277. {
  2278. if (row[i] != NULL)
  2279. OPENSSL_free(row[i]);
  2280. }
  2281. return(ok);
  2282. }
  2283. static int get_certificate_status(const char *serial, CA_DB *db)
  2284. {
  2285. char *row[DB_NUMBER],**rrow;
  2286. int ok=-1,i;
  2287. /* Free Resources */
  2288. for (i=0; i<DB_NUMBER; i++)
  2289. row[i]=NULL;
  2290. /* Malloc needed char spaces */
  2291. row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
  2292. if (row[DB_serial] == NULL)
  2293. {
  2294. BIO_printf(bio_err,"Malloc failure\n");
  2295. goto err;
  2296. }
  2297. if (strlen(serial) % 2)
  2298. {
  2299. /* Set the first char to 0 */;
  2300. row[DB_serial][0]='0';
  2301. /* Copy String from serial to row[DB_serial] */
  2302. memcpy(row[DB_serial]+1, serial, strlen(serial));
  2303. row[DB_serial][strlen(serial)+1]='\0';
  2304. }
  2305. else
  2306. {
  2307. /* Copy String from serial to row[DB_serial] */
  2308. memcpy(row[DB_serial], serial, strlen(serial));
  2309. row[DB_serial][strlen(serial)]='\0';
  2310. }
  2311. /* Make it Upper Case */
  2312. for (i=0; row[DB_serial][i] != '\0'; i++)
  2313. row[DB_serial][i] = toupper(row[DB_serial][i]);
  2314. ok=1;
  2315. /* Search for the certificate */
  2316. rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
  2317. if (rrow == NULL)
  2318. {
  2319. BIO_printf(bio_err,"Serial %s not present in db.\n",
  2320. row[DB_serial]);
  2321. ok=-1;
  2322. goto err;
  2323. }
  2324. else if (rrow[DB_type][0]=='V')
  2325. {
  2326. BIO_printf(bio_err,"%s=Valid (%c)\n",
  2327. row[DB_serial], rrow[DB_type][0]);
  2328. goto err;
  2329. }
  2330. else if (rrow[DB_type][0]=='R')
  2331. {
  2332. BIO_printf(bio_err,"%s=Revoked (%c)\n",
  2333. row[DB_serial], rrow[DB_type][0]);
  2334. goto err;
  2335. }
  2336. else if (rrow[DB_type][0]=='E')
  2337. {
  2338. BIO_printf(bio_err,"%s=Expired (%c)\n",
  2339. row[DB_serial], rrow[DB_type][0]);
  2340. goto err;
  2341. }
  2342. else if (rrow[DB_type][0]=='S')
  2343. {
  2344. BIO_printf(bio_err,"%s=Suspended (%c)\n",
  2345. row[DB_serial], rrow[DB_type][0]);
  2346. goto err;
  2347. }
  2348. else
  2349. {
  2350. BIO_printf(bio_err,"%s=Unknown (%c).\n",
  2351. row[DB_serial], rrow[DB_type][0]);
  2352. ok=-1;
  2353. }
  2354. err:
  2355. for (i=0; i<DB_NUMBER; i++)
  2356. {
  2357. if (row[i] != NULL)
  2358. OPENSSL_free(row[i]);
  2359. }
  2360. return(ok);
  2361. }
  2362. static int do_updatedb (CA_DB *db)
  2363. {
  2364. ASN1_UTCTIME *a_tm = NULL;
  2365. int i, cnt = 0;
  2366. int db_y2k, a_y2k; /* flags = 1 if y >= 2000 */
  2367. char **rrow, *a_tm_s;
  2368. a_tm = ASN1_UTCTIME_new();
  2369. /* get actual time and make a string */
  2370. a_tm = X509_gmtime_adj(a_tm, 0);
  2371. a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
  2372. if (a_tm_s == NULL)
  2373. {
  2374. cnt = -1;
  2375. goto err;
  2376. }
  2377. memcpy(a_tm_s, a_tm->data, a_tm->length);
  2378. a_tm_s[a_tm->length] = '\0';
  2379. if (strncmp(a_tm_s, "49", 2) <= 0)
  2380. a_y2k = 1;
  2381. else
  2382. a_y2k = 0;
  2383. for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++)
  2384. {
  2385. rrow = sk_OPENSSL_PSTRING_value(db->db->data, i);
  2386. if (rrow[DB_type][0] == 'V')
  2387. {
  2388. /* ignore entries that are not valid */
  2389. if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
  2390. db_y2k = 1;
  2391. else
  2392. db_y2k = 0;
  2393. if (db_y2k == a_y2k)
  2394. {
  2395. /* all on the same y2k side */
  2396. if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
  2397. {
  2398. rrow[DB_type][0] = 'E';
  2399. rrow[DB_type][1] = '\0';
  2400. cnt++;
  2401. BIO_printf(bio_err, "%s=Expired\n",
  2402. rrow[DB_serial]);
  2403. }
  2404. }
  2405. else if (db_y2k < a_y2k)
  2406. {
  2407. rrow[DB_type][0] = 'E';
  2408. rrow[DB_type][1] = '\0';
  2409. cnt++;
  2410. BIO_printf(bio_err, "%s=Expired\n",
  2411. rrow[DB_serial]);
  2412. }
  2413. }
  2414. }
  2415. err:
  2416. ASN1_UTCTIME_free(a_tm);
  2417. OPENSSL_free(a_tm_s);
  2418. return (cnt);
  2419. }
  2420. static const char *crl_reasons[] = {
  2421. /* CRL reason strings */
  2422. "unspecified",
  2423. "keyCompromise",
  2424. "CACompromise",
  2425. "affiliationChanged",
  2426. "superseded",
  2427. "cessationOfOperation",
  2428. "certificateHold",
  2429. "removeFromCRL",
  2430. /* Additional pseudo reasons */
  2431. "holdInstruction",
  2432. "keyTime",
  2433. "CAkeyTime"
  2434. };
  2435. #define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
  2436. /* Given revocation information convert to a DB string.
  2437. * The format of the string is:
  2438. * revtime[,reason,extra]. Where 'revtime' is the
  2439. * revocation time (the current time). 'reason' is the
  2440. * optional CRL reason and 'extra' is any additional
  2441. * argument
  2442. */
  2443. char *make_revocation_str(int rev_type, char *rev_arg)
  2444. {
  2445. char *other = NULL, *str;
  2446. const char *reason = NULL;
  2447. ASN1_OBJECT *otmp;
  2448. ASN1_UTCTIME *revtm = NULL;
  2449. int i;
  2450. switch (rev_type)
  2451. {
  2452. case REV_NONE:
  2453. break;
  2454. case REV_CRL_REASON:
  2455. for (i = 0; i < 8; i++)
  2456. {
  2457. if (!strcasecmp(rev_arg, crl_reasons[i]))
  2458. {
  2459. reason = crl_reasons[i];
  2460. break;
  2461. }
  2462. }
  2463. if (reason == NULL)
  2464. {
  2465. BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
  2466. return NULL;
  2467. }
  2468. break;
  2469. case REV_HOLD:
  2470. /* Argument is an OID */
  2471. otmp = OBJ_txt2obj(rev_arg, 0);
  2472. ASN1_OBJECT_free(otmp);
  2473. if (otmp == NULL)
  2474. {
  2475. BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
  2476. return NULL;
  2477. }
  2478. reason = "holdInstruction";
  2479. other = rev_arg;
  2480. break;
  2481. case REV_KEY_COMPROMISE:
  2482. case REV_CA_COMPROMISE:
  2483. /* Argument is the key compromise time */
  2484. if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
  2485. {
  2486. BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
  2487. return NULL;
  2488. }
  2489. other = rev_arg;
  2490. if (rev_type == REV_KEY_COMPROMISE)
  2491. reason = "keyTime";
  2492. else
  2493. reason = "CAkeyTime";
  2494. break;
  2495. }
  2496. revtm = X509_gmtime_adj(NULL, 0);
  2497. i = revtm->length + 1;
  2498. if (reason) i += strlen(reason) + 1;
  2499. if (other) i += strlen(other) + 1;
  2500. str = OPENSSL_malloc(i);
  2501. if (!str) return NULL;
  2502. BUF_strlcpy(str, (char *)revtm->data, i);
  2503. if (reason)
  2504. {
  2505. BUF_strlcat(str, ",", i);
  2506. BUF_strlcat(str, reason, i);
  2507. }
  2508. if (other)
  2509. {
  2510. BUF_strlcat(str, ",", i);
  2511. BUF_strlcat(str, other, i);
  2512. }
  2513. ASN1_UTCTIME_free(revtm);
  2514. return str;
  2515. }
  2516. /* Convert revocation field to X509_REVOKED entry
  2517. * return code:
  2518. * 0 error
  2519. * 1 OK
  2520. * 2 OK and some extensions added (i.e. V2 CRL)
  2521. */
  2522. int make_revoked(X509_REVOKED *rev, const char *str)
  2523. {
  2524. char *tmp = NULL;
  2525. int reason_code = -1;
  2526. int i, ret = 0;
  2527. ASN1_OBJECT *hold = NULL;
  2528. ASN1_GENERALIZEDTIME *comp_time = NULL;
  2529. ASN1_ENUMERATED *rtmp = NULL;
  2530. ASN1_TIME *revDate = NULL;
  2531. i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
  2532. if (i == 0)
  2533. goto err;
  2534. if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
  2535. goto err;
  2536. if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
  2537. {
  2538. rtmp = ASN1_ENUMERATED_new();
  2539. if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
  2540. goto err;
  2541. if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
  2542. goto err;
  2543. }
  2544. if (rev && comp_time)
  2545. {
  2546. if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
  2547. goto err;
  2548. }
  2549. if (rev && hold)
  2550. {
  2551. if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
  2552. goto err;
  2553. }
  2554. if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
  2555. ret = 2;
  2556. else ret = 1;
  2557. err:
  2558. if (tmp) OPENSSL_free(tmp);
  2559. ASN1_OBJECT_free(hold);
  2560. ASN1_GENERALIZEDTIME_free(comp_time);
  2561. ASN1_ENUMERATED_free(rtmp);
  2562. ASN1_TIME_free(revDate);
  2563. return ret;
  2564. }
  2565. int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
  2566. {
  2567. char buf[25],*pbuf, *p;
  2568. int j;
  2569. j=i2a_ASN1_OBJECT(bp,obj);
  2570. pbuf=buf;
  2571. for (j=22-j; j>0; j--)
  2572. *(pbuf++)=' ';
  2573. *(pbuf++)=':';
  2574. *(pbuf++)='\0';
  2575. BIO_puts(bp,buf);
  2576. if (str->type == V_ASN1_PRINTABLESTRING)
  2577. BIO_printf(bp,"PRINTABLE:'");
  2578. else if (str->type == V_ASN1_T61STRING)
  2579. BIO_printf(bp,"T61STRING:'");
  2580. else if (str->type == V_ASN1_IA5STRING)
  2581. BIO_printf(bp,"IA5STRING:'");
  2582. else if (str->type == V_ASN1_UNIVERSALSTRING)
  2583. BIO_printf(bp,"UNIVERSALSTRING:'");
  2584. else
  2585. BIO_printf(bp,"ASN.1 %2d:'",str->type);
  2586. p=(char *)str->data;
  2587. for (j=str->length; j>0; j--)
  2588. {
  2589. if ((*p >= ' ') && (*p <= '~'))
  2590. BIO_printf(bp,"%c",*p);
  2591. else if (*p & 0x80)
  2592. BIO_printf(bp,"\\0x%02X",*p);
  2593. else if ((unsigned char)*p == 0xf7)
  2594. BIO_printf(bp,"^?");
  2595. else BIO_printf(bp,"^%c",*p+'@');
  2596. p++;
  2597. }
  2598. BIO_printf(bp,"'\n");
  2599. return 1;
  2600. }
  2601. int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)
  2602. {
  2603. char *tmp = NULL;
  2604. char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
  2605. int reason_code = -1;
  2606. int ret = 0;
  2607. unsigned int i;
  2608. ASN1_OBJECT *hold = NULL;
  2609. ASN1_GENERALIZEDTIME *comp_time = NULL;
  2610. tmp = BUF_strdup(str);
  2611. p = strchr(tmp, ',');
  2612. rtime_str = tmp;
  2613. if (p)
  2614. {
  2615. *p = '\0';
  2616. p++;
  2617. reason_str = p;
  2618. p = strchr(p, ',');
  2619. if (p)
  2620. {
  2621. *p = '\0';
  2622. arg_str = p + 1;
  2623. }
  2624. }
  2625. if (prevtm)
  2626. {
  2627. *prevtm = ASN1_UTCTIME_new();
  2628. if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))
  2629. {
  2630. BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
  2631. goto err;
  2632. }
  2633. }
  2634. if (reason_str)
  2635. {
  2636. for (i = 0; i < NUM_REASONS; i++)
  2637. {
  2638. if(!strcasecmp(reason_str, crl_reasons[i]))
  2639. {
  2640. reason_code = i;
  2641. break;
  2642. }
  2643. }
  2644. if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
  2645. {
  2646. BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
  2647. goto err;
  2648. }
  2649. if (reason_code == 7)
  2650. reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
  2651. else if (reason_code == 8) /* Hold instruction */
  2652. {
  2653. if (!arg_str)
  2654. {
  2655. BIO_printf(bio_err, "missing hold instruction\n");
  2656. goto err;
  2657. }
  2658. reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
  2659. hold = OBJ_txt2obj(arg_str, 0);
  2660. if (!hold)
  2661. {
  2662. BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
  2663. goto err;
  2664. }
  2665. if (phold) *phold = hold;
  2666. }
  2667. else if ((reason_code == 9) || (reason_code == 10))
  2668. {
  2669. if (!arg_str)
  2670. {
  2671. BIO_printf(bio_err, "missing compromised time\n");
  2672. goto err;
  2673. }
  2674. comp_time = ASN1_GENERALIZEDTIME_new();
  2675. if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
  2676. {
  2677. BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
  2678. goto err;
  2679. }
  2680. if (reason_code == 9)
  2681. reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
  2682. else
  2683. reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
  2684. }
  2685. }
  2686. if (preason) *preason = reason_code;
  2687. if (pinvtm) *pinvtm = comp_time;
  2688. else ASN1_GENERALIZEDTIME_free(comp_time);
  2689. ret = 1;
  2690. err:
  2691. if (tmp) OPENSSL_free(tmp);
  2692. if (!phold) ASN1_OBJECT_free(hold);
  2693. if (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);
  2694. return ret;
  2695. }