req.c 38.7 KB
Newer Older
1
/* apps/req.c */
2
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <string.h>
63
#ifdef OPENSSL_NO_STDIO
64 65 66
#define APPS_WIN16
#endif
#include "apps.h"
67 68 69 70 71 72 73 74 75
#include <openssl/bio.h>
#include <openssl/evp.h>
#include <openssl/conf.h>
#include <openssl/err.h>
#include <openssl/asn1.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/objects.h>
#include <openssl/pem.h>
76 77 78 79 80

#define SECTION		"req"

#define BITS		"default_bits"
#define KEYFILE		"default_keyfile"
81
#define PROMPT		"prompt"
82 83
#define DISTINGUISHED_NAME	"distinguished_name"
#define ATTRIBUTES	"attributes"
84
#define V3_EXTENSIONS	"x509_extensions"
85
#define REQ_EXTENSIONS	"req_extensions"
86
#define STRING_MASK	"string_mask"
87
#define UTF8_IN		"utf8"
88 89 90 91 92 93 94

#define DEFAULT_KEY_LENGTH	512
#define MIN_KEY_LENGTH		384

#undef PROG
#define PROG	req_main

95
/* -inform arg	- input format - default PEM (DER or PEM)
96 97 98 99 100 101 102 103 104
 * -outform arg - output format - default PEM
 * -in arg	- input file - default stdin
 * -out arg	- output file - default stdout
 * -verify	- check request signature
 * -noout	- don't print stuff out.
 * -text	- print out human readable text.
 * -nodes	- no des encryption
 * -config file	- Load configuration file.
 * -key file	- make a request using key in file (or use it for verification).
R
Richard Levitte 已提交
105
 * -keyform arg	- key file format.
106
 * -rand file(s) - load the file(s) into the PRNG.
107 108
 * -newkey	- make a key and a request.
 * -modulus	- print RSA modulus.
109
 * -pubkey	- output Public Key.
110 111 112 113 114
 * -x509	- output a self signed X509 structure instead.
 * -asn1-kludge	- output new certificate request in a format that some CA's
 *		  require.  This format is wrong
 */

115 116 117
static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,char *dn,int attribs,
		unsigned long chtype);
static int build_subject(X509_REQ *req, char *subj, unsigned long chtype);
118 119
static int prompt_info(X509_REQ *req,
		STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect,
120 121
		STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs,
		unsigned long chtype);
122
static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk,
123 124
				STACK_OF(CONF_VALUE) *attr, int attribs,
				unsigned long chtype);
125
static int add_attribute_object(X509_REQ *req, char *text,
D
 
Dr. Stephen Henson 已提交
126
				char *def, char *value, int nid, int n_min,
127
				int n_max, unsigned long chtype);
128
static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
129
	int nid,int n_min,int n_max, unsigned long chtype);
130
#ifndef OPENSSL_NO_RSA
B
Ben Laurie 已提交
131
static void MS_CALLBACK req_cb(int p,int n,void *arg);
B
Ben Laurie 已提交
132
#endif
D
 
Dr. Stephen Henson 已提交
133
static int req_check_len(int len,int n_min,int n_max);
134
static int check_end(char *str, char *end);
135 136
#ifndef MONOLITH
static char *default_config_file=NULL;
D
 
Dr. Stephen Henson 已提交
137
static CONF *config=NULL;
138
#endif
D
 
Dr. Stephen Henson 已提交
139
static CONF *req_conf=NULL;
140
static int batch=0;
141 142 143 144

#define TYPE_RSA	1
#define TYPE_DSA	2
#define TYPE_DH		3
B
Bodo Möller 已提交
145
#define TYPE_ECDSA	4
146

147 148
int MAIN(int, char **);

U
Ulf Möller 已提交
149
int MAIN(int argc, char **argv)
150
	{
151
	ENGINE *e = NULL;
152
#ifndef OPENSSL_NO_DSA
153
	DSA *dsa_params=NULL;
B
Bodo Möller 已提交
154 155 156
#endif
#ifndef OPENSSL_NO_ECDSA
	ECDSA *ecdsa_params = NULL;
157
#endif
158
	unsigned long nmflag = 0;
159 160 161 162
	int ex=1,x509=0,days=30;
	X509 *x509ss=NULL;
	X509_REQ *req=NULL;
	EVP_PKEY *pkey=NULL;
B
Ben Laurie 已提交
163
	int i=0,badops=0,newreq=0,verbose=0,pkey_type=TYPE_RSA;
D
 
Dr. Stephen Henson 已提交
164
	long newkey = -1;
165 166
	BIO *in=NULL,*out=NULL;
	int informat,outformat,verify=0,noout=0,text=0,keyform=FORMAT_PEM;
167
	int nodes=0,kludge=0,newhdr=0,subject=0,pubkey=0;
168
	char *infile,*outfile,*prog,*keyfile=NULL,*template=NULL,*keyout=NULL;
169
	char *engine=NULL;
170
	char *extensions = NULL;
171
	char *req_exts = NULL;
D
 
Dr. Stephen Henson 已提交
172
	const EVP_CIPHER *cipher=NULL;
173
	ASN1_INTEGER *serial = NULL;
174
	int modulus=0;
175
	char *inrand=NULL;
D
Dr. Stephen Henson 已提交
176
	char *passargin = NULL, *passargout = NULL;
177
	char *passin = NULL, *passout = NULL;
178
	char *p;
179
	char *subj = NULL;
B
Ben Laurie 已提交
180
	const EVP_MD *md_alg=NULL,*digest=EVP_md5();
181
	unsigned long chtype = MBSTRING_ASC;
182 183
#ifndef MONOLITH
	MS_STATIC char config_name[256];
D
 
Dr. Stephen Henson 已提交
184
	long errline;
185 186
#endif

187
	req_conf = NULL;
188
#ifndef OPENSSL_NO_DES
189 190 191 192 193 194
	cipher=EVP_des_ede3_cbc();
#endif
	apps_startup();

	if (bio_err == NULL)
		if ((bio_err=BIO_new(BIO_s_file())) != NULL)
195
			BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216

	infile=NULL;
	outfile=NULL;
	informat=FORMAT_PEM;
	outformat=FORMAT_PEM;

	prog=argv[0];
	argc--;
	argv++;
	while (argc >= 1)
		{
		if 	(strcmp(*argv,"-inform") == 0)
			{
			if (--argc < 1) goto bad;
			informat=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-outform") == 0)
			{
			if (--argc < 1) goto bad;
			outformat=str2fmt(*(++argv));
			}
217 218 219 220 221
		else if (strcmp(*argv,"-engine") == 0)
			{
			if (--argc < 1) goto bad;
			engine= *(++argv);
			}
222 223 224 225 226
		else if (strcmp(*argv,"-key") == 0)
			{
			if (--argc < 1) goto bad;
			keyfile= *(++argv);
			}
227 228 229 230
		else if (strcmp(*argv,"-pubkey") == 0)
			{
			pubkey=1;
			}
231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259
		else if (strcmp(*argv,"-new") == 0)
			{
			newreq=1;
			}
		else if (strcmp(*argv,"-config") == 0)
			{	
			if (--argc < 1) goto bad;
			template= *(++argv);
			}
		else if (strcmp(*argv,"-keyform") == 0)
			{
			if (--argc < 1) goto bad;
			keyform=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-in") == 0)
			{
			if (--argc < 1) goto bad;
			infile= *(++argv);
			}
		else if (strcmp(*argv,"-out") == 0)
			{
			if (--argc < 1) goto bad;
			outfile= *(++argv);
			}
		else if (strcmp(*argv,"-keyout") == 0)
			{
			if (--argc < 1) goto bad;
			keyout= *(++argv);
			}
260 261 262
		else if (strcmp(*argv,"-passin") == 0)
			{
			if (--argc < 1) goto bad;
D
Dr. Stephen Henson 已提交
263
			passargin= *(++argv);
264 265 266 267
			}
		else if (strcmp(*argv,"-passout") == 0)
			{
			if (--argc < 1) goto bad;
D
Dr. Stephen Henson 已提交
268
			passargout= *(++argv);
269
			}
270 271 272 273 274
		else if (strcmp(*argv,"-rand") == 0)
			{
			if (--argc < 1) goto bad;
			inrand= *(++argv);
			}
275 276
		else if (strcmp(*argv,"-newkey") == 0)
			{
B
Ben Laurie 已提交
277 278
			int is_numeric;

279 280
			if (--argc < 1) goto bad;
			p= *(++argv);
B
Ben Laurie 已提交
281 282
			is_numeric = p[0] >= '0' && p[0] <= '9';
			if (strncmp("rsa:",p,4) == 0 || is_numeric)
283 284
				{
				pkey_type=TYPE_RSA;
B
Ben Laurie 已提交
285 286
				if(!is_numeric)
				    p+=4;
287 288
				newkey= atoi(p);
				}
289
			else
290
#ifndef OPENSSL_NO_DSA
291
				if (strncmp("dsa:",p,4) == 0)
292 293 294 295 296 297 298 299 300 301 302
				{
				X509 *xtmp=NULL;
				EVP_PKEY *dtmp;

				pkey_type=TYPE_DSA;
				p+=4;
				if ((in=BIO_new_file(p,"r")) == NULL)
					{
					perror(p);
					goto end;
					}
303
				if ((dsa_params=PEM_read_bio_DSAparams(in,NULL,NULL,NULL)) == NULL)
304 305
					{
					ERR_clear_error();
B
Bodo Möller 已提交
306
					(void)BIO_reset(in);
307
					if ((xtmp=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL)
308 309 310 311
						{
						BIO_printf(bio_err,"unable to load DSA parameters from file\n");
						goto end;
						}
312

B
Bodo Möller 已提交
313
					if ((dtmp=X509_get_pubkey(xtmp)) == NULL) goto end;
314 315
					if (dtmp->type == EVP_PKEY_DSA)
						dsa_params=DSAparams_dup(dtmp->pkey.dsa);
316
					EVP_PKEY_free(dtmp);
317 318 319 320 321 322 323 324 325
					X509_free(xtmp);
					if (dsa_params == NULL)
						{
						BIO_printf(bio_err,"Certificate does not contain DSA parameters\n");
						goto end;
						}
					}
				BIO_free(in);
				in=NULL;
B
Bodo Möller 已提交
326
				newkey=BN_num_bits(dsa_params->p);
327
				}
328 329
			else 
#endif
B
Bodo Möller 已提交
330 331 332 333 334 335 336 337 338 339 340 341 342
#ifndef OPENSSL_NO_ECDSA
				if (strncmp("ecdsa:",p,4) == 0)
				{
				X509 *xtmp=NULL;
				EVP_PKEY *dtmp;

				pkey_type=TYPE_ECDSA;
				p+=6;
				if ((in=BIO_new_file(p,"r")) == NULL)
					{
					perror(p);
					goto end;
					}
343 344 345
				if ((ecdsa_params = ECDSA_new()) == NULL)
					goto end;
				if ((ecdsa_params->group = PEM_read_bio_ECPKParameters(in, NULL, NULL, NULL)) == NULL)
B
Bodo Möller 已提交
346
					{
347 348
					if (ecdsa_params)
						ECDSA_free(ecdsa_params);
B
Bodo Möller 已提交
349 350 351 352 353 354 355 356
					ERR_clear_error();
					(void)BIO_reset(in);
					if ((xtmp=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL)
						{	
						BIO_printf(bio_err,"unable to load ECDSA parameters from file\n");
						goto end;
						}

B
Bodo Möller 已提交
357
					if ((dtmp=X509_get_pubkey(xtmp)) == NULL) goto end;
B
Bodo Möller 已提交
358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385
					if (dtmp->type == EVP_PKEY_ECDSA)
						ecdsa_params = ECDSAParameters_dup(dtmp->pkey.ecdsa);
					EVP_PKEY_free(dtmp);
					X509_free(xtmp);
					if (ecdsa_params == NULL)
						{
						BIO_printf(bio_err,"Certificate does not contain ECDSA parameters\n");
						goto end;
						}
					}

				BIO_free(in);
				in=NULL;
				
				{
				BIGNUM *order = BN_new();
				
				if (!order)
					goto end;
				if (!EC_GROUP_get_order(ecdsa_params->group, order, NULL))
					goto end;
				newkey = BN_num_bits(order);
				BN_free(order);
				}

				}
			else
#endif
386
#ifndef OPENSSL_NO_DH
387
				if (strncmp("dh:",p,4) == 0)
388 389 390 391 392
				{
				pkey_type=TYPE_DH;
				p+=3;
				}
			else
393
#endif
394 395 396 397
				pkey_type=TYPE_RSA;

			newreq=1;
			}
398 399
		else if (strcmp(*argv,"-batch") == 0)
			batch=1;
400 401
		else if (strcmp(*argv,"-newhdr") == 0)
			newhdr=1;
402 403 404 405 406 407 408 409
		else if (strcmp(*argv,"-modulus") == 0)
			modulus=1;
		else if (strcmp(*argv,"-verify") == 0)
			verify=1;
		else if (strcmp(*argv,"-nodes") == 0)
			nodes=1;
		else if (strcmp(*argv,"-noout") == 0)
			noout=1;
410 411
		else if (strcmp(*argv,"-verbose") == 0)
			verbose=1;
412 413
		else if (strcmp(*argv,"-utf8") == 0)
			chtype = MBSTRING_UTF8;
414 415 416 417 418 419 420
		else if (strcmp(*argv,"-nameopt") == 0)
			{
			if (--argc < 1) goto bad;
			if (!set_name_ex(&nmflag, *(++argv))) goto bad;
			}
		else if (strcmp(*argv,"-subject") == 0)
			subject=1;
421 422 423 424 425 426 427 428
		else if (strcmp(*argv,"-text") == 0)
			text=1;
		else if (strcmp(*argv,"-x509") == 0)
			x509=1;
		else if (strcmp(*argv,"-asn1-kludge") == 0)
			kludge=1;
		else if (strcmp(*argv,"-no-asn1-kludge") == 0)
			kludge=0;
429 430 431 432 433
		else if (strcmp(*argv,"-subj") == 0)
			{
			if (--argc < 1) goto bad;
			subj= *(++argv);
			}
434 435 436 437 438 439
		else if (strcmp(*argv,"-days") == 0)
			{
			if (--argc < 1) goto bad;
			days= atoi(*(++argv));
			if (days == 0) days=30;
			}
440 441 442 443 444 445
		else if (strcmp(*argv,"-set_serial") == 0)
			{
			if (--argc < 1) goto bad;
			serial = s2i_ASN1_INTEGER(NULL, *(++argv));
			if (!serial) goto bad;
			}
446 447 448 449 450
		else if ((md_alg=EVP_get_digestbyname(&((*argv)[1]))) != NULL)
			{
			/* ok */
			digest=md_alg;
			}
451 452 453 454 455 456 457 458 459 460
		else if (strcmp(*argv,"-extensions") == 0)
			{
			if (--argc < 1) goto bad;
			extensions = *(++argv);
			}
		else if (strcmp(*argv,"-reqexts") == 0)
			{
			if (--argc < 1) goto bad;
			req_exts = *(++argv);
			}
461 462 463 464 465 466 467 468 469 470 471 472 473 474 475
		else
			{
			BIO_printf(bio_err,"unknown option %s\n",*argv);
			badops=1;
			break;
			}
		argc--;
		argv++;
		}

	if (badops)
		{
bad:
		BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
		BIO_printf(bio_err,"where options  are\n");
476 477
		BIO_printf(bio_err," -inform arg    input format - DER or PEM\n");
		BIO_printf(bio_err," -outform arg   output format - DER or PEM\n");
478
		BIO_printf(bio_err," -in arg        input file\n");
479 480
		BIO_printf(bio_err," -out arg       output file\n");
		BIO_printf(bio_err," -text          text form of request\n");
481
		BIO_printf(bio_err," -pubkey        output public key\n");
482 483 484 485
		BIO_printf(bio_err," -noout         do not output REQ\n");
		BIO_printf(bio_err," -verify        verify signature on REQ\n");
		BIO_printf(bio_err," -modulus       RSA modulus\n");
		BIO_printf(bio_err," -nodes         don't encrypt the output key\n");
486 487 488 489
		BIO_printf(bio_err," -engine e      use engine e, possibly a hardware device\n");
		BIO_printf(bio_err," -subject       output the request's subject\n");
		BIO_printf(bio_err," -passin        private key password source\n");
		BIO_printf(bio_err," -key file      use the private key contained in file\n");
490 491
		BIO_printf(bio_err," -keyform arg   key file format\n");
		BIO_printf(bio_err," -keyout arg    file to send the key to\n");
492 493 494
		BIO_printf(bio_err," -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
		BIO_printf(bio_err,"                load the file (or the files in the directory) into\n");
		BIO_printf(bio_err,"                the random number generator\n");
495 496
		BIO_printf(bio_err," -newkey rsa:bits generate a new RSA key of 'bits' in size\n");
		BIO_printf(bio_err," -newkey dsa:file generate a new DSA key, parameters taken from CA in 'file'\n");
B
Bodo Möller 已提交
497
		BIO_printf(bio_err," -newkey ecdsa:file generate a new ECDSA key, parameters taken from CA in 'file'\n");
498
		BIO_printf(bio_err," -[digest]      Digest to sign with (md5, sha1, md2, mdc2, md4)\n");
M
Mark J. Cox 已提交
499
		BIO_printf(bio_err," -config file   request template file.\n");
500
		BIO_printf(bio_err," -subj arg      set or modify request subject\n");
501
		BIO_printf(bio_err," -new           new request.\n");
502
		BIO_printf(bio_err," -batch         do not ask anything during request generation\n");
503
		BIO_printf(bio_err," -x509          output a x509 structure instead of a cert. req.\n");
504 505
		BIO_printf(bio_err," -days          number of days a certificate generated by -x509 is valid for.\n");
		BIO_printf(bio_err," -set_serial    serial number to use for a certificate generated by -x509.\n");
506
		BIO_printf(bio_err," -newhdr        output \"NEW\" in the header lines\n");
507 508
		BIO_printf(bio_err," -asn1-kludge   Output the 'request' in a format that is wrong but some CA's\n");
		BIO_printf(bio_err,"                have been reported as requiring\n");
509 510
		BIO_printf(bio_err," -extensions .. specify certificate extension section (override value in config file)\n");
		BIO_printf(bio_err," -reqexts ..    specify request extension section (override value in config file)\n");
511
		BIO_printf(bio_err," -utf8          input characters are UTF8 (default ASCII)\n");
512
		BIO_printf(bio_err," -nameopt arg    - various certificate name options\n");
513 514 515 516
		goto end;
		}

	ERR_load_crypto_strings();
D
Dr. Stephen Henson 已提交
517 518 519 520
	if(!app_passwd(bio_err, passargin, passargout, &passin, &passout)) {
		BIO_printf(bio_err, "Error getting passwords\n");
		goto end;
	}
521

B
Bodo Möller 已提交
522
#ifndef MONOLITH /* else this has happened in openssl.c (global `config') */
523
	/* Lets load up our environment a little */
524 525 526
	p=getenv("OPENSSL_CONF");
	if (p == NULL)
		p=getenv("SSLEAY_CONF");
527 528 529
	if (p == NULL)
		{
		strcpy(config_name,X509_get_default_cert_area());
530
#ifndef OPENSSL_SYS_VMS
U
Ulf Möller 已提交
531
		strcat(config_name,"/");
U
Ulf Möller 已提交
532
#endif
533
		strcat(config_name,OPENSSL_CONF);
534 535
		p=config_name;
		}
B
Bodo Möller 已提交
536
	default_config_file=p;
D
 
Dr. Stephen Henson 已提交
537
	config=NCONF_new(NULL);
D
 
Dr. Stephen Henson 已提交
538
	i=NCONF_load(config, p, &errline);
539 540 541 542 543 544
#endif

	if (template != NULL)
		{
		long errline;

545 546
		if( verbose )
			BIO_printf(bio_err,"Using configuration from %s\n",template);
D
 
Dr. Stephen Henson 已提交
547 548 549
		req_conf=NCONF_new(NULL);
		i=NCONF_load(req_conf,template,&errline);
		if (i == 0)
550 551 552 553 554 555 556 557
			{
			BIO_printf(bio_err,"error on line %ld of %s\n",errline,template);
			goto end;
			}
		}
	else
		{
		req_conf=config;
558 559
		if( verbose )
			BIO_printf(bio_err,"Using configuration from %s\n",
560
			default_config_file);
D
 
Dr. Stephen Henson 已提交
561
		if (req_conf == NULL)
562 563 564 565 566
			{
			BIO_printf(bio_err,"Unable to load config info\n");
			}
		}

567 568
	if (req_conf != NULL)
		{
D
Dr. Stephen Henson 已提交
569 570
		if (!load_config(bio_err, req_conf))
			goto end;
D
 
Dr. Stephen Henson 已提交
571
		p=NCONF_get_string(req_conf,NULL,"oid_file");
572 573
		if (p == NULL)
			ERR_clear_error();
574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592
		if (p != NULL)
			{
			BIO *oid_bio;

			oid_bio=BIO_new_file(p,"r");
			if (oid_bio == NULL) 
				{
				/*
				BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
				ERR_print_errors(bio_err);
				*/
				}
			else
				{
				OBJ_create_objects(oid_bio);
				BIO_free(oid_bio);
				}
			}
		}
593
	if(!add_oid_section(bio_err, req_conf)) goto end;
594

595
	if (md_alg == NULL)
596
		{
D
 
Dr. Stephen Henson 已提交
597
		p=NCONF_get_string(req_conf,SECTION,"default_md");
598 599 600 601 602 603 604
		if (p == NULL)
			ERR_clear_error();
		if (p != NULL)
			{
			if ((md_alg=EVP_get_digestbyname(p)) != NULL)
				digest=md_alg;
			}
605 606
		}

607 608
	if (!extensions)
		{
D
 
Dr. Stephen Henson 已提交
609
		extensions = NCONF_get_string(req_conf, SECTION, V3_EXTENSIONS);
610 611 612 613
		if (!extensions)
			ERR_clear_error();
		}
	if (extensions) {
614
		/* Check syntax of file */
615 616
		X509V3_CTX ctx;
		X509V3_set_ctx_test(&ctx);
D
 
Dr. Stephen Henson 已提交
617 618
		X509V3_set_nconf(&ctx, req_conf);
		if(!X509V3_EXT_add_nconf(req_conf, &ctx, extensions, NULL)) {
619 620 621 622 623
			BIO_printf(bio_err,
			 "Error Loading extension section %s\n", extensions);
			goto end;
		}
	}
624

625
	if(!passin)
626
		{
D
 
Dr. Stephen Henson 已提交
627
		passin = NCONF_get_string(req_conf, SECTION, "input_password");
628 629 630 631
		if (!passin)
			ERR_clear_error();
		}
	
632
	if(!passout)
633
		{
D
 
Dr. Stephen Henson 已提交
634
		passout = NCONF_get_string(req_conf, SECTION, "output_password");
635 636 637
		if (!passout)
			ERR_clear_error();
		}
638

D
 
Dr. Stephen Henson 已提交
639
	p = NCONF_get_string(req_conf, SECTION, STRING_MASK);
640 641
	if (!p)
		ERR_clear_error();
642 643

	if(p && !ASN1_STRING_set_default_mask_asc(p)) {
644
		BIO_printf(bio_err, "Invalid global string mask setting %s\n", p);
645 646 647
		goto end;
	}

648 649 650 651 652 653 654 655 656 657
	if (chtype != MBSTRING_UTF8)
		{
		p = NCONF_get_string(req_conf, SECTION, UTF8_IN);
		if (!p)
			ERR_clear_error();
		else if (!strcmp(p, "yes"))
			chtype = MBSTRING_UTF8;
		}


658
	if(!req_exts)
659
		{
D
 
Dr. Stephen Henson 已提交
660
		req_exts = NCONF_get_string(req_conf, SECTION, REQ_EXTENSIONS);
661 662 663
		if (!req_exts)
			ERR_clear_error();
		}
664 665 666 667
	if(req_exts) {
		/* Check syntax of file */
		X509V3_CTX ctx;
		X509V3_set_ctx_test(&ctx);
D
 
Dr. Stephen Henson 已提交
668 669
		X509V3_set_nconf(&ctx, req_conf);
		if(!X509V3_EXT_add_nconf(req_conf, &ctx, req_exts, NULL)) {
670 671 672 673 674 675 676
			BIO_printf(bio_err,
			 "Error Loading request extension section %s\n",
								req_exts);
			goto end;
		}
	}

677 678 679 680 681
	in=BIO_new(BIO_s_file());
	out=BIO_new(BIO_s_file());
	if ((in == NULL) || (out == NULL))
		goto end;

682
        e = setup_engine(bio_err, engine, 0);
683

684 685
	if (keyfile != NULL)
		{
686
		pkey = load_key(bio_err, keyfile, keyform, 0, passin, e,
687 688
			"Private Key");
		if (!pkey)
689
			{
690 691
			/* load_key() has already printed an appropriate
			   message */
692 693
			goto end;
			}
B
Bodo Möller 已提交
694
		if (EVP_PKEY_type(pkey->type) == EVP_PKEY_DSA || EVP_PKEY_type(pkey->type) == EVP_PKEY_ECDSA)
D
 
Dr. Stephen Henson 已提交
695
			{
D
 
Dr. Stephen Henson 已提交
696
			char *randfile = NCONF_get_string(req_conf,SECTION,"RANDFILE");
697 698
			if (randfile == NULL)
				ERR_clear_error();
D
 
Dr. Stephen Henson 已提交
699
			app_RAND_load_file(randfile, bio_err, 0);
700
			}
701 702 703 704
		}

	if (newreq && (pkey == NULL))
		{
D
 
Dr. Stephen Henson 已提交
705
		char *randfile = NCONF_get_string(req_conf,SECTION,"RANDFILE");
706 707
		if (randfile == NULL)
			ERR_clear_error();
708
		app_RAND_load_file(randfile, bio_err, 0);
709 710
		if (inrand)
			app_RAND_load_files(inrand);
711
	
712 713
		if (newkey <= 0)
			{
D
 
Dr. Stephen Henson 已提交
714
			if (!NCONF_get_number(req_conf,SECTION,BITS, &newkey))
715 716 717
				newkey=DEFAULT_KEY_LENGTH;
			}

B
Bodo Möller 已提交
718 719
		if (newkey < MIN_KEY_LENGTH && (pkey_type == TYPE_RSA || pkey_type == TYPE_DSA))
		/* TODO: appropriate minimal keylength for the different algorithm (esp. ECDSA) */
720 721 722 723 724 725
			{
			BIO_printf(bio_err,"private key length is too short,\n");
			BIO_printf(bio_err,"it needs to be at least %d bits, not %d\n",MIN_KEY_LENGTH,newkey);
			goto end;
			}
		BIO_printf(bio_err,"Generating a %d bit %s private key\n",
B
Bodo Möller 已提交
726
			newkey,(pkey_type == TYPE_RSA)?"RSA":(pkey_type == TYPE_DSA)?"DSA":"ECDSA");
727 728 729

		if ((pkey=EVP_PKEY_new()) == NULL) goto end;

730
#ifndef OPENSSL_NO_RSA
731 732 733
		if (pkey_type == TYPE_RSA)
			{
			if (!EVP_PKEY_assign_RSA(pkey,
734
				RSA_generate_key(newkey,0x10001,
B
Ben Laurie 已提交
735
					req_cb,bio_err)))
736 737 738 739
				goto end;
			}
		else
#endif
740
#ifndef OPENSSL_NO_DSA
741 742 743 744 745 746 747
			if (pkey_type == TYPE_DSA)
			{
			if (!DSA_generate_key(dsa_params)) goto end;
			if (!EVP_PKEY_assign_DSA(pkey,dsa_params)) goto end;
			dsa_params=NULL;
			}
#endif
B
Bodo Möller 已提交
748 749 750 751 752 753 754 755
#ifndef OPENSSL_NO_ECDSA
			if (pkey_type == TYPE_ECDSA)
			{
			if (!ECDSA_generate_key(ecdsa_params)) goto end;
			if (!EVP_PKEY_assign_ECDSA(pkey, ecdsa_params)) goto end;
			ecdsa_params = NULL;
			}
#endif
756

757
		app_RAND_write_file(randfile, bio_err);
758 759 760 761

		if (pkey == NULL) goto end;

		if (keyout == NULL)
762
			{
D
 
Dr. Stephen Henson 已提交
763
			keyout=NCONF_get_string(req_conf,SECTION,KEYFILE);
764 765 766 767
			if (keyout == NULL)
				ERR_clear_error();
			}
		
768 769 770 771
		if (keyout == NULL)
			{
			BIO_printf(bio_err,"writing new private key to stdout\n");
			BIO_set_fp(out,stdout,BIO_NOCLOSE);
772
#ifdef OPENSSL_SYS_VMS
773 774 775 776 777
			{
			BIO *tmpbio = BIO_new(BIO_f_linebuffer());
			out = BIO_push(tmpbio, out);
			}
#endif
778 779 780 781 782 783 784 785 786 787 788
			}
		else
			{
			BIO_printf(bio_err,"writing new private key to '%s'\n",keyout);
			if (BIO_write_filename(out,keyout) <= 0)
				{
				perror(keyout);
				goto end;
				}
			}

D
 
Dr. Stephen Henson 已提交
789
		p=NCONF_get_string(req_conf,SECTION,"encrypt_rsa_key");
790
		if (p == NULL)
791 792
			{
			ERR_clear_error();
D
 
Dr. Stephen Henson 已提交
793
			p=NCONF_get_string(req_conf,SECTION,"encrypt_key");
794 795 796
			if (p == NULL)
				ERR_clear_error();
			}
797 798 799 800 801 802 803
		if ((p != NULL) && (strcmp(p,"no") == 0))
			cipher=NULL;
		if (nodes) cipher=NULL;
		
		i=0;
loop:
		if (!PEM_write_bio_PrivateKey(out,pkey,cipher,
D
Dr. Stephen Henson 已提交
804
			NULL,0,NULL,passout))
805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837
			{
			if ((ERR_GET_REASON(ERR_peek_error()) ==
				PEM_R_PROBLEMS_GETTING_PASSWORD) && (i < 3))
				{
				ERR_clear_error();
				i++;
				goto loop;
				}
			goto end;
			}
		BIO_printf(bio_err,"-----\n");
		}

	if (!newreq)
		{
		/* Since we are using a pre-existing certificate
		 * request, the kludge 'format' info should not be
		 * changed. */
		kludge= -1;
		if (infile == NULL)
			BIO_set_fp(in,stdin,BIO_NOCLOSE);
		else
			{
			if (BIO_read_filename(in,infile) <= 0)
				{
				perror(infile);
				goto end;
				}
			}

		if	(informat == FORMAT_ASN1)
			req=d2i_X509_REQ_bio(in,NULL);
		else if (informat == FORMAT_PEM)
838
			req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL);
839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857
		else
			{
			BIO_printf(bio_err,"bad input format specified for X509 request\n");
			goto end;
			}
		if (req == NULL)
			{
			BIO_printf(bio_err,"unable to load X509 request\n");
			goto end;
			}
		}

	if (newreq || x509)
		{
		if (pkey == NULL)
			{
			BIO_printf(bio_err,"you need to specify a private key\n");
			goto end;
			}
858
#ifndef OPENSSL_NO_DSA
B
Bodo Möller 已提交
859 860
		if (pkey->type == EVP_PKEY_DSA)
			digest=EVP_dss1();
B
Bodo Möller 已提交
861 862 863 864
#endif
#ifndef OPENSSL_NO_ECDSA
		if (pkey->type == EVP_PKEY_ECDSA)
			digest=EVP_ecdsa();
B
Bodo Möller 已提交
865
#endif
866 867 868 869 870 871 872 873
		if (req == NULL)
			{
			req=X509_REQ_new();
			if (req == NULL)
				{
				goto end;
				}

874
			i=make_REQ(req,pkey,subj,!x509, chtype);
875
			subj=NULL; /* done processing '-subj' option */
D
 
Dr. Stephen Henson 已提交
876 877 878 879 880
			if ((kludge > 0) && !sk_X509_ATTRIBUTE_num(req->req_info->attributes))
				{
				sk_X509_ATTRIBUTE_free(req->req_info->attributes);
				req->req_info->attributes = NULL;
				}
881 882 883 884 885 886 887 888
			if (!i)
				{
				BIO_printf(bio_err,"problems making Certificate Request\n");
				goto end;
				}
			}
		if (x509)
			{
889
			EVP_PKEY *tmppkey;
890
			X509V3_CTX ext_ctx;
891 892
			if ((x509ss=X509_new()) == NULL) goto end;

893 894
			/* Set version to V3 */
			if(!X509_set_version(x509ss, 2)) goto end;
895
			if (serial)
B
Bodo Möller 已提交
896 897 898
				{
				if (!X509_set_serialNumber(x509ss, serial)) goto end;
				}
899
			else
B
Bodo Möller 已提交
900 901 902 903 904 905 906 907
				{
				if (!ASN1_INTEGER_set(X509_get_serialNumber(x509ss),0L)) goto end;
				}

			if (!X509_set_issuer_name(x509ss, X509_REQ_get_subject_name(req))) goto end;
			if (!X509_gmtime_adj(X509_get_notBefore(x509ss),0)) goto end;
			if (!X509_gmtime_adj(X509_get_notAfter(x509ss), (long)60*60*24*days)) goto end;
			if (!X509_set_subject_name(x509ss, X509_REQ_get_subject_name(req))) goto end;
908
			tmppkey = X509_REQ_get_pubkey(req);
B
Bodo Möller 已提交
909
			if (!tmppkey || !X509_set_pubkey(x509ss,tmppkey)) goto end;
910
			EVP_PKEY_free(tmppkey);
911

912 913
			/* Set up V3 context struct */

914
			X509V3_set_ctx(&ext_ctx, x509ss, x509ss, NULL, NULL, 0);
D
 
Dr. Stephen Henson 已提交
915
			X509V3_set_nconf(&ext_ctx, req_conf);
916 917

			/* Add extensions */
D
 
Dr. Stephen Henson 已提交
918
			if(extensions && !X509V3_EXT_add_nconf(req_conf, 
B
Ben Laurie 已提交
919
				 	&ext_ctx, extensions, x509ss))
920 921 922 923 924 925 926
				{
				BIO_printf(bio_err,
					"Error Loading extension section %s\n",
					extensions);
				goto end;
				}
			
927 928 929 930 931
			if (!(i=X509_sign(x509ss,pkey,digest)))
				goto end;
			}
		else
			{
932 933 934 935 936
			X509V3_CTX ext_ctx;

			/* Set up V3 context struct */

			X509V3_set_ctx(&ext_ctx, NULL, NULL, req, NULL, 0);
D
 
Dr. Stephen Henson 已提交
937
			X509V3_set_nconf(&ext_ctx, req_conf);
938 939

			/* Add extensions */
D
 
Dr. Stephen Henson 已提交
940
			if(req_exts && !X509V3_EXT_REQ_add_nconf(req_conf, 
941
				 	&ext_ctx, req_exts, req))
942 943 944 945 946 947
				{
				BIO_printf(bio_err,
					"Error Loading extension section %s\n",
					req_exts);
				goto end;
				}
948 949 950 951 952
			if (!(i=X509_REQ_sign(req,pkey,digest)))
				goto end;
			}
		}

953 954 955 956 957 958 959 960 961 962 963 964 965 966
	if (subj && x509)
		{
		BIO_printf(bio_err, "Cannot modifiy certificate subject\n");
		goto end;
		}

	if (subj && !x509)
		{
		if (verbose)
			{
			BIO_printf(bio_err, "Modifying Request's Subject\n");
			print_name(bio_err, "old subject=", X509_REQ_get_subject_name(req), nmflag);
			}

967
		if (build_subject(req, subj, chtype) == 0)
968 969 970 971 972 973 974 975 976 977 978 979 980 981
			{
			BIO_printf(bio_err, "ERROR: cannot modify subject\n");
			ex=1;
			goto end;
			}

		req->req_info->enc.modified = 1;

		if (verbose)
			{
			print_name(bio_err, "new subject=", X509_REQ_get_subject_name(req), nmflag);
			}
		}

982 983 984 985 986 987 988 989 990 991 992 993
	if (verify && !x509)
		{
		int tmp=0;

		if (pkey == NULL)
			{
			pkey=X509_REQ_get_pubkey(req);
			tmp=1;
			if (pkey == NULL) goto end;
			}

		i=X509_REQ_verify(req,pkey);
994 995 996 997
		if (tmp) {
			EVP_PKEY_free(pkey);
			pkey=NULL;
		}
998 999 1000 1001 1002 1003 1004 1005

		if (i < 0)
			{
			goto end;
			}
		else if (i == 0)
			{
			BIO_printf(bio_err,"verify failure\n");
B
Ben Laurie 已提交
1006
			ERR_print_errors(bio_err);
1007 1008 1009 1010 1011
			}
		else /* if (i > 0) */
			BIO_printf(bio_err,"verify OK\n");
		}

1012
	if (noout && !text && !modulus && !subject && !pubkey)
1013 1014 1015 1016 1017 1018
		{
		ex=0;
		goto end;
		}

	if (outfile == NULL)
1019
		{
1020
		BIO_set_fp(out,stdout,BIO_NOCLOSE);
1021
#ifdef OPENSSL_SYS_VMS
1022 1023 1024 1025 1026 1027
		{
		BIO *tmpbio = BIO_new(BIO_f_linebuffer());
		out = BIO_push(tmpbio, out);
		}
#endif
		}
1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040
	else
		{
		if ((keyout != NULL) && (strcmp(outfile,keyout) == 0))
			i=(int)BIO_append_filename(out,outfile);
		else
			i=(int)BIO_write_filename(out,outfile);
		if (!i)
			{
			perror(outfile);
			goto end;
			}
		}

1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054
	if (pubkey)
		{
		EVP_PKEY *tpubkey; 
		tpubkey=X509_REQ_get_pubkey(req);
		if (tpubkey == NULL)
			{
			BIO_printf(bio_err,"Error getting public key\n");
			ERR_print_errors(bio_err);
			goto end;
			}
		PEM_write_bio_PUBKEY(out, tpubkey);
		EVP_PKEY_free(tpubkey);
		}

1055 1056 1057 1058 1059 1060 1061 1062
	if (text)
		{
		if (x509)
			X509_print(out,x509ss);
		else	
			X509_REQ_print(out,req);
		}

1063 1064 1065 1066 1067 1068 1069 1070
	if(subject) 
		{
		if(x509)
			print_name(out, "subject=", X509_get_subject_name(x509ss), nmflag);
		else
			print_name(out, "subject=", X509_REQ_get_subject_name(req), nmflag);
		}

1071 1072
	if (modulus)
		{
1073
		EVP_PKEY *tpubkey;
1074 1075

		if (x509)
1076
			tpubkey=X509_get_pubkey(x509ss);
1077
		else
1078 1079
			tpubkey=X509_REQ_get_pubkey(req);
		if (tpubkey == NULL)
1080 1081 1082 1083 1084
			{
			fprintf(stdout,"Modulus=unavailable\n");
			goto end; 
			}
		fprintf(stdout,"Modulus=");
1085
#ifndef OPENSSL_NO_RSA
1086 1087
		if (tpubkey->type == EVP_PKEY_RSA)
			BN_print(out,tpubkey->pkey.rsa->n);
1088
		else
1089
#endif
1090
			fprintf(stdout,"Wrong Algorithm type");
1091
		EVP_PKEY_free(tpubkey);
1092 1093 1094 1095 1096 1097 1098
		fprintf(stdout,"\n");
		}

	if (!noout && !x509)
		{
		if 	(outformat == FORMAT_ASN1)
			i=i2d_X509_REQ_bio(out,req);
1099 1100 1101 1102
		else if (outformat == FORMAT_PEM) {
			if(newhdr) i=PEM_write_bio_X509_REQ_NEW(out,req);
			else i=PEM_write_bio_X509_REQ(out,req);
		} else {
1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133
			BIO_printf(bio_err,"bad output format specified for outfile\n");
			goto end;
			}
		if (!i)
			{
			BIO_printf(bio_err,"unable to write X509 request\n");
			goto end;
			}
		}
	if (!noout && x509 && (x509ss != NULL))
		{
		if 	(outformat == FORMAT_ASN1)
			i=i2d_X509_bio(out,x509ss);
		else if (outformat == FORMAT_PEM)
			i=PEM_write_bio_X509(out,x509ss);
		else	{
			BIO_printf(bio_err,"bad output format specified for outfile\n");
			goto end;
			}
		if (!i)
			{
			BIO_printf(bio_err,"unable to write X509 certificate\n");
			goto end;
			}
		}
	ex=0;
end:
	if (ex)
		{
		ERR_print_errors(bio_err);
		}
D
 
Dr. Stephen Henson 已提交
1134
	if ((req_conf != NULL) && (req_conf != config)) NCONF_free(req_conf);
1135
	BIO_free(in);
1136
	BIO_free_all(out);
1137 1138 1139
	EVP_PKEY_free(pkey);
	X509_REQ_free(req);
	X509_free(x509ss);
1140
	ASN1_INTEGER_free(serial);
1141 1142
	if(passargin && passin) OPENSSL_free(passin);
	if(passargout && passout) OPENSSL_free(passout);
1143
	OBJ_cleanup();
1144
#ifndef OPENSSL_NO_DSA
1145
	if (dsa_params != NULL) DSA_free(dsa_params);
B
Bodo Möller 已提交
1146 1147 1148
#endif
#ifndef OPENSSL_NO_ECDSA
	if (ecdsa_params != NULL) ECDSA_free(ecdsa_params);
1149
#endif
1150
	apps_shutdown();
1151 1152 1153
	EXIT(ex);
	}

1154 1155
static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs,
			unsigned long chtype)
1156
	{
1157
	int ret=0,i;
1158 1159 1160 1161
	char no_prompt = 0;
	STACK_OF(CONF_VALUE) *dn_sk, *attr_sk = NULL;
	char *tmp, *dn_sect,*attr_sect;

D
 
Dr. Stephen Henson 已提交
1162
	tmp=NCONF_get_string(req_conf,SECTION,PROMPT);
1163 1164
	if (tmp == NULL)
		ERR_clear_error();
1165 1166
	if((tmp != NULL) && !strcmp(tmp, "no")) no_prompt = 1;

D
 
Dr. Stephen Henson 已提交
1167
	dn_sect=NCONF_get_string(req_conf,SECTION,DISTINGUISHED_NAME);
1168
	if (dn_sect == NULL)
1169 1170 1171 1172 1173
		{
		BIO_printf(bio_err,"unable to find '%s' in config\n",
			DISTINGUISHED_NAME);
		goto err;
		}
D
 
Dr. Stephen Henson 已提交
1174
	dn_sk=NCONF_get_section(req_conf,dn_sect);
1175
	if (dn_sk == NULL)
1176
		{
1177
		BIO_printf(bio_err,"unable to get '%s' section\n",dn_sect);
1178 1179 1180
		goto err;
		}

D
 
Dr. Stephen Henson 已提交
1181
	attr_sect=NCONF_get_string(req_conf,SECTION,ATTRIBUTES);
1182
	if (attr_sect == NULL)
1183 1184
		{
		ERR_clear_error();		
1185
		attr_sk=NULL;
1186
		}
1187 1188
	else
		{
D
 
Dr. Stephen Henson 已提交
1189
		attr_sk=NCONF_get_section(req_conf,attr_sect);
1190
		if (attr_sk == NULL)
1191
			{
1192
			BIO_printf(bio_err,"unable to get '%s' section\n",attr_sect);
1193 1194 1195 1196
			goto err;
			}
		}

1197
	/* setup version number */
1198
	if (!X509_REQ_set_version(req,0L)) goto err; /* version 1 */
1199

1200
	if (no_prompt) 
1201
		i = auto_info(req, dn_sk, attr_sk, attribs, chtype);
1202 1203 1204
	else 
		{
		if (subj)
1205
			i = build_subject(req, subj, chtype);
1206
		else
1207
			i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs, chtype);
1208
		}
1209
	if(!i) goto err;
1210

B
Bodo Möller 已提交
1211
	if (!X509_REQ_set_pubkey(req,pkey)) goto err;
1212 1213 1214 1215 1216 1217

	ret=1;
err:
	return(ret);
	}

1218 1219 1220 1221
/*
 * subject is expected to be in the format /type0=value0/type1=value1/type2=...
 * where characters may be escaped by \
 */
1222
static int build_subject(X509_REQ *req, char *subject, unsigned long chtype)
1223
	{
D
 
Dr. Stephen Henson 已提交
1224
	X509_NAME *n;
1225

D
 
Dr. Stephen Henson 已提交
1226 1227
	if (!(n = do_subject(subject, chtype)))
		return 0;
1228

D
 
Dr. Stephen Henson 已提交
1229
	if (!X509_REQ_set_subject_name(req, n))
1230
		{
D
 
Dr. Stephen Henson 已提交
1231 1232
		X509_NAME_free(n);
		return 0;
1233 1234 1235 1236 1237
		}
	X509_NAME_free(n);
	return 1;
}

1238 1239 1240

static int prompt_info(X509_REQ *req,
		STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect,
1241 1242
		STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs,
		unsigned long chtype)
1243 1244 1245 1246
	{
	int i;
	char *p,*q;
	char buf[100];
D
 
Dr. Stephen Henson 已提交
1247 1248
	int nid;
	long n_min,n_max;
1249 1250 1251 1252
	char *type,*def,*value;
	CONF_VALUE *v;
	X509_NAME *subj;
	subj = X509_REQ_get_subject_name(req);
1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263

	if(!batch)
		{
		BIO_printf(bio_err,"You are about to be asked to enter information that will be incorporated\n");
		BIO_printf(bio_err,"into your certificate request.\n");
		BIO_printf(bio_err,"What you are about to enter is what is called a Distinguished Name or a DN.\n");
		BIO_printf(bio_err,"There are quite a few fields but you can leave some blank\n");
		BIO_printf(bio_err,"For some fields there will be a default value,\n");
		BIO_printf(bio_err,"If you enter '.', the field will be left blank.\n");
		BIO_printf(bio_err,"-----\n");
		}
1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292


	if (sk_CONF_VALUE_num(dn_sk))
		{
		i= -1;
start:		for (;;)
			{
			i++;
			if (sk_CONF_VALUE_num(dn_sk) <= i) break;

			v=sk_CONF_VALUE_value(dn_sk,i);
			p=q=NULL;
			type=v->name;
			if(!check_end(type,"_min") || !check_end(type,"_max") ||
				!check_end(type,"_default") ||
					 !check_end(type,"_value")) continue;
			/* Skip past any leading X. X: X, etc to allow for
			 * multiple instances 
			 */
			for(p = v->name; *p ; p++) 
				if ((*p == ':') || (*p == ',') ||
							 (*p == '.')) {
					p++;
					if(*p) type = p;
					break;
				}
			/* If OBJ not recognised ignore it */
			if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start;
			sprintf(buf,"%s_default",v->name);
D
 
Dr. Stephen Henson 已提交
1293
			if ((def=NCONF_get_string(req_conf,dn_sect,buf)) == NULL)
1294 1295
				{
				ERR_clear_error();
1296
				def="";
1297
				}
1298 1299
				
			sprintf(buf,"%s_value",v->name);
D
 
Dr. Stephen Henson 已提交
1300
			if ((value=NCONF_get_string(req_conf,dn_sect,buf)) == NULL)
1301 1302
				{
				ERR_clear_error();
1303
				value=NULL;
1304
				}
1305 1306

			sprintf(buf,"%s_min",v->name);
D
 
Dr. Stephen Henson 已提交
1307 1308
			if (!NCONF_get_number(req_conf,dn_sect,buf, &n_min))
				n_min = -1;
1309 1310

			sprintf(buf,"%s_max",v->name);
D
 
Dr. Stephen Henson 已提交
1311 1312
			if (!NCONF_get_number(req_conf,dn_sect,buf, &n_max))
				n_max = -1;
1313 1314

			if (!add_DN_object(subj,v->value,def,value,nid,
1315
				n_min,n_max, chtype))
1316 1317 1318 1319 1320 1321 1322 1323 1324 1325
				return 0;
			}
		if (X509_NAME_entry_count(subj) == 0)
			{
			BIO_printf(bio_err,"error, no objects specified in config file\n");
			return 0;
			}

		if (attribs)
			{
1326
			if ((attr_sk != NULL) && (sk_CONF_VALUE_num(attr_sk) > 0) && (!batch))
1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345
				{
				BIO_printf(bio_err,"\nPlease enter the following 'extra' attributes\n");
				BIO_printf(bio_err,"to be sent with your certificate request\n");
				}

			i= -1;
start2:			for (;;)
				{
				i++;
				if ((attr_sk == NULL) ||
					    (sk_CONF_VALUE_num(attr_sk) <= i))
					break;

				v=sk_CONF_VALUE_value(attr_sk,i);
				type=v->name;
				if ((nid=OBJ_txt2nid(type)) == NID_undef)
					goto start2;

				sprintf(buf,"%s_default",type);
D
 
Dr. Stephen Henson 已提交
1346
				if ((def=NCONF_get_string(req_conf,attr_sect,buf))
1347
					== NULL)
1348 1349
					{
					ERR_clear_error();
1350
					def="";
1351 1352
					}
				
1353 1354
				
				sprintf(buf,"%s_value",type);
D
 
Dr. Stephen Henson 已提交
1355
				if ((value=NCONF_get_string(req_conf,attr_sect,buf))
1356
					== NULL)
1357 1358
					{
					ERR_clear_error();
1359
					value=NULL;
1360
					}
1361 1362

				sprintf(buf,"%s_min",type);
D
 
Dr. Stephen Henson 已提交
1363 1364
				if (!NCONF_get_number(req_conf,attr_sect,buf, &n_min))
					n_min = -1;
1365 1366

				sprintf(buf,"%s_max",type);
D
 
Dr. Stephen Henson 已提交
1367 1368
				if (!NCONF_get_number(req_conf,attr_sect,buf, &n_max))
					n_max = -1;
1369

1370
				if (!add_attribute_object(req,
1371
					v->value,def,value,nid,n_min,n_max, chtype))
1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386
					return 0;
				}
			}
		}
	else
		{
		BIO_printf(bio_err,"No template, please set one up.\n");
		return 0;
		}

	return 1;

	}

static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk,
1387
			STACK_OF(CONF_VALUE) *attr_sk, int attribs, unsigned long chtype)
1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405
	{
	int i;
	char *p,*q;
	char *type;
	CONF_VALUE *v;
	X509_NAME *subj;

	subj = X509_REQ_get_subject_name(req);

	for (i = 0; i < sk_CONF_VALUE_num(dn_sk); i++)
		{
		v=sk_CONF_VALUE_value(dn_sk,i);
		p=q=NULL;
		type=v->name;
		/* Skip past any leading X. X: X, etc to allow for
		 * multiple instances 
		 */
		for(p = v->name; *p ; p++) 
1406
#ifndef CHARSET_EBCDIC
1407
			if ((*p == ':') || (*p == ',') || (*p == '.')) {
1408 1409 1410
#else
			if ((*p == os_toascii[':']) || (*p == os_toascii[',']) || (*p == os_toascii['.'])) {
#endif
1411 1412 1413 1414
				p++;
				if(*p) type = p;
				break;
			}
1415
		if (!X509_NAME_add_entry_by_txt(subj,type, chtype,
1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426
				(unsigned char *) v->value,-1,-1,0)) return 0;

		}

		if (!X509_NAME_entry_count(subj))
			{
			BIO_printf(bio_err,"error, no objects specified in config file\n");
			return 0;
			}
		if (attribs)
			{
1427
			for (i = 0; i < sk_CONF_VALUE_num(attr_sk); i++)
1428 1429
				{
				v=sk_CONF_VALUE_value(attr_sk,i);
1430
				if(!X509_REQ_add1_attr_by_txt(req, v->name, chtype,
1431
					(unsigned char *)v->value, -1)) return 0;
1432 1433 1434 1435 1436 1437
				}
			}
	return 1;
	}


U
Ulf Möller 已提交
1438
static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
1439
	     int nid, int n_min, int n_max, unsigned long chtype)
1440
	{
1441
	int i,ret=0;
1442
	MS_STATIC char buf[1024];
1443
start:
1444
	if (!batch) BIO_printf(bio_err,"%s [%s]:",text,def);
B
Bodo Möller 已提交
1445
	(void)BIO_flush(bio_err);
1446
	if(value != NULL)
1447 1448 1449 1450 1451 1452 1453 1454
		{
		strcpy(buf,value);
		strcat(buf,"\n");
		BIO_printf(bio_err,"%s\n",value);
		}
	else
		{
		buf[0]='\0';
1455 1456 1457 1458 1459 1460 1461 1462 1463
		if (!batch)
			{
			fgets(buf,1024,stdin);
			}
		else
			{
			buf[0] = '\n';
			buf[1] = '\0';
			}
1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482
		}

	if (buf[0] == '\0') return(0);
	else if (buf[0] == '\n')
		{
		if ((def == NULL) || (def[0] == '\0'))
			return(1);
		strcpy(buf,def);
		strcat(buf,"\n");
		}
	else if ((buf[0] == '.') && (buf[1] == '\n')) return(1);

	i=strlen(buf);
	if (buf[i-1] != '\n')
		{
		BIO_printf(bio_err,"weird input :-(\n");
		return(0);
		}
	buf[--i]='\0';
1483 1484 1485
#ifdef CHARSET_EBCDIC
	ebcdic2ascii(buf, buf, i);
#endif
D
 
Dr. Stephen Henson 已提交
1486
	if(!req_check_len(i, n_min, n_max)) goto start;
1487
	if (!X509_NAME_add_entry_by_NID(n,nid, chtype,
1488
				(unsigned char *) buf, -1,-1,0)) goto err;
1489 1490 1491 1492 1493
	ret=1;
err:
	return(ret);
	}

1494
static int add_attribute_object(X509_REQ *req, char *text,
D
 
Dr. Stephen Henson 已提交
1495
				char *def, char *value, int nid, int n_min,
1496
				int n_max, unsigned long chtype)
1497
	{
1498
	int i;
1499 1500 1501
	static char buf[1024];

start:
1502
	if (!batch) BIO_printf(bio_err,"%s [%s]:",text,def);
B
Bodo Möller 已提交
1503
	(void)BIO_flush(bio_err);
1504 1505 1506 1507 1508 1509 1510 1511 1512
	if (value != NULL)
		{
		strcpy(buf,value);
		strcat(buf,"\n");
		BIO_printf(bio_err,"%s\n",value);
		}
	else
		{
		buf[0]='\0';
1513 1514 1515 1516 1517 1518 1519 1520 1521
		if (!batch)
			{
			fgets(buf,1024,stdin);
			}
		else
			{
			buf[0] = '\n';
			buf[1] = '\0';
			}
1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540
		}

	if (buf[0] == '\0') return(0);
	else if (buf[0] == '\n')
		{
		if ((def == NULL) || (def[0] == '\0'))
			return(1);
		strcpy(buf,def);
		strcat(buf,"\n");
		}
	else if ((buf[0] == '.') && (buf[1] == '\n')) return(1);

	i=strlen(buf);
	if (buf[i-1] != '\n')
		{
		BIO_printf(bio_err,"weird input :-(\n");
		return(0);
		}
	buf[--i]='\0';
1541 1542 1543
#ifdef CHARSET_EBCDIC
	ebcdic2ascii(buf, buf, i);
#endif
D
 
Dr. Stephen Henson 已提交
1544
	if(!req_check_len(i, n_min, n_max)) goto start;
1545

1546
	if(!X509_REQ_add1_attr_by_NID(req, nid, chtype,
1547 1548 1549
					(unsigned char *)buf, -1)) {
		BIO_printf(bio_err, "Error adding attribute\n");
		ERR_print_errors(bio_err);
1550
		goto err;
1551
	}
1552 1553 1554 1555 1556 1557

	return(1);
err:
	return(0);
	}

1558
#ifndef OPENSSL_NO_RSA
B
Ben Laurie 已提交
1559
static void MS_CALLBACK req_cb(int p, int n, void *arg)
1560 1561 1562 1563 1564 1565 1566
	{
	char c='*';

	if (p == 0) c='.';
	if (p == 1) c='+';
	if (p == 2) c='*';
	if (p == 3) c='\n';
1567
	BIO_write((BIO *)arg,&c,1);
B
Bodo Möller 已提交
1568
	(void)BIO_flush((BIO *)arg);
1569 1570 1571 1572
#ifdef LINT
	p=n;
#endif
	}
B
Ben Laurie 已提交
1573
#endif
1574

D
 
Dr. Stephen Henson 已提交
1575
static int req_check_len(int len, int n_min, int n_max)
1576
	{
D
 
Dr. Stephen Henson 已提交
1577
	if ((n_min > 0) && (len < n_min))
1578
		{
D
 
Dr. Stephen Henson 已提交
1579
		BIO_printf(bio_err,"string is too short, it needs to be at least %d bytes long\n",n_min);
1580 1581
		return(0);
		}
D
 
Dr. Stephen Henson 已提交
1582
	if ((n_max >= 0) && (len > n_max))
1583
		{
D
 
Dr. Stephen Henson 已提交
1584
		BIO_printf(bio_err,"string is too long, it needs to be less than  %d bytes long\n",n_max);
1585 1586 1587 1588
		return(0);
		}
	return(1);
	}
1589 1590

/* Check if the end of a string matches 'end' */
U
Ulf Möller 已提交
1591
static int check_end(char *str, char *end)
1592 1593 1594 1595 1596 1597 1598 1599 1600
{
	int elen, slen;	
	char *tmp;
	elen = strlen(end);
	slen = strlen(str);
	if(elen > slen) return 1;
	tmp = str + slen - elen;
	return strcmp(tmp, end);
}