ca.c 72.2 KB
Newer Older
1
/* apps/ca.c */
2
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

/* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
64
#include <ctype.h>
65 66 67
#include <sys/types.h>
#include <sys/stat.h>
#include "apps.h"
68 69 70 71 72 73 74 75 76
#include <openssl/conf.h>
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/bn.h>
#include <openssl/txt_db.h>
#include <openssl/evp.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/objects.h>
77
#include <openssl/ocsp.h>
78
#include <openssl/pem.h>
79
#include <openssl/engine.h>
80

81 82 83 84 85 86
#ifdef OPENSSL_SYS_WINDOWS
#define strcasecmp _stricmp
#else
#include <strings.h>
#endif

87
#ifndef W_OK
88
#  ifdef OPENSSL_SYS_VMS
U
Ulf Möller 已提交
89 90 91 92 93 94 95 96 97 98 99 100 101 102 103
#    if defined(__DECC)
#      include <unistd.h>
#    else
#      include <unixlib.h>
#    endif
#  else
#    include <sys/file.h>
#  endif
#endif

#ifndef W_OK
#  define F_OK 0
#  define X_OK 1
#  define W_OK 2
#  define R_OK 4
104 105 106 107 108 109
#endif

#undef PROG
#define PROG ca_main

#define BASE_SECTION	"ca"
U
Ulf Möller 已提交
110
#define CONFIG_FILE "openssl.cnf"
111 112 113 114 115 116 117 118 119 120 121 122 123 124

#define ENV_DEFAULT_CA		"default_ca"

#define ENV_DIR			"dir"
#define ENV_CERTS		"certs"
#define ENV_CRL_DIR		"crl_dir"
#define ENV_CA_DB		"CA_DB"
#define ENV_NEW_CERTS_DIR	"new_certs_dir"
#define ENV_CERTIFICATE 	"certificate"
#define ENV_SERIAL		"serial"
#define ENV_CRL			"crl"
#define ENV_PRIVATE_KEY		"private_key"
#define ENV_RANDFILE		"RANDFILE"
#define ENV_DEFAULT_DAYS 	"default_days"
125
#define ENV_DEFAULT_STARTDATE 	"default_startdate"
126
#define ENV_DEFAULT_ENDDATE 	"default_enddate"
127 128 129 130 131 132
#define ENV_DEFAULT_CRL_DAYS 	"default_crl_days"
#define ENV_DEFAULT_CRL_HOURS 	"default_crl_hours"
#define ENV_DEFAULT_MD		"default_md"
#define ENV_PRESERVE		"preserve"
#define ENV_POLICY      	"policy"
#define ENV_EXTENSIONS      	"x509_extensions"
133
#define ENV_CRLEXT      	"crl_extensions"
134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149
#define ENV_MSIE_HACK		"msie_hack"

#define ENV_DATABASE		"database"

#define DB_type         0
#define DB_exp_date     1
#define DB_rev_date     2
#define DB_serial       3       /* index - unique */
#define DB_file         4       
#define DB_name         5       /* index - unique for active */
#define DB_NUMBER       6

#define DB_TYPE_REV	'R'
#define DB_TYPE_EXP	'E'
#define DB_TYPE_VAL	'V'

150 151 152 153 154 155 156 157
/* Additional revocation information types */

#define REV_NONE		0	/* No addditional information */
#define REV_CRL_REASON		1	/* Value is CRL reason code */
#define REV_HOLD		2	/* Value is hold instruction */
#define REV_KEY_COMPROMISE	3	/* Value is cert key compromise time */
#define REV_CA_COMPROMISE	4	/* Value is CA key compromise time */

158 159 160 161 162 163 164 165 166
static char *ca_usage[]={
"usage: ca args\n",
"\n",
" -verbose        - Talk alot while doing things\n",
" -config file    - A config file\n",
" -name arg       - The particular CA definition to use\n",
" -gencrl         - Generate a new CRL\n",
" -crldays days   - Days is when the next CRL is due\n",
" -crlhours hours - Hours is when the next CRL is due\n",
167 168
" -startdate YYMMDDHHMMSSZ  - certificate validity notBefore\n",
" -enddate YYMMDDHHMMSSZ    - certificate validity notAfter (overrides -days)\n",
169 170 171
" -days arg       - number of days to certify the certificate for\n",
" -md arg         - md to use, one of md2, md5, sha or sha1\n",
" -policy arg     - The CA 'policy' to support\n",
172 173
" -keyfile arg    - private key file\n",
" -keyform arg    - private key file format (PEM or ENGINE)\n",
174
" -key arg        - key to decode the private key if it is encrypted\n",
B
Ben Laurie 已提交
175
" -cert file      - The CA certificate\n",
176 177 178 179 180
" -in file        - The input PEM encoded certificate request(s)\n",
" -out file       - Where to put the output file(s)\n",
" -outdir dir     - Where to put output certificates\n",
" -infiles ....   - The last argument, requests to process\n",
" -spkac file     - File contains DN and signed public key and challenge\n",
181
" -ss_cert file   - File contains a self signed cert to sign\n",
182
" -preserveDN     - Don't re-order the DN\n",
183 184
" -batch          - Don't ask questions\n",
" -msie_hack      - msie modifications to handle all those universal strings\n",
185
" -revoke file    - Revoke a certificate (given in file)\n",
186
" -subj arg       - Use arg instead of request's subject\n",
187
" -extensions ..  - Extension section (override value in config file)\n",
188
" -extfile file   - Configuration file with X509v3 extentions to add\n",
189
" -crlexts ..     - CRL extension section (override value in config file)\n",
190
" -engine e       - use engine e, possibly a hardware device.\n",
191 192
" -status serial  - Shows certificate status given the serial number\n",
" -updatedb       - Updates db for expired certificates\n",
193 194 195 196 197 198 199 200 201 202
NULL
};

#ifdef EFENCE
extern int EF_PROTECT_FREE;
extern int EF_PROTECT_BELOW;
extern int EF_ALIGNMENT;
#endif

static void lookup_fail(char *name,char *tag);
203 204 205
static unsigned long index_serial_hash(const char **a);
static int index_serial_cmp(const char **a, const char **b);
static unsigned long index_name_hash(const char **a);
206
static int index_name_qual(char **a);
207
static int index_name_cmp(const char **a,const char **b);
208 209 210
static BIGNUM *load_serial(char *serialfile);
static int save_serial(char *serialfile, BIGNUM *serial);
static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
211
		   const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,TXT_DB *db,
212 213
		   BIGNUM *serial, char *subj, char *startdate,char *enddate,
		   int days, int batch, char *ext_sect, LHASH *conf,int verbose);
214
static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
215
			const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
216
			TXT_DB *db, BIGNUM *serial, char *subj, char *startdate,
217 218
			char *enddate, int days, int batch, char *ext_sect,
			LHASH *conf,int verbose);
219
static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
220
			 const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
221
			 TXT_DB *db, BIGNUM *serial,char *subj, char *startdate,
222 223
			 char *enddate, int days, char *ext_sect,LHASH *conf,
				int verbose);
224
static int fix_data(int nid, int *type);
D
 
Dr. Stephen Henson 已提交
225
static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
B
Ben Laurie 已提交
226
static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
227
	STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,char *subj,
228 229
	char *startdate, char *enddate, int days, int batch, int verbose,
	X509_REQ *req, char *ext_sect, LHASH *conf);
230
static X509_NAME *do_subject(char *subject);
231
static int do_revoke(X509 *x509, TXT_DB *db, int ext, char *extval);
232 233
static int get_certificate_status(const char *ser_status, TXT_DB *db);
static int do_updatedb(TXT_DB *db);
234
static int check_time_format(char *str);
235 236
char *make_revocation_str(int rev_type, char *rev_arg);
int make_revoked(X509_REVOKED *rev, char *str);
237
static LHASH *conf=NULL;
238
static LHASH *extconf=NULL;
239 240 241 242 243
static char *section=NULL;

static int preserve=0;
static int msie_hack=0;

B
Ben Laurie 已提交
244 245 246 247
static IMPLEMENT_LHASH_HASH_FN(index_serial_hash,const char **)
static IMPLEMENT_LHASH_COMP_FN(index_serial_cmp,const char **)
static IMPLEMENT_LHASH_HASH_FN(index_name_hash,const char **)
static IMPLEMENT_LHASH_COMP_FN(index_name_cmp,const char **)
248 249


250 251
int MAIN(int, char **);

U
Ulf Möller 已提交
252
int MAIN(int argc, char **argv)
253
	{
254
	ENGINE *e = NULL;
255
	char *key=NULL,*passargin=NULL;
256 257 258 259 260 261 262
	int total=0;
	int total_done=0;
	int badops=0;
	int ret=1;
	int req=0;
	int verbose=0;
	int gencrl=0;
263
	int dorevoke=0;
264
	int doupdatedb=0;
265 266 267 268 269 270 271 272
	long crldays=0;
	long crlhours=0;
	long errorline= -1;
	char *configfile=NULL;
	char *md=NULL;
	char *policy=NULL;
	char *keyfile=NULL;
	char *certfile=NULL;
273
	int keyform=FORMAT_PEM;
274 275
	char *infile=NULL;
	char *spkac_file=NULL;
276
	char *ss_cert_file=NULL;
277
	char *ser_status=NULL;
278 279 280 281 282 283
	EVP_PKEY *pkey=NULL;
	int output_der = 0;
	char *outfile=NULL;
	char *outdir=NULL;
	char *serialfile=NULL;
	char *extensions=NULL;
284
	char *extfile=NULL;
285
	char *subj=NULL;
286
	char *crl_ext=NULL;
287 288
	int rev_type = REV_NONE;
	char *rev_arg = NULL;
289
	BIGNUM *serial=NULL;
290
	char *startdate=NULL;
291
	char *enddate=NULL;
292 293
	int days=0;
	int batch=0;
D
 
Dr. Stephen Henson 已提交
294
	int notext=0;
295 296 297 298 299 300 301 302 303 304 305
	X509 *x509=NULL;
	X509 *x=NULL;
	BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
	char *dbfile=NULL;
	TXT_DB *db=NULL;
	X509_CRL *crl=NULL;
	X509_CRL_INFO *ci=NULL;
	X509_REVOKED *r=NULL;
	char **pp,*p,*f;
	int i,j;
	long l;
B
Ben Laurie 已提交
306
	const EVP_MD *dgst=NULL;
307
	STACK_OF(CONF_VALUE) *attribs=NULL;
B
Ben Laurie 已提交
308
	STACK_OF(X509) *cert_sk=NULL;
309 310 311
#undef BSIZE
#define BSIZE 256
	MS_STATIC char buf[3][BSIZE];
B
Ben Laurie 已提交
312
	char *randfile=NULL;
313
	char *engine = NULL;
314 315 316 317 318 319 320 321 322

#ifdef EFENCE
EF_PROTECT_FREE=1;
EF_PROTECT_BELOW=1;
EF_ALIGNMENT=0;
#endif

	apps_startup();

323
	conf = NULL;
324 325 326
	key = NULL;
	section = NULL;

327
	preserve=0;
328
	msie_hack=0;
329 330
	if (bio_err == NULL)
		if ((bio_err=BIO_new(BIO_s_file())) != NULL)
331
			BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348

	argc--;
	argv++;
	while (argc >= 1)
		{
		if	(strcmp(*argv,"-verbose") == 0)
			verbose=1;
		else if	(strcmp(*argv,"-config") == 0)
			{
			if (--argc < 1) goto bad;
			configfile= *(++argv);
			}
		else if (strcmp(*argv,"-name") == 0)
			{
			if (--argc < 1) goto bad;
			section= *(++argv);
			}
349 350 351 352 353 354
		else if (strcmp(*argv,"-subj") == 0)
			{
			if (--argc < 1) goto bad;
			subj= *(++argv);
			/* preserve=1; */
			}
355 356 357 358 359
		else if (strcmp(*argv,"-startdate") == 0)
			{
			if (--argc < 1) goto bad;
			startdate= *(++argv);
			}
360 361 362 363 364
		else if (strcmp(*argv,"-enddate") == 0)
			{
			if (--argc < 1) goto bad;
			enddate= *(++argv);
			}
365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384
		else if (strcmp(*argv,"-days") == 0)
			{
			if (--argc < 1) goto bad;
			days=atoi(*(++argv));
			}
		else if (strcmp(*argv,"-md") == 0)
			{
			if (--argc < 1) goto bad;
			md= *(++argv);
			}
		else if (strcmp(*argv,"-policy") == 0)
			{
			if (--argc < 1) goto bad;
			policy= *(++argv);
			}
		else if (strcmp(*argv,"-keyfile") == 0)
			{
			if (--argc < 1) goto bad;
			keyfile= *(++argv);
			}
385 386 387 388 389
		else if (strcmp(*argv,"-keyform") == 0)
			{
			if (--argc < 1) goto bad;
			keyform=str2fmt(*(++argv));
			}
390 391 392 393 394
		else if (strcmp(*argv,"-passin") == 0)
			{
			if (--argc < 1) goto bad;
			passargin= *(++argv);
			}
395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420
		else if (strcmp(*argv,"-key") == 0)
			{
			if (--argc < 1) goto bad;
			key= *(++argv);
			}
		else if (strcmp(*argv,"-cert") == 0)
			{
			if (--argc < 1) goto bad;
			certfile= *(++argv);
			}
		else if (strcmp(*argv,"-in") == 0)
			{
			if (--argc < 1) goto bad;
			infile= *(++argv);
			req=1;
			}
		else if (strcmp(*argv,"-out") == 0)
			{
			if (--argc < 1) goto bad;
			outfile= *(++argv);
			}
		else if (strcmp(*argv,"-outdir") == 0)
			{
			if (--argc < 1) goto bad;
			outdir= *(++argv);
			}
D
 
Dr. Stephen Henson 已提交
421 422
		else if (strcmp(*argv,"-notext") == 0)
			notext=1;
423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447
		else if (strcmp(*argv,"-batch") == 0)
			batch=1;
		else if (strcmp(*argv,"-preserveDN") == 0)
			preserve=1;
		else if (strcmp(*argv,"-gencrl") == 0)
			gencrl=1;
		else if (strcmp(*argv,"-msie_hack") == 0)
			msie_hack=1;
		else if (strcmp(*argv,"-crldays") == 0)
			{
			if (--argc < 1) goto bad;
			crldays= atol(*(++argv));
			}
		else if (strcmp(*argv,"-crlhours") == 0)
			{
			if (--argc < 1) goto bad;
			crlhours= atol(*(++argv));
			}
		else if (strcmp(*argv,"-infiles") == 0)
			{
			argc--;
			argv++;
			req=1;
			break;
			}
448 449 450 451 452 453
		else if (strcmp(*argv, "-ss_cert") == 0)
			{
			if (--argc < 1) goto bad;
			ss_cert_file = *(++argv);
			req=1;
			}
454 455 456 457 458 459
		else if (strcmp(*argv, "-spkac") == 0)
			{
			if (--argc < 1) goto bad;
			spkac_file = *(++argv);
			req=1;
			}
460 461 462 463
		else if (strcmp(*argv,"-revoke") == 0)
			{
			if (--argc < 1) goto bad;
			infile= *(++argv);
464
			dorevoke=1;
465
			}
466 467 468 469 470
		else if (strcmp(*argv,"-extensions") == 0)
			{
			if (--argc < 1) goto bad;
			extensions= *(++argv);
			}
471 472 473 474 475
		else if (strcmp(*argv,"-extfile") == 0)
			{
			if (--argc < 1) goto bad;
			extfile= *(++argv);
			}
476 477 478 479 480 481 482 483 484
		else if (strcmp(*argv,"-status") == 0)
			{
			if (--argc < 1) goto bad;
			ser_status= *(++argv);
			}
		else if (strcmp(*argv,"-updatedb") == 0)
			{
			doupdatedb=1;
			}
485 486 487 488 489
		else if (strcmp(*argv,"-crlexts") == 0)
			{
			if (--argc < 1) goto bad;
			crl_ext= *(++argv);
			}
490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513
		else if (strcmp(*argv,"-crl_reason") == 0)
			{
			if (--argc < 1) goto bad;
			rev_arg = *(++argv);
			rev_type = REV_CRL_REASON;
			}
		else if (strcmp(*argv,"-crl_hold") == 0)
			{
			if (--argc < 1) goto bad;
			rev_arg = *(++argv);
			rev_type = REV_HOLD;
			}
		else if (strcmp(*argv,"-crl_compromise") == 0)
			{
			if (--argc < 1) goto bad;
			rev_arg = *(++argv);
			rev_type = REV_KEY_COMPROMISE;
			}
		else if (strcmp(*argv,"-crl_CA_compromise") == 0)
			{
			if (--argc < 1) goto bad;
			rev_arg = *(++argv);
			rev_type = REV_CA_COMPROMISE;
			}
514 515 516 517 518
		else if (strcmp(*argv,"-engine") == 0)
			{
			if (--argc < 1) goto bad;
			engine= *(++argv);
			}
519 520 521 522 523 524 525 526 527 528 529 530 531 532
		else
			{
bad:
			BIO_printf(bio_err,"unknown option %s\n",*argv);
			badops=1;
			break;
			}
		argc--;
		argv++;
		}

	if (badops)
		{
		for (pp=ca_usage; (*pp != NULL); pp++)
U
Ulf Möller 已提交
533
			BIO_printf(bio_err,"%s",*pp);
534 535 536 537 538
		goto err;
		}

	ERR_load_crypto_strings();

539 540
	if (engine != NULL)
		{
541
		if ((e = ENGINE_by_id(engine)) == NULL)
542 543 544 545 546
			{
			BIO_printf(bio_err,"invalid engine \"%s\"\n",
				engine);
			goto err;
			}
547
		if (!ENGINE_set_default(e, ENGINE_METHOD_ALL))
548 549 550 551 552 553 554 555 556
			{
			BIO_printf(bio_err,"can't use that engine\n");
			goto err;
			}
		BIO_printf(bio_err,"engine \"%s\" set.\n", engine);
		/* Free our "structural" reference. */
		ENGINE_free(e);
		}

557
	/*****************************************************************/
558 559
	if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
	if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
560 561 562
	if (configfile == NULL)
		{
		/* We will just use 'buf[0]' as a temporary buffer.  */
563
#ifdef OPENSSL_SYS_VMS
U
Ulf Möller 已提交
564 565 566
		strncpy(buf[0],X509_get_default_cert_area(),
			sizeof(buf[0])-1-sizeof(CONFIG_FILE));
#else
567 568 569
		strncpy(buf[0],X509_get_default_cert_area(),
			sizeof(buf[0])-2-sizeof(CONFIG_FILE));
		strcat(buf[0],"/");
U
Ulf Möller 已提交
570
#endif
571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597
		strcat(buf[0],CONFIG_FILE);
		configfile=buf[0];
		}

	BIO_printf(bio_err,"Using configuration from %s\n",configfile);
	if ((conf=CONF_load(NULL,configfile,&errorline)) == NULL)
		{
		if (errorline <= 0)
			BIO_printf(bio_err,"error loading the config file '%s'\n",
				configfile);
		else
			BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
				,errorline,configfile);
		goto err;
		}

	/* Lets get the config section we are using */
	if (section == NULL)
		{
		section=CONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
		if (section == NULL)
			{
			lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
			goto err;
			}
		}

598 599 600
	if (conf != NULL)
		{
		p=CONF_get_string(conf,NULL,"oid_file");
601 602
		if (p == NULL)
			ERR_clear_error();
603 604 605 606 607 608 609 610 611 612 613
		if (p != NULL)
			{
			BIO *oid_bio;

			oid_bio=BIO_new_file(p,"r");
			if (oid_bio == NULL) 
				{
				/*
				BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
				ERR_print_errors(bio_err);
				*/
B
Ben Laurie 已提交
614
				ERR_clear_error();
615 616 617 618 619 620 621
				}
			else
				{
				OBJ_create_objects(oid_bio);
				BIO_free(oid_bio);
				}
			}
622
		if (!add_oid_section(bio_err,conf)) 
623
			{
624 625
			ERR_print_errors(bio_err);
			goto err;
626
			}
627
		}
628

629
	randfile = CONF_get_string(conf, BASE_SECTION, "RANDFILE");
630 631
	if (randfile == NULL)
		ERR_clear_error();
632 633
	app_RAND_load_file(randfile, bio_err, 0);
	
634 635 636 637 638 639 640 641 642 643 644
	in=BIO_new(BIO_s_file());
	out=BIO_new(BIO_s_file());
	Sout=BIO_new(BIO_s_file());
	Cout=BIO_new(BIO_s_file());
	if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
		{
		ERR_print_errors(bio_err);
		goto err;
		}

	/*****************************************************************/
645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679
	/* report status of cert with serial number given on command line */
	if (ser_status)
	{
		if ((dbfile=CONF_get_string(conf,section,ENV_DATABASE)) == NULL)
			{
			lookup_fail(section,ENV_DATABASE);
			goto err;
			}
		if (BIO_read_filename(in,dbfile) <= 0)
			{
			perror(dbfile);
			BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
			goto err;
			}
		db=TXT_DB_read(in,DB_NUMBER);
		if (db == NULL) goto err;

		if (!TXT_DB_create_index(db, DB_serial, NULL,
					LHASH_HASH_FN(index_serial_hash),
					LHASH_COMP_FN(index_serial_cmp)))
			{
			BIO_printf(bio_err,
			  "error creating serial number index:(%ld,%ld,%ld)\n",
			  			db->error,db->arg1,db->arg2);
			goto err;
			}

		if (get_certificate_status(ser_status,db) != 1)
			BIO_printf(bio_err,"Error verifying serial %s!\n",
				 ser_status);
		goto err;
	}

	/*****************************************************************/
	/* we definitely need a public key, so let's get it */
680 681 682 683 684 685 686

	if ((keyfile == NULL) && ((keyfile=CONF_get_string(conf,
		section,ENV_PRIVATE_KEY)) == NULL))
		{
		lookup_fail(section,ENV_PRIVATE_KEY);
		goto err;
		}
687
	if (!key && !app_passwd(bio_err, passargin, NULL, &key, NULL))
688 689 690 691
		{
		BIO_printf(bio_err,"Error getting password\n");
		goto err;
		}
692
	if (keyform == FORMAT_ENGINE)
693
		{
694 695 696 697 698 699
		if (!e)
			{
			BIO_printf(bio_err,"no engine specified\n");
			goto err;
			}
		pkey = ENGINE_load_private_key(e, keyfile, key);
700
		}
701 702 703 704 705 706 707 708
	else if (keyform == FORMAT_PEM)
		{
		if (BIO_read_filename(in,keyfile) <= 0)
			{
			perror(keyfile);
			BIO_printf(bio_err,"trying to load CA private key\n");
			goto err;
			}
D
Dr. Stephen Henson 已提交
709
		pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,key);
710 711 712 713 714 715
		}
	else
		{
		BIO_printf(bio_err,"bad input format specified for key file\n");
		goto err;
		}
716
	if (key) memset(key,0,strlen(key));
717 718 719 720 721 722 723 724 725 726 727 728 729 730
	if (pkey == NULL)
		{
		BIO_printf(bio_err,"unable to load CA private key\n");
		goto err;
		}

	/*****************************************************************/
	/* we need a certificate */
	if ((certfile == NULL) && ((certfile=CONF_get_string(conf,
		section,ENV_CERTIFICATE)) == NULL))
		{
		lookup_fail(section,ENV_CERTIFICATE);
		goto err;
		}
731
	if (BIO_read_filename(in,certfile) <= 0)
732 733 734 735 736
		{
		perror(certfile);
		BIO_printf(bio_err,"trying to load CA certificate\n");
		goto err;
		}
737
	x509=PEM_read_bio_X509(in,NULL,NULL,NULL);
738 739 740 741 742 743
	if (x509 == NULL)
		{
		BIO_printf(bio_err,"unable to load CA certificate\n");
		goto err;
		}

744 745 746 747 748 749
	if (!X509_check_private_key(x509,pkey))
		{
		BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
		goto err;
		}

750
	f=CONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
751 752
	if (f == NULL)
		ERR_clear_error();
753 754 755
	if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
		preserve=1;
	f=CONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
756 757
	if (f == NULL)
		ERR_clear_error();
758 759 760 761 762 763 764 765 766 767 768 769 770 771 772
	if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
		msie_hack=1;

	/*****************************************************************/
	/* lookup where to write new certificates */
	if ((outdir == NULL) && (req))
		{
		struct stat sb;

		if ((outdir=CONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
			== NULL)
			{
			BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
			goto err;
			}
773 774
#ifndef OPENSSL_SYS_VMS
	    /* outdir is a directory spec, but access() for VMS demands a
775 776 777 778 779 780 781 782
	       filename.  In any case, stat(), below, will catch the problem
	       if outdir is not a directory spec, and the fopen() or open()
	       will catch an error if there is no write access.

	       Presumably, this problem could also be solved by using the DEC
	       C routines to convert the directory syntax to Unixly, and give
	       that to access().  However, time's too short to do that just
	       now.
783
	    */
784 785
		if (access(outdir,R_OK|W_OK|X_OK) != 0)
			{
U
Ulf Möller 已提交
786
			BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
787 788 789 790 791 792 793 794 795 796
			perror(outdir);
			goto err;
			}

		if (stat(outdir,&sb) != 0)
			{
			BIO_printf(bio_err,"unable to stat(%s)\n",outdir);
			perror(outdir);
			goto err;
			}
797
#ifdef S_IFDIR
798 799 800 801 802 803
		if (!(sb.st_mode & S_IFDIR))
			{
			BIO_printf(bio_err,"%s need to be a directory\n",outdir);
			perror(outdir);
			goto err;
			}
804
#endif
805
#endif
806 807 808 809 810 811 812 813 814
		}

	/*****************************************************************/
	/* we need to load the database file */
	if ((dbfile=CONF_get_string(conf,section,ENV_DATABASE)) == NULL)
		{
		lookup_fail(section,ENV_DATABASE);
		goto err;
		}
815
	if (BIO_read_filename(in,dbfile) <= 0)
816 817 818 819 820 821 822 823 824 825 826 827 828 829 830
		{
		perror(dbfile);
		BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
		goto err;
		}
	db=TXT_DB_read(in,DB_NUMBER);
	if (db == NULL) goto err;

	/* Lets check some fields */
	for (i=0; i<sk_num(db->data); i++)
		{
		pp=(char **)sk_value(db->data,i);
		if ((pp[DB_type][0] != DB_TYPE_REV) &&
			(pp[DB_rev_date][0] != '\0'))
			{
831
			BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
832 833 834
			goto err;
			}
		if ((pp[DB_type][0] == DB_TYPE_REV) &&
835
			!make_revoked(NULL, pp[DB_rev_date]))
836
			{
837
			BIO_printf(bio_err," in entry %d\n", i+1);
838 839 840 841 842 843 844 845 846
			goto err;
			}
		if (!check_time_format(pp[DB_exp_date]))
			{
			BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
			goto err;
			}
		p=pp[DB_serial];
		j=strlen(p);
847 848 849 850 851
		if (*p == '-')
			{
			p++;
			j--;
			}
852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870
		if ((j&1) || (j < 2))
			{
			BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
			goto err;
			}
		while (*p)
			{
			if (!(	((*p >= '0') && (*p <= '9')) ||
				((*p >= 'A') && (*p <= 'F')) ||
				((*p >= 'a') && (*p <= 'f')))  )
				{
				BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
				goto err;
				}
			p++;
			}
		}
	if (verbose)
		{
871
		BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
872
#ifdef OPENSSL_SYS_VMS
873 874 875 876 877
		{
		BIO *tmpbio = BIO_new(BIO_f_linebuffer());
		out = BIO_push(tmpbio, out);
		}
#endif
878 879 880
		TXT_DB_write(out,db);
		BIO_printf(bio_err,"%d entries loaded from the database\n",
			db->data->num);
U
Ulf Möller 已提交
881
		BIO_printf(bio_err,"generating index\n");
882 883
		}
	
884
	if (!TXT_DB_create_index(db, DB_serial, NULL,
885 886
			LHASH_HASH_FN(index_serial_hash),
			LHASH_COMP_FN(index_serial_cmp)))
887 888 889 890 891
		{
		BIO_printf(bio_err,"error creating serial number index:(%ld,%ld,%ld)\n",db->error,db->arg1,db->arg2);
		goto err;
		}

892
	if (!TXT_DB_create_index(db, DB_name, index_name_qual,
893 894
			LHASH_HASH_FN(index_name_hash),
			LHASH_COMP_FN(index_name_cmp)))
895 896 897 898 899 900
		{
		BIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\n",
			db->error,db->arg1,db->arg2);
		goto err;
		}

901 902 903 904 905 906 907 908 909 910 911 912 913
	/*****************************************************************/
	/* Update the db file for expired certificates */
	if (doupdatedb)
		{
		if (verbose)
			BIO_printf(bio_err, "Updating %s ...\n",
							dbfile);

		i = do_updatedb(db);
		if (i == -1)
			{
			BIO_printf(bio_err,"Malloc failure\n");
			goto err;
914
			}
915
		else if (i == 0)
916
			{
917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976
			if (verbose) BIO_printf(bio_err,
					"No entries found to mark expired\n"); 
			}
	    	else
			{
			out = BIO_new(BIO_s_file());
			if (out == NULL)
				{
				ERR_print_errors(bio_err);
				goto err;
				}

			j = BIO_snprintf(buf[0], sizeof buf[0], "%s.new", dbfile);
			if (j < 0 || j >= sizeof buf[0])
				{
				BIO_printf(bio_err, "file name too long\n");
				goto err;
				}
			if (BIO_write_filename(out,buf[0]) <= 0)
		  		{
		    		perror(dbfile);
		    		BIO_printf(bio_err,"unable to open '%s'\n",
									dbfile);
		    		goto err;
		  		}
			j=TXT_DB_write(out,db);
			if (j <= 0) goto err;
			
			BIO_free(out);
			out = NULL;
			j = BIO_snprintf(buf[1], sizeof buf[1], "%s.old", dbfile);
			if (j < 0 || j >= sizeof buf[1])
				{
				BIO_printf(bio_err, "file name too long\n");
				goto err;
				}
			if (rename(dbfile,buf[1]) < 0)
		  		{
		    		BIO_printf(bio_err,
						"unable to rename %s to %s\n",
						dbfile, buf[1]);
		    		perror("reason");
		    		goto err;
		  		}
			if (rename(buf[0],dbfile) < 0)
				{
		    		BIO_printf(bio_err,
						"unable to rename %s to %s\n",
						buf[0],dbfile);
		    		perror("reason");
		    		rename(buf[1],dbfile);
		    		goto err;
		  		}
				
			if (verbose) BIO_printf(bio_err,
				"Done. %d entries marked as expired\n",i); 
	      		}
			goto err;
	  	}

977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998
 	/*****************************************************************/
	/* Read extentions config file                                   */
	if (extfile)
		{
		if (!(extconf=CONF_load(NULL,extfile,&errorline)))
			{
			if (errorline <= 0)
				BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
					extfile);
			else
				BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
					errorline,extfile);
			ret = 1;
			goto err;
			}

		if (verbose)
			BIO_printf(bio_err, "Succesfully loaded extensions file %s\n", extfile);

		/* We can have sections in the ext file */
		if (!extensions && !(extensions = CONF_get_string(extconf, "default", "extensions")))
			extensions = "default";
999
		}
1000

1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012
	/*****************************************************************/
	if (req || gencrl)
		{
		if (outfile != NULL)
			{
			if (BIO_write_filename(Sout,outfile) <= 0)
				{
				perror(outfile);
				goto err;
				}
			}
		else
1013
			{
1014
			BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
1015
#ifdef OPENSSL_SYS_VMS
1016 1017 1018 1019 1020 1021
			{
			BIO *tmpbio = BIO_new(BIO_f_linebuffer());
			Sout = BIO_push(tmpbio, Sout);
			}
#endif
			}
1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054
		}

	if (req)
		{
		if ((md == NULL) && ((md=CONF_get_string(conf,
			section,ENV_DEFAULT_MD)) == NULL))
			{
			lookup_fail(section,ENV_DEFAULT_MD);
			goto err;
			}
		if ((dgst=EVP_get_digestbyname(md)) == NULL)
			{
			BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
			goto err;
			}
		if (verbose)
			BIO_printf(bio_err,"message digest is %s\n",
				OBJ_nid2ln(dgst->type));
		if ((policy == NULL) && ((policy=CONF_get_string(conf,
			section,ENV_POLICY)) == NULL))
			{
			lookup_fail(section,ENV_POLICY);
			goto err;
			}
		if (verbose)
			BIO_printf(bio_err,"policy is %s\n",policy);

		if ((serialfile=CONF_get_string(conf,section,ENV_SERIAL))
			== NULL)
			{
			lookup_fail(section,ENV_SERIAL);
			goto err;
			}
1055 1056

		if (!extconf)
1057
			{
1058 1059
			/* no '-extfile' option, so we look for extensions
			 * in the main configuration file */
1060 1061
			if (!extensions)
				{
1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077
				extensions=CONF_get_string(conf,section,
								ENV_EXTENSIONS);
				if (!extensions)
					ERR_clear_error();
				}
			if (extensions)
				{
				/* Check syntax of file */
				X509V3_CTX ctx;
				X509V3_set_ctx_test(&ctx);
				X509V3_set_conf_lhash(&ctx, conf);
				if (!X509V3_EXT_add_conf(conf, &ctx, extensions,
								NULL))
					{
					BIO_printf(bio_err,
				 	"Error Loading extension section %s\n",
1078
								 extensions);
1079 1080 1081
					ret = 1;
					goto err;
					}
1082
				}
1083 1084
			}

1085 1086
		if (startdate == NULL)
			{
1087
			startdate=CONF_get_string(conf,section,
1088
				ENV_DEFAULT_STARTDATE);
1089 1090
			if (startdate == NULL)
				ERR_clear_error();
1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102
			}
		if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))
			{
			BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");
			goto err;
			}
		if (startdate == NULL) startdate="today";

		if (enddate == NULL)
			{
			enddate=CONF_get_string(conf,section,
				ENV_DEFAULT_ENDDATE);
1103 1104
			if (enddate == NULL)
				ERR_clear_error();
1105 1106 1107 1108 1109
			}
		if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))
			{
			BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");
			goto err;
1110 1111
			}

1112 1113 1114 1115 1116
		if (days == 0)
			{
			days=(int)CONF_get_number(conf,section,
				ENV_DEFAULT_DAYS);
			}
1117
		if (!enddate && (days == 0))
1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129
			{
			BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
			goto err;
			}

		if ((serial=load_serial(serialfile)) == NULL)
			{
			BIO_printf(bio_err,"error while loading serial number\n");
			goto err;
			}
		if (verbose)
			{
1130
			if ((f=BN_bn2hex(serial)) == NULL) goto err;
1131
			BIO_printf(bio_err,"next serial number is %s\n",f);
1132
			OPENSSL_free(f);
1133 1134 1135 1136 1137 1138 1139 1140
			}

		if ((attribs=CONF_get_section(conf,policy)) == NULL)
			{
			BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
			goto err;
			}

B
Ben Laurie 已提交
1141
		if ((cert_sk=sk_X509_new_null()) == NULL)
1142
			{
1143
			BIO_printf(bio_err,"Memory allocation failure\n");
1144 1145 1146 1147 1148 1149
			goto err;
			}
		if (spkac_file != NULL)
			{
			total++;
			j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
1150
				serial,subj,startdate,enddate, days,extensions,conf,
1151
				verbose);
1152 1153 1154 1155 1156 1157
			if (j < 0) goto err;
			if (j > 0)
				{
				total_done++;
				BIO_printf(bio_err,"\n");
				if (!BN_add_word(serial,1)) goto err;
B
Ben Laurie 已提交
1158
				if (!sk_X509_push(cert_sk,x))
1159
					{
1160
					BIO_printf(bio_err,"Memory allocation failure\n");
1161 1162 1163 1164 1165 1166 1167 1168 1169
					goto err;
					}
				if (outfile)
					{
					output_der = 1;
					batch = 1;
					}
				}
			}
1170 1171 1172 1173
		if (ss_cert_file != NULL)
			{
			total++;
			j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
1174
				db,serial,subj,startdate,enddate,days,batch,
1175
				extensions,conf,verbose);
1176 1177 1178 1179 1180 1181
			if (j < 0) goto err;
			if (j > 0)
				{
				total_done++;
				BIO_printf(bio_err,"\n");
				if (!BN_add_word(serial,1)) goto err;
B
Ben Laurie 已提交
1182
				if (!sk_X509_push(cert_sk,x))
1183
					{
1184
					BIO_printf(bio_err,"Memory allocation failure\n");
1185 1186 1187 1188
					goto err;
					}
				}
			}
1189 1190 1191 1192
		if (infile != NULL)
			{
			total++;
			j=certify(&x,infile,pkey,x509,dgst,attribs,db,
1193
				serial,subj,startdate,enddate,days,batch,
1194
				extensions,conf,verbose);
1195 1196 1197 1198 1199 1200
			if (j < 0) goto err;
			if (j > 0)
				{
				total_done++;
				BIO_printf(bio_err,"\n");
				if (!BN_add_word(serial,1)) goto err;
B
Ben Laurie 已提交
1201
				if (!sk_X509_push(cert_sk,x))
1202
					{
1203
					BIO_printf(bio_err,"Memory allocation failure\n");
1204 1205 1206 1207 1208 1209 1210 1211
					goto err;
					}
				}
			}
		for (i=0; i<argc; i++)
			{
			total++;
			j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
1212
				serial,subj,startdate,enddate,days,batch,
1213
				extensions,conf,verbose);
1214 1215 1216 1217 1218 1219
			if (j < 0) goto err;
			if (j > 0)
				{
				total_done++;
				BIO_printf(bio_err,"\n");
				if (!BN_add_word(serial,1)) goto err;
B
Ben Laurie 已提交
1220
				if (!sk_X509_push(cert_sk,x))
1221
					{
1222
					BIO_printf(bio_err,"Memory allocation failure\n");
1223 1224 1225 1226 1227 1228 1229 1230
					goto err;
					}
				}
			}	
		/* we have a stack of newly certified certificates
		 * and a data base and serial number that need
		 * updating */

B
Ben Laurie 已提交
1231
		if (sk_X509_num(cert_sk) > 0)
1232 1233 1234 1235
			{
			if (!batch)
				{
				BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
B
Bodo Möller 已提交
1236
				(void)BIO_flush(bio_err);
1237 1238 1239 1240 1241 1242 1243 1244 1245 1246
				buf[0][0]='\0';
				fgets(buf[0],10,stdin);
				if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
					{
					BIO_printf(bio_err,"CERTIFICATION CANCELED\n"); 
					ret=0;
					goto err;
					}
				}

B
Ben Laurie 已提交
1247
			BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
1248 1249

			strncpy(buf[0],serialfile,BSIZE-4);
U
Ulf Möller 已提交
1250

1251
#ifdef OPENSSL_SYS_VMS
U
Ulf Möller 已提交
1252 1253
			strcat(buf[0],"-new");
#else
1254
			strcat(buf[0],".new");
U
Ulf Möller 已提交
1255
#endif
1256 1257 1258 1259

			if (!save_serial(buf[0],serial)) goto err;

			strncpy(buf[1],dbfile,BSIZE-4);
U
Ulf Möller 已提交
1260

1261
#ifdef OPENSSL_SYS_VMS
U
Ulf Möller 已提交
1262 1263
			strcat(buf[1],"-new");
#else
1264
			strcat(buf[1],".new");
U
Ulf Möller 已提交
1265 1266
#endif

1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278
			if (BIO_write_filename(out,buf[1]) <= 0)
				{
				perror(dbfile);
				BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
				goto err;
				}
			l=TXT_DB_write(out,db);
			if (l <= 0) goto err;
			}
	
		if (verbose)
			BIO_printf(bio_err,"writing new certificates\n");
B
Ben Laurie 已提交
1279
		for (i=0; i<sk_X509_num(cert_sk); i++)
1280 1281 1282 1283
			{
			int k;
			unsigned char *n;

B
Ben Laurie 已提交
1284
			x=sk_X509_value(cert_sk,i);
1285 1286 1287 1288 1289

			j=x->cert_info->serialNumber->length;
			p=(char *)x->cert_info->serialNumber->data;
			
			strncpy(buf[2],outdir,BSIZE-(j*2)-6);
U
Ulf Möller 已提交
1290

1291
#ifndef OPENSSL_SYS_VMS
1292
			strcat(buf[2],"/");
U
Ulf Möller 已提交
1293 1294
#endif

1295 1296 1297 1298 1299
			n=(unsigned char *)&(buf[2][strlen(buf[2])]);
			if (j > 0)
				{
				for (k=0; k<j; k++)
					{
1300
					sprintf((char *)n,"%02X",(unsigned char)*(p++));
1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318
					n+=2;
					}
				}
			else
				{
				*(n++)='0';
				*(n++)='0';
				}
			*(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
			*n='\0';
			if (verbose)
				BIO_printf(bio_err,"writing %s\n",buf[2]);

			if (BIO_write_filename(Cout,buf[2]) <= 0)
				{
				perror(buf[2]);
				goto err;
				}
D
 
Dr. Stephen Henson 已提交
1319 1320
			write_new_certificate(Cout,x, 0, notext);
			write_new_certificate(Sout,x, output_der, notext);
1321 1322
			}

B
Ben Laurie 已提交
1323
		if (sk_X509_num(cert_sk))
1324 1325 1326
			{
			/* Rename the database and the serial file */
			strncpy(buf[2],serialfile,BSIZE-4);
U
Ulf Möller 已提交
1327

1328
#ifdef OPENSSL_SYS_VMS
U
Ulf Möller 已提交
1329 1330
			strcat(buf[2],"-old");
#else
1331
			strcat(buf[2],".old");
U
Ulf Möller 已提交
1332 1333
#endif

1334
			BIO_free(in);
1335
			BIO_free_all(out);
1336 1337 1338 1339
			in=NULL;
			out=NULL;
			if (rename(serialfile,buf[2]) < 0)
				{
U
Ulf Möller 已提交
1340
				BIO_printf(bio_err,"unable to rename %s to %s\n",
1341 1342 1343 1344 1345 1346
					serialfile,buf[2]);
				perror("reason");
				goto err;
				}
			if (rename(buf[0],serialfile) < 0)
				{
U
Ulf Möller 已提交
1347
				BIO_printf(bio_err,"unable to rename %s to %s\n",
1348 1349 1350 1351 1352 1353 1354
					buf[0],serialfile);
				perror("reason");
				rename(buf[2],serialfile);
				goto err;
				}

			strncpy(buf[2],dbfile,BSIZE-4);
U
Ulf Möller 已提交
1355

1356
#ifdef OPENSSL_SYS_VMS
U
Ulf Möller 已提交
1357 1358
			strcat(buf[2],"-old");
#else
1359
			strcat(buf[2],".old");
U
Ulf Möller 已提交
1360 1361
#endif

1362 1363
			if (rename(dbfile,buf[2]) < 0)
				{
U
Ulf Möller 已提交
1364
				BIO_printf(bio_err,"unable to rename %s to %s\n",
1365 1366 1367 1368 1369 1370
					dbfile,buf[2]);
				perror("reason");
				goto err;
				}
			if (rename(buf[1],dbfile) < 0)
				{
U
Ulf Möller 已提交
1371
				BIO_printf(bio_err,"unable to rename %s to %s\n",
1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383
					buf[1],dbfile);
				perror("reason");
				rename(buf[2],dbfile);
				goto err;
				}
			BIO_printf(bio_err,"Data Base Updated\n");
			}
		}
	
	/*****************************************************************/
	if (gencrl)
		{
1384
		int crl_v2 = 0;
1385 1386 1387 1388 1389 1390 1391 1392
		if (!crl_ext)
			{
			crl_ext=CONF_get_string(conf,section,ENV_CRLEXT);
			if (!crl_ext)
				ERR_clear_error();
			}
		if (crl_ext)
			{
1393
			/* Check syntax of file */
1394 1395 1396
			X509V3_CTX ctx;
			X509V3_set_ctx_test(&ctx);
			X509V3_set_conf_lhash(&ctx, conf);
1397
			if (!X509V3_EXT_add_conf(conf, &ctx, crl_ext, NULL))
1398
				{
1399 1400 1401 1402 1403
				BIO_printf(bio_err,
				 "Error Loading CRL extension section %s\n",
								 crl_ext);
				ret = 1;
				goto err;
1404
				}
1405
			}
1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427

		if (!crldays && !crlhours)
			{
			crldays=CONF_get_number(conf,section,
				ENV_DEFAULT_CRL_DAYS);
			crlhours=CONF_get_number(conf,section,
				ENV_DEFAULT_CRL_HOURS);
			}
		if ((crldays == 0) && (crlhours == 0))
			{
			BIO_printf(bio_err,"cannot lookup how long until the next CRL is issuer\n");
			goto err;
			}

		if (verbose) BIO_printf(bio_err,"making CRL\n");
		if ((crl=X509_CRL_new()) == NULL) goto err;
		ci=crl->crl;
		X509_NAME_free(ci->issuer);
		ci->issuer=X509_NAME_dup(x509->cert_info->subject);
		if (ci->issuer == NULL) goto err;

		X509_gmtime_adj(ci->lastUpdate,0);
1428 1429
		if (ci->nextUpdate == NULL)
			ci->nextUpdate=ASN1_UTCTIME_new();
1430 1431 1432 1433 1434 1435 1436 1437
		X509_gmtime_adj(ci->nextUpdate,(crldays*24+crlhours)*60*60);

		for (i=0; i<sk_num(db->data); i++)
			{
			pp=(char **)sk_value(db->data,i);
			if (pp[DB_type][0] == DB_TYPE_REV)
				{
				if ((r=X509_REVOKED_new()) == NULL) goto err;
1438 1439 1440
				j = make_revoked(r, pp[DB_rev_date]);
				if (!j) goto err;
				if (j == 2) crl_v2 = 1;
1441 1442 1443 1444 1445 1446
				if (!BN_hex2bn(&serial, pp[DB_serial]))
					goto err;
				r->serialNumber = BN_to_ASN1_INTEGER(serial, r->serialNumber);
				BN_free(serial);
				serial = NULL;
				if (!r->serialNumber)
1447
					goto err;
D
 
Dr. Stephen Henson 已提交
1448
				X509_CRL_add0_revoked(crl,r);
1449 1450 1451 1452
				}
			}
		/* sort the data so it will be written in serial
		 * number order */
B
Ben Laurie 已提交
1453 1454
		sk_X509_REVOKED_sort(ci->revoked);
		for (i=0; i<sk_X509_REVOKED_num(ci->revoked); i++)
1455
			{
B
Ben Laurie 已提交
1456
			r=sk_X509_REVOKED_value(ci->revoked,i);
1457 1458 1459
			r->sequence=i;
			}

1460
		/* we now have a CRL */
1461 1462 1463 1464 1465 1466 1467 1468 1469 1470
		if (verbose) BIO_printf(bio_err,"signing CRL\n");
		if (md != NULL)
			{
			if ((dgst=EVP_get_digestbyname(md)) == NULL)
				{
				BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
				goto err;
				}
			}
		else
1471
			{
1472
#ifndef OPENSSL_NO_DSA
1473 1474 1475
			if (pkey->type == EVP_PKEY_DSA) 
				dgst=EVP_dss1();
			else
1476
#endif
1477 1478
				dgst=EVP_md5();
			}
B
Ben Laurie 已提交
1479

1480 1481
		/* Add any extensions asked for */

1482 1483 1484 1485 1486 1487 1488
		if (crl_ext)
			{
			X509V3_CTX crlctx;
			if (ci->version == NULL)
				if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;
			X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
			X509V3_set_conf_lhash(&crlctx, conf);
1489

1490 1491 1492
			if (!X509V3_EXT_CRL_add_conf(conf, &crlctx,
				crl_ext, crl)) goto err;
			}
1493 1494 1495 1496 1497 1498
		if (crl_ext || crl_v2)
			{
			if (ci->version == NULL)
				if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;
			ASN1_INTEGER_set(ci->version,1); /* version 2 CRL */
			}
1499

1500 1501 1502 1503 1504
		if (!X509_CRL_sign(crl,pkey,dgst)) goto err;

		PEM_write_bio_X509_CRL(Sout,crl);
		}
	/*****************************************************************/
1505
	if (dorevoke)
1506
		{
1507 1508 1509 1510 1511
		if (infile == NULL) 
			{
			BIO_printf(bio_err,"no input files\n");
			goto err;
			}
1512 1513
		else
			{
1514
			X509 *revcert;
1515 1516 1517 1518 1519 1520
			if (BIO_read_filename(in,infile) <= 0)
				{
				perror(infile);
				BIO_printf(bio_err,"error trying to load '%s' certificate\n",infile);
				goto err;
				}
1521 1522
			revcert=PEM_read_bio_X509(in,NULL,NULL,NULL);
			if (revcert == NULL)
1523 1524
				{
				BIO_printf(bio_err,"unable to load '%s' certificate\n",infile);
1525
				goto err;
1526
				}
1527
			j=do_revoke(revcert,db, rev_type, rev_arg);
1528 1529
			if (j <= 0) goto err;
			X509_free(revcert);
1530 1531

			strncpy(buf[0],dbfile,BSIZE-4);
1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557
			strcat(buf[0],".new");
			if (BIO_write_filename(out,buf[0]) <= 0)
				{
				perror(dbfile);
				BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
				goto err;
				}
			j=TXT_DB_write(out,db);
			if (j <= 0) goto err;
			strncpy(buf[1],dbfile,BSIZE-4);
			strcat(buf[1],".old");
			if (rename(dbfile,buf[1]) < 0)
				{
				BIO_printf(bio_err,"unable to rename %s to %s\n", dbfile, buf[1]);
				perror("reason");
				goto err;
				}
			if (rename(buf[0],dbfile) < 0)
				{
				BIO_printf(bio_err,"unable to rename %s to %s\n", buf[0],dbfile);
				perror("reason");
				rename(buf[1],dbfile);
				goto err;
				}
			BIO_printf(bio_err,"Data Base Updated\n"); 
			}
1558 1559
		}
	/*****************************************************************/
1560 1561
	ret=0;
err:
1562 1563 1564
	BIO_free_all(Cout);
	BIO_free_all(Sout);
	BIO_free_all(out);
1565
	BIO_free(in);
1566

B
Ben Laurie 已提交
1567
	sk_X509_pop_free(cert_sk,X509_free);
1568 1569

	if (ret) ERR_print_errors(bio_err);
1570
	app_RAND_write_file(randfile, bio_err);
1571 1572 1573 1574 1575 1576 1577
	BN_free(serial);
	TXT_DB_free(db);
	EVP_PKEY_free(pkey);
	X509_free(x509);
	X509_CRL_free(crl);
	CONF_free(conf);
	OBJ_cleanup();
1578 1579 1580
	EXIT(ret);
	}

U
Ulf Möller 已提交
1581
static void lookup_fail(char *name, char *tag)
1582 1583 1584 1585
	{
	BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
	}

1586
static unsigned long index_serial_hash(const char **a)
1587
	{
1588
	const char *n;
1589 1590 1591 1592 1593 1594

	n=a[DB_serial];
	while (*n == '0') n++;
	return(lh_strhash(n));
	}

1595
static int index_serial_cmp(const char **a, const char **b)
1596
	{
1597
	const char *aa,*bb;
1598 1599 1600 1601 1602 1603

	for (aa=a[DB_serial]; *aa == '0'; aa++);
	for (bb=b[DB_serial]; *bb == '0'; bb++);
	return(strcmp(aa,bb));
	}

1604
static unsigned long index_name_hash(const char **a)
1605 1606
	{ return(lh_strhash(a[DB_name])); }

U
Ulf Möller 已提交
1607
static int index_name_qual(char **a)
1608 1609
	{ return(a[0][0] == 'V'); }

1610
static int index_name_cmp(const char **a, const char **b)
U
Ulf Möller 已提交
1611 1612
	{ return(strcmp(a[DB_name],
	     b[DB_name])); }
1613

U
Ulf Möller 已提交
1614
static BIGNUM *load_serial(char *serialfile)
1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651
	{
	BIO *in=NULL;
	BIGNUM *ret=NULL;
	MS_STATIC char buf[1024];
	ASN1_INTEGER *ai=NULL;

	if ((in=BIO_new(BIO_s_file())) == NULL)
		{
		ERR_print_errors(bio_err);
		goto err;
		}

	if (BIO_read_filename(in,serialfile) <= 0)
		{
		perror(serialfile);
		goto err;
		}
	ai=ASN1_INTEGER_new();
	if (ai == NULL) goto err;
	if (!a2i_ASN1_INTEGER(in,ai,buf,1024))
		{
		BIO_printf(bio_err,"unable to load number from %s\n",
			serialfile);
		goto err;
		}
	ret=ASN1_INTEGER_to_BN(ai,NULL);
	if (ret == NULL)
		{
		BIO_printf(bio_err,"error converting number from bin to BIGNUM");
		goto err;
		}
err:
	if (in != NULL) BIO_free(in);
	if (ai != NULL) ASN1_INTEGER_free(ai);
	return(ret);
	}

U
Ulf Möller 已提交
1652
static int save_serial(char *serialfile, BIGNUM *serial)
1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678
	{
	BIO *out;
	int ret=0;
	ASN1_INTEGER *ai=NULL;

	out=BIO_new(BIO_s_file());
	if (out == NULL)
		{
		ERR_print_errors(bio_err);
		goto err;
		}
	if (BIO_write_filename(out,serialfile) <= 0)
		{
		perror(serialfile);
		goto err;
		}

	if ((ai=BN_to_ASN1_INTEGER(serial,NULL)) == NULL)
		{
		BIO_printf(bio_err,"error converting serial to ASN.1 format\n");
		goto err;
		}
	i2a_ASN1_INTEGER(out,ai);
	BIO_puts(out,"\n");
	ret=1;
err:
1679
	if (out != NULL) BIO_free_all(out);
1680 1681 1682 1683
	if (ai != NULL) ASN1_INTEGER_free(ai);
	return(ret);
	}

U
Ulf Möller 已提交
1684
static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1685
	     const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
1686
	     BIGNUM *serial, char *subj, char *startdate, char *enddate, int days,
1687
	     int batch, char *ext_sect, LHASH *lconf, int verbose)
1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700
	{
	X509_REQ *req=NULL;
	BIO *in=NULL;
	EVP_PKEY *pktmp=NULL;
	int ok= -1,i;

	in=BIO_new(BIO_s_file());

	if (BIO_read_filename(in,infile) <= 0)
		{
		perror(infile);
		goto err;
		}
1701
	if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717
		{
		BIO_printf(bio_err,"Error reading certificate request in %s\n",
			infile);
		goto err;
		}
	if (verbose)
		X509_REQ_print(bio_err,req);

	BIO_printf(bio_err,"Check that the request matches the signature\n");

	if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
		{
		BIO_printf(bio_err,"error unpacking public key\n");
		goto err;
		}
	i=X509_REQ_verify(req,pktmp);
1718
	EVP_PKEY_free(pktmp);
1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733
	if (i < 0)
		{
		ok=0;
		BIO_printf(bio_err,"Signature verification problems....\n");
		goto err;
		}
	if (i == 0)
		{
		ok=0;
		BIO_printf(bio_err,"Signature did not match the certificate request\n");
		goto err;
		}
	else
		BIO_printf(bio_err,"Signature ok\n");

1734
	ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,startdate, enddate,
B
Ben Laurie 已提交
1735
		days,batch,verbose,req,ext_sect,lconf);
1736 1737 1738 1739 1740 1741 1742

err:
	if (req != NULL) X509_REQ_free(req);
	if (in != NULL) BIO_free(in);
	return(ok);
	}

U
Ulf Möller 已提交
1743
static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1744
	     const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
1745
	     BIGNUM *serial, char *subj, char *startdate, char *enddate, int days,
1746
	     int batch, char *ext_sect, LHASH *lconf, int verbose)
1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760
	{
	X509 *req=NULL;
	X509_REQ *rreq=NULL;
	BIO *in=NULL;
	EVP_PKEY *pktmp=NULL;
	int ok= -1,i;

	in=BIO_new(BIO_s_file());

	if (BIO_read_filename(in,infile) <= 0)
		{
		perror(infile);
		goto err;
		}
1761
	if ((req=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL)
1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776
		{
		BIO_printf(bio_err,"Error reading self signed certificate in %s\n",infile);
		goto err;
		}
	if (verbose)
		X509_print(bio_err,req);

	BIO_printf(bio_err,"Check that the request matches the signature\n");

	if ((pktmp=X509_get_pubkey(req)) == NULL)
		{
		BIO_printf(bio_err,"error unpacking public key\n");
		goto err;
		}
	i=X509_verify(req,pktmp);
1777
	EVP_PKEY_free(pktmp);
1778 1779 1780 1781 1782 1783 1784 1785 1786
	if (i < 0)
		{
		ok=0;
		BIO_printf(bio_err,"Signature verification problems....\n");
		goto err;
		}
	if (i == 0)
		{
		ok=0;
1787
		BIO_printf(bio_err,"Signature did not match the certificate\n");
1788 1789 1790 1791 1792 1793 1794 1795
		goto err;
		}
	else
		BIO_printf(bio_err,"Signature ok\n");

	if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
		goto err;

1796
	ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,startdate,enddate,days,
B
Ben Laurie 已提交
1797
		batch,verbose,rreq,ext_sect,lconf);
1798 1799 1800 1801 1802 1803 1804 1805

err:
	if (rreq != NULL) X509_REQ_free(rreq);
	if (req != NULL) X509_free(req);
	if (in != NULL) BIO_free(in);
	return(ok);
	}

U
Ulf Möller 已提交
1806
static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
1807
	     STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial, char *subj,
1808 1809
	     char *startdate, char *enddate, int days, int batch, int verbose,
	     X509_REQ *req, char *ext_sect, LHASH *lconf)
1810 1811
	{
	X509_NAME *name=NULL,*CAname=NULL,*subject=NULL;
1812
	ASN1_UTCTIME *tm,*tmptm;
1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825
	ASN1_STRING *str,*str2;
	ASN1_OBJECT *obj;
	X509 *ret=NULL;
	X509_CINF *ci;
	X509_NAME_ENTRY *ne;
	X509_NAME_ENTRY *tne,*push;
	EVP_PKEY *pktmp;
	int ok= -1,i,j,last,nid;
	char *p;
	CONF_VALUE *cv;
	char *row[DB_NUMBER],**rrow,**irow=NULL;
	char buf[25],*pbuf;

1826 1827 1828 1829 1830 1831 1832
	tmptm=ASN1_UTCTIME_new();
	if (tmptm == NULL)
		{
		BIO_printf(bio_err,"malloc error\n");
		return(0);
		}

1833 1834 1835
	for (i=0; i<DB_NUMBER; i++)
		row[i]=NULL;

1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850
	if (subj)
		{
		X509_NAME *n = do_subject(subj);

		if (!n)
			{
			ERR_print_errors(bio_err);
			goto err;
			}
		X509_REQ_set_subject_name(req,n);
		req->req_info->enc.modified = 1;
		X509_NAME_free(n);
		}

	BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927
	name=X509_REQ_get_subject_name(req);
	for (i=0; i<X509_NAME_entry_count(name); i++)
		{
		ne=(X509_NAME_ENTRY *)X509_NAME_get_entry(name,i);
		obj=X509_NAME_ENTRY_get_object(ne);
		j=i2a_ASN1_OBJECT(bio_err,obj);
		str=X509_NAME_ENTRY_get_data(ne);
		pbuf=buf;
		for (j=22-j; j>0; j--)
			*(pbuf++)=' ';
		*(pbuf++)=':';
		*(pbuf++)='\0';
		BIO_puts(bio_err,buf);

		if (msie_hack)
			{
			/* assume all type should be strings */
			nid=OBJ_obj2nid(ne->object);

			if (str->type == V_ASN1_UNIVERSALSTRING)
				ASN1_UNIVERSALSTRING_to_string(str);

			if ((str->type == V_ASN1_IA5STRING) &&
				(nid != NID_pkcs9_emailAddress))
				str->type=V_ASN1_T61STRING;

			if ((nid == NID_pkcs9_emailAddress) &&
				(str->type == V_ASN1_PRINTABLESTRING))
				str->type=V_ASN1_IA5STRING;
			}

		if (str->type == V_ASN1_PRINTABLESTRING)
			BIO_printf(bio_err,"PRINTABLE:'");
		else if (str->type == V_ASN1_T61STRING)
			BIO_printf(bio_err,"T61STRING:'");
		else if (str->type == V_ASN1_IA5STRING)
			BIO_printf(bio_err,"IA5STRING:'");
		else if (str->type == V_ASN1_UNIVERSALSTRING)
			BIO_printf(bio_err,"UNIVERSALSTRING:'");
		else
			BIO_printf(bio_err,"ASN.1 %2d:'",str->type);

		/* check some things */
		if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
			(str->type != V_ASN1_IA5STRING))
			{
			BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
			goto err;
			}
		j=ASN1_PRINTABLE_type(str->data,str->length);
		if (	((j == V_ASN1_T61STRING) &&
			 (str->type != V_ASN1_T61STRING)) ||
			((j == V_ASN1_IA5STRING) &&
			 (str->type == V_ASN1_PRINTABLESTRING)))
			{
			BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
			goto err;
			}
			
		p=(char *)str->data;
		for (j=str->length; j>0; j--)
			{
			if ((*p >= ' ') && (*p <= '~'))
				BIO_printf(bio_err,"%c",*p);
			else if (*p & 0x80)
				BIO_printf(bio_err,"\\0x%02X",*p);
			else if ((unsigned char)*p == 0xf7)
				BIO_printf(bio_err,"^?");
			else	BIO_printf(bio_err,"^%c",*p+'@');
			p++;
			}
		BIO_printf(bio_err,"'\n");
		}

	/* Ok, now we check the 'policy' stuff. */
	if ((subject=X509_NAME_new()) == NULL)
		{
1928
		BIO_printf(bio_err,"Memory allocation failure\n");
1929 1930 1931 1932 1933 1934 1935 1936
		goto err;
		}

	/* take a copy of the issuer name before we mess with it. */
	CAname=X509_NAME_dup(x509->cert_info->subject);
	if (CAname == NULL) goto err;
	str=str2=NULL;

1937
	for (i=0; i<sk_CONF_VALUE_num(policy); i++)
1938
		{
1939
		cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009
		if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
			{
			BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
			goto err;
			}
		obj=OBJ_nid2obj(j);

		last= -1;
		for (;;)
			{
			/* lookup the object in the supplied name list */
			j=X509_NAME_get_index_by_OBJ(name,obj,last);
			if (j < 0)
				{
				if (last != -1) break;
				tne=NULL;
				}
			else
				{
				tne=X509_NAME_get_entry(name,j);
				}
			last=j;

			/* depending on the 'policy', decide what to do. */
			push=NULL;
			if (strcmp(cv->value,"optional") == 0)
				{
				if (tne != NULL)
					push=tne;
				}
			else if (strcmp(cv->value,"supplied") == 0)
				{
				if (tne == NULL)
					{
					BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
					goto err;
					}
				else
					push=tne;
				}
			else if (strcmp(cv->value,"match") == 0)
				{
				int last2;

				if (tne == NULL)
					{
					BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
					goto err;
					}

				last2= -1;

again2:
				j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
				if ((j < 0) && (last2 == -1))
					{
					BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
					goto err;
					}
				if (j >= 0)
					{
					push=X509_NAME_get_entry(CAname,j);
					str=X509_NAME_ENTRY_get_data(tne);
					str2=X509_NAME_ENTRY_get_data(push);
					last2=j;
					if (ASN1_STRING_cmp(str,str2) != 0)
						goto again2;
					}
				if (j < 0)
					{
2010
					BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021
					goto err;
					}
				}
			else
				{
				BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
				goto err;
				}

			if (push != NULL)
				{
2022
				if (!X509_NAME_add_entry(subject,push, -1, 0))
2023 2024 2025
					{
					if (push != NULL)
						X509_NAME_ENTRY_free(push);
2026
					BIO_printf(bio_err,"Memory allocation failure\n");
2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041
					goto err;
					}
				}
			if (j < 0) break;
			}
		}

	if (preserve)
		{
		X509_NAME_free(subject);
		subject=X509_NAME_dup(X509_REQ_get_subject_name(req));
		if (subject == NULL) goto err;
		}

	if (verbose)
U
Ulf Möller 已提交
2042
		BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
2043 2044

	row[DB_name]=X509_NAME_oneline(subject,NULL,0);
2045
	row[DB_serial]=BN_bn2hex(serial);
2046 2047
	if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
		{
2048
		BIO_printf(bio_err,"Memory allocation failure\n");
2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080
		goto err;
		}

	rrow=TXT_DB_get_by_index(db,DB_name,row);
	if (rrow != NULL)
		{
		BIO_printf(bio_err,"ERROR:There is already a certificate for %s\n",
			row[DB_name]);
		}
	else
		{
		rrow=TXT_DB_get_by_index(db,DB_serial,row);
		if (rrow != NULL)
			{
			BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
				row[DB_serial]);
			BIO_printf(bio_err,"      check the database/serial_file for corruption\n");
			}
		}

	if (rrow != NULL)
		{
		BIO_printf(bio_err,
			"The matching entry has the following details\n");
		if (rrow[DB_type][0] == 'E')
			p="Expired";
		else if (rrow[DB_type][0] == 'R')
			p="Revoked";
		else if (rrow[DB_type][0] == 'V')
			p="Valid";
		else
			p="\ninvalid type, Data base error\n";
2081
		BIO_printf(bio_err,"Type	  :%s\n",p);;
2082 2083 2084 2085 2086 2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098
		if (rrow[DB_type][0] == 'R')
			{
			p=rrow[DB_exp_date]; if (p == NULL) p="undef";
			BIO_printf(bio_err,"Was revoked on:%s\n",p);
			}
		p=rrow[DB_exp_date]; if (p == NULL) p="undef";
		BIO_printf(bio_err,"Expires on    :%s\n",p);
		p=rrow[DB_serial]; if (p == NULL) p="undef";
		BIO_printf(bio_err,"Serial Number :%s\n",p);
		p=rrow[DB_file]; if (p == NULL) p="undef";
		BIO_printf(bio_err,"File name     :%s\n",p);
		p=rrow[DB_name]; if (p == NULL) p="undef";
		BIO_printf(bio_err,"Subject Name  :%s\n",p);
		ok= -1; /* This is now a 'bad' error. */
		goto err;
		}

U
Ulf Möller 已提交
2099
	/* We are now totally happy, lets make and sign the certificate */
2100 2101 2102 2103 2104 2105 2106 2107 2108 2109 2110 2111 2112 2113 2114 2115 2116
	if (verbose)
		BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");

	if ((ret=X509_new()) == NULL) goto err;
	ci=ret->cert_info;

#ifdef X509_V3
	/* Make it an X509 v3 certificate. */
	if (!X509_set_version(x509,2)) goto err;
#endif

	if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
		goto err;
	if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
		goto err;

	BIO_printf(bio_err,"Certificate is to be certified until ");
2117 2118
	if (strcmp(startdate,"today") == 0)
		X509_gmtime_adj(X509_get_notBefore(ret),0);
2119 2120 2121
	else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);

	if (enddate == NULL)
2122
		X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);
2123 2124
	else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);

2125
	ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
2126
	if (days) BIO_printf(bio_err," (%d days)",days);
2127
	BIO_printf(bio_err, "\n");
2128 2129 2130 2131

	if (!X509_set_subject_name(ret,subject)) goto err;

	pktmp=X509_REQ_get_pubkey(req);
2132 2133 2134
	i = X509_set_pubkey(ret,pktmp);
	EVP_PKEY_free(pktmp);
	if (!i) goto err;
2135 2136

	/* Lets add the extensions, if there are any */
2137
	if (ext_sect)
2138
		{
2139
		X509V3_CTX ctx;
2140 2141 2142 2143 2144 2145
		if (ci->version == NULL)
			if ((ci->version=ASN1_INTEGER_new()) == NULL)
				goto err;
		ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */

		/* Free the current entries if any, there should not
U
Ulf Möller 已提交
2146
		 * be any I believe */
2147
		if (ci->extensions != NULL)
B
Ben Laurie 已提交
2148 2149
			sk_X509_EXTENSION_pop_free(ci->extensions,
						   X509_EXTENSION_free);
2150

2151 2152
		ci->extensions = NULL;

2153
		/* Initialize the context structure */
2154
		X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
2155

2156 2157 2158 2159 2160 2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182
		if (extconf)
			{
			if (verbose)
				BIO_printf(bio_err, "Extra configuration file found\n");
 
			/* Use the extconf configuration db LHASH */
			X509V3_set_conf_lhash(&ctx, extconf);
 
			/* Test the structure (needed?) */
			/* X509V3_set_ctx_test(&ctx); */

			/* Adds exts contained in the configuration file */
			if (!X509V3_EXT_add_conf(extconf, &ctx, ext_sect,ret))
				{
				BIO_printf(bio_err,
				    "ERROR: adding extensions in section %s\n",
								ext_sect);
				ERR_print_errors(bio_err);
				goto err;
				}
			if (verbose)
				BIO_printf(bio_err, "Successfully added extensions from file.\n");
			}
		else if (ext_sect)
			{
			/* We found extensions to be set from config file */
			X509V3_set_conf_lhash(&ctx, lconf);
2183

2184 2185 2186 2187 2188 2189 2190 2191 2192 2193
			if(!X509V3_EXT_add_conf(lconf, &ctx, ext_sect, ret))
				{
				BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
				ERR_print_errors(bio_err);
				goto err;
				}

			if (verbose) 
				BIO_printf(bio_err, "Successfully added extensions from config\n");
			}
2194 2195 2196 2197 2198 2199
		}


	if (!batch)
		{
		BIO_printf(bio_err,"Sign the certificate? [y/n]:");
B
Bodo Möller 已提交
2200
		(void)BIO_flush(bio_err);
2201 2202 2203 2204 2205 2206 2207 2208 2209 2210
		buf[0]='\0';
		fgets(buf,sizeof(buf)-1,stdin);
		if (!((buf[0] == 'y') || (buf[0] == 'Y')))
			{
			BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
			ok=0;
			goto err;
			}
		}

2211

2212
#ifndef OPENSSL_NO_DSA
2213
	if (pkey->type == EVP_PKEY_DSA) dgst=EVP_dss1();
2214 2215
	pktmp=X509_get_pubkey(ret);
	if (EVP_PKEY_missing_parameters(pktmp) &&
2216 2217
		!EVP_PKEY_missing_parameters(pkey))
		EVP_PKEY_copy_parameters(pktmp,pkey);
2218
	EVP_PKEY_free(pktmp);
2219 2220 2221 2222 2223 2224
#endif

	if (!X509_sign(ret,pkey,dgst))
		goto err;

	/* We now just add it to the database */
2225
	row[DB_type]=(char *)OPENSSL_malloc(2);
2226 2227

	tm=X509_get_notAfter(ret);
2228
	row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2229 2230 2231 2232 2233 2234
	memcpy(row[DB_exp_date],tm->data,tm->length);
	row[DB_exp_date][tm->length]='\0';

	row[DB_rev_date]=NULL;

	/* row[DB_serial] done already */
2235
	row[DB_file]=(char *)OPENSSL_malloc(8);
2236 2237 2238 2239 2240
	/* row[DB_name] done already */

	if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
		(row[DB_file] == NULL))
		{
2241
		BIO_printf(bio_err,"Memory allocation failure\n");
2242 2243 2244 2245 2246 2247
		goto err;
		}
	strcpy(row[DB_file],"unknown");
	row[DB_type][0]='V';
	row[DB_type][1]='\0';

2248
	if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2249
		{
2250
		BIO_printf(bio_err,"Memory allocation failure\n");
2251 2252 2253 2254 2255 2256 2257 2258 2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269
		goto err;
		}

	for (i=0; i<DB_NUMBER; i++)
		{
		irow[i]=row[i];
		row[i]=NULL;
		}
	irow[DB_NUMBER]=NULL;

	if (!TXT_DB_insert(db,irow))
		{
		BIO_printf(bio_err,"failed to update database\n");
		BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
		goto err;
		}
	ok=1;
err:
	for (i=0; i<DB_NUMBER; i++)
2270
		if (row[i] != NULL) OPENSSL_free(row[i]);
2271 2272 2273 2274 2275

	if (CAname != NULL)
		X509_NAME_free(CAname);
	if (subject != NULL)
		X509_NAME_free(subject);
2276 2277
	if (tmptm != NULL)
		ASN1_UTCTIME_free(tmptm);
2278 2279 2280 2281 2282 2283 2284 2285 2286 2287
	if (ok <= 0)
		{
		if (ret != NULL) X509_free(ret);
		ret=NULL;
		}
	else
		*xret=ret;
	return(ok);
	}

D
 
Dr. Stephen Henson 已提交
2288
static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
2289 2290 2291 2292 2293 2294 2295
	{

	if (output_der)
		{
		(void)i2d_X509_bio(bp,x);
		return;
		}
D
 
Dr. Stephen Henson 已提交
2296 2297
#if 0
	/* ??? Not needed since X509_print prints all this stuff anyway */
2298 2299 2300 2301 2302 2303 2304 2305 2306
	f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
	BIO_printf(bp,"issuer :%s\n",f);

	f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
	BIO_printf(bp,"subject:%s\n",f);

	BIO_puts(bp,"serial :");
	i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
	BIO_puts(bp,"\n\n");
D
 
Dr. Stephen Henson 已提交
2307
#endif
2308
	if (!notext)X509_print(bp,x);
2309 2310 2311
	PEM_write_bio_X509(bp,x);
	}

U
Ulf Möller 已提交
2312
static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
2313
	     const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
2314
	     BIGNUM *serial, char *subj, char *startdate, char *enddate, int days,
2315
	     char *ext_sect, LHASH *lconf, int verbose)
2316
	{
2317
	STACK_OF(CONF_VALUE) *sk=NULL;
2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344
	LHASH *parms=NULL;
	X509_REQ *req=NULL;
	CONF_VALUE *cv=NULL;
	NETSCAPE_SPKI *spki = NULL;
	X509_REQ_INFO *ri;
	char *type,*buf;
	EVP_PKEY *pktmp=NULL;
	X509_NAME *n=NULL;
	X509_NAME_ENTRY *ne=NULL;
	int ok= -1,i,j;
	long errline;
	int nid;

	/*
	 * Load input file into a hash table.  (This is just an easy
	 * way to read and parse the file, then put it into a convenient
	 * STACK format).
	 */
	parms=CONF_load(NULL,infile,&errline);
	if (parms == NULL)
		{
		BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
		ERR_print_errors(bio_err);
		goto err;
		}

	sk=CONF_get_section(parms, "default");
2345
	if (sk_CONF_VALUE_num(sk) == 0)
2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373
		{
		BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
		CONF_free(parms);
		goto err;
		}

	/*
	 * Now create a dummy X509 request structure.  We don't actually
	 * have an X509 request, but we have many of the components
	 * (a public key, various DN components).  The idea is that we
	 * put these components into the right X509 request structure
	 * and we can use the same code as if you had a real X509 request.
	 */
	req=X509_REQ_new();
	if (req == NULL)
		{
		ERR_print_errors(bio_err);
		goto err;
		}

	/*
	 * Build up the subject name set.
	 */
	ri=req->req_info;
	n = ri->subject;

	for (i = 0; ; i++)
		{
2374
		if (sk_CONF_VALUE_num(sk) <= i) break;
2375

2376
		cv=sk_CONF_VALUE_value(sk,i);
2377
		type=cv->name;
2378 2379 2380
		/* Skip past any leading X. X: X, etc to allow for
		 * multiple instances
		 */
2381 2382 2383 2384 2385 2386 2387
		for (buf = cv->name; *buf ; buf++)
			if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
				{
				buf++;
				if (*buf) type = buf;
				break;
				}
2388

2389
		buf=cv->value;
2390 2391 2392 2393
		if ((nid=OBJ_txt2nid(type)) == NID_undef)
			{
			if (strcmp(type, "SPKAC") == 0)
				{
2394
				spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
2395 2396 2397 2398 2399 2400 2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417
				if (spki == NULL)
					{
					BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
					ERR_print_errors(bio_err);
					goto err;
					}
				}
			continue;
			}

		j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
		if (fix_data(nid, &j) == 0)
			{
			BIO_printf(bio_err,
				"invalid characters in string %s\n",buf);
			goto err;
			}

		if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
			(unsigned char *)buf,
			strlen(buf))) == NULL)
			goto err;

2418
		if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432
		}
	if (spki == NULL)
		{
		BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
			infile);
		goto err;
		}

	/*
	 * Now extract the key from the SPKI structure.
	 */

	BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");

2433
	if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
2434 2435 2436 2437 2438 2439 2440 2441 2442 2443 2444 2445 2446 2447
		{
		BIO_printf(bio_err,"error unpacking SPKAC public key\n");
		goto err;
		}

	j = NETSCAPE_SPKI_verify(spki, pktmp);
	if (j <= 0)
		{
		BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
		goto err;
		}
	BIO_printf(bio_err,"Signature ok\n");

	X509_REQ_set_pubkey(req,pktmp);
2448
	EVP_PKEY_free(pktmp);
2449
	ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,startdate,enddate,
B
Ben Laurie 已提交
2450
		   days,1,verbose,req,ext_sect,lconf);
2451 2452 2453 2454 2455 2456 2457 2458 2459
err:
	if (req != NULL) X509_REQ_free(req);
	if (parms != NULL) CONF_free(parms);
	if (spki != NULL) NETSCAPE_SPKI_free(spki);
	if (ne != NULL) X509_NAME_ENTRY_free(ne);

	return(ok);
	}

U
Ulf Möller 已提交
2460
static int fix_data(int nid, int *type)
2461 2462 2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474
	{
	if (nid == NID_pkcs9_emailAddress)
		*type=V_ASN1_IA5STRING;
	if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
		*type=V_ASN1_T61STRING;
	if ((nid == NID_pkcs9_challengePassword) && (*type == V_ASN1_IA5STRING))
		*type=V_ASN1_T61STRING;
	if ((nid == NID_pkcs9_unstructuredName) && (*type == V_ASN1_T61STRING))
		return(0);
	if (nid == NID_pkcs9_unstructuredName)
		*type=V_ASN1_IA5STRING;
	return(1);
	}

U
Ulf Möller 已提交
2475
static int check_time_format(char *str)
2476 2477 2478 2479 2480 2481 2482 2483 2484
	{
	ASN1_UTCTIME tm;

	tm.data=(unsigned char *)str;
	tm.length=strlen(str);
	tm.type=V_ASN1_UTCTIME;
	return(ASN1_UTCTIME_check(&tm));
	}

2485
static int do_revoke(X509 *x509, TXT_DB *db, int type, char *value)
2486
	{
2487
	ASN1_UTCTIME *tm=NULL;
2488
	char *row[DB_NUMBER],**rrow,**irow;
2489
	char *rev_str = NULL;
2490
	BIGNUM *bn = NULL;
2491 2492 2493 2494
	int ok=-1,i;

	for (i=0; i<DB_NUMBER; i++)
		row[i]=NULL;
2495 2496 2497 2498
	row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
	bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
	row[DB_serial]=BN_bn2hex(bn);
	BN_free(bn);
2499 2500
	if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
		{
2501
		BIO_printf(bio_err,"Memory allocation failure\n");
2502 2503
		goto err;
		}
2504 2505 2506 2507
	/* We have to lookup by serial number because name lookup
	 * skips revoked certs
 	 */
	rrow=TXT_DB_get_by_index(db,DB_serial,row);
2508 2509 2510 2511 2512
	if (rrow == NULL)
		{
		BIO_printf(bio_err,"Adding Entry to DB for %s\n", row[DB_name]);

		/* We now just add it to the database */
2513
		row[DB_type]=(char *)OPENSSL_malloc(2);
2514 2515

		tm=X509_get_notAfter(x509);
2516
		row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2517 2518 2519 2520 2521 2522
		memcpy(row[DB_exp_date],tm->data,tm->length);
		row[DB_exp_date][tm->length]='\0';

		row[DB_rev_date]=NULL;

		/* row[DB_serial] done already */
2523
		row[DB_file]=(char *)OPENSSL_malloc(8);
2524 2525 2526 2527 2528 2529

		/* row[DB_name] done already */

		if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
			(row[DB_file] == NULL))
			{
2530
			BIO_printf(bio_err,"Memory allocation failure\n");
2531 2532 2533 2534 2535 2536
			goto err;
			}
		strcpy(row[DB_file],"unknown");
		row[DB_type][0]='V';
		row[DB_type][1]='\0';

2537
		if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2538
			{
2539
			BIO_printf(bio_err,"Memory allocation failure\n");
2540 2541 2542 2543 2544 2545 2546 2547 2548 2549 2550 2551 2552 2553 2554 2555 2556 2557
			goto err;
			}

		for (i=0; i<DB_NUMBER; i++)
			{
			irow[i]=row[i];
			row[i]=NULL;
			}
		irow[DB_NUMBER]=NULL;

		if (!TXT_DB_insert(db,irow))
			{
			BIO_printf(bio_err,"failed to update database\n");
			BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
			goto err;
			}

		/* Revoke Certificate */
2558
		ok = do_revoke(x509,db, type, value);
2559 2560 2561 2562

		goto err;

		}
2563
	else if (index_name_cmp((const char **)row,(const char **)rrow))
2564
		{
2565 2566
		BIO_printf(bio_err,"ERROR:name does not match %s\n",
			   row[DB_name]);
2567 2568 2569 2570 2571 2572 2573 2574 2575 2576 2577
		goto err;
		}
	else if (rrow[DB_type][0]=='R')
		{
		BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
			   row[DB_serial]);
		goto err;
		}
	else
		{
		BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
2578 2579 2580 2581 2582 2583
		rev_str = make_revocation_str(type, value);
		if (!rev_str)
			{
			BIO_printf(bio_err, "Error in revocation arguments\n");
			goto err;
			}
2584 2585
		rrow[DB_type][0]='R';
		rrow[DB_type][1]='\0';
2586
		rrow[DB_rev_date] = rev_str;
2587 2588
		}
	ok=1;
2589
err:
2590 2591 2592
	for (i=0; i<DB_NUMBER; i++)
		{
		if (row[i] != NULL) 
2593
			OPENSSL_free(row[i]);
2594 2595
		}
	return(ok);
2596 2597 2598 2599
	}

static int get_certificate_status(const char *serial, TXT_DB *db)
	{
D
Dr. Stephen Henson 已提交
2600
	char *row[DB_NUMBER],**rrow;
2601 2602 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629 2630 2631 2632
	int ok=-1,i;

	/* Free Resources */
	for (i=0; i<DB_NUMBER; i++)
		row[i]=NULL;

	/* Malloc needed char spaces */
	row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
	if (row[DB_serial] == NULL)
		{
		BIO_printf(bio_err,"Malloc failure\n");
		goto err;
		}

	if (strlen(serial) % 2)
		{
		/* Set the first char to 0 */;
		row[DB_serial][0]='0';

		/* Copy String from serial to row[DB_serial] */
		memcpy(row[DB_serial]+1, serial, strlen(serial));
		row[DB_serial][strlen(serial)+1]='\0';
		}
	else
		{
		/* Copy String from serial to row[DB_serial] */
		memcpy(row[DB_serial], serial, strlen(serial));
		row[DB_serial][strlen(serial)]='\0';
		}
			
	/* Make it Upper Case */
	for (i=0; row[DB_serial][i] != '\0'; i++)
2633 2634
		row[DB_serial][i] = toupper(row[DB_serial][i]);
	
2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709 2710

	ok=1;

	/* Search for the certificate */
	rrow=TXT_DB_get_by_index(db,DB_serial,row);
	if (rrow == NULL)
		{
		BIO_printf(bio_err,"Serial %s not present in db.\n",
				 row[DB_serial]);
		ok=-1;
		goto err;
		}
	else if (rrow[DB_type][0]=='V')
		{
		BIO_printf(bio_err,"%s=Valid (%c)\n",
			row[DB_serial], rrow[DB_type][0]);
		goto err;
		}
	else if (rrow[DB_type][0]=='R')
		{
		BIO_printf(bio_err,"%s=Revoked (%c)\n",
			row[DB_serial], rrow[DB_type][0]);
		goto err;
		}
	else if (rrow[DB_type][0]=='E')
		{
		BIO_printf(bio_err,"%s=Expired (%c)\n",
			row[DB_serial], rrow[DB_type][0]);
		goto err;
		}
	else if (rrow[DB_type][0]=='S')
		{
		BIO_printf(bio_err,"%s=Suspended (%c)\n",
			row[DB_serial], rrow[DB_type][0]);
		goto err;
		}
	else
		{
		BIO_printf(bio_err,"%s=Unknown (%c).\n",
			row[DB_serial], rrow[DB_type][0]);
		ok=-1;
		}
err:
	for (i=0; i<DB_NUMBER; i++)
		{
		if (row[i] != NULL)
			OPENSSL_free(row[i]);
		}
	return(ok);
	}

static int do_updatedb (TXT_DB *db)
	{
	ASN1_UTCTIME	*a_tm = NULL;
	int i, cnt = 0;
	int db_y2k, a_y2k;  /* flags = 1 if y >= 2000 */ 
	char **rrow, *a_tm_s;

	a_tm = ASN1_UTCTIME_new();

	/* get actual time and make a string */
	a_tm = X509_gmtime_adj(a_tm, 0);
	a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
	if (a_tm_s == NULL)
		{
		cnt = -1;
		goto err;
		}

	memcpy(a_tm_s, a_tm->data, a_tm->length);
	a_tm_s[a_tm->length] = '\0';

	if (strncmp(a_tm_s, "49", 2) <= 0)
		a_y2k = 1;
	else
		a_y2k = 0;
2711

2712 2713 2714 2715 2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755 2756
	for (i = 0; i < sk_num(db->data); i++)
		{
		rrow = (char **) sk_value(db->data, i);

		if (rrow[DB_type][0] == 'V')
		 	{
			/* ignore entries that are not valid */
			if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
				db_y2k = 1;
			else
				db_y2k = 0;

			if (db_y2k == a_y2k)
				{
				/* all on the same y2k side */
				if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
				       	{
				       	rrow[DB_type][0]  = 'E';
				       	rrow[DB_type][1]  = '\0';
	  				cnt++;

					BIO_printf(bio_err, "%s=Expired\n",
							rrow[DB_serial]);
					}
				}
			else if (db_y2k < a_y2k)
				{
		  		rrow[DB_type][0]  = 'E';
		  		rrow[DB_type][1]  = '\0';
	  			cnt++;

				BIO_printf(bio_err, "%s=Expired\n",
							rrow[DB_serial]);
				}

			}
    		}

err:

	ASN1_UTCTIME_free(a_tm);
	OPENSSL_free(a_tm_s);

	return (cnt);
	}
2757 2758 2759 2760 2761 2762 2763 2764 2765 2766 2767 2768 2769 2770 2771 2772 2773 2774 2775 2776 2777 2778 2779 2780 2781 2782 2783 2784 2785 2786 2787 2788 2789 2790 2791 2792 2793 2794 2795 2796 2797 2798 2799 2800 2801 2802 2803 2804 2805 2806 2807 2808 2809 2810 2811 2812 2813 2814 2815 2816 2817 2818 2819 2820 2821 2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857 2858 2859 2860 2861 2862 2863 2864 2865 2866 2867 2868 2869 2870 2871 2872 2873 2874 2875 2876 2877 2878 2879 2880 2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966 2967 2968 2969 2970 2971 2972 2973 2974 2975 2976 2977 2978 2979 2980 2981 2982 2983 2984 2985 2986 2987 2988 2989 2990 2991 2992 2993 2994 2995 2996 2997 2998

static char *crl_reasons[] = {
	/* CRL reason strings */
	"unspecified",
	"keyCompromise",
	"CACompromise",
	"affiliationChanged",
	"superseded", 
	"cessationOfOperation",
	"certificateHold",
	"removeFromCRL",
	/* Additional pseudo reasons */
	"holdInstruction",
	"keyTime",
	"CAkeyTime"
};

#define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))

/* Given revocation information convert to a DB string.
 * The format of the string is:
 * revtime[,reason,extra]. Where 'revtime' is the
 * revocation time (the current time). 'reason' is the
 * optional CRL reason and 'extra' is any additional
 * argument
 */

char *make_revocation_str(int rev_type, char *rev_arg)
	{
	char *reason = NULL, *other = NULL, *str;
	ASN1_OBJECT *otmp;
	ASN1_UTCTIME *revtm = NULL;
	int i;
	switch (rev_type)
		{
	case REV_NONE:
		break;

	case REV_CRL_REASON:
		for (i = 0; i < 8; i++)
			{
			if (!strcasecmp(rev_arg, crl_reasons[i]))
				{
				reason = crl_reasons[i];
				break;
				}
			}
		if (reason == NULL)
			{
			BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
			return NULL;
			}
		break;

	case REV_HOLD:
		/* Argument is an OID */

		otmp = OBJ_txt2obj(rev_arg, 0);
		ASN1_OBJECT_free(otmp);

		if (otmp == NULL)
			{
			BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
			return NULL;
			}

		reason = "holdInstruction";
		other = rev_arg;
		break;
		
	case REV_KEY_COMPROMISE:
	case REV_CA_COMPROMISE:

		/* Argument is the key compromise time  */
		if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
			{	
			BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
			return NULL;
			}
		other = rev_arg;
		if (rev_type == REV_KEY_COMPROMISE)
			reason = "keyTime";
		else 
			reason = "CAkeyTime";

		break;

		}

	revtm = X509_gmtime_adj(NULL, 0);

	i = revtm->length + 1;

	if (reason) i += strlen(reason) + 1;
	if (other) i += strlen(other) + 1;

	str = OPENSSL_malloc(i);

	if (!str) return NULL;

	strcpy(str, (char *)revtm->data);
	if (reason)
		{
		strcat(str, ",");
		strcat(str, reason);
		}
	if (other)
		{
		strcat(str, ",");
		strcat(str, other);
		}
	ASN1_UTCTIME_free(revtm);
	return str;
	}

/* Convert revocation field to X509_REVOKED entry 
 * return code:
 * 0 error
 * 1 OK
 * 2 OK and some extensions added (i.e. V2 CRL)
 */

int make_revoked(X509_REVOKED *rev, char *str)
	{
	char *tmp = NULL;
	char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
	int reason_code = -1;
	int i, ret = 0;
	ASN1_OBJECT *hold = NULL;
	ASN1_GENERALIZEDTIME *comp_time = NULL;
	ASN1_ENUMERATED *rtmp = NULL;
	tmp = BUF_strdup(str);

	p = strchr(tmp, ',');

	rtime_str = tmp;

	if (p)
		{
		*p = '\0';
		p++;
		reason_str = p;
		p = strchr(p, ',');
		if (p)
			{
			*p = '\0';
			arg_str = p + 1;
			}
		}

	if (rev && !ASN1_UTCTIME_set_string(rev->revocationDate, rtime_str))
		{
		BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
		goto err;
		}
	if (reason_str)
		{
		for (i = 0; i < NUM_REASONS; i++)
			{
			if(!strcasecmp(reason_str, crl_reasons[i]))
				{
				reason_code = i;
				break;
				}
			}
		if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
			{
			BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
			goto err;
			}

		if (reason_code == 7)
			reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
		else if (reason_code == 8)		/* Hold instruction */
			{
			if (!arg_str)
				{	
				BIO_printf(bio_err, "missing hold instruction\n");
				goto err;
				}
			reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
			hold = OBJ_txt2obj(arg_str, 0);

			if (!hold)
				{
				BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
				goto err;
				}
			}
		else if ((reason_code == 9) || (reason_code == 10))
			{
			if (!arg_str)
				{	
				BIO_printf(bio_err, "missing compromised time\n");
				goto err;
				}
			comp_time = ASN1_GENERALIZEDTIME_new();
			if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
				{	
				BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
				goto err;
				}
			if (reason_code == 9)
				reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
			else
				reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
			}
		}

	if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
		{
		rtmp = ASN1_ENUMERATED_new();
		if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
			goto err;
		if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
			goto err;
		}

	if (rev && comp_time)
		{
		if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
			goto err;
		}
	if (rev && hold)
		{
		if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
			goto err;
		}

	if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
		ret = 2;
	else ret = 1;

	err:

	if (tmp) OPENSSL_free(tmp);
	ASN1_OBJECT_free(hold);
	ASN1_GENERALIZEDTIME_free(comp_time);
	ASN1_ENUMERATED_free(rtmp);

	return ret;
	}
2999 3000 3001 3002 3003 3004 3005 3006 3007 3008 3009 3010 3011 3012 3013 3014 3015 3016 3017 3018 3019 3020 3021 3022 3023 3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034 3035 3036 3037 3038 3039 3040 3041 3042 3043 3044 3045 3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057

static X509_NAME *do_subject(char *subject)
	{
	X509_NAME *n = NULL;

	int i, nid, ne_num=0;

	char *ne_name = NULL;
	char *ne_value = NULL;

	char *tmp = NULL;
	char *p[2];

	char *str_list[256];
       
	p[0] = ",/";
	p[1] = "=";

	n = X509_NAME_new();

	tmp = strtok(subject, p[0]);
	while((tmp != NULL) && (ne_num < (sizeof str_list/sizeof *str_list)))
		{
		char *token = tmp;

		while (token[0] == ' ')
			token++;
		str_list[ne_num] = token;

		tmp = strtok(NULL, p[0]);
		ne_num++;
		}

	for (i = 0; i < ne_num; i++)
		{
		ne_name  = strtok(str_list[i], p[1]);
		ne_value = strtok(NULL, p[1]);

		if ((nid=OBJ_txt2nid(ne_name)) == NID_undef)
			{
			BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_name);
			continue;
			}

		if (ne_value == NULL)
			{
			BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_name);
			continue;
			}

		if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC, (unsigned char*)ne_value, -1,-1,0))
			{
			X509_NAME_free(n);
			return NULL;
			}
		}

	return n;
	}