1*de0e0e4dSAntonio Huete Jimenez /* $OpenBSD: ca.c,v 1.53 2022/02/03 17:44:04 tb Exp $ */
2f5b1c8a1SJohn Marino /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3f5b1c8a1SJohn Marino * All rights reserved.
4f5b1c8a1SJohn Marino *
5f5b1c8a1SJohn Marino * This package is an SSL implementation written
6f5b1c8a1SJohn Marino * by Eric Young (eay@cryptsoft.com).
7f5b1c8a1SJohn Marino * The implementation was written so as to conform with Netscapes SSL.
8f5b1c8a1SJohn Marino *
9f5b1c8a1SJohn Marino * This library is free for commercial and non-commercial use as long as
10f5b1c8a1SJohn Marino * the following conditions are aheared to. The following conditions
11f5b1c8a1SJohn Marino * apply to all code found in this distribution, be it the RC4, RSA,
12f5b1c8a1SJohn Marino * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13f5b1c8a1SJohn Marino * included with this distribution is covered by the same copyright terms
14f5b1c8a1SJohn Marino * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15f5b1c8a1SJohn Marino *
16f5b1c8a1SJohn Marino * Copyright remains Eric Young's, and as such any Copyright notices in
17f5b1c8a1SJohn Marino * the code are not to be removed.
18f5b1c8a1SJohn Marino * If this package is used in a product, Eric Young should be given attribution
19f5b1c8a1SJohn Marino * as the author of the parts of the library used.
20f5b1c8a1SJohn Marino * This can be in the form of a textual message at program startup or
21f5b1c8a1SJohn Marino * in documentation (online or textual) provided with the package.
22f5b1c8a1SJohn Marino *
23f5b1c8a1SJohn Marino * Redistribution and use in source and binary forms, with or without
24f5b1c8a1SJohn Marino * modification, are permitted provided that the following conditions
25f5b1c8a1SJohn Marino * are met:
26f5b1c8a1SJohn Marino * 1. Redistributions of source code must retain the copyright
27f5b1c8a1SJohn Marino * notice, this list of conditions and the following disclaimer.
28f5b1c8a1SJohn Marino * 2. Redistributions in binary form must reproduce the above copyright
29f5b1c8a1SJohn Marino * notice, this list of conditions and the following disclaimer in the
30f5b1c8a1SJohn Marino * documentation and/or other materials provided with the distribution.
31f5b1c8a1SJohn Marino * 3. All advertising materials mentioning features or use of this software
32f5b1c8a1SJohn Marino * must display the following acknowledgement:
33f5b1c8a1SJohn Marino * "This product includes cryptographic software written by
34f5b1c8a1SJohn Marino * Eric Young (eay@cryptsoft.com)"
35f5b1c8a1SJohn Marino * The word 'cryptographic' can be left out if the rouines from the library
36f5b1c8a1SJohn Marino * being used are not cryptographic related :-).
37f5b1c8a1SJohn Marino * 4. If you include any Windows specific code (or a derivative thereof) from
38f5b1c8a1SJohn Marino * the apps directory (application code) you must include an acknowledgement:
39f5b1c8a1SJohn Marino * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40f5b1c8a1SJohn Marino *
41f5b1c8a1SJohn Marino * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42f5b1c8a1SJohn Marino * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43f5b1c8a1SJohn Marino * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44f5b1c8a1SJohn Marino * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45f5b1c8a1SJohn Marino * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46f5b1c8a1SJohn Marino * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47f5b1c8a1SJohn Marino * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48f5b1c8a1SJohn Marino * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49f5b1c8a1SJohn Marino * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50f5b1c8a1SJohn Marino * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51f5b1c8a1SJohn Marino * SUCH DAMAGE.
52f5b1c8a1SJohn Marino *
53f5b1c8a1SJohn Marino * The licence and distribution terms for any publically available version or
54f5b1c8a1SJohn Marino * derivative of this code cannot be changed. i.e. this code cannot simply be
55f5b1c8a1SJohn Marino * copied and put under another distribution licence
56f5b1c8a1SJohn Marino * [including the GNU Public Licence.]
57f5b1c8a1SJohn Marino */
58f5b1c8a1SJohn Marino
59f5b1c8a1SJohn Marino /* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
60f5b1c8a1SJohn Marino
61f5b1c8a1SJohn Marino #include <sys/types.h>
62f5b1c8a1SJohn Marino
63f5b1c8a1SJohn Marino #include <ctype.h>
64f5b1c8a1SJohn Marino #include <stdio.h>
65f5b1c8a1SJohn Marino #include <stdlib.h>
66f5b1c8a1SJohn Marino #include <limits.h>
67f5b1c8a1SJohn Marino #include <string.h>
68f5b1c8a1SJohn Marino #include <unistd.h>
69f5b1c8a1SJohn Marino
70f5b1c8a1SJohn Marino #include "apps.h"
71f5b1c8a1SJohn Marino
72f5b1c8a1SJohn Marino #include <openssl/bio.h>
73f5b1c8a1SJohn Marino #include <openssl/bn.h>
74f5b1c8a1SJohn Marino #include <openssl/conf.h>
75f5b1c8a1SJohn Marino #include <openssl/err.h>
76f5b1c8a1SJohn Marino #include <openssl/evp.h>
77f5b1c8a1SJohn Marino #include <openssl/objects.h>
78f5b1c8a1SJohn Marino #include <openssl/ocsp.h>
79f5b1c8a1SJohn Marino #include <openssl/pem.h>
80f5b1c8a1SJohn Marino #include <openssl/txt_db.h>
81f5b1c8a1SJohn Marino #include <openssl/x509.h>
82f5b1c8a1SJohn Marino #include <openssl/x509v3.h>
83f5b1c8a1SJohn Marino
84f5b1c8a1SJohn Marino #define BASE_SECTION "ca"
85f5b1c8a1SJohn Marino
86f5b1c8a1SJohn Marino #define ENV_DEFAULT_CA "default_ca"
87f5b1c8a1SJohn Marino
88f5b1c8a1SJohn Marino #define STRING_MASK "string_mask"
89f5b1c8a1SJohn Marino #define UTF8_IN "utf8"
90f5b1c8a1SJohn Marino
91f5b1c8a1SJohn Marino #define ENV_NEW_CERTS_DIR "new_certs_dir"
92f5b1c8a1SJohn Marino #define ENV_CERTIFICATE "certificate"
93f5b1c8a1SJohn Marino #define ENV_SERIAL "serial"
94f5b1c8a1SJohn Marino #define ENV_CRLNUMBER "crlnumber"
95f5b1c8a1SJohn Marino #define ENV_PRIVATE_KEY "private_key"
96f5b1c8a1SJohn Marino #define ENV_DEFAULT_DAYS "default_days"
97f5b1c8a1SJohn Marino #define ENV_DEFAULT_STARTDATE "default_startdate"
98f5b1c8a1SJohn Marino #define ENV_DEFAULT_ENDDATE "default_enddate"
99f5b1c8a1SJohn Marino #define ENV_DEFAULT_CRL_DAYS "default_crl_days"
100f5b1c8a1SJohn Marino #define ENV_DEFAULT_CRL_HOURS "default_crl_hours"
101f5b1c8a1SJohn Marino #define ENV_DEFAULT_MD "default_md"
102f5b1c8a1SJohn Marino #define ENV_DEFAULT_EMAIL_DN "email_in_dn"
103f5b1c8a1SJohn Marino #define ENV_PRESERVE "preserve"
104f5b1c8a1SJohn Marino #define ENV_POLICY "policy"
105f5b1c8a1SJohn Marino #define ENV_EXTENSIONS "x509_extensions"
106f5b1c8a1SJohn Marino #define ENV_CRLEXT "crl_extensions"
107f5b1c8a1SJohn Marino #define ENV_MSIE_HACK "msie_hack"
108f5b1c8a1SJohn Marino #define ENV_NAMEOPT "name_opt"
109f5b1c8a1SJohn Marino #define ENV_CERTOPT "cert_opt"
110f5b1c8a1SJohn Marino #define ENV_EXTCOPY "copy_extensions"
111f5b1c8a1SJohn Marino #define ENV_UNIQUE_SUBJECT "unique_subject"
112f5b1c8a1SJohn Marino
113f5b1c8a1SJohn Marino #define ENV_DATABASE "database"
114f5b1c8a1SJohn Marino
115f5b1c8a1SJohn Marino /* Additional revocation information types */
116f5b1c8a1SJohn Marino
117f5b1c8a1SJohn Marino #define REV_NONE 0 /* No addditional information */
118f5b1c8a1SJohn Marino #define REV_CRL_REASON 1 /* Value is CRL reason code */
119f5b1c8a1SJohn Marino #define REV_HOLD 2 /* Value is hold instruction */
120f5b1c8a1SJohn Marino #define REV_KEY_COMPROMISE 3 /* Value is cert key compromise time */
121f5b1c8a1SJohn Marino #define REV_CA_COMPROMISE 4 /* Value is CA key compromise time */
122f5b1c8a1SJohn Marino
123f5b1c8a1SJohn Marino static void lookup_fail(const char *name, const char *tag);
124f5b1c8a1SJohn Marino static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
125f5b1c8a1SJohn Marino const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
126f5b1c8a1SJohn Marino STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
127f5b1c8a1SJohn Marino unsigned long chtype, int multirdn, int email_dn, char *startdate,
128f5b1c8a1SJohn Marino char *enddate, long days, int batch, char *ext_sect, CONF *conf,
129f5b1c8a1SJohn Marino int verbose, unsigned long certopt, unsigned long nameopt,
130f5b1c8a1SJohn Marino int default_op, int ext_copy, int selfsign);
131f5b1c8a1SJohn Marino static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey,
132f5b1c8a1SJohn Marino X509 *x509, const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
133f5b1c8a1SJohn Marino STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
134f5b1c8a1SJohn Marino unsigned long chtype, int multirdn, int email_dn, char *startdate,
135f5b1c8a1SJohn Marino char *enddate, long days, int batch, char *ext_sect, CONF *conf,
136f5b1c8a1SJohn Marino int verbose, unsigned long certopt, unsigned long nameopt, int default_op,
137f5b1c8a1SJohn Marino int ext_copy);
138f5b1c8a1SJohn Marino static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey,
139f5b1c8a1SJohn Marino X509 *x509, const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
140f5b1c8a1SJohn Marino STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
141f5b1c8a1SJohn Marino unsigned long chtype, int multirdn, int email_dn, char *startdate,
142f5b1c8a1SJohn Marino char *enddate, long days, char *ext_sect, CONF *conf, int verbose,
143f5b1c8a1SJohn Marino unsigned long certopt, unsigned long nameopt, int default_op, int ext_copy);
144*de0e0e4dSAntonio Huete Jimenez static int write_new_certificate(BIO *bp, X509 *x, int output_der,
145f5b1c8a1SJohn Marino int notext);
146f5b1c8a1SJohn Marino static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
147f5b1c8a1SJohn Marino const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
148f5b1c8a1SJohn Marino STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
149f5b1c8a1SJohn Marino unsigned long chtype, int multirdn, int email_dn, char *startdate,
150f5b1c8a1SJohn Marino char *enddate, long days, int batch, int verbose, X509_REQ *req,
151f5b1c8a1SJohn Marino char *ext_sect, CONF *conf, unsigned long certopt, unsigned long nameopt,
152f5b1c8a1SJohn Marino int default_op, int ext_copy, int selfsign);
153f5b1c8a1SJohn Marino static int do_revoke(X509 *x509, CA_DB *db, int ext, char *extval);
154*de0e0e4dSAntonio Huete Jimenez static int get_certificate_status(const char *serial, CA_DB *db);
155f5b1c8a1SJohn Marino static int do_updatedb(CA_DB *db);
156f5b1c8a1SJohn Marino static int check_time_format(const char *str);
157f5b1c8a1SJohn Marino static char *bin2hex(unsigned char *, size_t);
158f5b1c8a1SJohn Marino char *make_revocation_str(int rev_type, char *rev_arg);
159f5b1c8a1SJohn Marino int make_revoked(X509_REVOKED *rev, const char *str);
160f5b1c8a1SJohn Marino int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
161*de0e0e4dSAntonio Huete Jimenez
162f5b1c8a1SJohn Marino static CONF *conf = NULL;
163f5b1c8a1SJohn Marino static CONF *extconf = NULL;
164f5b1c8a1SJohn Marino
165*de0e0e4dSAntonio Huete Jimenez static struct {
166*de0e0e4dSAntonio Huete Jimenez int batch;
167*de0e0e4dSAntonio Huete Jimenez char *certfile;
168*de0e0e4dSAntonio Huete Jimenez unsigned long chtype;
169*de0e0e4dSAntonio Huete Jimenez char *configfile;
170*de0e0e4dSAntonio Huete Jimenez int create_serial;
171*de0e0e4dSAntonio Huete Jimenez char *crl_ext;
172*de0e0e4dSAntonio Huete Jimenez long crldays;
173*de0e0e4dSAntonio Huete Jimenez long crlhours;
174*de0e0e4dSAntonio Huete Jimenez long crlsec;
175*de0e0e4dSAntonio Huete Jimenez long days;
176*de0e0e4dSAntonio Huete Jimenez int dorevoke;
177*de0e0e4dSAntonio Huete Jimenez int doupdatedb;
178*de0e0e4dSAntonio Huete Jimenez int email_dn;
179*de0e0e4dSAntonio Huete Jimenez char *enddate;
180*de0e0e4dSAntonio Huete Jimenez char *extensions;
181*de0e0e4dSAntonio Huete Jimenez char *extfile;
182*de0e0e4dSAntonio Huete Jimenez int gencrl;
183*de0e0e4dSAntonio Huete Jimenez char *infile;
184*de0e0e4dSAntonio Huete Jimenez char **infiles;
185*de0e0e4dSAntonio Huete Jimenez int infiles_num;
186*de0e0e4dSAntonio Huete Jimenez char *key;
187*de0e0e4dSAntonio Huete Jimenez char *keyfile;
188*de0e0e4dSAntonio Huete Jimenez int keyform;
189*de0e0e4dSAntonio Huete Jimenez char *md;
190*de0e0e4dSAntonio Huete Jimenez int multirdn;
191*de0e0e4dSAntonio Huete Jimenez int msie_hack;
192*de0e0e4dSAntonio Huete Jimenez int notext;
193*de0e0e4dSAntonio Huete Jimenez char *outdir;
194*de0e0e4dSAntonio Huete Jimenez char *outfile;
195*de0e0e4dSAntonio Huete Jimenez char *passargin;
196*de0e0e4dSAntonio Huete Jimenez char *policy;
197*de0e0e4dSAntonio Huete Jimenez int preserve;
198*de0e0e4dSAntonio Huete Jimenez int req;
199*de0e0e4dSAntonio Huete Jimenez char *rev_arg;
200*de0e0e4dSAntonio Huete Jimenez int rev_type;
201*de0e0e4dSAntonio Huete Jimenez char *serial_status;
202*de0e0e4dSAntonio Huete Jimenez char *section;
203*de0e0e4dSAntonio Huete Jimenez int selfsign;
204*de0e0e4dSAntonio Huete Jimenez STACK_OF(OPENSSL_STRING) *sigopts;
205*de0e0e4dSAntonio Huete Jimenez char *spkac_file;
206*de0e0e4dSAntonio Huete Jimenez char *ss_cert_file;
207*de0e0e4dSAntonio Huete Jimenez char *startdate;
208*de0e0e4dSAntonio Huete Jimenez char *subj;
209*de0e0e4dSAntonio Huete Jimenez int verbose;
210*de0e0e4dSAntonio Huete Jimenez } ca_config;
211f5b1c8a1SJohn Marino
212*de0e0e4dSAntonio Huete Jimenez static int
ca_opt_chtype_utf8(void)213*de0e0e4dSAntonio Huete Jimenez ca_opt_chtype_utf8(void)
214*de0e0e4dSAntonio Huete Jimenez {
215*de0e0e4dSAntonio Huete Jimenez ca_config.chtype = MBSTRING_UTF8;
216*de0e0e4dSAntonio Huete Jimenez return (0);
217*de0e0e4dSAntonio Huete Jimenez }
218*de0e0e4dSAntonio Huete Jimenez
219*de0e0e4dSAntonio Huete Jimenez static int
ca_opt_crl_ca_compromise(char * arg)220*de0e0e4dSAntonio Huete Jimenez ca_opt_crl_ca_compromise(char *arg)
221*de0e0e4dSAntonio Huete Jimenez {
222*de0e0e4dSAntonio Huete Jimenez ca_config.rev_arg = arg;
223*de0e0e4dSAntonio Huete Jimenez ca_config.rev_type = REV_CA_COMPROMISE;
224*de0e0e4dSAntonio Huete Jimenez return (0);
225*de0e0e4dSAntonio Huete Jimenez }
226*de0e0e4dSAntonio Huete Jimenez
227*de0e0e4dSAntonio Huete Jimenez static int
ca_opt_crl_compromise(char * arg)228*de0e0e4dSAntonio Huete Jimenez ca_opt_crl_compromise(char *arg)
229*de0e0e4dSAntonio Huete Jimenez {
230*de0e0e4dSAntonio Huete Jimenez ca_config.rev_arg = arg;
231*de0e0e4dSAntonio Huete Jimenez ca_config.rev_type = REV_KEY_COMPROMISE;
232*de0e0e4dSAntonio Huete Jimenez return (0);
233*de0e0e4dSAntonio Huete Jimenez }
234*de0e0e4dSAntonio Huete Jimenez
235*de0e0e4dSAntonio Huete Jimenez static int
ca_opt_crl_hold(char * arg)236*de0e0e4dSAntonio Huete Jimenez ca_opt_crl_hold(char *arg)
237*de0e0e4dSAntonio Huete Jimenez {
238*de0e0e4dSAntonio Huete Jimenez ca_config.rev_arg = arg;
239*de0e0e4dSAntonio Huete Jimenez ca_config.rev_type = REV_HOLD;
240*de0e0e4dSAntonio Huete Jimenez return (0);
241*de0e0e4dSAntonio Huete Jimenez }
242*de0e0e4dSAntonio Huete Jimenez
243*de0e0e4dSAntonio Huete Jimenez static int
ca_opt_crl_reason(char * arg)244*de0e0e4dSAntonio Huete Jimenez ca_opt_crl_reason(char *arg)
245*de0e0e4dSAntonio Huete Jimenez {
246*de0e0e4dSAntonio Huete Jimenez ca_config.rev_arg = arg;
247*de0e0e4dSAntonio Huete Jimenez ca_config.rev_type = REV_CRL_REASON;
248*de0e0e4dSAntonio Huete Jimenez return (0);
249*de0e0e4dSAntonio Huete Jimenez }
250*de0e0e4dSAntonio Huete Jimenez
251*de0e0e4dSAntonio Huete Jimenez static int
ca_opt_in(char * arg)252*de0e0e4dSAntonio Huete Jimenez ca_opt_in(char *arg)
253*de0e0e4dSAntonio Huete Jimenez {
254*de0e0e4dSAntonio Huete Jimenez ca_config.infile = arg;
255*de0e0e4dSAntonio Huete Jimenez ca_config.req = 1;
256*de0e0e4dSAntonio Huete Jimenez return (0);
257*de0e0e4dSAntonio Huete Jimenez }
258*de0e0e4dSAntonio Huete Jimenez
259*de0e0e4dSAntonio Huete Jimenez static int
ca_opt_infiles(int argc,char ** argv,int * argsused)260*de0e0e4dSAntonio Huete Jimenez ca_opt_infiles(int argc, char **argv, int *argsused)
261*de0e0e4dSAntonio Huete Jimenez {
262*de0e0e4dSAntonio Huete Jimenez ca_config.infiles_num = argc - 1;
263*de0e0e4dSAntonio Huete Jimenez if (ca_config.infiles_num < 1)
264*de0e0e4dSAntonio Huete Jimenez return (1);
265*de0e0e4dSAntonio Huete Jimenez ca_config.infiles = argv + 1;
266*de0e0e4dSAntonio Huete Jimenez ca_config.req = 1;
267*de0e0e4dSAntonio Huete Jimenez *argsused = argc;
268*de0e0e4dSAntonio Huete Jimenez return (0);
269*de0e0e4dSAntonio Huete Jimenez }
270*de0e0e4dSAntonio Huete Jimenez
271*de0e0e4dSAntonio Huete Jimenez static int
ca_opt_revoke(char * arg)272*de0e0e4dSAntonio Huete Jimenez ca_opt_revoke(char *arg)
273*de0e0e4dSAntonio Huete Jimenez {
274*de0e0e4dSAntonio Huete Jimenez ca_config.infile = arg;
275*de0e0e4dSAntonio Huete Jimenez ca_config.dorevoke = 1;
276*de0e0e4dSAntonio Huete Jimenez return (0);
277*de0e0e4dSAntonio Huete Jimenez }
278*de0e0e4dSAntonio Huete Jimenez
279*de0e0e4dSAntonio Huete Jimenez static int
ca_opt_sigopt(char * arg)280*de0e0e4dSAntonio Huete Jimenez ca_opt_sigopt(char *arg)
281*de0e0e4dSAntonio Huete Jimenez {
282*de0e0e4dSAntonio Huete Jimenez if (ca_config.sigopts == NULL)
283*de0e0e4dSAntonio Huete Jimenez ca_config.sigopts = sk_OPENSSL_STRING_new_null();
284*de0e0e4dSAntonio Huete Jimenez if (ca_config.sigopts == NULL)
285*de0e0e4dSAntonio Huete Jimenez return (1);
286*de0e0e4dSAntonio Huete Jimenez if (!sk_OPENSSL_STRING_push(ca_config.sigopts, arg))
287*de0e0e4dSAntonio Huete Jimenez return (1);
288*de0e0e4dSAntonio Huete Jimenez return (0);
289*de0e0e4dSAntonio Huete Jimenez }
290*de0e0e4dSAntonio Huete Jimenez
291*de0e0e4dSAntonio Huete Jimenez static int
ca_opt_spkac(char * arg)292*de0e0e4dSAntonio Huete Jimenez ca_opt_spkac(char *arg)
293*de0e0e4dSAntonio Huete Jimenez {
294*de0e0e4dSAntonio Huete Jimenez ca_config.spkac_file = arg;
295*de0e0e4dSAntonio Huete Jimenez ca_config.req = 1;
296*de0e0e4dSAntonio Huete Jimenez return (0);
297*de0e0e4dSAntonio Huete Jimenez }
298*de0e0e4dSAntonio Huete Jimenez
299*de0e0e4dSAntonio Huete Jimenez static int
ca_opt_ss_cert(char * arg)300*de0e0e4dSAntonio Huete Jimenez ca_opt_ss_cert(char *arg)
301*de0e0e4dSAntonio Huete Jimenez {
302*de0e0e4dSAntonio Huete Jimenez ca_config.ss_cert_file = arg;
303*de0e0e4dSAntonio Huete Jimenez ca_config.req = 1;
304*de0e0e4dSAntonio Huete Jimenez return (0);
305*de0e0e4dSAntonio Huete Jimenez }
306*de0e0e4dSAntonio Huete Jimenez
307*de0e0e4dSAntonio Huete Jimenez static const struct option ca_options[] = {
308*de0e0e4dSAntonio Huete Jimenez {
309*de0e0e4dSAntonio Huete Jimenez .name = "batch",
310*de0e0e4dSAntonio Huete Jimenez .desc = "Operate in batch mode",
311*de0e0e4dSAntonio Huete Jimenez .type = OPTION_FLAG,
312*de0e0e4dSAntonio Huete Jimenez .opt.flag = &ca_config.batch,
313*de0e0e4dSAntonio Huete Jimenez },
314*de0e0e4dSAntonio Huete Jimenez {
315*de0e0e4dSAntonio Huete Jimenez .name = "cert",
316*de0e0e4dSAntonio Huete Jimenez .argname = "file",
317*de0e0e4dSAntonio Huete Jimenez .desc = "File containing the CA certificate",
318*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
319*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.certfile,
320*de0e0e4dSAntonio Huete Jimenez },
321*de0e0e4dSAntonio Huete Jimenez {
322*de0e0e4dSAntonio Huete Jimenez .name = "config",
323*de0e0e4dSAntonio Huete Jimenez .argname = "file",
324*de0e0e4dSAntonio Huete Jimenez .desc = "Specify an alternative configuration file",
325*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
326*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.configfile,
327*de0e0e4dSAntonio Huete Jimenez },
328*de0e0e4dSAntonio Huete Jimenez {
329*de0e0e4dSAntonio Huete Jimenez .name = "create_serial",
330*de0e0e4dSAntonio Huete Jimenez .desc = "If reading serial fails, create a new random serial",
331*de0e0e4dSAntonio Huete Jimenez .type = OPTION_FLAG,
332*de0e0e4dSAntonio Huete Jimenez .opt.flag = &ca_config.create_serial,
333*de0e0e4dSAntonio Huete Jimenez },
334*de0e0e4dSAntonio Huete Jimenez {
335*de0e0e4dSAntonio Huete Jimenez .name = "crl_CA_compromise",
336*de0e0e4dSAntonio Huete Jimenez .argname = "time",
337*de0e0e4dSAntonio Huete Jimenez .desc = "Set the compromise time and the revocation reason to\n"
338*de0e0e4dSAntonio Huete Jimenez "CACompromise",
339*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_FUNC,
340*de0e0e4dSAntonio Huete Jimenez .opt.argfunc = ca_opt_crl_ca_compromise,
341*de0e0e4dSAntonio Huete Jimenez },
342*de0e0e4dSAntonio Huete Jimenez {
343*de0e0e4dSAntonio Huete Jimenez .name = "crl_compromise",
344*de0e0e4dSAntonio Huete Jimenez .argname = "time",
345*de0e0e4dSAntonio Huete Jimenez .desc = "Set the compromise time and the revocation reason to\n"
346*de0e0e4dSAntonio Huete Jimenez "keyCompromise",
347*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_FUNC,
348*de0e0e4dSAntonio Huete Jimenez .opt.argfunc = ca_opt_crl_compromise,
349*de0e0e4dSAntonio Huete Jimenez },
350*de0e0e4dSAntonio Huete Jimenez {
351*de0e0e4dSAntonio Huete Jimenez .name = "crl_hold",
352*de0e0e4dSAntonio Huete Jimenez .argname = "instruction",
353*de0e0e4dSAntonio Huete Jimenez .desc = "Set the hold instruction and the revocation reason to\n"
354*de0e0e4dSAntonio Huete Jimenez "certificateHold",
355*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_FUNC,
356*de0e0e4dSAntonio Huete Jimenez .opt.argfunc = ca_opt_crl_hold,
357*de0e0e4dSAntonio Huete Jimenez },
358*de0e0e4dSAntonio Huete Jimenez {
359*de0e0e4dSAntonio Huete Jimenez .name = "crl_reason",
360*de0e0e4dSAntonio Huete Jimenez .argname = "reason",
361*de0e0e4dSAntonio Huete Jimenez .desc = "Revocation reason",
362*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_FUNC,
363*de0e0e4dSAntonio Huete Jimenez .opt.argfunc = ca_opt_crl_reason,
364*de0e0e4dSAntonio Huete Jimenez },
365*de0e0e4dSAntonio Huete Jimenez {
366*de0e0e4dSAntonio Huete Jimenez .name = "crldays",
367*de0e0e4dSAntonio Huete Jimenez .argname = "days",
368*de0e0e4dSAntonio Huete Jimenez .desc = "Number of days before the next CRL is due",
369*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_LONG,
370*de0e0e4dSAntonio Huete Jimenez .opt.lvalue = &ca_config.crldays,
371*de0e0e4dSAntonio Huete Jimenez },
372*de0e0e4dSAntonio Huete Jimenez {
373*de0e0e4dSAntonio Huete Jimenez .name = "crlexts",
374*de0e0e4dSAntonio Huete Jimenez .argname = "section",
375*de0e0e4dSAntonio Huete Jimenez .desc = "CRL extension section (override value in config file)",
376*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
377*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.crl_ext,
378*de0e0e4dSAntonio Huete Jimenez },
379*de0e0e4dSAntonio Huete Jimenez {
380*de0e0e4dSAntonio Huete Jimenez .name = "crlhours",
381*de0e0e4dSAntonio Huete Jimenez .argname = "hours",
382*de0e0e4dSAntonio Huete Jimenez .desc = "Number of hours before the next CRL is due",
383*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_LONG,
384*de0e0e4dSAntonio Huete Jimenez .opt.lvalue = &ca_config.crlhours,
385*de0e0e4dSAntonio Huete Jimenez },
386*de0e0e4dSAntonio Huete Jimenez {
387*de0e0e4dSAntonio Huete Jimenez .name = "crlsec",
388*de0e0e4dSAntonio Huete Jimenez .argname = "seconds",
389*de0e0e4dSAntonio Huete Jimenez .desc = "Number of seconds before the next CRL is due",
390*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_LONG,
391*de0e0e4dSAntonio Huete Jimenez .opt.lvalue = &ca_config.crlsec,
392*de0e0e4dSAntonio Huete Jimenez },
393*de0e0e4dSAntonio Huete Jimenez {
394*de0e0e4dSAntonio Huete Jimenez .name = "days",
395*de0e0e4dSAntonio Huete Jimenez .argname = "arg",
396*de0e0e4dSAntonio Huete Jimenez .desc = "Number of days to certify the certificate for",
397*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_LONG,
398*de0e0e4dSAntonio Huete Jimenez .opt.lvalue = &ca_config.days,
399*de0e0e4dSAntonio Huete Jimenez },
400*de0e0e4dSAntonio Huete Jimenez {
401*de0e0e4dSAntonio Huete Jimenez .name = "enddate",
402*de0e0e4dSAntonio Huete Jimenez .argname = "YYMMDDHHMMSSZ",
403*de0e0e4dSAntonio Huete Jimenez .desc = "Certificate validity notAfter (overrides -days)",
404*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
405*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.enddate,
406*de0e0e4dSAntonio Huete Jimenez },
407*de0e0e4dSAntonio Huete Jimenez {
408*de0e0e4dSAntonio Huete Jimenez .name = "extensions",
409*de0e0e4dSAntonio Huete Jimenez .argname = "section",
410*de0e0e4dSAntonio Huete Jimenez .desc = "Extension section (override value in config file)",
411*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
412*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.extensions,
413*de0e0e4dSAntonio Huete Jimenez },
414*de0e0e4dSAntonio Huete Jimenez {
415*de0e0e4dSAntonio Huete Jimenez .name = "extfile",
416*de0e0e4dSAntonio Huete Jimenez .argname = "file",
417*de0e0e4dSAntonio Huete Jimenez .desc = "Configuration file with X509v3 extentions to add",
418*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
419*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.extfile,
420*de0e0e4dSAntonio Huete Jimenez },
421*de0e0e4dSAntonio Huete Jimenez {
422*de0e0e4dSAntonio Huete Jimenez .name = "gencrl",
423*de0e0e4dSAntonio Huete Jimenez .desc = "Generate a new CRL",
424*de0e0e4dSAntonio Huete Jimenez .type = OPTION_FLAG,
425*de0e0e4dSAntonio Huete Jimenez .opt.flag = &ca_config.gencrl,
426*de0e0e4dSAntonio Huete Jimenez },
427*de0e0e4dSAntonio Huete Jimenez {
428*de0e0e4dSAntonio Huete Jimenez .name = "in",
429*de0e0e4dSAntonio Huete Jimenez .argname = "file",
430*de0e0e4dSAntonio Huete Jimenez .desc = "Input file containing a single certificate request",
431*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_FUNC,
432*de0e0e4dSAntonio Huete Jimenez .opt.argfunc = ca_opt_in,
433*de0e0e4dSAntonio Huete Jimenez },
434*de0e0e4dSAntonio Huete Jimenez {
435*de0e0e4dSAntonio Huete Jimenez .name = "infiles",
436*de0e0e4dSAntonio Huete Jimenez .argname = "...",
437*de0e0e4dSAntonio Huete Jimenez .desc = "The last argument, certificate requests to process",
438*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARGV_FUNC,
439*de0e0e4dSAntonio Huete Jimenez .opt.argvfunc = ca_opt_infiles,
440*de0e0e4dSAntonio Huete Jimenez },
441*de0e0e4dSAntonio Huete Jimenez {
442*de0e0e4dSAntonio Huete Jimenez .name = "key",
443*de0e0e4dSAntonio Huete Jimenez .argname = "password",
444*de0e0e4dSAntonio Huete Jimenez .desc = "Key to decode the private key if it is encrypted",
445*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
446*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.key,
447*de0e0e4dSAntonio Huete Jimenez },
448*de0e0e4dSAntonio Huete Jimenez {
449*de0e0e4dSAntonio Huete Jimenez .name = "keyfile",
450*de0e0e4dSAntonio Huete Jimenez .argname = "file",
451*de0e0e4dSAntonio Huete Jimenez .desc = "Private key file",
452*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
453*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.keyfile,
454*de0e0e4dSAntonio Huete Jimenez },
455*de0e0e4dSAntonio Huete Jimenez {
456*de0e0e4dSAntonio Huete Jimenez .name = "keyform",
457*de0e0e4dSAntonio Huete Jimenez .argname = "fmt",
458*de0e0e4dSAntonio Huete Jimenez .desc = "Private key file format (DER or PEM (default))",
459*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_FORMAT,
460*de0e0e4dSAntonio Huete Jimenez .opt.value = &ca_config.keyform,
461*de0e0e4dSAntonio Huete Jimenez },
462*de0e0e4dSAntonio Huete Jimenez {
463*de0e0e4dSAntonio Huete Jimenez .name = "md",
464*de0e0e4dSAntonio Huete Jimenez .argname = "alg",
465*de0e0e4dSAntonio Huete Jimenez .desc = "Message digest to use",
466*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
467*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.md,
468*de0e0e4dSAntonio Huete Jimenez },
469*de0e0e4dSAntonio Huete Jimenez {
470*de0e0e4dSAntonio Huete Jimenez .name = "msie_hack",
471*de0e0e4dSAntonio Huete Jimenez .type = OPTION_FLAG,
472*de0e0e4dSAntonio Huete Jimenez .opt.flag = &ca_config.msie_hack,
473*de0e0e4dSAntonio Huete Jimenez },
474*de0e0e4dSAntonio Huete Jimenez {
475*de0e0e4dSAntonio Huete Jimenez .name = "multivalue-rdn",
476*de0e0e4dSAntonio Huete Jimenez .desc = "Enable support for multivalued RDNs",
477*de0e0e4dSAntonio Huete Jimenez .type = OPTION_FLAG,
478*de0e0e4dSAntonio Huete Jimenez .opt.flag = &ca_config.multirdn,
479*de0e0e4dSAntonio Huete Jimenez },
480*de0e0e4dSAntonio Huete Jimenez {
481*de0e0e4dSAntonio Huete Jimenez .name = "name",
482*de0e0e4dSAntonio Huete Jimenez .argname = "section",
483*de0e0e4dSAntonio Huete Jimenez .desc = "Specifies the configuration file section to use",
484*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
485*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.section,
486*de0e0e4dSAntonio Huete Jimenez },
487*de0e0e4dSAntonio Huete Jimenez {
488*de0e0e4dSAntonio Huete Jimenez .name = "noemailDN",
489*de0e0e4dSAntonio Huete Jimenez .desc = "Do not add the EMAIL field to the DN",
490*de0e0e4dSAntonio Huete Jimenez .type = OPTION_VALUE,
491*de0e0e4dSAntonio Huete Jimenez .opt.value = &ca_config.email_dn,
492*de0e0e4dSAntonio Huete Jimenez .value = 0,
493*de0e0e4dSAntonio Huete Jimenez },
494*de0e0e4dSAntonio Huete Jimenez {
495*de0e0e4dSAntonio Huete Jimenez .name = "notext",
496*de0e0e4dSAntonio Huete Jimenez .desc = "Do not print the generated certificate",
497*de0e0e4dSAntonio Huete Jimenez .type = OPTION_FLAG,
498*de0e0e4dSAntonio Huete Jimenez .opt.flag = &ca_config.notext,
499*de0e0e4dSAntonio Huete Jimenez },
500*de0e0e4dSAntonio Huete Jimenez {
501*de0e0e4dSAntonio Huete Jimenez .name = "out",
502*de0e0e4dSAntonio Huete Jimenez .argname = "file",
503*de0e0e4dSAntonio Huete Jimenez .desc = "Output file (default stdout)",
504*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
505*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.outfile,
506*de0e0e4dSAntonio Huete Jimenez },
507*de0e0e4dSAntonio Huete Jimenez {
508*de0e0e4dSAntonio Huete Jimenez .name = "outdir",
509*de0e0e4dSAntonio Huete Jimenez .argname = "directory",
510*de0e0e4dSAntonio Huete Jimenez .desc = " Directory to output certificates to",
511*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
512*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.outdir,
513*de0e0e4dSAntonio Huete Jimenez },
514*de0e0e4dSAntonio Huete Jimenez {
515*de0e0e4dSAntonio Huete Jimenez .name = "passin",
516*de0e0e4dSAntonio Huete Jimenez .argname = "src",
517*de0e0e4dSAntonio Huete Jimenez .desc = "Private key input password source",
518*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
519*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.passargin,
520*de0e0e4dSAntonio Huete Jimenez },
521*de0e0e4dSAntonio Huete Jimenez {
522*de0e0e4dSAntonio Huete Jimenez .name = "policy",
523*de0e0e4dSAntonio Huete Jimenez .argname = "name",
524*de0e0e4dSAntonio Huete Jimenez .desc = "The CA 'policy' to support",
525*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
526*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.policy,
527*de0e0e4dSAntonio Huete Jimenez },
528*de0e0e4dSAntonio Huete Jimenez {
529*de0e0e4dSAntonio Huete Jimenez .name = "preserveDN",
530*de0e0e4dSAntonio Huete Jimenez .desc = "Do not re-order the DN",
531*de0e0e4dSAntonio Huete Jimenez .type = OPTION_FLAG,
532*de0e0e4dSAntonio Huete Jimenez .opt.flag = &ca_config.preserve,
533*de0e0e4dSAntonio Huete Jimenez },
534*de0e0e4dSAntonio Huete Jimenez {
535*de0e0e4dSAntonio Huete Jimenez .name = "revoke",
536*de0e0e4dSAntonio Huete Jimenez .argname = "file",
537*de0e0e4dSAntonio Huete Jimenez .desc = "Revoke a certificate (given in file)",
538*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_FUNC,
539*de0e0e4dSAntonio Huete Jimenez .opt.argfunc = ca_opt_revoke,
540*de0e0e4dSAntonio Huete Jimenez },
541*de0e0e4dSAntonio Huete Jimenez {
542*de0e0e4dSAntonio Huete Jimenez .name = "selfsign",
543*de0e0e4dSAntonio Huete Jimenez .desc = "Sign a certificate using the key associated with it",
544*de0e0e4dSAntonio Huete Jimenez .type = OPTION_FLAG,
545*de0e0e4dSAntonio Huete Jimenez .opt.flag = &ca_config.selfsign,
546*de0e0e4dSAntonio Huete Jimenez },
547*de0e0e4dSAntonio Huete Jimenez {
548*de0e0e4dSAntonio Huete Jimenez .name = "sigopt",
549*de0e0e4dSAntonio Huete Jimenez .argname = "nm:v",
550*de0e0e4dSAntonio Huete Jimenez .desc = "Signature parameter in nm:v form",
551*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_FUNC,
552*de0e0e4dSAntonio Huete Jimenez .opt.argfunc = ca_opt_sigopt,
553*de0e0e4dSAntonio Huete Jimenez },
554*de0e0e4dSAntonio Huete Jimenez {
555*de0e0e4dSAntonio Huete Jimenez .name = "spkac",
556*de0e0e4dSAntonio Huete Jimenez .argname = "file",
557*de0e0e4dSAntonio Huete Jimenez .desc = "File contains DN and signed public key and challenge",
558*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_FUNC,
559*de0e0e4dSAntonio Huete Jimenez .opt.argfunc = ca_opt_spkac,
560*de0e0e4dSAntonio Huete Jimenez },
561*de0e0e4dSAntonio Huete Jimenez {
562*de0e0e4dSAntonio Huete Jimenez .name = "ss_cert",
563*de0e0e4dSAntonio Huete Jimenez .argname = "file",
564*de0e0e4dSAntonio Huete Jimenez .desc = "File contains a self signed certificate to sign",
565*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG_FUNC,
566*de0e0e4dSAntonio Huete Jimenez .opt.argfunc = ca_opt_ss_cert,
567*de0e0e4dSAntonio Huete Jimenez },
568*de0e0e4dSAntonio Huete Jimenez {
569*de0e0e4dSAntonio Huete Jimenez .name = "startdate",
570*de0e0e4dSAntonio Huete Jimenez .argname = "YYMMDDHHMMSSZ",
571*de0e0e4dSAntonio Huete Jimenez .desc = "Certificate validity notBefore",
572*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
573*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.startdate,
574*de0e0e4dSAntonio Huete Jimenez },
575*de0e0e4dSAntonio Huete Jimenez {
576*de0e0e4dSAntonio Huete Jimenez .name = "status",
577*de0e0e4dSAntonio Huete Jimenez .argname = "serial",
578*de0e0e4dSAntonio Huete Jimenez .desc = "Shows certificate status given the serial number",
579*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
580*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.serial_status,
581*de0e0e4dSAntonio Huete Jimenez },
582*de0e0e4dSAntonio Huete Jimenez {
583*de0e0e4dSAntonio Huete Jimenez .name = "subj",
584*de0e0e4dSAntonio Huete Jimenez .argname = "arg",
585*de0e0e4dSAntonio Huete Jimenez .desc = "Use arg instead of request's subject",
586*de0e0e4dSAntonio Huete Jimenez .type = OPTION_ARG,
587*de0e0e4dSAntonio Huete Jimenez .opt.arg = &ca_config.subj,
588*de0e0e4dSAntonio Huete Jimenez },
589*de0e0e4dSAntonio Huete Jimenez {
590*de0e0e4dSAntonio Huete Jimenez .name = "updatedb",
591*de0e0e4dSAntonio Huete Jimenez .desc = "Updates db for expired certificates",
592*de0e0e4dSAntonio Huete Jimenez .type = OPTION_FLAG,
593*de0e0e4dSAntonio Huete Jimenez .opt.flag = &ca_config.doupdatedb,
594*de0e0e4dSAntonio Huete Jimenez },
595*de0e0e4dSAntonio Huete Jimenez {
596*de0e0e4dSAntonio Huete Jimenez .name = "utf8",
597*de0e0e4dSAntonio Huete Jimenez .desc = "Input characters are in UTF-8 (default ASCII)",
598*de0e0e4dSAntonio Huete Jimenez .type = OPTION_FUNC,
599*de0e0e4dSAntonio Huete Jimenez .opt.func = ca_opt_chtype_utf8,
600*de0e0e4dSAntonio Huete Jimenez },
601*de0e0e4dSAntonio Huete Jimenez {
602*de0e0e4dSAntonio Huete Jimenez .name = "verbose",
603*de0e0e4dSAntonio Huete Jimenez .desc = "Verbose output during processing",
604*de0e0e4dSAntonio Huete Jimenez .type = OPTION_FLAG,
605*de0e0e4dSAntonio Huete Jimenez .opt.flag = &ca_config.verbose,
606*de0e0e4dSAntonio Huete Jimenez },
607*de0e0e4dSAntonio Huete Jimenez { NULL },
608*de0e0e4dSAntonio Huete Jimenez };
609f5b1c8a1SJohn Marino
61072c33676SMaxim Ag /*
61172c33676SMaxim Ag * Set a certificate time based on user provided input. Make sure
61272c33676SMaxim Ag * what we put in the certificate is legit for RFC 5280. Returns
61372c33676SMaxim Ag * 0 on success, -1 on an invalid time string. Strings must be
61472c33676SMaxim Ag * YYYYMMDDHHMMSSZ for post 2050 dates. YYYYMMDDHHMMSSZ or
61572c33676SMaxim Ag * YYMMDDHHMMSSZ is accepted for pre 2050 dates, and fixed up to
61672c33676SMaxim Ag * be the correct format in the certificate.
61772c33676SMaxim Ag */
61872c33676SMaxim Ag static int
setCertificateTime(ASN1_TIME * x509time,char * timestring)61972c33676SMaxim Ag setCertificateTime(ASN1_TIME *x509time, char *timestring)
62072c33676SMaxim Ag {
62172c33676SMaxim Ag struct tm tm1;
622*de0e0e4dSAntonio Huete Jimenez
62372c33676SMaxim Ag if (ASN1_time_parse(timestring, strlen(timestring), &tm1, 0) == -1)
62472c33676SMaxim Ag return (-1);
62572c33676SMaxim Ag if (!ASN1_TIME_set_tm(x509time, &tm1))
62672c33676SMaxim Ag return (-1);
62772c33676SMaxim Ag return 0;
62872c33676SMaxim Ag }
62972c33676SMaxim Ag
630*de0e0e4dSAntonio Huete Jimenez static void
ca_usage(void)631*de0e0e4dSAntonio Huete Jimenez ca_usage(void)
632*de0e0e4dSAntonio Huete Jimenez {
633*de0e0e4dSAntonio Huete Jimenez fprintf(stderr,
634*de0e0e4dSAntonio Huete Jimenez "usage: ca [-batch] [-cert file] [-config file] [-create_serial]\n"
635*de0e0e4dSAntonio Huete Jimenez " [-crl_CA_compromise time] [-crl_compromise time]\n"
636*de0e0e4dSAntonio Huete Jimenez " [-crl_hold instruction] [-crl_reason reason] [-crldays days]\n"
637*de0e0e4dSAntonio Huete Jimenez " [-crlexts section] [-crlhours hours] [-crlsec seconds]\n"
638*de0e0e4dSAntonio Huete Jimenez " [-days arg] [-enddate date] [-extensions section]\n"
639*de0e0e4dSAntonio Huete Jimenez " [-extfile file] [-gencrl] [-in file] [-infiles]\n"
640*de0e0e4dSAntonio Huete Jimenez " [-key password] [-keyfile file] [-keyform pem | der]\n"
641*de0e0e4dSAntonio Huete Jimenez " [-md alg] [-multivalue-rdn] [-name section]\n"
642*de0e0e4dSAntonio Huete Jimenez " [-noemailDN] [-notext] [-out file] [-outdir directory]\n"
643*de0e0e4dSAntonio Huete Jimenez " [-passin arg] [-policy name] [-preserveDN] [-revoke file]\n"
644*de0e0e4dSAntonio Huete Jimenez " [-selfsign] [-sigopt nm:v] [-spkac file] [-ss_cert file]\n"
645*de0e0e4dSAntonio Huete Jimenez " [-startdate date] [-status serial] [-subj arg] [-updatedb]\n"
646*de0e0e4dSAntonio Huete Jimenez " [-utf8] [-verbose]\n\n");
647*de0e0e4dSAntonio Huete Jimenez options_usage(ca_options);
648*de0e0e4dSAntonio Huete Jimenez fprintf(stderr, "\n");
649*de0e0e4dSAntonio Huete Jimenez }
650*de0e0e4dSAntonio Huete Jimenez
651f5b1c8a1SJohn Marino int
ca_main(int argc,char ** argv)652f5b1c8a1SJohn Marino ca_main(int argc, char **argv)
653f5b1c8a1SJohn Marino {
654f5b1c8a1SJohn Marino int free_key = 0;
655f5b1c8a1SJohn Marino int total = 0;
656f5b1c8a1SJohn Marino int total_done = 0;
657f5b1c8a1SJohn Marino int ret = 1;
658f5b1c8a1SJohn Marino long errorline = -1;
659f5b1c8a1SJohn Marino EVP_PKEY *pkey = NULL;
660f5b1c8a1SJohn Marino int output_der = 0;
661f5b1c8a1SJohn Marino char *serialfile = NULL;
662f5b1c8a1SJohn Marino char *crlnumberfile = NULL;
663f5b1c8a1SJohn Marino char *tmp_email_dn = NULL;
664f5b1c8a1SJohn Marino BIGNUM *serial = NULL;
665f5b1c8a1SJohn Marino BIGNUM *crlnumber = NULL;
666f5b1c8a1SJohn Marino unsigned long nameopt = 0, certopt = 0;
667f5b1c8a1SJohn Marino int default_op = 1;
668f5b1c8a1SJohn Marino int ext_copy = EXT_COPY_NONE;
669f5b1c8a1SJohn Marino X509 *x509 = NULL, *x509p = NULL;
670f5b1c8a1SJohn Marino X509 *x = NULL;
671f5b1c8a1SJohn Marino BIO *in = NULL, *out = NULL, *Sout = NULL, *Cout = NULL;
672f5b1c8a1SJohn Marino char *dbfile = NULL;
673f5b1c8a1SJohn Marino CA_DB *db = NULL;
674f5b1c8a1SJohn Marino X509_CRL *crl = NULL;
675f5b1c8a1SJohn Marino X509_REVOKED *r = NULL;
676*de0e0e4dSAntonio Huete Jimenez ASN1_TIME *tmptm = NULL;
677*de0e0e4dSAntonio Huete Jimenez ASN1_INTEGER *tmpserial;
678f5b1c8a1SJohn Marino char *f;
679f5b1c8a1SJohn Marino const char *p;
680f5b1c8a1SJohn Marino char *const *pp;
681f5b1c8a1SJohn Marino int i, j;
682f5b1c8a1SJohn Marino const EVP_MD *dgst = NULL;
683f5b1c8a1SJohn Marino STACK_OF(CONF_VALUE) *attribs = NULL;
684f5b1c8a1SJohn Marino STACK_OF(X509) *cert_sk = NULL;
685f5b1c8a1SJohn Marino char *tofree = NULL;
686f5b1c8a1SJohn Marino DB_ATTR db_attr;
687f5b1c8a1SJohn Marino
688f5b1c8a1SJohn Marino if (single_execution) {
68972c33676SMaxim Ag if (pledge("stdio cpath wpath rpath tty", NULL) == -1) {
690f5b1c8a1SJohn Marino perror("pledge");
691f5b1c8a1SJohn Marino exit(1);
692f5b1c8a1SJohn Marino }
693f5b1c8a1SJohn Marino }
694f5b1c8a1SJohn Marino
695*de0e0e4dSAntonio Huete Jimenez memset(&ca_config, 0, sizeof(ca_config));
696*de0e0e4dSAntonio Huete Jimenez ca_config.email_dn = 1;
697*de0e0e4dSAntonio Huete Jimenez ca_config.keyform = FORMAT_PEM;
698*de0e0e4dSAntonio Huete Jimenez ca_config.chtype = MBSTRING_ASC;
699*de0e0e4dSAntonio Huete Jimenez ca_config.rev_type = REV_NONE;
700*de0e0e4dSAntonio Huete Jimenez
701f5b1c8a1SJohn Marino conf = NULL;
702f5b1c8a1SJohn Marino
703*de0e0e4dSAntonio Huete Jimenez if (options_parse(argc, argv, ca_options, NULL, NULL) != 0) {
704*de0e0e4dSAntonio Huete Jimenez ca_usage();
705f5b1c8a1SJohn Marino goto err;
706f5b1c8a1SJohn Marino }
707f5b1c8a1SJohn Marino
708f5b1c8a1SJohn Marino /*****************************************************************/
709f5b1c8a1SJohn Marino tofree = NULL;
710*de0e0e4dSAntonio Huete Jimenez if (ca_config.configfile == NULL)
711*de0e0e4dSAntonio Huete Jimenez ca_config.configfile = getenv("OPENSSL_CONF");
712*de0e0e4dSAntonio Huete Jimenez if (ca_config.configfile == NULL) {
713f5b1c8a1SJohn Marino if ((tofree = make_config_name()) == NULL) {
714f5b1c8a1SJohn Marino BIO_printf(bio_err, "error making config file name\n");
715f5b1c8a1SJohn Marino goto err;
716f5b1c8a1SJohn Marino }
717*de0e0e4dSAntonio Huete Jimenez ca_config.configfile = tofree;
718f5b1c8a1SJohn Marino }
719*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err, "Using configuration from %s\n",
720*de0e0e4dSAntonio Huete Jimenez ca_config.configfile);
721f5b1c8a1SJohn Marino conf = NCONF_new(NULL);
722*de0e0e4dSAntonio Huete Jimenez if (NCONF_load(conf, ca_config.configfile, &errorline) <= 0) {
723f5b1c8a1SJohn Marino if (errorline <= 0)
724f5b1c8a1SJohn Marino BIO_printf(bio_err,
725f5b1c8a1SJohn Marino "error loading the config file '%s'\n",
726*de0e0e4dSAntonio Huete Jimenez ca_config.configfile);
727f5b1c8a1SJohn Marino else
728f5b1c8a1SJohn Marino BIO_printf(bio_err,
729f5b1c8a1SJohn Marino "error on line %ld of config file '%s'\n",
730*de0e0e4dSAntonio Huete Jimenez errorline, ca_config.configfile);
731f5b1c8a1SJohn Marino goto err;
732f5b1c8a1SJohn Marino }
733f5b1c8a1SJohn Marino free(tofree);
734f5b1c8a1SJohn Marino tofree = NULL;
735f5b1c8a1SJohn Marino
736f5b1c8a1SJohn Marino /* Lets get the config section we are using */
737*de0e0e4dSAntonio Huete Jimenez if (ca_config.section == NULL) {
738*de0e0e4dSAntonio Huete Jimenez ca_config.section = NCONF_get_string(conf, BASE_SECTION,
739*de0e0e4dSAntonio Huete Jimenez ENV_DEFAULT_CA);
740*de0e0e4dSAntonio Huete Jimenez if (ca_config.section == NULL) {
741f5b1c8a1SJohn Marino lookup_fail(BASE_SECTION, ENV_DEFAULT_CA);
742f5b1c8a1SJohn Marino goto err;
743f5b1c8a1SJohn Marino }
744f5b1c8a1SJohn Marino }
745f5b1c8a1SJohn Marino if (conf != NULL) {
746f5b1c8a1SJohn Marino p = NCONF_get_string(conf, NULL, "oid_file");
747f5b1c8a1SJohn Marino if (p == NULL)
748f5b1c8a1SJohn Marino ERR_clear_error();
749f5b1c8a1SJohn Marino if (p != NULL) {
750f5b1c8a1SJohn Marino BIO *oid_bio;
751f5b1c8a1SJohn Marino
752f5b1c8a1SJohn Marino oid_bio = BIO_new_file(p, "r");
753f5b1c8a1SJohn Marino if (oid_bio == NULL) {
754f5b1c8a1SJohn Marino /*
755f5b1c8a1SJohn Marino BIO_printf(bio_err,
756f5b1c8a1SJohn Marino "problems opening %s for extra oid's\n", p);
757f5b1c8a1SJohn Marino ERR_print_errors(bio_err);
758f5b1c8a1SJohn Marino */
759f5b1c8a1SJohn Marino ERR_clear_error();
760f5b1c8a1SJohn Marino } else {
761f5b1c8a1SJohn Marino OBJ_create_objects(oid_bio);
762f5b1c8a1SJohn Marino BIO_free(oid_bio);
763f5b1c8a1SJohn Marino }
764f5b1c8a1SJohn Marino }
765f5b1c8a1SJohn Marino if (!add_oid_section(bio_err, conf)) {
766f5b1c8a1SJohn Marino ERR_print_errors(bio_err);
767f5b1c8a1SJohn Marino goto err;
768f5b1c8a1SJohn Marino }
769f5b1c8a1SJohn Marino }
770*de0e0e4dSAntonio Huete Jimenez f = NCONF_get_string(conf, ca_config.section, STRING_MASK);
771*de0e0e4dSAntonio Huete Jimenez if (f == NULL)
772f5b1c8a1SJohn Marino ERR_clear_error();
773f5b1c8a1SJohn Marino
774*de0e0e4dSAntonio Huete Jimenez if (f != NULL && !ASN1_STRING_set_default_mask_asc(f)) {
775f5b1c8a1SJohn Marino BIO_printf(bio_err,
776f5b1c8a1SJohn Marino "Invalid global string mask setting %s\n", f);
777f5b1c8a1SJohn Marino goto err;
778f5b1c8a1SJohn Marino }
779*de0e0e4dSAntonio Huete Jimenez if (ca_config.chtype != MBSTRING_UTF8) {
780*de0e0e4dSAntonio Huete Jimenez f = NCONF_get_string(conf, ca_config.section, UTF8_IN);
781*de0e0e4dSAntonio Huete Jimenez if (f == NULL)
782f5b1c8a1SJohn Marino ERR_clear_error();
783*de0e0e4dSAntonio Huete Jimenez else if (strcmp(f, "yes") == 0)
784*de0e0e4dSAntonio Huete Jimenez ca_config.chtype = MBSTRING_UTF8;
785f5b1c8a1SJohn Marino }
786f5b1c8a1SJohn Marino db_attr.unique_subject = 1;
787*de0e0e4dSAntonio Huete Jimenez p = NCONF_get_string(conf, ca_config.section, ENV_UNIQUE_SUBJECT);
788*de0e0e4dSAntonio Huete Jimenez if (p != NULL) {
789f5b1c8a1SJohn Marino db_attr.unique_subject = parse_yesno(p, 1);
790f5b1c8a1SJohn Marino } else
791f5b1c8a1SJohn Marino ERR_clear_error();
792f5b1c8a1SJohn Marino
793f5b1c8a1SJohn Marino in = BIO_new(BIO_s_file());
794f5b1c8a1SJohn Marino out = BIO_new(BIO_s_file());
795f5b1c8a1SJohn Marino Sout = BIO_new(BIO_s_file());
796f5b1c8a1SJohn Marino Cout = BIO_new(BIO_s_file());
797f5b1c8a1SJohn Marino if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL)) {
798f5b1c8a1SJohn Marino ERR_print_errors(bio_err);
799f5b1c8a1SJohn Marino goto err;
800f5b1c8a1SJohn Marino }
801f5b1c8a1SJohn Marino /*****************************************************************/
802f5b1c8a1SJohn Marino /* report status of cert with serial number given on command line */
803*de0e0e4dSAntonio Huete Jimenez if (ca_config.serial_status) {
804*de0e0e4dSAntonio Huete Jimenez if ((dbfile = NCONF_get_string(conf, ca_config.section,
805f5b1c8a1SJohn Marino ENV_DATABASE)) == NULL) {
806*de0e0e4dSAntonio Huete Jimenez lookup_fail(ca_config.section, ENV_DATABASE);
807f5b1c8a1SJohn Marino goto err;
808f5b1c8a1SJohn Marino }
809f5b1c8a1SJohn Marino db = load_index(dbfile, &db_attr);
810f5b1c8a1SJohn Marino if (db == NULL)
811f5b1c8a1SJohn Marino goto err;
812f5b1c8a1SJohn Marino
813f5b1c8a1SJohn Marino if (!index_index(db))
814f5b1c8a1SJohn Marino goto err;
815f5b1c8a1SJohn Marino
816*de0e0e4dSAntonio Huete Jimenez if (get_certificate_status(ca_config.serial_status, db) != 1)
817f5b1c8a1SJohn Marino BIO_printf(bio_err, "Error verifying serial %s!\n",
818*de0e0e4dSAntonio Huete Jimenez ca_config.serial_status);
819f5b1c8a1SJohn Marino goto err;
820f5b1c8a1SJohn Marino }
821f5b1c8a1SJohn Marino /*****************************************************************/
822f5b1c8a1SJohn Marino /* we definitely need a private key, so let's get it */
823f5b1c8a1SJohn Marino
824*de0e0e4dSAntonio Huete Jimenez if ((ca_config.keyfile == NULL) &&
825*de0e0e4dSAntonio Huete Jimenez ((ca_config.keyfile = NCONF_get_string(conf, ca_config.section,
826*de0e0e4dSAntonio Huete Jimenez ENV_PRIVATE_KEY)) == NULL)) {
827*de0e0e4dSAntonio Huete Jimenez lookup_fail(ca_config.section, ENV_PRIVATE_KEY);
828f5b1c8a1SJohn Marino goto err;
829f5b1c8a1SJohn Marino }
830*de0e0e4dSAntonio Huete Jimenez if (ca_config.key == NULL) {
831f5b1c8a1SJohn Marino free_key = 1;
832*de0e0e4dSAntonio Huete Jimenez if (!app_passwd(bio_err, ca_config.passargin, NULL,
833*de0e0e4dSAntonio Huete Jimenez &ca_config.key, NULL)) {
834f5b1c8a1SJohn Marino BIO_printf(bio_err, "Error getting password\n");
835f5b1c8a1SJohn Marino goto err;
836f5b1c8a1SJohn Marino }
837f5b1c8a1SJohn Marino }
838*de0e0e4dSAntonio Huete Jimenez pkey = load_key(bio_err, ca_config.keyfile, ca_config.keyform, 0,
839*de0e0e4dSAntonio Huete Jimenez ca_config.key, "CA private key");
840*de0e0e4dSAntonio Huete Jimenez if (ca_config.key != NULL)
841*de0e0e4dSAntonio Huete Jimenez explicit_bzero(ca_config.key, strlen(ca_config.key));
842f5b1c8a1SJohn Marino if (pkey == NULL) {
843f5b1c8a1SJohn Marino /* load_key() has already printed an appropriate message */
844f5b1c8a1SJohn Marino goto err;
845f5b1c8a1SJohn Marino }
846f5b1c8a1SJohn Marino /*****************************************************************/
847f5b1c8a1SJohn Marino /* we need a certificate */
848*de0e0e4dSAntonio Huete Jimenez if (!ca_config.selfsign || ca_config.spkac_file != NULL ||
849*de0e0e4dSAntonio Huete Jimenez ca_config.ss_cert_file != NULL || ca_config.gencrl) {
850*de0e0e4dSAntonio Huete Jimenez if ((ca_config.certfile == NULL) &&
851*de0e0e4dSAntonio Huete Jimenez ((ca_config.certfile = NCONF_get_string(conf,
852*de0e0e4dSAntonio Huete Jimenez ca_config.section, ENV_CERTIFICATE)) == NULL)) {
853*de0e0e4dSAntonio Huete Jimenez lookup_fail(ca_config.section, ENV_CERTIFICATE);
854f5b1c8a1SJohn Marino goto err;
855f5b1c8a1SJohn Marino }
856*de0e0e4dSAntonio Huete Jimenez x509 = load_cert(bio_err, ca_config.certfile, FORMAT_PEM, NULL,
857f5b1c8a1SJohn Marino "CA certificate");
858f5b1c8a1SJohn Marino if (x509 == NULL)
859f5b1c8a1SJohn Marino goto err;
860f5b1c8a1SJohn Marino
861f5b1c8a1SJohn Marino if (!X509_check_private_key(x509, pkey)) {
862f5b1c8a1SJohn Marino BIO_printf(bio_err,
863f5b1c8a1SJohn Marino "CA certificate and CA private key do not match\n");
864f5b1c8a1SJohn Marino goto err;
865f5b1c8a1SJohn Marino }
866f5b1c8a1SJohn Marino }
867*de0e0e4dSAntonio Huete Jimenez if (!ca_config.selfsign)
868f5b1c8a1SJohn Marino x509p = x509;
869f5b1c8a1SJohn Marino
870f5b1c8a1SJohn Marino f = NCONF_get_string(conf, BASE_SECTION, ENV_PRESERVE);
871f5b1c8a1SJohn Marino if (f == NULL)
872f5b1c8a1SJohn Marino ERR_clear_error();
873f5b1c8a1SJohn Marino if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
874*de0e0e4dSAntonio Huete Jimenez ca_config.preserve = 1;
875f5b1c8a1SJohn Marino f = NCONF_get_string(conf, BASE_SECTION, ENV_MSIE_HACK);
876f5b1c8a1SJohn Marino if (f == NULL)
877f5b1c8a1SJohn Marino ERR_clear_error();
878f5b1c8a1SJohn Marino if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
879*de0e0e4dSAntonio Huete Jimenez ca_config.msie_hack = 1;
880f5b1c8a1SJohn Marino
881*de0e0e4dSAntonio Huete Jimenez f = NCONF_get_string(conf, ca_config.section, ENV_NAMEOPT);
882f5b1c8a1SJohn Marino
883*de0e0e4dSAntonio Huete Jimenez if (f != NULL) {
884f5b1c8a1SJohn Marino if (!set_name_ex(&nameopt, f)) {
885f5b1c8a1SJohn Marino BIO_printf(bio_err,
886f5b1c8a1SJohn Marino "Invalid name options: \"%s\"\n", f);
887f5b1c8a1SJohn Marino goto err;
888f5b1c8a1SJohn Marino }
889f5b1c8a1SJohn Marino default_op = 0;
890f5b1c8a1SJohn Marino } else
891f5b1c8a1SJohn Marino ERR_clear_error();
892f5b1c8a1SJohn Marino
893*de0e0e4dSAntonio Huete Jimenez f = NCONF_get_string(conf, ca_config.section, ENV_CERTOPT);
894f5b1c8a1SJohn Marino
895*de0e0e4dSAntonio Huete Jimenez if (f != NULL) {
896f5b1c8a1SJohn Marino if (!set_cert_ex(&certopt, f)) {
897f5b1c8a1SJohn Marino BIO_printf(bio_err,
898f5b1c8a1SJohn Marino "Invalid certificate options: \"%s\"\n", f);
899f5b1c8a1SJohn Marino goto err;
900f5b1c8a1SJohn Marino }
901f5b1c8a1SJohn Marino default_op = 0;
902f5b1c8a1SJohn Marino } else
903f5b1c8a1SJohn Marino ERR_clear_error();
904f5b1c8a1SJohn Marino
905*de0e0e4dSAntonio Huete Jimenez f = NCONF_get_string(conf, ca_config.section, ENV_EXTCOPY);
906f5b1c8a1SJohn Marino
907*de0e0e4dSAntonio Huete Jimenez if (f != NULL) {
908f5b1c8a1SJohn Marino if (!set_ext_copy(&ext_copy, f)) {
909f5b1c8a1SJohn Marino BIO_printf(bio_err,
910f5b1c8a1SJohn Marino "Invalid extension copy option: \"%s\"\n", f);
911f5b1c8a1SJohn Marino goto err;
912f5b1c8a1SJohn Marino }
913f5b1c8a1SJohn Marino } else
914f5b1c8a1SJohn Marino ERR_clear_error();
915f5b1c8a1SJohn Marino
916f5b1c8a1SJohn Marino /*****************************************************************/
917f5b1c8a1SJohn Marino /* lookup where to write new certificates */
918*de0e0e4dSAntonio Huete Jimenez if (ca_config.outdir == NULL && ca_config.req) {
919*de0e0e4dSAntonio Huete Jimenez if ((ca_config.outdir = NCONF_get_string(conf,
920*de0e0e4dSAntonio Huete Jimenez ca_config.section, ENV_NEW_CERTS_DIR)) == NULL) {
92172c33676SMaxim Ag BIO_printf(bio_err, "output directory %s not defined\n",
92272c33676SMaxim Ag ENV_NEW_CERTS_DIR);
923f5b1c8a1SJohn Marino goto err;
924f5b1c8a1SJohn Marino }
925f5b1c8a1SJohn Marino }
926f5b1c8a1SJohn Marino /*****************************************************************/
927f5b1c8a1SJohn Marino /* we need to load the database file */
928*de0e0e4dSAntonio Huete Jimenez if ((dbfile = NCONF_get_string(conf, ca_config.section,
929*de0e0e4dSAntonio Huete Jimenez ENV_DATABASE)) == NULL) {
930*de0e0e4dSAntonio Huete Jimenez lookup_fail(ca_config.section, ENV_DATABASE);
931f5b1c8a1SJohn Marino goto err;
932f5b1c8a1SJohn Marino }
933f5b1c8a1SJohn Marino db = load_index(dbfile, &db_attr);
934f5b1c8a1SJohn Marino if (db == NULL)
935f5b1c8a1SJohn Marino goto err;
936f5b1c8a1SJohn Marino
937f5b1c8a1SJohn Marino /* Lets check some fields */
938f5b1c8a1SJohn Marino for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
939f5b1c8a1SJohn Marino pp = sk_OPENSSL_PSTRING_value(db->db->data, i);
940f5b1c8a1SJohn Marino if ((pp[DB_type][0] != DB_TYPE_REV) &&
941f5b1c8a1SJohn Marino (pp[DB_rev_date][0] != '\0')) {
942*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
943*de0e0e4dSAntonio Huete Jimenez "entry %d: not revoked yet, but has a revocation date\n",
944*de0e0e4dSAntonio Huete Jimenez i + 1);
945f5b1c8a1SJohn Marino goto err;
946f5b1c8a1SJohn Marino }
947f5b1c8a1SJohn Marino if ((pp[DB_type][0] == DB_TYPE_REV) &&
948f5b1c8a1SJohn Marino !make_revoked(NULL, pp[DB_rev_date])) {
949f5b1c8a1SJohn Marino BIO_printf(bio_err, " in entry %d\n", i + 1);
950f5b1c8a1SJohn Marino goto err;
951f5b1c8a1SJohn Marino }
952f5b1c8a1SJohn Marino if (!check_time_format((char *) pp[DB_exp_date])) {
953f5b1c8a1SJohn Marino BIO_printf(bio_err, "entry %d: invalid expiry date\n",
954f5b1c8a1SJohn Marino i + 1);
955f5b1c8a1SJohn Marino goto err;
956f5b1c8a1SJohn Marino }
957f5b1c8a1SJohn Marino p = pp[DB_serial];
958f5b1c8a1SJohn Marino j = strlen(p);
959f5b1c8a1SJohn Marino if (*p == '-') {
960f5b1c8a1SJohn Marino p++;
961f5b1c8a1SJohn Marino j--;
962f5b1c8a1SJohn Marino }
963f5b1c8a1SJohn Marino if ((j & 1) || (j < 2)) {
964f5b1c8a1SJohn Marino BIO_printf(bio_err,
965f5b1c8a1SJohn Marino "entry %d: bad serial number length (%d)\n",
966f5b1c8a1SJohn Marino i + 1, j);
967f5b1c8a1SJohn Marino goto err;
968f5b1c8a1SJohn Marino }
969f5b1c8a1SJohn Marino while (*p) {
970f5b1c8a1SJohn Marino if (!(((*p >= '0') && (*p <= '9')) ||
971f5b1c8a1SJohn Marino ((*p >= 'A') && (*p <= 'F')) ||
972f5b1c8a1SJohn Marino ((*p >= 'a') && (*p <= 'f')))) {
973*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
974*de0e0e4dSAntonio Huete Jimenez "entry %d: bad serial number characters, char pos %ld, char is '%c'\n",
975*de0e0e4dSAntonio Huete Jimenez i + 1, (long) (p - pp[DB_serial]), *p);
976f5b1c8a1SJohn Marino goto err;
977f5b1c8a1SJohn Marino }
978f5b1c8a1SJohn Marino p++;
979f5b1c8a1SJohn Marino }
980f5b1c8a1SJohn Marino }
981*de0e0e4dSAntonio Huete Jimenez if (ca_config.verbose) {
982*de0e0e4dSAntonio Huete Jimenez BIO_set_fp(out, stdout, BIO_NOCLOSE | BIO_FP_TEXT);
983f5b1c8a1SJohn Marino TXT_DB_write(out, db->db);
984f5b1c8a1SJohn Marino BIO_printf(bio_err, "%d entries loaded from the database\n",
985f5b1c8a1SJohn Marino sk_OPENSSL_PSTRING_num(db->db->data));
986f5b1c8a1SJohn Marino BIO_printf(bio_err, "generating index\n");
987f5b1c8a1SJohn Marino }
988f5b1c8a1SJohn Marino if (!index_index(db))
989f5b1c8a1SJohn Marino goto err;
990f5b1c8a1SJohn Marino
991f5b1c8a1SJohn Marino /*****************************************************************/
992f5b1c8a1SJohn Marino /* Update the db file for expired certificates */
993*de0e0e4dSAntonio Huete Jimenez if (ca_config.doupdatedb) {
994*de0e0e4dSAntonio Huete Jimenez if (ca_config.verbose)
995f5b1c8a1SJohn Marino BIO_printf(bio_err, "Updating %s ...\n", dbfile);
996f5b1c8a1SJohn Marino
997f5b1c8a1SJohn Marino i = do_updatedb(db);
998f5b1c8a1SJohn Marino if (i == -1) {
999f5b1c8a1SJohn Marino BIO_printf(bio_err, "Malloc failure\n");
1000f5b1c8a1SJohn Marino goto err;
1001f5b1c8a1SJohn Marino } else if (i == 0) {
1002*de0e0e4dSAntonio Huete Jimenez if (ca_config.verbose)
1003f5b1c8a1SJohn Marino BIO_printf(bio_err,
1004f5b1c8a1SJohn Marino "No entries found to mark expired\n");
1005f5b1c8a1SJohn Marino } else {
1006f5b1c8a1SJohn Marino if (!save_index(dbfile, "new", db))
1007f5b1c8a1SJohn Marino goto err;
1008f5b1c8a1SJohn Marino
1009f5b1c8a1SJohn Marino if (!rotate_index(dbfile, "new", "old"))
1010f5b1c8a1SJohn Marino goto err;
1011f5b1c8a1SJohn Marino
1012*de0e0e4dSAntonio Huete Jimenez if (ca_config.verbose)
1013f5b1c8a1SJohn Marino BIO_printf(bio_err,
1014f5b1c8a1SJohn Marino "Done. %d entries marked as expired\n", i);
1015f5b1c8a1SJohn Marino }
1016f5b1c8a1SJohn Marino }
1017f5b1c8a1SJohn Marino /*****************************************************************/
1018f5b1c8a1SJohn Marino /* Read extentions config file */
1019*de0e0e4dSAntonio Huete Jimenez if (ca_config.extfile != NULL) {
1020f5b1c8a1SJohn Marino extconf = NCONF_new(NULL);
1021*de0e0e4dSAntonio Huete Jimenez if (NCONF_load(extconf, ca_config.extfile, &errorline) <= 0) {
1022f5b1c8a1SJohn Marino if (errorline <= 0)
1023f5b1c8a1SJohn Marino BIO_printf(bio_err,
1024f5b1c8a1SJohn Marino "ERROR: loading the config file '%s'\n",
1025*de0e0e4dSAntonio Huete Jimenez ca_config.extfile);
1026f5b1c8a1SJohn Marino else
1027f5b1c8a1SJohn Marino BIO_printf(bio_err,
1028f5b1c8a1SJohn Marino "ERROR: on line %ld of config file '%s'\n",
1029*de0e0e4dSAntonio Huete Jimenez errorline, ca_config.extfile);
1030f5b1c8a1SJohn Marino ret = 1;
1031f5b1c8a1SJohn Marino goto err;
1032f5b1c8a1SJohn Marino }
1033*de0e0e4dSAntonio Huete Jimenez if (ca_config.verbose)
1034f5b1c8a1SJohn Marino BIO_printf(bio_err,
1035f5b1c8a1SJohn Marino "Successfully loaded extensions file %s\n",
1036*de0e0e4dSAntonio Huete Jimenez ca_config.extfile);
1037f5b1c8a1SJohn Marino
1038f5b1c8a1SJohn Marino /* We can have sections in the ext file */
1039*de0e0e4dSAntonio Huete Jimenez if (ca_config.extensions == NULL &&
1040*de0e0e4dSAntonio Huete Jimenez (ca_config.extensions = NCONF_get_string(extconf, "default",
1041*de0e0e4dSAntonio Huete Jimenez "extensions")) == NULL)
1042*de0e0e4dSAntonio Huete Jimenez ca_config.extensions = "default";
1043f5b1c8a1SJohn Marino }
1044f5b1c8a1SJohn Marino /*****************************************************************/
1045*de0e0e4dSAntonio Huete Jimenez if (ca_config.req || ca_config.gencrl) {
1046*de0e0e4dSAntonio Huete Jimenez if (ca_config.outfile != NULL) {
1047*de0e0e4dSAntonio Huete Jimenez if (BIO_write_filename(Sout, ca_config.outfile) <= 0) {
1048*de0e0e4dSAntonio Huete Jimenez perror(ca_config.outfile);
1049f5b1c8a1SJohn Marino goto err;
1050f5b1c8a1SJohn Marino }
1051f5b1c8a1SJohn Marino } else {
1052f5b1c8a1SJohn Marino BIO_set_fp(Sout, stdout, BIO_NOCLOSE | BIO_FP_TEXT);
1053f5b1c8a1SJohn Marino }
1054f5b1c8a1SJohn Marino }
1055*de0e0e4dSAntonio Huete Jimenez if ((ca_config.md == NULL) &&
1056*de0e0e4dSAntonio Huete Jimenez ((ca_config.md = NCONF_get_string(conf, ca_config.section,
1057f5b1c8a1SJohn Marino ENV_DEFAULT_MD)) == NULL)) {
1058*de0e0e4dSAntonio Huete Jimenez lookup_fail(ca_config.section, ENV_DEFAULT_MD);
1059f5b1c8a1SJohn Marino goto err;
1060f5b1c8a1SJohn Marino }
1061*de0e0e4dSAntonio Huete Jimenez if (strcmp(ca_config.md, "default") == 0) {
1062f5b1c8a1SJohn Marino int def_nid;
1063f5b1c8a1SJohn Marino if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0) {
1064f5b1c8a1SJohn Marino BIO_puts(bio_err, "no default digest\n");
1065f5b1c8a1SJohn Marino goto err;
1066f5b1c8a1SJohn Marino }
1067*de0e0e4dSAntonio Huete Jimenez ca_config.md = (char *) OBJ_nid2sn(def_nid);
1068*de0e0e4dSAntonio Huete Jimenez if (ca_config.md == NULL)
1069*de0e0e4dSAntonio Huete Jimenez goto err;
1070f5b1c8a1SJohn Marino }
1071*de0e0e4dSAntonio Huete Jimenez if ((dgst = EVP_get_digestbyname(ca_config.md)) == NULL) {
1072f5b1c8a1SJohn Marino BIO_printf(bio_err,
1073*de0e0e4dSAntonio Huete Jimenez "%s is an unsupported message digest type\n", ca_config.md);
1074f5b1c8a1SJohn Marino goto err;
1075f5b1c8a1SJohn Marino }
1076*de0e0e4dSAntonio Huete Jimenez if (ca_config.req) {
1077*de0e0e4dSAntonio Huete Jimenez if ((ca_config.email_dn == 1) &&
1078*de0e0e4dSAntonio Huete Jimenez ((tmp_email_dn = NCONF_get_string(conf, ca_config.section,
1079*de0e0e4dSAntonio Huete Jimenez ENV_DEFAULT_EMAIL_DN)) != NULL)) {
1080f5b1c8a1SJohn Marino if (strcmp(tmp_email_dn, "no") == 0)
1081*de0e0e4dSAntonio Huete Jimenez ca_config.email_dn = 0;
1082f5b1c8a1SJohn Marino }
1083*de0e0e4dSAntonio Huete Jimenez if (ca_config.verbose)
1084f5b1c8a1SJohn Marino BIO_printf(bio_err, "message digest is %s\n",
1085*de0e0e4dSAntonio Huete Jimenez OBJ_nid2ln(EVP_MD_type(dgst)));
1086*de0e0e4dSAntonio Huete Jimenez if ((ca_config.policy == NULL) &&
1087*de0e0e4dSAntonio Huete Jimenez ((ca_config.policy = NCONF_get_string(conf,
1088*de0e0e4dSAntonio Huete Jimenez ca_config.section, ENV_POLICY)) == NULL)) {
1089*de0e0e4dSAntonio Huete Jimenez lookup_fail(ca_config.section, ENV_POLICY);
1090f5b1c8a1SJohn Marino goto err;
1091f5b1c8a1SJohn Marino }
1092*de0e0e4dSAntonio Huete Jimenez if (ca_config.verbose)
1093*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err, "policy is %s\n", ca_config.policy);
1094f5b1c8a1SJohn Marino
1095*de0e0e4dSAntonio Huete Jimenez if ((serialfile = NCONF_get_string(conf, ca_config.section,
1096f5b1c8a1SJohn Marino ENV_SERIAL)) == NULL) {
1097*de0e0e4dSAntonio Huete Jimenez lookup_fail(ca_config.section, ENV_SERIAL);
1098f5b1c8a1SJohn Marino goto err;
1099f5b1c8a1SJohn Marino }
1100*de0e0e4dSAntonio Huete Jimenez if (extconf == NULL) {
1101f5b1c8a1SJohn Marino /*
1102f5b1c8a1SJohn Marino * no '-extfile' option, so we look for extensions in
1103f5b1c8a1SJohn Marino * the main configuration file
1104f5b1c8a1SJohn Marino */
1105*de0e0e4dSAntonio Huete Jimenez if (ca_config.extensions == NULL) {
1106*de0e0e4dSAntonio Huete Jimenez ca_config.extensions = NCONF_get_string(conf,
1107*de0e0e4dSAntonio Huete Jimenez ca_config.section, ENV_EXTENSIONS);
1108*de0e0e4dSAntonio Huete Jimenez if (ca_config.extensions == NULL)
1109f5b1c8a1SJohn Marino ERR_clear_error();
1110f5b1c8a1SJohn Marino }
1111*de0e0e4dSAntonio Huete Jimenez if (ca_config.extensions != NULL) {
1112f5b1c8a1SJohn Marino /* Check syntax of file */
1113f5b1c8a1SJohn Marino X509V3_CTX ctx;
1114f5b1c8a1SJohn Marino X509V3_set_ctx_test(&ctx);
1115f5b1c8a1SJohn Marino X509V3_set_nconf(&ctx, conf);
1116f5b1c8a1SJohn Marino if (!X509V3_EXT_add_nconf(conf, &ctx,
1117*de0e0e4dSAntonio Huete Jimenez ca_config.extensions, NULL)) {
1118f5b1c8a1SJohn Marino BIO_printf(bio_err,
1119f5b1c8a1SJohn Marino "Error Loading extension section %s\n",
1120*de0e0e4dSAntonio Huete Jimenez ca_config.extensions);
1121f5b1c8a1SJohn Marino ret = 1;
1122f5b1c8a1SJohn Marino goto err;
1123f5b1c8a1SJohn Marino }
1124f5b1c8a1SJohn Marino }
1125f5b1c8a1SJohn Marino }
1126*de0e0e4dSAntonio Huete Jimenez if (ca_config.startdate == NULL) {
1127*de0e0e4dSAntonio Huete Jimenez ca_config.startdate = NCONF_get_string(conf,
1128*de0e0e4dSAntonio Huete Jimenez ca_config.section, ENV_DEFAULT_STARTDATE);
1129*de0e0e4dSAntonio Huete Jimenez if (ca_config.startdate == NULL)
1130f5b1c8a1SJohn Marino ERR_clear_error();
1131f5b1c8a1SJohn Marino }
1132*de0e0e4dSAntonio Huete Jimenez if (ca_config.startdate == NULL)
1133*de0e0e4dSAntonio Huete Jimenez ca_config.startdate = "today";
1134f5b1c8a1SJohn Marino
1135*de0e0e4dSAntonio Huete Jimenez if (ca_config.enddate == NULL) {
1136*de0e0e4dSAntonio Huete Jimenez ca_config.enddate = NCONF_get_string(conf,
1137*de0e0e4dSAntonio Huete Jimenez ca_config.section, ENV_DEFAULT_ENDDATE);
1138*de0e0e4dSAntonio Huete Jimenez if (ca_config.enddate == NULL)
1139f5b1c8a1SJohn Marino ERR_clear_error();
1140f5b1c8a1SJohn Marino }
1141*de0e0e4dSAntonio Huete Jimenez if (ca_config.days == 0 && ca_config.enddate == NULL) {
1142*de0e0e4dSAntonio Huete Jimenez if (!NCONF_get_number(conf, ca_config.section,
1143*de0e0e4dSAntonio Huete Jimenez ENV_DEFAULT_DAYS, &ca_config.days))
1144*de0e0e4dSAntonio Huete Jimenez ca_config.days = 0;
1145f5b1c8a1SJohn Marino }
1146*de0e0e4dSAntonio Huete Jimenez if (ca_config.enddate == NULL && ca_config.days == 0) {
1147f5b1c8a1SJohn Marino BIO_printf(bio_err,
1148f5b1c8a1SJohn Marino "cannot lookup how many days to certify for\n");
1149f5b1c8a1SJohn Marino goto err;
1150f5b1c8a1SJohn Marino }
1151*de0e0e4dSAntonio Huete Jimenez if ((serial = load_serial(serialfile, ca_config.create_serial,
1152*de0e0e4dSAntonio Huete Jimenez NULL)) == NULL) {
1153f5b1c8a1SJohn Marino BIO_printf(bio_err,
1154f5b1c8a1SJohn Marino "error while loading serial number\n");
1155f5b1c8a1SJohn Marino goto err;
1156f5b1c8a1SJohn Marino }
1157*de0e0e4dSAntonio Huete Jimenez if (ca_config.verbose) {
1158f5b1c8a1SJohn Marino if (BN_is_zero(serial))
1159f5b1c8a1SJohn Marino BIO_printf(bio_err,
1160f5b1c8a1SJohn Marino "next serial number is 00\n");
1161f5b1c8a1SJohn Marino else {
1162f5b1c8a1SJohn Marino if ((f = BN_bn2hex(serial)) == NULL)
1163f5b1c8a1SJohn Marino goto err;
1164f5b1c8a1SJohn Marino BIO_printf(bio_err,
1165f5b1c8a1SJohn Marino "next serial number is %s\n", f);
1166f5b1c8a1SJohn Marino free(f);
1167f5b1c8a1SJohn Marino }
1168f5b1c8a1SJohn Marino }
1169*de0e0e4dSAntonio Huete Jimenez if ((attribs = NCONF_get_section(conf, ca_config.policy)) ==
1170*de0e0e4dSAntonio Huete Jimenez NULL) {
1171*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err, "unable to find 'section' for %s\n",
1172*de0e0e4dSAntonio Huete Jimenez ca_config.policy);
1173f5b1c8a1SJohn Marino goto err;
1174f5b1c8a1SJohn Marino }
1175f5b1c8a1SJohn Marino if ((cert_sk = sk_X509_new_null()) == NULL) {
1176f5b1c8a1SJohn Marino BIO_printf(bio_err, "Memory allocation failure\n");
1177f5b1c8a1SJohn Marino goto err;
1178f5b1c8a1SJohn Marino }
1179*de0e0e4dSAntonio Huete Jimenez if (ca_config.spkac_file != NULL) {
1180f5b1c8a1SJohn Marino total++;
1181*de0e0e4dSAntonio Huete Jimenez j = certify_spkac(&x, ca_config.spkac_file, pkey, x509,
1182*de0e0e4dSAntonio Huete Jimenez dgst, ca_config.sigopts, attribs, db, serial,
1183*de0e0e4dSAntonio Huete Jimenez ca_config.subj, ca_config.chtype,
1184*de0e0e4dSAntonio Huete Jimenez ca_config.multirdn, ca_config.email_dn,
1185*de0e0e4dSAntonio Huete Jimenez ca_config.startdate, ca_config.enddate,
1186*de0e0e4dSAntonio Huete Jimenez ca_config.days, ca_config.extensions, conf,
1187*de0e0e4dSAntonio Huete Jimenez ca_config.verbose, certopt, nameopt, default_op,
1188*de0e0e4dSAntonio Huete Jimenez ext_copy);
1189f5b1c8a1SJohn Marino if (j < 0)
1190f5b1c8a1SJohn Marino goto err;
1191f5b1c8a1SJohn Marino if (j > 0) {
1192f5b1c8a1SJohn Marino total_done++;
1193f5b1c8a1SJohn Marino BIO_printf(bio_err, "\n");
1194f5b1c8a1SJohn Marino if (!BN_add_word(serial, 1))
1195f5b1c8a1SJohn Marino goto err;
1196f5b1c8a1SJohn Marino if (!sk_X509_push(cert_sk, x)) {
1197f5b1c8a1SJohn Marino BIO_printf(bio_err,
1198f5b1c8a1SJohn Marino "Memory allocation failure\n");
1199f5b1c8a1SJohn Marino goto err;
1200f5b1c8a1SJohn Marino }
1201*de0e0e4dSAntonio Huete Jimenez if (ca_config.outfile != NULL) {
1202f5b1c8a1SJohn Marino output_der = 1;
1203*de0e0e4dSAntonio Huete Jimenez ca_config.batch = 1;
1204f5b1c8a1SJohn Marino }
1205f5b1c8a1SJohn Marino }
1206f5b1c8a1SJohn Marino }
1207*de0e0e4dSAntonio Huete Jimenez if (ca_config.ss_cert_file != NULL) {
1208f5b1c8a1SJohn Marino total++;
1209*de0e0e4dSAntonio Huete Jimenez j = certify_cert(&x, ca_config.ss_cert_file, pkey, x509,
1210*de0e0e4dSAntonio Huete Jimenez dgst, ca_config.sigopts, attribs, db, serial,
1211*de0e0e4dSAntonio Huete Jimenez ca_config.subj, ca_config.chtype,
1212*de0e0e4dSAntonio Huete Jimenez ca_config.multirdn, ca_config.email_dn,
1213*de0e0e4dSAntonio Huete Jimenez ca_config.startdate, ca_config.enddate,
1214*de0e0e4dSAntonio Huete Jimenez ca_config.days, ca_config.batch,
1215*de0e0e4dSAntonio Huete Jimenez ca_config.extensions, conf, ca_config.verbose,
1216*de0e0e4dSAntonio Huete Jimenez certopt, nameopt, default_op, ext_copy);
1217f5b1c8a1SJohn Marino if (j < 0)
1218f5b1c8a1SJohn Marino goto err;
1219f5b1c8a1SJohn Marino if (j > 0) {
1220f5b1c8a1SJohn Marino total_done++;
1221f5b1c8a1SJohn Marino BIO_printf(bio_err, "\n");
1222f5b1c8a1SJohn Marino if (!BN_add_word(serial, 1))
1223f5b1c8a1SJohn Marino goto err;
1224f5b1c8a1SJohn Marino if (!sk_X509_push(cert_sk, x)) {
1225f5b1c8a1SJohn Marino BIO_printf(bio_err,
1226f5b1c8a1SJohn Marino "Memory allocation failure\n");
1227f5b1c8a1SJohn Marino goto err;
1228f5b1c8a1SJohn Marino }
1229f5b1c8a1SJohn Marino }
1230f5b1c8a1SJohn Marino }
1231*de0e0e4dSAntonio Huete Jimenez if (ca_config.infile != NULL) {
1232f5b1c8a1SJohn Marino total++;
1233*de0e0e4dSAntonio Huete Jimenez j = certify(&x, ca_config.infile, pkey, x509p, dgst,
1234*de0e0e4dSAntonio Huete Jimenez ca_config.sigopts, attribs, db, serial,
1235*de0e0e4dSAntonio Huete Jimenez ca_config.subj, ca_config.chtype,
1236*de0e0e4dSAntonio Huete Jimenez ca_config.multirdn, ca_config.email_dn,
1237*de0e0e4dSAntonio Huete Jimenez ca_config.startdate, ca_config.enddate,
1238*de0e0e4dSAntonio Huete Jimenez ca_config.days, ca_config.batch,
1239*de0e0e4dSAntonio Huete Jimenez ca_config.extensions, conf, ca_config.verbose,
1240*de0e0e4dSAntonio Huete Jimenez certopt, nameopt, default_op, ext_copy,
1241*de0e0e4dSAntonio Huete Jimenez ca_config.selfsign);
1242f5b1c8a1SJohn Marino if (j < 0)
1243f5b1c8a1SJohn Marino goto err;
1244f5b1c8a1SJohn Marino if (j > 0) {
1245f5b1c8a1SJohn Marino total_done++;
1246f5b1c8a1SJohn Marino BIO_printf(bio_err, "\n");
1247f5b1c8a1SJohn Marino if (!BN_add_word(serial, 1))
1248f5b1c8a1SJohn Marino goto err;
1249f5b1c8a1SJohn Marino if (!sk_X509_push(cert_sk, x)) {
1250f5b1c8a1SJohn Marino BIO_printf(bio_err,
1251f5b1c8a1SJohn Marino "Memory allocation failure\n");
1252f5b1c8a1SJohn Marino goto err;
1253f5b1c8a1SJohn Marino }
1254f5b1c8a1SJohn Marino }
1255f5b1c8a1SJohn Marino }
1256*de0e0e4dSAntonio Huete Jimenez for (i = 0; i < ca_config.infiles_num; i++) {
1257f5b1c8a1SJohn Marino total++;
1258*de0e0e4dSAntonio Huete Jimenez j = certify(&x, ca_config.infiles[i], pkey, x509p, dgst,
1259*de0e0e4dSAntonio Huete Jimenez ca_config.sigopts, attribs, db, serial,
1260*de0e0e4dSAntonio Huete Jimenez ca_config.subj, ca_config.chtype,
1261*de0e0e4dSAntonio Huete Jimenez ca_config.multirdn, ca_config.email_dn,
1262*de0e0e4dSAntonio Huete Jimenez ca_config.startdate, ca_config.enddate,
1263*de0e0e4dSAntonio Huete Jimenez ca_config.days, ca_config.batch,
1264*de0e0e4dSAntonio Huete Jimenez ca_config.extensions, conf, ca_config.verbose,
1265*de0e0e4dSAntonio Huete Jimenez certopt, nameopt, default_op, ext_copy,
1266*de0e0e4dSAntonio Huete Jimenez ca_config.selfsign);
1267f5b1c8a1SJohn Marino if (j < 0)
1268f5b1c8a1SJohn Marino goto err;
1269f5b1c8a1SJohn Marino if (j > 0) {
1270f5b1c8a1SJohn Marino total_done++;
1271f5b1c8a1SJohn Marino BIO_printf(bio_err, "\n");
1272f5b1c8a1SJohn Marino if (!BN_add_word(serial, 1))
1273f5b1c8a1SJohn Marino goto err;
1274f5b1c8a1SJohn Marino if (!sk_X509_push(cert_sk, x)) {
1275f5b1c8a1SJohn Marino BIO_printf(bio_err,
1276f5b1c8a1SJohn Marino "Memory allocation failure\n");
1277f5b1c8a1SJohn Marino goto err;
1278f5b1c8a1SJohn Marino }
1279f5b1c8a1SJohn Marino }
1280f5b1c8a1SJohn Marino }
1281f5b1c8a1SJohn Marino /*
1282f5b1c8a1SJohn Marino * we have a stack of newly certified certificates and a data
1283f5b1c8a1SJohn Marino * base and serial number that need updating
1284f5b1c8a1SJohn Marino */
1285f5b1c8a1SJohn Marino
1286f5b1c8a1SJohn Marino if (sk_X509_num(cert_sk) > 0) {
1287*de0e0e4dSAntonio Huete Jimenez if (!ca_config.batch) {
128872c33676SMaxim Ag char answer[10];
128972c33676SMaxim Ag
1290*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1291*de0e0e4dSAntonio Huete Jimenez "\n%d out of %d certificate requests certified, commit? [y/n]",
1292*de0e0e4dSAntonio Huete Jimenez total_done, total);
1293f5b1c8a1SJohn Marino (void) BIO_flush(bio_err);
1294*de0e0e4dSAntonio Huete Jimenez if (fgets(answer, sizeof answer - 1, stdin) ==
1295*de0e0e4dSAntonio Huete Jimenez NULL) {
1296*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1297*de0e0e4dSAntonio Huete Jimenez "CERTIFICATION CANCELED: I/O error\n");
1298f5b1c8a1SJohn Marino ret = 0;
1299f5b1c8a1SJohn Marino goto err;
1300f5b1c8a1SJohn Marino }
130172c33676SMaxim Ag if ((answer[0] != 'y') && (answer[0] != 'Y')) {
1302*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1303*de0e0e4dSAntonio Huete Jimenez "CERTIFICATION CANCELED\n");
1304f5b1c8a1SJohn Marino ret = 0;
1305f5b1c8a1SJohn Marino goto err;
1306f5b1c8a1SJohn Marino }
1307f5b1c8a1SJohn Marino }
1308*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1309*de0e0e4dSAntonio Huete Jimenez "Write out database with %d new entries\n",
1310*de0e0e4dSAntonio Huete Jimenez sk_X509_num(cert_sk));
1311f5b1c8a1SJohn Marino
1312f5b1c8a1SJohn Marino if (!save_serial(serialfile, "new", serial, NULL))
1313f5b1c8a1SJohn Marino goto err;
1314f5b1c8a1SJohn Marino
1315f5b1c8a1SJohn Marino if (!save_index(dbfile, "new", db))
1316f5b1c8a1SJohn Marino goto err;
1317f5b1c8a1SJohn Marino }
1318*de0e0e4dSAntonio Huete Jimenez if (ca_config.verbose)
1319f5b1c8a1SJohn Marino BIO_printf(bio_err, "writing new certificates\n");
1320f5b1c8a1SJohn Marino for (i = 0; i < sk_X509_num(cert_sk); i++) {
1321*de0e0e4dSAntonio Huete Jimenez ASN1_INTEGER *serialNumber;
1322f5b1c8a1SJohn Marino int k;
1323f5b1c8a1SJohn Marino char *serialstr;
1324f5b1c8a1SJohn Marino unsigned char *data;
132572c33676SMaxim Ag char pempath[PATH_MAX];
1326f5b1c8a1SJohn Marino
1327f5b1c8a1SJohn Marino x = sk_X509_value(cert_sk, i);
1328f5b1c8a1SJohn Marino
1329*de0e0e4dSAntonio Huete Jimenez serialNumber = X509_get_serialNumber(x);
1330*de0e0e4dSAntonio Huete Jimenez j = ASN1_STRING_length(serialNumber);
1331*de0e0e4dSAntonio Huete Jimenez data = ASN1_STRING_data(serialNumber);
1332*de0e0e4dSAntonio Huete Jimenez
1333f5b1c8a1SJohn Marino if (j > 0)
1334f5b1c8a1SJohn Marino serialstr = bin2hex(data, j);
1335f5b1c8a1SJohn Marino else
1336f5b1c8a1SJohn Marino serialstr = strdup("00");
1337*de0e0e4dSAntonio Huete Jimenez if (serialstr != NULL) {
133872c33676SMaxim Ag k = snprintf(pempath, sizeof(pempath),
1339*de0e0e4dSAntonio Huete Jimenez "%s/%s.pem", ca_config.outdir, serialstr);
1340f5b1c8a1SJohn Marino free(serialstr);
1341cca6fc52SDaniel Fojt if (k < 0 || k >= sizeof(pempath)) {
1342f5b1c8a1SJohn Marino BIO_printf(bio_err,
1343f5b1c8a1SJohn Marino "certificate file name too long\n");
1344f5b1c8a1SJohn Marino goto err;
1345f5b1c8a1SJohn Marino }
1346f5b1c8a1SJohn Marino } else {
1347f5b1c8a1SJohn Marino BIO_printf(bio_err,
1348f5b1c8a1SJohn Marino "memory allocation failed\n");
1349f5b1c8a1SJohn Marino goto err;
1350f5b1c8a1SJohn Marino }
1351*de0e0e4dSAntonio Huete Jimenez if (ca_config.verbose)
135272c33676SMaxim Ag BIO_printf(bio_err, "writing %s\n", pempath);
1353f5b1c8a1SJohn Marino
135472c33676SMaxim Ag if (BIO_write_filename(Cout, pempath) <= 0) {
135572c33676SMaxim Ag perror(pempath);
1356f5b1c8a1SJohn Marino goto err;
1357f5b1c8a1SJohn Marino }
1358*de0e0e4dSAntonio Huete Jimenez if (!write_new_certificate(Cout, x, 0,
1359*de0e0e4dSAntonio Huete Jimenez ca_config.notext))
1360*de0e0e4dSAntonio Huete Jimenez goto err;
1361*de0e0e4dSAntonio Huete Jimenez if (!write_new_certificate(Sout, x, output_der,
1362*de0e0e4dSAntonio Huete Jimenez ca_config.notext))
1363*de0e0e4dSAntonio Huete Jimenez goto err;
1364f5b1c8a1SJohn Marino }
1365f5b1c8a1SJohn Marino
1366f5b1c8a1SJohn Marino if (sk_X509_num(cert_sk)) {
1367f5b1c8a1SJohn Marino /* Rename the database and the serial file */
1368f5b1c8a1SJohn Marino if (!rotate_serial(serialfile, "new", "old"))
1369f5b1c8a1SJohn Marino goto err;
1370f5b1c8a1SJohn Marino
1371f5b1c8a1SJohn Marino if (!rotate_index(dbfile, "new", "old"))
1372f5b1c8a1SJohn Marino goto err;
1373f5b1c8a1SJohn Marino
1374f5b1c8a1SJohn Marino BIO_printf(bio_err, "Data Base Updated\n");
1375f5b1c8a1SJohn Marino }
1376f5b1c8a1SJohn Marino }
1377f5b1c8a1SJohn Marino /*****************************************************************/
1378*de0e0e4dSAntonio Huete Jimenez if (ca_config.gencrl) {
1379f5b1c8a1SJohn Marino int crl_v2 = 0;
1380*de0e0e4dSAntonio Huete Jimenez if (ca_config.crl_ext == NULL) {
1381*de0e0e4dSAntonio Huete Jimenez ca_config.crl_ext = NCONF_get_string(conf,
1382*de0e0e4dSAntonio Huete Jimenez ca_config.section, ENV_CRLEXT);
1383*de0e0e4dSAntonio Huete Jimenez if (ca_config.crl_ext == NULL)
1384f5b1c8a1SJohn Marino ERR_clear_error();
1385f5b1c8a1SJohn Marino }
1386*de0e0e4dSAntonio Huete Jimenez if (ca_config.crl_ext != NULL) {
1387f5b1c8a1SJohn Marino /* Check syntax of file */
1388f5b1c8a1SJohn Marino X509V3_CTX ctx;
1389f5b1c8a1SJohn Marino X509V3_set_ctx_test(&ctx);
1390f5b1c8a1SJohn Marino X509V3_set_nconf(&ctx, conf);
1391*de0e0e4dSAntonio Huete Jimenez if (!X509V3_EXT_add_nconf(conf, &ctx, ca_config.crl_ext,
1392*de0e0e4dSAntonio Huete Jimenez NULL)) {
1393f5b1c8a1SJohn Marino BIO_printf(bio_err,
1394f5b1c8a1SJohn Marino "Error Loading CRL extension section %s\n",
1395*de0e0e4dSAntonio Huete Jimenez ca_config.crl_ext);
1396f5b1c8a1SJohn Marino ret = 1;
1397f5b1c8a1SJohn Marino goto err;
1398f5b1c8a1SJohn Marino }
1399f5b1c8a1SJohn Marino }
1400*de0e0e4dSAntonio Huete Jimenez if ((crlnumberfile = NCONF_get_string(conf, ca_config.section,
1401f5b1c8a1SJohn Marino ENV_CRLNUMBER)) != NULL)
1402f5b1c8a1SJohn Marino if ((crlnumber = load_serial(crlnumberfile, 0,
1403f5b1c8a1SJohn Marino NULL)) == NULL) {
1404f5b1c8a1SJohn Marino BIO_printf(bio_err,
1405f5b1c8a1SJohn Marino "error while loading CRL number\n");
1406f5b1c8a1SJohn Marino goto err;
1407f5b1c8a1SJohn Marino }
1408*de0e0e4dSAntonio Huete Jimenez if (!ca_config.crldays && !ca_config.crlhours &&
1409*de0e0e4dSAntonio Huete Jimenez !ca_config.crlsec) {
1410*de0e0e4dSAntonio Huete Jimenez if (!NCONF_get_number(conf, ca_config.section,
1411*de0e0e4dSAntonio Huete Jimenez ENV_DEFAULT_CRL_DAYS, &ca_config.crldays))
1412*de0e0e4dSAntonio Huete Jimenez ca_config.crldays = 0;
1413*de0e0e4dSAntonio Huete Jimenez if (!NCONF_get_number(conf, ca_config.section,
1414*de0e0e4dSAntonio Huete Jimenez ENV_DEFAULT_CRL_HOURS, &ca_config.crlhours))
1415*de0e0e4dSAntonio Huete Jimenez ca_config.crlhours = 0;
1416f5b1c8a1SJohn Marino ERR_clear_error();
1417f5b1c8a1SJohn Marino }
1418*de0e0e4dSAntonio Huete Jimenez if ((ca_config.crldays == 0) && (ca_config.crlhours == 0) &&
1419*de0e0e4dSAntonio Huete Jimenez (ca_config.crlsec == 0)) {
1420*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1421*de0e0e4dSAntonio Huete Jimenez "cannot lookup how long until the next CRL is issued\n");
1422f5b1c8a1SJohn Marino goto err;
1423f5b1c8a1SJohn Marino }
1424*de0e0e4dSAntonio Huete Jimenez if (ca_config.verbose)
1425f5b1c8a1SJohn Marino BIO_printf(bio_err, "making CRL\n");
1426f5b1c8a1SJohn Marino if ((crl = X509_CRL_new()) == NULL)
1427f5b1c8a1SJohn Marino goto err;
1428f5b1c8a1SJohn Marino if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509)))
1429f5b1c8a1SJohn Marino goto err;
1430f5b1c8a1SJohn Marino
1431*de0e0e4dSAntonio Huete Jimenez if ((tmptm = X509_gmtime_adj(NULL, 0)) == NULL)
1432f5b1c8a1SJohn Marino goto err;
1433*de0e0e4dSAntonio Huete Jimenez if (!X509_CRL_set_lastUpdate(crl, tmptm))
1434*de0e0e4dSAntonio Huete Jimenez goto err;
1435*de0e0e4dSAntonio Huete Jimenez if (X509_time_adj_ex(tmptm, ca_config.crldays,
1436*de0e0e4dSAntonio Huete Jimenez ca_config.crlhours * 60 * 60 + ca_config.crlsec, NULL) ==
1437*de0e0e4dSAntonio Huete Jimenez NULL) {
1438f5b1c8a1SJohn Marino BIO_puts(bio_err, "error setting CRL nextUpdate\n");
1439f5b1c8a1SJohn Marino goto err;
1440f5b1c8a1SJohn Marino }
1441*de0e0e4dSAntonio Huete Jimenez if (!X509_CRL_set_nextUpdate(crl, tmptm))
1442*de0e0e4dSAntonio Huete Jimenez goto err;
1443f5b1c8a1SJohn Marino ASN1_TIME_free(tmptm);
1444*de0e0e4dSAntonio Huete Jimenez tmptm = NULL;
1445f5b1c8a1SJohn Marino
1446f5b1c8a1SJohn Marino for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
1447f5b1c8a1SJohn Marino pp = sk_OPENSSL_PSTRING_value(db->db->data, i);
1448f5b1c8a1SJohn Marino if (pp[DB_type][0] == DB_TYPE_REV) {
1449f5b1c8a1SJohn Marino if ((r = X509_REVOKED_new()) == NULL)
1450f5b1c8a1SJohn Marino goto err;
1451f5b1c8a1SJohn Marino j = make_revoked(r, pp[DB_rev_date]);
1452f5b1c8a1SJohn Marino if (!j)
1453f5b1c8a1SJohn Marino goto err;
1454f5b1c8a1SJohn Marino if (j == 2)
1455f5b1c8a1SJohn Marino crl_v2 = 1;
1456f5b1c8a1SJohn Marino if (!BN_hex2bn(&serial, pp[DB_serial]))
1457f5b1c8a1SJohn Marino goto err;
1458*de0e0e4dSAntonio Huete Jimenez tmpserial = BN_to_ASN1_INTEGER(serial, NULL);
1459f5b1c8a1SJohn Marino BN_free(serial);
1460f5b1c8a1SJohn Marino serial = NULL;
1461*de0e0e4dSAntonio Huete Jimenez if (tmpserial == NULL)
1462f5b1c8a1SJohn Marino goto err;
1463*de0e0e4dSAntonio Huete Jimenez if (!X509_REVOKED_set_serialNumber(r, tmpserial)) {
1464*de0e0e4dSAntonio Huete Jimenez ASN1_INTEGER_free(tmpserial);
1465*de0e0e4dSAntonio Huete Jimenez goto err;
1466*de0e0e4dSAntonio Huete Jimenez }
1467*de0e0e4dSAntonio Huete Jimenez ASN1_INTEGER_free(tmpserial);
1468*de0e0e4dSAntonio Huete Jimenez if (!X509_CRL_add0_revoked(crl, r))
1469*de0e0e4dSAntonio Huete Jimenez goto err;
1470*de0e0e4dSAntonio Huete Jimenez r = NULL;
1471f5b1c8a1SJohn Marino }
1472f5b1c8a1SJohn Marino }
1473f5b1c8a1SJohn Marino
1474f5b1c8a1SJohn Marino /*
1475f5b1c8a1SJohn Marino * sort the data so it will be written in serial number order
1476f5b1c8a1SJohn Marino */
1477f5b1c8a1SJohn Marino X509_CRL_sort(crl);
1478f5b1c8a1SJohn Marino
1479f5b1c8a1SJohn Marino /* we now have a CRL */
1480*de0e0e4dSAntonio Huete Jimenez if (ca_config.verbose)
1481f5b1c8a1SJohn Marino BIO_printf(bio_err, "signing CRL\n");
1482f5b1c8a1SJohn Marino
1483f5b1c8a1SJohn Marino /* Add any extensions asked for */
1484f5b1c8a1SJohn Marino
1485*de0e0e4dSAntonio Huete Jimenez if (ca_config.crl_ext != NULL || crlnumberfile != NULL) {
1486f5b1c8a1SJohn Marino X509V3_CTX crlctx;
1487f5b1c8a1SJohn Marino X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
1488f5b1c8a1SJohn Marino X509V3_set_nconf(&crlctx, conf);
1489f5b1c8a1SJohn Marino
1490*de0e0e4dSAntonio Huete Jimenez if (ca_config.crl_ext != NULL)
1491f5b1c8a1SJohn Marino if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
1492*de0e0e4dSAntonio Huete Jimenez ca_config.crl_ext, crl))
1493f5b1c8a1SJohn Marino goto err;
1494f5b1c8a1SJohn Marino if (crlnumberfile != NULL) {
1495*de0e0e4dSAntonio Huete Jimenez tmpserial = BN_to_ASN1_INTEGER(crlnumber, NULL);
1496*de0e0e4dSAntonio Huete Jimenez if (tmpserial == NULL)
1497f5b1c8a1SJohn Marino goto err;
1498*de0e0e4dSAntonio Huete Jimenez if (!X509_CRL_add1_ext_i2d(crl, NID_crl_number,
1499*de0e0e4dSAntonio Huete Jimenez tmpserial, 0, 0)) {
1500*de0e0e4dSAntonio Huete Jimenez ASN1_INTEGER_free(tmpserial);
1501*de0e0e4dSAntonio Huete Jimenez goto err;
1502*de0e0e4dSAntonio Huete Jimenez }
1503*de0e0e4dSAntonio Huete Jimenez ASN1_INTEGER_free(tmpserial);
1504f5b1c8a1SJohn Marino crl_v2 = 1;
1505f5b1c8a1SJohn Marino if (!BN_add_word(crlnumber, 1))
1506f5b1c8a1SJohn Marino goto err;
1507f5b1c8a1SJohn Marino }
1508f5b1c8a1SJohn Marino }
1509*de0e0e4dSAntonio Huete Jimenez if (ca_config.crl_ext != NULL || crl_v2) {
1510f5b1c8a1SJohn Marino if (!X509_CRL_set_version(crl, 1))
1511f5b1c8a1SJohn Marino goto err; /* version 2 CRL */
1512f5b1c8a1SJohn Marino }
1513f5b1c8a1SJohn Marino if (crlnumberfile != NULL) /* we have a CRL number that
1514f5b1c8a1SJohn Marino * need updating */
1515f5b1c8a1SJohn Marino if (!save_serial(crlnumberfile, "new", crlnumber, NULL))
1516f5b1c8a1SJohn Marino goto err;
1517f5b1c8a1SJohn Marino
1518f5b1c8a1SJohn Marino BN_free(crlnumber);
1519f5b1c8a1SJohn Marino crlnumber = NULL;
1520*de0e0e4dSAntonio Huete Jimenez
1521*de0e0e4dSAntonio Huete Jimenez if (!do_X509_CRL_sign(bio_err, crl, pkey, dgst,
1522*de0e0e4dSAntonio Huete Jimenez ca_config.sigopts))
1523f5b1c8a1SJohn Marino goto err;
1524f5b1c8a1SJohn Marino
1525*de0e0e4dSAntonio Huete Jimenez if (!PEM_write_bio_X509_CRL(Sout, crl))
1526*de0e0e4dSAntonio Huete Jimenez goto err;
1527f5b1c8a1SJohn Marino
1528f5b1c8a1SJohn Marino if (crlnumberfile != NULL) /* Rename the crlnumber file */
1529f5b1c8a1SJohn Marino if (!rotate_serial(crlnumberfile, "new", "old"))
1530f5b1c8a1SJohn Marino goto err;
1531f5b1c8a1SJohn Marino
1532f5b1c8a1SJohn Marino }
1533f5b1c8a1SJohn Marino /*****************************************************************/
1534*de0e0e4dSAntonio Huete Jimenez if (ca_config.dorevoke) {
1535*de0e0e4dSAntonio Huete Jimenez if (ca_config.infile == NULL) {
1536f5b1c8a1SJohn Marino BIO_printf(bio_err, "no input files\n");
1537f5b1c8a1SJohn Marino goto err;
1538f5b1c8a1SJohn Marino } else {
1539f5b1c8a1SJohn Marino X509 *revcert;
1540*de0e0e4dSAntonio Huete Jimenez revcert = load_cert(bio_err, ca_config.infile,
1541*de0e0e4dSAntonio Huete Jimenez FORMAT_PEM, NULL, ca_config.infile);
1542f5b1c8a1SJohn Marino if (revcert == NULL)
1543f5b1c8a1SJohn Marino goto err;
1544*de0e0e4dSAntonio Huete Jimenez j = do_revoke(revcert, db, ca_config.rev_type,
1545*de0e0e4dSAntonio Huete Jimenez ca_config.rev_arg);
1546f5b1c8a1SJohn Marino if (j <= 0)
1547f5b1c8a1SJohn Marino goto err;
1548f5b1c8a1SJohn Marino X509_free(revcert);
1549f5b1c8a1SJohn Marino
1550f5b1c8a1SJohn Marino if (!save_index(dbfile, "new", db))
1551f5b1c8a1SJohn Marino goto err;
1552f5b1c8a1SJohn Marino
1553f5b1c8a1SJohn Marino if (!rotate_index(dbfile, "new", "old"))
1554f5b1c8a1SJohn Marino goto err;
1555f5b1c8a1SJohn Marino
1556f5b1c8a1SJohn Marino BIO_printf(bio_err, "Data Base Updated\n");
1557f5b1c8a1SJohn Marino }
1558f5b1c8a1SJohn Marino }
1559f5b1c8a1SJohn Marino /*****************************************************************/
1560f5b1c8a1SJohn Marino ret = 0;
1561f5b1c8a1SJohn Marino
1562f5b1c8a1SJohn Marino err:
1563f5b1c8a1SJohn Marino free(tofree);
1564f5b1c8a1SJohn Marino
1565f5b1c8a1SJohn Marino BIO_free_all(Cout);
1566f5b1c8a1SJohn Marino BIO_free_all(Sout);
1567f5b1c8a1SJohn Marino BIO_free_all(out);
1568f5b1c8a1SJohn Marino BIO_free_all(in);
1569f5b1c8a1SJohn Marino
1570f5b1c8a1SJohn Marino sk_X509_pop_free(cert_sk, X509_free);
1571f5b1c8a1SJohn Marino
1572f5b1c8a1SJohn Marino if (ret)
1573f5b1c8a1SJohn Marino ERR_print_errors(bio_err);
1574*de0e0e4dSAntonio Huete Jimenez if (free_key)
1575*de0e0e4dSAntonio Huete Jimenez free(ca_config.key);
1576f5b1c8a1SJohn Marino BN_free(serial);
1577f5b1c8a1SJohn Marino BN_free(crlnumber);
1578f5b1c8a1SJohn Marino free_index(db);
1579*de0e0e4dSAntonio Huete Jimenez sk_OPENSSL_STRING_free(ca_config.sigopts);
1580f5b1c8a1SJohn Marino EVP_PKEY_free(pkey);
1581f5b1c8a1SJohn Marino X509_free(x509);
1582f5b1c8a1SJohn Marino X509_CRL_free(crl);
1583*de0e0e4dSAntonio Huete Jimenez X509_REVOKED_free(r);
1584*de0e0e4dSAntonio Huete Jimenez ASN1_TIME_free(tmptm);
1585f5b1c8a1SJohn Marino NCONF_free(conf);
1586f5b1c8a1SJohn Marino NCONF_free(extconf);
1587f5b1c8a1SJohn Marino OBJ_cleanup();
1588f5b1c8a1SJohn Marino
1589f5b1c8a1SJohn Marino return (ret);
1590f5b1c8a1SJohn Marino }
1591f5b1c8a1SJohn Marino
1592f5b1c8a1SJohn Marino static void
lookup_fail(const char * name,const char * tag)1593f5b1c8a1SJohn Marino lookup_fail(const char *name, const char *tag)
1594f5b1c8a1SJohn Marino {
1595f5b1c8a1SJohn Marino BIO_printf(bio_err, "variable lookup failed for %s::%s\n", name, tag);
1596f5b1c8a1SJohn Marino }
1597f5b1c8a1SJohn Marino
1598f5b1c8a1SJohn Marino static int
certify(X509 ** xret,char * infile,EVP_PKEY * pkey,X509 * x509,const EVP_MD * dgst,STACK_OF (OPENSSL_STRING)* sigopts,STACK_OF (CONF_VALUE)* policy,CA_DB * db,BIGNUM * serial,char * subj,unsigned long chtype,int multirdn,int email_dn,char * startdate,char * enddate,long days,int batch,char * ext_sect,CONF * lconf,int verbose,unsigned long certopt,unsigned long nameopt,int default_op,int ext_copy,int selfsign)1599f5b1c8a1SJohn Marino certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1600f5b1c8a1SJohn Marino const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
1601f5b1c8a1SJohn Marino STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
1602f5b1c8a1SJohn Marino unsigned long chtype, int multirdn, int email_dn, char *startdate,
1603f5b1c8a1SJohn Marino char *enddate, long days, int batch, char *ext_sect, CONF *lconf,
1604f5b1c8a1SJohn Marino int verbose, unsigned long certopt, unsigned long nameopt, int default_op,
1605f5b1c8a1SJohn Marino int ext_copy, int selfsign)
1606f5b1c8a1SJohn Marino {
1607f5b1c8a1SJohn Marino X509_REQ *req = NULL;
1608f5b1c8a1SJohn Marino BIO *in = NULL;
1609f5b1c8a1SJohn Marino EVP_PKEY *pktmp = NULL;
1610f5b1c8a1SJohn Marino int ok = -1, i;
1611f5b1c8a1SJohn Marino
1612f5b1c8a1SJohn Marino in = BIO_new(BIO_s_file());
1613f5b1c8a1SJohn Marino
1614f5b1c8a1SJohn Marino if (BIO_read_filename(in, infile) <= 0) {
1615f5b1c8a1SJohn Marino perror(infile);
1616f5b1c8a1SJohn Marino goto err;
1617f5b1c8a1SJohn Marino }
1618f5b1c8a1SJohn Marino if ((req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL)) == NULL) {
1619f5b1c8a1SJohn Marino BIO_printf(bio_err, "Error reading certificate request in %s\n",
1620f5b1c8a1SJohn Marino infile);
1621f5b1c8a1SJohn Marino goto err;
1622f5b1c8a1SJohn Marino }
1623*de0e0e4dSAntonio Huete Jimenez if (verbose) {
1624*de0e0e4dSAntonio Huete Jimenez if (!X509_REQ_print(bio_err, req))
1625*de0e0e4dSAntonio Huete Jimenez goto err;
1626*de0e0e4dSAntonio Huete Jimenez }
1627f5b1c8a1SJohn Marino
1628f5b1c8a1SJohn Marino BIO_printf(bio_err, "Check that the request matches the signature\n");
1629f5b1c8a1SJohn Marino
1630f5b1c8a1SJohn Marino if (selfsign && !X509_REQ_check_private_key(req, pkey)) {
1631f5b1c8a1SJohn Marino BIO_printf(bio_err,
1632f5b1c8a1SJohn Marino "Certificate request and CA private key do not match\n");
1633f5b1c8a1SJohn Marino ok = 0;
1634f5b1c8a1SJohn Marino goto err;
1635f5b1c8a1SJohn Marino }
1636*de0e0e4dSAntonio Huete Jimenez if ((pktmp = X509_REQ_get0_pubkey(req)) == NULL) {
1637f5b1c8a1SJohn Marino BIO_printf(bio_err, "error unpacking public key\n");
1638f5b1c8a1SJohn Marino goto err;
1639f5b1c8a1SJohn Marino }
1640f5b1c8a1SJohn Marino i = X509_REQ_verify(req, pktmp);
1641f5b1c8a1SJohn Marino if (i < 0) {
1642f5b1c8a1SJohn Marino ok = 0;
1643f5b1c8a1SJohn Marino BIO_printf(bio_err, "Signature verification problems....\n");
1644f5b1c8a1SJohn Marino goto err;
1645f5b1c8a1SJohn Marino }
1646f5b1c8a1SJohn Marino if (i == 0) {
1647f5b1c8a1SJohn Marino ok = 0;
1648f5b1c8a1SJohn Marino BIO_printf(bio_err,
1649f5b1c8a1SJohn Marino "Signature did not match the certificate request\n");
1650f5b1c8a1SJohn Marino goto err;
1651f5b1c8a1SJohn Marino } else
1652f5b1c8a1SJohn Marino BIO_printf(bio_err, "Signature ok\n");
1653f5b1c8a1SJohn Marino
1654f5b1c8a1SJohn Marino ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial,
1655f5b1c8a1SJohn Marino subj, chtype, multirdn, email_dn, startdate, enddate, days, batch,
1656f5b1c8a1SJohn Marino verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
1657f5b1c8a1SJohn Marino ext_copy, selfsign);
1658f5b1c8a1SJohn Marino
1659f5b1c8a1SJohn Marino err:
1660f5b1c8a1SJohn Marino X509_REQ_free(req);
1661f5b1c8a1SJohn Marino BIO_free(in);
1662*de0e0e4dSAntonio Huete Jimenez
1663f5b1c8a1SJohn Marino return (ok);
1664f5b1c8a1SJohn Marino }
1665f5b1c8a1SJohn Marino
1666f5b1c8a1SJohn Marino static int
certify_cert(X509 ** xret,char * infile,EVP_PKEY * pkey,X509 * x509,const EVP_MD * dgst,STACK_OF (OPENSSL_STRING)* sigopts,STACK_OF (CONF_VALUE)* policy,CA_DB * db,BIGNUM * serial,char * subj,unsigned long chtype,int multirdn,int email_dn,char * startdate,char * enddate,long days,int batch,char * ext_sect,CONF * lconf,int verbose,unsigned long certopt,unsigned long nameopt,int default_op,int ext_copy)1667f5b1c8a1SJohn Marino certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1668f5b1c8a1SJohn Marino const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
1669f5b1c8a1SJohn Marino STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
1670f5b1c8a1SJohn Marino unsigned long chtype, int multirdn, int email_dn, char *startdate,
1671f5b1c8a1SJohn Marino char *enddate, long days, int batch, char *ext_sect, CONF *lconf,
1672f5b1c8a1SJohn Marino int verbose, unsigned long certopt, unsigned long nameopt, int default_op,
1673f5b1c8a1SJohn Marino int ext_copy)
1674f5b1c8a1SJohn Marino {
1675f5b1c8a1SJohn Marino X509 *req = NULL;
1676f5b1c8a1SJohn Marino X509_REQ *rreq = NULL;
1677f5b1c8a1SJohn Marino EVP_PKEY *pktmp = NULL;
1678f5b1c8a1SJohn Marino int ok = -1, i;
1679f5b1c8a1SJohn Marino
1680f5b1c8a1SJohn Marino if ((req = load_cert(bio_err, infile, FORMAT_PEM, NULL,
1681f5b1c8a1SJohn Marino infile)) == NULL)
1682f5b1c8a1SJohn Marino goto err;
1683*de0e0e4dSAntonio Huete Jimenez if (verbose) {
1684*de0e0e4dSAntonio Huete Jimenez if (!X509_print(bio_err, req))
1685*de0e0e4dSAntonio Huete Jimenez goto err;
1686*de0e0e4dSAntonio Huete Jimenez }
1687f5b1c8a1SJohn Marino
1688f5b1c8a1SJohn Marino BIO_printf(bio_err, "Check that the request matches the signature\n");
1689f5b1c8a1SJohn Marino
1690*de0e0e4dSAntonio Huete Jimenez if ((pktmp = X509_get0_pubkey(req)) == NULL) {
1691f5b1c8a1SJohn Marino BIO_printf(bio_err, "error unpacking public key\n");
1692f5b1c8a1SJohn Marino goto err;
1693f5b1c8a1SJohn Marino }
1694f5b1c8a1SJohn Marino i = X509_verify(req, pktmp);
1695f5b1c8a1SJohn Marino if (i < 0) {
1696f5b1c8a1SJohn Marino ok = 0;
1697f5b1c8a1SJohn Marino BIO_printf(bio_err, "Signature verification problems....\n");
1698f5b1c8a1SJohn Marino goto err;
1699f5b1c8a1SJohn Marino }
1700f5b1c8a1SJohn Marino if (i == 0) {
1701f5b1c8a1SJohn Marino ok = 0;
1702f5b1c8a1SJohn Marino BIO_printf(bio_err,
1703f5b1c8a1SJohn Marino "Signature did not match the certificate\n");
1704f5b1c8a1SJohn Marino goto err;
1705f5b1c8a1SJohn Marino } else
1706f5b1c8a1SJohn Marino BIO_printf(bio_err, "Signature ok\n");
1707f5b1c8a1SJohn Marino
1708f5b1c8a1SJohn Marino if ((rreq = X509_to_X509_REQ(req, NULL, EVP_md5())) == NULL)
1709f5b1c8a1SJohn Marino goto err;
1710f5b1c8a1SJohn Marino
1711f5b1c8a1SJohn Marino ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial,
1712f5b1c8a1SJohn Marino subj, chtype, multirdn, email_dn, startdate, enddate, days, batch,
1713f5b1c8a1SJohn Marino verbose, rreq, ext_sect, lconf, certopt, nameopt, default_op,
1714f5b1c8a1SJohn Marino ext_copy, 0);
1715f5b1c8a1SJohn Marino
1716f5b1c8a1SJohn Marino err:
1717f5b1c8a1SJohn Marino X509_REQ_free(rreq);
1718f5b1c8a1SJohn Marino X509_free(req);
1719*de0e0e4dSAntonio Huete Jimenez
1720f5b1c8a1SJohn Marino return (ok);
1721f5b1c8a1SJohn Marino }
1722f5b1c8a1SJohn Marino
1723f5b1c8a1SJohn Marino static int
do_body(X509 ** xret,EVP_PKEY * pkey,X509 * x509,const EVP_MD * dgst,STACK_OF (OPENSSL_STRING)* sigopts,STACK_OF (CONF_VALUE)* policy,CA_DB * db,BIGNUM * serial,char * subj,unsigned long chtype,int multirdn,int email_dn,char * startdate,char * enddate,long days,int batch,int verbose,X509_REQ * req,char * ext_sect,CONF * lconf,unsigned long certopt,unsigned long nameopt,int default_op,int ext_copy,int selfsign)1724f5b1c8a1SJohn Marino do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
1725f5b1c8a1SJohn Marino STACK_OF(OPENSSL_STRING) *sigopts, STACK_OF(CONF_VALUE) *policy,
1726f5b1c8a1SJohn Marino CA_DB *db, BIGNUM *serial, char *subj, unsigned long chtype, int multirdn,
1727f5b1c8a1SJohn Marino int email_dn, char *startdate, char *enddate, long days, int batch,
1728f5b1c8a1SJohn Marino int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
1729f5b1c8a1SJohn Marino unsigned long certopt, unsigned long nameopt, int default_op,
1730f5b1c8a1SJohn Marino int ext_copy, int selfsign)
1731f5b1c8a1SJohn Marino {
1732*de0e0e4dSAntonio Huete Jimenez X509_NAME *name = NULL, *CAname = NULL;
1733*de0e0e4dSAntonio Huete Jimenez X509_NAME *subject = NULL, *dn_subject = NULL;
1734*de0e0e4dSAntonio Huete Jimenez ASN1_UTCTIME *tm;
1735f5b1c8a1SJohn Marino ASN1_STRING *str, *str2;
1736f5b1c8a1SJohn Marino ASN1_OBJECT *obj;
1737f5b1c8a1SJohn Marino X509 *ret = NULL;
1738f5b1c8a1SJohn Marino X509_NAME_ENTRY *ne;
1739f5b1c8a1SJohn Marino X509_NAME_ENTRY *tne, *push;
1740f5b1c8a1SJohn Marino EVP_PKEY *pktmp;
1741f5b1c8a1SJohn Marino int ok = -1, i, j, last, nid;
1742f5b1c8a1SJohn Marino const char *p;
1743f5b1c8a1SJohn Marino CONF_VALUE *cv;
1744f5b1c8a1SJohn Marino OPENSSL_STRING row[DB_NUMBER];
1745f5b1c8a1SJohn Marino OPENSSL_STRING *irow = NULL;
1746f5b1c8a1SJohn Marino OPENSSL_STRING *rrow = NULL;
1747*de0e0e4dSAntonio Huete Jimenez const STACK_OF(X509_EXTENSION) *exts;
1748f5b1c8a1SJohn Marino
1749*de0e0e4dSAntonio Huete Jimenez *xret = NULL;
1750*de0e0e4dSAntonio Huete Jimenez
1751f5b1c8a1SJohn Marino for (i = 0; i < DB_NUMBER; i++)
1752f5b1c8a1SJohn Marino row[i] = NULL;
1753f5b1c8a1SJohn Marino
1754*de0e0e4dSAntonio Huete Jimenez if (subj != NULL) {
1755f5b1c8a1SJohn Marino X509_NAME *n = parse_name(subj, chtype, multirdn);
1756f5b1c8a1SJohn Marino
1757*de0e0e4dSAntonio Huete Jimenez if (n == NULL) {
1758f5b1c8a1SJohn Marino ERR_print_errors(bio_err);
1759f5b1c8a1SJohn Marino goto err;
1760f5b1c8a1SJohn Marino }
1761*de0e0e4dSAntonio Huete Jimenez if (!X509_REQ_set_subject_name(req, n)) {
1762*de0e0e4dSAntonio Huete Jimenez X509_NAME_free(n);
1763*de0e0e4dSAntonio Huete Jimenez goto err;
1764*de0e0e4dSAntonio Huete Jimenez }
1765f5b1c8a1SJohn Marino X509_NAME_free(n);
1766f5b1c8a1SJohn Marino }
1767f5b1c8a1SJohn Marino if (default_op)
1768f5b1c8a1SJohn Marino BIO_printf(bio_err,
1769f5b1c8a1SJohn Marino "The Subject's Distinguished Name is as follows\n");
1770f5b1c8a1SJohn Marino
1771f5b1c8a1SJohn Marino name = X509_REQ_get_subject_name(req);
1772f5b1c8a1SJohn Marino for (i = 0; i < X509_NAME_entry_count(name); i++) {
1773f5b1c8a1SJohn Marino ne = X509_NAME_get_entry(name, i);
1774*de0e0e4dSAntonio Huete Jimenez if (ne == NULL)
1775*de0e0e4dSAntonio Huete Jimenez goto err;
1776f5b1c8a1SJohn Marino str = X509_NAME_ENTRY_get_data(ne);
1777*de0e0e4dSAntonio Huete Jimenez if (str == NULL)
1778*de0e0e4dSAntonio Huete Jimenez goto err;
1779f5b1c8a1SJohn Marino obj = X509_NAME_ENTRY_get_object(ne);
1780*de0e0e4dSAntonio Huete Jimenez if (obj == NULL)
1781*de0e0e4dSAntonio Huete Jimenez goto err;
1782f5b1c8a1SJohn Marino
1783*de0e0e4dSAntonio Huete Jimenez if (ca_config.msie_hack) {
1784f5b1c8a1SJohn Marino /* assume all type should be strings */
1785*de0e0e4dSAntonio Huete Jimenez nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(ne));
1786*de0e0e4dSAntonio Huete Jimenez if (nid == NID_undef)
1787*de0e0e4dSAntonio Huete Jimenez goto err;
1788f5b1c8a1SJohn Marino
1789f5b1c8a1SJohn Marino if (str->type == V_ASN1_UNIVERSALSTRING)
1790f5b1c8a1SJohn Marino ASN1_UNIVERSALSTRING_to_string(str);
1791f5b1c8a1SJohn Marino
1792f5b1c8a1SJohn Marino if ((str->type == V_ASN1_IA5STRING) &&
1793f5b1c8a1SJohn Marino (nid != NID_pkcs9_emailAddress))
1794f5b1c8a1SJohn Marino str->type = V_ASN1_T61STRING;
1795f5b1c8a1SJohn Marino
1796f5b1c8a1SJohn Marino if ((nid == NID_pkcs9_emailAddress) &&
1797f5b1c8a1SJohn Marino (str->type == V_ASN1_PRINTABLESTRING))
1798f5b1c8a1SJohn Marino str->type = V_ASN1_IA5STRING;
1799f5b1c8a1SJohn Marino }
1800f5b1c8a1SJohn Marino /* If no EMAIL is wanted in the subject */
1801f5b1c8a1SJohn Marino if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
1802f5b1c8a1SJohn Marino continue;
1803f5b1c8a1SJohn Marino
1804f5b1c8a1SJohn Marino /* check some things */
1805f5b1c8a1SJohn Marino if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
1806f5b1c8a1SJohn Marino (str->type != V_ASN1_IA5STRING)) {
1807*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1808*de0e0e4dSAntonio Huete Jimenez "\nemailAddress type needs to be of type IA5STRING\n");
1809f5b1c8a1SJohn Marino goto err;
1810f5b1c8a1SJohn Marino }
1811f5b1c8a1SJohn Marino if ((str->type != V_ASN1_BMPSTRING) &&
1812f5b1c8a1SJohn Marino (str->type != V_ASN1_UTF8STRING)) {
1813f5b1c8a1SJohn Marino j = ASN1_PRINTABLE_type(str->data, str->length);
1814f5b1c8a1SJohn Marino if (((j == V_ASN1_T61STRING) &&
1815f5b1c8a1SJohn Marino (str->type != V_ASN1_T61STRING)) ||
1816f5b1c8a1SJohn Marino ((j == V_ASN1_IA5STRING) &&
1817f5b1c8a1SJohn Marino (str->type == V_ASN1_PRINTABLESTRING))) {
1818*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1819*de0e0e4dSAntonio Huete Jimenez "\nThe string contains characters that are illegal for the ASN.1 type\n");
1820f5b1c8a1SJohn Marino goto err;
1821f5b1c8a1SJohn Marino }
1822f5b1c8a1SJohn Marino }
1823f5b1c8a1SJohn Marino if (default_op)
1824f5b1c8a1SJohn Marino old_entry_print(bio_err, obj, str);
1825f5b1c8a1SJohn Marino }
1826f5b1c8a1SJohn Marino
1827f5b1c8a1SJohn Marino /* Ok, now we check the 'policy' stuff. */
1828f5b1c8a1SJohn Marino if ((subject = X509_NAME_new()) == NULL) {
1829f5b1c8a1SJohn Marino BIO_printf(bio_err, "Memory allocation failure\n");
1830f5b1c8a1SJohn Marino goto err;
1831f5b1c8a1SJohn Marino }
1832f5b1c8a1SJohn Marino /* take a copy of the issuer name before we mess with it. */
1833f5b1c8a1SJohn Marino if (selfsign)
1834f5b1c8a1SJohn Marino CAname = X509_NAME_dup(name);
1835f5b1c8a1SJohn Marino else
1836*de0e0e4dSAntonio Huete Jimenez CAname = X509_NAME_dup(X509_get_subject_name(x509));
1837f5b1c8a1SJohn Marino if (CAname == NULL)
1838f5b1c8a1SJohn Marino goto err;
1839f5b1c8a1SJohn Marino str = str2 = NULL;
1840f5b1c8a1SJohn Marino
1841f5b1c8a1SJohn Marino for (i = 0; i < sk_CONF_VALUE_num(policy); i++) {
1842f5b1c8a1SJohn Marino cv = sk_CONF_VALUE_value(policy, i); /* get the object id */
1843f5b1c8a1SJohn Marino if ((j = OBJ_txt2nid(cv->name)) == NID_undef) {
1844*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1845*de0e0e4dSAntonio Huete Jimenez "%s:unknown object type in 'policy' configuration\n",
1846*de0e0e4dSAntonio Huete Jimenez cv->name);
1847f5b1c8a1SJohn Marino goto err;
1848f5b1c8a1SJohn Marino }
1849f5b1c8a1SJohn Marino obj = OBJ_nid2obj(j);
1850*de0e0e4dSAntonio Huete Jimenez if (obj == NULL)
1851*de0e0e4dSAntonio Huete Jimenez goto err;
1852f5b1c8a1SJohn Marino
1853f5b1c8a1SJohn Marino last = -1;
1854f5b1c8a1SJohn Marino for (;;) {
1855f5b1c8a1SJohn Marino /* lookup the object in the supplied name list */
1856f5b1c8a1SJohn Marino j = X509_NAME_get_index_by_OBJ(name, obj, last);
1857f5b1c8a1SJohn Marino if (j < 0) {
1858f5b1c8a1SJohn Marino if (last != -1)
1859f5b1c8a1SJohn Marino break;
1860f5b1c8a1SJohn Marino tne = NULL;
1861f5b1c8a1SJohn Marino } else {
1862f5b1c8a1SJohn Marino tne = X509_NAME_get_entry(name, j);
1863*de0e0e4dSAntonio Huete Jimenez if (tne == NULL)
1864*de0e0e4dSAntonio Huete Jimenez goto err;
1865f5b1c8a1SJohn Marino }
1866f5b1c8a1SJohn Marino last = j;
1867f5b1c8a1SJohn Marino
1868f5b1c8a1SJohn Marino /* depending on the 'policy', decide what to do. */
1869f5b1c8a1SJohn Marino push = NULL;
1870f5b1c8a1SJohn Marino if (strcmp(cv->value, "optional") == 0) {
1871f5b1c8a1SJohn Marino if (tne != NULL)
1872f5b1c8a1SJohn Marino push = tne;
1873f5b1c8a1SJohn Marino } else if (strcmp(cv->value, "supplied") == 0) {
1874f5b1c8a1SJohn Marino if (tne == NULL) {
1875*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1876*de0e0e4dSAntonio Huete Jimenez "The %s field needed to be supplied and was missing\n",
1877*de0e0e4dSAntonio Huete Jimenez cv->name);
1878f5b1c8a1SJohn Marino goto err;
1879f5b1c8a1SJohn Marino } else
1880f5b1c8a1SJohn Marino push = tne;
1881f5b1c8a1SJohn Marino } else if (strcmp(cv->value, "match") == 0) {
1882f5b1c8a1SJohn Marino int last2;
1883f5b1c8a1SJohn Marino
1884f5b1c8a1SJohn Marino if (tne == NULL) {
1885*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1886*de0e0e4dSAntonio Huete Jimenez "The mandatory %s field was missing\n",
1887*de0e0e4dSAntonio Huete Jimenez cv->name);
1888f5b1c8a1SJohn Marino goto err;
1889f5b1c8a1SJohn Marino }
1890f5b1c8a1SJohn Marino last2 = -1;
1891f5b1c8a1SJohn Marino
1892f5b1c8a1SJohn Marino again2:
1893*de0e0e4dSAntonio Huete Jimenez j = X509_NAME_get_index_by_OBJ(CAname, obj,
1894*de0e0e4dSAntonio Huete Jimenez last2);
1895f5b1c8a1SJohn Marino if ((j < 0) && (last2 == -1)) {
1896*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1897*de0e0e4dSAntonio Huete Jimenez "The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",
1898*de0e0e4dSAntonio Huete Jimenez cv->name);
1899f5b1c8a1SJohn Marino goto err;
1900f5b1c8a1SJohn Marino }
1901f5b1c8a1SJohn Marino if (j >= 0) {
1902f5b1c8a1SJohn Marino push = X509_NAME_get_entry(CAname, j);
1903*de0e0e4dSAntonio Huete Jimenez if (push == NULL)
1904*de0e0e4dSAntonio Huete Jimenez goto err;
1905f5b1c8a1SJohn Marino str = X509_NAME_ENTRY_get_data(tne);
1906*de0e0e4dSAntonio Huete Jimenez if (str == NULL)
1907*de0e0e4dSAntonio Huete Jimenez goto err;
1908f5b1c8a1SJohn Marino str2 = X509_NAME_ENTRY_get_data(push);
1909*de0e0e4dSAntonio Huete Jimenez if (str2 == NULL)
1910*de0e0e4dSAntonio Huete Jimenez goto err;
1911f5b1c8a1SJohn Marino last2 = j;
1912f5b1c8a1SJohn Marino if (ASN1_STRING_cmp(str, str2) != 0)
1913f5b1c8a1SJohn Marino goto again2;
1914f5b1c8a1SJohn Marino }
1915f5b1c8a1SJohn Marino if (j < 0) {
1916*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1917*de0e0e4dSAntonio Huete Jimenez "The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",
1918*de0e0e4dSAntonio Huete Jimenez cv->name, ((str2 == NULL) ?
1919*de0e0e4dSAntonio Huete Jimenez "NULL" : (char *) str2->data),
1920*de0e0e4dSAntonio Huete Jimenez ((str == NULL) ?
1921*de0e0e4dSAntonio Huete Jimenez "NULL" : (char *) str->data));
1922f5b1c8a1SJohn Marino goto err;
1923f5b1c8a1SJohn Marino }
1924f5b1c8a1SJohn Marino } else {
1925*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1926*de0e0e4dSAntonio Huete Jimenez "%s:invalid type in 'policy' configuration\n",
1927*de0e0e4dSAntonio Huete Jimenez cv->value);
1928f5b1c8a1SJohn Marino goto err;
1929f5b1c8a1SJohn Marino }
1930f5b1c8a1SJohn Marino
1931f5b1c8a1SJohn Marino if (push != NULL) {
1932f5b1c8a1SJohn Marino if (!X509_NAME_add_entry(subject, push,
1933f5b1c8a1SJohn Marino -1, 0)) {
1934f5b1c8a1SJohn Marino X509_NAME_ENTRY_free(push);
1935f5b1c8a1SJohn Marino BIO_printf(bio_err,
1936f5b1c8a1SJohn Marino "Memory allocation failure\n");
1937f5b1c8a1SJohn Marino goto err;
1938f5b1c8a1SJohn Marino }
1939f5b1c8a1SJohn Marino }
1940f5b1c8a1SJohn Marino if (j < 0)
1941f5b1c8a1SJohn Marino break;
1942f5b1c8a1SJohn Marino }
1943f5b1c8a1SJohn Marino }
1944f5b1c8a1SJohn Marino
1945*de0e0e4dSAntonio Huete Jimenez if (ca_config.preserve) {
1946f5b1c8a1SJohn Marino X509_NAME_free(subject);
1947f5b1c8a1SJohn Marino /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
1948f5b1c8a1SJohn Marino subject = X509_NAME_dup(name);
1949f5b1c8a1SJohn Marino if (subject == NULL)
1950f5b1c8a1SJohn Marino goto err;
1951f5b1c8a1SJohn Marino }
1952*de0e0e4dSAntonio Huete Jimenez
1953*de0e0e4dSAntonio Huete Jimenez /* We are now totally happy, lets make and sign the certificate */
1954f5b1c8a1SJohn Marino if (verbose)
1955*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
1956*de0e0e4dSAntonio Huete Jimenez "Everything appears to be ok, creating and signing the certificate\n");
1957*de0e0e4dSAntonio Huete Jimenez
1958*de0e0e4dSAntonio Huete Jimenez if ((ret = X509_new()) == NULL)
1959*de0e0e4dSAntonio Huete Jimenez goto err;
1960*de0e0e4dSAntonio Huete Jimenez
1961*de0e0e4dSAntonio Huete Jimenez #ifdef X509_V3
1962*de0e0e4dSAntonio Huete Jimenez /* Make it an X509 v3 certificate. */
1963*de0e0e4dSAntonio Huete Jimenez if (!X509_set_version(ret, 2))
1964*de0e0e4dSAntonio Huete Jimenez goto err;
1965*de0e0e4dSAntonio Huete Jimenez #endif
1966*de0e0e4dSAntonio Huete Jimenez if (X509_get_serialNumber(ret) == NULL)
1967*de0e0e4dSAntonio Huete Jimenez goto err;
1968*de0e0e4dSAntonio Huete Jimenez if (BN_to_ASN1_INTEGER(serial, X509_get_serialNumber(ret)) == NULL)
1969*de0e0e4dSAntonio Huete Jimenez goto err;
1970*de0e0e4dSAntonio Huete Jimenez if (selfsign) {
1971*de0e0e4dSAntonio Huete Jimenez if (!X509_set_issuer_name(ret, subject))
1972*de0e0e4dSAntonio Huete Jimenez goto err;
1973*de0e0e4dSAntonio Huete Jimenez } else {
1974*de0e0e4dSAntonio Huete Jimenez if (!X509_set_issuer_name(ret, X509_get_subject_name(x509)))
1975*de0e0e4dSAntonio Huete Jimenez goto err;
1976*de0e0e4dSAntonio Huete Jimenez }
1977*de0e0e4dSAntonio Huete Jimenez
1978*de0e0e4dSAntonio Huete Jimenez if (strcmp(startdate, "today") == 0) {
1979*de0e0e4dSAntonio Huete Jimenez if (X509_gmtime_adj(X509_get_notBefore(ret), 0) == NULL)
1980*de0e0e4dSAntonio Huete Jimenez goto err;
1981*de0e0e4dSAntonio Huete Jimenez } else if (setCertificateTime(X509_get_notBefore(ret), startdate) == -1) {
1982*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err, "Invalid start date %s\n", startdate);
1983*de0e0e4dSAntonio Huete Jimenez goto err;
1984*de0e0e4dSAntonio Huete Jimenez }
1985*de0e0e4dSAntonio Huete Jimenez
1986*de0e0e4dSAntonio Huete Jimenez if (enddate == NULL) {
1987*de0e0e4dSAntonio Huete Jimenez if (X509_time_adj_ex(X509_get_notAfter(ret), days, 0,
1988*de0e0e4dSAntonio Huete Jimenez NULL) == NULL)
1989*de0e0e4dSAntonio Huete Jimenez goto err;
1990*de0e0e4dSAntonio Huete Jimenez } else if (setCertificateTime(X509_get_notAfter(ret), enddate) == -1) {
1991*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err, "Invalid end date %s\n", enddate);
1992*de0e0e4dSAntonio Huete Jimenez goto err;
1993*de0e0e4dSAntonio Huete Jimenez }
1994*de0e0e4dSAntonio Huete Jimenez
1995*de0e0e4dSAntonio Huete Jimenez if (!X509_set_subject_name(ret, subject))
1996*de0e0e4dSAntonio Huete Jimenez goto err;
1997*de0e0e4dSAntonio Huete Jimenez
1998*de0e0e4dSAntonio Huete Jimenez if ((pktmp = X509_REQ_get0_pubkey(req)) == NULL)
1999*de0e0e4dSAntonio Huete Jimenez goto err;
2000*de0e0e4dSAntonio Huete Jimenez
2001*de0e0e4dSAntonio Huete Jimenez if (!X509_set_pubkey(ret, pktmp))
2002*de0e0e4dSAntonio Huete Jimenez goto err;
2003*de0e0e4dSAntonio Huete Jimenez
2004*de0e0e4dSAntonio Huete Jimenez /* Lets add the extensions, if there are any */
2005*de0e0e4dSAntonio Huete Jimenez if (ext_sect != NULL) {
2006*de0e0e4dSAntonio Huete Jimenez X509V3_CTX ctx;
2007*de0e0e4dSAntonio Huete Jimenez
2008*de0e0e4dSAntonio Huete Jimenez /* Initialize the context structure */
2009*de0e0e4dSAntonio Huete Jimenez if (selfsign)
2010*de0e0e4dSAntonio Huete Jimenez X509V3_set_ctx(&ctx, ret, ret, req, NULL, 0);
2011*de0e0e4dSAntonio Huete Jimenez else
2012*de0e0e4dSAntonio Huete Jimenez X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
2013*de0e0e4dSAntonio Huete Jimenez
2014*de0e0e4dSAntonio Huete Jimenez if (extconf != NULL) {
2015*de0e0e4dSAntonio Huete Jimenez if (verbose)
2016*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
2017*de0e0e4dSAntonio Huete Jimenez "Extra configuration file found\n");
2018*de0e0e4dSAntonio Huete Jimenez
2019*de0e0e4dSAntonio Huete Jimenez /* Use the extconf configuration db LHASH */
2020*de0e0e4dSAntonio Huete Jimenez X509V3_set_nconf(&ctx, extconf);
2021*de0e0e4dSAntonio Huete Jimenez
2022*de0e0e4dSAntonio Huete Jimenez /* Test the structure (needed?) */
2023*de0e0e4dSAntonio Huete Jimenez /* X509V3_set_ctx_test(&ctx); */
2024*de0e0e4dSAntonio Huete Jimenez
2025*de0e0e4dSAntonio Huete Jimenez /* Adds exts contained in the configuration file */
2026*de0e0e4dSAntonio Huete Jimenez if (!X509V3_EXT_add_nconf(extconf, &ctx,
2027*de0e0e4dSAntonio Huete Jimenez ext_sect, ret)) {
2028*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
2029*de0e0e4dSAntonio Huete Jimenez "ERROR: adding extensions in section %s\n",
2030*de0e0e4dSAntonio Huete Jimenez ext_sect);
2031*de0e0e4dSAntonio Huete Jimenez ERR_print_errors(bio_err);
2032*de0e0e4dSAntonio Huete Jimenez goto err;
2033*de0e0e4dSAntonio Huete Jimenez }
2034*de0e0e4dSAntonio Huete Jimenez if (verbose)
2035*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
2036*de0e0e4dSAntonio Huete Jimenez "Successfully added extensions from file.\n");
2037*de0e0e4dSAntonio Huete Jimenez } else if (ext_sect != NULL) {
2038*de0e0e4dSAntonio Huete Jimenez /* We found extensions to be set from config file */
2039*de0e0e4dSAntonio Huete Jimenez X509V3_set_nconf(&ctx, lconf);
2040*de0e0e4dSAntonio Huete Jimenez
2041*de0e0e4dSAntonio Huete Jimenez if (!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret)) {
2042*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
2043*de0e0e4dSAntonio Huete Jimenez "ERROR: adding extensions in section %s\n",
2044*de0e0e4dSAntonio Huete Jimenez ext_sect);
2045*de0e0e4dSAntonio Huete Jimenez ERR_print_errors(bio_err);
2046*de0e0e4dSAntonio Huete Jimenez goto err;
2047*de0e0e4dSAntonio Huete Jimenez }
2048*de0e0e4dSAntonio Huete Jimenez if (verbose)
2049*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
2050*de0e0e4dSAntonio Huete Jimenez "Successfully added extensions from config\n");
2051*de0e0e4dSAntonio Huete Jimenez }
2052*de0e0e4dSAntonio Huete Jimenez }
2053*de0e0e4dSAntonio Huete Jimenez
2054*de0e0e4dSAntonio Huete Jimenez /* Copy extensions from request (if any) */
2055*de0e0e4dSAntonio Huete Jimenez if (!copy_extensions(ret, req, ext_copy)) {
2056*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err, "ERROR: adding extensions from request\n");
2057*de0e0e4dSAntonio Huete Jimenez ERR_print_errors(bio_err);
2058*de0e0e4dSAntonio Huete Jimenez goto err;
2059*de0e0e4dSAntonio Huete Jimenez }
2060*de0e0e4dSAntonio Huete Jimenez
2061*de0e0e4dSAntonio Huete Jimenez exts = X509_get0_extensions(ret);
2062*de0e0e4dSAntonio Huete Jimenez if (exts != NULL && sk_X509_EXTENSION_num(exts) > 0) {
2063*de0e0e4dSAntonio Huete Jimenez /* Make it an X509 v3 certificate. */
2064*de0e0e4dSAntonio Huete Jimenez if (!X509_set_version(ret, 2))
2065*de0e0e4dSAntonio Huete Jimenez goto err;
2066*de0e0e4dSAntonio Huete Jimenez }
2067*de0e0e4dSAntonio Huete Jimenez
2068*de0e0e4dSAntonio Huete Jimenez if (verbose)
2069*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
2070*de0e0e4dSAntonio Huete Jimenez "The subject name appears to be ok, checking data base for clashes\n");
2071f5b1c8a1SJohn Marino
2072f5b1c8a1SJohn Marino /* Build the correct Subject if no email is wanted in the subject */
2073*de0e0e4dSAntonio Huete Jimenez if (!email_dn) {
2074f5b1c8a1SJohn Marino X509_NAME_ENTRY *tmpne;
2075f5b1c8a1SJohn Marino /*
2076f5b1c8a1SJohn Marino * Its best to dup the subject DN and then delete any email
2077f5b1c8a1SJohn Marino * addresses because this retains its structure.
2078f5b1c8a1SJohn Marino */
2079*de0e0e4dSAntonio Huete Jimenez if ((dn_subject = X509_NAME_dup(subject)) == NULL) {
2080f5b1c8a1SJohn Marino BIO_printf(bio_err, "Memory allocation failure\n");
2081f5b1c8a1SJohn Marino goto err;
2082f5b1c8a1SJohn Marino }
2083f5b1c8a1SJohn Marino while ((i = X509_NAME_get_index_by_NID(dn_subject,
2084f5b1c8a1SJohn Marino NID_pkcs9_emailAddress, -1)) >= 0) {
2085f5b1c8a1SJohn Marino tmpne = X509_NAME_get_entry(dn_subject, i);
2086*de0e0e4dSAntonio Huete Jimenez if (tmpne == NULL)
2087*de0e0e4dSAntonio Huete Jimenez goto err;
2088*de0e0e4dSAntonio Huete Jimenez if (X509_NAME_delete_entry(dn_subject, i) == NULL) {
2089*de0e0e4dSAntonio Huete Jimenez X509_NAME_ENTRY_free(tmpne);
2090*de0e0e4dSAntonio Huete Jimenez goto err;
2091*de0e0e4dSAntonio Huete Jimenez }
2092f5b1c8a1SJohn Marino X509_NAME_ENTRY_free(tmpne);
2093f5b1c8a1SJohn Marino }
2094*de0e0e4dSAntonio Huete Jimenez
2095*de0e0e4dSAntonio Huete Jimenez if (!X509_set_subject_name(ret, dn_subject))
2096*de0e0e4dSAntonio Huete Jimenez goto err;
2097*de0e0e4dSAntonio Huete Jimenez
2098*de0e0e4dSAntonio Huete Jimenez X509_NAME_free(dn_subject);
2099*de0e0e4dSAntonio Huete Jimenez dn_subject = NULL;
2100*de0e0e4dSAntonio Huete Jimenez }
2101*de0e0e4dSAntonio Huete Jimenez
2102*de0e0e4dSAntonio Huete Jimenez row[DB_name] = X509_NAME_oneline(X509_get_subject_name(ret), NULL, 0);
2103*de0e0e4dSAntonio Huete Jimenez if (row[DB_name] == NULL) {
2104*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err, "Memory allocation failure\n");
2105*de0e0e4dSAntonio Huete Jimenez goto err;
2106f5b1c8a1SJohn Marino }
2107f5b1c8a1SJohn Marino
2108f5b1c8a1SJohn Marino if (BN_is_zero(serial))
2109f5b1c8a1SJohn Marino row[DB_serial] = strdup("00");
2110f5b1c8a1SJohn Marino else
2111f5b1c8a1SJohn Marino row[DB_serial] = BN_bn2hex(serial);
2112f5b1c8a1SJohn Marino if (row[DB_serial] == NULL) {
2113f5b1c8a1SJohn Marino BIO_printf(bio_err, "Memory allocation failure\n");
2114f5b1c8a1SJohn Marino goto err;
2115f5b1c8a1SJohn Marino }
2116*de0e0e4dSAntonio Huete Jimenez
2117*de0e0e4dSAntonio Huete Jimenez if (row[DB_name][0] == '\0') {
2118*de0e0e4dSAntonio Huete Jimenez /*
2119*de0e0e4dSAntonio Huete Jimenez * An empty subject! We'll use the serial number instead. If
2120*de0e0e4dSAntonio Huete Jimenez * unique_subject is in use then we don't want different
2121*de0e0e4dSAntonio Huete Jimenez * entries with empty subjects matching each other.
2122*de0e0e4dSAntonio Huete Jimenez */
2123*de0e0e4dSAntonio Huete Jimenez free(row[DB_name]);
2124*de0e0e4dSAntonio Huete Jimenez row[DB_name] = strdup(row[DB_serial]);
2125*de0e0e4dSAntonio Huete Jimenez if (row[DB_name] == NULL) {
2126*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err, "Memory allocation failure\n");
2127*de0e0e4dSAntonio Huete Jimenez goto err;
2128*de0e0e4dSAntonio Huete Jimenez }
2129*de0e0e4dSAntonio Huete Jimenez }
2130*de0e0e4dSAntonio Huete Jimenez
2131f5b1c8a1SJohn Marino if (db->attributes.unique_subject) {
2132f5b1c8a1SJohn Marino OPENSSL_STRING *crow = row;
2133f5b1c8a1SJohn Marino
2134f5b1c8a1SJohn Marino rrow = TXT_DB_get_by_index(db->db, DB_name, crow);
2135f5b1c8a1SJohn Marino if (rrow != NULL) {
2136f5b1c8a1SJohn Marino BIO_printf(bio_err,
2137f5b1c8a1SJohn Marino "ERROR:There is already a certificate for %s\n",
2138f5b1c8a1SJohn Marino row[DB_name]);
2139f5b1c8a1SJohn Marino }
2140f5b1c8a1SJohn Marino }
2141f5b1c8a1SJohn Marino if (rrow == NULL) {
2142f5b1c8a1SJohn Marino rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
2143f5b1c8a1SJohn Marino if (rrow != NULL) {
2144f5b1c8a1SJohn Marino BIO_printf(bio_err,
2145f5b1c8a1SJohn Marino "ERROR:Serial number %s has already been issued,\n",
2146f5b1c8a1SJohn Marino row[DB_serial]);
2147*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
2148*de0e0e4dSAntonio Huete Jimenez " check the database/serial_file for corruption\n");
2149f5b1c8a1SJohn Marino }
2150f5b1c8a1SJohn Marino }
2151f5b1c8a1SJohn Marino if (rrow != NULL) {
2152f5b1c8a1SJohn Marino BIO_printf(bio_err,
2153f5b1c8a1SJohn Marino "The matching entry has the following details\n");
2154*de0e0e4dSAntonio Huete Jimenez if (rrow[DB_type][0] == DB_TYPE_EXP)
2155f5b1c8a1SJohn Marino p = "Expired";
2156*de0e0e4dSAntonio Huete Jimenez else if (rrow[DB_type][0] == DB_TYPE_REV)
2157f5b1c8a1SJohn Marino p = "Revoked";
2158*de0e0e4dSAntonio Huete Jimenez else if (rrow[DB_type][0] == DB_TYPE_VAL)
2159f5b1c8a1SJohn Marino p = "Valid";
2160f5b1c8a1SJohn Marino else
2161f5b1c8a1SJohn Marino p = "\ninvalid type, Data base error\n";
2162f5b1c8a1SJohn Marino BIO_printf(bio_err, "Type :%s\n", p);
2163*de0e0e4dSAntonio Huete Jimenez if (rrow[DB_type][0] == DB_TYPE_REV) {
2164f5b1c8a1SJohn Marino p = rrow[DB_exp_date];
2165f5b1c8a1SJohn Marino if (p == NULL)
2166f5b1c8a1SJohn Marino p = "undef";
2167f5b1c8a1SJohn Marino BIO_printf(bio_err, "Was revoked on:%s\n", p);
2168f5b1c8a1SJohn Marino }
2169f5b1c8a1SJohn Marino p = rrow[DB_exp_date];
2170f5b1c8a1SJohn Marino if (p == NULL)
2171f5b1c8a1SJohn Marino p = "undef";
2172f5b1c8a1SJohn Marino BIO_printf(bio_err, "Expires on :%s\n", p);
2173f5b1c8a1SJohn Marino p = rrow[DB_serial];
2174f5b1c8a1SJohn Marino if (p == NULL)
2175f5b1c8a1SJohn Marino p = "undef";
2176f5b1c8a1SJohn Marino BIO_printf(bio_err, "Serial Number :%s\n", p);
2177f5b1c8a1SJohn Marino p = rrow[DB_file];
2178f5b1c8a1SJohn Marino if (p == NULL)
2179f5b1c8a1SJohn Marino p = "undef";
2180f5b1c8a1SJohn Marino BIO_printf(bio_err, "File name :%s\n", p);
2181f5b1c8a1SJohn Marino p = rrow[DB_name];
2182f5b1c8a1SJohn Marino if (p == NULL)
2183f5b1c8a1SJohn Marino p = "undef";
2184f5b1c8a1SJohn Marino BIO_printf(bio_err, "Subject Name :%s\n", p);
2185f5b1c8a1SJohn Marino ok = -1; /* This is now a 'bad' error. */
2186f5b1c8a1SJohn Marino goto err;
2187f5b1c8a1SJohn Marino }
2188f5b1c8a1SJohn Marino
2189f5b1c8a1SJohn Marino if (!default_op) {
2190f5b1c8a1SJohn Marino BIO_printf(bio_err, "Certificate Details:\n");
2191f5b1c8a1SJohn Marino /*
2192f5b1c8a1SJohn Marino * Never print signature details because signature not
2193f5b1c8a1SJohn Marino * present
2194f5b1c8a1SJohn Marino */
2195f5b1c8a1SJohn Marino certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
2196*de0e0e4dSAntonio Huete Jimenez if (!X509_print_ex(bio_err, ret, nameopt, certopt))
2197*de0e0e4dSAntonio Huete Jimenez goto err;
2198f5b1c8a1SJohn Marino }
2199f5b1c8a1SJohn Marino BIO_printf(bio_err, "Certificate is to be certified until ");
2200f5b1c8a1SJohn Marino ASN1_TIME_print(bio_err, X509_get_notAfter(ret));
2201f5b1c8a1SJohn Marino if (days)
2202f5b1c8a1SJohn Marino BIO_printf(bio_err, " (%ld days)", days);
2203f5b1c8a1SJohn Marino BIO_printf(bio_err, "\n");
2204f5b1c8a1SJohn Marino
2205f5b1c8a1SJohn Marino if (!batch) {
220672c33676SMaxim Ag char answer[25];
2207f5b1c8a1SJohn Marino
2208f5b1c8a1SJohn Marino BIO_printf(bio_err, "Sign the certificate? [y/n]:");
2209f5b1c8a1SJohn Marino (void) BIO_flush(bio_err);
221072c33676SMaxim Ag if (!fgets(answer, sizeof(answer) - 1, stdin)) {
2211f5b1c8a1SJohn Marino BIO_printf(bio_err,
2212f5b1c8a1SJohn Marino "CERTIFICATE WILL NOT BE CERTIFIED: I/O error\n");
2213f5b1c8a1SJohn Marino ok = 0;
2214f5b1c8a1SJohn Marino goto err;
2215f5b1c8a1SJohn Marino }
221672c33676SMaxim Ag if (!((answer[0] == 'y') || (answer[0] == 'Y'))) {
2217f5b1c8a1SJohn Marino BIO_printf(bio_err,
2218f5b1c8a1SJohn Marino "CERTIFICATE WILL NOT BE CERTIFIED\n");
2219f5b1c8a1SJohn Marino ok = 0;
2220f5b1c8a1SJohn Marino goto err;
2221f5b1c8a1SJohn Marino }
2222f5b1c8a1SJohn Marino }
2223*de0e0e4dSAntonio Huete Jimenez
2224*de0e0e4dSAntonio Huete Jimenez if ((pktmp = X509_get0_pubkey(ret)) == NULL)
2225*de0e0e4dSAntonio Huete Jimenez goto err;
2226*de0e0e4dSAntonio Huete Jimenez
2227f5b1c8a1SJohn Marino if (EVP_PKEY_missing_parameters(pktmp) &&
2228*de0e0e4dSAntonio Huete Jimenez !EVP_PKEY_missing_parameters(pkey)) {
2229*de0e0e4dSAntonio Huete Jimenez if (!EVP_PKEY_copy_parameters(pktmp, pkey)) {
2230*de0e0e4dSAntonio Huete Jimenez goto err;
2231*de0e0e4dSAntonio Huete Jimenez }
2232*de0e0e4dSAntonio Huete Jimenez }
2233f5b1c8a1SJohn Marino
2234f5b1c8a1SJohn Marino if (!do_X509_sign(bio_err, ret, pkey, dgst, sigopts))
2235f5b1c8a1SJohn Marino goto err;
2236f5b1c8a1SJohn Marino
2237f5b1c8a1SJohn Marino /* We now just add it to the database */
2238f5b1c8a1SJohn Marino row[DB_type] = malloc(2);
2239f5b1c8a1SJohn Marino
2240*de0e0e4dSAntonio Huete Jimenez if ((tm = X509_get_notAfter(ret)) == NULL)
2241*de0e0e4dSAntonio Huete Jimenez goto err;
2242*de0e0e4dSAntonio Huete Jimenez row[DB_exp_date] = strndup(tm->data, tm->length);
2243f5b1c8a1SJohn Marino if (row[DB_type] == NULL || row[DB_exp_date] == NULL) {
2244f5b1c8a1SJohn Marino BIO_printf(bio_err, "Memory allocation failure\n");
2245f5b1c8a1SJohn Marino goto err;
2246f5b1c8a1SJohn Marino }
2247f5b1c8a1SJohn Marino
2248f5b1c8a1SJohn Marino row[DB_rev_date] = NULL;
2249f5b1c8a1SJohn Marino
2250f5b1c8a1SJohn Marino /* row[DB_serial] done already */
2251f5b1c8a1SJohn Marino row[DB_file] = malloc(8);
2252f5b1c8a1SJohn Marino
2253f5b1c8a1SJohn Marino if ((row[DB_type] == NULL) || (row[DB_file] == NULL) ||
2254f5b1c8a1SJohn Marino (row[DB_name] == NULL)) {
2255f5b1c8a1SJohn Marino BIO_printf(bio_err, "Memory allocation failure\n");
2256f5b1c8a1SJohn Marino goto err;
2257f5b1c8a1SJohn Marino }
2258f5b1c8a1SJohn Marino (void) strlcpy(row[DB_file], "unknown", 8);
2259*de0e0e4dSAntonio Huete Jimenez row[DB_type][0] = DB_TYPE_VAL;
2260f5b1c8a1SJohn Marino row[DB_type][1] = '\0';
2261f5b1c8a1SJohn Marino
2262f5b1c8a1SJohn Marino if ((irow = reallocarray(NULL, DB_NUMBER + 1, sizeof(char *))) ==
2263f5b1c8a1SJohn Marino NULL) {
2264f5b1c8a1SJohn Marino BIO_printf(bio_err, "Memory allocation failure\n");
2265f5b1c8a1SJohn Marino goto err;
2266f5b1c8a1SJohn Marino }
2267f5b1c8a1SJohn Marino for (i = 0; i < DB_NUMBER; i++) {
2268f5b1c8a1SJohn Marino irow[i] = row[i];
2269f5b1c8a1SJohn Marino row[i] = NULL;
2270f5b1c8a1SJohn Marino }
2271f5b1c8a1SJohn Marino irow[DB_NUMBER] = NULL;
2272f5b1c8a1SJohn Marino
2273f5b1c8a1SJohn Marino if (!TXT_DB_insert(db->db, irow)) {
2274f5b1c8a1SJohn Marino BIO_printf(bio_err, "failed to update database\n");
2275f5b1c8a1SJohn Marino BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);
2276f5b1c8a1SJohn Marino goto err;
2277f5b1c8a1SJohn Marino }
2278*de0e0e4dSAntonio Huete Jimenez
2279*de0e0e4dSAntonio Huete Jimenez *xret = ret;
2280*de0e0e4dSAntonio Huete Jimenez ret = NULL;
2281f5b1c8a1SJohn Marino ok = 1;
2282*de0e0e4dSAntonio Huete Jimenez
2283f5b1c8a1SJohn Marino err:
2284f5b1c8a1SJohn Marino for (i = 0; i < DB_NUMBER; i++)
2285f5b1c8a1SJohn Marino free(row[i]);
2286f5b1c8a1SJohn Marino
2287f5b1c8a1SJohn Marino X509_NAME_free(CAname);
2288f5b1c8a1SJohn Marino X509_NAME_free(subject);
2289f5b1c8a1SJohn Marino X509_NAME_free(dn_subject);
2290f5b1c8a1SJohn Marino X509_free(ret);
2291*de0e0e4dSAntonio Huete Jimenez
2292f5b1c8a1SJohn Marino return (ok);
2293f5b1c8a1SJohn Marino }
2294f5b1c8a1SJohn Marino
2295*de0e0e4dSAntonio Huete Jimenez static int
write_new_certificate(BIO * bp,X509 * x,int output_der,int notext)2296f5b1c8a1SJohn Marino write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
2297f5b1c8a1SJohn Marino {
2298f5b1c8a1SJohn Marino if (output_der) {
2299*de0e0e4dSAntonio Huete Jimenez if (!i2d_X509_bio(bp, x))
2300*de0e0e4dSAntonio Huete Jimenez return (0);
2301f5b1c8a1SJohn Marino }
2302*de0e0e4dSAntonio Huete Jimenez if (!notext) {
2303*de0e0e4dSAntonio Huete Jimenez if (!X509_print(bp, x))
2304*de0e0e4dSAntonio Huete Jimenez return (0);
2305*de0e0e4dSAntonio Huete Jimenez }
2306*de0e0e4dSAntonio Huete Jimenez
2307*de0e0e4dSAntonio Huete Jimenez return PEM_write_bio_X509(bp, x);
2308f5b1c8a1SJohn Marino }
2309f5b1c8a1SJohn Marino
2310f5b1c8a1SJohn Marino static int
certify_spkac(X509 ** xret,char * infile,EVP_PKEY * pkey,X509 * x509,const EVP_MD * dgst,STACK_OF (OPENSSL_STRING)* sigopts,STACK_OF (CONF_VALUE)* policy,CA_DB * db,BIGNUM * serial,char * subj,unsigned long chtype,int multirdn,int email_dn,char * startdate,char * enddate,long days,char * ext_sect,CONF * lconf,int verbose,unsigned long certopt,unsigned long nameopt,int default_op,int ext_copy)2311f5b1c8a1SJohn Marino certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
2312f5b1c8a1SJohn Marino const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
2313f5b1c8a1SJohn Marino STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
2314f5b1c8a1SJohn Marino unsigned long chtype, int multirdn, int email_dn, char *startdate,
2315f5b1c8a1SJohn Marino char *enddate, long days, char *ext_sect, CONF *lconf, int verbose,
2316f5b1c8a1SJohn Marino unsigned long certopt, unsigned long nameopt, int default_op, int ext_copy)
2317f5b1c8a1SJohn Marino {
2318f5b1c8a1SJohn Marino STACK_OF(CONF_VALUE) *sk = NULL;
2319f5b1c8a1SJohn Marino LHASH_OF(CONF_VALUE) *parms = NULL;
2320f5b1c8a1SJohn Marino X509_REQ *req = NULL;
2321f5b1c8a1SJohn Marino CONF_VALUE *cv = NULL;
2322f5b1c8a1SJohn Marino NETSCAPE_SPKI *spki = NULL;
2323f5b1c8a1SJohn Marino char *type, *buf;
2324f5b1c8a1SJohn Marino EVP_PKEY *pktmp = NULL;
2325f5b1c8a1SJohn Marino X509_NAME *n = NULL;
2326f5b1c8a1SJohn Marino int ok = -1, i, j;
2327f5b1c8a1SJohn Marino long errline;
2328f5b1c8a1SJohn Marino int nid;
2329f5b1c8a1SJohn Marino
2330f5b1c8a1SJohn Marino /*
2331f5b1c8a1SJohn Marino * Load input file into a hash table. (This is just an easy
2332f5b1c8a1SJohn Marino * way to read and parse the file, then put it into a convenient
2333f5b1c8a1SJohn Marino * STACK format).
2334f5b1c8a1SJohn Marino */
2335f5b1c8a1SJohn Marino parms = CONF_load(NULL, infile, &errline);
2336f5b1c8a1SJohn Marino if (parms == NULL) {
2337f5b1c8a1SJohn Marino BIO_printf(bio_err, "error on line %ld of %s\n",
2338f5b1c8a1SJohn Marino errline, infile);
2339f5b1c8a1SJohn Marino ERR_print_errors(bio_err);
2340f5b1c8a1SJohn Marino goto err;
2341f5b1c8a1SJohn Marino }
2342f5b1c8a1SJohn Marino sk = CONF_get_section(parms, "default");
2343f5b1c8a1SJohn Marino if (sk_CONF_VALUE_num(sk) == 0) {
2344f5b1c8a1SJohn Marino BIO_printf(bio_err, "no name/value pairs found in %s\n",
2345f5b1c8a1SJohn Marino infile);
2346f5b1c8a1SJohn Marino CONF_free(parms);
2347f5b1c8a1SJohn Marino goto err;
2348f5b1c8a1SJohn Marino }
2349f5b1c8a1SJohn Marino /*
2350f5b1c8a1SJohn Marino * Now create a dummy X509 request structure. We don't actually
2351f5b1c8a1SJohn Marino * have an X509 request, but we have many of the components
2352f5b1c8a1SJohn Marino * (a public key, various DN components). The idea is that we
2353f5b1c8a1SJohn Marino * put these components into the right X509 request structure
2354f5b1c8a1SJohn Marino * and we can use the same code as if you had a real X509 request.
2355f5b1c8a1SJohn Marino */
2356f5b1c8a1SJohn Marino req = X509_REQ_new();
2357f5b1c8a1SJohn Marino if (req == NULL) {
2358f5b1c8a1SJohn Marino ERR_print_errors(bio_err);
2359f5b1c8a1SJohn Marino goto err;
2360f5b1c8a1SJohn Marino }
2361f5b1c8a1SJohn Marino /*
2362f5b1c8a1SJohn Marino * Build up the subject name set.
2363f5b1c8a1SJohn Marino */
2364*de0e0e4dSAntonio Huete Jimenez n = X509_REQ_get_subject_name(req);
2365f5b1c8a1SJohn Marino
2366f5b1c8a1SJohn Marino for (i = 0;; i++) {
2367f5b1c8a1SJohn Marino if (sk_CONF_VALUE_num(sk) <= i)
2368f5b1c8a1SJohn Marino break;
2369f5b1c8a1SJohn Marino
2370f5b1c8a1SJohn Marino cv = sk_CONF_VALUE_value(sk, i);
2371f5b1c8a1SJohn Marino type = cv->name;
2372f5b1c8a1SJohn Marino /*
2373f5b1c8a1SJohn Marino * Skip past any leading X. X: X, etc to allow for multiple
2374f5b1c8a1SJohn Marino * instances
2375f5b1c8a1SJohn Marino */
2376f5b1c8a1SJohn Marino for (buf = cv->name; *buf; buf++) {
2377f5b1c8a1SJohn Marino if ((*buf == ':') || (*buf == ',') || (*buf == '.')) {
2378f5b1c8a1SJohn Marino buf++;
2379f5b1c8a1SJohn Marino if (*buf)
2380f5b1c8a1SJohn Marino type = buf;
2381f5b1c8a1SJohn Marino break;
2382f5b1c8a1SJohn Marino }
2383f5b1c8a1SJohn Marino }
2384f5b1c8a1SJohn Marino
2385f5b1c8a1SJohn Marino buf = cv->value;
2386f5b1c8a1SJohn Marino if ((nid = OBJ_txt2nid(type)) == NID_undef) {
2387f5b1c8a1SJohn Marino if (strcmp(type, "SPKAC") == 0) {
2388f5b1c8a1SJohn Marino spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
2389f5b1c8a1SJohn Marino if (spki == NULL) {
2390*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err,
2391*de0e0e4dSAntonio Huete Jimenez "unable to load Netscape SPKAC structure\n");
2392f5b1c8a1SJohn Marino ERR_print_errors(bio_err);
2393f5b1c8a1SJohn Marino goto err;
2394f5b1c8a1SJohn Marino }
2395f5b1c8a1SJohn Marino }
2396f5b1c8a1SJohn Marino continue;
2397f5b1c8a1SJohn Marino }
2398f5b1c8a1SJohn Marino if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
2399f5b1c8a1SJohn Marino (unsigned char *)buf, -1, -1, 0))
2400f5b1c8a1SJohn Marino goto err;
2401f5b1c8a1SJohn Marino }
2402f5b1c8a1SJohn Marino if (spki == NULL) {
2403f5b1c8a1SJohn Marino BIO_printf(bio_err,
2404f5b1c8a1SJohn Marino "Netscape SPKAC structure not found in %s\n", infile);
2405f5b1c8a1SJohn Marino goto err;
2406f5b1c8a1SJohn Marino }
2407f5b1c8a1SJohn Marino /*
2408f5b1c8a1SJohn Marino * Now extract the key from the SPKI structure.
2409f5b1c8a1SJohn Marino */
2410f5b1c8a1SJohn Marino
2411f5b1c8a1SJohn Marino BIO_printf(bio_err,
2412f5b1c8a1SJohn Marino "Check that the SPKAC request matches the signature\n");
2413f5b1c8a1SJohn Marino
2414f5b1c8a1SJohn Marino if ((pktmp = NETSCAPE_SPKI_get_pubkey(spki)) == NULL) {
2415f5b1c8a1SJohn Marino BIO_printf(bio_err, "error unpacking SPKAC public key\n");
2416f5b1c8a1SJohn Marino goto err;
2417f5b1c8a1SJohn Marino }
2418f5b1c8a1SJohn Marino j = NETSCAPE_SPKI_verify(spki, pktmp);
2419f5b1c8a1SJohn Marino if (j <= 0) {
2420f5b1c8a1SJohn Marino BIO_printf(bio_err,
2421f5b1c8a1SJohn Marino "signature verification failed on SPKAC public key\n");
2422f5b1c8a1SJohn Marino goto err;
2423f5b1c8a1SJohn Marino }
2424f5b1c8a1SJohn Marino BIO_printf(bio_err, "Signature ok\n");
2425f5b1c8a1SJohn Marino
2426*de0e0e4dSAntonio Huete Jimenez if (!X509_REQ_set_pubkey(req, pktmp)) {
2427*de0e0e4dSAntonio Huete Jimenez EVP_PKEY_free(pktmp);
2428*de0e0e4dSAntonio Huete Jimenez goto err;
2429*de0e0e4dSAntonio Huete Jimenez }
2430f5b1c8a1SJohn Marino EVP_PKEY_free(pktmp);
2431f5b1c8a1SJohn Marino ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial,
2432f5b1c8a1SJohn Marino subj, chtype, multirdn, email_dn, startdate, enddate, days, 1,
2433f5b1c8a1SJohn Marino verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
2434f5b1c8a1SJohn Marino ext_copy, 0);
2435f5b1c8a1SJohn Marino
2436f5b1c8a1SJohn Marino err:
2437f5b1c8a1SJohn Marino X509_REQ_free(req);
2438f5b1c8a1SJohn Marino CONF_free(parms);
2439f5b1c8a1SJohn Marino NETSCAPE_SPKI_free(spki);
2440f5b1c8a1SJohn Marino
2441f5b1c8a1SJohn Marino return (ok);
2442f5b1c8a1SJohn Marino }
2443f5b1c8a1SJohn Marino
2444f5b1c8a1SJohn Marino static int
check_time_format(const char * str)2445f5b1c8a1SJohn Marino check_time_format(const char *str)
2446f5b1c8a1SJohn Marino {
2447f5b1c8a1SJohn Marino return ASN1_TIME_set_string(NULL, str);
2448f5b1c8a1SJohn Marino }
2449f5b1c8a1SJohn Marino
2450f5b1c8a1SJohn Marino static int
do_revoke(X509 * x509,CA_DB * db,int type,char * value)2451f5b1c8a1SJohn Marino do_revoke(X509 *x509, CA_DB *db, int type, char *value)
2452f5b1c8a1SJohn Marino {
2453f5b1c8a1SJohn Marino ASN1_UTCTIME *tm = NULL;
2454f5b1c8a1SJohn Marino char *row[DB_NUMBER], **rrow, **irow;
2455f5b1c8a1SJohn Marino char *rev_str = NULL;
2456f5b1c8a1SJohn Marino BIGNUM *bn = NULL;
2457f5b1c8a1SJohn Marino int ok = -1, i;
2458f5b1c8a1SJohn Marino
2459f5b1c8a1SJohn Marino for (i = 0; i < DB_NUMBER; i++)
2460f5b1c8a1SJohn Marino row[i] = NULL;
2461f5b1c8a1SJohn Marino row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);
2462f5b1c8a1SJohn Marino bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509), NULL);
2463*de0e0e4dSAntonio Huete Jimenez if (bn == NULL)
2464f5b1c8a1SJohn Marino goto err;
2465f5b1c8a1SJohn Marino if (BN_is_zero(bn))
2466f5b1c8a1SJohn Marino row[DB_serial] = strdup("00");
2467f5b1c8a1SJohn Marino else
2468f5b1c8a1SJohn Marino row[DB_serial] = BN_bn2hex(bn);
2469f5b1c8a1SJohn Marino BN_free(bn);
2470*de0e0e4dSAntonio Huete Jimenez
2471*de0e0e4dSAntonio Huete Jimenez if (row[DB_name] != NULL && row[DB_name][0] == '\0') {
2472*de0e0e4dSAntonio Huete Jimenez /*
2473*de0e0e4dSAntonio Huete Jimenez * Entries with empty Subjects actually use the serial number
2474*de0e0e4dSAntonio Huete Jimenez * instead
2475*de0e0e4dSAntonio Huete Jimenez */
2476*de0e0e4dSAntonio Huete Jimenez free(row[DB_name]);
2477*de0e0e4dSAntonio Huete Jimenez row[DB_name] = strdup(row[DB_serial]);
2478*de0e0e4dSAntonio Huete Jimenez if (row[DB_name] == NULL) {
2479*de0e0e4dSAntonio Huete Jimenez BIO_printf(bio_err, "Memory allocation failure\n");
2480*de0e0e4dSAntonio Huete Jimenez goto err;
2481*de0e0e4dSAntonio Huete Jimenez }
2482*de0e0e4dSAntonio Huete Jimenez }
2483*de0e0e4dSAntonio Huete Jimenez
2484f5b1c8a1SJohn Marino if ((row[DB_name] == NULL) || (row[DB_serial] == NULL)) {
2485f5b1c8a1SJohn Marino BIO_printf(bio_err, "Memory allocation failure\n");
2486f5b1c8a1SJohn Marino goto err;
2487f5b1c8a1SJohn Marino }
2488f5b1c8a1SJohn Marino /*
2489f5b1c8a1SJohn Marino * We have to lookup by serial number because name lookup skips
2490f5b1c8a1SJohn Marino * revoked certs
2491f5b1c8a1SJohn Marino */
2492f5b1c8a1SJohn Marino rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
2493f5b1c8a1SJohn Marino if (rrow == NULL) {
2494f5b1c8a1SJohn Marino BIO_printf(bio_err,
2495f5b1c8a1SJohn Marino "Adding Entry with serial number %s to DB for %s\n",
2496f5b1c8a1SJohn Marino row[DB_serial], row[DB_name]);
2497f5b1c8a1SJohn Marino
2498f5b1c8a1SJohn Marino /* We now just add it to the database */
2499f5b1c8a1SJohn Marino row[DB_type] = malloc(2);
2500f5b1c8a1SJohn Marino
2501*de0e0e4dSAntonio Huete Jimenez if ((tm = X509_get_notAfter(x509)) == NULL)
2502*de0e0e4dSAntonio Huete Jimenez goto err;
2503*de0e0e4dSAntonio Huete Jimenez row[DB_exp_date] = strndup(tm->data, tm->length);
2504f5b1c8a1SJohn Marino if (row[DB_type] == NULL || row[DB_exp_date] == NULL) {
2505f5b1c8a1SJohn Marino BIO_printf(bio_err, "Memory allocation failure\n");
2506f5b1c8a1SJohn Marino goto err;
2507f5b1c8a1SJohn Marino }
2508f5b1c8a1SJohn Marino
2509f5b1c8a1SJohn Marino row[DB_rev_date] = NULL;
2510f5b1c8a1SJohn Marino
2511f5b1c8a1SJohn Marino /* row[DB_serial] done already */
2512f5b1c8a1SJohn Marino row[DB_file] = malloc(8);
2513f5b1c8a1SJohn Marino
2514f5b1c8a1SJohn Marino /* row[DB_name] done already */
2515f5b1c8a1SJohn Marino
2516f5b1c8a1SJohn Marino if ((row[DB_type] == NULL) || (row[DB_file] == NULL)) {
2517f5b1c8a1SJohn Marino BIO_printf(bio_err, "Memory allocation failure\n");
2518f5b1c8a1SJohn Marino goto err;
2519f5b1c8a1SJohn Marino }
2520f5b1c8a1SJohn Marino (void) strlcpy(row[DB_file], "unknown", 8);
2521*de0e0e4dSAntonio Huete Jimenez row[DB_type][0] = DB_TYPE_VAL;
2522f5b1c8a1SJohn Marino row[DB_type][1] = '\0';
2523f5b1c8a1SJohn Marino
2524f5b1c8a1SJohn Marino if ((irow = reallocarray(NULL, sizeof(char *),
2525f5b1c8a1SJohn Marino (DB_NUMBER + 1))) == NULL) {
2526f5b1c8a1SJohn Marino BIO_printf(bio_err, "Memory allocation failure\n");
2527f5b1c8a1SJohn Marino goto err;
2528f5b1c8a1SJohn Marino }
2529f5b1c8a1SJohn Marino for (i = 0; i < DB_NUMBER; i++) {
2530f5b1c8a1SJohn Marino irow[i] = row[i];
2531f5b1c8a1SJohn Marino row[i] = NULL;
2532f5b1c8a1SJohn Marino }
2533f5b1c8a1SJohn Marino irow[DB_NUMBER] = NULL;
2534f5b1c8a1SJohn Marino
2535f5b1c8a1SJohn Marino if (!TXT_DB_insert(db->db, irow)) {
2536f5b1c8a1SJohn Marino BIO_printf(bio_err, "failed to update database\n");
2537f5b1c8a1SJohn Marino BIO_printf(bio_err, "TXT_DB error number %ld\n",
2538f5b1c8a1SJohn Marino db->db->error);
2539f5b1c8a1SJohn Marino goto err;
2540f5b1c8a1SJohn Marino }
2541f5b1c8a1SJohn Marino /* Revoke Certificate */
2542f5b1c8a1SJohn Marino ok = do_revoke(x509, db, type, value);
2543f5b1c8a1SJohn Marino
2544f5b1c8a1SJohn Marino goto err;
2545f5b1c8a1SJohn Marino
2546f5b1c8a1SJohn Marino } else if (index_name_cmp_noconst(row, rrow)) {
2547f5b1c8a1SJohn Marino BIO_printf(bio_err, "ERROR:name does not match %s\n",
2548f5b1c8a1SJohn Marino row[DB_name]);
2549f5b1c8a1SJohn Marino goto err;
2550*de0e0e4dSAntonio Huete Jimenez } else if (rrow[DB_type][0] == DB_TYPE_REV) {
2551f5b1c8a1SJohn Marino BIO_printf(bio_err, "ERROR:Already revoked, serial number %s\n",
2552f5b1c8a1SJohn Marino row[DB_serial]);
2553f5b1c8a1SJohn Marino goto err;
2554f5b1c8a1SJohn Marino } else {
2555f5b1c8a1SJohn Marino BIO_printf(bio_err, "Revoking Certificate %s.\n",
2556f5b1c8a1SJohn Marino rrow[DB_serial]);
2557f5b1c8a1SJohn Marino rev_str = make_revocation_str(type, value);
2558*de0e0e4dSAntonio Huete Jimenez if (rev_str == NULL) {
2559f5b1c8a1SJohn Marino BIO_printf(bio_err, "Error in revocation arguments\n");
2560f5b1c8a1SJohn Marino goto err;
2561f5b1c8a1SJohn Marino }
2562*de0e0e4dSAntonio Huete Jimenez rrow[DB_type][0] = DB_TYPE_REV;
2563f5b1c8a1SJohn Marino rrow[DB_type][1] = '\0';
2564f5b1c8a1SJohn Marino rrow[DB_rev_date] = rev_str;
2565f5b1c8a1SJohn Marino }
2566f5b1c8a1SJohn Marino ok = 1;
2567f5b1c8a1SJohn Marino
2568f5b1c8a1SJohn Marino err:
2569f5b1c8a1SJohn Marino for (i = 0; i < DB_NUMBER; i++)
2570f5b1c8a1SJohn Marino free(row[i]);
2571f5b1c8a1SJohn Marino
2572f5b1c8a1SJohn Marino return (ok);
2573f5b1c8a1SJohn Marino }
2574f5b1c8a1SJohn Marino
2575f5b1c8a1SJohn Marino static int
get_certificate_status(const char * serial,CA_DB * db)2576f5b1c8a1SJohn Marino get_certificate_status(const char *serial, CA_DB *db)
2577f5b1c8a1SJohn Marino {
2578f5b1c8a1SJohn Marino char *row[DB_NUMBER], **rrow;
2579f5b1c8a1SJohn Marino int ok = -1, i;
2580f5b1c8a1SJohn Marino
2581f5b1c8a1SJohn Marino /* Free Resources */
2582f5b1c8a1SJohn Marino for (i = 0; i < DB_NUMBER; i++)
2583f5b1c8a1SJohn Marino row[i] = NULL;
2584f5b1c8a1SJohn Marino
2585f5b1c8a1SJohn Marino /* Malloc needed char spaces */
2586f5b1c8a1SJohn Marino row[DB_serial] = malloc(strlen(serial) + 2);
2587f5b1c8a1SJohn Marino if (row[DB_serial] == NULL) {
2588f5b1c8a1SJohn Marino BIO_printf(bio_err, "Malloc failure\n");
2589f5b1c8a1SJohn Marino goto err;
2590f5b1c8a1SJohn Marino }
2591f5b1c8a1SJohn Marino if (strlen(serial) % 2) {
2592f5b1c8a1SJohn Marino /* Set the first char to 0 */ ;
2593f5b1c8a1SJohn Marino row[DB_serial][0] = '0';
2594f5b1c8a1SJohn Marino
2595f5b1c8a1SJohn Marino /* Copy String from serial to row[DB_serial] */
2596f5b1c8a1SJohn Marino memcpy(row[DB_serial] + 1, serial, strlen(serial));
2597f5b1c8a1SJohn Marino row[DB_serial][strlen(serial) + 1] = '\0';
2598f5b1c8a1SJohn Marino } else {
2599f5b1c8a1SJohn Marino /* Copy String from serial to row[DB_serial] */
2600f5b1c8a1SJohn Marino memcpy(row[DB_serial], serial, strlen(serial));
2601f5b1c8a1SJohn Marino row[DB_serial][strlen(serial)] = '\0';
2602f5b1c8a1SJohn Marino }
2603f5b1c8a1SJohn Marino
2604f5b1c8a1SJohn Marino /* Make it Upper Case */
2605f5b1c8a1SJohn Marino for (i = 0; row[DB_serial][i] != '\0'; i++)
2606f5b1c8a1SJohn Marino row[DB_serial][i] = toupper((unsigned char) row[DB_serial][i]);
2607f5b1c8a1SJohn Marino
2608f5b1c8a1SJohn Marino
2609f5b1c8a1SJohn Marino ok = 1;
2610f5b1c8a1SJohn Marino
2611f5b1c8a1SJohn Marino /* Search for the certificate */
2612f5b1c8a1SJohn Marino rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
2613f5b1c8a1SJohn Marino if (rrow == NULL) {
2614f5b1c8a1SJohn Marino BIO_printf(bio_err, "Serial %s not present in db.\n",
2615f5b1c8a1SJohn Marino row[DB_serial]);
2616f5b1c8a1SJohn Marino ok = -1;
2617f5b1c8a1SJohn Marino goto err;
2618*de0e0e4dSAntonio Huete Jimenez } else if (rrow[DB_type][0] == DB_TYPE_VAL) {
2619f5b1c8a1SJohn Marino BIO_printf(bio_err, "%s=Valid (%c)\n",
2620f5b1c8a1SJohn Marino row[DB_serial], rrow[DB_type][0]);
2621f5b1c8a1SJohn Marino goto err;
2622*de0e0e4dSAntonio Huete Jimenez } else if (rrow[DB_type][0] == DB_TYPE_REV) {
2623f5b1c8a1SJohn Marino BIO_printf(bio_err, "%s=Revoked (%c)\n",
2624f5b1c8a1SJohn Marino row[DB_serial], rrow[DB_type][0]);
2625f5b1c8a1SJohn Marino goto err;
2626*de0e0e4dSAntonio Huete Jimenez } else if (rrow[DB_type][0] == DB_TYPE_EXP) {
2627f5b1c8a1SJohn Marino BIO_printf(bio_err, "%s=Expired (%c)\n",
2628f5b1c8a1SJohn Marino row[DB_serial], rrow[DB_type][0]);
2629f5b1c8a1SJohn Marino goto err;
2630*de0e0e4dSAntonio Huete Jimenez } else if (rrow[DB_type][0] == DB_TYPE_SUSP) {
2631f5b1c8a1SJohn Marino BIO_printf(bio_err, "%s=Suspended (%c)\n",
2632f5b1c8a1SJohn Marino row[DB_serial], rrow[DB_type][0]);
2633f5b1c8a1SJohn Marino goto err;
2634f5b1c8a1SJohn Marino } else {
2635f5b1c8a1SJohn Marino BIO_printf(bio_err, "%s=Unknown (%c).\n",
2636f5b1c8a1SJohn Marino row[DB_serial], rrow[DB_type][0]);
2637f5b1c8a1SJohn Marino ok = -1;
2638f5b1c8a1SJohn Marino }
2639f5b1c8a1SJohn Marino
2640f5b1c8a1SJohn Marino err:
2641f5b1c8a1SJohn Marino for (i = 0; i < DB_NUMBER; i++)
2642f5b1c8a1SJohn Marino free(row[i]);
2643f5b1c8a1SJohn Marino
2644f5b1c8a1SJohn Marino return (ok);
2645f5b1c8a1SJohn Marino }
2646f5b1c8a1SJohn Marino
2647f5b1c8a1SJohn Marino static int
do_updatedb(CA_DB * db)2648f5b1c8a1SJohn Marino do_updatedb(CA_DB *db)
2649f5b1c8a1SJohn Marino {
2650f5b1c8a1SJohn Marino ASN1_UTCTIME *a_tm = NULL;
2651f5b1c8a1SJohn Marino int i, cnt = 0;
2652f5b1c8a1SJohn Marino int db_y2k, a_y2k; /* flags = 1 if y >= 2000 */
2653*de0e0e4dSAntonio Huete Jimenez char **rrow, *a_tm_s = NULL;
2654f5b1c8a1SJohn Marino
2655f5b1c8a1SJohn Marino a_tm = ASN1_UTCTIME_new();
2656*de0e0e4dSAntonio Huete Jimenez if (a_tm == NULL) {
2657*de0e0e4dSAntonio Huete Jimenez cnt = -1;
2658*de0e0e4dSAntonio Huete Jimenez goto err;
2659*de0e0e4dSAntonio Huete Jimenez }
2660f5b1c8a1SJohn Marino
2661f5b1c8a1SJohn Marino /* get actual time and make a string */
2662f5b1c8a1SJohn Marino a_tm = X509_gmtime_adj(a_tm, 0);
2663*de0e0e4dSAntonio Huete Jimenez if (a_tm == NULL) {
2664*de0e0e4dSAntonio Huete Jimenez cnt = -1;
2665*de0e0e4dSAntonio Huete Jimenez goto err;
2666*de0e0e4dSAntonio Huete Jimenez }
2667*de0e0e4dSAntonio Huete Jimenez a_tm_s = strndup(a_tm->data, a_tm->length);
2668f5b1c8a1SJohn Marino if (a_tm_s == NULL) {
2669f5b1c8a1SJohn Marino cnt = -1;
2670f5b1c8a1SJohn Marino goto err;
2671f5b1c8a1SJohn Marino }
2672f5b1c8a1SJohn Marino
2673f5b1c8a1SJohn Marino if (strncmp(a_tm_s, "49", 2) <= 0)
2674f5b1c8a1SJohn Marino a_y2k = 1;
2675f5b1c8a1SJohn Marino else
2676f5b1c8a1SJohn Marino a_y2k = 0;
2677f5b1c8a1SJohn Marino
2678f5b1c8a1SJohn Marino for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
2679f5b1c8a1SJohn Marino rrow = sk_OPENSSL_PSTRING_value(db->db->data, i);
2680f5b1c8a1SJohn Marino
2681*de0e0e4dSAntonio Huete Jimenez if (rrow[DB_type][0] == DB_TYPE_VAL) {
2682f5b1c8a1SJohn Marino /* ignore entries that are not valid */
2683f5b1c8a1SJohn Marino if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
2684f5b1c8a1SJohn Marino db_y2k = 1;
2685f5b1c8a1SJohn Marino else
2686f5b1c8a1SJohn Marino db_y2k = 0;
2687f5b1c8a1SJohn Marino
2688f5b1c8a1SJohn Marino if (db_y2k == a_y2k) {
2689f5b1c8a1SJohn Marino /* all on the same y2k side */
2690f5b1c8a1SJohn Marino if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0) {
2691*de0e0e4dSAntonio Huete Jimenez rrow[DB_type][0] = DB_TYPE_EXP;
2692f5b1c8a1SJohn Marino rrow[DB_type][1] = '\0';
2693f5b1c8a1SJohn Marino cnt++;
2694f5b1c8a1SJohn Marino
2695f5b1c8a1SJohn Marino BIO_printf(bio_err, "%s=Expired\n",
2696f5b1c8a1SJohn Marino rrow[DB_serial]);
2697f5b1c8a1SJohn Marino }
2698f5b1c8a1SJohn Marino } else if (db_y2k < a_y2k) {
2699*de0e0e4dSAntonio Huete Jimenez rrow[DB_type][0] = DB_TYPE_EXP;
2700f5b1c8a1SJohn Marino rrow[DB_type][1] = '\0';
2701f5b1c8a1SJohn Marino cnt++;
2702f5b1c8a1SJohn Marino
2703f5b1c8a1SJohn Marino BIO_printf(bio_err, "%s=Expired\n",
2704f5b1c8a1SJohn Marino rrow[DB_serial]);
2705f5b1c8a1SJohn Marino }
2706f5b1c8a1SJohn Marino }
2707f5b1c8a1SJohn Marino }
2708f5b1c8a1SJohn Marino
2709f5b1c8a1SJohn Marino err:
2710f5b1c8a1SJohn Marino ASN1_UTCTIME_free(a_tm);
2711f5b1c8a1SJohn Marino free(a_tm_s);
2712f5b1c8a1SJohn Marino
2713f5b1c8a1SJohn Marino return (cnt);
2714f5b1c8a1SJohn Marino }
2715f5b1c8a1SJohn Marino
2716f5b1c8a1SJohn Marino static const char *crl_reasons[] = {
2717f5b1c8a1SJohn Marino /* CRL reason strings */
2718f5b1c8a1SJohn Marino "unspecified",
2719f5b1c8a1SJohn Marino "keyCompromise",
2720f5b1c8a1SJohn Marino "CACompromise",
2721f5b1c8a1SJohn Marino "affiliationChanged",
2722f5b1c8a1SJohn Marino "superseded",
2723f5b1c8a1SJohn Marino "cessationOfOperation",
2724f5b1c8a1SJohn Marino "certificateHold",
2725f5b1c8a1SJohn Marino "removeFromCRL",
2726f5b1c8a1SJohn Marino /* Additional pseudo reasons */
2727f5b1c8a1SJohn Marino "holdInstruction",
2728f5b1c8a1SJohn Marino "keyTime",
2729f5b1c8a1SJohn Marino "CAkeyTime"
2730f5b1c8a1SJohn Marino };
2731f5b1c8a1SJohn Marino
2732f5b1c8a1SJohn Marino #define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
2733f5b1c8a1SJohn Marino
2734f5b1c8a1SJohn Marino /* Given revocation information convert to a DB string.
2735f5b1c8a1SJohn Marino * The format of the string is:
2736f5b1c8a1SJohn Marino * revtime[,reason,extra]. Where 'revtime' is the
2737f5b1c8a1SJohn Marino * revocation time (the current time). 'reason' is the
2738f5b1c8a1SJohn Marino * optional CRL reason and 'extra' is any additional
2739f5b1c8a1SJohn Marino * argument
2740f5b1c8a1SJohn Marino */
2741f5b1c8a1SJohn Marino
2742f5b1c8a1SJohn Marino char *
make_revocation_str(int rev_type,char * rev_arg)2743f5b1c8a1SJohn Marino make_revocation_str(int rev_type, char *rev_arg)
2744f5b1c8a1SJohn Marino {
2745f5b1c8a1SJohn Marino char *other = NULL, *str;
2746f5b1c8a1SJohn Marino const char *reason = NULL;
2747f5b1c8a1SJohn Marino ASN1_OBJECT *otmp;
2748f5b1c8a1SJohn Marino ASN1_UTCTIME *revtm = NULL;
2749f5b1c8a1SJohn Marino int i;
2750f5b1c8a1SJohn Marino switch (rev_type) {
2751f5b1c8a1SJohn Marino case REV_NONE:
2752f5b1c8a1SJohn Marino break;
2753f5b1c8a1SJohn Marino
2754f5b1c8a1SJohn Marino case REV_CRL_REASON:
2755f5b1c8a1SJohn Marino for (i = 0; i < 8; i++) {
2756*de0e0e4dSAntonio Huete Jimenez if (strcasecmp(rev_arg, crl_reasons[i]) == 0) {
2757f5b1c8a1SJohn Marino reason = crl_reasons[i];
2758f5b1c8a1SJohn Marino break;
2759f5b1c8a1SJohn Marino }
2760f5b1c8a1SJohn Marino }
2761f5b1c8a1SJohn Marino if (reason == NULL) {
2762f5b1c8a1SJohn Marino BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
2763f5b1c8a1SJohn Marino return NULL;
2764f5b1c8a1SJohn Marino }
2765f5b1c8a1SJohn Marino break;
2766f5b1c8a1SJohn Marino
2767f5b1c8a1SJohn Marino case REV_HOLD:
2768f5b1c8a1SJohn Marino /* Argument is an OID */
2769f5b1c8a1SJohn Marino otmp = OBJ_txt2obj(rev_arg, 0);
2770f5b1c8a1SJohn Marino ASN1_OBJECT_free(otmp);
2771f5b1c8a1SJohn Marino
2772f5b1c8a1SJohn Marino if (otmp == NULL) {
2773f5b1c8a1SJohn Marino BIO_printf(bio_err,
2774f5b1c8a1SJohn Marino "Invalid object identifier %s\n", rev_arg);
2775f5b1c8a1SJohn Marino return NULL;
2776f5b1c8a1SJohn Marino }
2777f5b1c8a1SJohn Marino reason = "holdInstruction";
2778f5b1c8a1SJohn Marino other = rev_arg;
2779f5b1c8a1SJohn Marino break;
2780f5b1c8a1SJohn Marino
2781f5b1c8a1SJohn Marino case REV_KEY_COMPROMISE:
2782f5b1c8a1SJohn Marino case REV_CA_COMPROMISE:
2783f5b1c8a1SJohn Marino /* Argument is the key compromise time */
2784f5b1c8a1SJohn Marino if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg)) {
2785f5b1c8a1SJohn Marino BIO_printf(bio_err,
2786f5b1c8a1SJohn Marino "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n",
2787f5b1c8a1SJohn Marino rev_arg);
2788f5b1c8a1SJohn Marino return NULL;
2789f5b1c8a1SJohn Marino }
2790f5b1c8a1SJohn Marino other = rev_arg;
2791f5b1c8a1SJohn Marino if (rev_type == REV_KEY_COMPROMISE)
2792f5b1c8a1SJohn Marino reason = "keyTime";
2793f5b1c8a1SJohn Marino else
2794f5b1c8a1SJohn Marino reason = "CAkeyTime";
2795f5b1c8a1SJohn Marino
2796f5b1c8a1SJohn Marino break;
2797f5b1c8a1SJohn Marino }
2798f5b1c8a1SJohn Marino
2799f5b1c8a1SJohn Marino revtm = X509_gmtime_adj(NULL, 0);
2800*de0e0e4dSAntonio Huete Jimenez if (revtm == NULL)
2801*de0e0e4dSAntonio Huete Jimenez return NULL;
2802*de0e0e4dSAntonio Huete Jimenez
2803f5b1c8a1SJohn Marino if (asprintf(&str, "%s%s%s%s%s", revtm->data,
2804f5b1c8a1SJohn Marino reason ? "," : "", reason ? reason : "",
2805f5b1c8a1SJohn Marino other ? "," : "", other ? other : "") == -1)
2806f5b1c8a1SJohn Marino str = NULL;
2807*de0e0e4dSAntonio Huete Jimenez
2808f5b1c8a1SJohn Marino ASN1_UTCTIME_free(revtm);
2809*de0e0e4dSAntonio Huete Jimenez
2810f5b1c8a1SJohn Marino return str;
2811f5b1c8a1SJohn Marino }
2812f5b1c8a1SJohn Marino
2813f5b1c8a1SJohn Marino /* Convert revocation field to X509_REVOKED entry
2814f5b1c8a1SJohn Marino * return code:
2815f5b1c8a1SJohn Marino * 0 error
2816f5b1c8a1SJohn Marino * 1 OK
2817f5b1c8a1SJohn Marino * 2 OK and some extensions added (i.e. V2 CRL)
2818f5b1c8a1SJohn Marino */
2819f5b1c8a1SJohn Marino
2820f5b1c8a1SJohn Marino int
make_revoked(X509_REVOKED * rev,const char * str)2821f5b1c8a1SJohn Marino make_revoked(X509_REVOKED *rev, const char *str)
2822f5b1c8a1SJohn Marino {
2823f5b1c8a1SJohn Marino char *tmp = NULL;
2824f5b1c8a1SJohn Marino int reason_code = -1;
2825f5b1c8a1SJohn Marino int i, ret = 0;
2826f5b1c8a1SJohn Marino ASN1_OBJECT *hold = NULL;
2827f5b1c8a1SJohn Marino ASN1_GENERALIZEDTIME *comp_time = NULL;
2828f5b1c8a1SJohn Marino ASN1_ENUMERATED *rtmp = NULL;
2829f5b1c8a1SJohn Marino
2830f5b1c8a1SJohn Marino ASN1_TIME *revDate = NULL;
2831f5b1c8a1SJohn Marino
2832f5b1c8a1SJohn Marino i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
2833f5b1c8a1SJohn Marino
2834f5b1c8a1SJohn Marino if (i == 0)
2835f5b1c8a1SJohn Marino goto err;
2836f5b1c8a1SJohn Marino
2837*de0e0e4dSAntonio Huete Jimenez if (rev != NULL && !X509_REVOKED_set_revocationDate(rev, revDate))
2838f5b1c8a1SJohn Marino goto err;
2839f5b1c8a1SJohn Marino
2840*de0e0e4dSAntonio Huete Jimenez if (rev != NULL && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)) {
2841f5b1c8a1SJohn Marino rtmp = ASN1_ENUMERATED_new();
2842*de0e0e4dSAntonio Huete Jimenez if (rtmp == NULL || !ASN1_ENUMERATED_set(rtmp, reason_code))
2843f5b1c8a1SJohn Marino goto err;
2844f5b1c8a1SJohn Marino if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
2845f5b1c8a1SJohn Marino goto err;
2846f5b1c8a1SJohn Marino }
2847*de0e0e4dSAntonio Huete Jimenez if (rev != NULL && comp_time != NULL) {
2848f5b1c8a1SJohn Marino if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date,
2849f5b1c8a1SJohn Marino comp_time, 0, 0))
2850f5b1c8a1SJohn Marino goto err;
2851f5b1c8a1SJohn Marino }
2852*de0e0e4dSAntonio Huete Jimenez if (rev != NULL && hold != NULL) {
2853f5b1c8a1SJohn Marino if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code,
2854f5b1c8a1SJohn Marino hold, 0, 0))
2855f5b1c8a1SJohn Marino goto err;
2856f5b1c8a1SJohn Marino }
2857f5b1c8a1SJohn Marino if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
2858f5b1c8a1SJohn Marino ret = 2;
2859f5b1c8a1SJohn Marino else
2860f5b1c8a1SJohn Marino ret = 1;
2861f5b1c8a1SJohn Marino
2862f5b1c8a1SJohn Marino err:
2863f5b1c8a1SJohn Marino free(tmp);
2864f5b1c8a1SJohn Marino
2865f5b1c8a1SJohn Marino ASN1_OBJECT_free(hold);
2866f5b1c8a1SJohn Marino ASN1_GENERALIZEDTIME_free(comp_time);
2867f5b1c8a1SJohn Marino ASN1_ENUMERATED_free(rtmp);
2868f5b1c8a1SJohn Marino ASN1_TIME_free(revDate);
2869f5b1c8a1SJohn Marino
2870f5b1c8a1SJohn Marino return ret;
2871f5b1c8a1SJohn Marino }
2872f5b1c8a1SJohn Marino
2873f5b1c8a1SJohn Marino int
old_entry_print(BIO * bp,ASN1_OBJECT * obj,ASN1_STRING * str)2874f5b1c8a1SJohn Marino old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
2875f5b1c8a1SJohn Marino {
2876f5b1c8a1SJohn Marino char buf[25], *pbuf, *p;
2877f5b1c8a1SJohn Marino int j;
2878f5b1c8a1SJohn Marino
2879f5b1c8a1SJohn Marino j = i2a_ASN1_OBJECT(bp, obj);
2880f5b1c8a1SJohn Marino pbuf = buf;
2881f5b1c8a1SJohn Marino for (j = 22 - j; j > 0; j--)
2882f5b1c8a1SJohn Marino *(pbuf++) = ' ';
2883f5b1c8a1SJohn Marino *(pbuf++) = ':';
2884f5b1c8a1SJohn Marino *(pbuf++) = '\0';
2885f5b1c8a1SJohn Marino BIO_puts(bp, buf);
2886f5b1c8a1SJohn Marino
2887f5b1c8a1SJohn Marino if (str->type == V_ASN1_PRINTABLESTRING)
2888f5b1c8a1SJohn Marino BIO_printf(bp, "PRINTABLE:'");
2889f5b1c8a1SJohn Marino else if (str->type == V_ASN1_T61STRING)
2890f5b1c8a1SJohn Marino BIO_printf(bp, "T61STRING:'");
2891f5b1c8a1SJohn Marino else if (str->type == V_ASN1_IA5STRING)
2892f5b1c8a1SJohn Marino BIO_printf(bp, "IA5STRING:'");
2893f5b1c8a1SJohn Marino else if (str->type == V_ASN1_UNIVERSALSTRING)
2894f5b1c8a1SJohn Marino BIO_printf(bp, "UNIVERSALSTRING:'");
2895f5b1c8a1SJohn Marino else
2896f5b1c8a1SJohn Marino BIO_printf(bp, "ASN.1 %2d:'", str->type);
2897f5b1c8a1SJohn Marino
2898f5b1c8a1SJohn Marino p = (char *) str->data;
2899f5b1c8a1SJohn Marino for (j = str->length; j > 0; j--) {
2900f5b1c8a1SJohn Marino if ((*p >= ' ') && (*p <= '~'))
2901f5b1c8a1SJohn Marino BIO_printf(bp, "%c", *p);
2902f5b1c8a1SJohn Marino else if (*p & 0x80)
2903f5b1c8a1SJohn Marino BIO_printf(bp, "\\0x%02X", *p);
2904f5b1c8a1SJohn Marino else if ((unsigned char) *p == 0xf7)
2905f5b1c8a1SJohn Marino BIO_printf(bp, "^?");
2906f5b1c8a1SJohn Marino else
2907f5b1c8a1SJohn Marino BIO_printf(bp, "^%c", *p + '@');
2908f5b1c8a1SJohn Marino p++;
2909f5b1c8a1SJohn Marino }
2910f5b1c8a1SJohn Marino BIO_printf(bp, "'\n");
2911f5b1c8a1SJohn Marino return 1;
2912f5b1c8a1SJohn Marino }
2913f5b1c8a1SJohn Marino
2914f5b1c8a1SJohn Marino int
unpack_revinfo(ASN1_TIME ** prevtm,int * preason,ASN1_OBJECT ** phold,ASN1_GENERALIZEDTIME ** pinvtm,const char * str)2915f5b1c8a1SJohn Marino unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
2916f5b1c8a1SJohn Marino ASN1_GENERALIZEDTIME **pinvtm, const char *str)
2917f5b1c8a1SJohn Marino {
2918f5b1c8a1SJohn Marino char *tmp = NULL;
2919f5b1c8a1SJohn Marino char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2920f5b1c8a1SJohn Marino int reason_code = -1;
2921f5b1c8a1SJohn Marino int ret = 0;
2922f5b1c8a1SJohn Marino unsigned int i;
2923f5b1c8a1SJohn Marino ASN1_OBJECT *hold = NULL;
2924f5b1c8a1SJohn Marino ASN1_GENERALIZEDTIME *comp_time = NULL;
2925f5b1c8a1SJohn Marino
2926f5b1c8a1SJohn Marino if ((tmp = strdup(str)) == NULL) {
2927f5b1c8a1SJohn Marino BIO_printf(bio_err, "malloc failed\n");
2928f5b1c8a1SJohn Marino goto err;
2929f5b1c8a1SJohn Marino }
2930f5b1c8a1SJohn Marino p = strchr(tmp, ',');
2931f5b1c8a1SJohn Marino rtime_str = tmp;
2932f5b1c8a1SJohn Marino
2933*de0e0e4dSAntonio Huete Jimenez if (p != NULL) {
2934f5b1c8a1SJohn Marino *p = '\0';
2935f5b1c8a1SJohn Marino p++;
2936f5b1c8a1SJohn Marino reason_str = p;
2937f5b1c8a1SJohn Marino p = strchr(p, ',');
2938*de0e0e4dSAntonio Huete Jimenez if (p != NULL) {
2939f5b1c8a1SJohn Marino *p = '\0';
2940f5b1c8a1SJohn Marino arg_str = p + 1;
2941f5b1c8a1SJohn Marino }
2942f5b1c8a1SJohn Marino }
2943*de0e0e4dSAntonio Huete Jimenez if (prevtm != NULL) {
2944f5b1c8a1SJohn Marino *prevtm = ASN1_UTCTIME_new();
2945f5b1c8a1SJohn Marino if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str)) {
2946f5b1c8a1SJohn Marino BIO_printf(bio_err, "invalid revocation date %s\n",
2947f5b1c8a1SJohn Marino rtime_str);
2948f5b1c8a1SJohn Marino goto err;
2949f5b1c8a1SJohn Marino }
2950f5b1c8a1SJohn Marino }
2951*de0e0e4dSAntonio Huete Jimenez if (reason_str != NULL) {
2952f5b1c8a1SJohn Marino for (i = 0; i < NUM_REASONS; i++) {
2953*de0e0e4dSAntonio Huete Jimenez if (strcasecmp(reason_str, crl_reasons[i]) == 0) {
2954f5b1c8a1SJohn Marino reason_code = i;
2955f5b1c8a1SJohn Marino break;
2956f5b1c8a1SJohn Marino }
2957f5b1c8a1SJohn Marino }
2958f5b1c8a1SJohn Marino if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS) {
2959f5b1c8a1SJohn Marino BIO_printf(bio_err, "invalid reason code %s\n",
2960f5b1c8a1SJohn Marino reason_str);
2961f5b1c8a1SJohn Marino goto err;
2962f5b1c8a1SJohn Marino }
2963f5b1c8a1SJohn Marino if (reason_code == 7)
2964f5b1c8a1SJohn Marino reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
2965f5b1c8a1SJohn Marino else if (reason_code == 8) { /* Hold instruction */
2966*de0e0e4dSAntonio Huete Jimenez if (arg_str == NULL) {
2967f5b1c8a1SJohn Marino BIO_printf(bio_err,
2968f5b1c8a1SJohn Marino "missing hold instruction\n");
2969f5b1c8a1SJohn Marino goto err;
2970f5b1c8a1SJohn Marino }
2971f5b1c8a1SJohn Marino reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
2972f5b1c8a1SJohn Marino hold = OBJ_txt2obj(arg_str, 0);
2973f5b1c8a1SJohn Marino
2974*de0e0e4dSAntonio Huete Jimenez if (hold == NULL) {
2975f5b1c8a1SJohn Marino BIO_printf(bio_err,
2976f5b1c8a1SJohn Marino "invalid object identifier %s\n", arg_str);
2977f5b1c8a1SJohn Marino goto err;
2978f5b1c8a1SJohn Marino }
2979*de0e0e4dSAntonio Huete Jimenez if (phold != NULL)
2980f5b1c8a1SJohn Marino *phold = hold;
2981f5b1c8a1SJohn Marino } else if ((reason_code == 9) || (reason_code == 10)) {
2982*de0e0e4dSAntonio Huete Jimenez if (arg_str == NULL) {
2983f5b1c8a1SJohn Marino BIO_printf(bio_err,
2984f5b1c8a1SJohn Marino "missing compromised time\n");
2985f5b1c8a1SJohn Marino goto err;
2986f5b1c8a1SJohn Marino }
2987f5b1c8a1SJohn Marino comp_time = ASN1_GENERALIZEDTIME_new();
2988f5b1c8a1SJohn Marino if (!ASN1_GENERALIZEDTIME_set_string(comp_time,
2989f5b1c8a1SJohn Marino arg_str)) {
2990f5b1c8a1SJohn Marino BIO_printf(bio_err,
2991f5b1c8a1SJohn Marino "invalid compromised time %s\n", arg_str);
2992f5b1c8a1SJohn Marino goto err;
2993f5b1c8a1SJohn Marino }
2994f5b1c8a1SJohn Marino if (reason_code == 9)
2995f5b1c8a1SJohn Marino reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
2996f5b1c8a1SJohn Marino else
2997f5b1c8a1SJohn Marino reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
2998f5b1c8a1SJohn Marino }
2999f5b1c8a1SJohn Marino }
3000*de0e0e4dSAntonio Huete Jimenez if (preason != NULL)
3001f5b1c8a1SJohn Marino *preason = reason_code;
3002*de0e0e4dSAntonio Huete Jimenez if (pinvtm != NULL)
3003f5b1c8a1SJohn Marino *pinvtm = comp_time;
3004f5b1c8a1SJohn Marino else
3005f5b1c8a1SJohn Marino ASN1_GENERALIZEDTIME_free(comp_time);
3006f5b1c8a1SJohn Marino
3007f5b1c8a1SJohn Marino ret = 1;
3008f5b1c8a1SJohn Marino
3009f5b1c8a1SJohn Marino err:
3010f5b1c8a1SJohn Marino free(tmp);
3011f5b1c8a1SJohn Marino
3012*de0e0e4dSAntonio Huete Jimenez if (phold == NULL)
3013f5b1c8a1SJohn Marino ASN1_OBJECT_free(hold);
3014*de0e0e4dSAntonio Huete Jimenez if (pinvtm == NULL)
3015f5b1c8a1SJohn Marino ASN1_GENERALIZEDTIME_free(comp_time);
3016f5b1c8a1SJohn Marino
3017f5b1c8a1SJohn Marino return ret;
3018f5b1c8a1SJohn Marino }
3019f5b1c8a1SJohn Marino
3020f5b1c8a1SJohn Marino static char *
bin2hex(unsigned char * data,size_t len)3021f5b1c8a1SJohn Marino bin2hex(unsigned char *data, size_t len)
3022f5b1c8a1SJohn Marino {
3023f5b1c8a1SJohn Marino char *ret = NULL;
3024f5b1c8a1SJohn Marino char hex[] = "0123456789ABCDEF";
3025f5b1c8a1SJohn Marino int i;
3026f5b1c8a1SJohn Marino
3027*de0e0e4dSAntonio Huete Jimenez if ((ret = malloc(len * 2 + 1)) != NULL) {
3028f5b1c8a1SJohn Marino for (i = 0; i < len; i++) {
3029f5b1c8a1SJohn Marino ret[i * 2 + 0] = hex[data[i] >> 4];
3030f5b1c8a1SJohn Marino ret[i * 2 + 1] = hex[data[i] & 0x0F];
3031f5b1c8a1SJohn Marino }
3032f5b1c8a1SJohn Marino ret[len * 2] = '\0';
3033f5b1c8a1SJohn Marino }
3034f5b1c8a1SJohn Marino return ret;
3035f5b1c8a1SJohn Marino }
3036