mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-27 05:21:51 +08:00
Code Issues Packages Projects Releases Wiki Activity
821951b851
openssl/apps/ca.c

3341 lines
79 KiB
C
Raw Normal View History

Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
/* apps/ca.c */
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
#include <ctype.h>
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
#include <sys/types.h>
#include <sys/stat.h>
Change #include filenames from <foo.h> to <openssl.h>. Submitted by: Reviewed by: PR:
1999-04-24 06:13:45 +08:00
#include <openssl/conf.h>
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/bn.h>
#include <openssl/txt_db.h>
#include <openssl/evp.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/objects.h>
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
#include <openssl/ocsp.h>
Change #include filenames from <foo.h> to <openssl.h>. Submitted by: Reviewed by: PR:
1999-04-24 06:13:45 +08:00
#include <openssl/pem.h>
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Windows does not know of strigs.h or strcasecmp, so when in Windows, make strcasecmp a macro to _stricmp.
2001-02-22 22:21:06 +08:00
#ifdef OPENSSL_SYS_WINDOWS
#define strcasecmp _stricmp
#else
Unixware doesn't have strings.h, so we need to declare strcasecmp() differently. Unixware 2 needs to link with libresolv. PR: 148
2002-07-18 15:47:30 +08:00
# ifdef NO_STRINGS_H
int strcasecmp();
# else
# include <strings.h>
# endif /* NO_STRINGS_H */
Windows does not know of strigs.h or strcasecmp, so when in Windows, make strcasecmp a macro to _stricmp.
2001-02-22 22:21:06 +08:00
#endif
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
#ifndef W_OK
Use new-style system-id macros everywhere possible. I hope I haven't missed any. This compiles and runs on Linux, and external applications have no problems with it. The definite test will be to build this on VMS.
2001-02-20 16:13:47 +08:00
# ifdef OPENSSL_SYS_VMS
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
# if defined(__DECC)
# include <unistd.h>
# else
# include <unixlib.h>
# endif
Windows doesn't know sys/file.h
2002-11-08 05:40:06 +08:00
# elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS)
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
# include <sys/file.h>
# endif
#endif
On certain platforms, we redefine certain symbols using macros in apps.h. For those, it's better to include apps.h after the system headers where those symbols may be defined, since there's otherwise a chance that the C compiler will barf when it sees something that looks like this after expansion: int VMS_strcasecmp((str1),(str2))(const char *, const char *);
2002-10-24 18:03:55 +08:00
#include "apps.h"
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
#ifndef W_OK
# define F_OK 0
# define X_OK 1
# define W_OK 2
# define R_OK 4
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
#endif
#undef PROG
#define PROG ca_main
#define BASE_SECTION "ca"
Move openssl.cnf out of lib/.
1999-05-11 07:59:28 +08:00
#define CONFIG_FILE "openssl.cnf"
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
#define ENV_DEFAULT_CA "default_ca"
#define ENV_DIR "dir"
#define ENV_CERTS "certs"
#define ENV_CRL_DIR "crl_dir"
#define ENV_CA_DB "CA_DB"
#define ENV_NEW_CERTS_DIR "new_certs_dir"
#define ENV_CERTIFICATE "certificate"
#define ENV_SERIAL "serial"
#define ENV_CRL "crl"
#define ENV_PRIVATE_KEY "private_key"
#define ENV_RANDFILE "RANDFILE"
#define ENV_DEFAULT_DAYS "default_days"
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
#define ENV_DEFAULT_STARTDATE "default_startdate"
Fix -startdate and -enddate arguments to 'ca' program. Also update NEWS file with some 0.9.4 changes.
1999-08-07 05:47:09 +08:00
#define ENV_DEFAULT_ENDDATE "default_enddate"
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
#define ENV_DEFAULT_CRL_DAYS "default_crl_days"
#define ENV_DEFAULT_CRL_HOURS "default_crl_hours"
#define ENV_DEFAULT_MD "default_md"
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
#define ENV_DEFAULT_EMAIL_DN "email_in_dn"
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
#define ENV_PRESERVE "preserve"
#define ENV_POLICY "policy"
#define ENV_EXTENSIONS "x509_extensions"
Added support for adding extensions to CRLs, also fix a memory leak and make 'req' check the config file syntax before it adds extensions. Added info in the documentation as well.
1999-03-07 03:33:29 +08:00
#define ENV_CRLEXT "crl_extensions"
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
#define ENV_MSIE_HACK "msie_hack"
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
#define ENV_NAMEOPT "name_opt"
#define ENV_CERTOPT "cert_opt"
Add copy_extensions option to 'ca' utility.
2001-03-16 10:04:17 +08:00
#define ENV_EXTCOPY "copy_extensions"
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
#define ENV_DATABASE "database"
#define DB_type 0
#define DB_exp_date 1
#define DB_rev_date 2
#define DB_serial 3 /* index - unique */
#define DB_file 4
#define DB_name 5 /* index - unique for active */
#define DB_NUMBER 6
#define DB_TYPE_REV 'R'
#define DB_TYPE_EXP 'E'
#define DB_TYPE_VAL 'V'
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
/* Additional revocation information types */
#define REV_NONE 0 /* No addditional information */
#define REV_CRL_REASON 1 /* Value is CRL reason code */
#define REV_HOLD 2 /* Value is hold instruction */
#define REV_KEY_COMPROMISE 3 /* Value is cert key compromise time */
#define REV_CA_COMPROMISE 4 /* Value is CA key compromise time */
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
static char *ca_usage[]={
"usage: ca args\n",
"\n",
" -verbose - Talk alot while doing things\n",
" -config file - A config file\n",
" -name arg - The particular CA definition to use\n",
" -gencrl - Generate a new CRL\n",
" -crldays days - Days is when the next CRL is due\n",
" -crlhours hours - Hours is when the next CRL is due\n",
Document -startdate and -enddate in usage summary.
1999-09-18 00:35:29 +08:00
" -startdate YYMMDDHHMMSSZ - certificate validity notBefore\n",
" -enddate YYMMDDHHMMSSZ - certificate validity notAfter (overrides -days)\n",
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
" -days arg - number of days to certify the certificate for\n",
" -md arg - md to use, one of md2, md5, sha or sha1\n",
" -policy arg - The CA 'policy' to support\n",
Add the possibility to use keys handled by engines in more applications.
2000-10-29 06:40:40 +08:00
" -keyfile arg - private key file\n",
" -keyform arg - private key file format (PEM or ENGINE)\n",
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
" -key arg - key to decode the private key if it is encrypted\n",
Typo in arguments.
1999-02-06 23:19:16 +08:00
" -cert file - The CA certificate\n",
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
" -in file - The input PEM encoded certificate request(s)\n",
" -out file - Where to put the output file(s)\n",
" -outdir dir - Where to put output certificates\n",
" -infiles .... - The last argument, requests to process\n",
" -spkac file - File contains DN and signed public key and challenge\n",
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
" -ss_cert file - File contains a self signed cert to sign\n",
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
" -preserveDN - Don't re-order the DN\n",
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
" -noemailDN - Don't add the EMAIL field into certificate' subject\n",
Fix a few typos and tabs while I'm poking around in ca.c...
1999-04-10 21:15:38 +08:00
" -batch - Don't ask questions\n",
" -msie_hack - msie modifications to handle all those universal strings\n",
Add `openssl ca -revoke <certfile>' facility which revokes a certificate specified in <certfile> by updating the entry in the index.txt file. This way one no longer has to edit the index.txt file manually for revoking a certificate. The -revoke option does the gory details now. Submitted by: Massimiliano Pala <madwolf@openca.org> Cleaned up and integrated by: Ralf S. Engelschall
1999-04-12 19:45:14 +08:00
" -revoke file - Revoke a certificate (given in file)\n",
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
" -subj arg - Use arg instead of request's subject\n",
Allow the extension section specified in config files to be overridden on the command line for various utilities.
1999-08-27 08:08:17 +08:00
" -extensions .. - Extension section (override value in config file)\n",
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
" -extfile file - Configuration file with X509v3 extentions to add\n",
Allow the extension section specified in config files to be overridden on the command line for various utilities.
1999-08-27 08:08:17 +08:00
" -crlexts .. - CRL extension section (override value in config file)\n",
Merge the engine branch into the main trunk. All conflicts resolved. At the same time, add VMS support for Rijndael.
2000-10-27 05:07:28 +08:00
" -engine e - use engine e, possibly a hardware device.\n",
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
" -status serial - Shows certificate status given the serial number\n",
" -updatedb - Updates db for expired certificates\n",
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
NULL
};
#ifdef EFENCE
extern int EF_PROTECT_FREE;
extern int EF_PROTECT_BELOW;
extern int EF_ALIGNMENT;
#endif
static void lookup_fail(char *name,char *tag);
Use the new LHASH macros to declare type-safe wrapper functions that can be used as the hash/compare callbacks without function pointer casting. For now, this is just happening in the apps/ directory whilst a few people check the approach. The rest of the library will be moved across to the same idea if there's no problems with this.
2000-12-03 07:16:54 +08:00
static unsigned long index_serial_hash(const char **a);
static int index_serial_cmp(const char **a, const char **b);
static unsigned long index_name_hash(const char **a);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
static int index_name_qual(char **a);
Use the new LHASH macros to declare type-safe wrapper functions that can be used as the hash/compare callbacks without function pointer casting. For now, this is just happening in the apps/ directory whilst a few people check the approach. The rest of the library will be moved across to the same idea if there's no problems with this.
2000-12-03 07:16:54 +08:00
static int index_name_cmp(const char **a,const char **b);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
static BIGNUM *load_serial(char *serialfile);
static int save_serial(char *serialfile, BIGNUM *serial);
static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,TXT_DB *db,
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
BIGNUM *serial, char *subj, int email_dn, char *startdate,
char *enddate, long days, int batch, char *ext_sect, CONF *conf,
int verbose, unsigned long certopt, unsigned long nameopt,
int default_op, int ext_copy);
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
TXT_DB *db, BIGNUM *serial, char *subj, int email_dn,
char *startdate, char *enddate, long days, int batch,
char *ext_sect, CONF *conf,int verbose, unsigned long certopt,
Make better use of load_cert, load_certs and load_key.
2001-06-27 17:12:43 +08:00
unsigned long nameopt, int default_op, int ext_copy,
ENGINE *e);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
TXT_DB *db, BIGNUM *serial,char *subj, int email_dn,
char *startdate, char *enddate, long days, char *ext_sect,
CONF *conf, int verbose, unsigned long certopt,
unsigned long nameopt, int default_op, int ext_copy);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
static int fix_data(int nid, int *type);
Add new -notext option to 'ca', -pubkey option to spkac. Remove some "WTF??" casts from applications. Fixes to keep VC++ happy and avoid warnings. Docs tidy.
2000-02-03 10:56:48 +08:00
static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
Massive constification.
1999-04-18 05:25:43 +08:00
static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,char *subj,
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
int email_dn, char *startdate, char *enddate, long days, int batch,
int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
unsigned long certopt, unsigned long nameopt, int default_op,
int ext_copy);
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
static int do_revoke(X509 *x509, TXT_DB *db, int ext, char *extval);
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
static int get_certificate_status(const char *ser_status, TXT_DB *db);
static int do_updatedb(TXT_DB *db);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
static int check_time_format(char *str);
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
char *make_revocation_str(int rev_type, char *rev_arg);
int make_revoked(X509_REVOKED *rev, char *str);
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
static CONF *conf=NULL;
static CONF *extconf=NULL;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
static char *section=NULL;
static int preserve=0;
static int msie_hack=0;
Fix warnings.
2000-12-03 18:04:22 +08:00
static IMPLEMENT_LHASH_HASH_FN(index_serial_hash,const char **)
static IMPLEMENT_LHASH_COMP_FN(index_serial_cmp,const char **)
static IMPLEMENT_LHASH_HASH_FN(index_name_hash,const char **)
static IMPLEMENT_LHASH_COMP_FN(index_name_cmp,const char **)
Use the new LHASH macros to declare type-safe wrapper functions that can be used as the hash/compare callbacks without function pointer casting. For now, this is just happening in the apps/ directory whilst a few people check the approach. The rest of the library will be moved across to the same idea if there's no problems with this.
2000-12-03 07:16:54 +08:00
Make gcc 2.95.2 happy again, even under ``-Wall -Wshadow -Wpointer-arith -Wcast-align -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Winline''.
2000-02-11 17:47:18 +08:00
int MAIN(int, char **);
Change functions to ANSI C.
1999-04-20 05:31:43 +08:00
int MAIN(int argc, char **argv)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
Merge the engine branch into the main trunk. All conflicts resolved. At the same time, add VMS support for Rijndael.
2000-10-27 05:07:28 +08:00
ENGINE *e = NULL;
Add 'rsautl' low level RSA utility. Add DER public key routines. Add -passin argument to 'ca' utility. Document sign and verify options to dgst.
2000-09-04 07:13:48 +08:00
char *key=NULL,*passargin=NULL;
Make -passin -passout etc work again. Fix leak in ca.c when using -passin.
2001-08-17 09:09:54 +08:00
int free_key = 0;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
int total=0;
int total_done=0;
int badops=0;
int ret=1;
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
int email_dn=1;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
int req=0;
int verbose=0;
int gencrl=0;
gcc claims this is a shadow, though I can't find what it is shadowing...
1999-04-13 01:17:39 +08:00
int dorevoke=0;
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
int doupdatedb=0;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
long crldays=0;
long crlhours=0;
long errorline= -1;
char *configfile=NULL;
char *md=NULL;
char *policy=NULL;
char *keyfile=NULL;
char *certfile=NULL;
Add the possibility to use keys handled by engines in more applications.
2000-10-29 06:40:40 +08:00
int keyform=FORMAT_PEM;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
char *infile=NULL;
char *spkac_file=NULL;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
char *ss_cert_file=NULL;
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
char *ser_status=NULL;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
EVP_PKEY *pkey=NULL;
int output_der = 0;
char *outfile=NULL;
char *outdir=NULL;
char *serialfile=NULL;
char *extensions=NULL;
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
char *extfile=NULL;
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
char *subj=NULL;
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
char *tmp_email_dn=NULL;
Added support for adding extensions to CRLs, also fix a memory leak and make 'req' check the config file syntax before it adds extensions. Added info in the documentation as well.
1999-03-07 03:33:29 +08:00
char *crl_ext=NULL;
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
int rev_type = REV_NONE;
char *rev_arg = NULL;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
BIGNUM *serial=NULL;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
char *startdate=NULL;
Fix -startdate and -enddate arguments to 'ca' program. Also update NEWS file with some 0.9.4 changes.
1999-08-07 05:47:09 +08:00
char *enddate=NULL;
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
long days=0;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
int batch=0;
Add new -notext option to 'ca', -pubkey option to spkac. Remove some "WTF??" casts from applications. Fixes to keep VC++ happy and avoid warnings. Docs tidy.
2000-02-03 10:56:48 +08:00
int notext=0;
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
unsigned long nameopt = 0, certopt = 0;
int default_op = 1;
Add copy_extensions option to 'ca' utility.
2001-03-16 10:04:17 +08:00
int ext_copy = EXT_COPY_NONE;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
X509 *x509=NULL;
X509 *x=NULL;
BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
char *dbfile=NULL;
TXT_DB *db=NULL;
X509_CRL *crl=NULL;
X509_REVOKED *r=NULL;
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
ASN1_TIME *tmptm;
ASN1_INTEGER *tmpser;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
char **pp,*p,*f;
int i,j;
long l;
Massive constification.
1999-04-18 05:25:43 +08:00
const EVP_MD *dgst=NULL;
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
STACK_OF(CONF_VALUE) *attribs=NULL;
Typesafety thought police.
2000-05-16 22:38:29 +08:00
STACK_OF(X509) *cert_sk=NULL;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
#undef BSIZE
#define BSIZE 256
MS_STATIC char buf[3][BSIZE];
Fix (spurious) warnings.
1999-11-09 20:09:24 +08:00
char *randfile=NULL;
Merge the engine branch into the main trunk. All conflicts resolved. At the same time, add VMS support for Rijndael.
2000-10-27 05:07:28 +08:00
char *engine = NULL;
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
char *tofree=NULL;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
#ifdef EFENCE
EF_PROTECT_FREE=1;
EF_PROTECT_BELOW=1;
EF_ALIGNMENT=0;
#endif
apps_startup();
Reinitialize conf to NULL whenver ca application is started. Submitted by: Lennart Bang
1999-09-06 04:53:08 +08:00
conf = NULL;
Reinitialize global variables when necessary (for monolith application).
1999-09-04 07:08:45 +08:00
key = NULL;
section = NULL;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
preserve=0;
Reinitialize global variables when necessary (for monolith application).
1999-09-04 07:08:45 +08:00
msie_hack=0;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (bio_err == NULL)
if ((bio_err=BIO_new(BIO_s_file())) != NULL)
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
argc--;
argv++;
while (argc >= 1)
{
if (strcmp(*argv,"-verbose") == 0)
verbose=1;
else if (strcmp(*argv,"-config") == 0)
{
if (--argc < 1) goto bad;
configfile= *(++argv);
}
else if (strcmp(*argv,"-name") == 0)
{
if (--argc < 1) goto bad;
section= *(++argv);
}
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
else if (strcmp(*argv,"-subj") == 0)
{
if (--argc < 1) goto bad;
subj= *(++argv);
/* preserve=1; */
}
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
else if (strcmp(*argv,"-startdate") == 0)
{
if (--argc < 1) goto bad;
startdate= *(++argv);
}
Fix -startdate and -enddate arguments to 'ca' program. Also update NEWS file with some 0.9.4 changes.
1999-08-07 05:47:09 +08:00
else if (strcmp(*argv,"-enddate") == 0)
{
if (--argc < 1) goto bad;
enddate= *(++argv);
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
else if (strcmp(*argv,"-days") == 0)
{
if (--argc < 1) goto bad;
days=atoi(*(++argv));
}
else if (strcmp(*argv,"-md") == 0)
{
if (--argc < 1) goto bad;
md= *(++argv);
}
else if (strcmp(*argv,"-policy") == 0)
{
if (--argc < 1) goto bad;
policy= *(++argv);
}
else if (strcmp(*argv,"-keyfile") == 0)
{
if (--argc < 1) goto bad;
keyfile= *(++argv);
}
Add the possibility to use keys handled by engines in more applications.
2000-10-29 06:40:40 +08:00
else if (strcmp(*argv,"-keyform") == 0)
{
if (--argc < 1) goto bad;
keyform=str2fmt(*(++argv));
}
Add 'rsautl' low level RSA utility. Add DER public key routines. Add -passin argument to 'ca' utility. Document sign and verify options to dgst.
2000-09-04 07:13:48 +08:00
else if (strcmp(*argv,"-passin") == 0)
{
if (--argc < 1) goto bad;
passargin= *(++argv);
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
else if (strcmp(*argv,"-key") == 0)
{
if (--argc < 1) goto bad;
key= *(++argv);
}
else if (strcmp(*argv,"-cert") == 0)
{
if (--argc < 1) goto bad;
certfile= *(++argv);
}
else if (strcmp(*argv,"-in") == 0)
{
if (--argc < 1) goto bad;
infile= *(++argv);
req=1;
}
else if (strcmp(*argv,"-out") == 0)
{
if (--argc < 1) goto bad;
outfile= *(++argv);
}
else if (strcmp(*argv,"-outdir") == 0)
{
if (--argc < 1) goto bad;
outdir= *(++argv);
}
Add new -notext option to 'ca', -pubkey option to spkac. Remove some "WTF??" casts from applications. Fixes to keep VC++ happy and avoid warnings. Docs tidy.
2000-02-03 10:56:48 +08:00
else if (strcmp(*argv,"-notext") == 0)
notext=1;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
else if (strcmp(*argv,"-batch") == 0)
batch=1;
else if (strcmp(*argv,"-preserveDN") == 0)
preserve=1;
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
else if (strcmp(*argv,"-noemailDN") == 0)
email_dn=0;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
else if (strcmp(*argv,"-gencrl") == 0)
gencrl=1;
else if (strcmp(*argv,"-msie_hack") == 0)
msie_hack=1;
else if (strcmp(*argv,"-crldays") == 0)
{
if (--argc < 1) goto bad;
crldays= atol(*(++argv));
}
else if (strcmp(*argv,"-crlhours") == 0)
{
if (--argc < 1) goto bad;
crlhours= atol(*(++argv));
}
else if (strcmp(*argv,"-infiles") == 0)
{
argc--;
argv++;
req=1;
break;
}
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
else if (strcmp(*argv, "-ss_cert") == 0)
{
if (--argc < 1) goto bad;
ss_cert_file = *(++argv);
req=1;
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
else if (strcmp(*argv, "-spkac") == 0)
{
if (--argc < 1) goto bad;
spkac_file = *(++argv);
req=1;
}
Add `openssl ca -revoke <certfile>' facility which revokes a certificate specified in <certfile> by updating the entry in the index.txt file. This way one no longer has to edit the index.txt file manually for revoking a certificate. The -revoke option does the gory details now. Submitted by: Massimiliano Pala <madwolf@openca.org> Cleaned up and integrated by: Ralf S. Engelschall
1999-04-12 19:45:14 +08:00
else if (strcmp(*argv,"-revoke") == 0)
{
if (--argc < 1) goto bad;
infile= *(++argv);
gcc claims this is a shadow, though I can't find what it is shadowing...
1999-04-13 01:17:39 +08:00
dorevoke=1;
Add `openssl ca -revoke <certfile>' facility which revokes a certificate specified in <certfile> by updating the entry in the index.txt file. This way one no longer has to edit the index.txt file manually for revoking a certificate. The -revoke option does the gory details now. Submitted by: Massimiliano Pala <madwolf@openca.org> Cleaned up and integrated by: Ralf S. Engelschall
1999-04-12 19:45:14 +08:00
}
Allow the extension section specified in config files to be overridden on the command line for various utilities.
1999-08-27 08:08:17 +08:00
else if (strcmp(*argv,"-extensions") == 0)
{
if (--argc < 1) goto bad;
extensions= *(++argv);
}
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
else if (strcmp(*argv,"-extfile") == 0)
{
if (--argc < 1) goto bad;
extfile= *(++argv);
}
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
else if (strcmp(*argv,"-status") == 0)
{
if (--argc < 1) goto bad;
ser_status= *(++argv);
}
else if (strcmp(*argv,"-updatedb") == 0)
{
doupdatedb=1;
}
Allow the extension section specified in config files to be overridden on the command line for various utilities.
1999-08-27 08:08:17 +08:00
else if (strcmp(*argv,"-crlexts") == 0)
{
if (--argc < 1) goto bad;
crl_ext= *(++argv);
}
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
else if (strcmp(*argv,"-crl_reason") == 0)
{
if (--argc < 1) goto bad;
rev_arg = *(++argv);
rev_type = REV_CRL_REASON;
}
else if (strcmp(*argv,"-crl_hold") == 0)
{
if (--argc < 1) goto bad;
rev_arg = *(++argv);
rev_type = REV_HOLD;
}
else if (strcmp(*argv,"-crl_compromise") == 0)
{
if (--argc < 1) goto bad;
rev_arg = *(++argv);
rev_type = REV_KEY_COMPROMISE;
}
else if (strcmp(*argv,"-crl_CA_compromise") == 0)
{
if (--argc < 1) goto bad;
rev_arg = *(++argv);
rev_type = REV_CA_COMPROMISE;
}
Merge the engine branch into the main trunk. All conflicts resolved. At the same time, add VMS support for Rijndael.
2000-10-27 05:07:28 +08:00
else if (strcmp(*argv,"-engine") == 0)
{
if (--argc < 1) goto bad;
engine= *(++argv);
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
else
{
bad:
BIO_printf(bio_err,"unknown option %s\n",*argv);
badops=1;
break;
}
argc--;
argv++;
}
if (badops)
{
for (pp=ca_usage; (*pp != NULL); pp++)
format strings
2001-02-06 10:57:35 +08:00
BIO_printf(bio_err,"%s",*pp);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
ERR_load_crypto_strings();
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
e = setup_engine(bio_err, engine, 0);
Merge the engine branch into the main trunk. All conflicts resolved. At the same time, add VMS support for Rijndael.
2000-10-27 05:07:28 +08:00
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
/*****************************************************************/
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
tofree=NULL;
Allows PKCS#12 password to be placed on command line and add allow config file name for 'ca' to come from the environment.
1999-05-08 20:59:50 +08:00
if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (configfile == NULL)
{
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
const char *s=X509_get_default_cert_area();
Use new-style system-id macros everywhere possible. I hope I haven't missed any. This compiles and runs on Linux, and external applications have no problems with it. The definite test will be to build this on VMS.
2001-02-20 16:13:47 +08:00
#ifdef OPENSSL_SYS_VMS
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
tofree=OPENSSL_malloc(strlen(s)+sizeof(CONFIG_FILE));
strcpy(tofree,s);
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
#else
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
tofree=OPENSSL_malloc(strlen(s)+sizeof(CONFIG_FILE)+1);
strcpy(tofree,s);
strcat(tofree,"/");
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
#endif
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
strcat(tofree,CONFIG_FILE);
configfile=tofree;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
BIO_printf(bio_err,"Using configuration from %s\n",configfile);
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
conf = NCONF_new(NULL);
if (NCONF_load(conf,configfile,&errorline) <= 0)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
if (errorline <= 0)
BIO_printf(bio_err,"error loading the config file '%s'\n",
configfile);
else
BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
,errorline,configfile);
goto err;
}
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
if(tofree)
OPENSSL_free(tofree);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Config code updates. CONF_modules_unload() now calls CONF_modules_finish() automatically. Default use of section openssl_conf moved to CONF_modules_load() Load config file in several openssl utilities. Most utilities now load modules from the config file, though in a few (such as version) this isn't done because it couldn't be used for anything. In the case of ca and req the config file used is the same as the utility itself: that is the -config command line option can be used to specify an alternative file.
2002-02-22 22:01:21 +08:00
if (!load_config(bio_err, conf))
goto err;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
/* Lets get the config section we are using */
if (section == NULL)
{
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (section == NULL)
{
lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
goto err;
}
}
Import of old SSLeay release: SSLeay 0.9.1b (unreleased)
1998-12-21 19:00:56 +08:00
if (conf != NULL)
{
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
p=NCONF_get_string(conf,NULL,"oid_file");
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
if (p == NULL)
ERR_clear_error();
Import of old SSLeay release: SSLeay 0.9.1b (unreleased)
1998-12-21 19:00:56 +08:00
if (p != NULL)
{
BIO *oid_bio;
oid_bio=BIO_new_file(p,"r");
if (oid_bio == NULL)
{
/*
BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
ERR_print_errors(bio_err);
*/
Clear error we don't care about.
1999-02-06 21:30:37 +08:00
ERR_clear_error();
Import of old SSLeay release: SSLeay 0.9.1b (unreleased)
1998-12-21 19:00:56 +08:00
}
else
{
OBJ_create_objects(oid_bio);
BIO_free(oid_bio);
}
}
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
if (!add_oid_section(bio_err,conf))
Various randomness handling bugfixes and improvements -- some utilities that should have used RANDFILE did not, and -rand handling was broken except in genrsa.
1999-10-26 09:56:29 +08:00
{
Redo the way 'req' and 'ca' add objects: add support for oid_section.
1999-02-23 08:07:46 +08:00
ERR_print_errors(bio_err);
goto err;
Various randomness handling bugfixes and improvements -- some utilities that should have used RANDFILE did not, and -rand handling was broken except in genrsa.
1999-10-26 09:56:29 +08:00
}
Redo the way 'req' and 'ca' add objects: add support for oid_section.
1999-02-23 08:07:46 +08:00
}
Import of old SSLeay release: SSLeay 0.9.1b (unreleased)
1998-12-21 19:00:56 +08:00
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
if (randfile == NULL)
ERR_clear_error();
Various randomness handling bugfixes and improvements -- some utilities that should have used RANDFILE did not, and -rand handling was broken except in genrsa.
1999-10-26 09:56:29 +08:00
app_RAND_load_file(randfile, bio_err, 0);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
in=BIO_new(BIO_s_file());
out=BIO_new(BIO_s_file());
Sout=BIO_new(BIO_s_file());
Cout=BIO_new(BIO_s_file());
if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
{
ERR_print_errors(bio_err);
goto err;
}
/*****************************************************************/
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
/* report status of cert with serial number given on command line */
if (ser_status)
{
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
{
lookup_fail(section,ENV_DATABASE);
goto err;
}
if (BIO_read_filename(in,dbfile) <= 0)
{
perror(dbfile);
BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
goto err;
}
db=TXT_DB_read(in,DB_NUMBER);
if (db == NULL) goto err;
Initial OCSP server support, using index.txt format. This can process internal requests or behave like a mini responder. Todo: documentation, update usage info.
2001-07-13 04:41:51 +08:00
if (!make_serial_index(db))
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
goto err;
if (get_certificate_status(ser_status,db) != 1)
BIO_printf(bio_err,"Error verifying serial %s!\n",
ser_status);
goto err;
}
/*****************************************************************/
/* we definitely need a public key, so let's get it */
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
section,ENV_PRIVATE_KEY)) == NULL))
{
lookup_fail(section,ENV_PRIVATE_KEY);
goto err;
}
Make -passin -passout etc work again. Fix leak in ca.c when using -passin.
2001-08-17 09:09:54 +08:00
if (!key)
Add 'rsautl' low level RSA utility. Add DER public key routines. Add -passin argument to 'ca' utility. Document sign and verify options to dgst.
2000-09-04 07:13:48 +08:00
{
Make -passin -passout etc work again. Fix leak in ca.c when using -passin.
2001-08-17 09:09:54 +08:00
free_key = 1;
if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
{
BIO_printf(bio_err,"Error getting password\n");
goto err;
}
Add 'rsautl' low level RSA utility. Add DER public key routines. Add -passin argument to 'ca' utility. Document sign and verify options to dgst.
2000-09-04 07:13:48 +08:00
}
Make it possible to load keys from stdin, and restore that functionality in the programs that had that before. Part fo PR 164
2002-08-02 00:28:40 +08:00
pkey = load_key(bio_err, keyfile, keyform, 0, key, e,
Extend all the loading functions to take an engine pointer, a pass string (some engines may have certificates protected by a PIN!) and a description to put into error messages. Also, have our own password callback that we can send both a password and some prompt info to. The default password callback in EVP assumes that the passed parameter is a password, which isn't always the right thing, and the ENGINE code (at least the nCipher one) makes other assumptions... Also, in spite of having the functions to load keys, some utilities did the loading all by themselves... That's changed too.
2001-05-30 23:29:28 +08:00
"CA private key");
Cleanse memory using the new OPENSSL_cleanse() function. I've covered all the memset()s I felt safe modifying, but may have missed some.
2002-11-28 16:04:36 +08:00
if (key) OPENSSL_cleanse(key,strlen(key));
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (pkey == NULL)
{
Extend all the loading functions to take an engine pointer, a pass string (some engines may have certificates protected by a PIN!) and a description to put into error messages. Also, have our own password callback that we can send both a password and some prompt info to. The default password callback in EVP assumes that the passed parameter is a password, which isn't always the right thing, and the ENGINE code (at least the nCipher one) makes other assumptions... Also, in spite of having the functions to load keys, some utilities did the loading all by themselves... That's changed too.
2001-05-30 23:29:28 +08:00
/* load_key() has already printed an appropriate message */
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
/*****************************************************************/
/* we need a certificate */
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if ((certfile == NULL) && ((certfile=NCONF_get_string(conf,
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
section,ENV_CERTIFICATE)) == NULL))
{
lookup_fail(section,ENV_CERTIFICATE);
goto err;
}
Make better use of load_cert, load_certs and load_key.
2001-06-27 17:12:43 +08:00
x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
"CA certificate");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (x509 == NULL)
goto err;
Import of old SSLeay release: SSLeay 0.9.1b (unreleased)
1998-12-21 19:00:56 +08:00
if (!X509_check_private_key(x509,pkey))
{
BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
goto err;
}
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
if (f == NULL)
ERR_clear_error();
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
preserve=1;
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
if (f == NULL)
ERR_clear_error();
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
msie_hack=1;
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
f=NCONF_get_string(conf,section,ENV_NAMEOPT);
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
if (f)
{
if (!set_name_ex(&nameopt, f))
{
BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
goto err;
}
default_op = 0;
}
else
ERR_clear_error();
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
f=NCONF_get_string(conf,section,ENV_CERTOPT);
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
if (f)
{
if (!set_cert_ex(&certopt, f))
{
BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
goto err;
}
default_op = 0;
}
else
ERR_clear_error();
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
f=NCONF_get_string(conf,section,ENV_EXTCOPY);
Add copy_extensions option to 'ca' utility.
2001-03-16 10:04:17 +08:00
if (f)
{
if (!set_ext_copy(&ext_copy, f))
{
BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
goto err;
}
}
else
ERR_clear_error();
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
/*****************************************************************/
/* lookup where to write new certificates */
if ((outdir == NULL) && (req))
{
struct stat sb;
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
== NULL)
{
BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
goto err;
}
Use new-style system-id macros everywhere possible. I hope I haven't missed any. This compiles and runs on Linux, and external applications have no problems with it. The definite test will be to build this on VMS.
2001-02-20 16:13:47 +08:00
#ifndef OPENSSL_SYS_VMS
/* outdir is a directory spec, but access() for VMS demands a
Remove the access() call altogether for VMS, since it doesn't quite work for directory specifications (this will be reported as a bug to DEC^H^H^HCompaq). It could as well be removed for all others as well, since stat() and open() will return appropriate errors as well, but I leave that to someone else to decide.
2000-02-15 17:44:54 +08:00
filename. In any case, stat(), below, will catch the problem
if outdir is not a directory spec, and the fopen() or open()
will catch an error if there is no write access.
Presumably, this problem could also be solved by using the DEC
C routines to convert the directory syntax to Unixly, and give
that to access(). However, time's too short to do that just
now.
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
*/
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (access(outdir,R_OK|W_OK|X_OK) != 0)
{
ispell (and minor modifications)
2000-02-04 07:23:24 +08:00
BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
perror(outdir);
goto err;
}
if (stat(outdir,&sb) != 0)
{
BIO_printf(bio_err,"unable to stat(%s)\n",outdir);
perror(outdir);
goto err;
}
Improve support for running everything as a monolithic application. Submitted by: Lennart Bång, Bodo Möller
1999-10-26 03:36:01 +08:00
#ifdef S_IFDIR
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (!(sb.st_mode & S_IFDIR))
{
BIO_printf(bio_err,"%s need to be a directory\n",outdir);
perror(outdir);
goto err;
}
The OpenVMS library is most definitely not built for anything but files, unless it's all in unixly syntax. We can't guarantee that right now, so let's skip the whole test suit. There are other places (like the open()) where errors are detected anyway.
2000-02-26 11:53:58 +08:00
#endif
Improve support for running everything as a monolithic application. Submitted by: Lennart Bång, Bodo Möller
1999-10-26 03:36:01 +08:00
#endif
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
/*****************************************************************/
/* we need to load the database file */
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
lookup_fail(section,ENV_DATABASE);
goto err;
}
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
if (BIO_read_filename(in,dbfile) <= 0)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
perror(dbfile);
BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
goto err;
}
db=TXT_DB_read(in,DB_NUMBER);
if (db == NULL) goto err;
/* Lets check some fields */
for (i=0; i<sk_num(db->data); i++)
{
pp=(char **)sk_value(db->data,i);
if ((pp[DB_type][0] != DB_TYPE_REV) &&
(pp[DB_rev_date][0] != '\0'))
{
Fix a few typos and tabs while I'm poking around in ca.c...
1999-04-10 21:15:38 +08:00
BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
if ((pp[DB_type][0] == DB_TYPE_REV) &&
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
!make_revoked(NULL, pp[DB_rev_date]))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
BIO_printf(bio_err," in entry %d\n", i+1);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
if (!check_time_format(pp[DB_exp_date]))
{
BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
goto err;
}
p=pp[DB_serial];
j=strlen(p);
New -set_serial options to 'req' and 'x509'. Remove the old broken bio read of serial numbers in the 'ca' index file. This would choke if a revoked certificate was specified with a negative serial number. Fix typo in uid.c
2001-02-19 21:38:32 +08:00
if (*p == '-')
{
p++;
j--;
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if ((j&1) || (j < 2))
{
BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
goto err;
}
while (*p)
{
if (!( ((*p >= '0') && (*p <= '9')) ||
((*p >= 'A') && (*p <= 'F')) ||
((*p >= 'a') && (*p <= 'f'))) )
{
BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
goto err;
}
p++;
}
}
if (verbose)
{
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
Use new-style system-id macros everywhere possible. I hope I haven't missed any. This compiles and runs on Linux, and external applications have no problems with it. The definite test will be to build this on VMS.
2001-02-20 16:13:47 +08:00
#ifdef OPENSSL_SYS_VMS
On VMS, stdout may very well lead to a file that is written to in a record-oriented fashion. That means that every write() will write a separate record, which will be read separately by the programs trying to read from it. This can be very confusing. The solution is to put a BIO filter in the way that will buffer text until a linefeed is reached, and then write everything a line at a time, so every record written will be an actual line, not chunks of lines and not (usually doesn't happen, but I've seen it once) several lines in one record. Voila, BIO_f_linebuffer() is born. Since we're so close to release time, I'm making this VMS-only for now, just to make sure no code is needlessly broken by this. After the release, this BIO method will be enabled on all other platforms as well.
2000-09-20 21:55:50 +08:00
{
BIO *tmpbio = BIO_new(BIO_f_linebuffer());
out = BIO_push(tmpbio, out);
}
#endif
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
TXT_DB_write(out,db);
BIO_printf(bio_err,"%d entries loaded from the database\n",
db->data->num);
ispell (and minor modifications)
2000-02-04 07:23:24 +08:00
BIO_printf(bio_err,"generating index\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
Initial OCSP server support, using index.txt format. This can process internal requests or behave like a mini responder. Todo: documentation, update usage info.
2001-07-13 04:41:51 +08:00
if (!make_serial_index(db))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
First step in tidying up the LHASH code. The callback prototypes (and casts) used in the lhash code are about as horrible and evil as they can be. For starters, the callback prototypes contain empty parameter lists. Yuck. This first change defines clearer prototypes - including "typedef"'d function pointer types to use as "hash" and "compare" callbacks, as well as the callbacks passed to the lh_doall and lh_doall_arg iteration functions. Now at least more explicit (and clear) casting is required in all of the dependant code - and that should be included in this commit. The next step will be to hunt down and obliterate some of the function pointer casting being used when it's not necessary - a particularly evil variant exists in the implementation of lh_doall.
2000-12-02 04:31:52 +08:00
if (!TXT_DB_create_index(db, DB_name, index_name_qual,
Use the new LHASH macros to declare type-safe wrapper functions that can be used as the hash/compare callbacks without function pointer casting. For now, this is just happening in the apps/ directory whilst a few people check the approach. The rest of the library will be moved across to the same idea if there's no problems with this.
2000-12-03 07:16:54 +08:00
LHASH_HASH_FN(index_name_hash),
LHASH_COMP_FN(index_name_cmp)))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
BIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\n",
db->error,db->arg1,db->arg2);
goto err;
}
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
/*****************************************************************/
/* Update the db file for expired certificates */
if (doupdatedb)
{
if (verbose)
BIO_printf(bio_err, "Updating %s ...\n",
dbfile);
i = do_updatedb(db);
if (i == -1)
{
BIO_printf(bio_err,"Malloc failure\n");
goto err;
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
}
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
else if (i == 0)
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
{
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
if (verbose) BIO_printf(bio_err,
"No entries found to mark expired\n");
}
else
{
out = BIO_new(BIO_s_file());
if (out == NULL)
{
ERR_print_errors(bio_err);
goto err;
}
VMS doesn't support more than on period in a file name
2001-05-22 20:47:38 +08:00
#ifndef OPENSSL_SYS_VMS
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
j = BIO_snprintf(buf[0], sizeof buf[0], "%s.new", dbfile);
VMS doesn't support more than on period in a file name
2001-05-22 20:47:38 +08:00
#else
j = BIO_snprintf(buf[0], sizeof buf[0], "%s-new", dbfile);
#endif
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
if (j < 0 || j >= sizeof buf[0])
{
BIO_printf(bio_err, "file name too long\n");
goto err;
}
if (BIO_write_filename(out,buf[0]) <= 0)
{
perror(dbfile);
BIO_printf(bio_err,"unable to open '%s'\n",
dbfile);
goto err;
}
j=TXT_DB_write(out,db);
if (j <= 0) goto err;
BIO_free(out);
out = NULL;
VMS doesn't support more than on period in a file name
2001-05-22 20:47:38 +08:00
#ifndef OPENSSL_SYS_VMS
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
j = BIO_snprintf(buf[1], sizeof buf[1], "%s.old", dbfile);
VMS doesn't support more than on period in a file name
2001-05-22 20:47:38 +08:00
#else
j = BIO_snprintf(buf[1], sizeof buf[1], "%s-old", dbfile);
#endif
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
if (j < 0 || j >= sizeof buf[1])
{
BIO_printf(bio_err, "file name too long\n");
goto err;
}
if (rename(dbfile,buf[1]) < 0)
{
BIO_printf(bio_err,
"unable to rename %s to %s\n",
dbfile, buf[1]);
perror("reason");
goto err;
}
if (rename(buf[0],dbfile) < 0)
{
BIO_printf(bio_err,
"unable to rename %s to %s\n",
buf[0],dbfile);
perror("reason");
rename(buf[1],dbfile);
goto err;
}
if (verbose) BIO_printf(bio_err,
"Done. %d entries marked as expired\n",i);
}
goto err;
}
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
/*****************************************************************/
/* Read extentions config file */
if (extfile)
{
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
extconf = NCONF_new(NULL);
if (NCONF_load(extconf,extfile,&errorline) <= 0)
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
{
if (errorline <= 0)
BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
extfile);
else
BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
errorline,extfile);
ret = 1;
goto err;
}
if (verbose)
BIO_printf(bio_err, "Succesfully loaded extensions file %s\n", extfile);
/* We can have sections in the ext file */
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
extensions = "default";
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
}
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
/*****************************************************************/
if (req || gencrl)
{
if (outfile != NULL)
{
if (BIO_write_filename(Sout,outfile) <= 0)
{
perror(outfile);
goto err;
}
}
else
On VMS, stdout may very well lead to a file that is written to in a record-oriented fashion. That means that every write() will write a separate record, which will be read separately by the programs trying to read from it. This can be very confusing. The solution is to put a BIO filter in the way that will buffer text until a linefeed is reached, and then write everything a line at a time, so every record written will be an actual line, not chunks of lines and not (usually doesn't happen, but I've seen it once) several lines in one record. Voila, BIO_f_linebuffer() is born. Since we're so close to release time, I'm making this VMS-only for now, just to make sure no code is needlessly broken by this. After the release, this BIO method will be enabled on all other platforms as well.
2000-09-20 21:55:50 +08:00
{
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
Use new-style system-id macros everywhere possible. I hope I haven't missed any. This compiles and runs on Linux, and external applications have no problems with it. The definite test will be to build this on VMS.
2001-02-20 16:13:47 +08:00
#ifdef OPENSSL_SYS_VMS
On VMS, stdout may very well lead to a file that is written to in a record-oriented fashion. That means that every write() will write a separate record, which will be read separately by the programs trying to read from it. This can be very confusing. The solution is to put a BIO filter in the way that will buffer text until a linefeed is reached, and then write everything a line at a time, so every record written will be an actual line, not chunks of lines and not (usually doesn't happen, but I've seen it once) several lines in one record. Voila, BIO_f_linebuffer() is born. Since we're so close to release time, I'm making this VMS-only for now, just to make sure no code is needlessly broken by this. After the release, this BIO method will be enabled on all other platforms as well.
2000-09-20 21:55:50 +08:00
{
BIO *tmpbio = BIO_new(BIO_f_linebuffer());
Sout = BIO_push(tmpbio, Sout);
}
#endif
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
if (req)
{
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if ((md == NULL) && ((md=NCONF_get_string(conf,
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
section,ENV_DEFAULT_MD)) == NULL))
{
lookup_fail(section,ENV_DEFAULT_MD);
goto err;
}
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
{
if(strcmp(tmp_email_dn,"no") == 0)
email_dn=0;
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if ((dgst=EVP_get_digestbyname(md)) == NULL)
{
BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
goto err;
}
if (verbose)
BIO_printf(bio_err,"message digest is %s\n",
OBJ_nid2ln(dgst->type));
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if ((policy == NULL) && ((policy=NCONF_get_string(conf,
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
section,ENV_POLICY)) == NULL))
{
lookup_fail(section,ENV_POLICY);
goto err;
}
if (verbose)
BIO_printf(bio_err,"policy is %s\n",policy);
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
== NULL)
{
lookup_fail(section,ENV_SERIAL);
goto err;
}
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
if (!extconf)
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
{
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
/* no '-extfile' option, so we look for extensions
* in the main configuration file */
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
if (!extensions)
{
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
extensions=NCONF_get_string(conf,section,
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
ENV_EXTENSIONS);
if (!extensions)
ERR_clear_error();
}
if (extensions)
{
/* Check syntax of file */
X509V3_CTX ctx;
X509V3_set_ctx_test(&ctx);
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
X509V3_set_nconf(&ctx, conf);
if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
NULL))
{
BIO_printf(bio_err,
"Error Loading extension section %s\n",
Still more X509 V3 stuff. Modify ca.c to work with the new code and modify openssl.cnf for the new syntax.
1999-01-26 09:19:27 +08:00
extensions);
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
ret = 1;
goto err;
}
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
if (startdate == NULL)
{
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
startdate=NCONF_get_string(conf,section,
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
ENV_DEFAULT_STARTDATE);
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
if (startdate == NULL)
ERR_clear_error();
Fix -startdate and -enddate arguments to 'ca' program. Also update NEWS file with some 0.9.4 changes.
1999-08-07 05:47:09 +08:00
}
if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))
{
BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");
goto err;
}
if (startdate == NULL) startdate="today";
if (enddate == NULL)
{
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
enddate=NCONF_get_string(conf,section,
Fix -startdate and -enddate arguments to 'ca' program. Also update NEWS file with some 0.9.4 changes.
1999-08-07 05:47:09 +08:00
ENV_DEFAULT_ENDDATE);
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
if (enddate == NULL)
ERR_clear_error();
Fix -startdate and -enddate arguments to 'ca' program. Also update NEWS file with some 0.9.4 changes.
1999-08-07 05:47:09 +08:00
}
if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))
{
BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");
goto err;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (days == 0)
{
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
days = 0;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
Fix -startdate and -enddate arguments to 'ca' program. Also update NEWS file with some 0.9.4 changes.
1999-08-07 05:47:09 +08:00
if (!enddate && (days == 0))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
goto err;
}
if ((serial=load_serial(serialfile)) == NULL)
{
BIO_printf(bio_err,"error while loading serial number\n");
goto err;
}
if (verbose)
{
BN_bn2hex() returns "0" instead of "00" for zero. This disrputs the requirement that the serial number always be an even amount of characters. PR: 248
2002-10-11 17:38:56 +08:00
if (BN_is_zero(serial))
BIO_printf(bio_err,"next serial number is 00\n");
else
{
if ((f=BN_bn2hex(serial)) == NULL) goto err;
BIO_printf(bio_err,"next serial number is %s\n",f);
OPENSSL_free(f);
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if ((attribs=NCONF_get_section(conf,policy)) == NULL)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
goto err;
}
Typesafety thought police.
2000-05-16 22:38:29 +08:00
if ((cert_sk=sk_X509_new_null()) == NULL)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
if (spkac_file != NULL)
{
total++;
j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
serial,subj,email_dn,startdate,enddate,days,extensions,
conf,verbose,certopt,nameopt,default_op,ext_copy);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (j < 0) goto err;
if (j > 0)
{
total_done++;
BIO_printf(bio_err,"\n");
if (!BN_add_word(serial,1)) goto err;
Typesafety thought police.
2000-05-16 22:38:29 +08:00
if (!sk_X509_push(cert_sk,x))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
if (outfile)
{
output_der = 1;
batch = 1;
}
}
}
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
if (ss_cert_file != NULL)
{
total++;
j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
db,serial,subj,email_dn,startdate,enddate,days,batch,
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
extensions,conf,verbose, certopt, nameopt,
Make better use of load_cert, load_certs and load_key.
2001-06-27 17:12:43 +08:00
default_op, ext_copy, e);
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
if (j < 0) goto err;
if (j > 0)
{
total_done++;
BIO_printf(bio_err,"\n");
if (!BN_add_word(serial,1)) goto err;
Typesafety thought police.
2000-05-16 22:38:29 +08:00
if (!sk_X509_push(cert_sk,x))
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
{
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
goto err;
}
}
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (infile != NULL)
{
total++;
j=certify(&x,infile,pkey,x509,dgst,attribs,db,
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
serial,subj,email_dn,startdate,enddate,days,batch,
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
extensions,conf,verbose, certopt, nameopt,
default_op, ext_copy);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (j < 0) goto err;
if (j > 0)
{
total_done++;
BIO_printf(bio_err,"\n");
if (!BN_add_word(serial,1)) goto err;
Typesafety thought police.
2000-05-16 22:38:29 +08:00
if (!sk_X509_push(cert_sk,x))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
}
}
for (i=0; i<argc; i++)
{
total++;
j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
serial,subj,email_dn,startdate,enddate,days,batch,
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
extensions,conf,verbose, certopt, nameopt,
default_op, ext_copy);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (j < 0) goto err;
if (j > 0)
{
total_done++;
BIO_printf(bio_err,"\n");
if (!BN_add_word(serial,1)) goto err;
Typesafety thought police.
2000-05-16 22:38:29 +08:00
if (!sk_X509_push(cert_sk,x))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
}
}
/* we have a stack of newly certified certificates
* and a data base and serial number that need
* updating */
Typesafety thought police.
2000-05-16 22:38:29 +08:00
if (sk_X509_num(cert_sk) > 0)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
if (!batch)
{
BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
Avoid warnings.
1999-06-11 00:29:32 +08:00
(void)BIO_flush(bio_err);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
buf[0][0]='\0';
fgets(buf[0],10,stdin);
if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
{
BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
ret=0;
goto err;
}
}
Typesafety thought police.
2000-05-16 22:38:29 +08:00
BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
if(strlen(serialfile) > BSIZE-5 || strlen(dbfile) > BSIZE-5)
{
BIO_printf(bio_err,"file name too long\n");
goto err;
}
strcpy(buf[0],serialfile);
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
Use new-style system-id macros everywhere possible. I hope I haven't missed any. This compiles and runs on Linux, and external applications have no problems with it. The definite test will be to build this on VMS.
2001-02-20 16:13:47 +08:00
#ifdef OPENSSL_SYS_VMS
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
strcat(buf[0],"-new");
#else
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
strcat(buf[0],".new");
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
#endif
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (!save_serial(buf[0],serial)) goto err;
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
strcpy(buf[1],dbfile);
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
Use new-style system-id macros everywhere possible. I hope I haven't missed any. This compiles and runs on Linux, and external applications have no problems with it. The definite test will be to build this on VMS.
2001-02-20 16:13:47 +08:00
#ifdef OPENSSL_SYS_VMS
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
strcat(buf[1],"-new");
#else
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
strcat(buf[1],".new");
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
#endif
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (BIO_write_filename(out,buf[1]) <= 0)
{
perror(dbfile);
BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
goto err;
}
l=TXT_DB_write(out,db);
if (l <= 0) goto err;
}
if (verbose)
BIO_printf(bio_err,"writing new certificates\n");
Typesafety thought police.
2000-05-16 22:38:29 +08:00
for (i=0; i<sk_X509_num(cert_sk); i++)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
int k;
unsigned char *n;
Typesafety thought police.
2000-05-16 22:38:29 +08:00
x=sk_X509_value(cert_sk,i);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
j=x->cert_info->serialNumber->length;
p=(char *)x->cert_info->serialNumber->data;
Remove warnings.
2002-11-14 23:57:38 +08:00
if(strlen(outdir) >= (size_t)(j ? BSIZE-j*2-6 : BSIZE-8))
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
{
BIO_printf(bio_err,"certificate file name too long\n");
goto err;
}
strcpy(buf[2],outdir);
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
Use new-style system-id macros everywhere possible. I hope I haven't missed any. This compiles and runs on Linux, and external applications have no problems with it. The definite test will be to build this on VMS.
2001-02-20 16:13:47 +08:00
#ifndef OPENSSL_SYS_VMS
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
strcat(buf[2],"/");
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
#endif
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
n=(unsigned char *)&(buf[2][strlen(buf[2])]);
if (j > 0)
{
for (k=0; k<j; k++)
{
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
sprintf((char *)n,"%02X",(unsigned char)*(p++));
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
n+=2;
}
}
else
{
*(n++)='0';
*(n++)='0';
}
*(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
*n='\0';
if (verbose)
BIO_printf(bio_err,"writing %s\n",buf[2]);
if (BIO_write_filename(Cout,buf[2]) <= 0)
{
perror(buf[2]);
goto err;
}
Add new -notext option to 'ca', -pubkey option to spkac. Remove some "WTF??" casts from applications. Fixes to keep VC++ happy and avoid warnings. Docs tidy.
2000-02-03 10:56:48 +08:00
write_new_certificate(Cout,x, 0, notext);
write_new_certificate(Sout,x, output_der, notext);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
Typesafety thought police.
2000-05-16 22:38:29 +08:00
if (sk_X509_num(cert_sk))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
/* Rename the database and the serial file */
strncpy(buf[2],serialfile,BSIZE-4);
Increase internal security when using strncpy, by making sure the resulting string is NUL-terminated
2002-02-28 20:42:19 +08:00
buf[2][BSIZE-4]='\0';
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
Use new-style system-id macros everywhere possible. I hope I haven't missed any. This compiles and runs on Linux, and external applications have no problems with it. The definite test will be to build this on VMS.
2001-02-20 16:13:47 +08:00
#ifdef OPENSSL_SYS_VMS
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
strcat(buf[2],"-old");
#else
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
strcat(buf[2],".old");
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
#endif
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
BIO_free(in);
On VMS, stdout may very well lead to a file that is written to in a record-oriented fashion. That means that every write() will write a separate record, which will be read separately by the programs trying to read from it. This can be very confusing. The solution is to put a BIO filter in the way that will buffer text until a linefeed is reached, and then write everything a line at a time, so every record written will be an actual line, not chunks of lines and not (usually doesn't happen, but I've seen it once) several lines in one record. Voila, BIO_f_linebuffer() is born. Since we're so close to release time, I'm making this VMS-only for now, just to make sure no code is needlessly broken by this. After the release, this BIO method will be enabled on all other platforms as well.
2000-09-20 21:55:50 +08:00
BIO_free_all(out);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
in=NULL;
out=NULL;
if (rename(serialfile,buf[2]) < 0)
{
ispell (and minor modifications)
2000-02-04 07:23:24 +08:00
BIO_printf(bio_err,"unable to rename %s to %s\n",
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
serialfile,buf[2]);
perror("reason");
goto err;
}
if (rename(buf[0],serialfile) < 0)
{
ispell (and minor modifications)
2000-02-04 07:23:24 +08:00
BIO_printf(bio_err,"unable to rename %s to %s\n",
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
buf[0],serialfile);
perror("reason");
rename(buf[2],serialfile);
goto err;
}
strncpy(buf[2],dbfile,BSIZE-4);
Increase internal security when using strncpy, by making sure the resulting string is NUL-terminated
2002-02-28 20:42:19 +08:00
buf[2][BSIZE-4]='\0';
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
Use new-style system-id macros everywhere possible. I hope I haven't missed any. This compiles and runs on Linux, and external applications have no problems with it. The definite test will be to build this on VMS.
2001-02-20 16:13:47 +08:00
#ifdef OPENSSL_SYS_VMS
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
strcat(buf[2],"-old");
#else
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
strcat(buf[2],".old");
VMS support. Submitted by: Richard Levitte <richard@levitte.org>
1999-05-13 19:37:32 +08:00
#endif
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (rename(dbfile,buf[2]) < 0)
{
ispell (and minor modifications)
2000-02-04 07:23:24 +08:00
BIO_printf(bio_err,"unable to rename %s to %s\n",
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
dbfile,buf[2]);
perror("reason");
goto err;
}
if (rename(buf[1],dbfile) < 0)
{
ispell (and minor modifications)
2000-02-04 07:23:24 +08:00
BIO_printf(bio_err,"unable to rename %s to %s\n",
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
buf[1],dbfile);
perror("reason");
rename(buf[2],dbfile);
goto err;
}
BIO_printf(bio_err,"Data Base Updated\n");
}
}
/*****************************************************************/
if (gencrl)
{
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
int crl_v2 = 0;
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
if (!crl_ext)
{
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
if (!crl_ext)
ERR_clear_error();
}
if (crl_ext)
{
Added support for adding extensions to CRLs, also fix a memory leak and make 'req' check the config file syntax before it adds extensions. Added info in the documentation as well.
1999-03-07 03:33:29 +08:00
/* Check syntax of file */
Initial support for Certificate Policies extension: print out works but setting isn't fully implemented (yet).
1999-04-19 07:21:03 +08:00
X509V3_CTX ctx;
X509V3_set_ctx_test(&ctx);
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
X509V3_set_nconf(&ctx, conf);
if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
{
Added support for adding extensions to CRLs, also fix a memory leak and make 'req' check the config file syntax before it adds extensions. Added info in the documentation as well.
1999-03-07 03:33:29 +08:00
BIO_printf(bio_err,
"Error Loading CRL extension section %s\n",
crl_ext);
ret = 1;
goto err;
If CONF_get_string returns NULL and we want to tolerate this (e.g., use a default), we have to call ERR_clear_error().
2000-12-16 00:59:49 +08:00
}
Added support for adding extensions to CRLs, also fix a memory leak and make 'req' check the config file syntax before it adds extensions. Added info in the documentation as well.
1999-03-07 03:33:29 +08:00
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (!crldays && !crlhours)
{
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if (!NCONF_get_number(conf,section,
ENV_DEFAULT_CRL_DAYS, &crldays))
crldays = 0;
if (!NCONF_get_number(conf,section,
ENV_DEFAULT_CRL_HOURS, &crlhours))
crlhours = 0;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
if ((crldays == 0) && (crlhours == 0))
{
Fix bug introduced with revision 1.95 when this filed was modified to use the new X509_CRL_set_issuer_name() function: The CRL issuer should be X509_get_subject_name(x509), not X509_get_issuer_name(x509). Submitted by: Juergen Lesny <lesnyj@informatik.tu-muenchen.de> typo
2002-07-18 19:23:50 +08:00
BIO_printf(bio_err,"cannot lookup how long until the next CRL is issued\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
if (verbose) BIO_printf(bio_err,"making CRL\n");
if ((crl=X509_CRL_new()) == NULL) goto err;
Fix bug introduced with revision 1.95 when this filed was modified to use the new X509_CRL_set_issuer_name() function: The CRL issuer should be X509_get_subject_name(x509), not X509_get_issuer_name(x509). Submitted by: Juergen Lesny <lesnyj@informatik.tu-muenchen.de> typo
2002-07-18 19:23:50 +08:00
if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509))) goto err;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
tmptm = ASN1_TIME_new();
if (!tmptm) goto err;
X509_gmtime_adj(tmptm,0);
X509_CRL_set_lastUpdate(crl, tmptm);
X509_gmtime_adj(tmptm,(crldays*24+crlhours)*60*60);
X509_CRL_set_nextUpdate(crl, tmptm);
ASN1_TIME_free(tmptm);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
for (i=0; i<sk_num(db->data); i++)
{
pp=(char **)sk_value(db->data,i);
if (pp[DB_type][0] == DB_TYPE_REV)
{
if ((r=X509_REVOKED_new()) == NULL) goto err;
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
j = make_revoked(r, pp[DB_rev_date]);
if (!j) goto err;
if (j == 2) crl_v2 = 1;
New -set_serial options to 'req' and 'x509'. Remove the old broken bio read of serial numbers in the 'ca' index file. This would choke if a revoked certificate was specified with a negative serial number. Fix typo in uid.c
2001-02-19 21:38:32 +08:00
if (!BN_hex2bn(&serial, pp[DB_serial]))
goto err;
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
tmpser = BN_to_ASN1_INTEGER(serial, NULL);
New -set_serial options to 'req' and 'x509'. Remove the old broken bio read of serial numbers in the 'ca' index file. This would choke if a revoked certificate was specified with a negative serial number. Fix typo in uid.c
2001-02-19 21:38:32 +08:00
BN_free(serial);
serial = NULL;
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
if (!tmpser)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
X509_REVOKED_set_serialNumber(r, tmpser);
ASN1_INTEGER_free(tmpser);
Merge from the ASN1 branch of new ASN1 code to main trunk. Lets see if the makes it to openssl-cvs :-)
2000-12-09 03:09:35 +08:00
X509_CRL_add0_revoked(crl,r);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
}
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
/* sort the data so it will be written in serial
* number order */
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
X509_CRL_sort(crl);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Incorporation of RSEs assembled patches
1998-12-22 23:59:57 +08:00
/* we now have a CRL */
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (verbose) BIO_printf(bio_err,"signing CRL\n");
if (md != NULL)
{
if ((dgst=EVP_get_digestbyname(md)) == NULL)
{
BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
goto err;
}
}
else
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
{
Make all configuration macros available for application by making sure they are available in opensslconf.h, by giving them names starting with "OPENSSL_" to avoid conflicts with other packages and by making sure e_os2.h will cover all platform-specific cases together with opensslconf.h. I've checked fairly well that nothing breaks with this (apart from external software that will adapt if they have used something like NO_KRB5), but I can't guarantee it completely, so a review of this change would be a good thing.
2001-02-20 00:06:34 +08:00
#ifndef OPENSSL_NO_DSA
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
if (pkey->type == EVP_PKEY_DSA)
dgst=EVP_dss1();
else
ECDSA support Submitted by: Nils Larsch <nla@trustcenter.de>
2002-02-14 02:21:51 +08:00
#endif
#ifndef OPENSSL_NO_ECDSA
get rid of EVP_PKEY_ECDSA (now we have EVP_PKEY_EC instead) Submitted by: Nils Larsch
2002-08-12 16:47:41 +08:00
if (pkey->type == EVP_PKEY_EC)
ECDSA support Submitted by: Nils Larsch <nla@trustcenter.de>
2002-02-14 02:21:51 +08:00
dgst=EVP_ecdsa();
else
Incorporation of RSEs assembled patches
1998-12-22 23:59:57 +08:00
#endif
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
dgst=EVP_md5();
}
Remove pointless MD5 hash. Contributed by: Anonymous <nobody@replay.com>
1999-01-17 22:14:41 +08:00
Added support for adding extensions to CRLs, also fix a memory leak and make 'req' check the config file syntax before it adds extensions. Added info in the documentation as well.
1999-03-07 03:33:29 +08:00
/* Add any extensions asked for */
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
if (crl_ext)
{
X509V3_CTX crlctx;
X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
X509V3_set_nconf(&crlctx, conf);
Added support for adding extensions to CRLs, also fix a memory leak and make 'req' check the config file syntax before it adds extensions. Added info in the documentation as well.
1999-03-07 03:33:29 +08:00
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
crl_ext, crl)) goto err;
}
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
if (crl_ext || crl_v2)
{
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
if (!X509_CRL_set_version(crl, 1))
goto err; /* version 2 CRL */
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
}
Added support for adding extensions to CRLs, also fix a memory leak and make 'req' check the config file syntax before it adds extensions. Added info in the documentation as well.
1999-03-07 03:33:29 +08:00
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
PEM_write_bio_X509_CRL(Sout,crl);
}
/*****************************************************************/
gcc claims this is a shadow, though I can't find what it is shadowing...
1999-04-13 01:17:39 +08:00
if (dorevoke)
Add `openssl ca -revoke <certfile>' facility which revokes a certificate specified in <certfile> by updating the entry in the index.txt file. This way one no longer has to edit the index.txt file manually for revoking a certificate. The -revoke option does the gory details now. Submitted by: Massimiliano Pala <madwolf@openca.org> Cleaned up and integrated by: Ralf S. Engelschall
1999-04-12 19:45:14 +08:00
{
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
if (infile == NULL)
{
BIO_printf(bio_err,"no input files\n");
goto err;
}
Add `openssl ca -revoke <certfile>' facility which revokes a certificate specified in <certfile> by updating the entry in the index.txt file. This way one no longer has to edit the index.txt file manually for revoking a certificate. The -revoke option does the gory details now. Submitted by: Massimiliano Pala <madwolf@openca.org> Cleaned up and integrated by: Ralf S. Engelschall
1999-04-12 19:45:14 +08:00
else
{
Fix to the -revoke option in ca. It was leaking memory, crashing and just plain not working :-( Also fix some memory leaks in the new X509_NAME code. Fix so new app_rand code doesn't crash 'x509' and move #include so it compiles under Win32.
1999-11-08 21:58:08 +08:00
X509 *revcert;
Make better use of load_cert, load_certs and load_key.
2001-06-27 17:12:43 +08:00
revcert=load_cert(bio_err, infile, FORMAT_PEM,
NULL, e, infile);
Fix to the -revoke option in ca. It was leaking memory, crashing and just plain not working :-( Also fix some memory leaks in the new X509_NAME code. Fix so new app_rand code doesn't crash 'x509' and move #include so it compiles under Win32.
1999-11-08 21:58:08 +08:00
if (revcert == NULL)
Add `openssl ca -revoke <certfile>' facility which revokes a certificate specified in <certfile> by updating the entry in the index.txt file. This way one no longer has to edit the index.txt file manually for revoking a certificate. The -revoke option does the gory details now. Submitted by: Massimiliano Pala <madwolf@openca.org> Cleaned up and integrated by: Ralf S. Engelschall
1999-04-12 19:45:14 +08:00
goto err;
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
j=do_revoke(revcert,db, rev_type, rev_arg);
Fix to the -revoke option in ca. It was leaking memory, crashing and just plain not working :-( Also fix some memory leaks in the new X509_NAME code. Fix so new app_rand code doesn't crash 'x509' and move #include so it compiles under Win32.
1999-11-08 21:58:08 +08:00
if (j <= 0) goto err;
X509_free(revcert);
Add `openssl ca -revoke <certfile>' facility which revokes a certificate specified in <certfile> by updating the entry in the index.txt file. This way one no longer has to edit the index.txt file manually for revoking a certificate. The -revoke option does the gory details now. Submitted by: Massimiliano Pala <madwolf@openca.org> Cleaned up and integrated by: Ralf S. Engelschall
1999-04-12 19:45:14 +08:00
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
if(strlen(dbfile) > BSIZE-5)
{
BIO_printf(bio_err,"filename too long\n");
goto err;
}
strcpy(buf[0],dbfile);
VMS doesn't support more than on period in a file name
2001-05-22 20:47:38 +08:00
#ifndef OPENSSL_SYS_VMS
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
strcat(buf[0],".new");
VMS doesn't support more than on period in a file name
2001-05-22 20:47:38 +08:00
#else
strcat(buf[0],"-new");
#endif
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
if (BIO_write_filename(out,buf[0]) <= 0)
{
perror(dbfile);
BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
goto err;
}
j=TXT_DB_write(out,db);
if (j <= 0) goto err;
strncpy(buf[1],dbfile,BSIZE-4);
Increase internal security when using strncpy, by making sure the resulting string is NUL-terminated
2002-02-28 20:42:19 +08:00
buf[1][BSIZE-4]='\0';
VMS doesn't support more than on period in a file name
2001-05-22 20:47:38 +08:00
#ifndef OPENSSL_SYS_VMS
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
strcat(buf[1],".old");
VMS doesn't support more than on period in a file name
2001-05-22 20:47:38 +08:00
#else
strcat(buf[1],"-old");
#endif
Fix the Win32_rename() function so it correctly returns an error code. Use the same code in Win9X and NT. Fix some ca.c options so they work under Win32: unlink/rename wont work under Win32 unless the file is closed.
2002-03-09 03:11:15 +08:00
BIO_free(in);
in = NULL;
BIO_free(out);
out = NULL;
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
if (rename(dbfile,buf[1]) < 0)
{
BIO_printf(bio_err,"unable to rename %s to %s\n", dbfile, buf[1]);
perror("reason");
goto err;
}
if (rename(buf[0],dbfile) < 0)
{
BIO_printf(bio_err,"unable to rename %s to %s\n", buf[0],dbfile);
perror("reason");
rename(buf[1],dbfile);
goto err;
}
BIO_printf(bio_err,"Data Base Updated\n");
}
Add `openssl ca -revoke <certfile>' facility which revokes a certificate specified in <certfile> by updating the entry in the index.txt file. This way one no longer has to edit the index.txt file manually for revoking a certificate. The -revoke option does the gory details now. Submitted by: Massimiliano Pala <madwolf@openca.org> Cleaned up and integrated by: Ralf S. Engelschall
1999-04-12 19:45:14 +08:00
}
/*****************************************************************/
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
ret=0;
err:
Security fixes brought forward from 0.9.7.
2002-11-13 23:43:43 +08:00
if(tofree)
OPENSSL_free(tofree);
On VMS, stdout may very well lead to a file that is written to in a record-oriented fashion. That means that every write() will write a separate record, which will be read separately by the programs trying to read from it. This can be very confusing. The solution is to put a BIO filter in the way that will buffer text until a linefeed is reached, and then write everything a line at a time, so every record written will be an actual line, not chunks of lines and not (usually doesn't happen, but I've seen it once) several lines in one record. Voila, BIO_f_linebuffer() is born. Since we're so close to release time, I'm making this VMS-only for now, just to make sure no code is needlessly broken by this. After the release, this BIO method will be enabled on all other platforms as well.
2000-09-20 21:55:50 +08:00
BIO_free_all(Cout);
BIO_free_all(Sout);
BIO_free_all(out);
Make better use of load_cert, load_certs and load_key.
2001-06-27 17:12:43 +08:00
BIO_free_all(in);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Typesafety thought police.
2000-05-16 22:38:29 +08:00
sk_X509_pop_free(cert_sk,X509_free);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (ret) ERR_print_errors(bio_err);
Various randomness handling bugfixes and improvements -- some utilities that should have used RANDFILE did not, and -rand handling was broken except in genrsa.
1999-10-26 09:56:29 +08:00
app_RAND_write_file(randfile, bio_err);
Make -passin -passout etc work again. Fix leak in ca.c when using -passin.
2001-08-17 09:09:54 +08:00
if (free_key)
OPENSSL_free(key);
Redo the way 'req' and 'ca' add objects: add support for oid_section.
1999-02-23 08:07:46 +08:00
BN_free(serial);
TXT_DB_free(db);
EVP_PKEY_free(pkey);
X509_free(x509);
X509_CRL_free(crl);
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
NCONF_free(conf);
Redo the way 'req' and 'ca' add objects: add support for oid_section.
1999-02-23 08:07:46 +08:00
OBJ_cleanup();
Make better use of load_cert, load_certs and load_key.
2001-06-27 17:12:43 +08:00
apps_shutdown();
EXIT() may mean return(). That's confusing, so let's have it really mean exit() in whatever way works for the intended platform, and define OPENSSL_EXIT() to have the old meaning (the name is of course because it's only used in the openssl program)
2002-12-04 00:33:03 +08:00
OPENSSL_EXIT(ret);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
Change functions to ANSI C.
1999-04-20 05:31:43 +08:00
static void lookup_fail(char *name, char *tag)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
}
Use the new LHASH macros to declare type-safe wrapper functions that can be used as the hash/compare callbacks without function pointer casting. For now, this is just happening in the apps/ directory whilst a few people check the approach. The rest of the library will be moved across to the same idea if there's no problems with this.
2000-12-03 07:16:54 +08:00
static unsigned long index_serial_hash(const char **a)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
Use the new LHASH macros to declare type-safe wrapper functions that can be used as the hash/compare callbacks without function pointer casting. For now, this is just happening in the apps/ directory whilst a few people check the approach. The rest of the library will be moved across to the same idea if there's no problems with this.
2000-12-03 07:16:54 +08:00
const char *n;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
n=a[DB_serial];
while (*n == '0') n++;
return(lh_strhash(n));
}
Use the new LHASH macros to declare type-safe wrapper functions that can be used as the hash/compare callbacks without function pointer casting. For now, this is just happening in the apps/ directory whilst a few people check the approach. The rest of the library will be moved across to the same idea if there's no problems with this.
2000-12-03 07:16:54 +08:00
static int index_serial_cmp(const char **a, const char **b)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
Use the new LHASH macros to declare type-safe wrapper functions that can be used as the hash/compare callbacks without function pointer casting. For now, this is just happening in the apps/ directory whilst a few people check the approach. The rest of the library will be moved across to the same idea if there's no problems with this.
2000-12-03 07:16:54 +08:00
const char *aa,*bb;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
for (aa=a[DB_serial]; *aa == '0'; aa++);
for (bb=b[DB_serial]; *bb == '0'; bb++);
return(strcmp(aa,bb));
}
Use the new LHASH macros to declare type-safe wrapper functions that can be used as the hash/compare callbacks without function pointer casting. For now, this is just happening in the apps/ directory whilst a few people check the approach. The rest of the library will be moved across to the same idea if there's no problems with this.
2000-12-03 07:16:54 +08:00
static unsigned long index_name_hash(const char **a)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{ return(lh_strhash(a[DB_name])); }
Change functions to ANSI C.
1999-04-20 05:31:43 +08:00
static int index_name_qual(char **a)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{ return(a[0][0] == 'V'); }
Use the new LHASH macros to declare type-safe wrapper functions that can be used as the hash/compare callbacks without function pointer casting. For now, this is just happening in the apps/ directory whilst a few people check the approach. The rest of the library will be moved across to the same idea if there's no problems with this.
2000-12-03 07:16:54 +08:00
static int index_name_cmp(const char **a, const char **b)
Change functions to ANSI C.
1999-04-20 05:31:43 +08:00
{ return(strcmp(a[DB_name],
b[DB_name])); }
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Change functions to ANSI C.
1999-04-20 05:31:43 +08:00
static BIGNUM *load_serial(char *serialfile)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
BIO *in=NULL;
BIGNUM *ret=NULL;
MS_STATIC char buf[1024];
ASN1_INTEGER *ai=NULL;
if ((in=BIO_new(BIO_s_file())) == NULL)
{
ERR_print_errors(bio_err);
goto err;
}
if (BIO_read_filename(in,serialfile) <= 0)
{
perror(serialfile);
goto err;
}
ai=ASN1_INTEGER_new();
if (ai == NULL) goto err;
if (!a2i_ASN1_INTEGER(in,ai,buf,1024))
{
BIO_printf(bio_err,"unable to load number from %s\n",
serialfile);
goto err;
}
ret=ASN1_INTEGER_to_BN(ai,NULL);
if (ret == NULL)
{
Add missing LF
2002-10-09 14:35:47 +08:00
BIO_printf(bio_err,"error converting number from bin to BIGNUM\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
err:
if (in != NULL) BIO_free(in);
if (ai != NULL) ASN1_INTEGER_free(ai);
return(ret);
}
Change functions to ANSI C.
1999-04-20 05:31:43 +08:00
static int save_serial(char *serialfile, BIGNUM *serial)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
BIO *out;
int ret=0;
ASN1_INTEGER *ai=NULL;
out=BIO_new(BIO_s_file());
if (out == NULL)
{
ERR_print_errors(bio_err);
goto err;
}
if (BIO_write_filename(out,serialfile) <= 0)
{
perror(serialfile);
goto err;
}
if ((ai=BN_to_ASN1_INTEGER(serial,NULL)) == NULL)
{
BIO_printf(bio_err,"error converting serial to ASN.1 format\n");
goto err;
}
i2a_ASN1_INTEGER(out,ai);
BIO_puts(out,"\n");
ret=1;
err:
On VMS, stdout may very well lead to a file that is written to in a record-oriented fashion. That means that every write() will write a separate record, which will be read separately by the programs trying to read from it. This can be very confusing. The solution is to put a BIO filter in the way that will buffer text until a linefeed is reached, and then write everything a line at a time, so every record written will be an actual line, not chunks of lines and not (usually doesn't happen, but I've seen it once) several lines in one record. Voila, BIO_f_linebuffer() is born. Since we're so close to release time, I'm making this VMS-only for now, just to make sure no code is needlessly broken by this. After the release, this BIO method will be enabled on all other platforms as well.
2000-09-20 21:55:50 +08:00
if (out != NULL) BIO_free_all(out);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (ai != NULL) ASN1_INTEGER_free(ai);
return(ret);
}
Change functions to ANSI C.
1999-04-20 05:31:43 +08:00
static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
long days, int batch, char *ext_sect, CONF *lconf, int verbose,
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
unsigned long certopt, unsigned long nameopt, int default_op,
int ext_copy)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
X509_REQ *req=NULL;
BIO *in=NULL;
EVP_PKEY *pktmp=NULL;
int ok= -1,i;
in=BIO_new(BIO_s_file());
if (BIO_read_filename(in,infile) <= 0)
{
perror(infile);
goto err;
}
Additional user data argument to pem_password_cb function type and to lots of PEM_... functions. Submitted by: Damien Miller <dmiller@ilogic.com.au>
1999-07-22 04:57:16 +08:00
if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
BIO_printf(bio_err,"Error reading certificate request in %s\n",
infile);
goto err;
}
if (verbose)
X509_REQ_print(bio_err,req);
BIO_printf(bio_err,"Check that the request matches the signature\n");
if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
{
BIO_printf(bio_err,"error unpacking public key\n");
goto err;
}
i=X509_REQ_verify(req,pktmp);
More EVP_PKEY patches for new functionality.
1999-01-04 07:00:45 +08:00
EVP_PKEY_free(pktmp);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (i < 0)
{
ok=0;
BIO_printf(bio_err,"Signature verification problems....\n");
goto err;
}
if (i == 0)
{
ok=0;
BIO_printf(bio_err,"Signature did not match the certificate request\n");
goto err;
}
else
BIO_printf(bio_err,"Signature ok\n");
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj, email_dn,
startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
certopt, nameopt, default_op, ext_copy);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
err:
if (req != NULL) X509_REQ_free(req);
if (in != NULL) BIO_free(in);
return(ok);
}
Change functions to ANSI C.
1999-04-20 05:31:43 +08:00
static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
long days, int batch, char *ext_sect, CONF *lconf, int verbose,
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
unsigned long certopt, unsigned long nameopt, int default_op,
Make better use of load_cert, load_certs and load_key.
2001-06-27 17:12:43 +08:00
int ext_copy, ENGINE *e)
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
{
X509 *req=NULL;
X509_REQ *rreq=NULL;
EVP_PKEY *pktmp=NULL;
int ok= -1,i;
Make better use of load_cert, load_certs and load_key.
2001-06-27 17:12:43 +08:00
if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
goto err;
if (verbose)
X509_print(bio_err,req);
BIO_printf(bio_err,"Check that the request matches the signature\n");
if ((pktmp=X509_get_pubkey(req)) == NULL)
{
BIO_printf(bio_err,"error unpacking public key\n");
goto err;
}
i=X509_verify(req,pktmp);
More EVP_PKEY patches for new functionality.
1999-01-04 07:00:45 +08:00
EVP_PKEY_free(pktmp);
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
if (i < 0)
{
ok=0;
BIO_printf(bio_err,"Signature verification problems....\n");
goto err;
}
if (i == 0)
{
ok=0;
Import of old SSLeay release: SSLeay 0.9.1b (unreleased)
1998-12-21 19:00:56 +08:00
BIO_printf(bio_err,"Signature did not match the certificate\n");
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
goto err;
}
else
BIO_printf(bio_err,"Signature ok\n");
if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
goto err;
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
ext_copy);
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
err:
if (rreq != NULL) X509_REQ_free(rreq);
if (req != NULL) X509_free(req);
return(ok);
}
Change functions to ANSI C.
1999-04-20 05:31:43 +08:00
static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial, char *subj,
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
int email_dn, char *startdate, char *enddate, long days, int batch,
int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
unsigned long certopt, unsigned long nameopt, int default_op,
int ext_copy)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
ASN1_UTCTIME *tm,*tmptm;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
ASN1_STRING *str,*str2;
ASN1_OBJECT *obj;
X509 *ret=NULL;
X509_CINF *ci;
X509_NAME_ENTRY *ne;
X509_NAME_ENTRY *tne,*push;
EVP_PKEY *pktmp;
int ok= -1,i,j,last,nid;
char *p;
CONF_VALUE *cv;
char *row[DB_NUMBER],**rrow,**irow=NULL;
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
char buf[25];
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
tmptm=ASN1_UTCTIME_new();
if (tmptm == NULL)
{
BIO_printf(bio_err,"malloc error\n");
return(0);
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
for (i=0; i<DB_NUMBER; i++)
row[i]=NULL;
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
if (subj)
{
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
X509_NAME *n = do_subject(subj, MBSTRING_ASC);
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
if (!n)
{
ERR_print_errors(bio_err);
goto err;
}
X509_REQ_set_subject_name(req,n);
req->req_info->enc.modified = 1;
X509_NAME_free(n);
}
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
if (default_op)
BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
name=X509_REQ_get_subject_name(req);
for (i=0; i<X509_NAME_entry_count(name); i++)
{
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
ne= X509_NAME_get_entry(name,i);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
str=X509_NAME_ENTRY_get_data(ne);
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
obj=X509_NAME_ENTRY_get_object(ne);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (msie_hack)
{
/* assume all type should be strings */
nid=OBJ_obj2nid(ne->object);
if (str->type == V_ASN1_UNIVERSALSTRING)
ASN1_UNIVERSALSTRING_to_string(str);
if ((str->type == V_ASN1_IA5STRING) &&
(nid != NID_pkcs9_emailAddress))
str->type=V_ASN1_T61STRING;
if ((nid == NID_pkcs9_emailAddress) &&
(str->type == V_ASN1_PRINTABLESTRING))
str->type=V_ASN1_IA5STRING;
}
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
/* If no EMAIL is wanted in the subject */
if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
continue;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
/* check some things */
if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
(str->type != V_ASN1_IA5STRING))
{
BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
goto err;
}
Allow ca to certify requests containing BMPStrings and UTF8Strings.
2001-10-28 01:04:47 +08:00
if ((str->type != V_ASN1_BMPSTRING) && (str->type != V_ASN1_UTF8STRING))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
Allow ca to certify requests containing BMPStrings and UTF8Strings.
2001-10-28 01:04:47 +08:00
j=ASN1_PRINTABLE_type(str->data,str->length);
if ( ((j == V_ASN1_T61STRING) &&
(str->type != V_ASN1_T61STRING)) ||
((j == V_ASN1_IA5STRING) &&
(str->type == V_ASN1_PRINTABLESTRING)))
{
BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
goto err;
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
if (default_op)
old_entry_print(bio_err, obj, str);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
/* Ok, now we check the 'policy' stuff. */
if ((subject=X509_NAME_new()) == NULL)
{
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
/* take a copy of the issuer name before we mess with it. */
CAname=X509_NAME_dup(x509->cert_info->subject);
if (CAname == NULL) goto err;
str=str2=NULL;
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
for (i=0; i<sk_CONF_VALUE_num(policy); i++)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
{
BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
goto err;
}
obj=OBJ_nid2obj(j);
last= -1;
for (;;)
{
/* lookup the object in the supplied name list */
j=X509_NAME_get_index_by_OBJ(name,obj,last);
if (j < 0)
{
if (last != -1) break;
tne=NULL;
}
else
{
tne=X509_NAME_get_entry(name,j);
}
last=j;
/* depending on the 'policy', decide what to do. */
push=NULL;
if (strcmp(cv->value,"optional") == 0)
{
if (tne != NULL)
push=tne;
}
else if (strcmp(cv->value,"supplied") == 0)
{
if (tne == NULL)
{
BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
goto err;
}
else
push=tne;
}
else if (strcmp(cv->value,"match") == 0)
{
int last2;
if (tne == NULL)
{
BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
goto err;
}
last2= -1;
again2:
j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
if ((j < 0) && (last2 == -1))
{
BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
goto err;
}
if (j >= 0)
{
push=X509_NAME_get_entry(CAname,j);
str=X509_NAME_ENTRY_get_data(tne);
str2=X509_NAME_ENTRY_get_data(push);
last2=j;
if (ASN1_STRING_cmp(str,str2) != 0)
goto again2;
}
if (j < 0)
{
Fix typo and make ca get the CA and request fields correct.
2000-03-08 20:44:10 +08:00
BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
}
else
{
BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
goto err;
}
if (push != NULL)
{
Continued multibyte character support. Add a bunch of functions to simplify the creation of X509_NAME structures. Change the X509_NAME_entry_add stuff in req/ca so it no longer uses X509_NAME_entry_count(): passing -1 has the same effect.
1999-10-27 08:15:11 +08:00
if (!X509_NAME_add_entry(subject,push, -1, 0))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
if (push != NULL)
X509_NAME_ENTRY_free(push);
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
}
if (j < 0) break;
}
}
if (preserve)
{
X509_NAME_free(subject);
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
/* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
subject=X509_NAME_dup(name);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (subject == NULL) goto err;
}
if (verbose)
ispell (and minor modifications)
2000-02-04 07:23:24 +08:00
BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
/* Build the correct Subject if no e-mail is wanted in the subject */
/* and add it later on because of the method extensions are added (altName) */
Bugfixes for noemailDN option. Make it use the correct name (instead of NULL) if nomailDN is not set, fix memory leaks and retain DN structure when deleting emailAddress.
2001-10-28 01:03:20 +08:00
if (email_dn)
dn_subject = subject;
else
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
{
Bugfixes for noemailDN option. Make it use the correct name (instead of NULL) if nomailDN is not set, fix memory leaks and retain DN structure when deleting emailAddress.
2001-10-28 01:03:20 +08:00
X509_NAME_ENTRY *tmpne;
/* Its best to dup the subject DN and then delete any email
* addresses because this retains its structure.
*/
if (!(dn_subject = X509_NAME_dup(subject)))
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
{
BIO_printf(bio_err,"Memory allocation failure\n");
goto err;
}
Bugfixes for noemailDN option. Make it use the correct name (instead of NULL) if nomailDN is not set, fix memory leaks and retain DN structure when deleting emailAddress.
2001-10-28 01:03:20 +08:00
while((i = X509_NAME_get_index_by_NID(dn_subject,
Fix email address delete code.
2001-11-06 09:44:21 +08:00
NID_pkcs9_emailAddress, -1)) >= 0)
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
{
Bugfixes for noemailDN option. Make it use the correct name (instead of NULL) if nomailDN is not set, fix memory leaks and retain DN structure when deleting emailAddress.
2001-10-28 01:03:20 +08:00
tmpne = X509_NAME_get_entry(dn_subject, i);
X509_NAME_delete_entry(dn_subject, i);
X509_NAME_ENTRY_free(tmpne);
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
}
}
BN_bn2hex() returns "0" instead of "00" for zero. This disrputs the requirement that the serial number always be an even amount of characters. PR: 248
2002-10-11 17:38:56 +08:00
if (BN_is_zero(serial))
row[DB_serial]=BUF_strdup("00");
else
row[DB_serial]=BN_bn2hex(serial);
If the email address is moved from the subject to the subject alternate name, the subject in the certificate would differ from the subject in the index file, which has quite bad concequences. PR: 180
2002-07-31 22:05:57 +08:00
if (row[DB_serial] == NULL)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
rrow=TXT_DB_get_by_index(db,DB_name,row);
if (rrow != NULL)
{
BIO_printf(bio_err,"ERROR:There is already a certificate for %s\n",
row[DB_name]);
}
else
{
rrow=TXT_DB_get_by_index(db,DB_serial,row);
if (rrow != NULL)
{
BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
row[DB_serial]);
BIO_printf(bio_err," check the database/serial_file for corruption\n");
}
}
if (rrow != NULL)
{
BIO_printf(bio_err,
"The matching entry has the following details\n");
if (rrow[DB_type][0] == 'E')
p="Expired";
else if (rrow[DB_type][0] == 'R')
p="Revoked";
else if (rrow[DB_type][0] == 'V')
p="Valid";
else
p="\ninvalid type, Data base error\n";
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
BIO_printf(bio_err,"Type :%s\n",p);;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (rrow[DB_type][0] == 'R')
{
p=rrow[DB_exp_date]; if (p == NULL) p="undef";
BIO_printf(bio_err,"Was revoked on:%s\n",p);
}
p=rrow[DB_exp_date]; if (p == NULL) p="undef";
BIO_printf(bio_err,"Expires on :%s\n",p);
p=rrow[DB_serial]; if (p == NULL) p="undef";
BIO_printf(bio_err,"Serial Number :%s\n",p);
p=rrow[DB_file]; if (p == NULL) p="undef";
BIO_printf(bio_err,"File name :%s\n",p);
p=rrow[DB_name]; if (p == NULL) p="undef";
BIO_printf(bio_err,"Subject Name :%s\n",p);
ok= -1; /* This is now a 'bad' error. */
goto err;
}
ispell (and minor modifications)
2000-02-04 07:23:24 +08:00
/* We are now totally happy, lets make and sign the certificate */
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (verbose)
BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
if ((ret=X509_new()) == NULL) goto err;
ci=ret->cert_info;
#ifdef X509_V3
/* Make it an X509 v3 certificate. */
if (!X509_set_version(x509,2)) goto err;
#endif
if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
goto err;
if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
goto err;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
if (strcmp(startdate,"today") == 0)
X509_gmtime_adj(X509_get_notBefore(ret),0);
Fix -startdate and -enddate arguments to 'ca' program. Also update NEWS file with some 0.9.4 changes.
1999-08-07 05:47:09 +08:00
else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);
if (enddate == NULL)
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 18:56:39 +08:00
X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);
Fix -startdate and -enddate arguments to 'ca' program. Also update NEWS file with some 0.9.4 changes.
1999-08-07 05:47:09 +08:00
else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (!X509_set_subject_name(ret,subject)) goto err;
pktmp=X509_REQ_get_pubkey(req);
More EVP_PKEY patches for new functionality.
1999-01-04 07:00:45 +08:00
i = X509_set_pubkey(ret,pktmp);
EVP_PKEY_free(pktmp);
if (!i) goto err;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
/* Lets add the extensions, if there are any */
Still more X509 V3 stuff. Modify ca.c to work with the new code and modify openssl.cnf for the new syntax.
1999-01-26 09:19:27 +08:00
if (ext_sect)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
More extension code. Incomplete support for subject and issuer alt name, issuer and authority key id. Change the i2v function parameters and add an extra 'crl' parameter in the X509V3_CTX structure: guess what that's for :-) Fix to ASN1 macro which messed up IMPLICIT tag and add f_enum.c which adds a2i, i2a for ENUMERATED.
1999-02-10 09:12:59 +08:00
X509V3_CTX ctx;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (ci->version == NULL)
if ((ci->version=ASN1_INTEGER_new()) == NULL)
goto err;
ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
/* Free the current entries if any, there should not
ispell (and minor modifications)
2000-02-04 07:23:24 +08:00
* be any I believe */
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (ci->extensions != NULL)
Yet another stack.
1999-05-03 05:36:58 +08:00
sk_X509_EXTENSION_pop_free(ci->extensions,
X509_EXTENSION_free);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Still more X509 V3 stuff. Modify ca.c to work with the new code and modify openssl.cnf for the new syntax.
1999-01-26 09:19:27 +08:00
ci->extensions = NULL;
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
/* Initialize the context structure */
Add initial support for r2i RAW extensions which can access the config database add various X509V3_CTX helper functions and support for LHASH as the config database.
1999-04-17 07:57:04 +08:00
X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
More extension code. Incomplete support for subject and issuer alt name, issuer and authority key id. Change the i2v function parameters and add an extra 'crl' parameter in the X509V3_CTX structure: guess what that's for :-) Fix to ASN1 macro which messed up IMPLICIT tag and add f_enum.c which adds a2i, i2a for ENUMERATED.
1999-02-10 09:12:59 +08:00
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
if (extconf)
{
if (verbose)
BIO_printf(bio_err, "Extra configuration file found\n");
/* Use the extconf configuration db LHASH */
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
X509V3_set_nconf(&ctx, extconf);
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
/* Test the structure (needed?) */
/* X509V3_set_ctx_test(&ctx); */
/* Adds exts contained in the configuration file */
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
{
BIO_printf(bio_err,
"ERROR: adding extensions in section %s\n",
ext_sect);
ERR_print_errors(bio_err);
goto err;
}
if (verbose)
BIO_printf(bio_err, "Successfully added extensions from file.\n");
}
else if (ext_sect)
{
/* We found extensions to be set from config file */
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
X509V3_set_nconf(&ctx, lconf);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Modify apps to use NCONF code instead of old CONF code. Add new extension functions which work with NCONF. Tidy up extension config routines and remove redundant code. Fix NCONF_get_number(). Todo: more testing of apps to see they still work...
2001-06-28 19:41:50 +08:00
if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
{
BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
ERR_print_errors(bio_err);
goto err;
}
if (verbose)
BIO_printf(bio_err, "Successfully added extensions from config\n");
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
Add copy_extensions option to 'ca' utility.
2001-03-16 10:04:17 +08:00
/* Copy extensions from request (if any) */
if (!copy_extensions(ret, req, ext_copy))
{
BIO_printf(bio_err, "ERROR: adding extensions from request\n");
ERR_print_errors(bio_err);
goto err;
}
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
/* Set the right value for the noemailDN option */
if( email_dn == 0 )
{
if (!X509_set_subject_name(ret,dn_subject)) goto err;
}
Add copy_extensions option to 'ca' utility.
2001-03-16 10:04:17 +08:00
if (!default_op)
{
BIO_printf(bio_err, "Certificate Details:\n");
/* Never print signature details because signature not present */
certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
X509_print_ex(bio_err, ret, nameopt, certopt);
}
BIO_printf(bio_err,"Certificate is to be certified until ");
ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
if (days) BIO_printf(bio_err," (%d days)",days);
BIO_printf(bio_err, "\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (!batch)
{
Add copy_extensions option to 'ca' utility.
2001-03-16 10:04:17 +08:00
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
BIO_printf(bio_err,"Sign the certificate? [y/n]:");
Avoid warnings.
1999-06-11 00:29:32 +08:00
(void)BIO_flush(bio_err);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
buf[0]='\0';
fgets(buf,sizeof(buf)-1,stdin);
if (!((buf[0] == 'y') || (buf[0] == 'Y')))
{
BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
ok=0;
goto err;
}
}
Import of old SSLeay release: SSLeay 0.9.1b (unreleased)
1998-12-21 19:00:56 +08:00
Make all configuration macros available for application by making sure they are available in opensslconf.h, by giving them names starting with "OPENSSL_" to avoid conflicts with other packages and by making sure e_os2.h will cover all platform-specific cases together with opensslconf.h. I've checked fairly well that nothing breaks with this (apart from external software that will adapt if they have used something like NO_KRB5), but I can't guarantee it completely, so a review of this change would be a good thing.
2001-02-20 00:06:34 +08:00
#ifndef OPENSSL_NO_DSA
Move DSA test in ca.c inside #ifdef and make pubkey BIT STRING always have zero unused bits.
1999-01-02 09:53:06 +08:00
if (pkey->type == EVP_PKEY_DSA) dgst=EVP_dss1();
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
pktmp=X509_get_pubkey(ret);
if (EVP_PKEY_missing_parameters(pktmp) &&
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
!EVP_PKEY_missing_parameters(pkey))
EVP_PKEY_copy_parameters(pktmp,pkey);
More EVP_PKEY patches for new functionality.
1999-01-04 07:00:45 +08:00
EVP_PKEY_free(pktmp);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
#endif
ECDSA support Submitted by: Nils Larsch <nla@trustcenter.de>
2002-02-14 02:21:51 +08:00
#ifndef OPENSSL_NO_ECDSA
get rid of EVP_PKEY_ECDSA (now we have EVP_PKEY_EC instead) Submitted by: Nils Larsch
2002-08-12 16:47:41 +08:00
if (pkey->type == EVP_PKEY_EC)
ECDSA support Submitted by: Nils Larsch <nla@trustcenter.de>
2002-02-14 02:21:51 +08:00
dgst = EVP_ecdsa();
pktmp = X509_get_pubkey(ret);
if (EVP_PKEY_missing_parameters(pktmp) &&
!EVP_PKEY_missing_parameters(pkey))
EVP_PKEY_copy_parameters(pktmp, pkey);
EVP_PKEY_free(pktmp);
#endif
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (!X509_sign(ret,pkey,dgst))
goto err;
/* We now just add it to the database */
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
row[DB_type]=(char *)OPENSSL_malloc(2);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
tm=X509_get_notAfter(ret);
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
memcpy(row[DB_exp_date],tm->data,tm->length);
row[DB_exp_date][tm->length]='\0';
row[DB_rev_date]=NULL;
/* row[DB_serial] done already */
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
row[DB_file]=(char *)OPENSSL_malloc(8);
If the email address is moved from the subject to the subject alternate name, the subject in the certificate would differ from the subject in the index file, which has quite bad concequences. PR: 180
2002-07-31 22:05:57 +08:00
row[DB_name]=X509_NAME_oneline(X509_get_subject_name(ret),NULL,0);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
If the email address is moved from the subject to the subject alternate name, the subject in the certificate would differ from the subject in the index file, which has quite bad concequences. PR: 180
2002-07-31 22:05:57 +08:00
(row[DB_file] == NULL) || (row[DB_name] == NULL))
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
strcpy(row[DB_file],"unknown");
row[DB_type][0]='V';
row[DB_type][1]='\0';
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
goto err;
}
for (i=0; i<DB_NUMBER; i++)
{
irow[i]=row[i];
row[i]=NULL;
}
irow[DB_NUMBER]=NULL;
if (!TXT_DB_insert(db,irow))
{
BIO_printf(bio_err,"failed to update database\n");
BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
goto err;
}
ok=1;
err:
for (i=0; i<DB_NUMBER; i++)
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
if (row[i] != NULL) OPENSSL_free(row[i]);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (CAname != NULL)
X509_NAME_free(CAname);
if (subject != NULL)
X509_NAME_free(subject);
Bugfixes for noemailDN option. Make it use the correct name (instead of NULL) if nomailDN is not set, fix memory leaks and retain DN structure when deleting emailAddress.
2001-10-28 01:03:20 +08:00
if ((dn_subject != NULL) && !email_dn)
X509_NAME_free(dn_subject);
Improve support for running everything as a monolithic application. Submitted by: Lennart Bång, Bodo Möller
1999-10-26 03:36:01 +08:00
if (tmptm != NULL)
ASN1_UTCTIME_free(tmptm);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (ok <= 0)
{
if (ret != NULL) X509_free(ret);
ret=NULL;
}
else
*xret=ret;
return(ok);
}
Add new -notext option to 'ca', -pubkey option to spkac. Remove some "WTF??" casts from applications. Fixes to keep VC++ happy and avoid warnings. Docs tidy.
2000-02-03 10:56:48 +08:00
static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
if (output_der)
{
(void)i2d_X509_bio(bp,x);
return;
}
Add new -notext option to 'ca', -pubkey option to spkac. Remove some "WTF??" casts from applications. Fixes to keep VC++ happy and avoid warnings. Docs tidy.
2000-02-03 10:56:48 +08:00
#if 0
/* ??? Not needed since X509_print prints all this stuff anyway */
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
BIO_printf(bp,"issuer :%s\n",f);
f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
BIO_printf(bp,"subject:%s\n",f);
BIO_puts(bp,"serial :");
i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
BIO_puts(bp,"\n\n");
Add new -notext option to 'ca', -pubkey option to spkac. Remove some "WTF??" casts from applications. Fixes to keep VC++ happy and avoid warnings. Docs tidy.
2000-02-03 10:56:48 +08:00
#endif
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
if (!notext)X509_print(bp,x);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
PEM_write_bio_X509(bp,x);
}
Change functions to ANSI C.
1999-04-20 05:31:43 +08:00
static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
long days, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
unsigned long nameopt, int default_op, int ext_copy)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
STACK_OF(CONF_VALUE) *sk=NULL;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
LHASH *parms=NULL;
X509_REQ *req=NULL;
CONF_VALUE *cv=NULL;
NETSCAPE_SPKI *spki = NULL;
X509_REQ_INFO *ri;
char *type,*buf;
EVP_PKEY *pktmp=NULL;
X509_NAME *n=NULL;
X509_NAME_ENTRY *ne=NULL;
int ok= -1,i,j;
long errline;
int nid;
/*
* Load input file into a hash table. (This is just an easy
* way to read and parse the file, then put it into a convenient
* STACK format).
*/
parms=CONF_load(NULL,infile,&errline);
if (parms == NULL)
{
BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
ERR_print_errors(bio_err);
goto err;
}
sk=CONF_get_section(parms, "default");
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
if (sk_CONF_VALUE_num(sk) == 0)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
CONF_free(parms);
goto err;
}
/*
* Now create a dummy X509 request structure. We don't actually
* have an X509 request, but we have many of the components
* (a public key, various DN components). The idea is that we
* put these components into the right X509 request structure
* and we can use the same code as if you had a real X509 request.
*/
req=X509_REQ_new();
if (req == NULL)
{
ERR_print_errors(bio_err);
goto err;
}
/*
* Build up the subject name set.
*/
ri=req->req_info;
n = ri->subject;
for (i = 0; ; i++)
{
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
if (sk_CONF_VALUE_num(sk) <= i) break;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Convert the CONF library to use a typesafe stack: a STACK_OF(CONF_VALUE). It seemed like a good idea at the time... several hours later it was rather obvious that these are used all over the place making the changes rather extensive.
1999-06-21 06:18:16 +08:00
cv=sk_CONF_VALUE_value(sk,i);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
type=cv->name;
Allow the 1.OU="my OU" syntax in 'ca' for SPKACs.
1999-08-26 07:18:23 +08:00
/* Skip past any leading X. X: X, etc to allow for
* multiple instances
*/
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
for (buf = cv->name; *buf ; buf++)
if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
{
buf++;
if (*buf) type = buf;
break;
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
Allow the 1.OU="my OU" syntax in 'ca' for SPKACs.
1999-08-26 07:18:23 +08:00
buf=cv->value;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if ((nid=OBJ_txt2nid(type)) == NID_undef)
{
if (strcmp(type, "SPKAC") == 0)
{
Add new 'spkac' utility and several SPKAC utility functions.
1999-09-03 09:08:34 +08:00
spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
if (spki == NULL)
{
BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
ERR_print_errors(bio_err);
goto err;
}
}
continue;
}
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
/*
if ((nid == NID_pkcs9_emailAddress) && (email_dn == 0))
continue;
*/
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
if (fix_data(nid, &j) == 0)
{
BIO_printf(bio_err,
"invalid characters in string %s\n",buf);
goto err;
}
if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
(unsigned char *)buf,
strlen(buf))) == NULL)
goto err;
Continued multibyte character support. Add a bunch of functions to simplify the creation of X509_NAME structures. Change the X509_NAME_entry_add stuff in req/ca so it no longer uses X509_NAME_entry_count(): passing -1 has the same effect.
1999-10-27 08:15:11 +08:00
if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
}
if (spki == NULL)
{
BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
infile);
goto err;
}
/*
* Now extract the key from the SPKI structure.
*/
BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
Add new 'spkac' utility and several SPKAC utility functions.
1999-09-03 09:08:34 +08:00
if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
BIO_printf(bio_err,"error unpacking SPKAC public key\n");
goto err;
}
j = NETSCAPE_SPKI_verify(spki, pktmp);
if (j <= 0)
{
BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
goto err;
}
BIO_printf(bio_err,"Signature ok\n");
X509_REQ_set_pubkey(req,pktmp);
More EVP_PKEY patches for new functionality.
1999-01-04 07:00:45 +08:00
EVP_PKEY_free(pktmp);
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of the e-mail address in the DN (i.e., it will go into a certificate extension only). The new configuration file option 'email_in_dn = no' has the same effect. Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 16:25:19 +08:00
ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
ext_copy);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
err:
if (req != NULL) X509_REQ_free(req);
if (parms != NULL) CONF_free(parms);
if (spki != NULL) NETSCAPE_SPKI_free(spki);
if (ne != NULL) X509_NAME_ENTRY_free(ne);
return(ok);
}
Change functions to ANSI C.
1999-04-20 05:31:43 +08:00
static int fix_data(int nid, int *type)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
if (nid == NID_pkcs9_emailAddress)
*type=V_ASN1_IA5STRING;
if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
*type=V_ASN1_T61STRING;
if ((nid == NID_pkcs9_challengePassword) && (*type == V_ASN1_IA5STRING))
*type=V_ASN1_T61STRING;
if ((nid == NID_pkcs9_unstructuredName) && (*type == V_ASN1_T61STRING))
return(0);
if (nid == NID_pkcs9_unstructuredName)
*type=V_ASN1_IA5STRING;
return(1);
}
Change functions to ANSI C.
1999-04-20 05:31:43 +08:00
static int check_time_format(char *str)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 18:52:47 +08:00
{
ASN1_UTCTIME tm;
tm.data=(unsigned char *)str;
tm.length=strlen(str);
tm.type=V_ASN1_UTCTIME;
return(ASN1_UTCTIME_check(&tm));
}
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
static int do_revoke(X509 *x509, TXT_DB *db, int type, char *value)
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
{
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
ASN1_UTCTIME *tm=NULL;
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
char *row[DB_NUMBER],**rrow,**irow;
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
char *rev_str = NULL;
Fix to the -revoke option in ca. It was leaking memory, crashing and just plain not working :-( Also fix some memory leaks in the new X509_NAME code. Fix so new app_rand code doesn't crash 'x509' and move #include so it compiles under Win32.
1999-11-08 21:58:08 +08:00
BIGNUM *bn = NULL;
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
int ok=-1,i;
for (i=0; i<DB_NUMBER; i++)
row[i]=NULL;
Fix to the -revoke option in ca. It was leaking memory, crashing and just plain not working :-( Also fix some memory leaks in the new X509_NAME code. Fix so new app_rand code doesn't crash 'x509' and move #include so it compiles under Win32.
1999-11-08 21:58:08 +08:00
row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
BN_bn2hex() returns "0" instead of "00" for zero. This disrputs the requirement that the serial number always be an even amount of characters. PR: 248
2002-10-11 17:38:56 +08:00
if (BN_is_zero(bn))
row[DB_serial]=BUF_strdup("00");
else
row[DB_serial]=BN_bn2hex(bn);
Fix to the -revoke option in ca. It was leaking memory, crashing and just plain not working :-( Also fix some memory leaks in the new X509_NAME code. Fix so new app_rand code doesn't crash 'x509' and move #include so it compiles under Win32.
1999-11-08 21:58:08 +08:00
BN_free(bn);
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
{
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
goto err;
}
Fix to the -revoke option in ca. It was leaking memory, crashing and just plain not working :-( Also fix some memory leaks in the new X509_NAME code. Fix so new app_rand code doesn't crash 'x509' and move #include so it compiles under Win32.
1999-11-08 21:58:08 +08:00
/* We have to lookup by serial number because name lookup
* skips revoked certs
*/
rrow=TXT_DB_get_by_index(db,DB_serial,row);
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
if (rrow == NULL)
{
BIO_printf(bio_err,"Adding Entry to DB for %s\n", row[DB_name]);
/* We now just add it to the database */
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
row[DB_type]=(char *)OPENSSL_malloc(2);
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
tm=X509_get_notAfter(x509);
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
memcpy(row[DB_exp_date],tm->data,tm->length);
row[DB_exp_date][tm->length]='\0';
row[DB_rev_date]=NULL;
/* row[DB_serial] done already */
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
row[DB_file]=(char *)OPENSSL_malloc(8);
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
/* row[DB_name] done already */
if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
(row[DB_file] == NULL))
{
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
goto err;
}
strcpy(row[DB_file],"unknown");
row[DB_type][0]='V';
row[DB_type][1]='\0';
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
{
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
BIO_printf(bio_err,"Memory allocation failure\n");
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
goto err;
}
for (i=0; i<DB_NUMBER; i++)
{
irow[i]=row[i];
row[i]=NULL;
}
irow[DB_NUMBER]=NULL;
if (!TXT_DB_insert(db,irow))
{
BIO_printf(bio_err,"failed to update database\n");
BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
goto err;
}
/* Revoke Certificate */
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
ok = do_revoke(x509,db, type, value);
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
goto err;
}
Use the new LHASH macros to declare type-safe wrapper functions that can be used as the hash/compare callbacks without function pointer casting. For now, this is just happening in the apps/ directory whilst a few people check the approach. The rest of the library will be moved across to the same idea if there's no problems with this.
2000-12-03 07:16:54 +08:00
else if (index_name_cmp((const char **)row,(const char **)rrow))
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
{
Fix to the -revoke option in ca. It was leaking memory, crashing and just plain not working :-( Also fix some memory leaks in the new X509_NAME code. Fix so new app_rand code doesn't crash 'x509' and move #include so it compiles under Win32.
1999-11-08 21:58:08 +08:00
BIO_printf(bio_err,"ERROR:name does not match %s\n",
row[DB_name]);
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
goto err;
}
else if (rrow[DB_type][0]=='R')
{
BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
row[DB_serial]);
goto err;
}
else
{
BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
rev_str = make_revocation_str(type, value);
if (!rev_str)
{
BIO_printf(bio_err, "Error in revocation arguments\n");
goto err;
}
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
rrow[DB_type][0]='R';
rrow[DB_type][1]='\0';
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
rrow[DB_rev_date] = rev_str;
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
}
ok=1;
Add `openssl ca -revoke <certfile>' facility which revokes a certificate specified in <certfile> by updating the entry in the index.txt file. This way one no longer has to edit the index.txt file manually for revoking a certificate. The -revoke option does the gory details now. Submitted by: Massimiliano Pala <madwolf@openca.org> Cleaned up and integrated by: Ralf S. Engelschall
1999-04-12 19:45:14 +08:00
err:
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
for (i=0; i<DB_NUMBER; i++)
{
if (row[i] != NULL)
There have been a number of complaints from a number of sources that names like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
2000-06-02 06:19:21 +08:00
OPENSSL_free(row[i]);
Don't mix real tabs with tabs expanded as 8 spaces -- that's a pain to read when using 4-space tabs.
1999-06-08 04:26:51 +08:00
}
return(ok);
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
}
static int get_certificate_status(const char *serial, TXT_DB *db)
{
Fix warning in apps/ca.c
2001-01-14 21:58:49 +08:00
char *row[DB_NUMBER],**rrow;
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
int ok=-1,i;
/* Free Resources */
for (i=0; i<DB_NUMBER; i++)
row[i]=NULL;
/* Malloc needed char spaces */
row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
if (row[DB_serial] == NULL)
{
BIO_printf(bio_err,"Malloc failure\n");
goto err;
}
if (strlen(serial) % 2)
{
/* Set the first char to 0 */;
row[DB_serial][0]='0';
/* Copy String from serial to row[DB_serial] */
memcpy(row[DB_serial]+1, serial, strlen(serial));
row[DB_serial][strlen(serial)+1]='\0';
}
else
{
/* Copy String from serial to row[DB_serial] */
memcpy(row[DB_serial], serial, strlen(serial));
row[DB_serial][strlen(serial)]='\0';
}
/* Make it Upper Case */
for (i=0; row[DB_serial][i] != '\0'; i++)
New '-extfile' option for 'openssl ca'. This allows keeping extensions in a separate configuration file. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-15 19:35:24 +08:00
row[DB_serial][i] = toupper(row[DB_serial][i]);
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
ok=1;
/* Search for the certificate */
rrow=TXT_DB_get_by_index(db,DB_serial,row);
if (rrow == NULL)
{
BIO_printf(bio_err,"Serial %s not present in db.\n",
row[DB_serial]);
ok=-1;
goto err;
}
else if (rrow[DB_type][0]=='V')
{
BIO_printf(bio_err,"%s=Valid (%c)\n",
row[DB_serial], rrow[DB_type][0]);
goto err;
}
else if (rrow[DB_type][0]=='R')
{
BIO_printf(bio_err,"%s=Revoked (%c)\n",
row[DB_serial], rrow[DB_type][0]);
goto err;
}
else if (rrow[DB_type][0]=='E')
{
BIO_printf(bio_err,"%s=Expired (%c)\n",
row[DB_serial], rrow[DB_type][0]);
goto err;
}
else if (rrow[DB_type][0]=='S')
{
BIO_printf(bio_err,"%s=Suspended (%c)\n",
row[DB_serial], rrow[DB_type][0]);
goto err;
}
else
{
BIO_printf(bio_err,"%s=Unknown (%c).\n",
row[DB_serial], rrow[DB_type][0]);
ok=-1;
}
err:
for (i=0; i<DB_NUMBER; i++)
{
if (row[i] != NULL)
OPENSSL_free(row[i]);
}
return(ok);
}
static int do_updatedb (TXT_DB *db)
{
ASN1_UTCTIME *a_tm = NULL;
int i, cnt = 0;
int db_y2k, a_y2k; /* flags = 1 if y >= 2000 */
char **rrow, *a_tm_s;
a_tm = ASN1_UTCTIME_new();
/* get actual time and make a string */
a_tm = X509_gmtime_adj(a_tm, 0);
a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
if (a_tm_s == NULL)
{
cnt = -1;
goto err;
}
memcpy(a_tm_s, a_tm->data, a_tm->length);
a_tm_s[a_tm->length] = '\0';
if (strncmp(a_tm_s, "49", 2) <= 0)
a_y2k = 1;
else
a_y2k = 0;
Add `openssl ca -revoke <certfile>' facility which revokes a certificate specified in <certfile> by updating the entry in the index.txt file. This way one no longer has to edit the index.txt file manually for revoking a certificate. The -revoke option does the gory details now. Submitted by: Massimiliano Pala <madwolf@openca.org> Cleaned up and integrated by: Ralf S. Engelschall
1999-04-12 19:45:14 +08:00
New 'openssl ca -status <serial>' and 'openssl ca -updatedb' commands. Submitted by: Massimiliano Pala <madwolf@comune.modena.it>
2001-01-12 22:50:44 +08:00
for (i = 0; i < sk_num(db->data); i++)
{
rrow = (char **) sk_value(db->data, i);
if (rrow[DB_type][0] == 'V')
{
/* ignore entries that are not valid */
if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
db_y2k = 1;
else
db_y2k = 0;
if (db_y2k == a_y2k)
{
/* all on the same y2k side */
if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
{
rrow[DB_type][0] = 'E';
rrow[DB_type][1] = '\0';
cnt++;
BIO_printf(bio_err, "%s=Expired\n",
rrow[DB_serial]);
}
}
else if (db_y2k < a_y2k)
{
rrow[DB_type][0] = 'E';
rrow[DB_type][1] = '\0';
cnt++;
BIO_printf(bio_err, "%s=Expired\n",
rrow[DB_serial]);
}
}
}
err:
ASN1_UTCTIME_free(a_tm);
OPENSSL_free(a_tm_s);
return (cnt);
}
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
static char *crl_reasons[] = {
/* CRL reason strings */
"unspecified",
"keyCompromise",
"CACompromise",
"affiliationChanged",
"superseded",
"cessationOfOperation",
"certificateHold",
"removeFromCRL",
/* Additional pseudo reasons */
"holdInstruction",
"keyTime",
"CAkeyTime"
};
#define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
/* Given revocation information convert to a DB string.
* The format of the string is:
* revtime[,reason,extra]. Where 'revtime' is the
* revocation time (the current time). 'reason' is the
* optional CRL reason and 'extra' is any additional
* argument
*/
char *make_revocation_str(int rev_type, char *rev_arg)
{
char *reason = NULL, *other = NULL, *str;
ASN1_OBJECT *otmp;
ASN1_UTCTIME *revtm = NULL;
int i;
switch (rev_type)
{
case REV_NONE:
break;
case REV_CRL_REASON:
for (i = 0; i < 8; i++)
{
if (!strcasecmp(rev_arg, crl_reasons[i]))
{
reason = crl_reasons[i];
break;
}
}
if (reason == NULL)
{
BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
return NULL;
}
break;
case REV_HOLD:
/* Argument is an OID */
otmp = OBJ_txt2obj(rev_arg, 0);
ASN1_OBJECT_free(otmp);
if (otmp == NULL)
{
BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
return NULL;
}
reason = "holdInstruction";
other = rev_arg;
break;
case REV_KEY_COMPROMISE:
case REV_CA_COMPROMISE:
/* Argument is the key compromise time */
if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
{
BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
return NULL;
}
other = rev_arg;
if (rev_type == REV_KEY_COMPROMISE)
reason = "keyTime";
else
reason = "CAkeyTime";
break;
}
revtm = X509_gmtime_adj(NULL, 0);
i = revtm->length + 1;
if (reason) i += strlen(reason) + 1;
if (other) i += strlen(other) + 1;
str = OPENSSL_malloc(i);
if (!str) return NULL;
strcpy(str, (char *)revtm->data);
if (reason)
{
strcat(str, ",");
strcat(str, reason);
}
if (other)
{
strcat(str, ",");
strcat(str, other);
}
ASN1_UTCTIME_free(revtm);
return str;
}
/* Convert revocation field to X509_REVOKED entry
* return code:
* 0 error
* 1 OK
* 2 OK and some extensions added (i.e. V2 CRL)
*/
Initial OCSP server support, using index.txt format. This can process internal requests or behave like a mini responder. Todo: documentation, update usage info.
2001-07-13 04:41:51 +08:00
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
int make_revoked(X509_REVOKED *rev, char *str)
{
char *tmp = NULL;
int reason_code = -1;
int i, ret = 0;
ASN1_OBJECT *hold = NULL;
ASN1_GENERALIZEDTIME *comp_time = NULL;
ASN1_ENUMERATED *rtmp = NULL;
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
ASN1_TIME *revDate = NULL;
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
Initial OCSP server support, using index.txt format. This can process internal requests or behave like a mini responder. Todo: documentation, update usage info.
2001-07-13 04:41:51 +08:00
if (i == 0)
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
goto err;
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
goto err;
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
{
rtmp = ASN1_ENUMERATED_new();
if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
goto err;
if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
goto err;
}
if (rev && comp_time)
{
if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
goto err;
}
if (rev && hold)
{
if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
goto err;
}
if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
ret = 2;
else ret = 1;
err:
if (tmp) OPENSSL_free(tmp);
ASN1_OBJECT_free(hold);
ASN1_GENERALIZEDTIME_free(comp_time);
ASN1_ENUMERATED_free(rtmp);
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
ASN1_TIME_free(revDate);
New options to 'ca' utility to support CRL entry extensions. Add revelant new X509V3 extensions. Add OIDs. Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 09:35:44 +08:00
return ret;
}
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
/*
* subject is expected to be in the format /type0=value0/type1=value1/type2=...
* where characters may be escaped by \
*/
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
X509_NAME *do_subject(char *subject, long chtype)
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
{
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
size_t buflen = strlen(subject)+1; /* to copy the types and values into. due to escaping, the copy can only become shorter */
char *buf = OPENSSL_malloc(buflen);
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
size_t max_ne = buflen / 2 + 1; /* maximum number of name elements */
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
char **ne_types = OPENSSL_malloc(max_ne * sizeof (char *));
char **ne_values = OPENSSL_malloc(max_ne * sizeof (char *));
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
char *sp = subject, *bp = buf;
int i, ne_num = 0;
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
X509_NAME *n = NULL;
int nid;
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
if (!buf || !ne_types || !ne_values)
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
BIO_printf(bio_err, "malloc error\n");
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
goto error;
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
}
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
if (*subject != '/')
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
BIO_printf(bio_err, "Subject does not start with '/'.\n");
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
goto error;
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
}
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
sp++; /* skip leading / */
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
while (*sp)
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
/* collect type */
ne_types[ne_num] = bp;
while (*sp)
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
if (*sp == '\\') /* is there anything to escape in the type...? */
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
if (*++sp)
*bp++ = *sp++;
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
else
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
BIO_printf(bio_err, "escape character at end of string\n");
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
goto error;
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
}
}
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
else if (*sp == '=')
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
sp++;
*bp++ = '\0';
break;
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
}
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
else
*bp++ = *sp++;
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
}
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
if (!*sp)
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
BIO_printf(bio_err, "end of string encountered while processing type of subject name element #%d\n", ne_num);
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
goto error;
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
}
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
ne_values[ne_num] = bp;
while (*sp)
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
if (*sp == '\\')
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
if (*++sp)
*bp++ = *sp++;
else
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
BIO_printf(bio_err, "escape character at end of string\n");
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
goto error;
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
}
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
}
else if (*sp == '/')
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
sp++;
break;
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
}
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
else
*bp++ = *sp++;
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
}
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
*bp++ = '\0';
ne_num++;
fix warnings, and harmonize indentation
2002-10-23 21:11:38 +08:00
}
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
if (!(n = X509_NAME_new()))
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
goto error;
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
for (i = 0; i < ne_num; i++)
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
if ((nid=OBJ_txt2nid(ne_types[i])) == NID_undef)
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_types[i]);
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
continue;
}
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
if (!*ne_values[i])
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
{
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_types[i]);
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
continue;
}
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
if (!X509_NAME_add_entry_by_NID(n, nid, chtype, (unsigned char*)ne_values[i], -1,-1,0))
goto error;
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
}
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
OPENSSL_free(ne_values);
OPENSSL_free(ne_types);
OPENSSL_free(buf);
New option '-subj arg' for 'openssl req' and 'openssl ca'. This sets the subject name for a new request or supersedes the subject name in a given request. Add options '-batch' and '-verbose' to 'openssl req'. Submitted by: Massimiliano Pala <madwolf@hackmasters.net> Reviewed by: Bodo Moeller
2001-03-05 19:09:43 +08:00
return n;
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
error:
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
X509_NAME_free(n);
Reorganise -subj option code, fix buffer overrun.
2002-05-20 00:31:10 +08:00
if (ne_values)
OPENSSL_free(ne_values);
if (ne_types)
OPENSSL_free(ne_types);
if (buf)
OPENSSL_free(buf);
Fix escaping when using the -subj option of "openssl req", document 'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
2002-04-30 20:08:18 +08:00
return NULL;
}
Overhaul the display of certificate details in the 'ca' utility. This can now be extensively customised in the configuration file and handles multibyte strings and extensions properly. This is required when extensions copying from certificate requests is supported: the user must be able to view the extensions before allowing a certificate to be issued.
2001-03-16 03:13:40 +08:00
int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
{
char buf[25],*pbuf, *p;
int j;
j=i2a_ASN1_OBJECT(bp,obj);
pbuf=buf;
for (j=22-j; j>0; j--)
*(pbuf++)=' ';
*(pbuf++)=':';
*(pbuf++)='\0';
BIO_puts(bp,buf);
if (str->type == V_ASN1_PRINTABLESTRING)
BIO_printf(bp,"PRINTABLE:'");
else if (str->type == V_ASN1_T61STRING)
BIO_printf(bp,"T61STRING:'");
else if (str->type == V_ASN1_IA5STRING)
BIO_printf(bp,"IA5STRING:'");
else if (str->type == V_ASN1_UNIVERSALSTRING)
BIO_printf(bp,"UNIVERSALSTRING:'");
else
BIO_printf(bp,"ASN.1 %2d:'",str->type);
p=(char *)str->data;
for (j=str->length; j>0; j--)
{
if ((*p >= ' ') && (*p <= '~'))
BIO_printf(bp,"%c",*p);
else if (*p & 0x80)
BIO_printf(bp,"\\0x%02X",*p);
else if ((unsigned char)*p == 0xf7)
BIO_printf(bp,"^?");
else BIO_printf(bp,"^%c",*p+'@');
p++;
}
BIO_printf(bp,"'\n");
return 1;
}
Initial OCSP server support, using index.txt format. This can process internal requests or behave like a mini responder. Todo: documentation, update usage info.
2001-07-13 04:41:51 +08:00
int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, char *str)
{
char *tmp = NULL;
char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
int reason_code = -1;
int i, ret = 0;
ASN1_OBJECT *hold = NULL;
ASN1_GENERALIZEDTIME *comp_time = NULL;
tmp = BUF_strdup(str);
p = strchr(tmp, ',');
rtime_str = tmp;
if (p)
{
*p = '\0';
p++;
reason_str = p;
p = strchr(p, ',');
if (p)
{
*p = '\0';
arg_str = p + 1;
}
}
if (prevtm)
{
*prevtm = ASN1_UTCTIME_new();
if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))
{
BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
goto err;
}
}
if (reason_str)
{
for (i = 0; i < NUM_REASONS; i++)
{
if(!strcasecmp(reason_str, crl_reasons[i]))
{
reason_code = i;
break;
}
}
if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
{
BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
goto err;
}
if (reason_code == 7)
reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
else if (reason_code == 8) /* Hold instruction */
{
if (!arg_str)
{
BIO_printf(bio_err, "missing hold instruction\n");
goto err;
}
reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
hold = OBJ_txt2obj(arg_str, 0);
if (!hold)
{
BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
goto err;
}
if (phold) *phold = hold;
}
else if ((reason_code == 9) || (reason_code == 10))
{
if (!arg_str)
{
BIO_printf(bio_err, "missing compromised time\n");
goto err;
}
comp_time = ASN1_GENERALIZEDTIME_new();
if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
{
BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
goto err;
}
if (reason_code == 9)
reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
else
reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
}
}
if (preason) *preason = reason_code;
if (pinvtm) *pinvtm = comp_time;
else ASN1_GENERALIZEDTIME_free(comp_time);
Add CRL utility functions to allow CRLs to be built up without accessing structures directly. Update ca.c to use new functions. Fix ca.c so it now build CRLs correctly again.
2001-08-17 08:33:43 +08:00
ret = 1;
Initial OCSP server support, using index.txt format. This can process internal requests or behave like a mini responder. Todo: documentation, update usage info.
2001-07-13 04:41:51 +08:00
err:
if (tmp) OPENSSL_free(tmp);
if (!phold) ASN1_OBJECT_free(hold);
if (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);
return ret;
}
int make_serial_index(TXT_DB *db)
{
if (!TXT_DB_create_index(db, DB_serial, NULL,
LHASH_HASH_FN(index_serial_hash),
LHASH_COMP_FN(index_serial_cmp)))
{
BIO_printf(bio_err,
"error creating serial number index:(%ld,%ld,%ld)\n",
db->error,db->arg1,db->arg2);
return 0;
}
return 1;
}
Reference in New Issue Copy Permalink