mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-01-18 13:44:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Remove asn1-kludge option.

Browse Source 
Remove asn1-kludge option from the req utility. It was a decade old
workaround for CAs and software which required an invalid encoding
of PKCS#10 certificate requests: omitting the attributes field even
though it is not OPTIONAL.

Reviewed-by: Rich Salz <rsalz@openssl.org>
This commit is contained in:
Dr. Stephen Henson 2015-08-31 18:27:57 +01:00
parent 36ac7bc8a9
commit d8c054f2da
2 changed files with 3 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
apps/req.c
View File

@ -126,8 +126,8 @@ typedef enum OPTION_choice {
OPT_PKEYOPT, OPT_SIGOPT, OPT_BATCH, OPT_NEWHDR, OPT_MODULUS,
OPT_VERIFY, OPT_NODES, OPT_NOOUT, OPT_VERBOSE, OPT_UTF8,
OPT_NAMEOPT, OPT_REQOPT, OPT_SUBJ, OPT_SUBJECT, OPT_TEXT, OPT_X509,
OPT_ASN1_KLUDGE, OPT_NO_ASN1_KLUDGE, OPT_MULTIVALUE_RDN,
OPT_DAYS, OPT_SET_SERIAL, OPT_EXTENSIONS, OPT_REQEXTS, OPT_MD
OPT_MULTIVALUE_RDN, OPT_DAYS, OPT_SET_SERIAL, OPT_EXTENSIONS,
OPT_REQEXTS, OPT_MD
} OPTION_CHOICE;
OPTIONS req_options[] = {
@ -163,10 +163,7 @@ OPTIONS req_options[] = {
{"text", OPT_TEXT, '-', "Text form of request"},
{"x509", OPT_X509, '-',
"Output a x509 structure instead of a cert request"},
{"asn1-kludge", OPT_ASN1_KLUDGE, '-',
"Output the request in a format that is wrong"},
{OPT_MORE_STR, 1, 1, "(Required by some CA's)"},
{"no-asn1-kludge", OPT_NO_ASN1_KLUDGE, '-'},
{"subj", OPT_SUBJ, 's', "Set or modify request subject"},
{"subject", OPT_SUBJECT, '-', "Output the request's subject"},
{"multivalue-rdn", OPT_MULTIVALUE_RDN, '-',
@ -208,7 +205,7 @@ int req_main(int argc, char **argv)
int pkey_type = -1, private = 0;
int informat = FORMAT_PEM, outformat = FORMAT_PEM, keyform = FORMAT_PEM;
int modulus = 0, multirdn = 0, verify = 0, noout = 0, text = 0;
int nodes = 0, kludge = 0, newhdr = 0, subject = 0, pubkey = 0;
int nodes = 0, newhdr = 0, subject = 0, pubkey = 0;
long newkey = -1;
unsigned long chtype = MBSTRING_ASC, nmflag = 0, reqflag = 0;
char nmflag_set = 0;
@ -338,12 +335,6 @@ int req_main(int argc, char **argv)
case OPT_X509:
x509 = 1;
break;
case OPT_ASN1_KLUDGE:
kludge = 1;
break;
case OPT_NO_ASN1_KLUDGE:
kludge = 0;
break;
case OPT_DAYS:
days = atoi(opt_arg());
break;
@ -610,11 +601,6 @@ int req_main(int argc, char **argv)
}
if (!newreq) {
/*
* Since we are using a pre-existing certificate request, the kludge
* 'format' info should not be changed.
*/
kludge = -1;
in = bio_open_default(infile, RB(informat));
if (in == NULL)
goto end;
@ -643,11 +629,6 @@ int req_main(int argc, char **argv)
i = make_REQ(req, pkey, subj, multirdn, !x509, chtype);
subj = NULL; /* done processing '-subj' option */
if ((kludge > 0)
&& !sk_X509_ATTRIBUTE_num(req->req_info->attributes)) {
sk_X509_ATTRIBUTE_free(req->req_info->attributes);
req->req_info->attributes = NULL;
}
if (!i) {
BIO_printf(bio_err, "problems making Certificate Request\n");
goto end;

22
doc/apps/req.pod
View File

@ -34,8 +34,6 @@ B<openssl> B<req>
[B<-x509>]
[B<-days n>]
[B<-set_serial n>]
[B<-asn1-kludge>]
[B<-no-asn1-kludge>]
[B<-newhdr>]
[B<-extensions section>]
[B<-reqexts section>]
@ -274,26 +272,6 @@ a single option or multiple options separated by commas.
See discussion of the B<-certopt> parameter in the L<x509(1)>
command.
=item B<-asn1-kludge>
by default the B<req> command outputs certificate requests containing
no attributes in the correct PKCS#10 format. However certain CAs will only
accept requests containing no attributes in an invalid form: this
option produces this invalid format.
More precisely the B<Attributes> in a PKCS#10 certificate request
are defined as a B<SET OF Attribute>. They are B<not OPTIONAL> so
if no attributes are present then they should be encoded as an
empty B<SET OF>. The invalid form does not include the empty
B<SET OF> whereas the correct form does.
It should be noted that very few CAs still require the use of this option.
=item B<-no-asn1-kludge>
Reverses effect of B<-asn1-kludge>
=item B<-newhdr>
Adds the word B<NEW> to the PEM file header and footer lines on the outputted