apps/ca.c

   1 /* apps/ca.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58
  59 /* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
  60
  61 #include <stdio.h>
  62 #include <stdlib.h>
  63 #include <string.h>
  64 #include <ctype.h>
  65 #include <sys/types.h>
  66 #include <sys/stat.h>
  67 #include <openssl/conf.h>
  68 #include <openssl/bio.h>
  69 #include <openssl/err.h>
  70 #include <openssl/bn.h>
  71 #include <openssl/txt_db.h>
  72 #include <openssl/evp.h>
  73 #include <openssl/x509.h>
  74 #include <openssl/x509v3.h>
  75 #include <openssl/objects.h>
  76 #include <openssl/ocsp.h>
  77 #include <openssl/pem.h>
  78
  79 #ifdef OPENSSL_SYS_WINDOWS
  80 #define strcasecmp _stricmp
  81 #else
  82 #  ifdef NO_STRINGS_H
  83     int strcasecmp();
  84 #  else
  85 #    include <strings.h>
  86 #  endif /* NO_STRINGS_H */
  87 #endif
  88
  89 #ifndef W_OK
  90 #  ifdef OPENSSL_SYS_VMS
  91 #    if defined(__DECC)
  92 #      include <unistd.h>
  93 #    else
  94 #      include <unixlib.h>
  95 #    endif
  96 #  elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS)
  97 #    include <sys/file.h>
  98 #  endif
  99 #endif
 100
 101 #include "apps.h"
 102
 103 #ifndef W_OK
 104 #  define F_OK 0
 105 #  define X_OK 1
 106 #  define W_OK 2
 107 #  define R_OK 4
 108 #endif
 109
 110 #undef PROG
 111 #define PROG ca_main
 112
 113 #define BASE_SECTION    "ca"
 114 #define CONFIG_FILE "openssl.cnf"
 115
 116 #define ENV_DEFAULT_CA          "default_ca"
 117
 118 #define ENV_DIR                 "dir"
 119 #define ENV_CERTS               "certs"
 120 #define ENV_CRL_DIR             "crl_dir"
 121 #define ENV_CA_DB               "CA_DB"
 122 #define ENV_NEW_CERTS_DIR       "new_certs_dir"
 123 #define ENV_CERTIFICATE         "certificate"
 124 #define ENV_SERIAL              "serial"
 125 #define ENV_CRL                 "crl"
 126 #define ENV_PRIVATE_KEY         "private_key"
 127 #define ENV_RANDFILE            "RANDFILE"
 128 #define ENV_DEFAULT_DAYS        "default_days"
 129 #define ENV_DEFAULT_STARTDATE   "default_startdate"
 130 #define ENV_DEFAULT_ENDDATE     "default_enddate"
 131 #define ENV_DEFAULT_CRL_DAYS    "default_crl_days"
 132 #define ENV_DEFAULT_CRL_HOURS   "default_crl_hours"
 133 #define ENV_DEFAULT_MD          "default_md"
 134 #define ENV_DEFAULT_EMAIL_DN    "email_in_dn"
 135 #define ENV_PRESERVE            "preserve"
 136 #define ENV_POLICY              "policy"
 137 #define ENV_EXTENSIONS          "x509_extensions"
 138 #define ENV_CRLEXT              "crl_extensions"
 139 #define ENV_MSIE_HACK           "msie_hack"
 140 #define ENV_NAMEOPT             "name_opt"
 141 #define ENV_CERTOPT             "cert_opt"
 142 #define ENV_EXTCOPY             "copy_extensions"
 143
 144 #define ENV_DATABASE            "database"
 145
 146 #define DB_type         0
 147 #define DB_exp_date     1
 148 #define DB_rev_date     2
 149 #define DB_serial       3       /* index - unique */
 150 #define DB_file         4
 151 #define DB_name         5       /* index - unique for active */
 152 #define DB_NUMBER       6
 153
 154 #define DB_TYPE_REV     'R'
 155 #define DB_TYPE_EXP     'E'
 156 #define DB_TYPE_VAL     'V'
 157
 158 /* Additional revocation information types */
 159
 160 #define REV_NONE                0       /* No addditional information */
 161 #define REV_CRL_REASON          1       /* Value is CRL reason code */
 162 #define REV_HOLD                2       /* Value is hold instruction */
 163 #define REV_KEY_COMPROMISE      3       /* Value is cert key compromise time */
 164 #define REV_CA_COMPROMISE       4       /* Value is CA key compromise time */
 165
 166 static char *ca_usage[]={
 167 "usage: ca args\n",
 168 "\n",
 169 " -verbose        - Talk alot while doing things\n",
 170 " -config file    - A config file\n",
 171 " -name arg       - The particular CA definition to use\n",
 172 " -gencrl         - Generate a new CRL\n",
 173 " -crldays days   - Days is when the next CRL is due\n",
 174 " -crlhours hours - Hours is when the next CRL is due\n",
 175 " -startdate YYMMDDHHMMSSZ  - certificate validity notBefore\n",
 176 " -enddate YYMMDDHHMMSSZ    - certificate validity notAfter (overrides -days)\n",
 177 " -days arg       - number of days to certify the certificate for\n",
 178 " -md arg         - md to use, one of md2, md5, sha or sha1\n",
 179 " -policy arg     - The CA 'policy' to support\n",
 180 " -keyfile arg    - private key file\n",
 181 " -keyform arg    - private key file format (PEM or ENGINE)\n",
 182 " -key arg        - key to decode the private key if it is encrypted\n",
 183 " -cert file      - The CA certificate\n",
 184 " -in file        - The input PEM encoded certificate request(s)\n",
 185 " -out file       - Where to put the output file(s)\n",
 186 " -outdir dir     - Where to put output certificates\n",
 187 " -infiles ....   - The last argument, requests to process\n",
 188 " -spkac file     - File contains DN and signed public key and challenge\n",
 189 " -ss_cert file   - File contains a self signed cert to sign\n",
 190 " -preserveDN     - Don't re-order the DN\n",
 191 " -noemailDN      - Don't add the EMAIL field into certificate' subject\n",
 192 " -batch          - Don't ask questions\n",
 193 " -msie_hack      - msie modifications to handle all those universal strings\n",
 194 " -revoke file    - Revoke a certificate (given in file)\n",
 195 " -subj arg       - Use arg instead of request's subject\n",
 196 " -extensions ..  - Extension section (override value in config file)\n",
 197 " -extfile file   - Configuration file with X509v3 extentions to add\n",
 198 " -crlexts ..     - CRL extension section (override value in config file)\n",
 199 #ifndef OPENSSL_NO_ENGINE
 200 " -engine e       - use engine e, possibly a hardware device.\n",
 201 #endif
 202 " -status serial  - Shows certificate status given the serial number\n",
 203 " -updatedb       - Updates db for expired certificates\n",
 204 NULL
 205 };
 206
 207 #ifdef EFENCE
 208 extern int EF_PROTECT_FREE;
 209 extern int EF_PROTECT_BELOW;
 210 extern int EF_ALIGNMENT;
 211 #endif
 212
 213 static void lookup_fail(char *name,char *tag);
 214 static unsigned long index_serial_hash(const char **a);
 215 static int index_serial_cmp(const char **a, const char **b);
 216 static unsigned long index_name_hash(const char **a);
 217 static int index_name_qual(char **a);
 218 static int index_name_cmp(const char **a,const char **b);
 219 static BIGNUM *load_serial(char *serialfile);
 220 static int save_serial(char *serialfile, BIGNUM *serial);
 221 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 222                    const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,TXT_DB *db,
 223                    BIGNUM *serial, char *subj, int email_dn, char *startdate,
 224                    char *enddate, long days, int batch, char *ext_sect, CONF *conf,
 225                    int verbose, unsigned long certopt, unsigned long nameopt,
 226                    int default_op, int ext_copy);
 227 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 228                         const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 229                         TXT_DB *db, BIGNUM *serial, char *subj, int email_dn,
 230                         char *startdate, char *enddate, long days, int batch,
 231                         char *ext_sect, CONF *conf,int verbose, unsigned long certopt,
 232                         unsigned long nameopt, int default_op, int ext_copy,
 233                         ENGINE *e);
 234 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 235                          const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 236                          TXT_DB *db, BIGNUM *serial,char *subj, int email_dn,
 237                          char *startdate, char *enddate, long days, char *ext_sect,
 238                          CONF *conf, int verbose, unsigned long certopt,
 239                          unsigned long nameopt, int default_op, int ext_copy);
 240 static int fix_data(int nid, int *type);
 241 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
 242 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
 243         STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,char *subj,
 244         int email_dn, char *startdate, char *enddate, long days, int batch,
 245         int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
 246         unsigned long certopt, unsigned long nameopt, int default_op,
 247         int ext_copy);
 248 static int do_revoke(X509 *x509, TXT_DB *db, int ext, char *extval);
 249 static int get_certificate_status(const char *ser_status, TXT_DB *db);
 250 static int do_updatedb(TXT_DB *db);
 251 static int check_time_format(char *str);
 252 char *make_revocation_str(int rev_type, char *rev_arg);
 253 int make_revoked(X509_REVOKED *rev, char *str);
 254 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
 255 static CONF *conf=NULL;
 256 static CONF *extconf=NULL;
 257 static char *section=NULL;
 258
 259 static int preserve=0;
 260 static int msie_hack=0;
 261
 262 static IMPLEMENT_LHASH_HASH_FN(index_serial_hash,const char **)
 263 static IMPLEMENT_LHASH_COMP_FN(index_serial_cmp,const char **)
 264 static IMPLEMENT_LHASH_HASH_FN(index_name_hash,const char **)
 265 static IMPLEMENT_LHASH_COMP_FN(index_name_cmp,const char **)
 266
 267
 268 int MAIN(int, char **);
 269
 270 int MAIN(int argc, char **argv)
 271         {
 272         ENGINE *e = NULL;
 273         char *key=NULL,*passargin=NULL;
 274         int free_key = 0;
 275         int total=0;
 276         int total_done=0;
 277         int badops=0;
 278         int ret=1;
 279         int email_dn=1;
 280         int req=0;
 281         int verbose=0;
 282         int gencrl=0;
 283         int dorevoke=0;
 284         int doupdatedb=0;
 285         long crldays=0;
 286         long crlhours=0;
 287         long errorline= -1;
 288         char *configfile=NULL;
 289         char *md=NULL;
 290         char *policy=NULL;
 291         char *keyfile=NULL;
 292         char *certfile=NULL;
 293         int keyform=FORMAT_PEM;
 294         char *infile=NULL;
 295         char *spkac_file=NULL;
 296         char *ss_cert_file=NULL;
 297         char *ser_status=NULL;
 298         EVP_PKEY *pkey=NULL;
 299         int output_der = 0;
 300         char *outfile=NULL;
 301         char *outdir=NULL;
 302         char *serialfile=NULL;
 303         char *extensions=NULL;
 304         char *extfile=NULL;
 305         char *subj=NULL;
 306         char *tmp_email_dn=NULL;
 307         char *crl_ext=NULL;
 308         int rev_type = REV_NONE;
 309         char *rev_arg = NULL;
 310         BIGNUM *serial=NULL;
 311         char *startdate=NULL;
 312         char *enddate=NULL;
 313         long days=0;
 314         int batch=0;
 315         int notext=0;
 316         unsigned long nameopt = 0, certopt = 0;
 317         int default_op = 1;
 318         int ext_copy = EXT_COPY_NONE;
 319         X509 *x509=NULL;
 320         X509 *x=NULL;
 321         BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
 322         char *dbfile=NULL;
 323         TXT_DB *db=NULL;
 324         X509_CRL *crl=NULL;
 325         X509_REVOKED *r=NULL;
 326         ASN1_TIME *tmptm;
 327         ASN1_INTEGER *tmpser;
 328         char **pp,*p,*f;
 329         int i,j;
 330         long l;
 331         const EVP_MD *dgst=NULL;
 332         STACK_OF(CONF_VALUE) *attribs=NULL;
 333         STACK_OF(X509) *cert_sk=NULL;
 334 #undef BSIZE
 335 #define BSIZE 256
 336         MS_STATIC char buf[3][BSIZE];
 337         char *randfile=NULL;
 338 #ifndef OPENSSL_NO_ENGINE
 339         char *engine = NULL;
 340 #endif
 341         char *tofree=NULL;
 342
 343 #ifdef EFENCE
 344 EF_PROTECT_FREE=1;
 345 EF_PROTECT_BELOW=1;
 346 EF_ALIGNMENT=0;
 347 #endif
 348
 349         apps_startup();
 350
 351         conf = NULL;
 352         key = NULL;
 353         section = NULL;
 354
 355         preserve=0;
 356         msie_hack=0;
 357         if (bio_err == NULL)
 358                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
 359                         BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 360
 361         argc--;
 362         argv++;
 363         while (argc >= 1)
 364                 {
 365                 if      (strcmp(*argv,"-verbose") == 0)
 366                         verbose=1;
 367                 else if (strcmp(*argv,"-config") == 0)
 368                         {
 369                         if (--argc < 1) goto bad;
 370                         configfile= *(++argv);
 371                         }
 372                 else if (strcmp(*argv,"-name") == 0)
 373                         {
 374                         if (--argc < 1) goto bad;
 375                         section= *(++argv);
 376                         }
 377                 else if (strcmp(*argv,"-subj") == 0)
 378                         {
 379                         if (--argc < 1) goto bad;
 380                         subj= *(++argv);
 381                         /* preserve=1; */
 382                         }
 383                 else if (strcmp(*argv,"-startdate") == 0)
 384                         {
 385                         if (--argc < 1) goto bad;
 386                         startdate= *(++argv);
 387                         }
 388                 else if (strcmp(*argv,"-enddate") == 0)
 389                         {
 390                         if (--argc < 1) goto bad;
 391                         enddate= *(++argv);
 392                         }
 393                 else if (strcmp(*argv,"-days") == 0)
 394                         {
 395                         if (--argc < 1) goto bad;
 396                         days=atoi(*(++argv));
 397                         }
 398                 else if (strcmp(*argv,"-md") == 0)
 399                         {
 400                         if (--argc < 1) goto bad;
 401                         md= *(++argv);
 402                         }
 403                 else if (strcmp(*argv,"-policy") == 0)
 404                         {
 405                         if (--argc < 1) goto bad;
 406                         policy= *(++argv);
 407                         }
 408                 else if (strcmp(*argv,"-keyfile") == 0)
 409                         {
 410                         if (--argc < 1) goto bad;
 411                         keyfile= *(++argv);
 412                         }
 413                 else if (strcmp(*argv,"-keyform") == 0)
 414                         {
 415                         if (--argc < 1) goto bad;
 416                         keyform=str2fmt(*(++argv));
 417                         }
 418                 else if (strcmp(*argv,"-passin") == 0)
 419                         {
 420                         if (--argc < 1) goto bad;
 421                         passargin= *(++argv);
 422                         }
 423                 else if (strcmp(*argv,"-key") == 0)
 424                         {
 425                         if (--argc < 1) goto bad;
 426                         key= *(++argv);
 427                         }
 428                 else if (strcmp(*argv,"-cert") == 0)
 429                         {
 430                         if (--argc < 1) goto bad;
 431                         certfile= *(++argv);
 432                         }
 433                 else if (strcmp(*argv,"-in") == 0)
 434                         {
 435                         if (--argc < 1) goto bad;
 436                         infile= *(++argv);
 437                         req=1;
 438                         }
 439                 else if (strcmp(*argv,"-out") == 0)
 440                         {
 441                         if (--argc < 1) goto bad;
 442                         outfile= *(++argv);
 443                         }
 444                 else if (strcmp(*argv,"-outdir") == 0)
 445                         {
 446                         if (--argc < 1) goto bad;
 447                         outdir= *(++argv);
 448                         }
 449                 else if (strcmp(*argv,"-notext") == 0)
 450                         notext=1;
 451                 else if (strcmp(*argv,"-batch") == 0)
 452                         batch=1;
 453                 else if (strcmp(*argv,"-preserveDN") == 0)
 454                         preserve=1;
 455                 else if (strcmp(*argv,"-noemailDN") == 0)
 456                         email_dn=0;
 457                 else if (strcmp(*argv,"-gencrl") == 0)
 458                         gencrl=1;
 459                 else if (strcmp(*argv,"-msie_hack") == 0)
 460                         msie_hack=1;
 461                 else if (strcmp(*argv,"-crldays") == 0)
 462                         {
 463                         if (--argc < 1) goto bad;
 464                         crldays= atol(*(++argv));
 465                         }
 466                 else if (strcmp(*argv,"-crlhours") == 0)
 467                         {
 468                         if (--argc < 1) goto bad;
 469                         crlhours= atol(*(++argv));
 470                         }
 471                 else if (strcmp(*argv,"-infiles") == 0)
 472                         {
 473                         argc--;
 474                         argv++;
 475                         req=1;
 476                         break;
 477                         }
 478                 else if (strcmp(*argv, "-ss_cert") == 0)
 479                         {
 480                         if (--argc < 1) goto bad;
 481                         ss_cert_file = *(++argv);
 482                         req=1;
 483                         }
 484                 else if (strcmp(*argv, "-spkac") == 0)
 485                         {
 486                         if (--argc < 1) goto bad;
 487                         spkac_file = *(++argv);
 488                         req=1;
 489                         }
 490                 else if (strcmp(*argv,"-revoke") == 0)
 491                         {
 492                         if (--argc < 1) goto bad;
 493                         infile= *(++argv);
 494                         dorevoke=1;
 495                         }
 496                 else if (strcmp(*argv,"-extensions") == 0)
 497                         {
 498                         if (--argc < 1) goto bad;
 499                         extensions= *(++argv);
 500                         }
 501                 else if (strcmp(*argv,"-extfile") == 0)
 502                         {
 503                         if (--argc < 1) goto bad;
 504                         extfile= *(++argv);
 505                         }
 506                 else if (strcmp(*argv,"-status") == 0)
 507                         {
 508                         if (--argc < 1) goto bad;
 509                         ser_status= *(++argv);
 510                         }
 511                 else if (strcmp(*argv,"-updatedb") == 0)
 512                         {
 513                         doupdatedb=1;
 514                         }
 515                 else if (strcmp(*argv,"-crlexts") == 0)
 516                         {
 517                         if (--argc < 1) goto bad;
 518                         crl_ext= *(++argv);
 519                         }
 520                 else if (strcmp(*argv,"-crl_reason") == 0)
 521                         {
 522                         if (--argc < 1) goto bad;
 523                         rev_arg = *(++argv);
 524                         rev_type = REV_CRL_REASON;
 525                         }
 526                 else if (strcmp(*argv,"-crl_hold") == 0)
 527                         {
 528                         if (--argc < 1) goto bad;
 529                         rev_arg = *(++argv);
 530                         rev_type = REV_HOLD;
 531                         }
 532                 else if (strcmp(*argv,"-crl_compromise") == 0)
 533                         {
 534                         if (--argc < 1) goto bad;
 535                         rev_arg = *(++argv);
 536                         rev_type = REV_KEY_COMPROMISE;
 537                         }
 538                 else if (strcmp(*argv,"-crl_CA_compromise") == 0)
 539                         {
 540                         if (--argc < 1) goto bad;
 541                         rev_arg = *(++argv);
 542                         rev_type = REV_CA_COMPROMISE;
 543                         }
 544 #ifndef OPENSSL_NO_ENGINE
 545                 else if (strcmp(*argv,"-engine") == 0)
 546                         {
 547                         if (--argc < 1) goto bad;
 548                         engine= *(++argv);
 549                         }
 550 #endif
 551                 else
 552                         {
 553 bad:
 554                         BIO_printf(bio_err,"unknown option %s\n",*argv);
 555                         badops=1;
 556                         break;
 557                         }
 558                 argc--;
 559                 argv++;
 560                 }
 561
 562         if (badops)
 563                 {
 564                 for (pp=ca_usage; (*pp != NULL); pp++)
 565                         BIO_printf(bio_err,"%s",*pp);
 566                 goto err;
 567                 }
 568
 569         ERR_load_crypto_strings();
 570
 571 #ifndef OPENSSL_NO_ENGINE
 572         e = setup_engine(bio_err, engine, 0);
 573 #endif
 574
 575         /*****************************************************************/
 576         tofree=NULL;
 577         if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
 578         if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
 579         if (configfile == NULL)
 580                 {
 581                 const char *s=X509_get_default_cert_area();
 582
 583 #ifdef OPENSSL_SYS_VMS
 584                 tofree=OPENSSL_malloc(strlen(s)+sizeof(CONFIG_FILE));
 585                 strcpy(tofree,s);
 586 #else
 587                 tofree=OPENSSL_malloc(strlen(s)+sizeof(CONFIG_FILE)+1);
 588                 strcpy(tofree,s);
 589                 strcat(tofree,"/");
 590 #endif
 591                 strcat(tofree,CONFIG_FILE);
 592                 configfile=tofree;
 593                 }
 594
 595         BIO_printf(bio_err,"Using configuration from %s\n",configfile);
 596         conf = NCONF_new(NULL);
 597         if (NCONF_load(conf,configfile,&errorline) <= 0)
 598                 {
 599                 if (errorline <= 0)
 600                         BIO_printf(bio_err,"error loading the config file '%s'\n",
 601                                 configfile);
 602                 else
 603                         BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
 604                                 ,errorline,configfile);
 605                 goto err;
 606                 }
 607         if(tofree)
 608                 {
 609                 OPENSSL_free(tofree);
 610                 tofree = NULL;
 611                 }
 612
 613         if (!load_config(bio_err, conf))
 614                 goto err;
 615
 616         /* Lets get the config section we are using */
 617         if (section == NULL)
 618                 {
 619                 section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
 620                 if (section == NULL)
 621                         {
 622                         lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
 623                         goto err;
 624                         }
 625                 }
 626
 627         if (conf != NULL)
 628                 {
 629                 p=NCONF_get_string(conf,NULL,"oid_file");
 630                 if (p == NULL)
 631                         ERR_clear_error();
 632                 if (p != NULL)
 633                         {
 634                         BIO *oid_bio;
 635
 636                         oid_bio=BIO_new_file(p,"r");
 637                         if (oid_bio == NULL)
 638                                 {
 639                                 /*
 640                                 BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
 641                                 ERR_print_errors(bio_err);
 642                                 */
 643                                 ERR_clear_error();
 644                                 }
 645                         else
 646                                 {
 647                                 OBJ_create_objects(oid_bio);
 648                                 BIO_free(oid_bio);
 649                                 }
 650                         }
 651                 if (!add_oid_section(bio_err,conf))
 652                         {
 653                         ERR_print_errors(bio_err);
 654                         goto err;
 655                         }
 656                 }
 657
 658         randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
 659         if (randfile == NULL)
 660                 ERR_clear_error();
 661         app_RAND_load_file(randfile, bio_err, 0);
 662
 663         in=BIO_new(BIO_s_file());
 664         out=BIO_new(BIO_s_file());
 665         Sout=BIO_new(BIO_s_file());
 666         Cout=BIO_new(BIO_s_file());
 667         if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
 668                 {
 669                 ERR_print_errors(bio_err);
 670                 goto err;
 671                 }
 672
 673         /*****************************************************************/
 674         /* report status of cert with serial number given on command line */
 675         if (ser_status)
 676         {
 677                 if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 678                         {
 679                         lookup_fail(section,ENV_DATABASE);
 680                         goto err;
 681                         }
 682                 if (BIO_read_filename(in,dbfile) <= 0)
 683                         {
 684                         perror(dbfile);
 685                         BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
 686                         goto err;
 687                         }
 688                 db=TXT_DB_read(in,DB_NUMBER);
 689                 if (db == NULL) goto err;
 690
 691                 if (!make_serial_index(db))
 692                         goto err;
 693
 694                 if (get_certificate_status(ser_status,db) != 1)
 695                         BIO_printf(bio_err,"Error verifying serial %s!\n",
 696                                  ser_status);
 697                 goto err;
 698         }
 699
 700         /*****************************************************************/
 701         /* we definitely need a public key, so let's get it */
 702
 703         if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
 704                 section,ENV_PRIVATE_KEY)) == NULL))
 705                 {
 706                 lookup_fail(section,ENV_PRIVATE_KEY);
 707                 goto err;
 708                 }
 709         if (!key)
 710                 {
 711                 free_key = 1;
 712                 if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
 713                         {
 714                         BIO_printf(bio_err,"Error getting password\n");
 715                         goto err;
 716                         }
 717                 }
 718         pkey = load_key(bio_err, keyfile, keyform, 0, key, e,
 719                 "CA private key");
 720         if (key) OPENSSL_cleanse(key,strlen(key));
 721         if (pkey == NULL)
 722                 {
 723                 /* load_key() has already printed an appropriate message */
 724                 goto err;
 725                 }
 726
 727         /*****************************************************************/
 728         /* we need a certificate */
 729         if ((certfile == NULL) && ((certfile=NCONF_get_string(conf,
 730                 section,ENV_CERTIFICATE)) == NULL))
 731                 {
 732                 lookup_fail(section,ENV_CERTIFICATE);
 733                 goto err;
 734                 }
 735         x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
 736                 "CA certificate");
 737         if (x509 == NULL)
 738                 goto err;
 739
 740         if (!X509_check_private_key(x509,pkey))
 741                 {
 742                 BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
 743                 goto err;
 744                 }
 745
 746         f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
 747         if (f == NULL)
 748                 ERR_clear_error();
 749         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 750                 preserve=1;
 751         f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
 752         if (f == NULL)
 753                 ERR_clear_error();
 754         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 755                 msie_hack=1;
 756
 757         f=NCONF_get_string(conf,section,ENV_NAMEOPT);
 758
 759         if (f)
 760                 {
 761                 if (!set_name_ex(&nameopt, f))
 762                         {
 763                         BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
 764                         goto err;
 765                         }
 766                 default_op = 0;
 767                 }
 768         else
 769                 ERR_clear_error();
 770
 771         f=NCONF_get_string(conf,section,ENV_CERTOPT);
 772
 773         if (f)
 774                 {
 775                 if (!set_cert_ex(&certopt, f))
 776                         {
 777                         BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
 778                         goto err;
 779                         }
 780                 default_op = 0;
 781                 }
 782         else
 783                 ERR_clear_error();
 784
 785         f=NCONF_get_string(conf,section,ENV_EXTCOPY);
 786
 787         if (f)
 788                 {
 789                 if (!set_ext_copy(&ext_copy, f))
 790                         {
 791                         BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
 792                         goto err;
 793                         }
 794                 }
 795         else
 796                 ERR_clear_error();
 797
 798         /*****************************************************************/
 799         /* lookup where to write new certificates */
 800         if ((outdir == NULL) && (req))
 801                 {
 802                 struct stat sb;
 803
 804                 if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
 805                         == NULL)
 806                         {
 807                         BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
 808                         goto err;
 809                         }
 810 #ifndef OPENSSL_SYS_VMS
 811             /* outdir is a directory spec, but access() for VMS demands a
 812                filename.  In any case, stat(), below, will catch the problem
 813                if outdir is not a directory spec, and the fopen() or open()
 814                will catch an error if there is no write access.
 815
 816                Presumably, this problem could also be solved by using the DEC
 817                C routines to convert the directory syntax to Unixly, and give
 818                that to access().  However, time's too short to do that just
 819                now.
 820             */
 821                 if (access(outdir,R_OK|W_OK|X_OK) != 0)
 822                         {
 823                         BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
 824                         perror(outdir);
 825                         goto err;
 826                         }
 827
 828                 if (stat(outdir,&sb) != 0)
 829                         {
 830                         BIO_printf(bio_err,"unable to stat(%s)\n",outdir);
 831                         perror(outdir);
 832                         goto err;
 833                         }
 834 #ifdef S_IFDIR
 835                 if (!(sb.st_mode & S_IFDIR))
 836                         {
 837                         BIO_printf(bio_err,"%s need to be a directory\n",outdir);
 838                         perror(outdir);
 839                         goto err;
 840                         }
 841 #endif
 842 #endif
 843                 }
 844
 845         /*****************************************************************/
 846         /* we need to load the database file */
 847         if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 848                 {
 849                 lookup_fail(section,ENV_DATABASE);
 850                 goto err;
 851                 }
 852         if (BIO_read_filename(in,dbfile) <= 0)
 853                 {
 854                 perror(dbfile);
 855                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
 856                 goto err;
 857                 }
 858         db=TXT_DB_read(in,DB_NUMBER);
 859         if (db == NULL) goto err;
 860
 861         /* Lets check some fields */
 862         for (i=0; i<sk_num(db->data); i++)
 863                 {
 864                 pp=(char **)sk_value(db->data,i);
 865                 if ((pp[DB_type][0] != DB_TYPE_REV) &&
 866                         (pp[DB_rev_date][0] != '\0'))
 867                         {
 868                         BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
 869                         goto err;
 870                         }
 871                 if ((pp[DB_type][0] == DB_TYPE_REV) &&
 872                         !make_revoked(NULL, pp[DB_rev_date]))
 873                         {
 874                         BIO_printf(bio_err," in entry %d\n", i+1);
 875                         goto err;
 876                         }
 877                 if (!check_time_format(pp[DB_exp_date]))
 878                         {
 879                         BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
 880                         goto err;
 881                         }
 882                 p=pp[DB_serial];
 883                 j=strlen(p);
 884                 if (*p == '-')
 885                         {
 886                         p++;
 887                         j--;
 888                         }
 889                 if ((j&1) || (j < 2))
 890                         {
 891                         BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
 892                         goto err;
 893                         }
 894                 while (*p)
 895                         {
 896                         if (!(  ((*p >= '0') && (*p <= '9')) ||
 897                                 ((*p >= 'A') && (*p <= 'F')) ||
 898                                 ((*p >= 'a') && (*p <= 'f')))  )
 899                                 {
 900                                 BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
 901                                 goto err;
 902                                 }
 903                         p++;
 904                         }
 905                 }
 906         if (verbose)
 907                 {
 908                 BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
 909 #ifdef OPENSSL_SYS_VMS
 910                 {
 911                 BIO *tmpbio = BIO_new(BIO_f_linebuffer());
 912                 out = BIO_push(tmpbio, out);
 913                 }
 914 #endif
 915                 TXT_DB_write(out,db);
 916                 BIO_printf(bio_err,"%d entries loaded from the database\n",
 917                         db->data->num);
 918                 BIO_printf(bio_err,"generating index\n");
 919                 }
 920
 921         if (!make_serial_index(db))
 922                 goto err;
 923
 924         if (!TXT_DB_create_index(db, DB_name, index_name_qual,
 925                         LHASH_HASH_FN(index_name_hash),
 926                         LHASH_COMP_FN(index_name_cmp)))
 927                 {
 928                 BIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\n",
 929                         db->error,db->arg1,db->arg2);
 930                 goto err;
 931                 }
 932
 933         /*****************************************************************/
 934         /* Update the db file for expired certificates */
 935         if (doupdatedb)
 936                 {
 937                 if (verbose)
 938                         BIO_printf(bio_err, "Updating %s ...\n",
 939                                                         dbfile);
 940
 941                 i = do_updatedb(db);
 942                 if (i == -1)
 943                         {
 944                         BIO_printf(bio_err,"Malloc failure\n");
 945                         goto err;
 946                         }
 947                 else if (i == 0)
 948                         {
 949                         if (verbose) BIO_printf(bio_err,
 950                                         "No entries found to mark expired\n");
 951                         }
 952                 else
 953                         {
 954                         out = BIO_new(BIO_s_file());
 955                         if (out == NULL)
 956                                 {
 957                                 ERR_print_errors(bio_err);
 958                                 goto err;
 959                                 }
 960
 961 #ifndef OPENSSL_SYS_VMS
 962                         j = BIO_snprintf(buf[0], sizeof buf[0], "%s.new", dbfile);
 963 #else
 964                         j = BIO_snprintf(buf[0], sizeof buf[0], "%s-new", dbfile);
 965 #endif
 966                         if (j < 0 || j >= sizeof buf[0])
 967                                 {
 968                                 BIO_printf(bio_err, "file name too long\n");
 969                                 goto err;
 970                                 }
 971                         if (BIO_write_filename(out,buf[0]) <= 0)
 972                                 {
 973                                 perror(dbfile);
 974                                 BIO_printf(bio_err,"unable to open '%s'\n",
 975                                                                         dbfile);
 976                                 goto err;
 977                                 }
 978                         j=TXT_DB_write(out,db);
 979                         if (j <= 0) goto err;
 980
 981                         BIO_free(out);
 982                         out = NULL;
 983 #ifndef OPENSSL_SYS_VMS
 984                         j = BIO_snprintf(buf[1], sizeof buf[1], "%s.old", dbfile);
 985 #else
 986                         j = BIO_snprintf(buf[1], sizeof buf[1], "%s-old", dbfile);
 987 #endif
 988                         if (j < 0 || j >= sizeof buf[1])
 989                                 {
 990                                 BIO_printf(bio_err, "file name too long\n");
 991                                 goto err;
 992                                 }
 993                         if (rename(dbfile,buf[1]) < 0)
 994                                 {
 995                                 BIO_printf(bio_err,
 996                                                 "unable to rename %s to %s\n",
 997                                                 dbfile, buf[1]);
 998                                 perror("reason");
 999                                 goto err;
1000                                 }
1001                         if (rename(buf[0],dbfile) < 0)
1002                                 {
1003                                 BIO_printf(bio_err,
1004                                                 "unable to rename %s to %s\n",
1005                                                 buf[0],dbfile);
1006                                 perror("reason");
1007                                 rename(buf[1],dbfile);
1008                                 goto err;
1009                                 }
1010
1011                         if (verbose) BIO_printf(bio_err,
1012                                 "Done. %d entries marked as expired\n",i);
1013                         }
1014                         goto err;
1015                 }
1016
1017         /*****************************************************************/
1018         /* Read extentions config file                                   */
1019         if (extfile)
1020                 {
1021                 extconf = NCONF_new(NULL);
1022                 if (NCONF_load(extconf,extfile,&errorline) <= 0)
1023                         {
1024                         if (errorline <= 0)
1025                                 BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
1026                                         extfile);
1027                         else
1028                                 BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
1029                                         errorline,extfile);
1030                         ret = 1;
1031                         goto err;
1032                         }
1033
1034                 if (verbose)
1035                         BIO_printf(bio_err, "Successfully loaded extensions file %s\n", extfile);
1036
1037                 /* We can have sections in the ext file */
1038                 if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
1039                         extensions = "default";
1040                 }
1041
1042         /*****************************************************************/
1043         if (req || gencrl)
1044                 {
1045                 if (outfile != NULL)
1046                         {
1047                         if (BIO_write_filename(Sout,outfile) <= 0)
1048                                 {
1049                                 perror(outfile);
1050                                 goto err;
1051                                 }
1052                         }
1053                 else
1054                         {
1055                         BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
1056 #ifdef OPENSSL_SYS_VMS
1057                         {
1058                         BIO *tmpbio = BIO_new(BIO_f_linebuffer());
1059                         Sout = BIO_push(tmpbio, Sout);
1060                         }
1061 #endif
1062                         }
1063                 }
1064
1065         if (req)
1066                 {
1067                 if ((md == NULL) && ((md=NCONF_get_string(conf,
1068                         section,ENV_DEFAULT_MD)) == NULL))
1069                         {
1070                         lookup_fail(section,ENV_DEFAULT_MD);
1071                         goto err;
1072                         }
1073                 if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
1074                         section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
1075                         {
1076                         if(strcmp(tmp_email_dn,"no") == 0)
1077                                 email_dn=0;
1078                         }
1079                 if ((dgst=EVP_get_digestbyname(md)) == NULL)
1080                         {
1081                         BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1082                         goto err;
1083                         }
1084                 if (verbose)
1085                         BIO_printf(bio_err,"message digest is %s\n",
1086                                 OBJ_nid2ln(dgst->type));
1087                 if ((policy == NULL) && ((policy=NCONF_get_string(conf,
1088                         section,ENV_POLICY)) == NULL))
1089                         {
1090                         lookup_fail(section,ENV_POLICY);
1091                         goto err;
1092                         }
1093                 if (verbose)
1094                         BIO_printf(bio_err,"policy is %s\n",policy);
1095
1096                 if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
1097                         == NULL)
1098                         {
1099                         lookup_fail(section,ENV_SERIAL);
1100                         goto err;
1101                         }
1102
1103                 if (!extconf)
1104                         {
1105                         /* no '-extfile' option, so we look for extensions
1106                          * in the main configuration file */
1107                         if (!extensions)
1108                                 {
1109                                 extensions=NCONF_get_string(conf,section,
1110                                                                 ENV_EXTENSIONS);
1111                                 if (!extensions)
1112                                         ERR_clear_error();
1113                                 }
1114                         if (extensions)
1115                                 {
1116                                 /* Check syntax of file */
1117                                 X509V3_CTX ctx;
1118                                 X509V3_set_ctx_test(&ctx);
1119                                 X509V3_set_nconf(&ctx, conf);
1120                                 if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
1121                                                                 NULL))
1122                                         {
1123                                         BIO_printf(bio_err,
1124                                         "Error Loading extension section %s\n",
1125                                                                  extensions);
1126                                         ret = 1;
1127                                         goto err;
1128                                         }
1129                                 }
1130                         }
1131
1132                 if (startdate == NULL)
1133                         {
1134                         startdate=NCONF_get_string(conf,section,
1135                                 ENV_DEFAULT_STARTDATE);
1136                         if (startdate == NULL)
1137                                 ERR_clear_error();
1138                         }
1139                 if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))
1140                         {
1141                         BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");
1142                         goto err;
1143                         }
1144                 if (startdate == NULL) startdate="today";
1145
1146                 if (enddate == NULL)
1147                         {
1148                         enddate=NCONF_get_string(conf,section,
1149                                 ENV_DEFAULT_ENDDATE);
1150                         if (enddate == NULL)
1151                                 ERR_clear_error();
1152                         }
1153                 if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))
1154                         {
1155                         BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");
1156                         goto err;
1157                         }
1158
1159                 if (days == 0)
1160                         {
1161                         if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
1162                                 days = 0;
1163                         }
1164                 if (!enddate && (days == 0))
1165                         {
1166                         BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
1167                         goto err;
1168                         }
1169
1170                 if ((serial=load_serial(serialfile)) == NULL)
1171                         {
1172                         BIO_printf(bio_err,"error while loading serial number\n");
1173                         goto err;
1174                         }
1175                 if (verbose)
1176                         {
1177                         if (BN_is_zero(serial))
1178                                 BIO_printf(bio_err,"next serial number is 00\n");
1179                         else
1180                                 {
1181                                 if ((f=BN_bn2hex(serial)) == NULL) goto err;
1182                                 BIO_printf(bio_err,"next serial number is %s\n",f);
1183                                 OPENSSL_free(f);
1184                                 }
1185                         }
1186
1187                 if ((attribs=NCONF_get_section(conf,policy)) == NULL)
1188                         {
1189                         BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
1190                         goto err;
1191                         }
1192
1193                 if ((cert_sk=sk_X509_new_null()) == NULL)
1194                         {
1195                         BIO_printf(bio_err,"Memory allocation failure\n");
1196                         goto err;
1197                         }
1198                 if (spkac_file != NULL)
1199                         {
1200                         total++;
1201                         j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
1202                                 serial,subj,email_dn,startdate,enddate,days,extensions,
1203                                 conf,verbose,certopt,nameopt,default_op,ext_copy);
1204                         if (j < 0) goto err;
1205                         if (j > 0)
1206                                 {
1207                                 total_done++;
1208                                 BIO_printf(bio_err,"\n");
1209                                 if (!BN_add_word(serial,1)) goto err;
1210                                 if (!sk_X509_push(cert_sk,x))
1211                                         {
1212                                         BIO_printf(bio_err,"Memory allocation failure\n");
1213                                         goto err;
1214                                         }
1215                                 if (outfile)
1216                                         {
1217                                         output_der = 1;
1218                                         batch = 1;
1219                                         }
1220                                 }
1221                         }
1222                 if (ss_cert_file != NULL)
1223                         {
1224                         total++;
1225                         j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
1226                                 db,serial,subj,email_dn,startdate,enddate,days,batch,
1227                                 extensions,conf,verbose, certopt, nameopt,
1228                                 default_op, ext_copy, e);
1229                         if (j < 0) goto err;
1230                         if (j > 0)
1231                                 {
1232                                 total_done++;
1233                                 BIO_printf(bio_err,"\n");
1234                                 if (!BN_add_word(serial,1)) goto err;
1235                                 if (!sk_X509_push(cert_sk,x))
1236                                         {
1237                                         BIO_printf(bio_err,"Memory allocation failure\n");
1238                                         goto err;
1239                                         }
1240                                 }
1241                         }
1242                 if (infile != NULL)
1243                         {
1244                         total++;
1245                         j=certify(&x,infile,pkey,x509,dgst,attribs,db,
1246                                 serial,subj,email_dn,startdate,enddate,days,batch,
1247                                 extensions,conf,verbose, certopt, nameopt,
1248                                 default_op, ext_copy);
1249                         if (j < 0) goto err;
1250                         if (j > 0)
1251                                 {
1252                                 total_done++;
1253                                 BIO_printf(bio_err,"\n");
1254                                 if (!BN_add_word(serial,1)) goto err;
1255                                 if (!sk_X509_push(cert_sk,x))
1256                                         {
1257                                         BIO_printf(bio_err,"Memory allocation failure\n");
1258                                         goto err;
1259                                         }
1260                                 }
1261                         }
1262                 for (i=0; i<argc; i++)
1263                         {
1264                         total++;
1265                         j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
1266                                 serial,subj,email_dn,startdate,enddate,days,batch,
1267                                 extensions,conf,verbose, certopt, nameopt,
1268                                 default_op, ext_copy);
1269                         if (j < 0) goto err;
1270                         if (j > 0)
1271                                 {
1272                                 total_done++;
1273                                 BIO_printf(bio_err,"\n");
1274                                 if (!BN_add_word(serial,1)) goto err;
1275                                 if (!sk_X509_push(cert_sk,x))
1276                                         {
1277                                         BIO_printf(bio_err,"Memory allocation failure\n");
1278                                         goto err;
1279                                         }
1280                                 }
1281                         }
1282                 /* we have a stack of newly certified certificates
1283                  * and a data base and serial number that need
1284                  * updating */
1285
1286                 if (sk_X509_num(cert_sk) > 0)
1287                         {
1288                         if (!batch)
1289                                 {
1290                                 BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
1291                                 (void)BIO_flush(bio_err);
1292                                 buf[0][0]='\0';
1293                                 fgets(buf[0],10,stdin);
1294                                 if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
1295                                         {
1296                                         BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
1297                                         ret=0;
1298                                         goto err;
1299                                         }
1300                                 }
1301
1302                         BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
1303
1304                         if(strlen(serialfile) > BSIZE-5 || strlen(dbfile) > BSIZE-5)
1305                                 {
1306                                 BIO_printf(bio_err,"file name too long\n");
1307                                 goto err;
1308                                 }
1309
1310                         strcpy(buf[0],serialfile);
1311
1312 #ifdef OPENSSL_SYS_VMS
1313                         strcat(buf[0],"-new");
1314 #else
1315                         strcat(buf[0],".new");
1316 #endif
1317
1318                         if (!save_serial(buf[0],serial)) goto err;
1319
1320                         strcpy(buf[1],dbfile);
1321
1322 #ifdef OPENSSL_SYS_VMS
1323                         strcat(buf[1],"-new");
1324 #else
1325                         strcat(buf[1],".new");
1326 #endif
1327
1328                         if (BIO_write_filename(out,buf[1]) <= 0)
1329                                 {
1330                                 perror(dbfile);
1331                                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
1332                                 goto err;
1333                                 }
1334                         l=TXT_DB_write(out,db);
1335                         if (l <= 0) goto err;
1336                         }
1337
1338                 if (verbose)
1339                         BIO_printf(bio_err,"writing new certificates\n");
1340                 for (i=0; i<sk_X509_num(cert_sk); i++)
1341                         {
1342                         int k;
1343                         unsigned char *n;
1344
1345                         x=sk_X509_value(cert_sk,i);
1346
1347                         j=x->cert_info->serialNumber->length;
1348                         p=(char *)x->cert_info->serialNumber->data;
1349
1350                         if(strlen(outdir) >= (size_t)(j ? BSIZE-j*2-6 : BSIZE-8))
1351                                 {
1352                                 BIO_printf(bio_err,"certificate file name too long\n");
1353                                 goto err;
1354                                 }
1355
1356                         strcpy(buf[2],outdir);
1357
1358 #ifndef OPENSSL_SYS_VMS
1359                         strcat(buf[2],"/");
1360 #endif
1361
1362                         n=(unsigned char *)&(buf[2][strlen(buf[2])]);
1363                         if (j > 0)
1364                                 {
1365                                 for (k=0; k<j; k++)
1366                                         {
1367                                         sprintf((char *)n,"%02X",(unsigned char)*(p++));
1368                                         n+=2;
1369                                         }
1370                                 }
1371                         else
1372                                 {
1373                                 *(n++)='0';
1374                                 *(n++)='0';
1375                                 }
1376                         *(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
1377                         *n='\0';
1378                         if (verbose)
1379                                 BIO_printf(bio_err,"writing %s\n",buf[2]);
1380
1381                         if (BIO_write_filename(Cout,buf[2]) <= 0)
1382                                 {
1383                                 perror(buf[2]);
1384                                 goto err;
1385                                 }
1386                         write_new_certificate(Cout,x, 0, notext);
1387                         write_new_certificate(Sout,x, output_der, notext);
1388                         }
1389
1390                 if (sk_X509_num(cert_sk))
1391                         {
1392                         /* Rename the database and the serial file */
1393                         strncpy(buf[2],serialfile,BSIZE-4);
1394                         buf[2][BSIZE-4]='\0';
1395
1396 #ifdef OPENSSL_SYS_VMS
1397                         strcat(buf[2],"-old");
1398 #else
1399                         strcat(buf[2],".old");
1400 #endif
1401
1402                         BIO_free(in);
1403                         BIO_free_all(out);
1404                         in=NULL;
1405                         out=NULL;
1406                         if (rename(serialfile,buf[2]) < 0)
1407                                 {
1408                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1409                                         serialfile,buf[2]);
1410                                 perror("reason");
1411                                 goto err;
1412                                 }
1413                         if (rename(buf[0],serialfile) < 0)
1414                                 {
1415                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1416                                         buf[0],serialfile);
1417                                 perror("reason");
1418                                 rename(buf[2],serialfile);
1419                                 goto err;
1420                                 }
1421
1422                         strncpy(buf[2],dbfile,BSIZE-4);
1423                         buf[2][BSIZE-4]='\0';
1424
1425 #ifdef OPENSSL_SYS_VMS
1426                         strcat(buf[2],"-old");
1427 #else
1428                         strcat(buf[2],".old");
1429 #endif
1430
1431                         if (rename(dbfile,buf[2]) < 0)
1432                                 {
1433                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1434                                         dbfile,buf[2]);
1435                                 perror("reason");
1436                                 goto err;
1437                                 }
1438                         if (rename(buf[1],dbfile) < 0)
1439                                 {
1440                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1441                                         buf[1],dbfile);
1442                                 perror("reason");
1443                                 rename(buf[2],dbfile);
1444                                 goto err;
1445                                 }
1446                         BIO_printf(bio_err,"Data Base Updated\n");
1447                         }
1448                 }
1449
1450         /*****************************************************************/
1451         if (gencrl)
1452                 {
1453                 int crl_v2 = 0;
1454                 if (!crl_ext)
1455                         {
1456                         crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
1457                         if (!crl_ext)
1458                                 ERR_clear_error();
1459                         }
1460                 if (crl_ext)
1461                         {
1462                         /* Check syntax of file */
1463                         X509V3_CTX ctx;
1464                         X509V3_set_ctx_test(&ctx);
1465                         X509V3_set_nconf(&ctx, conf);
1466                         if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
1467                                 {
1468                                 BIO_printf(bio_err,
1469                                  "Error Loading CRL extension section %s\n",
1470                                                                  crl_ext);
1471                                 ret = 1;
1472                                 goto err;
1473                                 }
1474                         }
1475
1476                 if (!crldays && !crlhours)
1477                         {
1478                         if (!NCONF_get_number(conf,section,
1479                                 ENV_DEFAULT_CRL_DAYS, &crldays))
1480                                 crldays = 0;
1481                         if (!NCONF_get_number(conf,section,
1482                                 ENV_DEFAULT_CRL_HOURS, &crlhours))
1483                                 crlhours = 0;
1484                         }
1485                 if ((crldays == 0) && (crlhours == 0))
1486                         {
1487                         BIO_printf(bio_err,"cannot lookup how long until the next CRL is issued\n");
1488                         goto err;
1489                         }
1490
1491                 if (verbose) BIO_printf(bio_err,"making CRL\n");
1492                 if ((crl=X509_CRL_new()) == NULL) goto err;
1493                 if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509))) goto err;
1494
1495                 tmptm = ASN1_TIME_new();
1496                 if (!tmptm) goto err;
1497                 X509_gmtime_adj(tmptm,0);
1498                 X509_CRL_set_lastUpdate(crl, tmptm);
1499                 X509_gmtime_adj(tmptm,(crldays*24+crlhours)*60*60);
1500                 X509_CRL_set_nextUpdate(crl, tmptm);
1501
1502                 ASN1_TIME_free(tmptm);
1503
1504                 for (i=0; i<sk_num(db->data); i++)
1505                         {
1506                         pp=(char **)sk_value(db->data,i);
1507                         if (pp[DB_type][0] == DB_TYPE_REV)
1508                                 {
1509                                 if ((r=X509_REVOKED_new()) == NULL) goto err;
1510                                 j = make_revoked(r, pp[DB_rev_date]);
1511                                 if (!j) goto err;
1512                                 if (j == 2) crl_v2 = 1;
1513                                 if (!BN_hex2bn(&serial, pp[DB_serial]))
1514                                         goto err;
1515                                 tmpser = BN_to_ASN1_INTEGER(serial, NULL);
1516                                 BN_free(serial);
1517                                 serial = NULL;
1518                                 if (!tmpser)
1519                                         goto err;
1520                                 X509_REVOKED_set_serialNumber(r, tmpser);
1521                                 ASN1_INTEGER_free(tmpser);
1522                                 X509_CRL_add0_revoked(crl,r);
1523                                 }
1524                         }
1525
1526                 /* sort the data so it will be written in serial
1527                  * number order */
1528                 X509_CRL_sort(crl);
1529
1530                 /* we now have a CRL */
1531                 if (verbose) BIO_printf(bio_err,"signing CRL\n");
1532                 if (md != NULL)
1533                         {
1534                         if ((dgst=EVP_get_digestbyname(md)) == NULL)
1535                                 {
1536                                 BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1537                                 goto err;
1538                                 }
1539                         }
1540                 else
1541                         {
1542 #ifndef OPENSSL_NO_DSA
1543                         if (pkey->type == EVP_PKEY_DSA)
1544                                 dgst=EVP_dss1();
1545                         else
1546 #endif
1547                                 dgst=EVP_md5();
1548                         }
1549
1550                 /* Add any extensions asked for */
1551
1552                 if (crl_ext)
1553                         {
1554                         X509V3_CTX crlctx;
1555                         X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
1556                         X509V3_set_nconf(&crlctx, conf);
1557
1558                         if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
1559                                 crl_ext, crl)) goto err;
1560                         }
1561                 if (crl_ext || crl_v2)
1562                         {
1563                         if (!X509_CRL_set_version(crl, 1))
1564                                 goto err; /* version 2 CRL */
1565                         }
1566
1567                 if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
1568
1569                 PEM_write_bio_X509_CRL(Sout,crl);
1570                 }
1571         /*****************************************************************/
1572         if (dorevoke)
1573                 {
1574                 if (infile == NULL)
1575                         {
1576                         BIO_printf(bio_err,"no input files\n");
1577                         goto err;
1578                         }
1579                 else
1580                         {
1581                         X509 *revcert;
1582                         revcert=load_cert(bio_err, infile, FORMAT_PEM,
1583                                 NULL, e, infile);
1584                         if (revcert == NULL)
1585                                 goto err;
1586                         j=do_revoke(revcert,db, rev_type, rev_arg);
1587                         if (j <= 0) goto err;
1588                         X509_free(revcert);
1589
1590                         if(strlen(dbfile) > BSIZE-5)
1591                                 {
1592                                 BIO_printf(bio_err,"filename too long\n");
1593                                 goto err;
1594                                 }
1595
1596                         strcpy(buf[0],dbfile);
1597 #ifndef OPENSSL_SYS_VMS
1598                         strcat(buf[0],".new");
1599 #else
1600                         strcat(buf[0],"-new");
1601 #endif
1602                         if (BIO_write_filename(out,buf[0]) <= 0)
1603                                 {
1604                                 perror(dbfile);
1605                                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
1606                                 goto err;
1607                                 }
1608                         j=TXT_DB_write(out,db);
1609                         if (j <= 0) goto err;
1610                         BIO_free_all(out);
1611                         out = NULL;
1612                         BIO_free_all(in);
1613                         in = NULL;
1614                         strncpy(buf[1],dbfile,BSIZE-4);
1615                         buf[1][BSIZE-4]='\0';
1616 #ifndef OPENSSL_SYS_VMS
1617                         strcat(buf[1],".old");
1618 #else
1619                         strcat(buf[1],"-old");
1620 #endif
1621                         if (rename(dbfile,buf[1]) < 0)
1622                                 {
1623                                 BIO_printf(bio_err,"unable to rename %s to %s\n", dbfile, buf[1]);
1624                                 perror("reason");
1625                                 goto err;
1626                                 }
1627                         if (rename(buf[0],dbfile) < 0)
1628                                 {
1629                                 BIO_printf(bio_err,"unable to rename %s to %s\n", buf[0],dbfile);
1630                                 perror("reason");
1631                                 rename(buf[1],dbfile);
1632                                 goto err;
1633                                 }
1634                         BIO_printf(bio_err,"Data Base Updated\n");
1635                         }
1636                 }
1637         /*****************************************************************/
1638         ret=0;
1639 err:
1640         if(tofree)
1641                 OPENSSL_free(tofree);
1642         BIO_free_all(Cout);
1643         BIO_free_all(Sout);
1644         BIO_free_all(out);
1645         BIO_free_all(in);
1646
1647         if (cert_sk)
1648                 sk_X509_pop_free(cert_sk,X509_free);
1649
1650         if (ret) ERR_print_errors(bio_err);
1651         app_RAND_write_file(randfile, bio_err);
1652         if (free_key && key)
1653                 OPENSSL_free(key);
1654         BN_free(serial);
1655         TXT_DB_free(db);
1656         EVP_PKEY_free(pkey);
1657         X509_free(x509);
1658         X509_CRL_free(crl);
1659         NCONF_free(conf);
1660         OBJ_cleanup();
1661         apps_shutdown();
1662         OPENSSL_EXIT(ret);
1663         }
1664
1665 static void lookup_fail(char *name, char *tag)
1666         {
1667         BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
1668         }
1669
1670 static unsigned long index_serial_hash(const char **a)
1671         {
1672         const char *n;
1673
1674         n=a[DB_serial];
1675         while (*n == '0') n++;
1676         return(lh_strhash(n));
1677         }
1678
1679 static int index_serial_cmp(const char **a, const char **b)
1680         {
1681         const char *aa,*bb;
1682
1683         for (aa=a[DB_serial]; *aa == '0'; aa++);
1684         for (bb=b[DB_serial]; *bb == '0'; bb++);
1685         return(strcmp(aa,bb));
1686         }
1687
1688 static unsigned long index_name_hash(const char **a)
1689         { return(lh_strhash(a[DB_name])); }
1690
1691 static int index_name_qual(char **a)
1692         { return(a[0][0] == 'V'); }
1693
1694 static int index_name_cmp(const char **a, const char **b)
1695         { return(strcmp(a[DB_name],
1696              b[DB_name])); }
1697
1698 static BIGNUM *load_serial(char *serialfile)
1699         {
1700         BIO *in=NULL;
1701         BIGNUM *ret=NULL;
1702         MS_STATIC char buf[1024];
1703         ASN1_INTEGER *ai=NULL;
1704
1705         if ((in=BIO_new(BIO_s_file())) == NULL)
1706                 {
1707                 ERR_print_errors(bio_err);
1708                 goto err;
1709                 }
1710
1711         if (BIO_read_filename(in,serialfile) <= 0)
1712                 {
1713                 perror(serialfile);
1714                 goto err;
1715                 }
1716         ai=ASN1_INTEGER_new();
1717         if (ai == NULL) goto err;
1718         if (!a2i_ASN1_INTEGER(in,ai,buf,1024))
1719                 {
1720                 BIO_printf(bio_err,"unable to load number from %s\n",
1721                         serialfile);
1722                 goto err;
1723                 }
1724         ret=ASN1_INTEGER_to_BN(ai,NULL);
1725         if (ret == NULL)
1726                 {
1727                 BIO_printf(bio_err,"error converting number from bin to BIGNUM\n");
1728                 goto err;
1729                 }
1730 err:
1731         if (in != NULL) BIO_free(in);
1732         if (ai != NULL) ASN1_INTEGER_free(ai);
1733         return(ret);
1734         }
1735
1736 static int save_serial(char *serialfile, BIGNUM *serial)
1737         {
1738         BIO *out;
1739         int ret=0;
1740         ASN1_INTEGER *ai=NULL;
1741
1742         out=BIO_new(BIO_s_file());
1743         if (out == NULL)
1744                 {
1745                 ERR_print_errors(bio_err);
1746                 goto err;
1747                 }
1748         if (BIO_write_filename(out,serialfile) <= 0)
1749                 {
1750                 perror(serialfile);
1751                 goto err;
1752                 }
1753
1754         if ((ai=BN_to_ASN1_INTEGER(serial,NULL)) == NULL)
1755                 {
1756                 BIO_printf(bio_err,"error converting serial to ASN.1 format\n");
1757                 goto err;
1758                 }
1759         i2a_ASN1_INTEGER(out,ai);
1760         BIO_puts(out,"\n");
1761         ret=1;
1762 err:
1763         if (out != NULL) BIO_free_all(out);
1764         if (ai != NULL) ASN1_INTEGER_free(ai);
1765         return(ret);
1766         }
1767
1768 static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1769              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
1770              BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
1771              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1772              unsigned long certopt, unsigned long nameopt, int default_op,
1773              int ext_copy)
1774         {
1775         X509_REQ *req=NULL;
1776         BIO *in=NULL;
1777         EVP_PKEY *pktmp=NULL;
1778         int ok= -1,i;
1779
1780         in=BIO_new(BIO_s_file());
1781
1782         if (BIO_read_filename(in,infile) <= 0)
1783                 {
1784                 perror(infile);
1785                 goto err;
1786                 }
1787         if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
1788                 {
1789                 BIO_printf(bio_err,"Error reading certificate request in %s\n",
1790                         infile);
1791                 goto err;
1792                 }
1793         if (verbose)
1794                 X509_REQ_print(bio_err,req);
1795
1796         BIO_printf(bio_err,"Check that the request matches the signature\n");
1797
1798         if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
1799                 {
1800                 BIO_printf(bio_err,"error unpacking public key\n");
1801                 goto err;
1802                 }
1803         i=X509_REQ_verify(req,pktmp);
1804         EVP_PKEY_free(pktmp);
1805         if (i < 0)
1806                 {
1807                 ok=0;
1808                 BIO_printf(bio_err,"Signature verification problems....\n");
1809                 goto err;
1810                 }
1811         if (i == 0)
1812                 {
1813                 ok=0;
1814                 BIO_printf(bio_err,"Signature did not match the certificate request\n");
1815                 goto err;
1816                 }
1817         else
1818                 BIO_printf(bio_err,"Signature ok\n");
1819
1820         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj, email_dn,
1821                 startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
1822                 certopt, nameopt, default_op, ext_copy);
1823
1824 err:
1825         if (req != NULL) X509_REQ_free(req);
1826         if (in != NULL) BIO_free(in);
1827         return(ok);
1828         }
1829
1830 static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1831              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
1832              BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
1833              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1834              unsigned long certopt, unsigned long nameopt, int default_op,
1835              int ext_copy, ENGINE *e)
1836         {
1837         X509 *req=NULL;
1838         X509_REQ *rreq=NULL;
1839         EVP_PKEY *pktmp=NULL;
1840         int ok= -1,i;
1841
1842         if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
1843                 goto err;
1844         if (verbose)
1845                 X509_print(bio_err,req);
1846
1847         BIO_printf(bio_err,"Check that the request matches the signature\n");
1848
1849         if ((pktmp=X509_get_pubkey(req)) == NULL)
1850                 {
1851                 BIO_printf(bio_err,"error unpacking public key\n");
1852                 goto err;
1853                 }
1854         i=X509_verify(req,pktmp);
1855         EVP_PKEY_free(pktmp);
1856         if (i < 0)
1857                 {
1858                 ok=0;
1859                 BIO_printf(bio_err,"Signature verification problems....\n");
1860                 goto err;
1861                 }
1862         if (i == 0)
1863                 {
1864                 ok=0;
1865                 BIO_printf(bio_err,"Signature did not match the certificate\n");
1866                 goto err;
1867                 }
1868         else
1869                 BIO_printf(bio_err,"Signature ok\n");
1870
1871         if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
1872                 goto err;
1873
1874         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
1875                 days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
1876                 ext_copy);
1877
1878 err:
1879         if (rreq != NULL) X509_REQ_free(rreq);
1880         if (req != NULL) X509_free(req);
1881         return(ok);
1882         }
1883
1884 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
1885              STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial, char *subj,
1886              int email_dn, char *startdate, char *enddate, long days, int batch,
1887              int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
1888              unsigned long certopt, unsigned long nameopt, int default_op,
1889              int ext_copy)
1890         {
1891         X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
1892         ASN1_UTCTIME *tm,*tmptm;
1893         ASN1_STRING *str,*str2;
1894         ASN1_OBJECT *obj;
1895         X509 *ret=NULL;
1896         X509_CINF *ci;
1897         X509_NAME_ENTRY *ne;
1898         X509_NAME_ENTRY *tne,*push;
1899         EVP_PKEY *pktmp;
1900         int ok= -1,i,j,last,nid;
1901         char *p;
1902         CONF_VALUE *cv;
1903         char *row[DB_NUMBER],**rrow,**irow=NULL;
1904         char buf[25];
1905
1906         tmptm=ASN1_UTCTIME_new();
1907         if (tmptm == NULL)
1908                 {
1909                 BIO_printf(bio_err,"malloc error\n");
1910                 return(0);
1911                 }
1912
1913         for (i=0; i<DB_NUMBER; i++)
1914                 row[i]=NULL;
1915
1916         if (subj)
1917                 {
1918                 X509_NAME *n = do_subject(subj, MBSTRING_ASC);
1919
1920                 if (!n)
1921                         {
1922                         ERR_print_errors(bio_err);
1923                         goto err;
1924                         }
1925                 X509_REQ_set_subject_name(req,n);
1926                 req->req_info->enc.modified = 1;
1927                 X509_NAME_free(n);
1928                 }
1929
1930         if (default_op)
1931                 BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
1932
1933         name=X509_REQ_get_subject_name(req);
1934         for (i=0; i<X509_NAME_entry_count(name); i++)
1935                 {
1936                 ne= X509_NAME_get_entry(name,i);
1937                 str=X509_NAME_ENTRY_get_data(ne);
1938                 obj=X509_NAME_ENTRY_get_object(ne);
1939
1940                 if (msie_hack)
1941                         {
1942                         /* assume all type should be strings */
1943                         nid=OBJ_obj2nid(ne->object);
1944
1945                         if (str->type == V_ASN1_UNIVERSALSTRING)
1946                                 ASN1_UNIVERSALSTRING_to_string(str);
1947
1948                         if ((str->type == V_ASN1_IA5STRING) &&
1949                                 (nid != NID_pkcs9_emailAddress))
1950                                 str->type=V_ASN1_T61STRING;
1951
1952                         if ((nid == NID_pkcs9_emailAddress) &&
1953                                 (str->type == V_ASN1_PRINTABLESTRING))
1954                                 str->type=V_ASN1_IA5STRING;
1955                         }
1956
1957                 /* If no EMAIL is wanted in the subject */
1958                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
1959                         continue;
1960
1961                 /* check some things */
1962                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
1963                         (str->type != V_ASN1_IA5STRING))
1964                         {
1965                         BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
1966                         goto err;
1967                         }
1968                 if ((str->type != V_ASN1_BMPSTRING) && (str->type != V_ASN1_UTF8STRING))
1969                         {
1970                         j=ASN1_PRINTABLE_type(str->data,str->length);
1971                         if (    ((j == V_ASN1_T61STRING) &&
1972                                  (str->type != V_ASN1_T61STRING)) ||
1973                                 ((j == V_ASN1_IA5STRING) &&
1974                                  (str->type == V_ASN1_PRINTABLESTRING)))
1975                                 {
1976                                 BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
1977                                 goto err;
1978                                 }
1979                         }
1980
1981                 if (default_op)
1982                         old_entry_print(bio_err, obj, str);
1983                 }
1984
1985         /* Ok, now we check the 'policy' stuff. */
1986         if ((subject=X509_NAME_new()) == NULL)
1987                 {
1988                 BIO_printf(bio_err,"Memory allocation failure\n");
1989                 goto err;
1990                 }
1991
1992         /* take a copy of the issuer name before we mess with it. */
1993         CAname=X509_NAME_dup(x509->cert_info->subject);
1994         if (CAname == NULL) goto err;
1995         str=str2=NULL;
1996
1997         for (i=0; i<sk_CONF_VALUE_num(policy); i++)
1998                 {
1999                 cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
2000                 if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
2001                         {
2002                         BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
2003                         goto err;
2004                         }
2005                 obj=OBJ_nid2obj(j);
2006
2007                 last= -1;
2008                 for (;;)
2009                         {
2010                         /* lookup the object in the supplied name list */
2011                         j=X509_NAME_get_index_by_OBJ(name,obj,last);
2012                         if (j < 0)
2013                                 {
2014                                 if (last != -1) break;
2015                                 tne=NULL;
2016                                 }
2017                         else
2018                                 {
2019                                 tne=X509_NAME_get_entry(name,j);
2020                                 }
2021                         last=j;
2022
2023                         /* depending on the 'policy', decide what to do. */
2024                         push=NULL;
2025                         if (strcmp(cv->value,"optional") == 0)
2026                                 {
2027                                 if (tne != NULL)
2028                                         push=tne;
2029                                 }
2030                         else if (strcmp(cv->value,"supplied") == 0)
2031                                 {
2032                                 if (tne == NULL)
2033                                         {
2034                                         BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
2035                                         goto err;
2036                                         }
2037                                 else
2038                                         push=tne;
2039                                 }
2040                         else if (strcmp(cv->value,"match") == 0)
2041                                 {
2042                                 int last2;
2043
2044                                 if (tne == NULL)
2045                                         {
2046                                         BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
2047                                         goto err;
2048                                         }
2049
2050                                 last2= -1;
2051
2052 again2:
2053                                 j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
2054                                 if ((j < 0) && (last2 == -1))
2055                                         {
2056                                         BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
2057                                         goto err;
2058                                         }
2059                                 if (j >= 0)
2060                                         {
2061                                         push=X509_NAME_get_entry(CAname,j);
2062                                         str=X509_NAME_ENTRY_get_data(tne);
2063                                         str2=X509_NAME_ENTRY_get_data(push);
2064                                         last2=j;
2065                                         if (ASN1_STRING_cmp(str,str2) != 0)
2066                                                 goto again2;
2067                                         }
2068                                 if (j < 0)
2069                                         {
2070                                         BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
2071                                         goto err;
2072                                         }
2073                                 }
2074                         else
2075                                 {
2076                                 BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
2077                                 goto err;
2078                                 }
2079
2080                         if (push != NULL)
2081                                 {
2082                                 if (!X509_NAME_add_entry(subject,push, -1, 0))
2083                                         {
2084                                         if (push != NULL)
2085                                                 X509_NAME_ENTRY_free(push);
2086                                         BIO_printf(bio_err,"Memory allocation failure\n");
2087                                         goto err;
2088                                         }
2089                                 }
2090                         if (j < 0) break;
2091                         }
2092                 }
2093
2094         if (preserve)
2095                 {
2096                 X509_NAME_free(subject);
2097                 /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
2098                 subject=X509_NAME_dup(name);
2099                 if (subject == NULL) goto err;
2100                 }
2101
2102         if (verbose)
2103                 BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
2104
2105         /* Build the correct Subject if no e-mail is wanted in the subject */
2106         /* and add it later on because of the method extensions are added (altName) */
2107
2108         if (email_dn)
2109                 dn_subject = subject;
2110         else
2111                 {
2112                 X509_NAME_ENTRY *tmpne;
2113                 /* Its best to dup the subject DN and then delete any email
2114                  * addresses because this retains its structure.
2115                  */
2116                 if (!(dn_subject = X509_NAME_dup(subject)))
2117                         {
2118                         BIO_printf(bio_err,"Memory allocation failure\n");
2119                         goto err;
2120                         }
2121                 while((i = X509_NAME_get_index_by_NID(dn_subject,
2122                                         NID_pkcs9_emailAddress, -1)) >= 0)
2123                         {
2124                         tmpne = X509_NAME_get_entry(dn_subject, i);
2125                         X509_NAME_delete_entry(dn_subject, i);
2126                         X509_NAME_ENTRY_free(tmpne);
2127                         }
2128                 }
2129
2130         if (BN_is_zero(serial))
2131                 row[DB_serial]=BUF_strdup("00");
2132         else
2133                 row[DB_serial]=BN_bn2hex(serial);
2134         if (row[DB_serial] == NULL)
2135                 {
2136                 BIO_printf(bio_err,"Memory allocation failure\n");
2137                 goto err;
2138                 }
2139
2140         rrow=TXT_DB_get_by_index(db,DB_name,row);
2141         if (rrow != NULL)
2142                 {
2143                 BIO_printf(bio_err,"ERROR:There is already a certificate for %s\n",
2144                         row[DB_name]);
2145                 }
2146         else
2147                 {
2148                 rrow=TXT_DB_get_by_index(db,DB_serial,row);
2149                 if (rrow != NULL)
2150                         {
2151                         BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
2152                                 row[DB_serial]);
2153                         BIO_printf(bio_err,"      check the database/serial_file for corruption\n");
2154                         }
2155                 }
2156
2157         if (rrow != NULL)
2158                 {
2159                 BIO_printf(bio_err,
2160                         "The matching entry has the following details\n");
2161                 if (rrow[DB_type][0] == 'E')
2162                         p="Expired";
2163                 else if (rrow[DB_type][0] == 'R')
2164                         p="Revoked";
2165                 else if (rrow[DB_type][0] == 'V')
2166                         p="Valid";
2167                 else
2168                         p="\ninvalid type, Data base error\n";
2169                 BIO_printf(bio_err,"Type          :%s\n",p);;
2170                 if (rrow[DB_type][0] == 'R')
2171                         {
2172                         p=rrow[DB_exp_date]; if (p == NULL) p="undef";
2173                         BIO_printf(bio_err,"Was revoked on:%s\n",p);
2174                         }
2175                 p=rrow[DB_exp_date]; if (p == NULL) p="undef";
2176                 BIO_printf(bio_err,"Expires on    :%s\n",p);
2177                 p=rrow[DB_serial]; if (p == NULL) p="undef";
2178                 BIO_printf(bio_err,"Serial Number :%s\n",p);
2179                 p=rrow[DB_file]; if (p == NULL) p="undef";
2180                 BIO_printf(bio_err,"File name     :%s\n",p);
2181                 p=rrow[DB_name]; if (p == NULL) p="undef";
2182                 BIO_printf(bio_err,"Subject Name  :%s\n",p);
2183                 ok= -1; /* This is now a 'bad' error. */
2184                 goto err;
2185                 }
2186
2187         /* We are now totally happy, lets make and sign the certificate */
2188         if (verbose)
2189                 BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
2190
2191         if ((ret=X509_new()) == NULL) goto err;
2192         ci=ret->cert_info;
2193
2194 #ifdef X509_V3
2195         /* Make it an X509 v3 certificate. */
2196         if (!X509_set_version(ret,2)) goto err;
2197 #endif
2198
2199         if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
2200                 goto err;
2201         if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
2202                 goto err;
2203
2204         if (strcmp(startdate,"today") == 0)
2205                 X509_gmtime_adj(X509_get_notBefore(ret),0);
2206         else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);
2207
2208         if (enddate == NULL)
2209                 X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);
2210         else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);
2211
2212         if (!X509_set_subject_name(ret,subject)) goto err;
2213
2214         pktmp=X509_REQ_get_pubkey(req);
2215         i = X509_set_pubkey(ret,pktmp);
2216         EVP_PKEY_free(pktmp);
2217         if (!i) goto err;
2218
2219         /* Lets add the extensions, if there are any */
2220         if (ext_sect)
2221                 {
2222                 X509V3_CTX ctx;
2223                 if (ci->version == NULL)
2224                         if ((ci->version=ASN1_INTEGER_new()) == NULL)
2225                                 goto err;
2226                 ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
2227
2228                 /* Free the current entries if any, there should not
2229                  * be any I believe */
2230                 if (ci->extensions != NULL)
2231                         sk_X509_EXTENSION_pop_free(ci->extensions,
2232                                                    X509_EXTENSION_free);
2233
2234                 ci->extensions = NULL;
2235
2236                 /* Initialize the context structure */
2237                 X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
2238
2239                 if (extconf)
2240                         {
2241                         if (verbose)
2242                                 BIO_printf(bio_err, "Extra configuration file found\n");
2243
2244                         /* Use the extconf configuration db LHASH */
2245                         X509V3_set_nconf(&ctx, extconf);
2246
2247                         /* Test the structure (needed?) */
2248                         /* X509V3_set_ctx_test(&ctx); */
2249
2250                         /* Adds exts contained in the configuration file */
2251                         if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
2252                                 {
2253                                 BIO_printf(bio_err,
2254                                     "ERROR: adding extensions in section %s\n",
2255                                                                 ext_sect);
2256                                 ERR_print_errors(bio_err);
2257                                 goto err;
2258                                 }
2259                         if (verbose)
2260                                 BIO_printf(bio_err, "Successfully added extensions from file.\n");
2261                         }
2262                 else if (ext_sect)
2263                         {
2264                         /* We found extensions to be set from config file */
2265                         X509V3_set_nconf(&ctx, lconf);
2266
2267                         if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
2268                                 {
2269                                 BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
2270                                 ERR_print_errors(bio_err);
2271                                 goto err;
2272                                 }
2273
2274                         if (verbose)
2275                                 BIO_printf(bio_err, "Successfully added extensions from config\n");
2276                         }
2277                 }
2278
2279         /* Copy extensions from request (if any) */
2280
2281         if (!copy_extensions(ret, req, ext_copy))
2282                 {
2283                 BIO_printf(bio_err, "ERROR: adding extensions from request\n");
2284                 ERR_print_errors(bio_err);
2285                 goto err;
2286                 }
2287
2288         /* Set the right value for the noemailDN option */
2289         if( email_dn == 0 )
2290                 {
2291                 if (!X509_set_subject_name(ret,dn_subject)) goto err;
2292                 }
2293
2294         if (!default_op)
2295                 {
2296                 BIO_printf(bio_err, "Certificate Details:\n");
2297                 /* Never print signature details because signature not present */
2298                 certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
2299                 X509_print_ex(bio_err, ret, nameopt, certopt);
2300                 }
2301
2302         BIO_printf(bio_err,"Certificate is to be certified until ");
2303         ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
2304         if (days) BIO_printf(bio_err," (%d days)",days);
2305         BIO_printf(bio_err, "\n");
2306
2307         if (!batch)
2308                 {
2309
2310                 BIO_printf(bio_err,"Sign the certificate? [y/n]:");
2311                 (void)BIO_flush(bio_err);
2312                 buf[0]='\0';
2313                 fgets(buf,sizeof(buf)-1,stdin);
2314                 if (!((buf[0] == 'y') || (buf[0] == 'Y')))
2315                         {
2316                         BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
2317                         ok=0;
2318                         goto err;
2319                         }
2320                 }
2321
2322
2323 #ifndef OPENSSL_NO_DSA
2324         if (pkey->type == EVP_PKEY_DSA) dgst=EVP_dss1();
2325         pktmp=X509_get_pubkey(ret);
2326         if (EVP_PKEY_missing_parameters(pktmp) &&
2327                 !EVP_PKEY_missing_parameters(pkey))
2328                 EVP_PKEY_copy_parameters(pktmp,pkey);
2329         EVP_PKEY_free(pktmp);
2330 #endif
2331
2332         if (!X509_sign(ret,pkey,dgst))
2333                 goto err;
2334
2335         /* We now just add it to the database */
2336         row[DB_type]=(char *)OPENSSL_malloc(2);
2337
2338         tm=X509_get_notAfter(ret);
2339         row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2340         memcpy(row[DB_exp_date],tm->data,tm->length);
2341         row[DB_exp_date][tm->length]='\0';
2342
2343         row[DB_rev_date]=NULL;
2344
2345         /* row[DB_serial] done already */
2346         row[DB_file]=(char *)OPENSSL_malloc(8);
2347         row[DB_name]=X509_NAME_oneline(X509_get_subject_name(ret),NULL,0);
2348
2349         if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2350                 (row[DB_file] == NULL) || (row[DB_name] == NULL))
2351                 {
2352                 BIO_printf(bio_err,"Memory allocation failure\n");
2353                 goto err;
2354                 }
2355         strcpy(row[DB_file],"unknown");
2356         row[DB_type][0]='V';
2357         row[DB_type][1]='\0';
2358
2359         if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2360                 {
2361                 BIO_printf(bio_err,"Memory allocation failure\n");
2362                 goto err;
2363                 }
2364
2365         for (i=0; i<DB_NUMBER; i++)
2366                 {
2367                 irow[i]=row[i];
2368                 row[i]=NULL;
2369                 }
2370         irow[DB_NUMBER]=NULL;
2371
2372         if (!TXT_DB_insert(db,irow))
2373                 {
2374                 BIO_printf(bio_err,"failed to update database\n");
2375                 BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
2376                 goto err;
2377                 }
2378         ok=1;
2379 err:
2380         for (i=0; i<DB_NUMBER; i++)
2381                 if (row[i] != NULL) OPENSSL_free(row[i]);
2382
2383         if (CAname != NULL)
2384                 X509_NAME_free(CAname);
2385         if (subject != NULL)
2386                 X509_NAME_free(subject);
2387         if ((dn_subject != NULL) && !email_dn)
2388                 X509_NAME_free(dn_subject);
2389         if (tmptm != NULL)
2390                 ASN1_UTCTIME_free(tmptm);
2391         if (ok <= 0)
2392                 {
2393                 if (ret != NULL) X509_free(ret);
2394                 ret=NULL;
2395                 }
2396         else
2397                 *xret=ret;
2398         return(ok);
2399         }
2400
2401 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
2402         {
2403
2404         if (output_der)
2405                 {
2406                 (void)i2d_X509_bio(bp,x);
2407                 return;
2408                 }
2409 #if 0
2410         /* ??? Not needed since X509_print prints all this stuff anyway */
2411         f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
2412         BIO_printf(bp,"issuer :%s\n",f);
2413
2414         f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
2415         BIO_printf(bp,"subject:%s\n",f);
2416
2417         BIO_puts(bp,"serial :");
2418         i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
2419         BIO_puts(bp,"\n\n");
2420 #endif
2421         if (!notext)X509_print(bp,x);
2422         PEM_write_bio_X509(bp,x);
2423         }
2424
2425 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
2426              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
2427              BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
2428              long days, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
2429              unsigned long nameopt, int default_op, int ext_copy)
2430         {
2431         STACK_OF(CONF_VALUE) *sk=NULL;
2432         LHASH *parms=NULL;
2433         X509_REQ *req=NULL;
2434         CONF_VALUE *cv=NULL;
2435         NETSCAPE_SPKI *spki = NULL;
2436         X509_REQ_INFO *ri;
2437         char *type,*buf;
2438         EVP_PKEY *pktmp=NULL;
2439         X509_NAME *n=NULL;
2440         X509_NAME_ENTRY *ne=NULL;
2441         int ok= -1,i,j;
2442         long errline;
2443         int nid;
2444
2445         /*
2446          * Load input file into a hash table.  (This is just an easy
2447          * way to read and parse the file, then put it into a convenient
2448          * STACK format).
2449          */
2450         parms=CONF_load(NULL,infile,&errline);
2451         if (parms == NULL)
2452                 {
2453                 BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
2454                 ERR_print_errors(bio_err);
2455                 goto err;
2456                 }
2457
2458         sk=CONF_get_section(parms, "default");
2459         if (sk_CONF_VALUE_num(sk) == 0)
2460                 {
2461                 BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
2462                 CONF_free(parms);
2463                 goto err;
2464                 }
2465
2466         /*
2467          * Now create a dummy X509 request structure.  We don't actually
2468          * have an X509 request, but we have many of the components
2469          * (a public key, various DN components).  The idea is that we
2470          * put these components into the right X509 request structure
2471          * and we can use the same code as if you had a real X509 request.
2472          */
2473         req=X509_REQ_new();
2474         if (req == NULL)
2475                 {
2476                 ERR_print_errors(bio_err);
2477                 goto err;
2478                 }
2479
2480         /*
2481          * Build up the subject name set.
2482          */
2483         ri=req->req_info;
2484         n = ri->subject;
2485
2486         for (i = 0; ; i++)
2487                 {
2488                 if (sk_CONF_VALUE_num(sk) <= i) break;
2489
2490                 cv=sk_CONF_VALUE_value(sk,i);
2491                 type=cv->name;
2492                 /* Skip past any leading X. X: X, etc to allow for
2493                  * multiple instances
2494                  */
2495                 for (buf = cv->name; *buf ; buf++)
2496                         if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
2497                                 {
2498                                 buf++;
2499                                 if (*buf) type = buf;
2500                                 break;
2501                                 }
2502
2503                 buf=cv->value;
2504                 if ((nid=OBJ_txt2nid(type)) == NID_undef)
2505                         {
2506                         if (strcmp(type, "SPKAC") == 0)
2507                                 {
2508                                 spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
2509                                 if (spki == NULL)
2510                                         {
2511                                         BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
2512                                         ERR_print_errors(bio_err);
2513                                         goto err;
2514                                         }
2515                                 }
2516                         continue;
2517                         }
2518
2519                 /*
2520                 if ((nid == NID_pkcs9_emailAddress) && (email_dn == 0))
2521                         continue;
2522                 */
2523
2524                 j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
2525                 if (fix_data(nid, &j) == 0)
2526                         {
2527                         BIO_printf(bio_err,
2528                                 "invalid characters in string %s\n",buf);
2529                         goto err;
2530                         }
2531
2532                 if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
2533                         (unsigned char *)buf,
2534                         strlen(buf))) == NULL)
2535                         goto err;
2536
2537                 if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
2538                 }
2539         if (spki == NULL)
2540                 {
2541                 BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
2542                         infile);
2543                 goto err;
2544                 }
2545
2546         /*
2547          * Now extract the key from the SPKI structure.
2548          */
2549
2550         BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
2551
2552         if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
2553                 {
2554                 BIO_printf(bio_err,"error unpacking SPKAC public key\n");
2555                 goto err;
2556                 }
2557
2558         j = NETSCAPE_SPKI_verify(spki, pktmp);
2559         if (j <= 0)
2560                 {
2561                 BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
2562                 goto err;
2563                 }
2564         BIO_printf(bio_err,"Signature ok\n");
2565
2566         X509_REQ_set_pubkey(req,pktmp);
2567         EVP_PKEY_free(pktmp);
2568         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
2569                    days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
2570                         ext_copy);
2571 err:
2572         if (req != NULL) X509_REQ_free(req);
2573         if (parms != NULL) CONF_free(parms);
2574         if (spki != NULL) NETSCAPE_SPKI_free(spki);
2575         if (ne != NULL) X509_NAME_ENTRY_free(ne);
2576
2577         return(ok);
2578         }
2579
2580 static int fix_data(int nid, int *type)
2581         {
2582         if (nid == NID_pkcs9_emailAddress)
2583                 *type=V_ASN1_IA5STRING;
2584         if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
2585                 *type=V_ASN1_T61STRING;
2586         if ((nid == NID_pkcs9_challengePassword) && (*type == V_ASN1_IA5STRING))
2587                 *type=V_ASN1_T61STRING;
2588         if ((nid == NID_pkcs9_unstructuredName) && (*type == V_ASN1_T61STRING))
2589                 return(0);
2590         if (nid == NID_pkcs9_unstructuredName)
2591                 *type=V_ASN1_IA5STRING;
2592         return(1);
2593         }
2594
2595 static int check_time_format(char *str)
2596         {
2597         ASN1_UTCTIME tm;
2598
2599         tm.data=(unsigned char *)str;
2600         tm.length=strlen(str);
2601         tm.type=V_ASN1_UTCTIME;
2602         return(ASN1_UTCTIME_check(&tm));
2603         }
2604
2605 static int do_revoke(X509 *x509, TXT_DB *db, int type, char *value)
2606         {
2607         ASN1_UTCTIME *tm=NULL;
2608         char *row[DB_NUMBER],**rrow,**irow;
2609         char *rev_str = NULL;
2610         BIGNUM *bn = NULL;
2611         int ok=-1,i;
2612
2613         for (i=0; i<DB_NUMBER; i++)
2614                 row[i]=NULL;
2615         row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
2616         bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
2617         if (BN_is_zero(bn))
2618                 row[DB_serial]=BUF_strdup("00");
2619         else
2620                 row[DB_serial]=BN_bn2hex(bn);
2621         BN_free(bn);
2622         if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2623                 {
2624                 BIO_printf(bio_err,"Memory allocation failure\n");
2625                 goto err;
2626                 }
2627         /* We have to lookup by serial number because name lookup
2628          * skips revoked certs
2629          */
2630         rrow=TXT_DB_get_by_index(db,DB_serial,row);
2631         if (rrow == NULL)
2632                 {
2633                 BIO_printf(bio_err,"Adding Entry to DB for %s\n", row[DB_name]);
2634
2635                 /* We now just add it to the database */
2636                 row[DB_type]=(char *)OPENSSL_malloc(2);
2637
2638                 tm=X509_get_notAfter(x509);
2639                 row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2640                 memcpy(row[DB_exp_date],tm->data,tm->length);
2641                 row[DB_exp_date][tm->length]='\0';
2642
2643                 row[DB_rev_date]=NULL;
2644
2645                 /* row[DB_serial] done already */
2646                 row[DB_file]=(char *)OPENSSL_malloc(8);
2647
2648                 /* row[DB_name] done already */
2649
2650                 if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2651                         (row[DB_file] == NULL))
2652                         {
2653                         BIO_printf(bio_err,"Memory allocation failure\n");
2654                         goto err;
2655                         }
2656                 strcpy(row[DB_file],"unknown");
2657                 row[DB_type][0]='V';
2658                 row[DB_type][1]='\0';
2659
2660                 if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2661                         {
2662                         BIO_printf(bio_err,"Memory allocation failure\n");
2663                         goto err;
2664                         }
2665
2666                 for (i=0; i<DB_NUMBER; i++)
2667                         {
2668                         irow[i]=row[i];
2669                         row[i]=NULL;
2670                         }
2671                 irow[DB_NUMBER]=NULL;
2672
2673                 if (!TXT_DB_insert(db,irow))
2674                         {
2675                         BIO_printf(bio_err,"failed to update database\n");
2676                         BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
2677                         goto err;
2678                         }
2679
2680                 /* Revoke Certificate */
2681                 ok = do_revoke(x509,db, type, value);
2682
2683                 goto err;
2684
2685                 }
2686         else if (index_name_cmp((const char **)row,(const char **)rrow))
2687                 {
2688                 BIO_printf(bio_err,"ERROR:name does not match %s\n",
2689                            row[DB_name]);
2690                 goto err;
2691                 }
2692         else if (rrow[DB_type][0]=='R')
2693                 {
2694                 BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
2695                            row[DB_serial]);
2696                 goto err;
2697                 }
2698         else
2699                 {
2700                 BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
2701                 rev_str = make_revocation_str(type, value);
2702                 if (!rev_str)
2703                         {
2704                         BIO_printf(bio_err, "Error in revocation arguments\n");
2705                         goto err;
2706                         }
2707                 rrow[DB_type][0]='R';
2708                 rrow[DB_type][1]='\0';
2709                 rrow[DB_rev_date] = rev_str;
2710                 }
2711         ok=1;
2712 err:
2713         for (i=0; i<DB_NUMBER; i++)
2714                 {
2715                 if (row[i] != NULL)
2716                         OPENSSL_free(row[i]);
2717                 }
2718         return(ok);
2719         }
2720
2721 static int get_certificate_status(const char *serial, TXT_DB *db)
2722         {
2723         char *row[DB_NUMBER],**rrow;
2724         int ok=-1,i;
2725
2726         /* Free Resources */
2727         for (i=0; i<DB_NUMBER; i++)
2728                 row[i]=NULL;
2729
2730         /* Malloc needed char spaces */
2731         row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
2732         if (row[DB_serial] == NULL)
2733                 {
2734                 BIO_printf(bio_err,"Malloc failure\n");
2735                 goto err;
2736                 }
2737
2738         if (strlen(serial) % 2)
2739                 {
2740                 /* Set the first char to 0 */;
2741                 row[DB_serial][0]='0';
2742
2743                 /* Copy String from serial to row[DB_serial] */
2744                 memcpy(row[DB_serial]+1, serial, strlen(serial));
2745                 row[DB_serial][strlen(serial)+1]='\0';
2746                 }
2747         else
2748                 {
2749                 /* Copy String from serial to row[DB_serial] */
2750                 memcpy(row[DB_serial], serial, strlen(serial));
2751                 row[DB_serial][strlen(serial)]='\0';
2752                 }
2753
2754         /* Make it Upper Case */
2755         for (i=0; row[DB_serial][i] != '\0'; i++)
2756                 row[DB_serial][i] = toupper(row[DB_serial][i]);
2757
2758
2759         ok=1;
2760
2761         /* Search for the certificate */
2762         rrow=TXT_DB_get_by_index(db,DB_serial,row);
2763         if (rrow == NULL)
2764                 {
2765                 BIO_printf(bio_err,"Serial %s not present in db.\n",
2766                                  row[DB_serial]);
2767                 ok=-1;
2768                 goto err;
2769                 }
2770         else if (rrow[DB_type][0]=='V')
2771                 {
2772                 BIO_printf(bio_err,"%s=Valid (%c)\n",
2773                         row[DB_serial], rrow[DB_type][0]);
2774                 goto err;
2775                 }
2776         else if (rrow[DB_type][0]=='R')
2777                 {
2778                 BIO_printf(bio_err,"%s=Revoked (%c)\n",
2779                         row[DB_serial], rrow[DB_type][0]);
2780                 goto err;
2781                 }
2782         else if (rrow[DB_type][0]=='E')
2783                 {
2784                 BIO_printf(bio_err,"%s=Expired (%c)\n",
2785                         row[DB_serial], rrow[DB_type][0]);
2786                 goto err;
2787                 }
2788         else if (rrow[DB_type][0]=='S')
2789                 {
2790                 BIO_printf(bio_err,"%s=Suspended (%c)\n",
2791                         row[DB_serial], rrow[DB_type][0]);
2792                 goto err;
2793                 }
2794         else
2795                 {
2796                 BIO_printf(bio_err,"%s=Unknown (%c).\n",
2797                         row[DB_serial], rrow[DB_type][0]);
2798                 ok=-1;
2799                 }
2800 err:
2801         for (i=0; i<DB_NUMBER; i++)
2802                 {
2803                 if (row[i] != NULL)
2804                         OPENSSL_free(row[i]);
2805                 }
2806         return(ok);
2807         }
2808
2809 static int do_updatedb (TXT_DB *db)
2810         {
2811         ASN1_UTCTIME    *a_tm = NULL;
2812         int i, cnt = 0;
2813         int db_y2k, a_y2k;  /* flags = 1 if y >= 2000 */
2814         char **rrow, *a_tm_s;
2815
2816         a_tm = ASN1_UTCTIME_new();
2817
2818         /* get actual time and make a string */
2819         a_tm = X509_gmtime_adj(a_tm, 0);
2820         a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
2821         if (a_tm_s == NULL)
2822                 {
2823                 cnt = -1;
2824                 goto err;
2825                 }
2826
2827         memcpy(a_tm_s, a_tm->data, a_tm->length);
2828         a_tm_s[a_tm->length] = '\0';
2829
2830         if (strncmp(a_tm_s, "49", 2) <= 0)
2831                 a_y2k = 1;
2832         else
2833                 a_y2k = 0;
2834
2835         for (i = 0; i < sk_num(db->data); i++)
2836                 {
2837                 rrow = (char **) sk_value(db->data, i);
2838
2839                 if (rrow[DB_type][0] == 'V')
2840                         {
2841                         /* ignore entries that are not valid */
2842                         if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
2843                                 db_y2k = 1;
2844                         else
2845                                 db_y2k = 0;
2846
2847                         if (db_y2k == a_y2k)
2848                                 {
2849                                 /* all on the same y2k side */
2850                                 if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
2851                                         {
2852                                         rrow[DB_type][0]  = 'E';
2853                                         rrow[DB_type][1]  = '\0';
2854                                         cnt++;
2855
2856                                         BIO_printf(bio_err, "%s=Expired\n",
2857                                                         rrow[DB_serial]);
2858                                         }
2859                                 }
2860                         else if (db_y2k < a_y2k)
2861                                 {
2862                                 rrow[DB_type][0]  = 'E';
2863                                 rrow[DB_type][1]  = '\0';
2864                                 cnt++;
2865
2866                                 BIO_printf(bio_err, "%s=Expired\n",
2867                                                         rrow[DB_serial]);
2868                                 }
2869
2870                         }
2871                 }
2872
2873 err:
2874
2875         ASN1_UTCTIME_free(a_tm);
2876         OPENSSL_free(a_tm_s);
2877
2878         return (cnt);
2879         }
2880
2881 static char *crl_reasons[] = {
2882         /* CRL reason strings */
2883         "unspecified",
2884         "keyCompromise",
2885         "CACompromise",
2886         "affiliationChanged",
2887         "superseded",
2888         "cessationOfOperation",
2889         "certificateHold",
2890         "removeFromCRL",
2891         /* Additional pseudo reasons */
2892         "holdInstruction",
2893         "keyTime",
2894         "CAkeyTime"
2895 };
2896
2897 #define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
2898
2899 /* Given revocation information convert to a DB string.
2900  * The format of the string is:
2901  * revtime[,reason,extra]. Where 'revtime' is the
2902  * revocation time (the current time). 'reason' is the
2903  * optional CRL reason and 'extra' is any additional
2904  * argument
2905  */
2906
2907 char *make_revocation_str(int rev_type, char *rev_arg)
2908         {
2909         char *reason = NULL, *other = NULL, *str;
2910         ASN1_OBJECT *otmp;
2911         ASN1_UTCTIME *revtm = NULL;
2912         int i;
2913         switch (rev_type)
2914                 {
2915         case REV_NONE:
2916                 break;
2917
2918         case REV_CRL_REASON:
2919                 for (i = 0; i < 8; i++)
2920                         {
2921                         if (!strcasecmp(rev_arg, crl_reasons[i]))
2922                                 {
2923                                 reason = crl_reasons[i];
2924                                 break;
2925                                 }
2926                         }
2927                 if (reason == NULL)
2928                         {
2929                         BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
2930                         return NULL;
2931                         }
2932                 break;
2933
2934         case REV_HOLD:
2935                 /* Argument is an OID */
2936
2937                 otmp = OBJ_txt2obj(rev_arg, 0);
2938                 ASN1_OBJECT_free(otmp);
2939
2940                 if (otmp == NULL)
2941                         {
2942                         BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
2943                         return NULL;
2944                         }
2945
2946                 reason = "holdInstruction";
2947                 other = rev_arg;
2948                 break;
2949
2950         case REV_KEY_COMPROMISE:
2951         case REV_CA_COMPROMISE:
2952
2953                 /* Argument is the key compromise time  */
2954                 if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
2955                         {
2956                         BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
2957                         return NULL;
2958                         }
2959                 other = rev_arg;
2960                 if (rev_type == REV_KEY_COMPROMISE)
2961                         reason = "keyTime";
2962                 else
2963                         reason = "CAkeyTime";
2964
2965                 break;
2966
2967                 }
2968
2969         revtm = X509_gmtime_adj(NULL, 0);
2970
2971         i = revtm->length + 1;
2972
2973         if (reason) i += strlen(reason) + 1;
2974         if (other) i += strlen(other) + 1;
2975
2976         str = OPENSSL_malloc(i);
2977
2978         if (!str) return NULL;
2979
2980         strcpy(str, (char *)revtm->data);
2981         if (reason)
2982                 {
2983                 strcat(str, ",");
2984                 strcat(str, reason);
2985                 }
2986         if (other)
2987                 {
2988                 strcat(str, ",");
2989                 strcat(str, other);
2990                 }
2991         ASN1_UTCTIME_free(revtm);
2992         return str;
2993         }
2994
2995 /* Convert revocation field to X509_REVOKED entry
2996  * return code:
2997  * 0 error
2998  * 1 OK
2999  * 2 OK and some extensions added (i.e. V2 CRL)
3000  */
3001
3002
3003 int make_revoked(X509_REVOKED *rev, char *str)
3004         {
3005         char *tmp = NULL;
3006         int reason_code = -1;
3007         int i, ret = 0;
3008         ASN1_OBJECT *hold = NULL;
3009         ASN1_GENERALIZEDTIME *comp_time = NULL;
3010         ASN1_ENUMERATED *rtmp = NULL;
3011
3012         ASN1_TIME *revDate = NULL;
3013
3014         i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
3015
3016         if (i == 0)
3017                 goto err;
3018
3019         if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
3020                 goto err;
3021
3022         if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
3023                 {
3024                 rtmp = ASN1_ENUMERATED_new();
3025                 if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
3026                         goto err;
3027                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
3028                         goto err;
3029                 }
3030
3031         if (rev && comp_time)
3032                 {
3033                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
3034                         goto err;
3035                 }
3036         if (rev && hold)
3037                 {
3038                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
3039                         goto err;
3040                 }
3041
3042         if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
3043                 ret = 2;
3044         else ret = 1;
3045
3046         err:
3047
3048         if (tmp) OPENSSL_free(tmp);
3049         ASN1_OBJECT_free(hold);
3050         ASN1_GENERALIZEDTIME_free(comp_time);
3051         ASN1_ENUMERATED_free(rtmp);
3052         ASN1_TIME_free(revDate);
3053
3054         return ret;
3055         }
3056
3057 /*
3058  * subject is expected to be in the format /type0=value0/type1=value1/type2=...
3059  * where characters may be escaped by \
3060  */
3061 X509_NAME *do_subject(char *subject, long chtype)
3062         {
3063         size_t buflen = strlen(subject)+1; /* to copy the types and values into. due to escaping, the copy can only become shorter */
3064         char *buf = OPENSSL_malloc(buflen);
3065         size_t max_ne = buflen / 2 + 1; /* maximum number of name elements */
3066         char **ne_types = OPENSSL_malloc(max_ne * sizeof (char *));
3067         char **ne_values = OPENSSL_malloc(max_ne * sizeof (char *));
3068
3069         char *sp = subject, *bp = buf;
3070         int i, ne_num = 0;
3071
3072         X509_NAME *n = NULL;
3073         int nid;
3074
3075         if (!buf || !ne_types || !ne_values)
3076         {
3077                 BIO_printf(bio_err, "malloc error\n");
3078                 goto error;
3079         }
3080
3081         if (*subject != '/')
3082         {
3083                 BIO_printf(bio_err, "Subject does not start with '/'.\n");
3084                 goto error;
3085         }
3086         sp++; /* skip leading / */
3087
3088         while (*sp)
3089                 {
3090                 /* collect type */
3091                 ne_types[ne_num] = bp;
3092                 while (*sp)
3093                         {
3094                         if (*sp == '\\') /* is there anything to escape in the type...? */
3095                                 {
3096                                 if (*++sp)
3097                                         *bp++ = *sp++;
3098                                 else
3099                                         {
3100                                         BIO_printf(bio_err, "escape character at end of string\n");
3101                                         goto error;
3102                                         }
3103                                 }
3104                         else if (*sp == '=')
3105                                 {
3106                                 sp++;
3107                                 *bp++ = '\0';
3108                                 break;
3109                                 }
3110                         else
3111                                 *bp++ = *sp++;
3112                         }
3113                 if (!*sp)
3114                         {
3115                         BIO_printf(bio_err, "end of string encountered while processing type of subject name element #%d\n", ne_num);
3116                         goto error;
3117                         }
3118                 ne_values[ne_num] = bp;
3119                 while (*sp)
3120                         {
3121                         if (*sp == '\\')
3122                                 {
3123                                 if (*++sp)
3124                                         *bp++ = *sp++;
3125                                 else
3126                                         {
3127                                         BIO_printf(bio_err, "escape character at end of string\n");
3128                                         goto error;
3129                                         }
3130                                 }
3131                         else if (*sp == '/')
3132                                 {
3133                                 sp++;
3134                                 break;
3135                                 }
3136                         else
3137                                 *bp++ = *sp++;
3138                         }
3139                 *bp++ = '\0';
3140                 ne_num++;
3141                 }
3142
3143         if (!(n = X509_NAME_new()))
3144                 goto error;
3145
3146         for (i = 0; i < ne_num; i++)
3147                 {
3148                 if ((nid=OBJ_txt2nid(ne_types[i])) == NID_undef)
3149                         {
3150                         BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_types[i]);
3151                         continue;
3152                         }
3153
3154                 if (!*ne_values[i])
3155                         {
3156                         BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_types[i]);
3157                         continue;
3158                         }
3159
3160                 if (!X509_NAME_add_entry_by_NID(n, nid, chtype, (unsigned char*)ne_values[i], -1,-1,0))
3161                         goto error;
3162                 }
3163
3164         OPENSSL_free(ne_values);
3165         OPENSSL_free(ne_types);
3166         OPENSSL_free(buf);
3167         return n;
3168
3169 error:
3170         X509_NAME_free(n);
3171         if (ne_values)
3172                 OPENSSL_free(ne_values);
3173         if (ne_types)
3174                 OPENSSL_free(ne_types);
3175         if (buf)
3176                 OPENSSL_free(buf);
3177         return NULL;
3178 }
3179
3180 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
3181         {
3182         char buf[25],*pbuf, *p;
3183         int j;
3184         j=i2a_ASN1_OBJECT(bp,obj);
3185         pbuf=buf;
3186         for (j=22-j; j>0; j--)
3187                 *(pbuf++)=' ';
3188         *(pbuf++)=':';
3189         *(pbuf++)='\0';
3190         BIO_puts(bp,buf);
3191
3192         if (str->type == V_ASN1_PRINTABLESTRING)
3193                 BIO_printf(bp,"PRINTABLE:'");
3194         else if (str->type == V_ASN1_T61STRING)
3195                 BIO_printf(bp,"T61STRING:'");
3196         else if (str->type == V_ASN1_IA5STRING)
3197                 BIO_printf(bp,"IA5STRING:'");
3198         else if (str->type == V_ASN1_UNIVERSALSTRING)
3199                 BIO_printf(bp,"UNIVERSALSTRING:'");
3200         else
3201                 BIO_printf(bp,"ASN.1 %2d:'",str->type);
3202
3203         p=(char *)str->data;
3204         for (j=str->length; j>0; j--)
3205                 {
3206                 if ((*p >= ' ') && (*p <= '~'))
3207                         BIO_printf(bp,"%c",*p);
3208                 else if (*p & 0x80)
3209                         BIO_printf(bp,"\\0x%02X",*p);
3210                 else if ((unsigned char)*p == 0xf7)
3211                         BIO_printf(bp,"^?");
3212                 else    BIO_printf(bp,"^%c",*p+'@');
3213                 p++;
3214                 }
3215         BIO_printf(bp,"'\n");
3216         return 1;
3217         }
3218
3219 int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, char *str)
3220         {
3221         char *tmp = NULL;
3222         char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
3223         int reason_code = -1;
3224         int i, ret = 0;
3225         ASN1_OBJECT *hold = NULL;
3226         ASN1_GENERALIZEDTIME *comp_time = NULL;
3227         tmp = BUF_strdup(str);
3228
3229         p = strchr(tmp, ',');
3230
3231         rtime_str = tmp;
3232
3233         if (p)
3234                 {
3235                 *p = '\0';
3236                 p++;
3237                 reason_str = p;
3238                 p = strchr(p, ',');
3239                 if (p)
3240                         {
3241                         *p = '\0';
3242                         arg_str = p + 1;
3243                         }
3244                 }
3245
3246         if (prevtm)
3247                 {
3248                 *prevtm = ASN1_UTCTIME_new();
3249                 if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))
3250                         {
3251                         BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
3252                         goto err;
3253                         }
3254                 }
3255         if (reason_str)
3256                 {
3257                 for (i = 0; i < NUM_REASONS; i++)
3258                         {
3259                         if(!strcasecmp(reason_str, crl_reasons[i]))
3260                                 {
3261                                 reason_code = i;
3262                                 break;
3263                                 }
3264                         }
3265                 if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
3266                         {
3267                         BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
3268                         goto err;
3269                         }
3270
3271                 if (reason_code == 7)
3272                         reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
3273                 else if (reason_code == 8)              /* Hold instruction */
3274                         {
3275                         if (!arg_str)
3276                                 {
3277                                 BIO_printf(bio_err, "missing hold instruction\n");
3278                                 goto err;
3279                                 }
3280                         reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
3281                         hold = OBJ_txt2obj(arg_str, 0);
3282
3283                         if (!hold)
3284                                 {
3285                                 BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
3286                                 goto err;
3287                                 }
3288                         if (phold) *phold = hold;
3289                         }
3290                 else if ((reason_code == 9) || (reason_code == 10))
3291                         {
3292                         if (!arg_str)
3293                                 {
3294                                 BIO_printf(bio_err, "missing compromised time\n");
3295                                 goto err;
3296                                 }
3297                         comp_time = ASN1_GENERALIZEDTIME_new();
3298                         if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
3299                                 {
3300                                 BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
3301                                 goto err;
3302                                 }
3303                         if (reason_code == 9)
3304                                 reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
3305                         else
3306                                 reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
3307                         }
3308                 }
3309
3310         if (preason) *preason = reason_code;
3311         if (pinvtm) *pinvtm = comp_time;
3312         else ASN1_GENERALIZEDTIME_free(comp_time);
3313
3314         ret = 1;
3315
3316         err:
3317
3318         if (tmp) OPENSSL_free(tmp);
3319         if (!phold) ASN1_OBJECT_free(hold);
3320         if (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);
3321
3322         return ret;
3323         }
3324
3325 int make_serial_index(TXT_DB *db)
3326         {
3327         if (!TXT_DB_create_index(db, DB_serial, NULL,
3328                                 LHASH_HASH_FN(index_serial_hash),
3329                                 LHASH_COMP_FN(index_serial_cmp)))
3330                 {
3331                 BIO_printf(bio_err,
3332                   "error creating serial number index:(%ld,%ld,%ld)\n",
3333                                         db->error,db->arg1,db->arg2);
3334                         return 0;
3335                 }
3336         return 1;
3337         }