- a_tm = ASN1_UTCTIME_new();
-
- /* get actual time and make a string */
- a_tm = X509_gmtime_adj(a_tm, 0);
- a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
- if (a_tm_s == NULL)
- {
- cnt = -1;
- goto err;
- }
-
- memcpy(a_tm_s, a_tm->data, a_tm->length);
- a_tm_s[a_tm->length] = '\0';
-
- if (strncmp(a_tm_s, "49", 2) <= 0)
- a_y2k = 1;
- else
- a_y2k = 0;
-
- for (i = 0; i < sk_num(db->data); i++)
- {
- rrow = (char **) sk_value(db->data, i);
-
- if (rrow[DB_type][0] == 'V')
- {
- /* ignore entries that are not valid */
- if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
- db_y2k = 1;
- else
- db_y2k = 0;
-
- if (db_y2k == a_y2k)
- {
- /* all on the same y2k side */
- if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
- {
- rrow[DB_type][0] = 'E';
- rrow[DB_type][1] = '\0';
- cnt++;
-
- BIO_printf(bio_err, "%s=Expired\n",
- rrow[DB_serial]);
- }
- }
- else if (db_y2k < a_y2k)
- {
- rrow[DB_type][0] = 'E';
- rrow[DB_type][1] = '\0';
- cnt++;
-
- BIO_printf(bio_err, "%s=Expired\n",
- rrow[DB_serial]);
- }
-
- }
- }
-
-err:
-
- ASN1_UTCTIME_free(a_tm);
- OPENSSL_free(a_tm_s);
-
- return (cnt);
- }
-
-static char *crl_reasons[] = {
- /* CRL reason strings */
- "unspecified",
- "keyCompromise",
- "CACompromise",
- "affiliationChanged",
- "superseded",
- "cessationOfOperation",
- "certificateHold",
- "removeFromCRL",
- /* Additional pseudo reasons */
- "holdInstruction",
- "keyTime",
- "CAkeyTime"
-};
-
-#define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
-
-/* Given revocation information convert to a DB string.
- * The format of the string is:
- * revtime[,reason,extra]. Where 'revtime' is the
- * revocation time (the current time). 'reason' is the
- * optional CRL reason and 'extra' is any additional
- * argument
- */
-
-char *make_revocation_str(int rev_type, char *rev_arg)
- {
- char *reason = NULL, *other = NULL, *str;
- ASN1_OBJECT *otmp;
- ASN1_UTCTIME *revtm = NULL;
- int i;
- switch (rev_type)
- {
- case REV_NONE:
- break;
-
- case REV_CRL_REASON:
- for (i = 0; i < 8; i++)
- {
- if (!strcasecmp(rev_arg, crl_reasons[i]))
- {
- reason = crl_reasons[i];
- break;
- }
- }
- if (reason == NULL)
- {
- BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
- return NULL;
- }
- break;
-
- case REV_HOLD:
- /* Argument is an OID */
-
- otmp = OBJ_txt2obj(rev_arg, 0);
- ASN1_OBJECT_free(otmp);
-
- if (otmp == NULL)
- {
- BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
- return NULL;
- }
-
- reason = "holdInstruction";
- other = rev_arg;
- break;
-
- case REV_KEY_COMPROMISE:
- case REV_CA_COMPROMISE:
-
- /* Argument is the key compromise time */
- if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
- {
- BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
- return NULL;
- }
- other = rev_arg;
- if (rev_type == REV_KEY_COMPROMISE)
- reason = "keyTime";
- else
- reason = "CAkeyTime";
-
- break;
-
- }
-
- revtm = X509_gmtime_adj(NULL, 0);
-
- i = revtm->length + 1;
-
- if (reason) i += strlen(reason) + 1;
- if (other) i += strlen(other) + 1;
-
- str = OPENSSL_malloc(i);
-
- if (!str) return NULL;
-
- strcpy(str, (char *)revtm->data);
- if (reason)
- {
- strcat(str, ",");
- strcat(str, reason);
- }
- if (other)
- {
- strcat(str, ",");
- strcat(str, other);
- }
- ASN1_UTCTIME_free(revtm);
- return str;
- }
-
-/* Convert revocation field to X509_REVOKED entry
- * return code:
- * 0 error
- * 1 OK
- * 2 OK and some extensions added (i.e. V2 CRL)
- */
-
-int make_revoked(X509_REVOKED *rev, char *str)
- {
- char *tmp = NULL;
- char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
- int reason_code = -1;
- int i, ret = 0;
- ASN1_OBJECT *hold = NULL;
- ASN1_GENERALIZEDTIME *comp_time = NULL;
- ASN1_ENUMERATED *rtmp = NULL;
- tmp = BUF_strdup(str);
-
- p = strchr(tmp, ',');
-
- rtime_str = tmp;
-
- if (p)
- {
- *p = '\0';
- p++;
- reason_str = p;
- p = strchr(p, ',');
- if (p)
- {
- *p = '\0';
- arg_str = p + 1;
- }
- }
-
- if (rev && !ASN1_UTCTIME_set_string(rev->revocationDate, rtime_str))
- {
- BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
- goto err;
- }
- if (reason_str)
- {
- for (i = 0; i < NUM_REASONS; i++)
- {
- if(!strcasecmp(reason_str, crl_reasons[i]))
- {
- reason_code = i;
- break;
- }
- }
- if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
- {
- BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
- goto err;
- }
-
- if (reason_code == 7)
- reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
- else if (reason_code == 8) /* Hold instruction */
- {
- if (!arg_str)
- {
- BIO_printf(bio_err, "missing hold instruction\n");
- goto err;
- }
- reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
- hold = OBJ_txt2obj(arg_str, 0);
-
- if (!hold)
- {
- BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
- goto err;
- }
- }
- else if ((reason_code == 9) || (reason_code == 10))
- {
- if (!arg_str)
- {
- BIO_printf(bio_err, "missing compromised time\n");
- goto err;
- }
- comp_time = ASN1_GENERALIZEDTIME_new();
- if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
- {
- BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
- goto err;
- }
- if (reason_code == 9)
- reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
- else
- reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
- }
- }
-
- if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
- {
- rtmp = ASN1_ENUMERATED_new();
- if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
- goto err;
- if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
- goto err;
- }
-
- if (rev && comp_time)
- {
- if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
- goto err;
- }
- if (rev && hold)
- {
- if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
- goto err;
- }
-
- if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
- ret = 2;
- else ret = 1;
-
- err:
-
- if (tmp) OPENSSL_free(tmp);
- ASN1_OBJECT_free(hold);
- ASN1_GENERALIZEDTIME_free(comp_time);
- ASN1_ENUMERATED_free(rtmp);
-
- return ret;
- }
-
-static X509_NAME *do_subject(char *subject)
- {
- X509_NAME *n = NULL;
-
- int i, nid, ne_num=0;
-
- char *ne_name = NULL;
- char *ne_value = NULL;
-
- char *tmp = NULL;
- char *p[2];
-
- char *str_list[256];
-
- p[0] = ",/";
- p[1] = "=";
-
- n = X509_NAME_new();
-
- tmp = strtok(subject, p[0]);
- while((tmp != NULL) && (ne_num < (sizeof str_list/sizeof *str_list)))
- {
- char *token = tmp;
-
- while (token[0] == ' ')
- token++;
- str_list[ne_num] = token;
-
- tmp = strtok(NULL, p[0]);
- ne_num++;
- }
-
- for (i = 0; i < ne_num; i++)
- {
- ne_name = strtok(str_list[i], p[1]);
- ne_value = strtok(NULL, p[1]);
-
- if ((nid=OBJ_txt2nid(ne_name)) == NID_undef)
- {
- BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_name);
- continue;
- }
-
- if (ne_value == NULL)
- {
- BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_name);
- continue;
- }
-
- if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC, (unsigned char*)ne_value, -1,-1,0))
- {
- X509_NAME_free(n);
- return NULL;
- }
- }
-
- return n;
- }