+/* Until the key-gen callbacks are modified to use newer prototypes, we allow
+ * deprecated functions for openssl-internal code */
+#ifdef OPENSSL_NO_DEPRECATED
+#undef OPENSSL_NO_DEPRECATED
+#endif
+
-static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,char *dn,int attribs,
- unsigned long chtype);
-static int build_subject(X509_REQ *req, char *subj, unsigned long chtype);
+static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,char *dn,int mutlirdn,
+ int attribs,unsigned long chtype);
+static int build_subject(X509_REQ *req, char *subj, unsigned long chtype,
+ int multirdn);
static int prompt_info(X509_REQ *req,
STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect,
STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs,
static int prompt_info(X509_REQ *req,
STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect,
STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs,
static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk,
STACK_OF(CONF_VALUE) *attr, int attribs,
unsigned long chtype);
static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk,
STACK_OF(CONF_VALUE) *attr, int attribs,
unsigned long chtype);
-static int add_attribute_object(X509_REQ *req, char *text,
- char *def, char *value, int nid, int n_min,
+static int add_attribute_object(X509_REQ *req, char *text, const char *def,
+ char *value, int nid, int n_min,
-static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
- int nid,int n_min,int n_max, unsigned long chtype);
+static int add_DN_object(X509_NAME *n, char *text, const char *def, char *value,
+ int nid,int n_min,int n_max, unsigned long chtype, int mval);
int informat,outformat,verify=0,noout=0,text=0,keyform=FORMAT_PEM;
int nodes=0,kludge=0,newhdr=0,subject=0,pubkey=0;
char *infile,*outfile,*prog,*keyfile=NULL,*template=NULL,*keyout=NULL;
int informat,outformat,verify=0,noout=0,text=0,keyform=FORMAT_PEM;
int nodes=0,kludge=0,newhdr=0,subject=0,pubkey=0;
char *infile,*outfile,*prog,*keyfile=NULL,*template=NULL,*keyout=NULL;
else if (strcmp(*argv,"-engine") == 0)
{
if (--argc < 1) goto bad;
engine= *(++argv);
}
else if (strcmp(*argv,"-engine") == 0)
{
if (--argc < 1) goto bad;
engine= *(++argv);
}
else if (strcmp(*argv,"-key") == 0)
{
if (--argc < 1) goto bad;
else if (strcmp(*argv,"-key") == 0)
{
if (--argc < 1) goto bad;
- if ((ecdsa_params->group = PEM_read_bio_ECPKParameters(in, NULL, NULL, NULL)) == NULL)
+ group = PEM_read_bio_ECPKParameters(in, NULL, NULL, NULL);
+ if (group == NULL)
ERR_clear_error();
(void)BIO_reset(in);
if ((xtmp=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL)
{
ERR_clear_error();
(void)BIO_reset(in);
if ((xtmp=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL)
{
- if ((dtmp=X509_get_pubkey(xtmp)) == NULL) goto end;
- if (dtmp->type == EVP_PKEY_ECDSA)
- ecdsa_params = ECDSAParameters_dup(dtmp->pkey.ecdsa);
+ if ((dtmp=X509_get_pubkey(xtmp))==NULL)
+ goto end;
+ if (dtmp->type == EVP_PKEY_EC)
+ ec_params = EC_KEY_dup(dtmp->pkey.ec);
-
- {
- BIGNUM *order = BN_new();
-
- if (!order)
- goto end;
- if (!EC_GROUP_get_order(ecdsa_params->group, order, NULL))
- goto end;
- newkey = BN_num_bits(order);
- BN_free(order);
- }
-
+ newkey = EC_GROUP_get_degree(EC_KEY_get0_group(ec_params));
if (--argc < 1) goto bad;
if (!set_name_ex(&nmflag, *(++argv))) goto bad;
}
if (--argc < 1) goto bad;
if (!set_name_ex(&nmflag, *(++argv))) goto bad;
}
else if (strcmp(*argv,"-subject") == 0)
subject=1;
else if (strcmp(*argv,"-text") == 0)
else if (strcmp(*argv,"-subject") == 0)
subject=1;
else if (strcmp(*argv,"-text") == 0)
else if (strcmp(*argv,"-days") == 0)
{
if (--argc < 1) goto bad;
else if (strcmp(*argv,"-days") == 0)
{
if (--argc < 1) goto bad;
BIO_printf(bio_err," -verify verify signature on REQ\n");
BIO_printf(bio_err," -modulus RSA modulus\n");
BIO_printf(bio_err," -nodes don't encrypt the output key\n");
BIO_printf(bio_err," -verify verify signature on REQ\n");
BIO_printf(bio_err," -modulus RSA modulus\n");
BIO_printf(bio_err," -nodes don't encrypt the output key\n");
BIO_printf(bio_err," -subject output the request's subject\n");
BIO_printf(bio_err," -passin private key password source\n");
BIO_printf(bio_err," -key file use the private key contained in file\n");
BIO_printf(bio_err," -subject output the request's subject\n");
BIO_printf(bio_err," -passin private key password source\n");
BIO_printf(bio_err," -key file use the private key contained in file\n");
BIO_printf(bio_err," the random number generator\n");
BIO_printf(bio_err," -newkey rsa:bits generate a new RSA key of 'bits' in size\n");
BIO_printf(bio_err," -newkey dsa:file generate a new DSA key, parameters taken from CA in 'file'\n");
BIO_printf(bio_err," the random number generator\n");
BIO_printf(bio_err," -newkey rsa:bits generate a new RSA key of 'bits' in size\n");
BIO_printf(bio_err," -newkey dsa:file generate a new DSA key, parameters taken from CA in 'file'\n");
- BIO_printf(bio_err," -newkey ecdsa:file generate a new ECDSA key, parameters taken from CA in 'file'\n");
+#ifndef OPENSSL_NO_ECDSA
+ BIO_printf(bio_err," -newkey ec:file generate a new EC key, parameters taken from CA in 'file'\n");
+#endif
BIO_printf(bio_err," -[digest] Digest to sign with (md5, sha1, md2, mdc2, md4)\n");
BIO_printf(bio_err," -config file request template file.\n");
BIO_printf(bio_err," -subj arg set or modify request subject\n");
BIO_printf(bio_err," -[digest] Digest to sign with (md5, sha1, md2, mdc2, md4)\n");
BIO_printf(bio_err," -config file request template file.\n");
BIO_printf(bio_err," -subj arg set or modify request subject\n");
BIO_printf(bio_err," -new new request.\n");
BIO_printf(bio_err," -batch do not ask anything during request generation\n");
BIO_printf(bio_err," -x509 output a x509 structure instead of a cert. req.\n");
BIO_printf(bio_err," -new new request.\n");
BIO_printf(bio_err," -batch do not ask anything during request generation\n");
BIO_printf(bio_err," -x509 output a x509 structure instead of a cert. req.\n");
BIO_printf(bio_err," -reqexts .. specify request extension section (override value in config file)\n");
BIO_printf(bio_err," -utf8 input characters are UTF8 (default ASCII)\n");
BIO_printf(bio_err," -nameopt arg - various certificate name options\n");
BIO_printf(bio_err," -reqexts .. specify request extension section (override value in config file)\n");
BIO_printf(bio_err," -utf8 input characters are UTF8 (default ASCII)\n");
BIO_printf(bio_err," -nameopt arg - various certificate name options\n");
- {
- strcpy(config_name,X509_get_default_cert_area());
-#ifndef OPENSSL_SYS_VMS
- strcat(config_name,"/");
-#endif
- strcat(config_name,OPENSSL_CONF);
- p=config_name;
- }
+ p=to_free=make_config_name();
- pkey = load_key(bio_err, keyfile, keyform, passin, e,
+ pkey = load_key(bio_err, keyfile, keyform, 0, passin, e,
- BIO_printf(bio_err,"it needs to be at least %d bits, not %d\n",MIN_KEY_LENGTH,newkey);
+ BIO_printf(bio_err,"it needs to be at least %d bits, not %ld\n",MIN_KEY_LENGTH,newkey);
- BIO_printf(bio_err,"Generating a %d bit %s private key\n",
- newkey,(pkey_type == TYPE_RSA)?"RSA":(pkey_type == TYPE_DSA)?"DSA":"ECDSA");
+ BIO_printf(bio_err,"Generating a %ld bit %s private key\n",
+ newkey,(pkey_type == TYPE_RSA)?"RSA":
+ (pkey_type == TYPE_DSA)?"DSA":"EC");
- if (!EVP_PKEY_assign_RSA(pkey,
- RSA_generate_key(newkey,0x10001,
- req_cb,bio_err)))
+ RSA *rsa = RSA_new();
+ BIGNUM *bn = BN_new();
+ if(!bn || !rsa || !BN_set_word(bn, 0x10001) ||
+ !RSA_generate_key_ex(rsa, newkey, bn, &cb) ||
+ !EVP_PKEY_assign_RSA(pkey, rsa))
+ {
+ if(bn) BN_free(bn);
+ if(rsa) RSA_free(rsa);
- if (!ECDSA_generate_key(ecdsa_params)) goto end;
- if (!EVP_PKEY_assign_ECDSA(pkey, ecdsa_params)) goto end;
- ecdsa_params = NULL;
+ if (!EC_KEY_generate_key(ec_params)) goto end;
+ if (!EVP_PKEY_assign_EC_KEY(pkey, ec_params))
+ goto end;
+ ec_params = NULL;
- i=make_REQ(req,pkey,subj,!x509, chtype);
+ i=make_REQ(req,pkey,subj,multirdn,!x509, chtype);
subj=NULL; /* done processing '-subj' option */
if ((kludge > 0) && !sk_X509_ATTRIBUTE_num(req->req_info->attributes))
{
subj=NULL; /* done processing '-subj' option */
if ((kludge > 0) && !sk_X509_ATTRIBUTE_num(req->req_info->attributes))
{
print_name(bio_err, "old subject=", X509_REQ_get_subject_name(req), nmflag);
}
print_name(bio_err, "old subject=", X509_REQ_get_subject_name(req), nmflag);
}
-static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs,
- unsigned long chtype)
+static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int multirdn,
+ int attribs, unsigned long chtype)
else
i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs, chtype);
}
else
i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs, chtype);
}
* subject is expected to be in the format /type0=value0/type1=value1/type2=...
* where characters may be escaped by \
*/
* subject is expected to be in the format /type0=value0/type1=value1/type2=...
* where characters may be escaped by \
*/
-static int build_subject(X509_REQ *req, char *subject, unsigned long chtype)
+static int build_subject(X509_REQ *req, char *subject, unsigned long chtype, int multirdn)
- sprintf(buf,"%s_default",v->name);
+ if (BIO_snprintf(buf,sizeof buf,"%s_default",v->name)
+ >= (int)sizeof(buf))
+ {
+ BIO_printf(bio_err,"Name '%s' too long\n",v->name);
+ return 0;
+ }
+
if (!NCONF_get_number(req_conf,dn_sect,buf, &n_min))
if (!NCONF_get_number(req_conf,dn_sect,buf, &n_min))
if (!NCONF_get_number(req_conf,dn_sect,buf, &n_max))
if (!NCONF_get_number(req_conf,dn_sect,buf, &n_max))
if (!add_DN_object(subj,v->value,def,value,nid,
if (!add_DN_object(subj,v->value,def,value,nid,
- sprintf(buf,"%s_default",type);
+ if (BIO_snprintf(buf,sizeof buf,"%s_default",type)
+ >= (int)sizeof(buf))
+ {
+ BIO_printf(bio_err,"Name '%s' too long\n",v->name);
+ return 0;
+ }
+
if (!NCONF_get_number(req_conf,attr_sect,buf, &n_min))
n_min = -1;
if (!NCONF_get_number(req_conf,attr_sect,buf, &n_min))
n_min = -1;
if (!NCONF_get_number(req_conf,attr_sect,buf, &n_max))
n_max = -1;
if (!NCONF_get_number(req_conf,attr_sect,buf, &n_max))
n_max = -1;
if (!X509_NAME_add_entry_by_txt(subj,type, chtype,
if (!X509_NAME_add_entry_by_txt(subj,type, chtype,
- (unsigned char *) v->value,-1,-1,0)) return 0;
+ (unsigned char *) v->value,-1,-1,mval)) return 0;
-static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
- int nid, int n_min, int n_max, unsigned long chtype)
+static int add_DN_object(X509_NAME *n, char *text, const char *def, char *value,
+ int nid, int n_min, int n_max, unsigned long chtype, int mval)
#endif
if(!req_check_len(i, n_min, n_max)) goto start;
if (!X509_NAME_add_entry_by_NID(n,nid, chtype,
#endif
if(!req_check_len(i, n_min, n_max)) goto start;
if (!X509_NAME_add_entry_by_NID(n,nid, chtype,
- (unsigned char *) buf, -1,-1,0)) goto err;
+ (unsigned char *) buf, -1,-1,mval)) goto err;
-static int add_attribute_object(X509_REQ *req, char *text,
- char *def, char *value, int nid, int n_min,
+static int add_attribute_object(X509_REQ *req, char *text, const char *def,
+ char *value, int nid, int n_min,
- BIO_write((BIO *)arg,&c,1);
- (void)BIO_flush((BIO *)arg);
+ BIO_write(cb->arg,&c,1);
+ (void)BIO_flush(cb->arg);