#include <openssl/x509v3.h>
#include <openssl/objects.h>
#include <openssl/pem.h>
-#include "../crypto/cryptlib.h"
+#include <openssl/bn.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
#define SECTION "req"
* require. This format is wrong
*/
-static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,char *dn,int attribs,
- unsigned long chtype);
-static int build_subject(X509_REQ *req, char *subj, unsigned long chtype);
+static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,char *dn,int mutlirdn,
+ int attribs,unsigned long chtype);
+static int build_subject(X509_REQ *req, char *subj, unsigned long chtype,
+ int multirdn);
static int prompt_info(X509_REQ *req,
STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect,
STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs,
static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk,
STACK_OF(CONF_VALUE) *attr, int attribs,
unsigned long chtype);
-static int add_attribute_object(X509_REQ *req, char *text,
- char *def, char *value, int nid, int n_min,
+static int add_attribute_object(X509_REQ *req, char *text, const char *def,
+ char *value, int nid, int n_min,
int n_max, unsigned long chtype);
-static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
+static int add_DN_object(X509_NAME *n, char *text, const char *def, char *value,
int nid,int n_min,int n_max, unsigned long chtype, int mval);
#ifndef OPENSSL_NO_RSA
-static void MS_CALLBACK req_cb(int p,int n,void *arg);
+static int MS_CALLBACK req_cb(int p, int n, BN_GENCB *cb);
#endif
static int req_check_len(int len,int n_min,int n_max);
-static int check_end(char *str, char *end);
+static int check_end(const char *str, const char *end);
#ifndef MONOLITH
static char *default_config_file=NULL;
#endif
char *passin = NULL, *passout = NULL;
char *p;
char *subj = NULL;
- const EVP_MD *md_alg=NULL,*digest=EVP_md5();
+ int multirdn = 0;
+ const EVP_MD *md_alg=NULL,*digest=EVP_sha1();
unsigned long chtype = MBSTRING_ASC;
#ifndef MONOLITH
char *to_free;
{
X509 *xtmp=NULL;
EVP_PKEY *dtmp;
+ EC_GROUP *group;
pkey_type=TYPE_EC;
p+=3;
}
if ((ec_params = EC_KEY_new()) == NULL)
goto end;
- if ((ec_params->group = PEM_read_bio_ECPKParameters(in, NULL, NULL, NULL)) == NULL)
+ group = PEM_read_bio_ECPKParameters(in, NULL, NULL, NULL);
+ if (group == NULL)
{
- if (ec_params)
- EC_KEY_free(ec_params);
+ EC_KEY_free(ec_params);
ERR_clear_error();
(void)BIO_reset(in);
if ((xtmp=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL)
if ((dtmp=X509_get_pubkey(xtmp))==NULL)
goto end;
if (dtmp->type == EVP_PKEY_EC)
- ec_params = ECParameters_dup(dtmp->pkey.eckey);
+ ec_params = EC_KEY_dup(dtmp->pkey.ec);
EVP_PKEY_free(dtmp);
X509_free(xtmp);
if (ec_params == NULL)
goto end;
}
}
+ else
+ {
+ if (EC_KEY_set_group(ec_params, group) == 0)
+ goto end;
+ EC_GROUP_free(group);
+ }
BIO_free(in);
in=NULL;
-
- newkey = EC_GROUP_get_degree(ec_params->group);
-
+ newkey = EC_GROUP_get_degree(EC_KEY_get0_group(ec_params));
}
else
#endif
if (--argc < 1) goto bad;
subj= *(++argv);
}
+ else if (strcmp(*argv,"-multivalue-rdn") == 0)
+ multirdn=1;
else if (strcmp(*argv,"-days") == 0)
{
if (--argc < 1) goto bad;
BIO_printf(bio_err," -[digest] Digest to sign with (md5, sha1, md2, mdc2, md4)\n");
BIO_printf(bio_err," -config file request template file.\n");
BIO_printf(bio_err," -subj arg set or modify request subject\n");
+ BIO_printf(bio_err," -multivalue-rdn enable support for multivalued RDNs\n");
BIO_printf(bio_err," -new new request.\n");
BIO_printf(bio_err," -batch do not ask anything during request generation\n");
BIO_printf(bio_err," -x509 output a x509 structure instead of a cert. req.\n");
else
{
req_conf=config;
- if( verbose )
- BIO_printf(bio_err,"Using configuration from %s\n",
- default_config_file);
+
if (req_conf == NULL)
{
- BIO_printf(bio_err,"Unable to load config info\n");
+ BIO_printf(bio_err,"Unable to load config info from %s\n", default_config_file);
+ if (newreq)
+ goto end;
}
+ else if( verbose )
+ BIO_printf(bio_err,"Using configuration from %s\n",
+ default_config_file);
}
if (req_conf != NULL)
if (newreq && (pkey == NULL))
{
+#ifndef OPENSSL_NO_RSA
+ BN_GENCB cb;
+#endif
char *randfile = NCONF_get_string(req_conf,SECTION,"RANDFILE");
if (randfile == NULL)
ERR_clear_error();
if ((pkey=EVP_PKEY_new()) == NULL) goto end;
#ifndef OPENSSL_NO_RSA
+ BN_GENCB_set(&cb, req_cb, bio_err);
if (pkey_type == TYPE_RSA)
{
- if (!EVP_PKEY_assign_RSA(pkey,
- RSA_generate_key(newkey,0x10001,
- req_cb,bio_err)))
+ RSA *rsa = RSA_new();
+ BIGNUM *bn = BN_new();
+ if(!bn || !rsa || !BN_set_word(bn, 0x10001) ||
+ !RSA_generate_key_ex(rsa, newkey, bn, &cb) ||
+ !EVP_PKEY_assign_RSA(pkey, rsa))
+ {
+ if(bn) BN_free(bn);
+ if(rsa) RSA_free(rsa);
goto end;
+ }
+ BN_free(bn);
}
else
#endif
app_RAND_write_file(randfile, bio_err);
- if (pkey == NULL) goto end;
-
if (keyout == NULL)
{
keyout=NCONF_get_string(req_conf,SECTION,KEYFILE);
goto end;
}
- i=make_REQ(req,pkey,subj,!x509, chtype);
+ i=make_REQ(req,pkey,subj,multirdn,!x509, chtype);
subj=NULL; /* done processing '-subj' option */
if ((kludge > 0) && !sk_X509_ATTRIBUTE_num(req->req_info->attributes))
{
if ((x509ss=X509_new()) == NULL) goto end;
/* Set version to V3 */
- if(!X509_set_version(x509ss, 2)) goto end;
+ if(extensions && !X509_set_version(x509ss, 2)) goto end;
if (serial)
{
if (!X509_set_serialNumber(x509ss, serial)) goto end;
}
else
{
- if (!ASN1_INTEGER_set(X509_get_serialNumber(x509ss),0L)) goto end;
+ if (!rand_serial(NULL,
+ X509_get_serialNumber(x509ss)))
+ goto end;
}
if (!X509_set_issuer_name(x509ss, X509_REQ_get_subject_name(req))) goto end;
print_name(bio_err, "old subject=", X509_REQ_get_subject_name(req), nmflag);
}
- if (build_subject(req, subj, chtype) == 0)
+ if (build_subject(req, subj, chtype, multirdn) == 0)
{
BIO_printf(bio_err, "ERROR: cannot modify subject\n");
ex=1;
OPENSSL_EXIT(ex);
}
-static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs,
- unsigned long chtype)
+static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int multirdn,
+ int attribs, unsigned long chtype)
{
int ret=0,i;
char no_prompt = 0;
else
{
if (subj)
- i = build_subject(req, subj, chtype);
+ i = build_subject(req, subj, chtype, multirdn);
else
i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs, chtype);
}
* subject is expected to be in the format /type0=value0/type1=value1/type2=...
* where characters may be escaped by \
*/
-static int build_subject(X509_REQ *req, char *subject, unsigned long chtype)
+static int build_subject(X509_REQ *req, char *subject, unsigned long chtype, int multirdn)
{
X509_NAME *n;
- if (!(n = do_subject(subject, chtype)))
+ if (!(n = parse_name(subject, chtype, multirdn)))
return 0;
if (!X509_REQ_set_subject_name(req, n))
char buf[100];
int nid, mval;
long n_min,n_max;
- char *type,*def,*value;
+ char *type, *value;
+ const char *def;
CONF_VALUE *v;
X509_NAME *subj;
subj = X509_REQ_get_subject_name(req);
mval = 0;
/* If OBJ not recognised ignore it */
if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start;
-
- if(strlen(v->name) > sizeof buf-9)
+ if (BIO_snprintf(buf,sizeof buf,"%s_default",v->name)
+ >= (int)sizeof(buf))
{
BIO_printf(bio_err,"Name '%s' too long\n",v->name);
return 0;
}
- sprintf(buf,"%s_default",v->name);
if ((def=NCONF_get_string(req_conf,dn_sect,buf)) == NULL)
{
ERR_clear_error();
def="";
}
- sprintf(buf,"%s_value",v->name);
+
+ BIO_snprintf(buf,sizeof buf,"%s_value",v->name);
if ((value=NCONF_get_string(req_conf,dn_sect,buf)) == NULL)
{
ERR_clear_error();
value=NULL;
}
- sprintf(buf,"%s_min",v->name);
+ BIO_snprintf(buf,sizeof buf,"%s_min",v->name);
if (!NCONF_get_number(req_conf,dn_sect,buf, &n_min))
{
ERR_clear_error();
n_min = -1;
}
- sprintf(buf,"%s_max",v->name);
+ BIO_snprintf(buf,sizeof buf,"%s_max",v->name);
if (!NCONF_get_number(req_conf,dn_sect,buf, &n_max))
{
ERR_clear_error();
if ((nid=OBJ_txt2nid(type)) == NID_undef)
goto start2;
- if(strlen(v->name) > sizeof buf-9)
+ if (BIO_snprintf(buf,sizeof buf,"%s_default",type)
+ >= (int)sizeof(buf))
{
BIO_printf(bio_err,"Name '%s' too long\n",v->name);
return 0;
}
- sprintf(buf,"%s_default",type);
if ((def=NCONF_get_string(req_conf,attr_sect,buf))
== NULL)
{
}
- sprintf(buf,"%s_value",type);
+ BIO_snprintf(buf,sizeof buf,"%s_value",type);
if ((value=NCONF_get_string(req_conf,attr_sect,buf))
== NULL)
{
value=NULL;
}
- sprintf(buf,"%s_min",type);
+ BIO_snprintf(buf,sizeof buf,"%s_min",type);
if (!NCONF_get_number(req_conf,attr_sect,buf, &n_min))
n_min = -1;
- sprintf(buf,"%s_max",type);
+ BIO_snprintf(buf,sizeof buf,"%s_max",type);
if (!NCONF_get_number(req_conf,attr_sect,buf, &n_max))
n_max = -1;
}
-static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
+static int add_DN_object(X509_NAME *n, char *text, const char *def, char *value,
int nid, int n_min, int n_max, unsigned long chtype, int mval)
{
int i,ret=0;
(void)BIO_flush(bio_err);
if(value != NULL)
{
- OPENSSL_assert(strlen(value) < sizeof buf-2);
- strcpy(buf,value);
- strcat(buf,"\n");
+ BUF_strlcpy(buf,value,sizeof buf);
+ BUF_strlcat(buf,"\n",sizeof buf);
BIO_printf(bio_err,"%s\n",value);
}
else
{
if ((def == NULL) || (def[0] == '\0'))
return(1);
- strcpy(buf,def);
- strcat(buf,"\n");
+ BUF_strlcpy(buf,def,sizeof buf);
+ BUF_strlcat(buf,"\n",sizeof buf);
}
else if ((buf[0] == '.') && (buf[1] == '\n')) return(1);
return(ret);
}
-static int add_attribute_object(X509_REQ *req, char *text,
- char *def, char *value, int nid, int n_min,
+static int add_attribute_object(X509_REQ *req, char *text, const char *def,
+ char *value, int nid, int n_min,
int n_max, unsigned long chtype)
{
int i;
(void)BIO_flush(bio_err);
if (value != NULL)
{
- OPENSSL_assert(strlen(value) < sizeof buf-2);
- strcpy(buf,value);
- strcat(buf,"\n");
+ BUF_strlcpy(buf,value,sizeof buf);
+ BUF_strlcat(buf,"\n",sizeof buf);
BIO_printf(bio_err,"%s\n",value);
}
else
{
if ((def == NULL) || (def[0] == '\0'))
return(1);
- strcpy(buf,def);
- strcat(buf,"\n");
+ BUF_strlcpy(buf,def,sizeof buf);
+ BUF_strlcat(buf,"\n",sizeof buf);
}
else if ((buf[0] == '.') && (buf[1] == '\n')) return(1);
}
#ifndef OPENSSL_NO_RSA
-static void MS_CALLBACK req_cb(int p, int n, void *arg)
+static int MS_CALLBACK req_cb(int p, int n, BN_GENCB *cb)
{
char c='*';
if (p == 1) c='+';
if (p == 2) c='*';
if (p == 3) c='\n';
- BIO_write((BIO *)arg,&c,1);
- (void)BIO_flush((BIO *)arg);
+ BIO_write(cb->arg,&c,1);
+ (void)BIO_flush(cb->arg);
#ifdef LINT
p=n;
#endif
+ return 1;
}
#endif
}
/* Check if the end of a string matches 'end' */
-static int check_end(char *str, char *end)
+static int check_end(const char *str, const char *end)
{
int elen, slen;
- char *tmp;
+ const char *tmp;
elen = strlen(end);
slen = strlen(str);
if(elen > slen) return 1;