X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;f=apps%2Freq.c;h=c2bada07c8f649c2ad33b899a82b278d121bb459;hb=9fa15b6ff88dc33a705fed7fc044639143dd394e;hp=27a7bba106451fe62c7b8c1e68e1b855a047e5da;hpb=4d94ae00d5614d64d4dd065860c4b00161a81f82;p=oweals%2Fopenssl.git diff --git a/apps/req.c b/apps/req.c index 27a7bba106..c2bada07c8 100644 --- a/apps/req.c +++ b/apps/req.c @@ -73,6 +73,7 @@ #include #include #include +#include "../crypto/cryptlib.h" #define SECTION "req" @@ -142,7 +143,6 @@ static int batch=0; #define TYPE_RSA 1 #define TYPE_DSA 2 #define TYPE_DH 3 -#define TYPE_ECDSA 4 int MAIN(int, char **); @@ -152,10 +152,7 @@ int MAIN(int argc, char **argv) #ifndef OPENSSL_NO_DSA DSA *dsa_params=NULL; #endif -#ifndef OPENSSL_NO_ECDSA - ECDSA *ecdsa_params = NULL; -#endif - unsigned long nmflag = 0; + unsigned long nmflag = 0, reqflag = 0; int ex=1,x509=0,days=30; X509 *x509ss=NULL; X509_REQ *req=NULL; @@ -180,7 +177,8 @@ int MAIN(int argc, char **argv) const EVP_MD *md_alg=NULL,*digest=EVP_md5(); unsigned long chtype = MBSTRING_ASC; #ifndef MONOLITH - MS_STATIC char config_name[256]; + char *to_free; + long errline; #endif req_conf = NULL; @@ -309,7 +307,7 @@ int MAIN(int argc, char **argv) goto end; } - dtmp=X509_get_pubkey(xtmp); + if ((dtmp=X509_get_pubkey(xtmp)) == NULL) goto end; if (dtmp->type == EVP_PKEY_DSA) dsa_params=DSAparams_dup(dtmp->pkey.dsa); EVP_PKEY_free(dtmp); @@ -321,62 +319,10 @@ int MAIN(int argc, char **argv) } } BIO_free(in); - in=NULL; newkey=BN_num_bits(dsa_params->p); - } - else -#endif -#ifndef OPENSSL_NO_ECDSA - if (strncmp("ecdsa:",p,4) == 0) - { - X509 *xtmp=NULL; - EVP_PKEY *dtmp; - - pkey_type=TYPE_ECDSA; - p+=6; - if ((in=BIO_new_file(p,"r")) == NULL) - { - perror(p); - goto end; - } - if ((ecdsa_params = PEM_read_bio_ECDSAParameters(in, NULL, NULL, NULL)) == NULL) - { - ERR_clear_error(); - (void)BIO_reset(in); - if ((xtmp=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL) - { - BIO_printf(bio_err,"unable to load ECDSA parameters from file\n"); - goto end; - } - - dtmp=X509_get_pubkey(xtmp); - if (dtmp->type == EVP_PKEY_ECDSA) - ecdsa_params = ECDSAParameters_dup(dtmp->pkey.ecdsa); - EVP_PKEY_free(dtmp); - X509_free(xtmp); - if (ecdsa_params == NULL) - { - BIO_printf(bio_err,"Certificate does not contain ECDSA parameters\n"); - goto end; - } - } - - BIO_free(in); in=NULL; - - { - BIGNUM *order = BN_new(); - - if (!order) - goto end; - if (!EC_GROUP_get_order(ecdsa_params->group, order, NULL)) - goto end; - newkey = BN_num_bits(order); - BN_free(order); - } - } - else + else #endif #ifndef OPENSSL_NO_DH if (strncmp("dh:",p,4) == 0) @@ -411,6 +357,11 @@ int MAIN(int argc, char **argv) if (--argc < 1) goto bad; if (!set_name_ex(&nmflag, *(++argv))) goto bad; } + else if (strcmp(*argv,"-reqopt") == 0) + { + if (--argc < 1) goto bad; + if (!set_cert_ex(&reqflag, *(++argv))) goto bad; + } else if (strcmp(*argv,"-subject") == 0) subject=1; else if (strcmp(*argv,"-text") == 0) @@ -489,7 +440,6 @@ bad: BIO_printf(bio_err," the random number generator\n"); BIO_printf(bio_err," -newkey rsa:bits generate a new RSA key of 'bits' in size\n"); BIO_printf(bio_err," -newkey dsa:file generate a new DSA key, parameters taken from CA in 'file'\n"); - BIO_printf(bio_err," -newkey ecdsa:file generate a new ECDSA key, parameters taken from CA in 'file'\n"); BIO_printf(bio_err," -[digest] Digest to sign with (md5, sha1, md2, mdc2, md4)\n"); BIO_printf(bio_err," -config file request template file.\n"); BIO_printf(bio_err," -subj arg set or modify request subject\n"); @@ -504,6 +454,8 @@ bad: BIO_printf(bio_err," -extensions .. specify certificate extension section (override value in config file)\n"); BIO_printf(bio_err," -reqexts .. specify request extension section (override value in config file)\n"); BIO_printf(bio_err," -utf8 input characters are UTF8 (default ASCII)\n"); + BIO_printf(bio_err," -nameopt arg - various certificate name options\n"); + BIO_printf(bio_err," -reqopt arg - various request text options\n\n"); goto end; } @@ -519,22 +471,15 @@ bad: if (p == NULL) p=getenv("SSLEAY_CONF"); if (p == NULL) - { - strcpy(config_name,X509_get_default_cert_area()); -#ifndef OPENSSL_SYS_VMS - strcat(config_name,"/"); -#endif - strcat(config_name,OPENSSL_CONF); - p=config_name; - } + p=to_free=make_config_name(); default_config_file=p; config=NCONF_new(NULL); - i=NCONF_load(config, p); + i=NCONF_load(config, p, &errline); #endif if (template != NULL) { - long errline; + long errline = -1; if( verbose ) BIO_printf(bio_err,"Using configuration from %s\n",template); @@ -560,6 +505,8 @@ bad: if (req_conf != NULL) { + if (!load_config(bio_err, req_conf)) + goto end; p=NCONF_get_string(req_conf,NULL,"oid_file"); if (p == NULL) ERR_clear_error(); @@ -675,7 +622,7 @@ bad: if (keyfile != NULL) { - pkey = load_key(bio_err, keyfile, keyform, passin, e, + pkey = load_key(bio_err, keyfile, keyform, 0, passin, e, "Private Key"); if (!pkey) { @@ -683,7 +630,7 @@ bad: message */ goto end; } - if (EVP_PKEY_type(pkey->type) == EVP_PKEY_DSA || EVP_PKEY_type(pkey->type) == EVP_PKEY_ECDSA) + if (EVP_PKEY_type(pkey->type) == EVP_PKEY_DSA) { char *randfile = NCONF_get_string(req_conf,SECTION,"RANDFILE"); if (randfile == NULL) @@ -707,15 +654,14 @@ bad: newkey=DEFAULT_KEY_LENGTH; } - if (newkey < MIN_KEY_LENGTH && (pkey_type == TYPE_RSA || pkey_type == TYPE_DSA)) - /* TODO: appropriate minimal keylength for the different algorithm (esp. ECDSA) */ + if (newkey < MIN_KEY_LENGTH) { BIO_printf(bio_err,"private key length is too short,\n"); BIO_printf(bio_err,"it needs to be at least %d bits, not %d\n",MIN_KEY_LENGTH,newkey); goto end; } BIO_printf(bio_err,"Generating a %d bit %s private key\n", - newkey,(pkey_type == TYPE_RSA)?"RSA":(pkey_type == TYPE_DSA)?"DSA":"ECDSA"); + newkey,(pkey_type == TYPE_RSA)?"RSA":"DSA"); if ((pkey=EVP_PKEY_new()) == NULL) goto end; @@ -737,14 +683,6 @@ bad: dsa_params=NULL; } #endif -#ifndef OPENSSL_NO_ECDSA - if (pkey_type == TYPE_ECDSA) - { - if (!ECDSA_generate_key(ecdsa_params)) goto end; - if (!EVP_PKEY_assign_ECDSA(pkey, ecdsa_params)) goto end; - ecdsa_params = NULL; - } -#endif app_RAND_write_file(randfile, bio_err); @@ -850,10 +788,6 @@ loop: #ifndef OPENSSL_NO_DSA if (pkey->type == EVP_PKEY_DSA) digest=EVP_dss1(); -#endif -#ifndef OPENSSL_NO_ECDSA - if (pkey->type == EVP_PKEY_ECDSA) - digest=EVP_ecdsa(); #endif if (req == NULL) { @@ -885,19 +819,20 @@ loop: /* Set version to V3 */ if(!X509_set_version(x509ss, 2)) goto end; if (serial) - X509_set_serialNumber(x509ss, serial); + { + if (!X509_set_serialNumber(x509ss, serial)) goto end; + } else - ASN1_INTEGER_set(X509_get_serialNumber(x509ss),0L); - - X509_set_issuer_name(x509ss, - X509_REQ_get_subject_name(req)); - X509_gmtime_adj(X509_get_notBefore(x509ss),0); - X509_gmtime_adj(X509_get_notAfter(x509ss), - (long)60*60*24*days); - X509_set_subject_name(x509ss, - X509_REQ_get_subject_name(req)); + { + if (!ASN1_INTEGER_set(X509_get_serialNumber(x509ss),0L)) goto end; + } + + if (!X509_set_issuer_name(x509ss, X509_REQ_get_subject_name(req))) goto end; + if (!X509_gmtime_adj(X509_get_notBefore(x509ss),0)) goto end; + if (!X509_gmtime_adj(X509_get_notAfter(x509ss), (long)60*60*24*days)) goto end; + if (!X509_set_subject_name(x509ss, X509_REQ_get_subject_name(req))) goto end; tmppkey = X509_REQ_get_pubkey(req); - X509_set_pubkey(x509ss,tmppkey); + if (!tmppkey || !X509_set_pubkey(x509ss,tmppkey)) goto end; EVP_PKEY_free(tmppkey); /* Set up V3 context struct */ @@ -1046,9 +981,9 @@ loop: if (text) { if (x509) - X509_print(out,x509ss); + X509_print_ex(out, x509ss, nmflag, reqflag); else - X509_REQ_print(out,req); + X509_REQ_print_ex(out, req, nmflag, reqflag); } if(subject) @@ -1118,6 +1053,10 @@ loop: } ex=0; end: +#ifndef MONOLITH + if(to_free) + OPENSSL_free(to_free); +#endif if (ex) { ERR_print_errors(bio_err); @@ -1134,9 +1073,6 @@ end: OBJ_cleanup(); #ifndef OPENSSL_NO_DSA if (dsa_params != NULL) DSA_free(dsa_params); -#endif -#ifndef OPENSSL_NO_ECDSA - if (ecdsa_params != NULL) ECDSA_free(ecdsa_params); #endif apps_shutdown(); EXIT(ex); @@ -1199,71 +1135,29 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs, } if(!i) goto err; - X509_REQ_set_pubkey(req,pkey); + if (!X509_REQ_set_pubkey(req,pkey)) goto err; ret=1; err: return(ret); } +/* + * subject is expected to be in the format /type0=value0/type1=value1/type2=... + * where characters may be escaped by \ + */ static int build_subject(X509_REQ *req, char *subject, unsigned long chtype) { - X509_NAME *n = NULL; - - int i, nid, ne_num=0; - - char *ne_name = NULL; - char *ne_value = NULL; - - char *tmp = NULL; - char *p[2]; - - char *str_list[256]; - - p[0] = ",/"; - p[1] = "="; - - n = X509_NAME_new(); - - tmp = strtok(subject, p[0]); - while((tmp != NULL) && (ne_num < (sizeof str_list/sizeof *str_list))) - { - char *token = tmp; - - while (token[0] == ' ') - token++; - str_list[ne_num] = token; + X509_NAME *n; - tmp = strtok(NULL, p[0]); - ne_num++; - } - - for(i = 0; i < ne_num; i++) - { - ne_name = strtok(str_list[i], p[1]); - ne_value = strtok(NULL, p[1]); - - if ((nid=OBJ_txt2nid(ne_name)) == NID_undef) - { - BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_name); - continue; - } - - if (ne_value == NULL) - { - BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_name); - continue; - } - - if (!X509_NAME_add_entry_by_NID(n, nid, chtype, (unsigned char*)ne_value, -1,-1,0)) - { - X509_NAME_free(n); - return 0; - } - } + if (!(n = do_subject(subject, chtype))) + return 0; if (!X509_REQ_set_subject_name(req, n)) + { + X509_NAME_free(n); return 0; + } X509_NAME_free(n); return 1; } @@ -1322,13 +1216,19 @@ start: for (;;) } /* If OBJ not recognised ignore it */ if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start; + + if(strlen(v->name) > sizeof buf-9) + { + BIO_printf(bio_err,"Name '%s' too long\n",v->name); + return 0; + } + sprintf(buf,"%s_default",v->name); if ((def=NCONF_get_string(req_conf,dn_sect,buf)) == NULL) { ERR_clear_error(); def=""; } - sprintf(buf,"%s_value",v->name); if ((value=NCONF_get_string(req_conf,dn_sect,buf)) == NULL) { @@ -1375,6 +1275,12 @@ start2: for (;;) if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start2; + if(strlen(v->name) > sizeof buf-9) + { + BIO_printf(bio_err,"Name '%s' too long\n",v->name); + return 0; + } + sprintf(buf,"%s_default",type); if ((def=NCONF_get_string(req_conf,attr_sect,buf)) == NULL) @@ -1478,6 +1384,7 @@ start: (void)BIO_flush(bio_err); if(value != NULL) { + OPENSSL_assert(strlen(value) < sizeof buf-2); strcpy(buf,value); strcat(buf,"\n"); BIO_printf(bio_err,"%s\n",value); @@ -1487,7 +1394,7 @@ start: buf[0]='\0'; if (!batch) { - fgets(buf,1024,stdin); + fgets(buf,sizeof buf,stdin); } else { @@ -1536,6 +1443,7 @@ start: (void)BIO_flush(bio_err); if (value != NULL) { + OPENSSL_assert(strlen(value) < sizeof buf-2); strcpy(buf,value); strcat(buf,"\n"); BIO_printf(bio_err,"%s\n",value); @@ -1545,7 +1453,7 @@ start: buf[0]='\0'; if (!batch) { - fgets(buf,1024,stdin); + fgets(buf,sizeof buf,stdin); } else {