Allow the extension section specified in config files to be overridden

on the command line for various utilities.

diff --git a/CHANGES b/CHANGES
index 32a46769fc9586067a53abf32f26b64453c4fdfc..24f977df028089ec928cab3527c2f6eec0f3a011 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,14 @@
 
  Changes between 0.9.4 and 0.9.5  [xx XXX 1999]
 
+  *) Allow the config file extension section to be overwritten on the
+     command line. Based on an original idea from Massimiliano Pala
+     <madwolf@comune.modena.it>. The new option is called -extensions
+     and can be applied to ca, req and x509. Also -reqexts to override
+     the request extensions in req and -crlexts to override the crl extensions
+     in ca.
+     [Steve Henson]
+
   *) Add new feature to the SPKAC handling in ca.  Now you can include
      the same field multiple times by preceding it by "XXXX." for example:
      1.OU="Unit name 1"

diff --git a/apps/ca.c b/apps/ca.c
index fa355ab0c9646d862b9e6a00ce29fe3d18cc50a6..e1eb275d4039219f8b90436e7f6018b6a2adb0ef 100644 (file)
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -163,6 +163,8 @@ static char *ca_usage[]={
 " -batch          - Don't ask questions\n",
 " -msie_hack      - msie modifications to handle all those universal strings\n",
 " -revoke file    - Revoke a certificate (given in file)\n",
+" -extensions ..  - Extension section (override value in config file)\n",
+" -crlexts ..     - CRL extension section (override value in config file)\n",
 NULL
 };
 
@@ -393,6 +395,16 @@ EF_ALIGNMENT=0;
                        infile= *(++argv);
                        dorevoke=1;
                        }
+               else if (strcmp(*argv,"-extensions") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       extensions= *(++argv);
+                       }
+               else if (strcmp(*argv,"-crlexts") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       crl_ext= *(++argv);
+                       }
                else
                        {
 bad:
@@ -720,8 +732,8 @@ bad:
                        lookup_fail(section,ENV_SERIAL);
                        goto err;
                        }
-
-               extensions=CONF_get_string(conf,section,ENV_EXTENSIONS);
+               if(!extensions)
+                       extensions=CONF_get_string(conf,section,ENV_EXTENSIONS);
                if(extensions) {
                        /* Check syntax of file */
                        X509V3_CTX ctx;
@@ -1031,7 +1043,7 @@ bad:
        /*****************************************************************/
        if (gencrl)
                {
-               crl_ext=CONF_get_string(conf,section,ENV_CRLEXT);
+               if(!crl_ext) crl_ext=CONF_get_string(conf,section,ENV_CRLEXT);
                if(crl_ext) {
                        /* Check syntax of file */
                        X509V3_CTX ctx;

diff --git a/apps/req.c b/apps/req.c
index fa8f7339f345116c751254995cae51fe3dbc414f..cc524de8e22d3eea899ae3280b32fd3431a0334b 100644 (file)
--- a/apps/req.c
+++ b/apps/req.c
@@ -310,8 +310,17 @@ int MAIN(int argc, char **argv)
                        /* ok */
                        digest=md_alg;
                        }
+               else if (strcmp(*argv,"-extensions") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       extensions = *(++argv);
+                       }
+               else if (strcmp(*argv,"-reqexts") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       req_exts = *(++argv);
+                       }
                else
-
                        {
                        BIO_printf(bio_err,"unknown option %s\n",*argv);
                        badops=1;
@@ -349,6 +358,8 @@ bad:
                BIO_printf(bio_err," -asn1-kludge   Output the 'request' in a format that is wrong but some CA's\n");
                BIO_printf(bio_err,"                have been reported as requiring\n");
                BIO_printf(bio_err,"                [ It is now always turned on but can be turned off with -no-asn1-kludge ]\n");
+               BIO_printf(bio_err," -extensions .. specify certificate extension section (override value in config file)\n");
+               BIO_printf(bio_err," -reqexts ..    specify request extension section (override value in config file)\n");
                goto end;
                }
 
@@ -427,7 +438,8 @@ bad:
                        digest=md_alg;
                }
 
-       extensions = CONF_get_string(req_conf, SECTION, V3_EXTENSIONS);
+       if(!extensions)
+               extensions = CONF_get_string(req_conf, SECTION, V3_EXTENSIONS);
        if(extensions) {
                /* Check syntax of file */
                X509V3_CTX ctx;
@@ -440,7 +452,8 @@ bad:
                }
        }
 
-       req_exts = CONF_get_string(req_conf, SECTION, REQ_EXTENSIONS);
+       if(!req_exts)
+               req_exts = CONF_get_string(req_conf, SECTION, REQ_EXTENSIONS);
        if(req_exts) {
                /* Check syntax of file */
                X509V3_CTX ctx;

diff --git a/apps/x509.c b/apps/x509.c
index 2e2d18bea4d93b323a8f4cfa365f3e1581bcdff4..aa6e0573d60dc7eb04ff0bf804500785f09272a0 100644 (file)
--- a/apps/x509.c
+++ b/apps/x509.c
@@ -115,6 +115,7 @@ static char *x509_usage[]={
 " -C              - print out C code forms\n",
 " -md2/-md5/-sha1/-mdc2 - digest to do an RSA sign with\n",
 " -extfile        - configuration file with X509V3 extensions to add\n",
+" -extensions     - section from config file with X509V3 extensions to add\n",
 NULL
 };
 
@@ -218,6 +219,11 @@ int MAIN(int argc, char **argv)
                        if (--argc < 1) goto bad;
                        extfile= *(++argv);
                        }
+               else if (strcmp(*argv,"-extensions") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       extsect= *(++argv);
+                       }
                else if (strcmp(*argv,"-in") == 0)
                        {
                        if (--argc < 1) goto bad;
@@ -335,7 +341,7 @@ bad:
                                                        ,errorline,extfile);
                        goto end;
                }
-               if(!(extsect = CONF_get_string(extconf, "default",
+               if(!extsect && !(extsect = CONF_get_string(extconf, "default",
                                         "extensions"))) extsect = "default";
                X509V3_set_ctx_test(&ctx2);
                X509V3_set_conf_lhash(&ctx2, extconf);