aboutsummaryrefslogtreecommitdiffstats
path: root/apps
diff options
context:
space:
mode:
Diffstat (limited to 'apps')
-rw-r--r--apps/app_rand.c188
-rw-r--r--apps/apps.c5085
-rw-r--r--apps/apps.h354
-rw-r--r--apps/asn1pars.c693
-rw-r--r--apps/ca.c5555
-rw-r--r--apps/ciphers.c300
-rw-r--r--apps/cms.c2438
-rw-r--r--apps/crl.c678
-rw-r--r--apps/crl2p7.c469
-rw-r--r--apps/dgst.c1070
-rw-r--r--apps/dh.c518
-rw-r--r--apps/dhparam.c842
-rw-r--r--apps/dsa.c570
-rw-r--r--apps/dsaparam.c781
-rw-r--r--apps/ec.c569
-rw-r--r--apps/ecparam.c1180
-rw-r--r--apps/enc.c1220
-rw-r--r--apps/engine.c886
-rw-r--r--apps/errstr.c101
-rw-r--r--apps/gendh.c345
-rw-r--r--apps/gendsa.c418
-rw-r--r--apps/genpkey.c655
-rw-r--r--apps/genrsa.c515
-rw-r--r--apps/nseq.c181
-rw-r--r--apps/ocsp.c2560
-rw-r--r--apps/openssl.c1038
-rw-r--r--apps/passwd.c938
-rw-r--r--apps/pkcs12.c1658
-rw-r--r--apps/pkcs7.c414
-rw-r--r--apps/pkcs8.c637
-rw-r--r--apps/pkey.c381
-rw-r--r--apps/pkeyparam.c211
-rw-r--r--apps/pkeyutl.c899
-rw-r--r--apps/prime.c159
-rw-r--r--apps/progs.h352
-rw-r--r--apps/rand.c298
-rw-r--r--apps/req.c3224
-rw-r--r--apps/rsa.c747
-rw-r--r--apps/rsautl.c560
-rw-r--r--apps/s_apps.h76
-rw-r--r--apps/s_cb.c1509
-rw-r--r--apps/s_client.c3558
-rw-r--r--apps/s_server.c4845
-rw-r--r--apps/s_socket.c986
-rw-r--r--apps/s_time.c803
-rw-r--r--apps/sess_id.c434
-rw-r--r--apps/smime.c1381
-rw-r--r--apps/speed.c5176
-rw-r--r--apps/spkac.c404
-rw-r--r--apps/srp.c1350
-rw-r--r--apps/testdsa.h430
-rw-r--r--apps/testrsa.h924
-rw-r--r--apps/timeouts.h14
-rw-r--r--apps/ts.c1908
-rw-r--r--apps/verify.c539
-rw-r--r--apps/version.c139
-rw-r--r--apps/x509.c2262
57 files changed, 32412 insertions, 34013 deletions
diff --git a/apps/app_rand.c b/apps/app_rand.c
index b7b6128c1eb9..595fc7821c85 100644
--- a/apps/app_rand.c
+++ b/apps/app_rand.c
@@ -5,21 +5,21 @@
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -34,10 +34,10 @@
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -49,7 +49,7 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
@@ -63,7 +63,7 @@
* are met:
*
* 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
+ * notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
@@ -115,104 +115,106 @@
#include <openssl/bio.h>
#include <openssl/rand.h>
-
static int seeded = 0;
static int egdsocket = 0;
int app_RAND_load_file(const char *file, BIO *bio_e, int dont_warn)
- {
- int consider_randfile = (file == NULL);
- char buffer[200];
-
+{
+ int consider_randfile = (file == NULL);
+ char buffer[200];
+
#ifdef OPENSSL_SYS_WINDOWS
- BIO_printf(bio_e,"Loading 'screen' into random state -");
- BIO_flush(bio_e);
- RAND_screen();
- BIO_printf(bio_e," done\n");
+ BIO_printf(bio_e, "Loading 'screen' into random state -");
+ BIO_flush(bio_e);
+ RAND_screen();
+ BIO_printf(bio_e, " done\n");
#endif
- if (file == NULL)
- file = RAND_file_name(buffer, sizeof buffer);
- else if (RAND_egd(file) > 0)
- {
- /* we try if the given filename is an EGD socket.
- if it is, we don't write anything back to the file. */
- egdsocket = 1;
- return 1;
- }
- if (file == NULL || !RAND_load_file(file, -1))
- {
- if (RAND_status() == 0)
- {
- if (!dont_warn)
- {
- BIO_printf(bio_e,"unable to load 'random state'\n");
- BIO_printf(bio_e,"This means that the random number generator has not been seeded\n");
- BIO_printf(bio_e,"with much random data.\n");
- if (consider_randfile) /* explanation does not apply when a file is explicitly named */
- {
- BIO_printf(bio_e,"Consider setting the RANDFILE environment variable to point at a file that\n");
- BIO_printf(bio_e,"'random' data can be kept in (the file will be overwritten).\n");
- }
- }
- return 0;
- }
- }
- seeded = 1;
- return 1;
- }
+ if (file == NULL)
+ file = RAND_file_name(buffer, sizeof buffer);
+ else if (RAND_egd(file) > 0) {
+ /*
+ * we try if the given filename is an EGD socket. if it is, we don't
+ * write anything back to the file.
+ */
+ egdsocket = 1;
+ return 1;
+ }
+ if (file == NULL || !RAND_load_file(file, -1)) {
+ if (RAND_status() == 0) {
+ if (!dont_warn) {
+ BIO_printf(bio_e, "unable to load 'random state'\n");
+ BIO_printf(bio_e,
+ "This means that the random number generator has not been seeded\n");
+ BIO_printf(bio_e, "with much random data.\n");
+ if (consider_randfile) { /* explanation does not apply when a
+ * file is explicitly named */
+ BIO_printf(bio_e,
+ "Consider setting the RANDFILE environment variable to point at a file that\n");
+ BIO_printf(bio_e,
+ "'random' data can be kept in (the file will be overwritten).\n");
+ }
+ }
+ return 0;
+ }
+ }
+ seeded = 1;
+ return 1;
+}
long app_RAND_load_files(char *name)
- {
- char *p,*n;
- int last;
- long tot=0;
- int egd;
-
- for (;;)
- {
- last=0;
- for (p=name; ((*p != '\0') && (*p != LIST_SEPARATOR_CHAR)); p++);
- if (*p == '\0') last=1;
- *p='\0';
- n=name;
- name=p+1;
- if (*n == '\0') break;
+{
+ char *p, *n;
+ int last;
+ long tot = 0;
+ int egd;
- egd=RAND_egd(n);
- if (egd > 0)
- tot+=egd;
- else
- tot+=RAND_load_file(n,-1);
- if (last) break;
- }
- if (tot > 512)
- app_RAND_allow_write_file();
- return(tot);
- }
+ for (;;) {
+ last = 0;
+ for (p = name; ((*p != '\0') && (*p != LIST_SEPARATOR_CHAR)); p++) ;
+ if (*p == '\0')
+ last = 1;
+ *p = '\0';
+ n = name;
+ name = p + 1;
+ if (*n == '\0')
+ break;
+
+ egd = RAND_egd(n);
+ if (egd > 0)
+ tot += egd;
+ else
+ tot += RAND_load_file(n, -1);
+ if (last)
+ break;
+ }
+ if (tot > 512)
+ app_RAND_allow_write_file();
+ return (tot);
+}
int app_RAND_write_file(const char *file, BIO *bio_e)
- {
- char buffer[200];
-
- if (egdsocket || !seeded)
- /* If we did not manage to read the seed file,
- * we should not write a low-entropy seed file back --
- * it would suppress a crucial warning the next time
- * we want to use it. */
- return 0;
+{
+ char buffer[200];
+
+ if (egdsocket || !seeded)
+ /*
+ * If we did not manage to read the seed file, we should not write a
+ * low-entropy seed file back -- it would suppress a crucial warning
+ * the next time we want to use it.
+ */
+ return 0;
- if (file == NULL)
- file = RAND_file_name(buffer, sizeof buffer);
- if (file == NULL || !RAND_write_file(file))
- {
- BIO_printf(bio_e,"unable to write 'random state'\n");
- return 0;
- }
- return 1;
- }
+ if (file == NULL)
+ file = RAND_file_name(buffer, sizeof buffer);
+ if (file == NULL || !RAND_write_file(file)) {
+ BIO_printf(bio_e, "unable to write 'random state'\n");
+ return 0;
+ }
+ return 1;
+}
void app_RAND_allow_write_file(void)
- {
- seeded = 1;
- }
+{
+ seeded = 1;
+}
diff --git a/apps/apps.c b/apps/apps.c
index 3e18289a4b5b..9862afde3a77 100644
--- a/apps/apps.c
+++ b/apps/apps.c
@@ -5,21 +5,21 @@
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -34,10 +34,10 @@
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -49,7 +49,7 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
@@ -63,7 +63,7 @@
* are met:
*
* 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
+ * notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
@@ -110,16 +110,17 @@
*/
#if !defined(_POSIX_C_SOURCE) && defined(OPENSSL_SYS_VMS)
-#define _POSIX_C_SOURCE 2 /* On VMS, you need to define this to get
- the declaration of fileno(). The value
- 2 is to make sure no function defined
- in POSIX-2 is left undefined. */
+/*
+ * On VMS, you need to define this to get the declaration of fileno(). The
+ * value 2 is to make sure no function defined in POSIX-2 is left undefined.
+ */
+# define _POSIX_C_SOURCE 2
#endif
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#if !defined(OPENSSL_SYSNAME_WIN32) && !defined(NETWARE_CLIB)
-#include <strings.h>
+# include <strings.h>
#endif
#include <sys/types.h>
#include <ctype.h>
@@ -133,14 +134,14 @@
#include <openssl/ui.h>
#include <openssl/safestack.h>
#ifndef OPENSSL_NO_ENGINE
-#include <openssl/engine.h>
+# include <openssl/engine.h>
#endif
#ifndef OPENSSL_NO_RSA
-#include <openssl/rsa.h>
+# include <openssl/rsa.h>
#endif
#include <openssl/bn.h>
#ifndef OPENSSL_NO_JPAKE
-#include <openssl/jpake.h>
+# include <openssl/jpake.h>
#endif
#define NON_MAIN
@@ -149,2586 +150,2448 @@
#ifdef _WIN32
static int WIN32_rename(const char *from, const char *to);
-#define rename(from,to) WIN32_rename((from),(to))
+# define rename(from,to) WIN32_rename((from),(to))
#endif
typedef struct {
- const char *name;
- unsigned long flag;
- unsigned long mask;
+ const char *name;
+ unsigned long flag;
+ unsigned long mask;
} NAME_EX_TBL;
static UI_METHOD *ui_method = NULL;
-static int set_table_opts(unsigned long *flags, const char *arg, const NAME_EX_TBL *in_tbl);
-static int set_multi_opts(unsigned long *flags, const char *arg, const NAME_EX_TBL *in_tbl);
+static int set_table_opts(unsigned long *flags, const char *arg,
+ const NAME_EX_TBL * in_tbl);
+static int set_multi_opts(unsigned long *flags, const char *arg,
+ const NAME_EX_TBL * in_tbl);
#if !defined(OPENSSL_NO_RC4) && !defined(OPENSSL_NO_RSA)
/* Looks like this stuff is worth moving into separate function */
-static EVP_PKEY *
-load_netscape_key(BIO *err, BIO *key, const char *file,
- const char *key_descrip, int format);
+static EVP_PKEY *load_netscape_key(BIO *err, BIO *key, const char *file,
+ const char *key_descrip, int format);
#endif
int app_init(long mesgwin);
-#ifdef undef /* never finished - probably never will be :-) */
+#ifdef undef /* never finished - probably never will be
+ * :-) */
int args_from_file(char *file, int *argc, char **argv[])
- {
- FILE *fp;
- int num,i;
- unsigned int len;
- static char *buf=NULL;
- static char **arg=NULL;
- char *p;
-
- fp=fopen(file,"r");
- if (fp == NULL)
- return(0);
-
- if (fseek(fp,0,SEEK_END)==0)
- len=ftell(fp), rewind(fp);
- else len=-1;
- if (len<=0)
- {
- fclose(fp);
- return(0);
- }
-
- *argc=0;
- *argv=NULL;
-
- if (buf != NULL) OPENSSL_free(buf);
- buf=(char *)OPENSSL_malloc(len+1);
- if (buf == NULL) return(0);
-
- len=fread(buf,1,len,fp);
- if (len <= 1) return(0);
- buf[len]='\0';
-
- i=0;
- for (p=buf; *p; p++)
- if (*p == '\n') i++;
- if (arg != NULL) OPENSSL_free(arg);
- arg=(char **)OPENSSL_malloc(sizeof(char *)*(i*2));
-
- *argv=arg;
- num=0;
- p=buf;
- for (;;)
- {
- if (!*p) break;
- if (*p == '#') /* comment line */
- {
- while (*p && (*p != '\n')) p++;
- continue;
- }
- /* else we have a line */
- *(arg++)=p;
- num++;
- while (*p && ((*p != ' ') && (*p != '\t') && (*p != '\n')))
- p++;
- if (!*p) break;
- if (*p == '\n')
- {
- *(p++)='\0';
- continue;
- }
- /* else it is a tab or space */
- p++;
- while (*p && ((*p == ' ') || (*p == '\t') || (*p == '\n')))
- p++;
- if (!*p) break;
- if (*p == '\n')
- {
- p++;
- continue;
- }
- *(arg++)=p++;
- num++;
- while (*p && (*p != '\n')) p++;
- if (!*p) break;
- /* else *p == '\n' */
- *(p++)='\0';
- }
- *argc=num;
- return(1);
- }
+{
+ FILE *fp;
+ int num, i;
+ unsigned int len;
+ static char *buf = NULL;
+ static char **arg = NULL;
+ char *p;
+
+ fp = fopen(file, "r");
+ if (fp == NULL)
+ return (0);
+
+ if (fseek(fp, 0, SEEK_END) == 0)
+ len = ftell(fp), rewind(fp);
+ else
+ len = -1;
+ if (len <= 0) {
+ fclose(fp);
+ return (0);
+ }
+
+ *argc = 0;
+ *argv = NULL;
+
+ if (buf != NULL)
+ OPENSSL_free(buf);
+ buf = (char *)OPENSSL_malloc(len + 1);
+ if (buf == NULL)
+ return (0);
+
+ len = fread(buf, 1, len, fp);
+ if (len <= 1)
+ return (0);
+ buf[len] = '\0';
+
+ i = 0;
+ for (p = buf; *p; p++)
+ if (*p == '\n')
+ i++;
+ if (arg != NULL)
+ OPENSSL_free(arg);
+ arg = (char **)OPENSSL_malloc(sizeof(char *) * (i * 2));
+
+ *argv = arg;
+ num = 0;
+ p = buf;
+ for (;;) {
+ if (!*p)
+ break;
+ if (*p == '#') { /* comment line */
+ while (*p && (*p != '\n'))
+ p++;
+ continue;
+ }
+ /* else we have a line */
+ *(arg++) = p;
+ num++;
+ while (*p && ((*p != ' ') && (*p != '\t') && (*p != '\n')))
+ p++;
+ if (!*p)
+ break;
+ if (*p == '\n') {
+ *(p++) = '\0';
+ continue;
+ }
+ /* else it is a tab or space */
+ p++;
+ while (*p && ((*p == ' ') || (*p == '\t') || (*p == '\n')))
+ p++;
+ if (!*p)
+ break;
+ if (*p == '\n') {
+ p++;
+ continue;
+ }
+ *(arg++) = p++;
+ num++;
+ while (*p && (*p != '\n'))
+ p++;
+ if (!*p)
+ break;
+ /* else *p == '\n' */
+ *(p++) = '\0';
+ }
+ *argc = num;
+ return (1);
+}
#endif
int str2fmt(char *s)
- {
- if (s == NULL)
- return FORMAT_UNDEF;
- if ((*s == 'D') || (*s == 'd'))
- return(FORMAT_ASN1);
- else if ((*s == 'T') || (*s == 't'))
- return(FORMAT_TEXT);
- else if ((*s == 'N') || (*s == 'n'))
- return(FORMAT_NETSCAPE);
- else if ((*s == 'S') || (*s == 's'))
- return(FORMAT_SMIME);
- else if ((*s == 'M') || (*s == 'm'))
- return(FORMAT_MSBLOB);
- else if ((*s == '1')
- || (strcmp(s,"PKCS12") == 0) || (strcmp(s,"pkcs12") == 0)
- || (strcmp(s,"P12") == 0) || (strcmp(s,"p12") == 0))
- return(FORMAT_PKCS12);
- else if ((*s == 'E') || (*s == 'e'))
- return(FORMAT_ENGINE);
- else if ((*s == 'P') || (*s == 'p'))
- {
- if (s[1] == 'V' || s[1] == 'v')
- return FORMAT_PVK;
- else
- return(FORMAT_PEM);
- }
- else
- return(FORMAT_UNDEF);
- }
+{
+ if (s == NULL)
+ return FORMAT_UNDEF;
+ if ((*s == 'D') || (*s == 'd'))
+ return (FORMAT_ASN1);
+ else if ((*s == 'T') || (*s == 't'))
+ return (FORMAT_TEXT);
+ else if ((*s == 'N') || (*s == 'n'))
+ return (FORMAT_NETSCAPE);
+ else if ((*s == 'S') || (*s == 's'))
+ return (FORMAT_SMIME);
+ else if ((*s == 'M') || (*s == 'm'))
+ return (FORMAT_MSBLOB);
+ else if ((*s == '1')
+ || (strcmp(s, "PKCS12") == 0) || (strcmp(s, "pkcs12") == 0)
+ || (strcmp(s, "P12") == 0) || (strcmp(s, "p12") == 0))
+ return (FORMAT_PKCS12);
+ else if ((*s == 'E') || (*s == 'e'))
+ return (FORMAT_ENGINE);
+ else if ((*s == 'P') || (*s == 'p')) {
+ if (s[1] == 'V' || s[1] == 'v')
+ return FORMAT_PVK;
+ else
+ return (FORMAT_PEM);
+ } else
+ return (FORMAT_UNDEF);
+}
#if defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WIN16) || defined(OPENSSL_SYS_NETWARE)
void program_name(char *in, char *out, int size)
- {
- int i,n;
- char *p=NULL;
-
- n=strlen(in);
- /* find the last '/', '\' or ':' */
- for (i=n-1; i>0; i--)
- {
- if ((in[i] == '/') || (in[i] == '\\') || (in[i] == ':'))
- {
- p= &(in[i+1]);
- break;
- }
- }
- if (p == NULL)
- p=in;
- n=strlen(p);
-
-#if defined(OPENSSL_SYS_NETWARE)
- /* strip off trailing .nlm if present. */
- if ((n > 4) && (p[n-4] == '.') &&
- ((p[n-3] == 'n') || (p[n-3] == 'N')) &&
- ((p[n-2] == 'l') || (p[n-2] == 'L')) &&
- ((p[n-1] == 'm') || (p[n-1] == 'M')))
- n-=4;
-#else
- /* strip off trailing .exe if present. */
- if ((n > 4) && (p[n-4] == '.') &&
- ((p[n-3] == 'e') || (p[n-3] == 'E')) &&
- ((p[n-2] == 'x') || (p[n-2] == 'X')) &&
- ((p[n-1] == 'e') || (p[n-1] == 'E')))
- n-=4;
-#endif
+{
+ int i, n;
+ char *p = NULL;
+
+ n = strlen(in);
+ /* find the last '/', '\' or ':' */
+ for (i = n - 1; i > 0; i--) {
+ if ((in[i] == '/') || (in[i] == '\\') || (in[i] == ':')) {
+ p = &(in[i + 1]);
+ break;
+ }
+ }
+ if (p == NULL)
+ p = in;
+ n = strlen(p);
+
+# if defined(OPENSSL_SYS_NETWARE)
+ /* strip off trailing .nlm if present. */
+ if ((n > 4) && (p[n - 4] == '.') &&
+ ((p[n - 3] == 'n') || (p[n - 3] == 'N')) &&
+ ((p[n - 2] == 'l') || (p[n - 2] == 'L')) &&
+ ((p[n - 1] == 'm') || (p[n - 1] == 'M')))
+ n -= 4;
+# else
+ /* strip off trailing .exe if present. */
+ if ((n > 4) && (p[n - 4] == '.') &&
+ ((p[n - 3] == 'e') || (p[n - 3] == 'E')) &&
+ ((p[n - 2] == 'x') || (p[n - 2] == 'X')) &&
+ ((p[n - 1] == 'e') || (p[n - 1] == 'E')))
+ n -= 4;
+# endif
- if (n > size-1)
- n=size-1;
-
- for (i=0; i<n; i++)
- {
- if ((p[i] >= 'A') && (p[i] <= 'Z'))
- out[i]=p[i]-'A'+'a';
- else
- out[i]=p[i];
- }
- out[n]='\0';
- }
+ if (n > size - 1)
+ n = size - 1;
+
+ for (i = 0; i < n; i++) {
+ if ((p[i] >= 'A') && (p[i] <= 'Z'))
+ out[i] = p[i] - 'A' + 'a';
+ else
+ out[i] = p[i];
+ }
+ out[n] = '\0';
+}
#else
-#ifdef OPENSSL_SYS_VMS
+# ifdef OPENSSL_SYS_VMS
void program_name(char *in, char *out, int size)
- {
- char *p=in, *q;
- char *chars=":]>";
-
- while(*chars != '\0')
- {
- q=strrchr(p,*chars);
- if (q > p)
- p = q + 1;
- chars++;
- }
-
- q=strrchr(p,'.');
- if (q == NULL)
- q = p + strlen(p);
- strncpy(out,p,size-1);
- if (q-p >= size)
- {
- out[size-1]='\0';
- }
- else
- {
- out[q-p]='\0';
- }
- }
-#else
+{
+ char *p = in, *q;
+ char *chars = ":]>";
+
+ while (*chars != '\0') {
+ q = strrchr(p, *chars);
+ if (q > p)
+ p = q + 1;
+ chars++;
+ }
+
+ q = strrchr(p, '.');
+ if (q == NULL)
+ q = p + strlen(p);
+ strncpy(out, p, size - 1);
+ if (q - p >= size) {
+ out[size - 1] = '\0';
+ } else {
+ out[q - p] = '\0';
+ }
+}
+# else
void program_name(char *in, char *out, int size)
- {
- char *p;
-
- p=strrchr(in,'/');
- if (p != NULL)
- p++;
- else
- p=in;
- BUF_strlcpy(out,p,size);
- }
-#endif
+{
+ char *p;
+
+ p = strrchr(in, '/');
+ if (p != NULL)
+ p++;
+ else
+ p = in;
+ BUF_strlcpy(out, p, size);
+}
+# endif
#endif
int chopup_args(ARGS *arg, char *buf, int *argc, char **argv[])
- {
- int num,i;
- char *p;
-
- *argc=0;
- *argv=NULL;
-
- i=0;
- if (arg->count == 0)
- {
- arg->count=20;
- arg->data=(char **)OPENSSL_malloc(sizeof(char *)*arg->count);
- if (arg->data == NULL)
- return 0;
- }
- for (i=0; i<arg->count; i++)
- arg->data[i]=NULL;
-
- num=0;
- p=buf;
- for (;;)
- {
- /* first scan over white space */
- if (!*p) break;
- while (*p && ((*p == ' ') || (*p == '\t') || (*p == '\n')))
- p++;
- if (!*p) break;
-
- /* The start of something good :-) */
- if (num >= arg->count)
- {
- char **tmp_p;
- int tlen = arg->count + 20;
- tmp_p = (char **)OPENSSL_realloc(arg->data,
- sizeof(char *)*tlen);
- if (tmp_p == NULL)
- return 0;
- arg->data = tmp_p;
- arg->count = tlen;
- /* initialize newly allocated data */
- for (i = num; i < arg->count; i++)
- arg->data[i] = NULL;
- }
- arg->data[num++]=p;
-
- /* now look for the end of this */
- if ((*p == '\'') || (*p == '\"')) /* scan for closing quote */
- {
- i= *(p++);
- arg->data[num-1]++; /* jump over quote */
- while (*p && (*p != i))
- p++;
- *p='\0';
- }
- else
- {
- while (*p && ((*p != ' ') &&
- (*p != '\t') && (*p != '\n')))
- p++;
-
- if (*p == '\0')
- p--;
- else
- *p='\0';
- }
- p++;
- }
- *argc=num;
- *argv=arg->data;
- return(1);
- }
+{
+ int num, i;
+ char *p;
+
+ *argc = 0;
+ *argv = NULL;
+
+ i = 0;
+ if (arg->count == 0) {
+ arg->count = 20;
+ arg->data = (char **)OPENSSL_malloc(sizeof(char *) * arg->count);
+ if (arg->data == NULL)
+ return 0;
+ }
+ for (i = 0; i < arg->count; i++)
+ arg->data[i] = NULL;
+
+ num = 0;
+ p = buf;
+ for (;;) {
+ /* first scan over white space */
+ if (!*p)
+ break;
+ while (*p && ((*p == ' ') || (*p == '\t') || (*p == '\n')))
+ p++;
+ if (!*p)
+ break;
+
+ /* The start of something good :-) */
+ if (num >= arg->count) {
+ char **tmp_p;
+ int tlen = arg->count + 20;
+ tmp_p = (char **)OPENSSL_realloc(arg->data,
+ sizeof(char *) * tlen);
+ if (tmp_p == NULL)
+ return 0;
+ arg->data = tmp_p;
+ arg->count = tlen;
+ /* initialize newly allocated data */
+ for (i = num; i < arg->count; i++)
+ arg->data[i] = NULL;
+ }
+ arg->data[num++] = p;
+
+ /* now look for the end of this */
+ if ((*p == '\'') || (*p == '\"')) { /* scan for closing quote */
+ i = *(p++);
+ arg->data[num - 1]++; /* jump over quote */
+ while (*p && (*p != i))
+ p++;
+ *p = '\0';
+ } else {
+ while (*p && ((*p != ' ') && (*p != '\t') && (*p != '\n')))
+ p++;
+
+ if (*p == '\0')
+ p--;
+ else
+ *p = '\0';
+ }
+ p++;
+ }
+ *argc = num;
+ *argv = arg->data;
+ return (1);
+}
#ifndef APP_INIT
int app_init(long mesgwin)
- {
- return(1);
- }
+{
+ return (1);
+}
#endif
-
-int dump_cert_text (BIO *out, X509 *x)
+int dump_cert_text(BIO *out, X509 *x)
{
- char *p;
+ char *p;
- p=X509_NAME_oneline(X509_get_subject_name(x),NULL,0);
- BIO_puts(out,"subject=");
- BIO_puts(out,p);
- OPENSSL_free(p);
+ p = X509_NAME_oneline(X509_get_subject_name(x), NULL, 0);
+ BIO_puts(out, "subject=");
+ BIO_puts(out, p);
+ OPENSSL_free(p);
- p=X509_NAME_oneline(X509_get_issuer_name(x),NULL,0);
- BIO_puts(out,"\nissuer=");
- BIO_puts(out,p);
- BIO_puts(out,"\n");
- OPENSSL_free(p);
+ p = X509_NAME_oneline(X509_get_issuer_name(x), NULL, 0);
+ BIO_puts(out, "\nissuer=");
+ BIO_puts(out, p);
+ BIO_puts(out, "\n");
+ OPENSSL_free(p);
- return 0;
+ return 0;
}
static int ui_open(UI *ui)
- {
- return UI_method_get_opener(UI_OpenSSL())(ui);
- }
+{
+ return UI_method_get_opener(UI_OpenSSL())(ui);
+}
+
static int ui_read(UI *ui, UI_STRING *uis)
- {
- if (UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD
- && UI_get0_user_data(ui))
- {
- switch(UI_get_string_type(uis))
- {
- case UIT_PROMPT:
- case UIT_VERIFY:
- {
- const char *password =
- ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
- if (password && password[0] != '\0')
- {
- UI_set_result(ui, uis, password);
- return 1;
- }
- }
- default:
- break;
- }
- }
- return UI_method_get_reader(UI_OpenSSL())(ui, uis);
- }
+{
+ if (UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD
+ && UI_get0_user_data(ui)) {
+ switch (UI_get_string_type(uis)) {
+ case UIT_PROMPT:
+ case UIT_VERIFY:
+ {
+ const char *password =
+ ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
+ if (password && password[0] != '\0') {
+ UI_set_result(ui, uis, password);
+ return 1;
+ }
+ }
+ default:
+ break;
+ }
+ }
+ return UI_method_get_reader(UI_OpenSSL())(ui, uis);
+}
+
static int ui_write(UI *ui, UI_STRING *uis)
- {
- if (UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD
- && UI_get0_user_data(ui))
- {
- switch(UI_get_string_type(uis))
- {
- case UIT_PROMPT:
- case UIT_VERIFY:
- {
- const char *password =
- ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
- if (password && password[0] != '\0')
- return 1;
- }
- default:
- break;
- }
- }
- return UI_method_get_writer(UI_OpenSSL())(ui, uis);
- }
+{
+ if (UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD
+ && UI_get0_user_data(ui)) {
+ switch (UI_get_string_type(uis)) {
+ case UIT_PROMPT:
+ case UIT_VERIFY:
+ {
+ const char *password =
+ ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
+ if (password && password[0] != '\0')
+ return 1;
+ }
+ default:
+ break;
+ }
+ }
+ return UI_method_get_writer(UI_OpenSSL())(ui, uis);
+}
+
static int ui_close(UI *ui)
- {
- return UI_method_get_closer(UI_OpenSSL())(ui);
- }
+{
+ return UI_method_get_closer(UI_OpenSSL())(ui);
+}
+
int setup_ui_method(void)
- {
- ui_method = UI_create_method("OpenSSL application user interface");
- UI_method_set_opener(ui_method, ui_open);
- UI_method_set_reader(ui_method, ui_read);
- UI_method_set_writer(ui_method, ui_write);
- UI_method_set_closer(ui_method, ui_close);
- return 0;
- }
+{
+ ui_method = UI_create_method("OpenSSL application user interface");
+ UI_method_set_opener(ui_method, ui_open);
+ UI_method_set_reader(ui_method, ui_read);
+ UI_method_set_writer(ui_method, ui_write);
+ UI_method_set_closer(ui_method, ui_close);
+ return 0;
+}
+
void destroy_ui_method(void)
- {
- if(ui_method)
- {
- UI_destroy_method(ui_method);
- ui_method = NULL;
- }
- }
-int password_callback(char *buf, int bufsiz, int verify,
- PW_CB_DATA *cb_tmp)
- {
- UI *ui = NULL;
- int res = 0;
- const char *prompt_info = NULL;
- const char *password = NULL;
- PW_CB_DATA *cb_data = (PW_CB_DATA *)cb_tmp;
-
- if (cb_data)
- {
- if (cb_data->password)
- password = cb_data->password;
- if (cb_data->prompt_info)
- prompt_info = cb_data->prompt_info;
- }
-
- if (password)
- {
- res = strlen(password);
- if (res > bufsiz)
- res = bufsiz;
- memcpy(buf, password, res);
- return res;
- }
-
- ui = UI_new_method(ui_method);
- if (ui)
- {
- int ok = 0;
- char *buff = NULL;
- int ui_flags = 0;
- char *prompt = NULL;
-
- prompt = UI_construct_prompt(ui, "pass phrase",
- prompt_info);
-
- ui_flags |= UI_INPUT_FLAG_DEFAULT_PWD;
- UI_ctrl(ui, UI_CTRL_PRINT_ERRORS, 1, 0, 0);
-
- if (ok >= 0)
- ok = UI_add_input_string(ui,prompt,ui_flags,buf,
- PW_MIN_LENGTH,bufsiz-1);
- if (ok >= 0 && verify)
- {
- buff = (char *)OPENSSL_malloc(bufsiz);
- ok = UI_add_verify_string(ui,prompt,ui_flags,buff,
- PW_MIN_LENGTH,bufsiz-1, buf);
- }
- if (ok >= 0)
- do
- {
- ok = UI_process(ui);
- }
- while (ok < 0 && UI_ctrl(ui, UI_CTRL_IS_REDOABLE, 0, 0, 0));
-
- if (buff)
- {
- OPENSSL_cleanse(buff,(unsigned int)bufsiz);
- OPENSSL_free(buff);
- }
-
- if (ok >= 0)
- res = strlen(buf);
- if (ok == -1)
- {
- BIO_printf(bio_err, "User interface error\n");
- ERR_print_errors(bio_err);
- OPENSSL_cleanse(buf,(unsigned int)bufsiz);
- res = 0;
- }
- if (ok == -2)
- {
- BIO_printf(bio_err,"aborted!\n");
- OPENSSL_cleanse(buf,(unsigned int)bufsiz);
- res = 0;
- }
- UI_free(ui);
- OPENSSL_free(prompt);
- }
- return res;
- }
+{
+ if (ui_method) {
+ UI_destroy_method(ui_method);
+ ui_method = NULL;
+ }
+}
+
+int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_tmp)
+{
+ UI *ui = NULL;
+ int res = 0;
+ const char *prompt_info = NULL;
+ const char *password = NULL;
+ PW_CB_DATA *cb_data = (PW_CB_DATA *)cb_tmp;
+
+ if (cb_data) {
+ if (cb_data->password)
+ password = cb_data->password;
+ if (cb_data->prompt_info)
+ prompt_info = cb_data->prompt_info;
+ }
+
+ if (password) {
+ res = strlen(password);
+ if (res > bufsiz)
+ res = bufsiz;
+ memcpy(buf, password, res);
+ return res;
+ }
+
+ ui = UI_new_method(ui_method);
+ if (ui) {
+ int ok = 0;
+ char *buff = NULL;
+ int ui_flags = 0;
+ char *prompt = NULL;
+
+ prompt = UI_construct_prompt(ui, "pass phrase", prompt_info);
+ if(!prompt) {
+ BIO_printf(bio_err, "Out of memory\n");
+ UI_free(ui);
+ return 0;
+ }
+
+ ui_flags |= UI_INPUT_FLAG_DEFAULT_PWD;
+ UI_ctrl(ui, UI_CTRL_PRINT_ERRORS, 1, 0, 0);
+
+ if (ok >= 0)
+ ok = UI_add_input_string(ui, prompt, ui_flags, buf,
+ PW_MIN_LENGTH, bufsiz - 1);
+ if (ok >= 0 && verify) {
+ buff = (char *)OPENSSL_malloc(bufsiz);
+ if(!buff) {
+ BIO_printf(bio_err, "Out of memory\n");
+ UI_free(ui);
+ OPENSSL_free(prompt);
+ return 0;
+ }
+ ok = UI_add_verify_string(ui, prompt, ui_flags, buff,
+ PW_MIN_LENGTH, bufsiz - 1, buf);
+ }
+ if (ok >= 0)
+ do {
+ ok = UI_process(ui);
+ }
+ while (ok < 0 && UI_ctrl(ui, UI_CTRL_IS_REDOABLE, 0, 0, 0));
+
+ if (buff) {
+ OPENSSL_cleanse(buff, (unsigned int)bufsiz);
+ OPENSSL_free(buff);
+ }
+
+ if (ok >= 0)
+ res = strlen(buf);
+ if (ok == -1) {
+ BIO_printf(bio_err, "User interface error\n");
+ ERR_print_errors(bio_err);
+ OPENSSL_cleanse(buf, (unsigned int)bufsiz);
+ res = 0;
+ }
+ if (ok == -2) {
+ BIO_printf(bio_err, "aborted!\n");
+ OPENSSL_cleanse(buf, (unsigned int)bufsiz);
+ res = 0;
+ }
+ UI_free(ui);
+ OPENSSL_free(prompt);
+ }
+ return res;
+}
static char *app_get_pass(BIO *err, char *arg, int keepbio);
int app_passwd(BIO *err, char *arg1, char *arg2, char **pass1, char **pass2)
{
- int same;
- if(!arg2 || !arg1 || strcmp(arg1, arg2)) same = 0;
- else same = 1;
- if(arg1) {
- *pass1 = app_get_pass(err, arg1, same);
- if(!*pass1) return 0;
- } else if(pass1) *pass1 = NULL;
- if(arg2) {
- *pass2 = app_get_pass(err, arg2, same ? 2 : 0);
- if(!*pass2) return 0;
- } else if(pass2) *pass2 = NULL;
- return 1;
+ int same;
+ if (!arg2 || !arg1 || strcmp(arg1, arg2))
+ same = 0;
+ else
+ same = 1;
+ if (arg1) {
+ *pass1 = app_get_pass(err, arg1, same);
+ if (!*pass1)
+ return 0;
+ } else if (pass1)
+ *pass1 = NULL;
+ if (arg2) {
+ *pass2 = app_get_pass(err, arg2, same ? 2 : 0);
+ if (!*pass2)
+ return 0;
+ } else if (pass2)
+ *pass2 = NULL;
+ return 1;
}
static char *app_get_pass(BIO *err, char *arg, int keepbio)
{
- char *tmp, tpass[APP_PASS_LEN];
- static BIO *pwdbio = NULL;
- int i;
- if(!strncmp(arg, "pass:", 5)) return BUF_strdup(arg + 5);
- if(!strncmp(arg, "env:", 4)) {
- tmp = getenv(arg + 4);
- if(!tmp) {
- BIO_printf(err, "Can't read environment variable %s\n", arg + 4);
- return NULL;
- }
- return BUF_strdup(tmp);
- }
- if(!keepbio || !pwdbio) {
- if(!strncmp(arg, "file:", 5)) {
- pwdbio = BIO_new_file(arg + 5, "r");
- if(!pwdbio) {
- BIO_printf(err, "Can't open file %s\n", arg + 5);
- return NULL;
- }
+ char *tmp, tpass[APP_PASS_LEN];
+ static BIO *pwdbio = NULL;
+ int i;
+ if (!strncmp(arg, "pass:", 5))
+ return BUF_strdup(arg + 5);
+ if (!strncmp(arg, "env:", 4)) {
+ tmp = getenv(arg + 4);
+ if (!tmp) {
+ BIO_printf(err, "Can't read environment variable %s\n", arg + 4);
+ return NULL;
+ }
+ return BUF_strdup(tmp);
+ }
+ if (!keepbio || !pwdbio) {
+ if (!strncmp(arg, "file:", 5)) {
+ pwdbio = BIO_new_file(arg + 5, "r");
+ if (!pwdbio) {
+ BIO_printf(err, "Can't open file %s\n", arg + 5);
+ return NULL;
+ }
#if !defined(_WIN32)
- /*
- * Under _WIN32, which covers even Win64 and CE, file
- * descriptors referenced by BIO_s_fd are not inherited
- * by child process and therefore below is not an option.
- * It could have been an option if bss_fd.c was operating
- * on real Windows descriptors, such as those obtained
- * with CreateFile.
- */
- } else if(!strncmp(arg, "fd:", 3)) {
- BIO *btmp;
- i = atoi(arg + 3);
- if(i >= 0) pwdbio = BIO_new_fd(i, BIO_NOCLOSE);
- if((i < 0) || !pwdbio) {
- BIO_printf(err, "Can't access file descriptor %s\n", arg + 3);
- return NULL;
- }
- /* Can't do BIO_gets on an fd BIO so add a buffering BIO */
- btmp = BIO_new(BIO_f_buffer());
- pwdbio = BIO_push(btmp, pwdbio);
-#endif
- } else if(!strcmp(arg, "stdin")) {
- pwdbio = BIO_new_fp(stdin, BIO_NOCLOSE);
- if(!pwdbio) {
- BIO_printf(err, "Can't open BIO for stdin\n");
- return NULL;
- }
- } else {
- BIO_printf(err, "Invalid password argument \"%s\"\n", arg);
- return NULL;
- }
- }
- i = BIO_gets(pwdbio, tpass, APP_PASS_LEN);
- if(keepbio != 1) {
- BIO_free_all(pwdbio);
- pwdbio = NULL;
- }
- if(i <= 0) {
- BIO_printf(err, "Error reading password from BIO\n");
- return NULL;
- }
- tmp = strchr(tpass, '\n');
- if(tmp) *tmp = 0;
- return BUF_strdup(tpass);
+ /*
+ * Under _WIN32, which covers even Win64 and CE, file
+ * descriptors referenced by BIO_s_fd are not inherited
+ * by child process and therefore below is not an option.
+ * It could have been an option if bss_fd.c was operating
+ * on real Windows descriptors, such as those obtained
+ * with CreateFile.
+ */
+ } else if (!strncmp(arg, "fd:", 3)) {
+ BIO *btmp;
+ i = atoi(arg + 3);
+ if (i >= 0)
+ pwdbio = BIO_new_fd(i, BIO_NOCLOSE);
+ if ((i < 0) || !pwdbio) {
+ BIO_printf(err, "Can't access file descriptor %s\n", arg + 3);
+ return NULL;
+ }
+ /*
+ * Can't do BIO_gets on an fd BIO so add a buffering BIO
+ */
+ btmp = BIO_new(BIO_f_buffer());
+ pwdbio = BIO_push(btmp, pwdbio);
+#endif
+ } else if (!strcmp(arg, "stdin")) {
+ pwdbio = BIO_new_fp(stdin, BIO_NOCLOSE);
+ if (!pwdbio) {
+ BIO_printf(err, "Can't open BIO for stdin\n");
+ return NULL;
+ }
+ } else {
+ BIO_printf(err, "Invalid password argument \"%s\"\n", arg);
+ return NULL;
+ }
+ }
+ i = BIO_gets(pwdbio, tpass, APP_PASS_LEN);
+ if (keepbio != 1) {
+ BIO_free_all(pwdbio);
+ pwdbio = NULL;
+ }
+ if (i <= 0) {
+ BIO_printf(err, "Error reading password from BIO\n");
+ return NULL;
+ }
+ tmp = strchr(tpass, '\n');
+ if (tmp)
+ *tmp = 0;
+ return BUF_strdup(tpass);
}
int add_oid_section(BIO *err, CONF *conf)
-{
- char *p;
- STACK_OF(CONF_VALUE) *sktmp;
- CONF_VALUE *cnf;
- int i;
- if(!(p=NCONF_get_string(conf,NULL,"oid_section")))
- {
- ERR_clear_error();
- return 1;
- }
- if(!(sktmp = NCONF_get_section(conf, p))) {
- BIO_printf(err, "problem loading oid section %s\n", p);
- return 0;
- }
- for(i = 0; i < sk_CONF_VALUE_num(sktmp); i++) {
- cnf = sk_CONF_VALUE_value(sktmp, i);
- if(OBJ_create(cnf->value, cnf->name, cnf->name) == NID_undef) {
- BIO_printf(err, "problem creating object %s=%s\n",
- cnf->name, cnf->value);
- return 0;
- }
- }
- return 1;
+{
+ char *p;
+ STACK_OF(CONF_VALUE) *sktmp;
+ CONF_VALUE *cnf;
+ int i;
+ if (!(p = NCONF_get_string(conf, NULL, "oid_section"))) {
+ ERR_clear_error();
+ return 1;
+ }
+ if (!(sktmp = NCONF_get_section(conf, p))) {
+ BIO_printf(err, "problem loading oid section %s\n", p);
+ return 0;
+ }
+ for (i = 0; i < sk_CONF_VALUE_num(sktmp); i++) {
+ cnf = sk_CONF_VALUE_value(sktmp, i);
+ if (OBJ_create(cnf->value, cnf->name, cnf->name) == NID_undef) {
+ BIO_printf(err, "problem creating object %s=%s\n",
+ cnf->name, cnf->value);
+ return 0;
+ }
+ }
+ return 1;
}
static int load_pkcs12(BIO *err, BIO *in, const char *desc,
- pem_password_cb *pem_cb, void *cb_data,
- EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
- {
- const char *pass;
- char tpass[PEM_BUFSIZE];
- int len, ret = 0;
- PKCS12 *p12;
- p12 = d2i_PKCS12_bio(in, NULL);
- if (p12 == NULL)
- {
- BIO_printf(err, "Error loading PKCS12 file for %s\n", desc);
- goto die;
- }
- /* See if an empty password will do */
- if (PKCS12_verify_mac(p12, "", 0) || PKCS12_verify_mac(p12, NULL, 0))
- pass = "";
- else
- {
- if (!pem_cb)
- pem_cb = (pem_password_cb *)password_callback;
- len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data);
- if (len < 0)
- {
- BIO_printf(err, "Passpharse callback error for %s\n",
- desc);
- goto die;
- }
- if (len < PEM_BUFSIZE)
- tpass[len] = 0;
- if (!PKCS12_verify_mac(p12, tpass, len))
- {
- BIO_printf(err,
- "Mac verify error (wrong password?) in PKCS12 file for %s\n", desc);
- goto die;
- }
- pass = tpass;
- }
- ret = PKCS12_parse(p12, pass, pkey, cert, ca);
- die:
- if (p12)
- PKCS12_free(p12);
- return ret;
- }
+ pem_password_cb *pem_cb, void *cb_data,
+ EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
+{
+ const char *pass;
+ char tpass[PEM_BUFSIZE];
+ int len, ret = 0;
+ PKCS12 *p12;
+ p12 = d2i_PKCS12_bio(in, NULL);
+ if (p12 == NULL) {
+ BIO_printf(err, "Error loading PKCS12 file for %s\n", desc);
+ goto die;
+ }
+ /* See if an empty password will do */
+ if (PKCS12_verify_mac(p12, "", 0) || PKCS12_verify_mac(p12, NULL, 0))
+ pass = "";
+ else {
+ if (!pem_cb)
+ pem_cb = (pem_password_cb *)password_callback;
+ len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data);
+ if (len < 0) {
+ BIO_printf(err, "Passpharse callback error for %s\n", desc);
+ goto die;
+ }
+ if (len < PEM_BUFSIZE)
+ tpass[len] = 0;
+ if (!PKCS12_verify_mac(p12, tpass, len)) {
+ BIO_printf(err,
+ "Mac verify error (wrong password?) in PKCS12 file for %s\n",
+ desc);
+ goto die;
+ }
+ pass = tpass;
+ }
+ ret = PKCS12_parse(p12, pass, pkey, cert, ca);
+ die:
+ if (p12)
+ PKCS12_free(p12);
+ return ret;
+}
X509 *load_cert(BIO *err, const char *file, int format,
- const char *pass, ENGINE *e, const char *cert_descrip)
- {
- X509 *x=NULL;
- BIO *cert;
-
- if ((cert=BIO_new(BIO_s_file())) == NULL)
- {
- ERR_print_errors(err);
- goto end;
- }
-
- if (file == NULL)
- {
+ const char *pass, ENGINE *e, const char *cert_descrip)
+{
+ X509 *x = NULL;
+ BIO *cert;
+
+ if ((cert = BIO_new(BIO_s_file())) == NULL) {
+ ERR_print_errors(err);
+ goto end;
+ }
+
+ if (file == NULL) {
#ifdef _IONBF
# ifndef OPENSSL_NO_SETVBUF_IONBF
- setvbuf(stdin, NULL, _IONBF, 0);
-# endif /* ndef OPENSSL_NO_SETVBUF_IONBF */
-#endif
- BIO_set_fp(cert,stdin,BIO_NOCLOSE);
- }
- else
- {
- if (BIO_read_filename(cert,file) <= 0)
- {
- BIO_printf(err, "Error opening %s %s\n",
- cert_descrip, file);
- ERR_print_errors(err);
- goto end;
- }
- }
-
- if (format == FORMAT_ASN1)
- x=d2i_X509_bio(cert,NULL);
- else if (format == FORMAT_NETSCAPE)
- {
- NETSCAPE_X509 *nx;
- nx=ASN1_item_d2i_bio(ASN1_ITEM_rptr(NETSCAPE_X509),cert,NULL);
- if (nx == NULL)
- goto end;
-
- if ((strncmp(NETSCAPE_CERT_HDR,(char *)nx->header->data,
- nx->header->length) != 0))
- {
- NETSCAPE_X509_free(nx);
- BIO_printf(err,"Error reading header on certificate\n");
- goto end;
- }
- x=nx->cert;
- nx->cert = NULL;
- NETSCAPE_X509_free(nx);
- }
- else if (format == FORMAT_PEM)
- x=PEM_read_bio_X509_AUX(cert,NULL,
- (pem_password_cb *)password_callback, NULL);
- else if (format == FORMAT_PKCS12)
- {
- if (!load_pkcs12(err, cert,cert_descrip, NULL, NULL,
- NULL, &x, NULL))
- goto end;
- }
- else {
- BIO_printf(err,"bad input format specified for %s\n",
- cert_descrip);
- goto end;
- }
-end:
- if (x == NULL)
- {
- BIO_printf(err,"unable to load certificate\n");
- ERR_print_errors(err);
- }
- if (cert != NULL) BIO_free(cert);
- return(x);
- }
+ setvbuf(stdin, NULL, _IONBF, 0);
+# endif /* ndef OPENSSL_NO_SETVBUF_IONBF */
+#endif
+ BIO_set_fp(cert, stdin, BIO_NOCLOSE);
+ } else {
+ if (BIO_read_filename(cert, file) <= 0) {
+ BIO_printf(err, "Error opening %s %s\n", cert_descrip, file);
+ ERR_print_errors(err);
+ goto end;
+ }
+ }
+
+ if (format == FORMAT_ASN1)
+ x = d2i_X509_bio(cert, NULL);
+ else if (format == FORMAT_NETSCAPE) {
+ NETSCAPE_X509 *nx;
+ nx = ASN1_item_d2i_bio(ASN1_ITEM_rptr(NETSCAPE_X509), cert, NULL);
+ if (nx == NULL)
+ goto end;
+
+ if ((strncmp(NETSCAPE_CERT_HDR, (char *)nx->header->data,
+ nx->header->length) != 0)) {
+ NETSCAPE_X509_free(nx);
+ BIO_printf(err, "Error reading header on certificate\n");
+ goto end;
+ }
+ x = nx->cert;
+ nx->cert = NULL;
+ NETSCAPE_X509_free(nx);
+ } else if (format == FORMAT_PEM)
+ x = PEM_read_bio_X509_AUX(cert, NULL,
+ (pem_password_cb *)password_callback, NULL);
+ else if (format == FORMAT_PKCS12) {
+ if (!load_pkcs12(err, cert, cert_descrip, NULL, NULL, NULL, &x, NULL))
+ goto end;
+ } else {
+ BIO_printf(err, "bad input format specified for %s\n", cert_descrip);
+ goto end;
+ }
+ end:
+ if (x == NULL) {
+ BIO_printf(err, "unable to load certificate\n");
+ ERR_print_errors(err);
+ }
+ if (cert != NULL)
+ BIO_free(cert);
+ return (x);
+}
EVP_PKEY *load_key(BIO *err, const char *file, int format, int maybe_stdin,
- const char *pass, ENGINE *e, const char *key_descrip)
- {
- BIO *key=NULL;
- EVP_PKEY *pkey=NULL;
- PW_CB_DATA cb_data;
-
- cb_data.password = pass;
- cb_data.prompt_info = file;
-
- if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE))
- {
- BIO_printf(err,"no keyfile specified\n");
- goto end;
- }
+ const char *pass, ENGINE *e, const char *key_descrip)
+{
+ BIO *key = NULL;
+ EVP_PKEY *pkey = NULL;
+ PW_CB_DATA cb_data;
+
+ cb_data.password = pass;
+ cb_data.prompt_info = file;
+
+ if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE)) {
+ BIO_printf(err, "no keyfile specified\n");
+ goto end;
+ }
#ifndef OPENSSL_NO_ENGINE
- if (format == FORMAT_ENGINE)
- {
- if (!e)
- BIO_printf(err,"no engine specified\n");
- else
- {
- pkey = ENGINE_load_private_key(e, file,
- ui_method, &cb_data);
- if (!pkey)
- {
- BIO_printf(err,"cannot load %s from engine\n",key_descrip);
- ERR_print_errors(err);
- }
- }
- goto end;
- }
-#endif
- key=BIO_new(BIO_s_file());
- if (key == NULL)
- {
- ERR_print_errors(err);
- goto end;
- }
- if (file == NULL && maybe_stdin)
- {
+ if (format == FORMAT_ENGINE) {
+ if (!e)
+ BIO_printf(err, "no engine specified\n");
+ else {
+ pkey = ENGINE_load_private_key(e, file, ui_method, &cb_data);
+ if (!pkey) {
+ BIO_printf(err, "cannot load %s from engine\n", key_descrip);
+ ERR_print_errors(err);
+ }
+ }
+ goto end;
+ }
+#endif
+ key = BIO_new(BIO_s_file());
+ if (key == NULL) {
+ ERR_print_errors(err);
+ goto end;
+ }
+ if (file == NULL && maybe_stdin) {
#ifdef _IONBF
# ifndef OPENSSL_NO_SETVBUF_IONBF
- setvbuf(stdin, NULL, _IONBF, 0);
-# endif /* ndef OPENSSL_NO_SETVBUF_IONBF */
-#endif
- BIO_set_fp(key,stdin,BIO_NOCLOSE);
- }
- else
- if (BIO_read_filename(key,file) <= 0)
- {
- BIO_printf(err, "Error opening %s %s\n",
- key_descrip, file);
- ERR_print_errors(err);
- goto end;
- }
- if (format == FORMAT_ASN1)
- {
- pkey=d2i_PrivateKey_bio(key, NULL);
- }
- else if (format == FORMAT_PEM)
- {
- pkey=PEM_read_bio_PrivateKey(key,NULL,
- (pem_password_cb *)password_callback, &cb_data);
- }
+ setvbuf(stdin, NULL, _IONBF, 0);
+# endif /* ndef OPENSSL_NO_SETVBUF_IONBF */
+#endif
+ BIO_set_fp(key, stdin, BIO_NOCLOSE);
+ } else if (BIO_read_filename(key, file) <= 0) {
+ BIO_printf(err, "Error opening %s %s\n", key_descrip, file);
+ ERR_print_errors(err);
+ goto end;
+ }
+ if (format == FORMAT_ASN1) {
+ pkey = d2i_PrivateKey_bio(key, NULL);
+ } else if (format == FORMAT_PEM) {
+ pkey = PEM_read_bio_PrivateKey(key, NULL,
+ (pem_password_cb *)password_callback,
+ &cb_data);
+ }
#if !defined(OPENSSL_NO_RC4) && !defined(OPENSSL_NO_RSA)
- else if (format == FORMAT_NETSCAPE || format == FORMAT_IISSGC)
- pkey = load_netscape_key(err, key, file, key_descrip, format);
-#endif
- else if (format == FORMAT_PKCS12)
- {
- if (!load_pkcs12(err, key, key_descrip,
- (pem_password_cb *)password_callback, &cb_data,
- &pkey, NULL, NULL))
- goto end;
- }
+ else if (format == FORMAT_NETSCAPE || format == FORMAT_IISSGC)
+ pkey = load_netscape_key(err, key, file, key_descrip, format);
+#endif
+ else if (format == FORMAT_PKCS12) {
+ if (!load_pkcs12(err, key, key_descrip,
+ (pem_password_cb *)password_callback, &cb_data,
+ &pkey, NULL, NULL))
+ goto end;
+ }
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DSA) && !defined (OPENSSL_NO_RC4)
- else if (format == FORMAT_MSBLOB)
- pkey = b2i_PrivateKey_bio(key);
- else if (format == FORMAT_PVK)
- pkey = b2i_PVK_bio(key, (pem_password_cb *)password_callback,
- &cb_data);
-#endif
- else
- {
- BIO_printf(err,"bad input format specified for key file\n");
- goto end;
- }
+ else if (format == FORMAT_MSBLOB)
+ pkey = b2i_PrivateKey_bio(key);
+ else if (format == FORMAT_PVK)
+ pkey = b2i_PVK_bio(key, (pem_password_cb *)password_callback,
+ &cb_data);
+#endif
+ else {
+ BIO_printf(err, "bad input format specified for key file\n");
+ goto end;
+ }
end:
- if (key != NULL) BIO_free(key);
- if (pkey == NULL)
- {
- BIO_printf(err,"unable to load %s\n", key_descrip);
- ERR_print_errors(err);
- }
- return(pkey);
- }
+ if (key != NULL)
+ BIO_free(key);
+ if (pkey == NULL) {
+ BIO_printf(err, "unable to load %s\n", key_descrip);
+ ERR_print_errors(err);
+ }
+ return (pkey);
+}
EVP_PKEY *load_pubkey(BIO *err, const char *file, int format, int maybe_stdin,
- const char *pass, ENGINE *e, const char *key_descrip)
- {
- BIO *key=NULL;
- EVP_PKEY *pkey=NULL;
- PW_CB_DATA cb_data;
-
- cb_data.password = pass;
- cb_data.prompt_info = file;
-
- if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE))
- {
- BIO_printf(err,"no keyfile specified\n");
- goto end;
- }
+ const char *pass, ENGINE *e, const char *key_descrip)
+{
+ BIO *key = NULL;
+ EVP_PKEY *pkey = NULL;
+ PW_CB_DATA cb_data;
+
+ cb_data.password = pass;
+ cb_data.prompt_info = file;
+
+ if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE)) {
+ BIO_printf(err, "no keyfile specified\n");
+ goto end;
+ }
#ifndef OPENSSL_NO_ENGINE
- if (format == FORMAT_ENGINE)
- {
- if (!e)
- BIO_printf(bio_err,"no engine specified\n");
- else
- pkey = ENGINE_load_public_key(e, file,
- ui_method, &cb_data);
- goto end;
- }
-#endif
- key=BIO_new(BIO_s_file());
- if (key == NULL)
- {
- ERR_print_errors(err);
- goto end;
- }
- if (file == NULL && maybe_stdin)
- {
+ if (format == FORMAT_ENGINE) {
+ if (!e)
+ BIO_printf(bio_err, "no engine specified\n");
+ else
+ pkey = ENGINE_load_public_key(e, file, ui_method, &cb_data);
+ goto end;
+ }
+#endif
+ key = BIO_new(BIO_s_file());
+ if (key == NULL) {
+ ERR_print_errors(err);
+ goto end;
+ }
+ if (file == NULL && maybe_stdin) {
#ifdef _IONBF
# ifndef OPENSSL_NO_SETVBUF_IONBF
- setvbuf(stdin, NULL, _IONBF, 0);
-# endif /* ndef OPENSSL_NO_SETVBUF_IONBF */
-#endif
- BIO_set_fp(key,stdin,BIO_NOCLOSE);
- }
- else
- if (BIO_read_filename(key,file) <= 0)
- {
- BIO_printf(err, "Error opening %s %s\n",
- key_descrip, file);
- ERR_print_errors(err);
- goto end;
- }
- if (format == FORMAT_ASN1)
- {
- pkey=d2i_PUBKEY_bio(key, NULL);
- }
+ setvbuf(stdin, NULL, _IONBF, 0);
+# endif /* ndef OPENSSL_NO_SETVBUF_IONBF */
+#endif
+ BIO_set_fp(key, stdin, BIO_NOCLOSE);
+ } else if (BIO_read_filename(key, file) <= 0) {
+ BIO_printf(err, "Error opening %s %s\n", key_descrip, file);
+ ERR_print_errors(err);
+ goto end;
+ }
+ if (format == FORMAT_ASN1) {
+ pkey = d2i_PUBKEY_bio(key, NULL);
+ }
#ifndef OPENSSL_NO_RSA
- else if (format == FORMAT_ASN1RSA)
- {
- RSA *rsa;
- rsa = d2i_RSAPublicKey_bio(key, NULL);
- if (rsa)
- {
- pkey = EVP_PKEY_new();
- if (pkey)
- EVP_PKEY_set1_RSA(pkey, rsa);
- RSA_free(rsa);
- }
- else
- pkey = NULL;
- }
- else if (format == FORMAT_PEMRSA)
- {
- RSA *rsa;
- rsa = PEM_read_bio_RSAPublicKey(key, NULL,
- (pem_password_cb *)password_callback, &cb_data);
- if (rsa)
- {
- pkey = EVP_PKEY_new();
- if (pkey)
- EVP_PKEY_set1_RSA(pkey, rsa);
- RSA_free(rsa);
- }
- else
- pkey = NULL;
- }
-#endif
- else if (format == FORMAT_PEM)
- {
- pkey=PEM_read_bio_PUBKEY(key,NULL,
- (pem_password_cb *)password_callback, &cb_data);
- }
+ else if (format == FORMAT_ASN1RSA) {
+ RSA *rsa;
+ rsa = d2i_RSAPublicKey_bio(key, NULL);
+ if (rsa) {
+ pkey = EVP_PKEY_new();
+ if (pkey)
+ EVP_PKEY_set1_RSA(pkey, rsa);
+ RSA_free(rsa);
+ } else
+ pkey = NULL;
+ } else if (format == FORMAT_PEMRSA) {
+ RSA *rsa;
+ rsa = PEM_read_bio_RSAPublicKey(key, NULL,
+ (pem_password_cb *)password_callback,
+ &cb_data);
+ if (rsa) {
+ pkey = EVP_PKEY_new();
+ if (pkey)
+ EVP_PKEY_set1_RSA(pkey, rsa);
+ RSA_free(rsa);
+ } else
+ pkey = NULL;
+ }
+#endif
+ else if (format == FORMAT_PEM) {
+ pkey = PEM_read_bio_PUBKEY(key, NULL,
+ (pem_password_cb *)password_callback,
+ &cb_data);
+ }
#if !defined(OPENSSL_NO_RC4) && !defined(OPENSSL_NO_RSA)
- else if (format == FORMAT_NETSCAPE || format == FORMAT_IISSGC)
- pkey = load_netscape_key(err, key, file, key_descrip, format);
+ else if (format == FORMAT_NETSCAPE || format == FORMAT_IISSGC)
+ pkey = load_netscape_key(err, key, file, key_descrip, format);
#endif
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DSA)
- else if (format == FORMAT_MSBLOB)
- pkey = b2i_PublicKey_bio(key);
+ else if (format == FORMAT_MSBLOB)
+ pkey = b2i_PublicKey_bio(key);
#endif
- else
- {
- BIO_printf(err,"bad input format specified for key file\n");
- goto end;
- }
+ else {
+ BIO_printf(err, "bad input format specified for key file\n");
+ goto end;
+ }
end:
- if (key != NULL) BIO_free(key);
- if (pkey == NULL)
- BIO_printf(err,"unable to load %s\n", key_descrip);
- return(pkey);
- }
+ if (key != NULL)
+ BIO_free(key);
+ if (pkey == NULL)
+ BIO_printf(err, "unable to load %s\n", key_descrip);
+ return (pkey);
+}
#if !defined(OPENSSL_NO_RC4) && !defined(OPENSSL_NO_RSA)
-static EVP_PKEY *
-load_netscape_key(BIO *err, BIO *key, const char *file,
- const char *key_descrip, int format)
- {
- EVP_PKEY *pkey;
- BUF_MEM *buf;
- RSA *rsa;
- const unsigned char *p;
- int size, i;
-
- buf=BUF_MEM_new();
- pkey = EVP_PKEY_new();
- size = 0;
- if (buf == NULL || pkey == NULL)
- goto error;
- for (;;)
- {
- if (!BUF_MEM_grow_clean(buf,size+1024*10))
- goto error;
- i = BIO_read(key, &(buf->data[size]), 1024*10);
- size += i;
- if (i == 0)
- break;
- if (i < 0)
- {
- BIO_printf(err, "Error reading %s %s",
- key_descrip, file);
- goto error;
- }
- }
- p=(unsigned char *)buf->data;
- rsa = d2i_RSA_NET(NULL,&p,(long)size,NULL,
- (format == FORMAT_IISSGC ? 1 : 0));
- if (rsa == NULL)
- goto error;
- BUF_MEM_free(buf);
- EVP_PKEY_set1_RSA(pkey, rsa);
- return pkey;
-error:
- BUF_MEM_free(buf);
- EVP_PKEY_free(pkey);
- return NULL;
- }
-#endif /* ndef OPENSSL_NO_RC4 */
+static EVP_PKEY *load_netscape_key(BIO *err, BIO *key, const char *file,
+ const char *key_descrip, int format)
+{
+ EVP_PKEY *pkey;
+ BUF_MEM *buf;
+ RSA *rsa;
+ const unsigned char *p;
+ int size, i;
+
+ buf = BUF_MEM_new();
+ pkey = EVP_PKEY_new();
+ size = 0;
+ if (buf == NULL || pkey == NULL)
+ goto error;
+ for (;;) {
+ if (!BUF_MEM_grow_clean(buf, size + 1024 * 10))
+ goto error;
+ i = BIO_read(key, &(buf->data[size]), 1024 * 10);
+ size += i;
+ if (i == 0)
+ break;
+ if (i < 0) {
+ BIO_printf(err, "Error reading %s %s", key_descrip, file);
+ goto error;
+ }
+ }
+ p = (unsigned char *)buf->data;
+ rsa = d2i_RSA_NET(NULL, &p, (long)size, NULL,
+ (format == FORMAT_IISSGC ? 1 : 0));
+ if (rsa == NULL)
+ goto error;
+ BUF_MEM_free(buf);
+ EVP_PKEY_set1_RSA(pkey, rsa);
+ return pkey;
+ error:
+ BUF_MEM_free(buf);
+ EVP_PKEY_free(pkey);
+ return NULL;
+}
+#endif /* ndef OPENSSL_NO_RC4 */
static int load_certs_crls(BIO *err, const char *file, int format,
- const char *pass, ENGINE *e, const char *desc,
- STACK_OF(X509) **pcerts, STACK_OF(X509_CRL) **pcrls)
- {
- int i;
- BIO *bio;
- STACK_OF(X509_INFO) *xis = NULL;
- X509_INFO *xi;
- PW_CB_DATA cb_data;
- int rv = 0;
-
- cb_data.password = pass;
- cb_data.prompt_info = file;
-
- if (format != FORMAT_PEM)
- {
- BIO_printf(err,"bad input format specified for %s\n", desc);
- return 0;
- }
-
- if (file == NULL)
- bio = BIO_new_fp(stdin,BIO_NOCLOSE);
- else
- bio = BIO_new_file(file, "r");
-
- if (bio == NULL)
- {
- BIO_printf(err, "Error opening %s %s\n",
- desc, file ? file : "stdin");
- ERR_print_errors(err);
- return 0;
- }
-
- xis = PEM_X509_INFO_read_bio(bio, NULL,
- (pem_password_cb *)password_callback, &cb_data);
-
- BIO_free(bio);
-
- if (pcerts)
- {
- *pcerts = sk_X509_new_null();
- if (!*pcerts)
- goto end;
- }
-
- if (pcrls)
- {
- *pcrls = sk_X509_CRL_new_null();
- if (!*pcrls)
- goto end;
- }
-
- for(i = 0; i < sk_X509_INFO_num(xis); i++)
- {
- xi = sk_X509_INFO_value (xis, i);
- if (xi->x509 && pcerts)
- {
- if (!sk_X509_push(*pcerts, xi->x509))
- goto end;
- xi->x509 = NULL;
- }
- if (xi->crl && pcrls)
- {
- if (!sk_X509_CRL_push(*pcrls, xi->crl))
- goto end;
- xi->crl = NULL;
- }
- }
-
- if (pcerts && sk_X509_num(*pcerts) > 0)
- rv = 1;
-
- if (pcrls && sk_X509_CRL_num(*pcrls) > 0)
- rv = 1;
-
- end:
-
- if (xis)
- sk_X509_INFO_pop_free(xis, X509_INFO_free);
-
- if (rv == 0)
- {
- if (pcerts)
- {
- sk_X509_pop_free(*pcerts, X509_free);
- *pcerts = NULL;
- }
- if (pcrls)
- {
- sk_X509_CRL_pop_free(*pcrls, X509_CRL_free);
- *pcrls = NULL;
- }
- BIO_printf(err,"unable to load %s\n",
- pcerts ? "certificates" : "CRLs");
- ERR_print_errors(err);
- }
- return rv;
- }
+ const char *pass, ENGINE *e, const char *desc,
+ STACK_OF(X509) **pcerts,
+ STACK_OF(X509_CRL) **pcrls)
+{
+ int i;
+ BIO *bio;
+ STACK_OF(X509_INFO) *xis = NULL;
+ X509_INFO *xi;
+ PW_CB_DATA cb_data;
+ int rv = 0;
+
+ cb_data.password = pass;
+ cb_data.prompt_info = file;
+
+ if (format != FORMAT_PEM) {
+ BIO_printf(err, "bad input format specified for %s\n", desc);
+ return 0;
+ }
+
+ if (file == NULL)
+ bio = BIO_new_fp(stdin, BIO_NOCLOSE);
+ else
+ bio = BIO_new_file(file, "r");
+
+ if (bio == NULL) {
+ BIO_printf(err, "Error opening %s %s\n", desc, file ? file : "stdin");
+ ERR_print_errors(err);
+ return 0;
+ }
+
+ xis = PEM_X509_INFO_read_bio(bio, NULL,
+ (pem_password_cb *)password_callback,
+ &cb_data);
+
+ BIO_free(bio);
+
+ if (pcerts) {
+ *pcerts = sk_X509_new_null();
+ if (!*pcerts)
+ goto end;
+ }
+
+ if (pcrls) {
+ *pcrls = sk_X509_CRL_new_null();
+ if (!*pcrls)
+ goto end;
+ }
+
+ for (i = 0; i < sk_X509_INFO_num(xis); i++) {
+ xi = sk_X509_INFO_value(xis, i);
+ if (xi->x509 && pcerts) {
+ if (!sk_X509_push(*pcerts, xi->x509))
+ goto end;
+ xi->x509 = NULL;
+ }
+ if (xi->crl && pcrls) {
+ if (!sk_X509_CRL_push(*pcrls, xi->crl))
+ goto end;
+ xi->crl = NULL;
+ }
+ }
+
+ if (pcerts && sk_X509_num(*pcerts) > 0)
+ rv = 1;
+
+ if (pcrls && sk_X509_CRL_num(*pcrls) > 0)
+ rv = 1;
+
+ end:
+
+ if (xis)
+ sk_X509_INFO_pop_free(xis, X509_INFO_free);
+
+ if (rv == 0) {
+ if (pcerts) {
+ sk_X509_pop_free(*pcerts, X509_free);
+ *pcerts = NULL;
+ }
+ if (pcrls) {
+ sk_X509_CRL_pop_free(*pcrls, X509_CRL_free);
+ *pcrls = NULL;
+ }
+ BIO_printf(err, "unable to load %s\n",
+ pcerts ? "certificates" : "CRLs");
+ ERR_print_errors(err);
+ }
+ return rv;
+}
STACK_OF(X509) *load_certs(BIO *err, const char *file, int format,
- const char *pass, ENGINE *e, const char *desc)
- {
- STACK_OF(X509) *certs;
- if (!load_certs_crls(err, file, format, pass, e, desc, &certs, NULL))
- return NULL;
- return certs;
- }
+ const char *pass, ENGINE *e, const char *desc)
+{
+ STACK_OF(X509) *certs;
+ if (!load_certs_crls(err, file, format, pass, e, desc, &certs, NULL))
+ return NULL;
+ return certs;
+}
STACK_OF(X509_CRL) *load_crls(BIO *err, const char *file, int format,
- const char *pass, ENGINE *e, const char *desc)
- {
- STACK_OF(X509_CRL) *crls;
- if (!load_certs_crls(err, file, format, pass, e, desc, NULL, &crls))
- return NULL;
- return crls;
- }
-
-#define X509V3_EXT_UNKNOWN_MASK (0xfL << 16)
+ const char *pass, ENGINE *e, const char *desc)
+{
+ STACK_OF(X509_CRL) *crls;
+ if (!load_certs_crls(err, file, format, pass, e, desc, NULL, &crls))
+ return NULL;
+ return crls;
+}
+
+#define X509V3_EXT_UNKNOWN_MASK (0xfL << 16)
/* Return error for unknown extensions */
-#define X509V3_EXT_DEFAULT 0
+#define X509V3_EXT_DEFAULT 0
/* Print error for unknown extensions */
-#define X509V3_EXT_ERROR_UNKNOWN (1L << 16)
+#define X509V3_EXT_ERROR_UNKNOWN (1L << 16)
/* ASN1 parse unknown extensions */
-#define X509V3_EXT_PARSE_UNKNOWN (2L << 16)
+#define X509V3_EXT_PARSE_UNKNOWN (2L << 16)
/* BIO_dump unknown extensions */
-#define X509V3_EXT_DUMP_UNKNOWN (3L << 16)
+#define X509V3_EXT_DUMP_UNKNOWN (3L << 16)
#define X509_FLAG_CA (X509_FLAG_NO_ISSUER | X509_FLAG_NO_PUBKEY | \
- X509_FLAG_NO_HEADER | X509_FLAG_NO_VERSION)
+ X509_FLAG_NO_HEADER | X509_FLAG_NO_VERSION)
int set_cert_ex(unsigned long *flags, const char *arg)
{
- static const NAME_EX_TBL cert_tbl[] = {
- { "compatible", X509_FLAG_COMPAT, 0xffffffffl},
- { "ca_default", X509_FLAG_CA, 0xffffffffl},
- { "no_header", X509_FLAG_NO_HEADER, 0},
- { "no_version", X509_FLAG_NO_VERSION, 0},
- { "no_serial", X509_FLAG_NO_SERIAL, 0},
- { "no_signame", X509_FLAG_NO_SIGNAME, 0},
- { "no_validity", X509_FLAG_NO_VALIDITY, 0},
- { "no_subject", X509_FLAG_NO_SUBJECT, 0},
- { "no_issuer", X509_FLAG_NO_ISSUER, 0},
- { "no_pubkey", X509_FLAG_NO_PUBKEY, 0},
- { "no_extensions", X509_FLAG_NO_EXTENSIONS, 0},
- { "no_sigdump", X509_FLAG_NO_SIGDUMP, 0},
- { "no_aux", X509_FLAG_NO_AUX, 0},
- { "no_attributes", X509_FLAG_NO_ATTRIBUTES, 0},
- { "ext_default", X509V3_EXT_DEFAULT, X509V3_EXT_UNKNOWN_MASK},
- { "ext_error", X509V3_EXT_ERROR_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
- { "ext_parse", X509V3_EXT_PARSE_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
- { "ext_dump", X509V3_EXT_DUMP_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
- { NULL, 0, 0}
- };
- return set_multi_opts(flags, arg, cert_tbl);
+ static const NAME_EX_TBL cert_tbl[] = {
+ {"compatible", X509_FLAG_COMPAT, 0xffffffffl},
+ {"ca_default", X509_FLAG_CA, 0xffffffffl},
+ {"no_header", X509_FLAG_NO_HEADER, 0},
+ {"no_version", X509_FLAG_NO_VERSION, 0},
+ {"no_serial", X509_FLAG_NO_SERIAL, 0},
+ {"no_signame", X509_FLAG_NO_SIGNAME, 0},
+ {"no_validity", X509_FLAG_NO_VALIDITY, 0},
+ {"no_subject", X509_FLAG_NO_SUBJECT, 0},
+ {"no_issuer", X509_FLAG_NO_ISSUER, 0},
+ {"no_pubkey", X509_FLAG_NO_PUBKEY, 0},
+ {"no_extensions", X509_FLAG_NO_EXTENSIONS, 0},
+ {"no_sigdump", X509_FLAG_NO_SIGDUMP, 0},
+ {"no_aux", X509_FLAG_NO_AUX, 0},
+ {"no_attributes", X509_FLAG_NO_ATTRIBUTES, 0},
+ {"ext_default", X509V3_EXT_DEFAULT, X509V3_EXT_UNKNOWN_MASK},
+ {"ext_error", X509V3_EXT_ERROR_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
+ {"ext_parse", X509V3_EXT_PARSE_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
+ {"ext_dump", X509V3_EXT_DUMP_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
+ {NULL, 0, 0}
+ };
+ return set_multi_opts(flags, arg, cert_tbl);
}
int set_name_ex(unsigned long *flags, const char *arg)
{
- static const NAME_EX_TBL ex_tbl[] = {
- { "esc_2253", ASN1_STRFLGS_ESC_2253, 0},
- { "esc_ctrl", ASN1_STRFLGS_ESC_CTRL, 0},
- { "esc_msb", ASN1_STRFLGS_ESC_MSB, 0},
- { "use_quote", ASN1_STRFLGS_ESC_QUOTE, 0},
- { "utf8", ASN1_STRFLGS_UTF8_CONVERT, 0},
- { "ignore_type", ASN1_STRFLGS_IGNORE_TYPE, 0},
- { "show_type", ASN1_STRFLGS_SHOW_TYPE, 0},
- { "dump_all", ASN1_STRFLGS_DUMP_ALL, 0},
- { "dump_nostr", ASN1_STRFLGS_DUMP_UNKNOWN, 0},
- { "dump_der", ASN1_STRFLGS_DUMP_DER, 0},
- { "compat", XN_FLAG_COMPAT, 0xffffffffL},
- { "sep_comma_plus", XN_FLAG_SEP_COMMA_PLUS, XN_FLAG_SEP_MASK},
- { "sep_comma_plus_space", XN_FLAG_SEP_CPLUS_SPC, XN_FLAG_SEP_MASK},
- { "sep_semi_plus_space", XN_FLAG_SEP_SPLUS_SPC, XN_FLAG_SEP_MASK},
- { "sep_multiline", XN_FLAG_SEP_MULTILINE, XN_FLAG_SEP_MASK},
- { "dn_rev", XN_FLAG_DN_REV, 0},
- { "nofname", XN_FLAG_FN_NONE, XN_FLAG_FN_MASK},
- { "sname", XN_FLAG_FN_SN, XN_FLAG_FN_MASK},
- { "lname", XN_FLAG_FN_LN, XN_FLAG_FN_MASK},
- { "align", XN_FLAG_FN_ALIGN, 0},
- { "oid", XN_FLAG_FN_OID, XN_FLAG_FN_MASK},
- { "space_eq", XN_FLAG_SPC_EQ, 0},
- { "dump_unknown", XN_FLAG_DUMP_UNKNOWN_FIELDS, 0},
- { "RFC2253", XN_FLAG_RFC2253, 0xffffffffL},
- { "oneline", XN_FLAG_ONELINE, 0xffffffffL},
- { "multiline", XN_FLAG_MULTILINE, 0xffffffffL},
- { "ca_default", XN_FLAG_MULTILINE, 0xffffffffL},
- { NULL, 0, 0}
- };
- return set_multi_opts(flags, arg, ex_tbl);
+ static const NAME_EX_TBL ex_tbl[] = {
+ {"esc_2253", ASN1_STRFLGS_ESC_2253, 0},
+ {"esc_ctrl", ASN1_STRFLGS_ESC_CTRL, 0},
+ {"esc_msb", ASN1_STRFLGS_ESC_MSB, 0},
+ {"use_quote", ASN1_STRFLGS_ESC_QUOTE, 0},
+ {"utf8", ASN1_STRFLGS_UTF8_CONVERT, 0},
+ {"ignore_type", ASN1_STRFLGS_IGNORE_TYPE, 0},
+ {"show_type", ASN1_STRFLGS_SHOW_TYPE, 0},
+ {"dump_all", ASN1_STRFLGS_DUMP_ALL, 0},
+ {"dump_nostr", ASN1_STRFLGS_DUMP_UNKNOWN, 0},
+ {"dump_der", ASN1_STRFLGS_DUMP_DER, 0},
+ {"compat", XN_FLAG_COMPAT, 0xffffffffL},
+ {"sep_comma_plus", XN_FLAG_SEP_COMMA_PLUS, XN_FLAG_SEP_MASK},
+ {"sep_comma_plus_space", XN_FLAG_SEP_CPLUS_SPC, XN_FLAG_SEP_MASK},
+ {"sep_semi_plus_space", XN_FLAG_SEP_SPLUS_SPC, XN_FLAG_SEP_MASK},
+ {"sep_multiline", XN_FLAG_SEP_MULTILINE, XN_FLAG_SEP_MASK},
+ {"dn_rev", XN_FLAG_DN_REV, 0},
+ {"nofname", XN_FLAG_FN_NONE, XN_FLAG_FN_MASK},
+ {"sname", XN_FLAG_FN_SN, XN_FLAG_FN_MASK},
+ {"lname", XN_FLAG_FN_LN, XN_FLAG_FN_MASK},
+ {"align", XN_FLAG_FN_ALIGN, 0},
+ {"oid", XN_FLAG_FN_OID, XN_FLAG_FN_MASK},
+ {"space_eq", XN_FLAG_SPC_EQ, 0},
+ {"dump_unknown", XN_FLAG_DUMP_UNKNOWN_FIELDS, 0},
+ {"RFC2253", XN_FLAG_RFC2253, 0xffffffffL},
+ {"oneline", XN_FLAG_ONELINE, 0xffffffffL},
+ {"multiline", XN_FLAG_MULTILINE, 0xffffffffL},
+ {"ca_default", XN_FLAG_MULTILINE, 0xffffffffL},
+ {NULL, 0, 0}
+ };
+ return set_multi_opts(flags, arg, ex_tbl);
}
int set_ext_copy(int *copy_type, const char *arg)
{
- if (!strcasecmp(arg, "none"))
- *copy_type = EXT_COPY_NONE;
- else if (!strcasecmp(arg, "copy"))
- *copy_type = EXT_COPY_ADD;
- else if (!strcasecmp(arg, "copyall"))
- *copy_type = EXT_COPY_ALL;
- else
- return 0;
- return 1;
+ if (!strcasecmp(arg, "none"))
+ *copy_type = EXT_COPY_NONE;
+ else if (!strcasecmp(arg, "copy"))
+ *copy_type = EXT_COPY_ADD;
+ else if (!strcasecmp(arg, "copyall"))
+ *copy_type = EXT_COPY_ALL;
+ else
+ return 0;
+ return 1;
}
int copy_extensions(X509 *x, X509_REQ *req, int copy_type)
{
- STACK_OF(X509_EXTENSION) *exts = NULL;
- X509_EXTENSION *ext, *tmpext;
- ASN1_OBJECT *obj;
- int i, idx, ret = 0;
- if (!x || !req || (copy_type == EXT_COPY_NONE))
- return 1;
- exts = X509_REQ_get_extensions(req);
-
- for(i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
- ext = sk_X509_EXTENSION_value(exts, i);
- obj = X509_EXTENSION_get_object(ext);
- idx = X509_get_ext_by_OBJ(x, obj, -1);
- /* Does extension exist? */
- if (idx != -1) {
- /* If normal copy don't override existing extension */
- if (copy_type == EXT_COPY_ADD)
- continue;
- /* Delete all extensions of same type */
- do {
- tmpext = X509_get_ext(x, idx);
- X509_delete_ext(x, idx);
- X509_EXTENSION_free(tmpext);
- idx = X509_get_ext_by_OBJ(x, obj, -1);
- } while (idx != -1);
- }
- if (!X509_add_ext(x, ext, -1))
- goto end;
- }
-
- ret = 1;
-
- end:
-
- sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
-
- return ret;
-}
-
-
-
-
-static int set_multi_opts(unsigned long *flags, const char *arg, const NAME_EX_TBL *in_tbl)
-{
- STACK_OF(CONF_VALUE) *vals;
- CONF_VALUE *val;
- int i, ret = 1;
- if(!arg) return 0;
- vals = X509V3_parse_list(arg);
- for (i = 0; i < sk_CONF_VALUE_num(vals); i++) {
- val = sk_CONF_VALUE_value(vals, i);
- if (!set_table_opts(flags, val->name, in_tbl))
- ret = 0;
- }
- sk_CONF_VALUE_pop_free(vals, X509V3_conf_free);
- return ret;
-}
-
-static int set_table_opts(unsigned long *flags, const char *arg, const NAME_EX_TBL *in_tbl)
-{
- char c;
- const NAME_EX_TBL *ptbl;
- c = arg[0];
-
- if(c == '-') {
- c = 0;
- arg++;
- } else if (c == '+') {
- c = 1;
- arg++;
- } else c = 1;
-
- for(ptbl = in_tbl; ptbl->name; ptbl++) {
- if(!strcasecmp(arg, ptbl->name)) {
- *flags &= ~ptbl->mask;
- if(c) *flags |= ptbl->flag;
- else *flags &= ~ptbl->flag;
- return 1;
- }
- }
- return 0;
-}
-
-void print_name(BIO *out, const char *title, X509_NAME *nm, unsigned long lflags)
-{
- char *buf;
- char mline = 0;
- int indent = 0;
-
- if(title) BIO_puts(out, title);
- if((lflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) {
- mline = 1;
- indent = 4;
- }
- if(lflags == XN_FLAG_COMPAT) {
- buf = X509_NAME_oneline(nm, 0, 0);
- BIO_puts(out, buf);
- BIO_puts(out, "\n");
- OPENSSL_free(buf);
- } else {
- if(mline) BIO_puts(out, "\n");
- X509_NAME_print_ex(out, nm, indent, lflags);
- BIO_puts(out, "\n");
- }
+ STACK_OF(X509_EXTENSION) *exts = NULL;
+ X509_EXTENSION *ext, *tmpext;
+ ASN1_OBJECT *obj;
+ int i, idx, ret = 0;
+ if (!x || !req || (copy_type == EXT_COPY_NONE))
+ return 1;
+ exts = X509_REQ_get_extensions(req);
+
+ for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
+ ext = sk_X509_EXTENSION_value(exts, i);
+ obj = X509_EXTENSION_get_object(ext);
+ idx = X509_get_ext_by_OBJ(x, obj, -1);
+ /* Does extension exist? */
+ if (idx != -1) {
+ /* If normal copy don't override existing extension */
+ if (copy_type == EXT_COPY_ADD)
+ continue;
+ /* Delete all extensions of same type */
+ do {
+ tmpext = X509_get_ext(x, idx);
+ X509_delete_ext(x, idx);
+ X509_EXTENSION_free(tmpext);
+ idx = X509_get_ext_by_OBJ(x, obj, -1);
+ } while (idx != -1);
+ }
+ if (!X509_add_ext(x, ext, -1))
+ goto end;
+ }
+
+ ret = 1;
+
+ end:
+
+ sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
+
+ return ret;
+}
+
+static int set_multi_opts(unsigned long *flags, const char *arg,
+ const NAME_EX_TBL * in_tbl)
+{
+ STACK_OF(CONF_VALUE) *vals;
+ CONF_VALUE *val;
+ int i, ret = 1;
+ if (!arg)
+ return 0;
+ vals = X509V3_parse_list(arg);
+ for (i = 0; i < sk_CONF_VALUE_num(vals); i++) {
+ val = sk_CONF_VALUE_value(vals, i);
+ if (!set_table_opts(flags, val->name, in_tbl))
+ ret = 0;
+ }
+ sk_CONF_VALUE_pop_free(vals, X509V3_conf_free);
+ return ret;
+}
+
+static int set_table_opts(unsigned long *flags, const char *arg,
+ const NAME_EX_TBL * in_tbl)
+{
+ char c;
+ const NAME_EX_TBL *ptbl;
+ c = arg[0];
+
+ if (c == '-') {
+ c = 0;
+ arg++;
+ } else if (c == '+') {
+ c = 1;
+ arg++;
+ } else
+ c = 1;
+
+ for (ptbl = in_tbl; ptbl->name; ptbl++) {
+ if (!strcasecmp(arg, ptbl->name)) {
+ *flags &= ~ptbl->mask;
+ if (c)
+ *flags |= ptbl->flag;
+ else
+ *flags &= ~ptbl->flag;
+ return 1;
+ }
+ }
+ return 0;
+}
+
+void print_name(BIO *out, const char *title, X509_NAME *nm,
+ unsigned long lflags)
+{
+ char *buf;
+ char mline = 0;
+ int indent = 0;
+
+ if (title)
+ BIO_puts(out, title);
+ if ((lflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) {
+ mline = 1;
+ indent = 4;
+ }
+ if (lflags == XN_FLAG_COMPAT) {
+ buf = X509_NAME_oneline(nm, 0, 0);
+ BIO_puts(out, buf);
+ BIO_puts(out, "\n");
+ OPENSSL_free(buf);
+ } else {
+ if (mline)
+ BIO_puts(out, "\n");
+ X509_NAME_print_ex(out, nm, indent, lflags);
+ BIO_puts(out, "\n");
+ }
}
X509_STORE *setup_verify(BIO *bp, char *CAfile, char *CApath)
{
- X509_STORE *store;
- X509_LOOKUP *lookup;
- if(!(store = X509_STORE_new())) goto end;
- lookup=X509_STORE_add_lookup(store,X509_LOOKUP_file());
- if (lookup == NULL) goto end;
- if (CAfile) {
- if(!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM)) {
- BIO_printf(bp, "Error loading file %s\n", CAfile);
- goto end;
- }
- } else X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
-
- lookup=X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir());
- if (lookup == NULL) goto end;
- if (CApath) {
- if(!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM)) {
- BIO_printf(bp, "Error loading directory %s\n", CApath);
- goto end;
- }
- } else X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
-
- ERR_clear_error();
- return store;
- end:
- X509_STORE_free(store);
- return NULL;
+ X509_STORE *store;
+ X509_LOOKUP *lookup;
+ if (!(store = X509_STORE_new()))
+ goto end;
+ lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
+ if (lookup == NULL)
+ goto end;
+ if (CAfile) {
+ if (!X509_LOOKUP_load_file(lookup, CAfile, X509_FILETYPE_PEM)) {
+ BIO_printf(bp, "Error loading file %s\n", CAfile);
+ goto end;
+ }
+ } else
+ X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);
+
+ lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
+ if (lookup == NULL)
+ goto end;
+ if (CApath) {
+ if (!X509_LOOKUP_add_dir(lookup, CApath, X509_FILETYPE_PEM)) {
+ BIO_printf(bp, "Error loading directory %s\n", CApath);
+ goto end;
+ }
+ } else
+ X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
+
+ ERR_clear_error();
+ return store;
+ end:
+ X509_STORE_free(store);
+ return NULL;
}
#ifndef OPENSSL_NO_ENGINE
/* Try to load an engine in a shareable library */
static ENGINE *try_load_engine(BIO *err, const char *engine, int debug)
- {
- ENGINE *e = ENGINE_by_id("dynamic");
- if (e)
- {
- if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine, 0)
- || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0))
- {
- ENGINE_free(e);
- e = NULL;
- }
- }
- return e;
- }
+{
+ ENGINE *e = ENGINE_by_id("dynamic");
+ if (e) {
+ if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine, 0)
+ || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) {
+ ENGINE_free(e);
+ e = NULL;
+ }
+ }
+ return e;
+}
ENGINE *setup_engine(BIO *err, const char *engine, int debug)
- {
- ENGINE *e = NULL;
-
- if (engine)
- {
- if(strcmp(engine, "auto") == 0)
- {
- BIO_printf(err,"enabling auto ENGINE support\n");
- ENGINE_register_all_complete();
- return NULL;
- }
- if((e = ENGINE_by_id(engine)) == NULL
- && (e = try_load_engine(err, engine, debug)) == NULL)
- {
- BIO_printf(err,"invalid engine \"%s\"\n", engine);
- ERR_print_errors(err);
- return NULL;
- }
- if (debug)
- {
- ENGINE_ctrl(e, ENGINE_CTRL_SET_LOGSTREAM,
- 0, err, 0);
- }
- ENGINE_ctrl_cmd(e, "SET_USER_INTERFACE", 0, ui_method, 0, 1);
- if(!ENGINE_set_default(e, ENGINE_METHOD_ALL))
- {
- BIO_printf(err,"can't use that engine\n");
- ERR_print_errors(err);
- ENGINE_free(e);
- return NULL;
- }
-
- BIO_printf(err,"engine \"%s\" set.\n", ENGINE_get_id(e));
-
- /* Free our "structural" reference. */
- ENGINE_free(e);
- }
- return e;
+{
+ ENGINE *e = NULL;
+
+ if (engine) {
+ if (strcmp(engine, "auto") == 0) {
+ BIO_printf(err, "enabling auto ENGINE support\n");
+ ENGINE_register_all_complete();
+ return NULL;
+ }
+ if ((e = ENGINE_by_id(engine)) == NULL
+ && (e = try_load_engine(err, engine, debug)) == NULL) {
+ BIO_printf(err, "invalid engine \"%s\"\n", engine);
+ ERR_print_errors(err);
+ return NULL;
+ }
+ if (debug) {
+ ENGINE_ctrl(e, ENGINE_CTRL_SET_LOGSTREAM, 0, err, 0);
}
+ ENGINE_ctrl_cmd(e, "SET_USER_INTERFACE", 0, ui_method, 0, 1);
+ if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
+ BIO_printf(err, "can't use that engine\n");
+ ERR_print_errors(err);
+ ENGINE_free(e);
+ return NULL;
+ }
+
+ BIO_printf(err, "engine \"%s\" set.\n", ENGINE_get_id(e));
+
+ /* Free our "structural" reference. */
+ ENGINE_free(e);
+ }
+ return e;
+}
#endif
int load_config(BIO *err, CONF *cnf)
- {
- static int load_config_called = 0;
- if (load_config_called)
- return 1;
- load_config_called = 1;
- if (!cnf)
- cnf = config;
- if (!cnf)
- return 1;
-
- OPENSSL_load_builtin_modules();
-
- if (CONF_modules_load(cnf, NULL, 0) <= 0)
- {
- BIO_printf(err, "Error configuring OpenSSL\n");
- ERR_print_errors(err);
- return 0;
- }
- return 1;
- }
+{
+ static int load_config_called = 0;
+ if (load_config_called)
+ return 1;
+ load_config_called = 1;
+ if (!cnf)
+ cnf = config;
+ if (!cnf)
+ return 1;
+
+ OPENSSL_load_builtin_modules();
+
+ if (CONF_modules_load(cnf, NULL, 0) <= 0) {
+ BIO_printf(err, "Error configuring OpenSSL\n");
+ ERR_print_errors(err);
+ return 0;
+ }
+ return 1;
+}
char *make_config_name()
- {
- const char *t=X509_get_default_cert_area();
- size_t len;
- char *p;
-
- len=strlen(t)+strlen(OPENSSL_CONF)+2;
- p=OPENSSL_malloc(len);
- if (p == NULL)
- return NULL;
- BUF_strlcpy(p,t,len);
+{
+ const char *t = X509_get_default_cert_area();
+ size_t len;
+ char *p;
+
+ len = strlen(t) + strlen(OPENSSL_CONF) + 2;
+ p = OPENSSL_malloc(len);
+ if (p == NULL)
+ return NULL;
+ BUF_strlcpy(p, t, len);
#ifndef OPENSSL_SYS_VMS
- BUF_strlcat(p,"/",len);
+ BUF_strlcat(p, "/", len);
#endif
- BUF_strlcat(p,OPENSSL_CONF,len);
+ BUF_strlcat(p, OPENSSL_CONF, len);
- return p;
- }
+ return p;
+}
static unsigned long index_serial_hash(const OPENSSL_CSTRING *a)
- {
- const char *n;
+{
+ const char *n;
- n=a[DB_serial];
- while (*n == '0') n++;
- return(lh_strhash(n));
- }
+ n = a[DB_serial];
+ while (*n == '0')
+ n++;
+ return (lh_strhash(n));
+}
-static int index_serial_cmp(const OPENSSL_CSTRING *a, const OPENSSL_CSTRING *b)
- {
- const char *aa,*bb;
+static int index_serial_cmp(const OPENSSL_CSTRING *a,
+ const OPENSSL_CSTRING *b)
+{
+ const char *aa, *bb;
- for (aa=a[DB_serial]; *aa == '0'; aa++);
- for (bb=b[DB_serial]; *bb == '0'; bb++);
- return(strcmp(aa,bb));
- }
+ for (aa = a[DB_serial]; *aa == '0'; aa++) ;
+ for (bb = b[DB_serial]; *bb == '0'; bb++) ;
+ return (strcmp(aa, bb));
+}
static int index_name_qual(char **a)
- { return(a[0][0] == 'V'); }
+{
+ return (a[0][0] == 'V');
+}
static unsigned long index_name_hash(const OPENSSL_CSTRING *a)
- { return(lh_strhash(a[DB_name])); }
+{
+ return (lh_strhash(a[DB_name]));
+}
int index_name_cmp(const OPENSSL_CSTRING *a, const OPENSSL_CSTRING *b)
- { return(strcmp(a[DB_name], b[DB_name])); }
+{
+ return (strcmp(a[DB_name], b[DB_name]));
+}
static IMPLEMENT_LHASH_HASH_FN(index_serial, OPENSSL_CSTRING)
static IMPLEMENT_LHASH_COMP_FN(index_serial, OPENSSL_CSTRING)
static IMPLEMENT_LHASH_HASH_FN(index_name, OPENSSL_CSTRING)
static IMPLEMENT_LHASH_COMP_FN(index_name, OPENSSL_CSTRING)
-
#undef BSIZE
#define BSIZE 256
-
BIGNUM *load_serial(char *serialfile, int create, ASN1_INTEGER **retai)
- {
- BIO *in=NULL;
- BIGNUM *ret=NULL;
- MS_STATIC char buf[1024];
- ASN1_INTEGER *ai=NULL;
-
- ai=ASN1_INTEGER_new();
- if (ai == NULL) goto err;
-
- if ((in=BIO_new(BIO_s_file())) == NULL)
- {
- ERR_print_errors(bio_err);
- goto err;
- }
-
- if (BIO_read_filename(in,serialfile) <= 0)
- {
- if (!create)
- {
- perror(serialfile);
- goto err;
- }
- else
- {
- ret=BN_new();
- if (ret == NULL || !rand_serial(ret, ai))
- BIO_printf(bio_err, "Out of memory\n");
- }
- }
- else
- {
- if (!a2i_ASN1_INTEGER(in,ai,buf,1024))
- {
- BIO_printf(bio_err,"unable to load number from %s\n",
- serialfile);
- goto err;
- }
- ret=ASN1_INTEGER_to_BN(ai,NULL);
- if (ret == NULL)
- {
- BIO_printf(bio_err,"error converting number from bin to BIGNUM\n");
- goto err;
- }
- }
-
- if (ret && retai)
- {
- *retai = ai;
- ai = NULL;
- }
+{
+ BIO *in = NULL;
+ BIGNUM *ret = NULL;
+ MS_STATIC char buf[1024];
+ ASN1_INTEGER *ai = NULL;
+
+ ai = ASN1_INTEGER_new();
+ if (ai == NULL)
+ goto err;
+
+ if ((in = BIO_new(BIO_s_file())) == NULL) {
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+
+ if (BIO_read_filename(in, serialfile) <= 0) {
+ if (!create) {
+ perror(serialfile);
+ goto err;
+ } else {
+ ret = BN_new();
+ if (ret == NULL || !rand_serial(ret, ai))
+ BIO_printf(bio_err, "Out of memory\n");
+ }
+ } else {
+ if (!a2i_ASN1_INTEGER(in, ai, buf, 1024)) {
+ BIO_printf(bio_err, "unable to load number from %s\n",
+ serialfile);
+ goto err;
+ }
+ ret = ASN1_INTEGER_to_BN(ai, NULL);
+ if (ret == NULL) {
+ BIO_printf(bio_err,
+ "error converting number from bin to BIGNUM\n");
+ goto err;
+ }
+ }
+
+ if (ret && retai) {
+ *retai = ai;
+ ai = NULL;
+ }
err:
- if (in != NULL) BIO_free(in);
- if (ai != NULL) ASN1_INTEGER_free(ai);
- return(ret);
- }
-
-int save_serial(char *serialfile, char *suffix, BIGNUM *serial, ASN1_INTEGER **retai)
- {
- char buf[1][BSIZE];
- BIO *out = NULL;
- int ret=0;
- ASN1_INTEGER *ai=NULL;
- int j;
-
- if (suffix == NULL)
- j = strlen(serialfile);
- else
- j = strlen(serialfile) + strlen(suffix) + 1;
- if (j >= BSIZE)
- {
- BIO_printf(bio_err,"file name too long\n");
- goto err;
- }
-
- if (suffix == NULL)
- BUF_strlcpy(buf[0], serialfile, BSIZE);
- else
- {
+ if (in != NULL)
+ BIO_free(in);
+ if (ai != NULL)
+ ASN1_INTEGER_free(ai);
+ return (ret);
+}
+
+int save_serial(char *serialfile, char *suffix, BIGNUM *serial,
+ ASN1_INTEGER **retai)
+{
+ char buf[1][BSIZE];
+ BIO *out = NULL;
+ int ret = 0;
+ ASN1_INTEGER *ai = NULL;
+ int j;
+
+ if (suffix == NULL)
+ j = strlen(serialfile);
+ else
+ j = strlen(serialfile) + strlen(suffix) + 1;
+ if (j >= BSIZE) {
+ BIO_printf(bio_err, "file name too long\n");
+ goto err;
+ }
+
+ if (suffix == NULL)
+ BUF_strlcpy(buf[0], serialfile, BSIZE);
+ else {
#ifndef OPENSSL_SYS_VMS
- j = BIO_snprintf(buf[0], sizeof buf[0], "%s.%s", serialfile, suffix);
+ j = BIO_snprintf(buf[0], sizeof buf[0], "%s.%s", serialfile, suffix);
#else
- j = BIO_snprintf(buf[0], sizeof buf[0], "%s-%s", serialfile, suffix);
+ j = BIO_snprintf(buf[0], sizeof buf[0], "%s-%s", serialfile, suffix);
#endif
- }
+ }
#ifdef RL_DEBUG
- BIO_printf(bio_err, "DEBUG: writing \"%s\"\n", buf[0]);
-#endif
- out=BIO_new(BIO_s_file());
- if (out == NULL)
- {
- ERR_print_errors(bio_err);
- goto err;
- }
- if (BIO_write_filename(out,buf[0]) <= 0)
- {
- perror(serialfile);
- goto err;
- }
-
- if ((ai=BN_to_ASN1_INTEGER(serial,NULL)) == NULL)
- {
- BIO_printf(bio_err,"error converting serial to ASN.1 format\n");
- goto err;
- }
- i2a_ASN1_INTEGER(out,ai);
- BIO_puts(out,"\n");
- ret=1;
- if (retai)
- {
- *retai = ai;
- ai = NULL;
- }
-err:
- if (out != NULL) BIO_free_all(out);
- if (ai != NULL) ASN1_INTEGER_free(ai);
- return(ret);
- }
+ BIO_printf(bio_err, "DEBUG: writing \"%s\"\n", buf[0]);
+#endif
+ out = BIO_new(BIO_s_file());
+ if (out == NULL) {
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+ if (BIO_write_filename(out, buf[0]) <= 0) {
+ perror(serialfile);
+ goto err;
+ }
+
+ if ((ai = BN_to_ASN1_INTEGER(serial, NULL)) == NULL) {
+ BIO_printf(bio_err, "error converting serial to ASN.1 format\n");
+ goto err;
+ }
+ i2a_ASN1_INTEGER(out, ai);
+ BIO_puts(out, "\n");
+ ret = 1;
+ if (retai) {
+ *retai = ai;
+ ai = NULL;
+ }
+ err:
+ if (out != NULL)
+ BIO_free_all(out);
+ if (ai != NULL)
+ ASN1_INTEGER_free(ai);
+ return (ret);
+}
int rotate_serial(char *serialfile, char *new_suffix, char *old_suffix)
- {
- char buf[5][BSIZE];
- int i,j;
-
- i = strlen(serialfile) + strlen(old_suffix);
- j = strlen(serialfile) + strlen(new_suffix);
- if (i > j) j = i;
- if (j + 1 >= BSIZE)
- {
- BIO_printf(bio_err,"file name too long\n");
- goto err;
- }
-
+{
+ char buf[5][BSIZE];
+ int i, j;
+
+ i = strlen(serialfile) + strlen(old_suffix);
+ j = strlen(serialfile) + strlen(new_suffix);
+ if (i > j)
+ j = i;
+ if (j + 1 >= BSIZE) {
+ BIO_printf(bio_err, "file name too long\n");
+ goto err;
+ }
#ifndef OPENSSL_SYS_VMS
- j = BIO_snprintf(buf[0], sizeof buf[0], "%s.%s",
- serialfile, new_suffix);
+ j = BIO_snprintf(buf[0], sizeof buf[0], "%s.%s", serialfile, new_suffix);
#else
- j = BIO_snprintf(buf[0], sizeof buf[0], "%s-%s",
- serialfile, new_suffix);
+ j = BIO_snprintf(buf[0], sizeof buf[0], "%s-%s", serialfile, new_suffix);
#endif
#ifndef OPENSSL_SYS_VMS
- j = BIO_snprintf(buf[1], sizeof buf[1], "%s.%s",
- serialfile, old_suffix);
+ j = BIO_snprintf(buf[1], sizeof buf[1], "%s.%s", serialfile, old_suffix);
#else
- j = BIO_snprintf(buf[1], sizeof buf[1], "%s-%s",
- serialfile, old_suffix);
+ j = BIO_snprintf(buf[1], sizeof buf[1], "%s-%s", serialfile, old_suffix);
#endif
#ifdef RL_DEBUG
- BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
- serialfile, buf[1]);
+ BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
+ serialfile, buf[1]);
#endif
- if (rename(serialfile,buf[1]) < 0 && errno != ENOENT
+ if (rename(serialfile, buf[1]) < 0 && errno != ENOENT
#ifdef ENOTDIR
- && errno != ENOTDIR
-#endif
- ) {
- BIO_printf(bio_err,
- "unable to rename %s to %s\n",
- serialfile, buf[1]);
- perror("reason");
- goto err;
- }
+ && errno != ENOTDIR
+#endif
+ ) {
+ BIO_printf(bio_err,
+ "unable to rename %s to %s\n", serialfile, buf[1]);
+ perror("reason");
+ goto err;
+ }
#ifdef RL_DEBUG
- BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
- buf[0],serialfile);
-#endif
- if (rename(buf[0],serialfile) < 0)
- {
- BIO_printf(bio_err,
- "unable to rename %s to %s\n",
- buf[0],serialfile);
- perror("reason");
- rename(buf[1],serialfile);
- goto err;
- }
- return 1;
+ BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
+ buf[0], serialfile);
+#endif
+ if (rename(buf[0], serialfile) < 0) {
+ BIO_printf(bio_err,
+ "unable to rename %s to %s\n", buf[0], serialfile);
+ perror("reason");
+ rename(buf[1], serialfile);
+ goto err;
+ }
+ return 1;
err:
- return 0;
- }
+ return 0;
+}
int rand_serial(BIGNUM *b, ASN1_INTEGER *ai)
- {
- BIGNUM *btmp;
- int ret = 0;
- if (b)
- btmp = b;
- else
- btmp = BN_new();
-
- if (!btmp)
- return 0;
-
- if (!BN_pseudo_rand(btmp, SERIAL_RAND_BITS, 0, 0))
- goto error;
- if (ai && !BN_to_ASN1_INTEGER(btmp, ai))
- goto error;
-
- ret = 1;
-
- error:
-
- if (!b)
- BN_free(btmp);
-
- return ret;
- }
+{
+ BIGNUM *btmp;
+ int ret = 0;
+ if (b)
+ btmp = b;
+ else
+ btmp = BN_new();
+
+ if (!btmp)
+ return 0;
+
+ if (!BN_pseudo_rand(btmp, SERIAL_RAND_BITS, 0, 0))
+ goto error;
+ if (ai && !BN_to_ASN1_INTEGER(btmp, ai))
+ goto error;
+
+ ret = 1;
+
+ error:
+
+ if (!b)
+ BN_free(btmp);
+
+ return ret;
+}
CA_DB *load_index(char *dbfile, DB_ATTR *db_attr)
- {
- CA_DB *retdb = NULL;
- TXT_DB *tmpdb = NULL;
- BIO *in = BIO_new(BIO_s_file());
- CONF *dbattr_conf = NULL;
- char buf[1][BSIZE];
- long errorline= -1;
-
- if (in == NULL)
- {
- ERR_print_errors(bio_err);
- goto err;
- }
- if (BIO_read_filename(in,dbfile) <= 0)
- {
- perror(dbfile);
- BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
- goto err;
- }
- if ((tmpdb = TXT_DB_read(in,DB_NUMBER)) == NULL)
- goto err;
+{
+ CA_DB *retdb = NULL;
+ TXT_DB *tmpdb = NULL;
+ BIO *in = BIO_new(BIO_s_file());
+ CONF *dbattr_conf = NULL;
+ char buf[1][BSIZE];
+ long errorline = -1;
+
+ if (in == NULL) {
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+ if (BIO_read_filename(in, dbfile) <= 0) {
+ perror(dbfile);
+ BIO_printf(bio_err, "unable to open '%s'\n", dbfile);
+ goto err;
+ }
+ if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
+ goto err;
#ifndef OPENSSL_SYS_VMS
- BIO_snprintf(buf[0], sizeof buf[0], "%s.attr", dbfile);
+ BIO_snprintf(buf[0], sizeof buf[0], "%s.attr", dbfile);
#else
- BIO_snprintf(buf[0], sizeof buf[0], "%s-attr", dbfile);
-#endif
- dbattr_conf = NCONF_new(NULL);
- if (NCONF_load(dbattr_conf,buf[0],&errorline) <= 0)
- {
- if (errorline > 0)
- {
- BIO_printf(bio_err,
- "error on line %ld of db attribute file '%s'\n"
- ,errorline,buf[0]);
- goto err;
- }
- else
- {
- NCONF_free(dbattr_conf);
- dbattr_conf = NULL;
- }
- }
-
- if ((retdb = OPENSSL_malloc(sizeof(CA_DB))) == NULL)
- {
- fprintf(stderr, "Out of memory\n");
- goto err;
- }
-
- retdb->db = tmpdb;
- tmpdb = NULL;
- if (db_attr)
- retdb->attributes = *db_attr;
- else
- {
- retdb->attributes.unique_subject = 1;
- }
-
- if (dbattr_conf)
- {
- char *p = NCONF_get_string(dbattr_conf,NULL,"unique_subject");
- if (p)
- {
+ BIO_snprintf(buf[0], sizeof buf[0], "%s-attr", dbfile);
+#endif
+ dbattr_conf = NCONF_new(NULL);
+ if (NCONF_load(dbattr_conf, buf[0], &errorline) <= 0) {
+ if (errorline > 0) {
+ BIO_printf(bio_err,
+ "error on line %ld of db attribute file '%s'\n",
+ errorline, buf[0]);
+ goto err;
+ } else {
+ NCONF_free(dbattr_conf);
+ dbattr_conf = NULL;
+ }
+ }
+
+ if ((retdb = OPENSSL_malloc(sizeof(CA_DB))) == NULL) {
+ fprintf(stderr, "Out of memory\n");
+ goto err;
+ }
+
+ retdb->db = tmpdb;
+ tmpdb = NULL;
+ if (db_attr)
+ retdb->attributes = *db_attr;
+ else {
+ retdb->attributes.unique_subject = 1;
+ }
+
+ if (dbattr_conf) {
+ char *p = NCONF_get_string(dbattr_conf, NULL, "unique_subject");
+ if (p) {
#ifdef RL_DEBUG
- BIO_printf(bio_err, "DEBUG[load_index]: unique_subject = \"%s\"\n", p);
+ BIO_printf(bio_err,
+ "DEBUG[load_index]: unique_subject = \"%s\"\n", p);
#endif
- retdb->attributes.unique_subject = parse_yesno(p,1);
- }
- }
+ retdb->attributes.unique_subject = parse_yesno(p, 1);
+ }
+ }
err:
- if (dbattr_conf) NCONF_free(dbattr_conf);
- if (tmpdb) TXT_DB_free(tmpdb);
- if (in) BIO_free_all(in);
- return retdb;
- }
+ if (dbattr_conf)
+ NCONF_free(dbattr_conf);
+ if (tmpdb)
+ TXT_DB_free(tmpdb);
+ if (in)
+ BIO_free_all(in);
+ return retdb;
+}
int index_index(CA_DB *db)
- {
- if (!TXT_DB_create_index(db->db, DB_serial, NULL,
- LHASH_HASH_FN(index_serial),
- LHASH_COMP_FN(index_serial)))
- {
- BIO_printf(bio_err,
- "error creating serial number index:(%ld,%ld,%ld)\n",
- db->db->error,db->db->arg1,db->db->arg2);
- return 0;
- }
-
- if (db->attributes.unique_subject
- && !TXT_DB_create_index(db->db, DB_name, index_name_qual,
- LHASH_HASH_FN(index_name),
- LHASH_COMP_FN(index_name)))
- {
- BIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\n",
- db->db->error,db->db->arg1,db->db->arg2);
- return 0;
- }
- return 1;
- }
+{
+ if (!TXT_DB_create_index(db->db, DB_serial, NULL,
+ LHASH_HASH_FN(index_serial),
+ LHASH_COMP_FN(index_serial))) {
+ BIO_printf(bio_err,
+ "error creating serial number index:(%ld,%ld,%ld)\n",
+ db->db->error, db->db->arg1, db->db->arg2);
+ return 0;
+ }
+
+ if (db->attributes.unique_subject
+ && !TXT_DB_create_index(db->db, DB_name, index_name_qual,
+ LHASH_HASH_FN(index_name),
+ LHASH_COMP_FN(index_name))) {
+ BIO_printf(bio_err, "error creating name index:(%ld,%ld,%ld)\n",
+ db->db->error, db->db->arg1, db->db->arg2);
+ return 0;
+ }
+ return 1;
+}
int save_index(const char *dbfile, const char *suffix, CA_DB *db)
- {
- char buf[3][BSIZE];
- BIO *out = BIO_new(BIO_s_file());
- int j;
-
- if (out == NULL)
- {
- ERR_print_errors(bio_err);
- goto err;
- }
-
- j = strlen(dbfile) + strlen(suffix);
- if (j + 6 >= BSIZE)
- {
- BIO_printf(bio_err,"file name too long\n");
- goto err;
- }
-
+{
+ char buf[3][BSIZE];
+ BIO *out = BIO_new(BIO_s_file());
+ int j;
+
+ if (out == NULL) {
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+
+ j = strlen(dbfile) + strlen(suffix);
+ if (j + 6 >= BSIZE) {
+ BIO_printf(bio_err, "file name too long\n");
+ goto err;
+ }
#ifndef OPENSSL_SYS_VMS
- j = BIO_snprintf(buf[2], sizeof buf[2], "%s.attr", dbfile);
+ j = BIO_snprintf(buf[2], sizeof buf[2], "%s.attr", dbfile);
#else
- j = BIO_snprintf(buf[2], sizeof buf[2], "%s-attr", dbfile);
+ j = BIO_snprintf(buf[2], sizeof buf[2], "%s-attr", dbfile);
#endif
#ifndef OPENSSL_SYS_VMS
- j = BIO_snprintf(buf[1], sizeof buf[1], "%s.attr.%s", dbfile, suffix);
+ j = BIO_snprintf(buf[1], sizeof buf[1], "%s.attr.%s", dbfile, suffix);
#else
- j = BIO_snprintf(buf[1], sizeof buf[1], "%s-attr-%s", dbfile, suffix);
+ j = BIO_snprintf(buf[1], sizeof buf[1], "%s-attr-%s", dbfile, suffix);
#endif
#ifndef OPENSSL_SYS_VMS
- j = BIO_snprintf(buf[0], sizeof buf[0], "%s.%s", dbfile, suffix);
+ j = BIO_snprintf(buf[0], sizeof buf[0], "%s.%s", dbfile, suffix);
#else
- j = BIO_snprintf(buf[0], sizeof buf[0], "%s-%s", dbfile, suffix);
+ j = BIO_snprintf(buf[0], sizeof buf[0], "%s-%s", dbfile, suffix);
#endif
#ifdef RL_DEBUG
- BIO_printf(bio_err, "DEBUG: writing \"%s\"\n", buf[0]);
+ BIO_printf(bio_err, "DEBUG: writing \"%s\"\n", buf[0]);
#endif
- if (BIO_write_filename(out,buf[0]) <= 0)
- {
- perror(dbfile);
- BIO_printf(bio_err,"unable to open '%s'\n", dbfile);
- goto err;
- }
- j=TXT_DB_write(out,db->db);
- if (j <= 0) goto err;
-
- BIO_free(out);
-
- out = BIO_new(BIO_s_file());
+ if (BIO_write_filename(out, buf[0]) <= 0) {
+ perror(dbfile);
+ BIO_printf(bio_err, "unable to open '%s'\n", dbfile);
+ goto err;
+ }
+ j = TXT_DB_write(out, db->db);
+ if (j <= 0)
+ goto err;
+
+ BIO_free(out);
+
+ out = BIO_new(BIO_s_file());
#ifdef RL_DEBUG
- BIO_printf(bio_err, "DEBUG: writing \"%s\"\n", buf[1]);
-#endif
- if (BIO_write_filename(out,buf[1]) <= 0)
- {
- perror(buf[2]);
- BIO_printf(bio_err,"unable to open '%s'\n", buf[2]);
- goto err;
- }
- BIO_printf(out,"unique_subject = %s\n",
- db->attributes.unique_subject ? "yes" : "no");
- BIO_free(out);
-
- return 1;
+ BIO_printf(bio_err, "DEBUG: writing \"%s\"\n", buf[1]);
+#endif
+ if (BIO_write_filename(out, buf[1]) <= 0) {
+ perror(buf[2]);
+ BIO_printf(bio_err, "unable to open '%s'\n", buf[2]);
+ goto err;
+ }
+ BIO_printf(out, "unique_subject = %s\n",
+ db->attributes.unique_subject ? "yes" : "no");
+ BIO_free(out);
+
+ return 1;
err:
- return 0;
- }
-
-int rotate_index(const char *dbfile, const char *new_suffix, const char *old_suffix)
- {
- char buf[5][BSIZE];
- int i,j;
-
- i = strlen(dbfile) + strlen(old_suffix);
- j = strlen(dbfile) + strlen(new_suffix);
- if (i > j) j = i;
- if (j + 6 >= BSIZE)
- {
- BIO_printf(bio_err,"file name too long\n");
- goto err;
- }
+ return 0;
+}
+int rotate_index(const char *dbfile, const char *new_suffix,
+ const char *old_suffix)
+{
+ char buf[5][BSIZE];
+ int i, j;
+
+ i = strlen(dbfile) + strlen(old_suffix);
+ j = strlen(dbfile) + strlen(new_suffix);
+ if (i > j)
+ j = i;
+ if (j + 6 >= BSIZE) {
+ BIO_printf(bio_err, "file name too long\n");
+ goto err;
+ }
#ifndef OPENSSL_SYS_VMS
- j = BIO_snprintf(buf[4], sizeof buf[4], "%s.attr", dbfile);
+ j = BIO_snprintf(buf[4], sizeof buf[4], "%s.attr", dbfile);
#else
- j = BIO_snprintf(buf[4], sizeof buf[4], "%s-attr", dbfile);
+ j = BIO_snprintf(buf[4], sizeof buf[4], "%s-attr", dbfile);
#endif
#ifndef OPENSSL_SYS_VMS
- j = BIO_snprintf(buf[2], sizeof buf[2], "%s.attr.%s",
- dbfile, new_suffix);
+ j = BIO_snprintf(buf[2], sizeof buf[2], "%s.attr.%s", dbfile, new_suffix);
#else
- j = BIO_snprintf(buf[2], sizeof buf[2], "%s-attr-%s",
- dbfile, new_suffix);
+ j = BIO_snprintf(buf[2], sizeof buf[2], "%s-attr-%s", dbfile, new_suffix);
#endif
#ifndef OPENSSL_SYS_VMS
- j = BIO_snprintf(buf[0], sizeof buf[0], "%s.%s",
- dbfile, new_suffix);
+ j = BIO_snprintf(buf[0], sizeof buf[0], "%s.%s", dbfile, new_suffix);
#else
- j = BIO_snprintf(buf[0], sizeof buf[0], "%s-%s",
- dbfile, new_suffix);
+ j = BIO_snprintf(buf[0], sizeof buf[0], "%s-%s", dbfile, new_suffix);
#endif
#ifndef OPENSSL_SYS_VMS
- j = BIO_snprintf(buf[1], sizeof buf[1], "%s.%s",
- dbfile, old_suffix);
+ j = BIO_snprintf(buf[1], sizeof buf[1], "%s.%s", dbfile, old_suffix);
#else
- j = BIO_snprintf(buf[1], sizeof buf[1], "%s-%s",
- dbfile, old_suffix);
+ j = BIO_snprintf(buf[1], sizeof buf[1], "%s-%s", dbfile, old_suffix);
#endif
#ifndef OPENSSL_SYS_VMS
- j = BIO_snprintf(buf[3], sizeof buf[3], "%s.attr.%s",
- dbfile, old_suffix);
+ j = BIO_snprintf(buf[3], sizeof buf[3], "%s.attr.%s", dbfile, old_suffix);
#else
- j = BIO_snprintf(buf[3], sizeof buf[3], "%s-attr-%s",
- dbfile, old_suffix);
+ j = BIO_snprintf(buf[3], sizeof buf[3], "%s-attr-%s", dbfile, old_suffix);
#endif
#ifdef RL_DEBUG
- BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
- dbfile, buf[1]);
+ BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n", dbfile, buf[1]);
#endif
- if (rename(dbfile,buf[1]) < 0 && errno != ENOENT
+ if (rename(dbfile, buf[1]) < 0 && errno != ENOENT
#ifdef ENOTDIR
- && errno != ENOTDIR
+ && errno != ENOTDIR
#endif
- ) {
- BIO_printf(bio_err,
- "unable to rename %s to %s\n",
- dbfile, buf[1]);
- perror("reason");
- goto err;
- }
+ ) {
+ BIO_printf(bio_err, "unable to rename %s to %s\n", dbfile, buf[1]);
+ perror("reason");
+ goto err;
+ }
#ifdef RL_DEBUG
- BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
- buf[0],dbfile);
-#endif
- if (rename(buf[0],dbfile) < 0)
- {
- BIO_printf(bio_err,
- "unable to rename %s to %s\n",
- buf[0],dbfile);
- perror("reason");
- rename(buf[1],dbfile);
- goto err;
- }
+ BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n", buf[0], dbfile);
+#endif
+ if (rename(buf[0], dbfile) < 0) {
+ BIO_printf(bio_err, "unable to rename %s to %s\n", buf[0], dbfile);
+ perror("reason");
+ rename(buf[1], dbfile);
+ goto err;
+ }
#ifdef RL_DEBUG
- BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
- buf[4],buf[3]);
+ BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n", buf[4], buf[3]);
#endif
- if (rename(buf[4],buf[3]) < 0 && errno != ENOENT
+ if (rename(buf[4], buf[3]) < 0 && errno != ENOENT
#ifdef ENOTDIR
- && errno != ENOTDIR
-#endif
- ) {
- BIO_printf(bio_err,
- "unable to rename %s to %s\n",
- buf[4], buf[3]);
- perror("reason");
- rename(dbfile,buf[0]);
- rename(buf[1],dbfile);
- goto err;
- }
+ && errno != ENOTDIR
+#endif
+ ) {
+ BIO_printf(bio_err, "unable to rename %s to %s\n", buf[4], buf[3]);
+ perror("reason");
+ rename(dbfile, buf[0]);
+ rename(buf[1], dbfile);
+ goto err;
+ }
#ifdef RL_DEBUG
- BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
- buf[2],buf[4]);
-#endif
- if (rename(buf[2],buf[4]) < 0)
- {
- BIO_printf(bio_err,
- "unable to rename %s to %s\n",
- buf[2],buf[4]);
- perror("reason");
- rename(buf[3],buf[4]);
- rename(dbfile,buf[0]);
- rename(buf[1],dbfile);
- goto err;
- }
- return 1;
+ BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n", buf[2], buf[4]);
+#endif
+ if (rename(buf[2], buf[4]) < 0) {
+ BIO_printf(bio_err, "unable to rename %s to %s\n", buf[2], buf[4]);
+ perror("reason");
+ rename(buf[3], buf[4]);
+ rename(dbfile, buf[0]);
+ rename(buf[1], dbfile);
+ goto err;
+ }
+ return 1;
err:
- return 0;
- }
+ return 0;
+}
void free_index(CA_DB *db)
- {
- if (db)
- {
- if (db->db) TXT_DB_free(db->db);
- OPENSSL_free(db);
- }
- }
+{
+ if (db) {
+ if (db->db)
+ TXT_DB_free(db->db);
+ OPENSSL_free(db);
+ }
+}
int parse_yesno(const char *str, int def)
- {
- int ret = def;
- if (str)
- {
- switch (*str)
- {
- case 'f': /* false */
- case 'F': /* FALSE */
- case 'n': /* no */
- case 'N': /* NO */
- case '0': /* 0 */
- ret = 0;
- break;
- case 't': /* true */
- case 'T': /* TRUE */
- case 'y': /* yes */
- case 'Y': /* YES */
- case '1': /* 1 */
- ret = 1;
- break;
- default:
- ret = def;
- break;
- }
- }
- return ret;
- }
+{
+ int ret = def;
+ if (str) {
+ switch (*str) {
+ case 'f': /* false */
+ case 'F': /* FALSE */
+ case 'n': /* no */
+ case 'N': /* NO */
+ case '0': /* 0 */
+ ret = 0;
+ break;
+ case 't': /* true */
+ case 'T': /* TRUE */
+ case 'y': /* yes */
+ case 'Y': /* YES */
+ case '1': /* 1 */
+ ret = 1;
+ break;
+ default:
+ ret = def;
+ break;
+ }
+ }
+ return ret;
+}
/*
* subject is expected to be in the format /type0=value0/type1=value1/type2=...
* where characters may be escaped by \
*/
X509_NAME *parse_name(char *subject, long chtype, int multirdn)
- {
- size_t buflen = strlen(subject)+1; /* to copy the types and values into. due to escaping, the copy can only become shorter */
- char *buf = OPENSSL_malloc(buflen);
- size_t max_ne = buflen / 2 + 1; /* maximum number of name elements */
- char **ne_types = OPENSSL_malloc(max_ne * sizeof (char *));
- char **ne_values = OPENSSL_malloc(max_ne * sizeof (char *));
- int *mval = OPENSSL_malloc (max_ne * sizeof (int));
-
- char *sp = subject, *bp = buf;
- int i, ne_num = 0;
-
- X509_NAME *n = NULL;
- int nid;
-
- if (!buf || !ne_types || !ne_values || !mval)
- {
- BIO_printf(bio_err, "malloc error\n");
- goto error;
- }
-
- if (*subject != '/')
- {
- BIO_printf(bio_err, "Subject does not start with '/'.\n");
- goto error;
- }
- sp++; /* skip leading / */
-
- /* no multivalued RDN by default */
- mval[ne_num] = 0;
-
- while (*sp)
- {
- /* collect type */
- ne_types[ne_num] = bp;
- while (*sp)
- {
- if (*sp == '\\') /* is there anything to escape in the type...? */
- {
- if (*++sp)
- *bp++ = *sp++;
- else
- {
- BIO_printf(bio_err, "escape character at end of string\n");
- goto error;
- }
- }
- else if (*sp == '=')
- {
- sp++;
- *bp++ = '\0';
- break;
- }
- else
- *bp++ = *sp++;
- }
- if (!*sp)
- {
- BIO_printf(bio_err, "end of string encountered while processing type of subject name element #%d\n", ne_num);
- goto error;
- }
- ne_values[ne_num] = bp;
- while (*sp)
- {
- if (*sp == '\\')
- {
- if (*++sp)
- *bp++ = *sp++;
- else
- {
- BIO_printf(bio_err, "escape character at end of string\n");
- goto error;
- }
- }
- else if (*sp == '/')
- {
- sp++;
- /* no multivalued RDN by default */
- mval[ne_num+1] = 0;
- break;
- }
- else if (*sp == '+' && multirdn)
- {
- /* a not escaped + signals a mutlivalued RDN */
- sp++;
- mval[ne_num+1] = -1;
- break;
- }
- else
- *bp++ = *sp++;
- }
- *bp++ = '\0';
- ne_num++;
- }
-
- if (!(n = X509_NAME_new()))
- goto error;
-
- for (i = 0; i < ne_num; i++)
- {
- if ((nid=OBJ_txt2nid(ne_types[i])) == NID_undef)
- {
- BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_types[i]);
- continue;
- }
-
- if (!*ne_values[i])
- {
- BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_types[i]);
- continue;
- }
-
- if (!X509_NAME_add_entry_by_NID(n, nid, chtype, (unsigned char*)ne_values[i], -1,-1,mval[i]))
- goto error;
- }
-
- OPENSSL_free(ne_values);
- OPENSSL_free(ne_types);
- OPENSSL_free(buf);
- OPENSSL_free(mval);
- return n;
-
-error:
- X509_NAME_free(n);
- if (ne_values)
- OPENSSL_free(ne_values);
- if (ne_types)
- OPENSSL_free(ne_types);
- if (mval)
- OPENSSL_free(mval);
- if (buf)
- OPENSSL_free(buf);
- return NULL;
+{
+ size_t buflen = strlen(subject) + 1; /* to copy the types and values
+ * into. due to escaping, the copy
+ * can only become shorter */
+ char *buf = OPENSSL_malloc(buflen);
+ size_t max_ne = buflen / 2 + 1; /* maximum number of name elements */
+ char **ne_types = OPENSSL_malloc(max_ne * sizeof(char *));
+ char **ne_values = OPENSSL_malloc(max_ne * sizeof(char *));
+ int *mval = OPENSSL_malloc(max_ne * sizeof(int));
+
+ char *sp = subject, *bp = buf;
+ int i, ne_num = 0;
+
+ X509_NAME *n = NULL;
+ int nid;
+
+ if (!buf || !ne_types || !ne_values || !mval) {
+ BIO_printf(bio_err, "malloc error\n");
+ goto error;
+ }
+
+ if (*subject != '/') {
+ BIO_printf(bio_err, "Subject does not start with '/'.\n");
+ goto error;
+ }
+ sp++; /* skip leading / */
+
+ /* no multivalued RDN by default */
+ mval[ne_num] = 0;
+
+ while (*sp) {
+ /* collect type */
+ ne_types[ne_num] = bp;
+ while (*sp) {
+ if (*sp == '\\') { /* is there anything to escape in the
+ * type...? */
+ if (*++sp)
+ *bp++ = *sp++;
+ else {
+ BIO_printf(bio_err,
+ "escape character at end of string\n");
+ goto error;
+ }
+ } else if (*sp == '=') {
+ sp++;
+ *bp++ = '\0';
+ break;
+ } else
+ *bp++ = *sp++;
+ }
+ if (!*sp) {
+ BIO_printf(bio_err,
+ "end of string encountered while processing type of subject name element #%d\n",
+ ne_num);
+ goto error;
+ }
+ ne_values[ne_num] = bp;
+ while (*sp) {
+ if (*sp == '\\') {
+ if (*++sp)
+ *bp++ = *sp++;
+ else {
+ BIO_printf(bio_err,
+ "escape character at end of string\n");
+ goto error;
+ }
+ } else if (*sp == '/') {
+ sp++;
+ /* no multivalued RDN by default */
+ mval[ne_num + 1] = 0;
+ break;
+ } else if (*sp == '+' && multirdn) {
+ /*
+ * a not escaped + signals a mutlivalued RDN
+ */
+ sp++;
+ mval[ne_num + 1] = -1;
+ break;
+ } else
+ *bp++ = *sp++;
+ }
+ *bp++ = '\0';
+ ne_num++;
+ }
+
+ if (!(n = X509_NAME_new()))
+ goto error;
+
+ for (i = 0; i < ne_num; i++) {
+ if ((nid = OBJ_txt2nid(ne_types[i])) == NID_undef) {
+ BIO_printf(bio_err,
+ "Subject Attribute %s has no known NID, skipped\n",
+ ne_types[i]);
+ continue;
+ }
+
+ if (!*ne_values[i]) {
+ BIO_printf(bio_err,
+ "No value provided for Subject Attribute %s, skipped\n",
+ ne_types[i]);
+ continue;
+ }
+
+ if (!X509_NAME_add_entry_by_NID
+ (n, nid, chtype, (unsigned char *)ne_values[i], -1, -1, mval[i]))
+ goto error;
+ }
+
+ OPENSSL_free(ne_values);
+ OPENSSL_free(ne_types);
+ OPENSSL_free(buf);
+ OPENSSL_free(mval);
+ return n;
+
+ error:
+ X509_NAME_free(n);
+ if (ne_values)
+ OPENSSL_free(ne_values);
+ if (ne_types)
+ OPENSSL_free(ne_types);
+ if (mval)
+ OPENSSL_free(mval);
+ if (buf)
+ OPENSSL_free(buf);
+ return NULL;
}
int args_verify(char ***pargs, int *pargc,
- int *badarg, BIO *err, X509_VERIFY_PARAM **pm)
- {
- ASN1_OBJECT *otmp = NULL;
- unsigned long flags = 0;
- int i;
- int purpose = 0, depth = -1;
- char **oldargs = *pargs;
- char *arg = **pargs, *argn = (*pargs)[1];
- time_t at_time = 0;
- if (!strcmp(arg, "-policy"))
- {
- if (!argn)
- *badarg = 1;
- else
- {
- otmp = OBJ_txt2obj(argn, 0);
- if (!otmp)
- {
- BIO_printf(err, "Invalid Policy \"%s\"\n",
- argn);
- *badarg = 1;
- }
- }
- (*pargs)++;
- }
- else if (strcmp(arg,"-purpose") == 0)
- {
- X509_PURPOSE *xptmp;
- if (!argn)
- *badarg = 1;
- else
- {
- i = X509_PURPOSE_get_by_sname(argn);
- if(i < 0)
- {
- BIO_printf(err, "unrecognized purpose\n");
- *badarg = 1;
- }
- else
- {
- xptmp = X509_PURPOSE_get0(i);
- purpose = X509_PURPOSE_get_id(xptmp);
- }
- }
- (*pargs)++;
- }
- else if (strcmp(arg,"-verify_depth") == 0)
- {
- if (!argn)
- *badarg = 1;
- else
- {
- depth = atoi(argn);
- if(depth < 0)
- {
- BIO_printf(err, "invalid depth\n");
- *badarg = 1;
- }
- }
- (*pargs)++;
- }
- else if (strcmp(arg,"-attime") == 0)
- {
- if (!argn)
- *badarg = 1;
- else
- {
- long timestamp;
- /* interpret the -attime argument as seconds since
- * Epoch */
- if (sscanf(argn, "%li", &timestamp) != 1)
- {
- BIO_printf(bio_err,
- "Error parsing timestamp %s\n",
- argn);
- *badarg = 1;
- }
- /* on some platforms time_t may be a float */
- at_time = (time_t) timestamp;
- }
- (*pargs)++;
- }
- else if (!strcmp(arg, "-ignore_critical"))
- flags |= X509_V_FLAG_IGNORE_CRITICAL;
- else if (!strcmp(arg, "-issuer_checks"))
- flags |= X509_V_FLAG_CB_ISSUER_CHECK;
- else if (!strcmp(arg, "-crl_check"))
- flags |= X509_V_FLAG_CRL_CHECK;
- else if (!strcmp(arg, "-crl_check_all"))
- flags |= X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL;
- else if (!strcmp(arg, "-policy_check"))
- flags |= X509_V_FLAG_POLICY_CHECK;
- else if (!strcmp(arg, "-explicit_policy"))
- flags |= X509_V_FLAG_EXPLICIT_POLICY;
- else if (!strcmp(arg, "-inhibit_any"))
- flags |= X509_V_FLAG_INHIBIT_ANY;
- else if (!strcmp(arg, "-inhibit_map"))
- flags |= X509_V_FLAG_INHIBIT_MAP;
- else if (!strcmp(arg, "-x509_strict"))
- flags |= X509_V_FLAG_X509_STRICT;
- else if (!strcmp(arg, "-extended_crl"))
- flags |= X509_V_FLAG_EXTENDED_CRL_SUPPORT;
- else if (!strcmp(arg, "-use_deltas"))
- flags |= X509_V_FLAG_USE_DELTAS;
- else if (!strcmp(arg, "-policy_print"))
- flags |= X509_V_FLAG_NOTIFY_POLICY;
- else if (!strcmp(arg, "-check_ss_sig"))
- flags |= X509_V_FLAG_CHECK_SS_SIGNATURE;
- else
- return 0;
-
- if (*badarg)
- {
- if (*pm)
- X509_VERIFY_PARAM_free(*pm);
- *pm = NULL;
- goto end;
- }
-
- if (!*pm && !(*pm = X509_VERIFY_PARAM_new()))
- {
- *badarg = 1;
- goto end;
- }
-
- if (otmp)
- X509_VERIFY_PARAM_add0_policy(*pm, otmp);
- if (flags)
- X509_VERIFY_PARAM_set_flags(*pm, flags);
-
- if (purpose)
- X509_VERIFY_PARAM_set_purpose(*pm, purpose);
-
- if (depth >= 0)
- X509_VERIFY_PARAM_set_depth(*pm, depth);
-
- if (at_time)
- X509_VERIFY_PARAM_set_time(*pm, at_time);
-
- end:
-
- (*pargs)++;
-
- if (pargc)
- *pargc -= *pargs - oldargs;
-
- return 1;
-
- }
-
-/* Read whole contents of a BIO into an allocated memory buffer and
- * return it.
+ int *badarg, BIO *err, X509_VERIFY_PARAM **pm)
+{
+ ASN1_OBJECT *otmp = NULL;
+ unsigned long flags = 0;
+ int i;
+ int purpose = 0, depth = -1;
+ char **oldargs = *pargs;
+ char *arg = **pargs, *argn = (*pargs)[1];
+ time_t at_time = 0;
+ if (!strcmp(arg, "-policy")) {
+ if (!argn)
+ *badarg = 1;
+ else {
+ otmp = OBJ_txt2obj(argn, 0);
+ if (!otmp) {
+ BIO_printf(err, "Invalid Policy \"%s\"\n", argn);
+ *badarg = 1;
+ }
+ }
+ (*pargs)++;
+ } else if (strcmp(arg, "-purpose") == 0) {
+ X509_PURPOSE *xptmp;
+ if (!argn)
+ *badarg = 1;
+ else {
+ i = X509_PURPOSE_get_by_sname(argn);
+ if (i < 0) {
+ BIO_printf(err, "unrecognized purpose\n");
+ *badarg = 1;
+ } else {
+ xptmp = X509_PURPOSE_get0(i);
+ purpose = X509_PURPOSE_get_id(xptmp);
+ }
+ }
+ (*pargs)++;
+ } else if (strcmp(arg, "-verify_depth") == 0) {
+ if (!argn)
+ *badarg = 1;
+ else {
+ depth = atoi(argn);
+ if (depth < 0) {
+ BIO_printf(err, "invalid depth\n");
+ *badarg = 1;
+ }
+ }
+ (*pargs)++;
+ } else if (strcmp(arg, "-attime") == 0) {
+ if (!argn)
+ *badarg = 1;
+ else {
+ long timestamp;
+ /*
+ * interpret the -attime argument as seconds since Epoch
+ */
+ if (sscanf(argn, "%li", &timestamp) != 1) {
+ BIO_printf(bio_err, "Error parsing timestamp %s\n", argn);
+ *badarg = 1;
+ }
+ /* on some platforms time_t may be a float */
+ at_time = (time_t)timestamp;
+ }
+ (*pargs)++;
+ } else if (!strcmp(arg, "-ignore_critical"))
+ flags |= X509_V_FLAG_IGNORE_CRITICAL;
+ else if (!strcmp(arg, "-issuer_checks"))
+ flags |= X509_V_FLAG_CB_ISSUER_CHECK;
+ else if (!strcmp(arg, "-crl_check"))
+ flags |= X509_V_FLAG_CRL_CHECK;
+ else if (!strcmp(arg, "-crl_check_all"))
+ flags |= X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL;
+ else if (!strcmp(arg, "-policy_check"))
+ flags |= X509_V_FLAG_POLICY_CHECK;
+ else if (!strcmp(arg, "-explicit_policy"))
+ flags |= X509_V_FLAG_EXPLICIT_POLICY;
+ else if (!strcmp(arg, "-inhibit_any"))
+ flags |= X509_V_FLAG_INHIBIT_ANY;
+ else if (!strcmp(arg, "-inhibit_map"))
+ flags |= X509_V_FLAG_INHIBIT_MAP;
+ else if (!strcmp(arg, "-x509_strict"))
+ flags |= X509_V_FLAG_X509_STRICT;
+ else if (!strcmp(arg, "-extended_crl"))
+ flags |= X509_V_FLAG_EXTENDED_CRL_SUPPORT;
+ else if (!strcmp(arg, "-use_deltas"))
+ flags |= X509_V_FLAG_USE_DELTAS;
+ else if (!strcmp(arg, "-policy_print"))
+ flags |= X509_V_FLAG_NOTIFY_POLICY;
+ else if (!strcmp(arg, "-check_ss_sig"))
+ flags |= X509_V_FLAG_CHECK_SS_SIGNATURE;
+ else
+ return 0;
+
+ if (*badarg) {
+ if (*pm)
+ X509_VERIFY_PARAM_free(*pm);
+ *pm = NULL;
+ goto end;
+ }
+
+ if (!*pm && !(*pm = X509_VERIFY_PARAM_new())) {
+ *badarg = 1;
+ goto end;
+ }
+
+ if (otmp)
+ X509_VERIFY_PARAM_add0_policy(*pm, otmp);
+ if (flags)
+ X509_VERIFY_PARAM_set_flags(*pm, flags);
+
+ if (purpose)
+ X509_VERIFY_PARAM_set_purpose(*pm, purpose);
+
+ if (depth >= 0)
+ X509_VERIFY_PARAM_set_depth(*pm, depth);
+
+ if (at_time)
+ X509_VERIFY_PARAM_set_time(*pm, at_time);
+
+ end:
+
+ (*pargs)++;
+
+ if (pargc)
+ *pargc -= *pargs - oldargs;
+
+ return 1;
+
+}
+
+/*
+ * Read whole contents of a BIO into an allocated memory buffer and return
+ * it.
*/
int bio_to_mem(unsigned char **out, int maxlen, BIO *in)
- {
- BIO *mem;
- int len, ret;
- unsigned char tbuf[1024];
- mem = BIO_new(BIO_s_mem());
- if (!mem)
- return -1;
- for(;;)
- {
- if ((maxlen != -1) && maxlen < 1024)
- len = maxlen;
- else
- len = 1024;
- len = BIO_read(in, tbuf, len);
- if (len <= 0)
- break;
- if (BIO_write(mem, tbuf, len) != len)
- {
- BIO_free(mem);
- return -1;
- }
- maxlen -= len;
-
- if (maxlen == 0)
- break;
- }
- ret = BIO_get_mem_data(mem, (char **)out);
- BIO_set_flags(mem, BIO_FLAGS_MEM_RDONLY);
- BIO_free(mem);
- return ret;
- }
+{
+ BIO *mem;
+ int len, ret;
+ unsigned char tbuf[1024];
+ mem = BIO_new(BIO_s_mem());
+ if (!mem)
+ return -1;
+ for (;;) {
+ if ((maxlen != -1) && maxlen < 1024)
+ len = maxlen;
+ else
+ len = 1024;
+ len = BIO_read(in, tbuf, len);
+ if (len <= 0)
+ break;
+ if (BIO_write(mem, tbuf, len) != len) {
+ BIO_free(mem);
+ return -1;
+ }
+ maxlen -= len;
+
+ if (maxlen == 0)
+ break;
+ }
+ ret = BIO_get_mem_data(mem, (char **)out);
+ BIO_set_flags(mem, BIO_FLAGS_MEM_RDONLY);
+ BIO_free(mem);
+ return ret;
+}
int pkey_ctrl_string(EVP_PKEY_CTX *ctx, char *value)
- {
- int rv;
- char *stmp, *vtmp = NULL;
- stmp = BUF_strdup(value);
- if (!stmp)
- return -1;
- vtmp = strchr(stmp, ':');
- if (vtmp)
- {
- *vtmp = 0;
- vtmp++;
- }
- rv = EVP_PKEY_CTX_ctrl_str(ctx, stmp, vtmp);
- OPENSSL_free(stmp);
- return rv;
- }
+{
+ int rv;
+ char *stmp, *vtmp = NULL;
+ stmp = BUF_strdup(value);
+ if (!stmp)
+ return -1;
+ vtmp = strchr(stmp, ':');
+ if (vtmp) {
+ *vtmp = 0;
+ vtmp++;
+ }
+ rv = EVP_PKEY_CTX_ctrl_str(ctx, stmp, vtmp);
+ OPENSSL_free(stmp);
+ return rv;
+}
static void nodes_print(BIO *out, const char *name,
- STACK_OF(X509_POLICY_NODE) *nodes)
- {
- X509_POLICY_NODE *node;
- int i;
- BIO_printf(out, "%s Policies:", name);
- if (nodes)
- {
- BIO_puts(out, "\n");
- for (i = 0; i < sk_X509_POLICY_NODE_num(nodes); i++)
- {
- node = sk_X509_POLICY_NODE_value(nodes, i);
- X509_POLICY_NODE_print(out, node, 2);
- }
- }
- else
- BIO_puts(out, " <empty>\n");
- }
+ STACK_OF(X509_POLICY_NODE) *nodes)
+{
+ X509_POLICY_NODE *node;
+ int i;
+ BIO_printf(out, "%s Policies:", name);
+ if (nodes) {
+ BIO_puts(out, "\n");
+ for (i = 0; i < sk_X509_POLICY_NODE_num(nodes); i++) {
+ node = sk_X509_POLICY_NODE_value(nodes, i);
+ X509_POLICY_NODE_print(out, node, 2);
+ }
+ } else
+ BIO_puts(out, " <empty>\n");
+}
void policies_print(BIO *out, X509_STORE_CTX *ctx)
- {
- X509_POLICY_TREE *tree;
- int explicit_policy;
- int free_out = 0;
- if (out == NULL)
- {
- out = BIO_new_fp(stderr, BIO_NOCLOSE);
- free_out = 1;
- }
- tree = X509_STORE_CTX_get0_policy_tree(ctx);
- explicit_policy = X509_STORE_CTX_get_explicit_policy(ctx);
-
- BIO_printf(out, "Require explicit Policy: %s\n",
- explicit_policy ? "True" : "False");
-
- nodes_print(out, "Authority", X509_policy_tree_get0_policies(tree));
- nodes_print(out, "User", X509_policy_tree_get0_user_policies(tree));
- if (free_out)
- BIO_free(out);
- }
+{
+ X509_POLICY_TREE *tree;
+ int explicit_policy;
+ int free_out = 0;
+ if (out == NULL) {
+ out = BIO_new_fp(stderr, BIO_NOCLOSE);
+ free_out = 1;
+ }
+ tree = X509_STORE_CTX_get0_policy_tree(ctx);
+ explicit_policy = X509_STORE_CTX_get_explicit_policy(ctx);
+
+ BIO_printf(out, "Require explicit Policy: %s\n",
+ explicit_policy ? "True" : "False");
+
+ nodes_print(out, "Authority", X509_policy_tree_get0_policies(tree));
+ nodes_print(out, "User", X509_policy_tree_get0_user_policies(tree));
+ if (free_out)
+ BIO_free(out);
+}
#if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
static JPAKE_CTX *jpake_init(const char *us, const char *them,
- const char *secret)
- {
- BIGNUM *p = NULL;
- BIGNUM *g = NULL;
- BIGNUM *q = NULL;
- BIGNUM *bnsecret = BN_new();
- JPAKE_CTX *ctx;
-
- /* Use a safe prime for p (that we found earlier) */
- BN_hex2bn(&p, "F9E5B365665EA7A05A9C534502780FEE6F1AB5BD4F49947FD036DBD7E905269AF46EF28B0FC07487EE4F5D20FB3C0AF8E700F3A2FA3414970CBED44FEDFF80CE78D800F184BB82435D137AADA2C6C16523247930A63B85661D1FC817A51ACD96168E95898A1F83A79FFB529368AA7833ABD1B0C3AEDDB14D2E1A2F71D99F763F");
- g = BN_new();
- BN_set_word(g, 2);
- q = BN_new();
- BN_rshift1(q, p);
-
- BN_bin2bn((const unsigned char *)secret, strlen(secret), bnsecret);
-
- ctx = JPAKE_CTX_new(us, them, p, g, q, bnsecret);
- BN_free(bnsecret);
- BN_free(q);
- BN_free(g);
- BN_free(p);
-
- return ctx;
- }
+ const char *secret)
+{
+ BIGNUM *p = NULL;
+ BIGNUM *g = NULL;
+ BIGNUM *q = NULL;
+ BIGNUM *bnsecret = BN_new();
+ JPAKE_CTX *ctx;
+
+ /* Use a safe prime for p (that we found earlier) */
+ BN_hex2bn(&p,
+ "F9E5B365665EA7A05A9C534502780FEE6F1AB5BD4F49947FD036DBD7E905269AF46EF28B0FC07487EE4F5D20FB3C0AF8E700F3A2FA3414970CBED44FEDFF80CE78D800F184BB82435D137AADA2C6C16523247930A63B85661D1FC817A51ACD96168E95898A1F83A79FFB529368AA7833ABD1B0C3AEDDB14D2E1A2F71D99F763F");
+ g = BN_new();
+ BN_set_word(g, 2);
+ q = BN_new();
+ BN_rshift1(q, p);
+
+ BN_bin2bn((const unsigned char *)secret, strlen(secret), bnsecret);
+
+ ctx = JPAKE_CTX_new(us, them, p, g, q, bnsecret);
+ BN_free(bnsecret);
+ BN_free(q);
+ BN_free(g);
+ BN_free(p);
+
+ return ctx;
+}
static void jpake_send_part(BIO *conn, const JPAKE_STEP_PART *p)
- {
- BN_print(conn, p->gx);
- BIO_puts(conn, "\n");
- BN_print(conn, p->zkpx.gr);
- BIO_puts(conn, "\n");
- BN_print(conn, p->zkpx.b);
- BIO_puts(conn, "\n");
- }
+{
+ BN_print(conn, p->gx);
+ BIO_puts(conn, "\n");
+ BN_print(conn, p->zkpx.gr);
+ BIO_puts(conn, "\n");
+ BN_print(conn, p->zkpx.b);
+ BIO_puts(conn, "\n");
+}
static void jpake_send_step1(BIO *bconn, JPAKE_CTX *ctx)
- {
- JPAKE_STEP1 s1;
-
- JPAKE_STEP1_init(&s1);
- JPAKE_STEP1_generate(&s1, ctx);
- jpake_send_part(bconn, &s1.p1);
- jpake_send_part(bconn, &s1.p2);
- (void)BIO_flush(bconn);
- JPAKE_STEP1_release(&s1);
- }
+{
+ JPAKE_STEP1 s1;
+
+ JPAKE_STEP1_init(&s1);
+ JPAKE_STEP1_generate(&s1, ctx);
+ jpake_send_part(bconn, &s1.p1);
+ jpake_send_part(bconn, &s1.p2);
+ (void)BIO_flush(bconn);
+ JPAKE_STEP1_release(&s1);
+}
static void jpake_send_step2(BIO *bconn, JPAKE_CTX *ctx)
- {
- JPAKE_STEP2 s2;
+{
+ JPAKE_STEP2 s2;
- JPAKE_STEP2_init(&s2);
- JPAKE_STEP2_generate(&s2, ctx);
- jpake_send_part(bconn, &s2);
- (void)BIO_flush(bconn);
- JPAKE_STEP2_release(&s2);
- }
+ JPAKE_STEP2_init(&s2);
+ JPAKE_STEP2_generate(&s2, ctx);
+ jpake_send_part(bconn, &s2);
+ (void)BIO_flush(bconn);
+ JPAKE_STEP2_release(&s2);
+}
static void jpake_send_step3a(BIO *bconn, JPAKE_CTX *ctx)
- {
- JPAKE_STEP3A s3a;
+{
+ JPAKE_STEP3A s3a;
- JPAKE_STEP3A_init(&s3a);
- JPAKE_STEP3A_generate(&s3a, ctx);
- BIO_write(bconn, s3a.hhk, sizeof s3a.hhk);
- (void)BIO_flush(bconn);
- JPAKE_STEP3A_release(&s3a);
- }
+ JPAKE_STEP3A_init(&s3a);
+ JPAKE_STEP3A_generate(&s3a, ctx);
+ BIO_write(bconn, s3a.hhk, sizeof s3a.hhk);
+ (void)BIO_flush(bconn);
+ JPAKE_STEP3A_release(&s3a);
+}
static void jpake_send_step3b(BIO *bconn, JPAKE_CTX *ctx)
- {
- JPAKE_STEP3B s3b;
+{
+ JPAKE_STEP3B s3b;
- JPAKE_STEP3B_init(&s3b);
- JPAKE_STEP3B_generate(&s3b, ctx);
- BIO_write(bconn, s3b.hk, sizeof s3b.hk);
- (void)BIO_flush(bconn);
- JPAKE_STEP3B_release(&s3b);
- }
+ JPAKE_STEP3B_init(&s3b);
+ JPAKE_STEP3B_generate(&s3b, ctx);
+ BIO_write(bconn, s3b.hk, sizeof s3b.hk);
+ (void)BIO_flush(bconn);
+ JPAKE_STEP3B_release(&s3b);
+}
static void readbn(BIGNUM **bn, BIO *bconn)
- {
- char buf[10240];
- int l;
-
- l = BIO_gets(bconn, buf, sizeof buf);
- assert(l > 0);
- assert(buf[l-1] == '\n');
- buf[l-1] = '\0';
- BN_hex2bn(bn, buf);
- }
+{
+ char buf[10240];
+ int l;
+
+ l = BIO_gets(bconn, buf, sizeof buf);
+ assert(l > 0);
+ assert(buf[l - 1] == '\n');
+ buf[l - 1] = '\0';
+ BN_hex2bn(bn, buf);
+}
static void jpake_receive_part(JPAKE_STEP_PART *p, BIO *bconn)
- {
- readbn(&p->gx, bconn);
- readbn(&p->zkpx.gr, bconn);
- readbn(&p->zkpx.b, bconn);
- }
+{
+ readbn(&p->gx, bconn);
+ readbn(&p->zkpx.gr, bconn);
+ readbn(&p->zkpx.b, bconn);
+}
static void jpake_receive_step1(JPAKE_CTX *ctx, BIO *bconn)
- {
- JPAKE_STEP1 s1;
-
- JPAKE_STEP1_init(&s1);
- jpake_receive_part(&s1.p1, bconn);
- jpake_receive_part(&s1.p2, bconn);
- if(!JPAKE_STEP1_process(ctx, &s1))
- {
- ERR_print_errors(bio_err);
- exit(1);
- }
- JPAKE_STEP1_release(&s1);
- }
+{
+ JPAKE_STEP1 s1;
+
+ JPAKE_STEP1_init(&s1);
+ jpake_receive_part(&s1.p1, bconn);
+ jpake_receive_part(&s1.p2, bconn);
+ if (!JPAKE_STEP1_process(ctx, &s1)) {
+ ERR_print_errors(bio_err);
+ exit(1);
+ }
+ JPAKE_STEP1_release(&s1);
+}
static void jpake_receive_step2(JPAKE_CTX *ctx, BIO *bconn)
- {
- JPAKE_STEP2 s2;
-
- JPAKE_STEP2_init(&s2);
- jpake_receive_part(&s2, bconn);
- if(!JPAKE_STEP2_process(ctx, &s2))
- {
- ERR_print_errors(bio_err);
- exit(1);
- }
- JPAKE_STEP2_release(&s2);
- }
+{
+ JPAKE_STEP2 s2;
+
+ JPAKE_STEP2_init(&s2);
+ jpake_receive_part(&s2, bconn);
+ if (!JPAKE_STEP2_process(ctx, &s2)) {
+ ERR_print_errors(bio_err);
+ exit(1);
+ }
+ JPAKE_STEP2_release(&s2);
+}
static void jpake_receive_step3a(JPAKE_CTX *ctx, BIO *bconn)
- {
- JPAKE_STEP3A s3a;
- int l;
-
- JPAKE_STEP3A_init(&s3a);
- l = BIO_read(bconn, s3a.hhk, sizeof s3a.hhk);
- assert(l == sizeof s3a.hhk);
- if(!JPAKE_STEP3A_process(ctx, &s3a))
- {
- ERR_print_errors(bio_err);
- exit(1);
- }
- JPAKE_STEP3A_release(&s3a);
- }
+{
+ JPAKE_STEP3A s3a;
+ int l;
+
+ JPAKE_STEP3A_init(&s3a);
+ l = BIO_read(bconn, s3a.hhk, sizeof s3a.hhk);
+ assert(l == sizeof s3a.hhk);
+ if (!JPAKE_STEP3A_process(ctx, &s3a)) {
+ ERR_print_errors(bio_err);
+ exit(1);
+ }
+ JPAKE_STEP3A_release(&s3a);
+}
static void jpake_receive_step3b(JPAKE_CTX *ctx, BIO *bconn)
- {
- JPAKE_STEP3B s3b;
- int l;
-
- JPAKE_STEP3B_init(&s3b);
- l = BIO_read(bconn, s3b.hk, sizeof s3b.hk);
- assert(l == sizeof s3b.hk);
- if(!JPAKE_STEP3B_process(ctx, &s3b))
- {
- ERR_print_errors(bio_err);
- exit(1);
- }
- JPAKE_STEP3B_release(&s3b);
- }
+{
+ JPAKE_STEP3B s3b;
+ int l;
+
+ JPAKE_STEP3B_init(&s3b);
+ l = BIO_read(bconn, s3b.hk, sizeof s3b.hk);
+ assert(l == sizeof s3b.hk);
+ if (!JPAKE_STEP3B_process(ctx, &s3b)) {
+ ERR_print_errors(bio_err);
+ exit(1);
+ }
+ JPAKE_STEP3B_release(&s3b);
+}
void jpake_client_auth(BIO *out, BIO *conn, const char *secret)
- {
- JPAKE_CTX *ctx;
- BIO *bconn;
+{
+ JPAKE_CTX *ctx;
+ BIO *bconn;
- BIO_puts(out, "Authenticating with JPAKE\n");
+ BIO_puts(out, "Authenticating with JPAKE\n");
- ctx = jpake_init("client", "server", secret);
+ ctx = jpake_init("client", "server", secret);
- bconn = BIO_new(BIO_f_buffer());
- BIO_push(bconn, conn);
+ bconn = BIO_new(BIO_f_buffer());
+ BIO_push(bconn, conn);
- jpake_send_step1(bconn, ctx);
- jpake_receive_step1(ctx, bconn);
- jpake_send_step2(bconn, ctx);
- jpake_receive_step2(ctx, bconn);
- jpake_send_step3a(bconn, ctx);
- jpake_receive_step3b(ctx, bconn);
+ jpake_send_step1(bconn, ctx);
+ jpake_receive_step1(ctx, bconn);
+ jpake_send_step2(bconn, ctx);
+ jpake_receive_step2(ctx, bconn);
+ jpake_send_step3a(bconn, ctx);
+ jpake_receive_step3b(ctx, bconn);
- BIO_puts(out, "JPAKE authentication succeeded, setting PSK\n");
+ BIO_puts(out, "JPAKE authentication succeeded, setting PSK\n");
- psk_key = BN_bn2hex(JPAKE_get_shared_key(ctx));
+ psk_key = BN_bn2hex(JPAKE_get_shared_key(ctx));
- BIO_pop(bconn);
- BIO_free(bconn);
+ BIO_pop(bconn);
+ BIO_free(bconn);
- JPAKE_CTX_free(ctx);
- }
+ JPAKE_CTX_free(ctx);
+}
void jpake_server_auth(BIO *out, BIO *conn, const char *secret)
- {
- JPAKE_CTX *ctx;
- BIO *bconn;
+{
+ JPAKE_CTX *ctx;
+ BIO *bconn;
- BIO_puts(out, "Authenticating with JPAKE\n");
+ BIO_puts(out, "Authenticating with JPAKE\n");
- ctx = jpake_init("server", "client", secret);
+ ctx = jpake_init("server", "client", secret);
- bconn = BIO_new(BIO_f_buffer());
- BIO_push(bconn, conn);
+ bconn = BIO_new(BIO_f_buffer());
+ BIO_push(bconn, conn);
- jpake_receive_step1(ctx, bconn);
- jpake_send_step1(bconn, ctx);
- jpake_receive_step2(ctx, bconn);
- jpake_send_step2(bconn, ctx);
- jpake_receive_step3a(ctx, bconn);
- jpake_send_step3b(bconn, ctx);
+ jpake_receive_step1(ctx, bconn);
+ jpake_send_step1(bconn, ctx);
+ jpake_receive_step2(ctx, bconn);
+ jpake_send_step2(bconn, ctx);
+ jpake_receive_step3a(ctx, bconn);
+ jpake_send_step3b(bconn, ctx);
- BIO_puts(out, "JPAKE authentication succeeded, setting PSK\n");
+ BIO_puts(out, "JPAKE authentication succeeded, setting PSK\n");
- psk_key = BN_bn2hex(JPAKE_get_shared_key(ctx));
+ psk_key = BN_bn2hex(JPAKE_get_shared_key(ctx));
- BIO_pop(bconn);
- BIO_free(bconn);
+ BIO_pop(bconn);
+ BIO_free(bconn);
- JPAKE_CTX_free(ctx);
- }
+ JPAKE_CTX_free(ctx);
+}
#endif
#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
-/* next_protos_parse parses a comma separated list of strings into a string
+/*-
+ * next_protos_parse parses a comma separated list of strings into a string
* in a format suitable for passing to SSL_CTX_set_next_protos_advertised.
* outlen: (output) set to the length of the resulting buffer on success.
* err: (maybe NULL) on failure, an error message line is written to this BIO.
@@ -2737,39 +2600,36 @@ void jpake_server_auth(BIO *out, BIO *conn, const char *secret)
* returns: a malloced buffer or NULL on failure.
*/
unsigned char *next_protos_parse(unsigned short *outlen, const char *in)
- {
- size_t len;
- unsigned char *out;
- size_t i, start = 0;
-
- len = strlen(in);
- if (len >= 65535)
- return NULL;
-
- out = OPENSSL_malloc(strlen(in) + 1);
- if (!out)
- return NULL;
-
- for (i = 0; i <= len; ++i)
- {
- if (i == len || in[i] == ',')
- {
- if (i - start > 255)
- {
- OPENSSL_free(out);
- return NULL;
- }
- out[start] = i - start;
- start = i + 1;
- }
- else
- out[i+1] = in[i];
- }
-
- *outlen = len + 1;
- return out;
- }
-#endif /* !OPENSSL_NO_TLSEXT && !OPENSSL_NO_NEXTPROTONEG */
+{
+ size_t len;
+ unsigned char *out;
+ size_t i, start = 0;
+
+ len = strlen(in);
+ if (len >= 65535)
+ return NULL;
+
+ out = OPENSSL_malloc(strlen(in) + 1);
+ if (!out)
+ return NULL;
+
+ for (i = 0; i <= len; ++i) {
+ if (i == len || in[i] == ',') {
+ if (i - start > 255) {
+ OPENSSL_free(out);
+ return NULL;
+ }
+ out[start] = i - start;
+ start = i + 1;
+ } else
+ out[i + 1] = in[i];
+ }
+
+ *outlen = len + 1;
+ return out;
+}
+#endif /* !OPENSSL_NO_TLSEXT &&
+ * !OPENSSL_NO_NEXTPROTONEG */
/*
* Platform-specific sections
@@ -2784,315 +2644,332 @@ unsigned char *next_protos_parse(unsigned short *outlen, const char *in)
# include <tchar.h>
static int WIN32_rename(const char *from, const char *to)
- {
- TCHAR *tfrom=NULL,*tto;
- DWORD err;
- int ret=0;
-
- if (sizeof(TCHAR) == 1)
- {
- tfrom = (TCHAR *)from;
- tto = (TCHAR *)to;
- }
- else /* UNICODE path */
- {
- size_t i,flen=strlen(from)+1,tlen=strlen(to)+1;
- tfrom = (TCHAR *)malloc(sizeof(TCHAR)*(flen+tlen));
- if (tfrom==NULL) goto err;
- tto=tfrom+flen;
-#if !defined(_WIN32_WCE) || _WIN32_WCE>=101
- if (!MultiByteToWideChar(CP_ACP,0,from,flen,(WCHAR *)tfrom,flen))
-#endif
- for (i=0;i<flen;i++) tfrom[i]=(TCHAR)from[i];
-#if !defined(_WIN32_WCE) || _WIN32_WCE>=101
- if (!MultiByteToWideChar(CP_ACP,0,to, tlen,(WCHAR *)tto, tlen))
-#endif
- for (i=0;i<tlen;i++) tto[i] =(TCHAR)to[i];
- }
-
- if (MoveFile(tfrom,tto)) goto ok;
- err=GetLastError();
- if (err==ERROR_ALREADY_EXISTS || err==ERROR_FILE_EXISTS)
- {
- if (DeleteFile(tto) && MoveFile(tfrom,tto))
- goto ok;
- err=GetLastError();
- }
- if (err==ERROR_FILE_NOT_FOUND || err==ERROR_PATH_NOT_FOUND)
- errno = ENOENT;
- else if (err==ERROR_ACCESS_DENIED)
- errno = EACCES;
- else
- errno = EINVAL; /* we could map more codes... */
-err:
- ret=-1;
-ok:
- if (tfrom!=NULL && tfrom!=(TCHAR *)from) free(tfrom);
- return ret;
- }
+{
+ TCHAR *tfrom = NULL, *tto;
+ DWORD err;
+ int ret = 0;
+
+ if (sizeof(TCHAR) == 1) {
+ tfrom = (TCHAR *)from;
+ tto = (TCHAR *)to;
+ } else { /* UNICODE path */
+
+ size_t i, flen = strlen(from) + 1, tlen = strlen(to) + 1;
+ tfrom = (TCHAR *)malloc(sizeof(TCHAR) * (flen + tlen));
+ if (tfrom == NULL)
+ goto err;
+ tto = tfrom + flen;
+# if !defined(_WIN32_WCE) || _WIN32_WCE>=101
+ if (!MultiByteToWideChar(CP_ACP, 0, from, flen, (WCHAR *)tfrom, flen))
+# endif
+ for (i = 0; i < flen; i++)
+ tfrom[i] = (TCHAR)from[i];
+# if !defined(_WIN32_WCE) || _WIN32_WCE>=101
+ if (!MultiByteToWideChar(CP_ACP, 0, to, tlen, (WCHAR *)tto, tlen))
+# endif
+ for (i = 0; i < tlen; i++)
+ tto[i] = (TCHAR)to[i];
+ }
+
+ if (MoveFile(tfrom, tto))
+ goto ok;
+ err = GetLastError();
+ if (err == ERROR_ALREADY_EXISTS || err == ERROR_FILE_EXISTS) {
+ if (DeleteFile(tto) && MoveFile(tfrom, tto))
+ goto ok;
+ err = GetLastError();
+ }
+ if (err == ERROR_FILE_NOT_FOUND || err == ERROR_PATH_NOT_FOUND)
+ errno = ENOENT;
+ else if (err == ERROR_ACCESS_DENIED)
+ errno = EACCES;
+ else
+ errno = EINVAL; /* we could map more codes... */
+ err:
+ ret = -1;
+ ok:
+ if (tfrom != NULL && tfrom != (TCHAR *)from)
+ free(tfrom);
+ return ret;
+}
#endif
/* app_tminterval section */
#if defined(_WIN32)
-double app_tminterval(int stop,int usertime)
- {
- FILETIME now;
- double ret=0;
- static ULARGE_INTEGER tmstart;
- static int warning=1;
-#ifdef _WIN32_WINNT
- static HANDLE proc=NULL;
-
- if (proc==NULL)
- {
- if (check_winnt())
- proc = OpenProcess(PROCESS_QUERY_INFORMATION,FALSE,
- GetCurrentProcessId());
- if (proc==NULL) proc = (HANDLE)-1;
- }
-
- if (usertime && proc!=(HANDLE)-1)
- {
- FILETIME junk;
- GetProcessTimes(proc,&junk,&junk,&junk,&now);
- }
- else
-#endif
- {
- SYSTEMTIME systime;
-
- if (usertime && warning)
- {
- BIO_printf(bio_err,"To get meaningful results, run "
- "this program on idle system.\n");
- warning=0;
- }
- GetSystemTime(&systime);
- SystemTimeToFileTime(&systime,&now);
- }
-
- if (stop==TM_START)
- {
- tmstart.u.LowPart = now.dwLowDateTime;
- tmstart.u.HighPart = now.dwHighDateTime;
- }
- else {
- ULARGE_INTEGER tmstop;
-
- tmstop.u.LowPart = now.dwLowDateTime;
- tmstop.u.HighPart = now.dwHighDateTime;
-
- ret = (__int64)(tmstop.QuadPart - tmstart.QuadPart)*1e-7;
- }
-
- return (ret);
- }
-
-#elif defined(OPENSSL_SYS_NETWARE)
-#include <time.h>
-
-double app_tminterval(int stop,int usertime)
- {
- double ret=0;
- static clock_t tmstart;
- static int warning=1;
+double app_tminterval(int stop, int usertime)
+{
+ FILETIME now;
+ double ret = 0;
+ static ULARGE_INTEGER tmstart;
+ static int warning = 1;
+# ifdef _WIN32_WINNT
+ static HANDLE proc = NULL;
+
+ if (proc == NULL) {
+ if (check_winnt())
+ proc = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE,
+ GetCurrentProcessId());
+ if (proc == NULL)
+ proc = (HANDLE) - 1;
+ }
+
+ if (usertime && proc != (HANDLE) - 1) {
+ FILETIME junk;
+ GetProcessTimes(proc, &junk, &junk, &junk, &now);
+ } else
+# endif
+ {
+ SYSTEMTIME systime;
- if (usertime && warning)
- {
- BIO_printf(bio_err,"To get meaningful results, run "
- "this program on idle system.\n");
- warning=0;
- }
+ if (usertime && warning) {
+ BIO_printf(bio_err, "To get meaningful results, run "
+ "this program on idle system.\n");
+ warning = 0;
+ }
+ GetSystemTime(&systime);
+ SystemTimeToFileTime(&systime, &now);
+ }
- if (stop==TM_START) tmstart = clock();
- else ret = (clock()-tmstart)/(double)CLOCKS_PER_SEC;
+ if (stop == TM_START) {
+ tmstart.u.LowPart = now.dwLowDateTime;
+ tmstart.u.HighPart = now.dwHighDateTime;
+ } else {
+ ULARGE_INTEGER tmstop;
- return (ret);
- }
+ tmstop.u.LowPart = now.dwLowDateTime;
+ tmstop.u.HighPart = now.dwHighDateTime;
-#elif defined(OPENSSL_SYSTEM_VXWORKS)
-#include <time.h>
-
-double app_tminterval(int stop,int usertime)
- {
- double ret=0;
-#ifdef CLOCK_REALTIME
- static struct timespec tmstart;
- struct timespec now;
-#else
- static unsigned long tmstart;
- unsigned long now;
-#endif
- static int warning=1;
-
- if (usertime && warning)
- {
- BIO_printf(bio_err,"To get meaningful results, run "
- "this program on idle system.\n");
- warning=0;
- }
-
-#ifdef CLOCK_REALTIME
- clock_gettime(CLOCK_REALTIME,&now);
- if (stop==TM_START) tmstart = now;
- else ret = ( (now.tv_sec+now.tv_nsec*1e-9)
- - (tmstart.tv_sec+tmstart.tv_nsec*1e-9) );
-#else
- now = tickGet();
- if (stop==TM_START) tmstart = now;
- else ret = (now - tmstart)/(double)sysClkRateGet();
-#endif
- return (ret);
- }
+ ret = (__int64)(tmstop.QuadPart - tmstart.QuadPart) * 1e-7;
+ }
-#elif defined(OPENSSL_SYSTEM_VMS)
-#include <time.h>
-#include <times.h>
-
-double app_tminterval(int stop,int usertime)
- {
- static clock_t tmstart;
- double ret = 0;
- clock_t now;
-#ifdef __TMS
- struct tms rus;
-
- now = times(&rus);
- if (usertime) now = rus.tms_utime;
-#else
- if (usertime)
- now = clock(); /* sum of user and kernel times */
- else {
- struct timeval tv;
- gettimeofday(&tv,NULL);
- now = (clock_t)(
- (unsigned long long)tv.tv_sec*CLK_TCK +
- (unsigned long long)tv.tv_usec*(1000000/CLK_TCK)
- );
- }
-#endif
- if (stop==TM_START) tmstart = now;
- else ret = (now - tmstart)/(double)(CLK_TCK);
+ return (ret);
+}
- return (ret);
- }
+#elif defined(OPENSSL_SYS_NETWARE)
+# include <time.h>
-#elif defined(_SC_CLK_TCK) /* by means of unistd.h */
-#include <sys/times.h>
+double app_tminterval(int stop, int usertime)
+{
+ double ret = 0;
+ static clock_t tmstart;
+ static int warning = 1;
+
+ if (usertime && warning) {
+ BIO_printf(bio_err, "To get meaningful results, run "
+ "this program on idle system.\n");
+ warning = 0;
+ }
+
+ if (stop == TM_START)
+ tmstart = clock();
+ else
+ ret = (clock() - tmstart) / (double)CLOCKS_PER_SEC;
+
+ return (ret);
+}
-double app_tminterval(int stop,int usertime)
- {
- double ret = 0;
- struct tms rus;
- clock_t now = times(&rus);
- static clock_t tmstart;
+#elif defined(OPENSSL_SYSTEM_VXWORKS)
+# include <time.h>
- if (usertime) now = rus.tms_utime;
+double app_tminterval(int stop, int usertime)
+{
+ double ret = 0;
+# ifdef CLOCK_REALTIME
+ static struct timespec tmstart;
+ struct timespec now;
+# else
+ static unsigned long tmstart;
+ unsigned long now;
+# endif
+ static int warning = 1;
+
+ if (usertime && warning) {
+ BIO_printf(bio_err, "To get meaningful results, run "
+ "this program on idle system.\n");
+ warning = 0;
+ }
+# ifdef CLOCK_REALTIME
+ clock_gettime(CLOCK_REALTIME, &now);
+ if (stop == TM_START)
+ tmstart = now;
+ else
+ ret = ((now.tv_sec + now.tv_nsec * 1e-9)
+ - (tmstart.tv_sec + tmstart.tv_nsec * 1e-9));
+# else
+ now = tickGet();
+ if (stop == TM_START)
+ tmstart = now;
+ else
+ ret = (now - tmstart) / (double)sysClkRateGet();
+# endif
+ return (ret);
+}
- if (stop==TM_START) tmstart = now;
- else
- {
- long int tck = sysconf(_SC_CLK_TCK);
- ret = (now - tmstart)/(double)tck;
- }
+#elif defined(OPENSSL_SYSTEM_VMS)
+# include <time.h>
+# include <times.h>
- return (ret);
- }
+double app_tminterval(int stop, int usertime)
+{
+ static clock_t tmstart;
+ double ret = 0;
+ clock_t now;
+# ifdef __TMS
+ struct tms rus;
+
+ now = times(&rus);
+ if (usertime)
+ now = rus.tms_utime;
+# else
+ if (usertime)
+ now = clock(); /* sum of user and kernel times */
+ else {
+ struct timeval tv;
+ gettimeofday(&tv, NULL);
+ now = (clock_t)((unsigned long long)tv.tv_sec * CLK_TCK +
+ (unsigned long long)tv.tv_usec * (1000000 / CLK_TCK)
+ );
+ }
+# endif
+ if (stop == TM_START)
+ tmstart = now;
+ else
+ ret = (now - tmstart) / (double)(CLK_TCK);
-#else
-#include <sys/time.h>
-#include <sys/resource.h>
+ return (ret);
+}
-double app_tminterval(int stop,int usertime)
- {
- double ret = 0;
- struct rusage rus;
- struct timeval now;
- static struct timeval tmstart;
+#elif defined(_SC_CLK_TCK) /* by means of unistd.h */
+# include <sys/times.h>
- if (usertime) getrusage(RUSAGE_SELF,&rus), now = rus.ru_utime;
- else gettimeofday(&now,NULL);
+double app_tminterval(int stop, int usertime)
+{
+ double ret = 0;
+ struct tms rus;
+ clock_t now = times(&rus);
+ static clock_t tmstart;
+
+ if (usertime)
+ now = rus.tms_utime;
+
+ if (stop == TM_START)
+ tmstart = now;
+ else {
+ long int tck = sysconf(_SC_CLK_TCK);
+ ret = (now - tmstart) / (double)tck;
+ }
+
+ return (ret);
+}
- if (stop==TM_START) tmstart = now;
- else ret = ( (now.tv_sec+now.tv_usec*1e-6)
- - (tmstart.tv_sec+tmstart.tv_usec*1e-6) );
+#else
+# include <sys/time.h>
+# include <sys/resource.h>
- return ret;
- }
+double app_tminterval(int stop, int usertime)
+{
+ double ret = 0;
+ struct rusage rus;
+ struct timeval now;
+ static struct timeval tmstart;
+
+ if (usertime)
+ getrusage(RUSAGE_SELF, &rus), now = rus.ru_utime;
+ else
+ gettimeofday(&now, NULL);
+
+ if (stop == TM_START)
+ tmstart = now;
+ else
+ ret = ((now.tv_sec + now.tv_usec * 1e-6)
+ - (tmstart.tv_sec + tmstart.tv_usec * 1e-6));
+
+ return ret;
+}
#endif
/* app_isdir section */
#ifdef _WIN32
int app_isdir(const char *name)
- {
- HANDLE hList;
- WIN32_FIND_DATA FileData;
-#if defined(UNICODE) || defined(_UNICODE)
- size_t i, len_0 = strlen(name)+1;
-
- if (len_0 > sizeof(FileData.cFileName)/sizeof(FileData.cFileName[0]))
- return -1;
-
-#if !defined(_WIN32_WCE) || _WIN32_WCE>=101
- if (!MultiByteToWideChar(CP_ACP,0,name,len_0,FileData.cFileName,len_0))
-#endif
- for (i=0;i<len_0;i++)
- FileData.cFileName[i] = (WCHAR)name[i];
-
- hList = FindFirstFile(FileData.cFileName,&FileData);
-#else
- hList = FindFirstFile(name,&FileData);
-#endif
- if (hList == INVALID_HANDLE_VALUE) return -1;
- FindClose(hList);
- return ((FileData.dwFileAttributes&FILE_ATTRIBUTE_DIRECTORY)!=0);
- }
+{
+ HANDLE hList;
+ WIN32_FIND_DATA FileData;
+# if defined(UNICODE) || defined(_UNICODE)
+ size_t i, len_0 = strlen(name) + 1;
+
+ if (len_0 > sizeof(FileData.cFileName) / sizeof(FileData.cFileName[0]))
+ return -1;
+
+# if !defined(_WIN32_WCE) || _WIN32_WCE>=101
+ if (!MultiByteToWideChar
+ (CP_ACP, 0, name, len_0, FileData.cFileName, len_0))
+# endif
+ for (i = 0; i < len_0; i++)
+ FileData.cFileName[i] = (WCHAR)name[i];
+
+ hList = FindFirstFile(FileData.cFileName, &FileData);
+# else
+ hList = FindFirstFile(name, &FileData);
+# endif
+ if (hList == INVALID_HANDLE_VALUE)
+ return -1;
+ FindClose(hList);
+ return ((FileData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0);
+}
#else
-#include <sys/stat.h>
-#ifndef S_ISDIR
-# if defined(_S_IFMT) && defined(_S_IFDIR)
-# define S_ISDIR(a) (((a) & _S_IFMT) == _S_IFDIR)
-# else
-# define S_ISDIR(a) (((a) & S_IFMT) == S_IFDIR)
-# endif
-#endif
+# include <sys/stat.h>
+# ifndef S_ISDIR
+# if defined(_S_IFMT) && defined(_S_IFDIR)
+# define S_ISDIR(a) (((a) & _S_IFMT) == _S_IFDIR)
+# else
+# define S_ISDIR(a) (((a) & S_IFMT) == S_IFDIR)
+# endif
+# endif
int app_isdir(const char *name)
- {
-#if defined(S_ISDIR)
- struct stat st;
-
- if (stat(name,&st)==0) return S_ISDIR(st.st_mode);
- else return -1;
-#else
- return -1;
-#endif
- }
+{
+# if defined(S_ISDIR)
+ struct stat st;
+
+ if (stat(name, &st) == 0)
+ return S_ISDIR(st.st_mode);
+ else
+ return -1;
+# else
+ return -1;
+# endif
+}
#endif
/* raw_read|write section */
#if defined(_WIN32) && defined(STD_INPUT_HANDLE)
-int raw_read_stdin(void *buf,int siz)
- {
- DWORD n;
- if (ReadFile(GetStdHandle(STD_INPUT_HANDLE),buf,siz,&n,NULL))
- return (n);
- else return (-1);
- }
+int raw_read_stdin(void *buf, int siz)
+{
+ DWORD n;
+ if (ReadFile(GetStdHandle(STD_INPUT_HANDLE), buf, siz, &n, NULL))
+ return (n);
+ else
+ return (-1);
+}
#else
-int raw_read_stdin(void *buf,int siz)
- { return read(fileno(stdin),buf,siz); }
+int raw_read_stdin(void *buf, int siz)
+{
+ return read(fileno(stdin), buf, siz);
+}
#endif
#if defined(_WIN32) && defined(STD_OUTPUT_HANDLE)
-int raw_write_stdout(const void *buf,int siz)
- {
- DWORD n;
- if (WriteFile(GetStdHandle(STD_OUTPUT_HANDLE),buf,siz,&n,NULL))
- return (n);
- else return (-1);
- }
+int raw_write_stdout(const void *buf, int siz)
+{
+ DWORD n;
+ if (WriteFile(GetStdHandle(STD_OUTPUT_HANDLE), buf, siz, &n, NULL))
+ return (n);
+ else
+ return (-1);
+}
#else
-int raw_write_stdout(const void *buf,int siz)
- { return write(fileno(stdout),buf,siz); }
+int raw_write_stdout(const void *buf, int siz)
+{
+ return write(fileno(stdout), buf, siz);
+}
#endif
diff --git a/apps/apps.h b/apps/apps.h
index 3aeb46c4e299..33b293e5b215 100644
--- a/apps/apps.h
+++ b/apps/apps.h
@@ -5,21 +5,21 @@
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -34,10 +34,10 @@
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -49,7 +49,7 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
@@ -63,7 +63,7 @@
* are met:
*
* 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
+ * notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
@@ -110,122 +110,119 @@
*/
#ifndef HEADER_APPS_H
-#define HEADER_APPS_H
-
-#include "e_os.h"
-
-#include <openssl/bio.h>
-#include <openssl/x509.h>
-#include <openssl/lhash.h>
-#include <openssl/conf.h>
-#include <openssl/txt_db.h>
-#ifndef OPENSSL_NO_ENGINE
-#include <openssl/engine.h>
-#endif
-#ifndef OPENSSL_NO_OCSP
-#include <openssl/ocsp.h>
-#endif
-#include <openssl/ossl_typ.h>
+# define HEADER_APPS_H
+
+# include "e_os.h"
+
+# include <openssl/bio.h>
+# include <openssl/x509.h>
+# include <openssl/lhash.h>
+# include <openssl/conf.h>
+# include <openssl/txt_db.h>
+# ifndef OPENSSL_NO_ENGINE
+# include <openssl/engine.h>
+# endif
+# ifndef OPENSSL_NO_OCSP
+# include <openssl/ocsp.h>
+# endif
+# include <openssl/ossl_typ.h>
int app_RAND_load_file(const char *file, BIO *bio_e, int dont_warn);
int app_RAND_write_file(const char *file, BIO *bio_e);
-/* When `file' is NULL, use defaults.
- * `bio_e' is for error messages. */
+/*
+ * When `file' is NULL, use defaults. `bio_e' is for error messages.
+ */
void app_RAND_allow_write_file(void);
long app_RAND_load_files(char *file); /* `file' is a list of files to read,
* separated by LIST_SEPARATOR_CHAR
* (see e_os.h). The string is
* destroyed! */
-#ifndef MONOLITH
+# ifndef MONOLITH
-#define MAIN(a,v) main(a,v)
+# define MAIN(a,v) main(a,v)
-#ifndef NON_MAIN
-CONF *config=NULL;
-BIO *bio_err=NULL;
-#else
+# ifndef NON_MAIN
+CONF *config = NULL;
+BIO *bio_err = NULL;
+# else
extern CONF *config;
extern BIO *bio_err;
-#endif
+# endif
-#else
+# else
-#define MAIN(a,v) PROG(a,v)
+# define MAIN(a,v) PROG(a,v)
extern CONF *config;
extern char *default_config_file;
extern BIO *bio_err;
-#endif
+# endif
-#ifndef OPENSSL_SYS_NETWARE
-#include <signal.h>
-#endif
+# ifndef OPENSSL_SYS_NETWARE
+# include <signal.h>
+# endif
-#ifdef SIGPIPE
-#define do_pipe_sig() signal(SIGPIPE,SIG_IGN)
-#else
-#define do_pipe_sig()
-#endif
+# ifdef SIGPIPE
+# define do_pipe_sig() signal(SIGPIPE,SIG_IGN)
+# else
+# define do_pipe_sig()
+# endif
-#ifdef OPENSSL_NO_COMP
-#define zlib_cleanup()
-#else
-#define zlib_cleanup() COMP_zlib_cleanup()
-#endif
+# ifdef OPENSSL_NO_COMP
+# define zlib_cleanup()
+# else
+# define zlib_cleanup() COMP_zlib_cleanup()
+# endif
-#if defined(MONOLITH) && !defined(OPENSSL_C)
+# if defined(MONOLITH) && !defined(OPENSSL_C)
# define apps_startup() \
- do_pipe_sig()
+ do_pipe_sig()
# define apps_shutdown()
-#else
+# else
# ifndef OPENSSL_NO_ENGINE
-# define apps_startup() \
- do { do_pipe_sig(); CRYPTO_malloc_init(); \
- ERR_load_crypto_strings(); OpenSSL_add_all_algorithms(); \
- ENGINE_load_builtin_engines(); setup_ui_method(); } while(0)
-# define apps_shutdown() \
- do { CONF_modules_unload(1); destroy_ui_method(); \
- OBJ_cleanup(); EVP_cleanup(); ENGINE_cleanup(); \
- CRYPTO_cleanup_all_ex_data(); ERR_remove_thread_state(NULL); \
- RAND_cleanup(); \
- ERR_free_strings(); zlib_cleanup();} while(0)
+# define apps_startup() \
+ do { do_pipe_sig(); CRYPTO_malloc_init(); \
+ ERR_load_crypto_strings(); OpenSSL_add_all_algorithms(); \
+ ENGINE_load_builtin_engines(); setup_ui_method(); } while(0)
+# define apps_shutdown() \
+ do { CONF_modules_unload(1); destroy_ui_method(); \
+ OBJ_cleanup(); EVP_cleanup(); ENGINE_cleanup(); \
+ CRYPTO_cleanup_all_ex_data(); ERR_remove_thread_state(NULL); \
+ RAND_cleanup(); \
+ ERR_free_strings(); zlib_cleanup();} while(0)
# else
-# define apps_startup() \
- do { do_pipe_sig(); CRYPTO_malloc_init(); \
- ERR_load_crypto_strings(); OpenSSL_add_all_algorithms(); \
- setup_ui_method(); } while(0)
-# define apps_shutdown() \
- do { CONF_modules_unload(1); destroy_ui_method(); \
- OBJ_cleanup(); EVP_cleanup(); \
- CRYPTO_cleanup_all_ex_data(); ERR_remove_thread_state(NULL); \
- RAND_cleanup(); \
- ERR_free_strings(); zlib_cleanup(); } while(0)
+# define apps_startup() \
+ do { do_pipe_sig(); CRYPTO_malloc_init(); \
+ ERR_load_crypto_strings(); OpenSSL_add_all_algorithms(); \
+ setup_ui_method(); } while(0)
+# define apps_shutdown() \
+ do { CONF_modules_unload(1); destroy_ui_method(); \
+ OBJ_cleanup(); EVP_cleanup(); \
+ CRYPTO_cleanup_all_ex_data(); ERR_remove_thread_state(NULL); \
+ RAND_cleanup(); \
+ ERR_free_strings(); zlib_cleanup(); } while(0)
# endif
-#endif
+# endif
-#ifdef OPENSSL_SYSNAME_WIN32
+# ifdef OPENSSL_SYSNAME_WIN32
# define openssl_fdset(a,b) FD_SET((unsigned int)a, b)
-#else
+# else
# define openssl_fdset(a,b) FD_SET(a, b)
-#endif
+# endif
+typedef struct args_st {
+ char **data;
+ int count;
+} ARGS;
-typedef struct args_st
- {
- char **data;
- int count;
- } ARGS;
+# define PW_MIN_LENGTH 4
+typedef struct pw_cb_data {
+ const void *password;
+ const char *prompt_info;
+} PW_CB_DATA;
-#define PW_MIN_LENGTH 4
-typedef struct pw_cb_data
- {
- const void *password;
- const char *prompt_info;
- } PW_CB_DATA;
-
-int password_callback(char *buf, int bufsiz, int verify,
- PW_CB_DATA *cb_data);
+int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_data);
int setup_ui_method(void);
void destroy_ui_method(void);
@@ -233,12 +230,13 @@ void destroy_ui_method(void);
int should_retry(int i);
int args_from_file(char *file, int *argc, char **argv[]);
int str2fmt(char *s);
-void program_name(char *in,char *out,int size);
-int chopup_args(ARGS *arg,char *buf, int *argc, char **argv[]);
-#ifdef HEADER_X509_H
+void program_name(char *in, char *out, int size);
+int chopup_args(ARGS *arg, char *buf, int *argc, char **argv[]);
+# ifdef HEADER_X509_H
int dump_cert_text(BIO *out, X509 *x);
-void print_name(BIO *out, const char *title, X509_NAME *nm, unsigned long lflags);
-#endif
+void print_name(BIO *out, const char *title, X509_NAME *nm,
+ unsigned long lflags);
+# endif
int set_cert_ex(unsigned long *flags, const char *arg);
int set_name_ex(unsigned long *flags, const char *arg);
int set_ext_copy(int *copy_type, const char *arg);
@@ -246,130 +244,134 @@ int copy_extensions(X509 *x, X509_REQ *req, int copy_type);
int app_passwd(BIO *err, char *arg1, char *arg2, char **pass1, char **pass2);
int add_oid_section(BIO *err, CONF *conf);
X509 *load_cert(BIO *err, const char *file, int format,
- const char *pass, ENGINE *e, const char *cert_descrip);
+ const char *pass, ENGINE *e, const char *cert_descrip);
EVP_PKEY *load_key(BIO *err, const char *file, int format, int maybe_stdin,
- const char *pass, ENGINE *e, const char *key_descrip);
+ const char *pass, ENGINE *e, const char *key_descrip);
EVP_PKEY *load_pubkey(BIO *err, const char *file, int format, int maybe_stdin,
- const char *pass, ENGINE *e, const char *key_descrip);
+ const char *pass, ENGINE *e, const char *key_descrip);
STACK_OF(X509) *load_certs(BIO *err, const char *file, int format,
- const char *pass, ENGINE *e, const char *cert_descrip);
+ const char *pass, ENGINE *e,
+ const char *cert_descrip);
STACK_OF(X509_CRL) *load_crls(BIO *err, const char *file, int format,
- const char *pass, ENGINE *e, const char *cert_descrip);
+ const char *pass, ENGINE *e,
+ const char *cert_descrip);
X509_STORE *setup_verify(BIO *bp, char *CAfile, char *CApath);
-#ifndef OPENSSL_NO_ENGINE
+# ifndef OPENSSL_NO_ENGINE
ENGINE *setup_engine(BIO *err, const char *engine, int debug);
-#endif
+# endif
-#ifndef OPENSSL_NO_OCSP
+# ifndef OPENSSL_NO_OCSP
OCSP_RESPONSE *process_responder(BIO *err, OCSP_REQUEST *req,
- char *host, char *path, char *port, int use_ssl,
- STACK_OF(CONF_VALUE) *headers,
- int req_timeout);
-#endif
+ char *host, char *path, char *port,
+ int use_ssl, STACK_OF(CONF_VALUE) *headers,
+ int req_timeout);
+# endif
int load_config(BIO *err, CONF *cnf);
char *make_config_name(void);
/* Functions defined in ca.c and also used in ocsp.c */
int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
- ASN1_GENERALIZEDTIME **pinvtm, const char *str);
-
-#define DB_type 0
-#define DB_exp_date 1
-#define DB_rev_date 2
-#define DB_serial 3 /* index - unique */
-#define DB_file 4
-#define DB_name 5 /* index - unique when active and not disabled */
-#define DB_NUMBER 6
-
-#define DB_TYPE_REV 'R'
-#define DB_TYPE_EXP 'E'
-#define DB_TYPE_VAL 'V'
-
-typedef struct db_attr_st
- {
- int unique_subject;
- } DB_ATTR;
-typedef struct ca_db_st
- {
- DB_ATTR attributes;
- TXT_DB *db;
- } CA_DB;
+ ASN1_GENERALIZEDTIME **pinvtm, const char *str);
+
+# define DB_type 0
+# define DB_exp_date 1
+# define DB_rev_date 2
+# define DB_serial 3 /* index - unique */
+# define DB_file 4
+# define DB_name 5 /* index - unique when active and not
+ * disabled */
+# define DB_NUMBER 6
+
+# define DB_TYPE_REV 'R'
+# define DB_TYPE_EXP 'E'
+# define DB_TYPE_VAL 'V'
+
+typedef struct db_attr_st {
+ int unique_subject;
+} DB_ATTR;
+typedef struct ca_db_st {
+ DB_ATTR attributes;
+ TXT_DB *db;
+} CA_DB;
BIGNUM *load_serial(char *serialfile, int create, ASN1_INTEGER **retai);
-int save_serial(char *serialfile, char *suffix, BIGNUM *serial, ASN1_INTEGER **retai);
+int save_serial(char *serialfile, char *suffix, BIGNUM *serial,
+ ASN1_INTEGER **retai);
int rotate_serial(char *serialfile, char *new_suffix, char *old_suffix);
int rand_serial(BIGNUM *b, ASN1_INTEGER *ai);
CA_DB *load_index(char *dbfile, DB_ATTR *dbattr);
int index_index(CA_DB *db);
int save_index(const char *dbfile, const char *suffix, CA_DB *db);
-int rotate_index(const char *dbfile, const char *new_suffix, const char *old_suffix);
+int rotate_index(const char *dbfile, const char *new_suffix,
+ const char *old_suffix);
void free_index(CA_DB *db);
-#define index_name_cmp_noconst(a, b) \
- index_name_cmp((const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, a), \
- (const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, b))
+# define index_name_cmp_noconst(a, b) \
+ index_name_cmp((const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, a), \
+ (const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, b))
int index_name_cmp(const OPENSSL_CSTRING *a, const OPENSSL_CSTRING *b);
int parse_yesno(const char *str, int def);
X509_NAME *parse_name(char *str, long chtype, int multirdn);
int args_verify(char ***pargs, int *pargc,
- int *badarg, BIO *err, X509_VERIFY_PARAM **pm);
+ int *badarg, BIO *err, X509_VERIFY_PARAM **pm);
void policies_print(BIO *out, X509_STORE_CTX *ctx);
int bio_to_mem(unsigned char **out, int maxlen, BIO *in);
int pkey_ctrl_string(EVP_PKEY_CTX *ctx, char *value);
int init_gen_str(BIO *err, EVP_PKEY_CTX **pctx,
- const char *algname, ENGINE *e, int do_param);
+ const char *algname, ENGINE *e, int do_param);
int do_X509_sign(BIO *err, X509 *x, EVP_PKEY *pkey, const EVP_MD *md,
- STACK_OF(OPENSSL_STRING) *sigopts);
+ STACK_OF(OPENSSL_STRING) *sigopts);
int do_X509_REQ_sign(BIO *err, X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md,
- STACK_OF(OPENSSL_STRING) *sigopts);
+ STACK_OF(OPENSSL_STRING) *sigopts);
int do_X509_CRL_sign(BIO *err, X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md,
- STACK_OF(OPENSSL_STRING) *sigopts);
-#ifndef OPENSSL_NO_PSK
+ STACK_OF(OPENSSL_STRING) *sigopts);
+# ifndef OPENSSL_NO_PSK
extern char *psk_key;
-#endif
-#ifndef OPENSSL_NO_JPAKE
+# endif
+# ifndef OPENSSL_NO_JPAKE
void jpake_client_auth(BIO *out, BIO *conn, const char *secret);
void jpake_server_auth(BIO *out, BIO *conn, const char *secret);
-#endif
+# endif
-#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
+# if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
unsigned char *next_protos_parse(unsigned short *outlen, const char *in);
-#endif /* !OPENSSL_NO_TLSEXT && !OPENSSL_NO_NEXTPROTONEG */
-
-#define FORMAT_UNDEF 0
-#define FORMAT_ASN1 1
-#define FORMAT_TEXT 2
-#define FORMAT_PEM 3
-#define FORMAT_NETSCAPE 4
-#define FORMAT_PKCS12 5
-#define FORMAT_SMIME 6
-#define FORMAT_ENGINE 7
-#define FORMAT_IISSGC 8 /* XXX this stupid macro helps us to avoid
- * adding yet another param to load_*key() */
-#define FORMAT_PEMRSA 9 /* PEM RSAPubicKey format */
-#define FORMAT_ASN1RSA 10 /* DER RSAPubicKey format */
-#define FORMAT_MSBLOB 11 /* MS Key blob format */
-#define FORMAT_PVK 12 /* MS PVK file format */
-
-#define EXT_COPY_NONE 0
-#define EXT_COPY_ADD 1
-#define EXT_COPY_ALL 2
-
-#define NETSCAPE_CERT_HDR "certificate"
-
-#define APP_PASS_LEN 1024
-
-#define SERIAL_RAND_BITS 64
+# endif /* !OPENSSL_NO_TLSEXT &&
+ * !OPENSSL_NO_NEXTPROTONEG */
+
+# define FORMAT_UNDEF 0
+# define FORMAT_ASN1 1
+# define FORMAT_TEXT 2
+# define FORMAT_PEM 3
+# define FORMAT_NETSCAPE 4
+# define FORMAT_PKCS12 5
+# define FORMAT_SMIME 6
+# define FORMAT_ENGINE 7
+# define FORMAT_IISSGC 8 /* XXX this stupid macro helps us to avoid
+ * adding yet another param to load_*key() */
+# define FORMAT_PEMRSA 9 /* PEM RSAPubicKey format */
+# define FORMAT_ASN1RSA 10 /* DER RSAPubicKey format */
+# define FORMAT_MSBLOB 11 /* MS Key blob format */
+# define FORMAT_PVK 12 /* MS PVK file format */
+
+# define EXT_COPY_NONE 0
+# define EXT_COPY_ADD 1
+# define EXT_COPY_ALL 2
+
+# define NETSCAPE_CERT_HDR "certificate"
+
+# define APP_PASS_LEN 1024
+
+# define SERIAL_RAND_BITS 64
int app_isdir(const char *);
-int raw_read_stdin(void *,int);
-int raw_write_stdout(const void *,int);
+int raw_read_stdin(void *, int);
+int raw_write_stdout(const void *, int);
-#define TM_START 0
-#define TM_STOP 1
-double app_tminterval (int stop,int usertime);
+# define TM_START 0
+# define TM_STOP 1
+double app_tminterval(int stop, int usertime);
-#define OPENSSL_NO_SSL_INTERN
+# define OPENSSL_NO_SSL_INTERN
#endif
diff --git a/apps/asn1pars.c b/apps/asn1pars.c
index 0d6607071fe6..7a0f1694328e 100644
--- a/apps/asn1pars.c
+++ b/apps/asn1pars.c
@@ -5,21 +5,21 @@
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -34,10 +34,10 @@
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -49,15 +49,16 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
-/* A nice addition from Dr Stephen Henson <steve@openssl.org> to
- * add the -strparse option which parses nested binary structures
+/*
+ * A nice addition from Dr Stephen Henson <steve@openssl.org> to add the
+ * -strparse option which parses nested binary structures
*/
#include <stdio.h>
@@ -69,377 +70,361 @@
#include <openssl/x509.h>
#include <openssl/pem.h>
-/* -inform arg - input format - default PEM (DER or PEM)
- * -in arg - input file - default stdin
- * -i - indent the details by depth
- * -offset - where in the file to start
- * -length - how many bytes to use
- * -oid file - extra oid description file
+/*-
+ * -inform arg - input format - default PEM (DER or PEM)
+ * -in arg - input file - default stdin
+ * -i - indent the details by depth
+ * -offset - where in the file to start
+ * -length - how many bytes to use
+ * -oid file - extra oid description file
*/
#undef PROG
-#define PROG asn1parse_main
+#define PROG asn1parse_main
int MAIN(int, char **);
static int do_generate(BIO *bio, char *genstr, char *genconf, BUF_MEM *buf);
int MAIN(int argc, char **argv)
- {
- int i,badops=0,offset=0,ret=1,j;
- unsigned int length=0;
- long num,tmplen;
- BIO *in=NULL,*out=NULL,*b64=NULL, *derout = NULL;
- int informat,indent=0, noout = 0, dump = 0;
- char *infile=NULL,*str=NULL,*prog,*oidfile=NULL, *derfile=NULL;
- char *genstr=NULL, *genconf=NULL;
- unsigned char *tmpbuf;
- const unsigned char *ctmpbuf;
- BUF_MEM *buf=NULL;
- STACK_OF(OPENSSL_STRING) *osk=NULL;
- ASN1_TYPE *at=NULL;
-
- informat=FORMAT_PEM;
-
- apps_startup();
-
- if (bio_err == NULL)
- if ((bio_err=BIO_new(BIO_s_file())) != NULL)
- BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
-
- if (!load_config(bio_err, NULL))
- goto end;
-
- prog=argv[0];
- argc--;
- argv++;
- if ((osk=sk_OPENSSL_STRING_new_null()) == NULL)
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto end;
- }
- while (argc >= 1)
- {
- if (strcmp(*argv,"-inform") == 0)
- {
- if (--argc < 1) goto bad;
- informat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-in") == 0)
- {
- if (--argc < 1) goto bad;
- infile= *(++argv);
- }
- else if (strcmp(*argv,"-out") == 0)
- {
- if (--argc < 1) goto bad;
- derfile= *(++argv);
- }
- else if (strcmp(*argv,"-i") == 0)
- {
- indent=1;
- }
- else if (strcmp(*argv,"-noout") == 0) noout = 1;
- else if (strcmp(*argv,"-oid") == 0)
- {
- if (--argc < 1) goto bad;
- oidfile= *(++argv);
- }
- else if (strcmp(*argv,"-offset") == 0)
- {
- if (--argc < 1) goto bad;
- offset= atoi(*(++argv));
- }
- else if (strcmp(*argv,"-length") == 0)
- {
- if (--argc < 1) goto bad;
- length= atoi(*(++argv));
- if (length == 0) goto bad;
- }
- else if (strcmp(*argv,"-dump") == 0)
- {
- dump= -1;
- }
- else if (strcmp(*argv,"-dlimit") == 0)
- {
- if (--argc < 1) goto bad;
- dump= atoi(*(++argv));
- if (dump <= 0) goto bad;
- }
- else if (strcmp(*argv,"-strparse") == 0)
- {
- if (--argc < 1) goto bad;
- sk_OPENSSL_STRING_push(osk,*(++argv));
- }
- else if (strcmp(*argv,"-genstr") == 0)
- {
- if (--argc < 1) goto bad;
- genstr= *(++argv);
- }
- else if (strcmp(*argv,"-genconf") == 0)
- {
- if (--argc < 1) goto bad;
- genconf= *(++argv);
- }
- else
- {
- BIO_printf(bio_err,"unknown option %s\n",*argv);
- badops=1;
- break;
- }
- argc--;
- argv++;
- }
-
- if (badops)
- {
-bad:
- BIO_printf(bio_err,"%s [options] <infile\n",prog);
- BIO_printf(bio_err,"where options are\n");
- BIO_printf(bio_err," -inform arg input format - one of DER PEM\n");
- BIO_printf(bio_err," -in arg input file\n");
- BIO_printf(bio_err," -out arg output file (output format is always DER\n");
- BIO_printf(bio_err," -noout arg don't produce any output\n");
- BIO_printf(bio_err," -offset arg offset into file\n");
- BIO_printf(bio_err," -length arg length of section in file\n");
- BIO_printf(bio_err," -i indent entries\n");
- BIO_printf(bio_err," -dump dump unknown data in hex form\n");
- BIO_printf(bio_err," -dlimit arg dump the first arg bytes of unknown data in hex form\n");
- BIO_printf(bio_err," -oid file file of extra oid definitions\n");
- BIO_printf(bio_err," -strparse offset\n");
- BIO_printf(bio_err," a series of these can be used to 'dig' into multiple\n");
- BIO_printf(bio_err," ASN1 blob wrappings\n");
- BIO_printf(bio_err," -genstr str string to generate ASN1 structure from\n");
- BIO_printf(bio_err," -genconf file file to generate ASN1 structure from\n");
- goto end;
- }
-
- ERR_load_crypto_strings();
-
- in=BIO_new(BIO_s_file());
- out=BIO_new(BIO_s_file());
- if ((in == NULL) || (out == NULL))
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
+{
+ int i, badops = 0, offset = 0, ret = 1, j;
+ unsigned int length = 0;
+ long num, tmplen;
+ BIO *in = NULL, *out = NULL, *b64 = NULL, *derout = NULL;
+ int informat, indent = 0, noout = 0, dump = 0;
+ char *infile = NULL, *str = NULL, *prog, *oidfile = NULL, *derfile = NULL;
+ char *genstr = NULL, *genconf = NULL;
+ unsigned char *tmpbuf;
+ const unsigned char *ctmpbuf;
+ BUF_MEM *buf = NULL;
+ STACK_OF(OPENSSL_STRING) *osk = NULL;
+ ASN1_TYPE *at = NULL;
+
+ informat = FORMAT_PEM;
+
+ apps_startup();
+
+ if (bio_err == NULL)
+ if ((bio_err = BIO_new(BIO_s_file())) != NULL)
+ BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
+
+ if (!load_config(bio_err, NULL))
+ goto end;
+
+ prog = argv[0];
+ argc--;
+ argv++;
+ if ((osk = sk_OPENSSL_STRING_new_null()) == NULL) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto end;
+ }
+ while (argc >= 1) {
+ if (strcmp(*argv, "-inform") == 0) {
+ if (--argc < 1)
+ goto bad;
+ informat = str2fmt(*(++argv));
+ } else if (strcmp(*argv, "-in") == 0) {
+ if (--argc < 1)
+ goto bad;
+ infile = *(++argv);
+ } else if (strcmp(*argv, "-out") == 0) {
+ if (--argc < 1)
+ goto bad;
+ derfile = *(++argv);
+ } else if (strcmp(*argv, "-i") == 0) {
+ indent = 1;
+ } else if (strcmp(*argv, "-noout") == 0)
+ noout = 1;
+ else if (strcmp(*argv, "-oid") == 0) {
+ if (--argc < 1)
+ goto bad;
+ oidfile = *(++argv);
+ } else if (strcmp(*argv, "-offset") == 0) {
+ if (--argc < 1)
+ goto bad;
+ offset = atoi(*(++argv));
+ } else if (strcmp(*argv, "-length") == 0) {
+ if (--argc < 1)
+ goto bad;
+ length = atoi(*(++argv));
+ if (length == 0)
+ goto bad;
+ } else if (strcmp(*argv, "-dump") == 0) {
+ dump = -1;
+ } else if (strcmp(*argv, "-dlimit") == 0) {
+ if (--argc < 1)
+ goto bad;
+ dump = atoi(*(++argv));
+ if (dump <= 0)
+ goto bad;
+ } else if (strcmp(*argv, "-strparse") == 0) {
+ if (--argc < 1)
+ goto bad;
+ sk_OPENSSL_STRING_push(osk, *(++argv));
+ } else if (strcmp(*argv, "-genstr") == 0) {
+ if (--argc < 1)
+ goto bad;
+ genstr = *(++argv);
+ } else if (strcmp(*argv, "-genconf") == 0) {
+ if (--argc < 1)
+ goto bad;
+ genconf = *(++argv);
+ } else {
+ BIO_printf(bio_err, "unknown option %s\n", *argv);
+ badops = 1;
+ break;
+ }
+ argc--;
+ argv++;
+ }
+
+ if (badops) {
+ bad:
+ BIO_printf(bio_err, "%s [options] <infile\n", prog);
+ BIO_printf(bio_err, "where options are\n");
+ BIO_printf(bio_err, " -inform arg input format - one of DER PEM\n");
+ BIO_printf(bio_err, " -in arg input file\n");
+ BIO_printf(bio_err,
+ " -out arg output file (output format is always DER\n");
+ BIO_printf(bio_err, " -noout arg don't produce any output\n");
+ BIO_printf(bio_err, " -offset arg offset into file\n");
+ BIO_printf(bio_err, " -length arg length of section in file\n");
+ BIO_printf(bio_err, " -i indent entries\n");
+ BIO_printf(bio_err, " -dump dump unknown data in hex form\n");
+ BIO_printf(bio_err,
+ " -dlimit arg dump the first arg bytes of unknown data in hex form\n");
+ BIO_printf(bio_err, " -oid file file of extra oid definitions\n");
+ BIO_printf(bio_err, " -strparse offset\n");
+ BIO_printf(bio_err,
+ " a series of these can be used to 'dig' into multiple\n");
+ BIO_printf(bio_err, " ASN1 blob wrappings\n");
+ BIO_printf(bio_err,
+ " -genstr str string to generate ASN1 structure from\n");
+ BIO_printf(bio_err,
+ " -genconf file file to generate ASN1 structure from\n");
+ goto end;
+ }
+
+ ERR_load_crypto_strings();
+
+ in = BIO_new(BIO_s_file());
+ out = BIO_new(BIO_s_file());
+ if ((in == NULL) || (out == NULL)) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ BIO_set_fp(out, stdout, BIO_NOCLOSE | BIO_FP_TEXT);
#ifdef OPENSSL_SYS_VMS
- {
- BIO *tmpbio = BIO_new(BIO_f_linebuffer());
- out = BIO_push(tmpbio, out);
- }
+ {
+ BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+ out = BIO_push(tmpbio, out);
+ }
#endif
- if (oidfile != NULL)
- {
- if (BIO_read_filename(in,oidfile) <= 0)
- {
- BIO_printf(bio_err,"problems opening %s\n",oidfile);
- ERR_print_errors(bio_err);
- goto end;
- }
- OBJ_create_objects(in);
- }
-
- if (infile == NULL)
- BIO_set_fp(in,stdin,BIO_NOCLOSE);
- else
- {
- if (BIO_read_filename(in,infile) <= 0)
- {
- perror(infile);
- goto end;
- }
- }
-
- if (derfile) {
- if(!(derout = BIO_new_file(derfile, "wb"))) {
- BIO_printf(bio_err,"problems opening %s\n",derfile);
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-
- if ((buf=BUF_MEM_new()) == NULL) goto end;
- if (!BUF_MEM_grow(buf,BUFSIZ*8)) goto end; /* Pre-allocate :-) */
-
- if (genstr || genconf)
- {
- num = do_generate(bio_err, genstr, genconf, buf);
- if (num < 0)
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-
- else
- {
-
- if (informat == FORMAT_PEM)
- {
- BIO *tmp;
-
- if ((b64=BIO_new(BIO_f_base64())) == NULL)
- goto end;
- BIO_push(b64,in);
- tmp=in;
- in=b64;
- b64=tmp;
- }
-
- num=0;
- for (;;)
- {
- if (!BUF_MEM_grow(buf,(int)num+BUFSIZ)) goto end;
- i=BIO_read(in,&(buf->data[num]),BUFSIZ);
- if (i <= 0) break;
- num+=i;
- }
- }
- str=buf->data;
-
- /* If any structs to parse go through in sequence */
-
- if (sk_OPENSSL_STRING_num(osk))
- {
- tmpbuf=(unsigned char *)str;
- tmplen=num;
- for (i=0; i<sk_OPENSSL_STRING_num(osk); i++)
- {
- ASN1_TYPE *atmp;
- int typ;
- j=atoi(sk_OPENSSL_STRING_value(osk,i));
- if (j == 0)
- {
- BIO_printf(bio_err,"'%s' is an invalid number\n",sk_OPENSSL_STRING_value(osk,i));
- continue;
- }
- tmpbuf+=j;
- tmplen-=j;
- atmp = at;
- ctmpbuf = tmpbuf;
- at = d2i_ASN1_TYPE(NULL,&ctmpbuf,tmplen);
- ASN1_TYPE_free(atmp);
- if(!at)
- {
- BIO_printf(bio_err,"Error parsing structure\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- typ = ASN1_TYPE_get(at);
- if ((typ == V_ASN1_OBJECT)
- || (typ == V_ASN1_NULL))
- {
- BIO_printf(bio_err, "Can't parse %s type\n",
- typ == V_ASN1_NULL ? "NULL" : "OBJECT");
- ERR_print_errors(bio_err);
- goto end;
- }
- /* hmm... this is a little evil but it works */
- tmpbuf=at->value.asn1_string->data;
- tmplen=at->value.asn1_string->length;
- }
- str=(char *)tmpbuf;
- num=tmplen;
- }
-
- if (offset >= num)
- {
- BIO_printf(bio_err, "Error: offset too large\n");
- goto end;
- }
-
- num -= offset;
-
- if ((length == 0) || ((long)length > num)) length=(unsigned int)num;
- if(derout) {
- if(BIO_write(derout, str + offset, length) != (int)length) {
- BIO_printf(bio_err, "Error writing output\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
- if (!noout &&
- !ASN1_parse_dump(out,(unsigned char *)&(str[offset]),length,
- indent,dump))
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- ret=0;
-end:
- BIO_free(derout);
- if (in != NULL) BIO_free(in);
- if (out != NULL) BIO_free_all(out);
- if (b64 != NULL) BIO_free(b64);
- if (ret != 0)
- ERR_print_errors(bio_err);
- if (buf != NULL) BUF_MEM_free(buf);
- if (at != NULL) ASN1_TYPE_free(at);
- if (osk != NULL) sk_OPENSSL_STRING_free(osk);
- OBJ_cleanup();
- apps_shutdown();
- OPENSSL_EXIT(ret);
- }
+ if (oidfile != NULL) {
+ if (BIO_read_filename(in, oidfile) <= 0) {
+ BIO_printf(bio_err, "problems opening %s\n", oidfile);
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ OBJ_create_objects(in);
+ }
+
+ if (infile == NULL)
+ BIO_set_fp(in, stdin, BIO_NOCLOSE);
+ else {
+ if (BIO_read_filename(in, infile) <= 0) {
+ perror(infile);
+ goto end;
+ }
+ }
+
+ if (derfile) {
+ if (!(derout = BIO_new_file(derfile, "wb"))) {
+ BIO_printf(bio_err, "problems opening %s\n", derfile);
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+
+ if ((buf = BUF_MEM_new()) == NULL)
+ goto end;
+ if (!BUF_MEM_grow(buf, BUFSIZ * 8))
+ goto end; /* Pre-allocate :-) */
+
+ if (genstr || genconf) {
+ num = do_generate(bio_err, genstr, genconf, buf);
+ if (num < 0) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+
+ else {
+
+ if (informat == FORMAT_PEM) {
+ BIO *tmp;
+
+ if ((b64 = BIO_new(BIO_f_base64())) == NULL)
+ goto end;
+ BIO_push(b64, in);
+ tmp = in;
+ in = b64;
+ b64 = tmp;
+ }
+
+ num = 0;
+ for (;;) {
+ if (!BUF_MEM_grow(buf, (int)num + BUFSIZ))
+ goto end;
+ i = BIO_read(in, &(buf->data[num]), BUFSIZ);
+ if (i <= 0)
+ break;
+ num += i;
+ }
+ }
+ str = buf->data;
+
+ /* If any structs to parse go through in sequence */
+
+ if (sk_OPENSSL_STRING_num(osk)) {
+ tmpbuf = (unsigned char *)str;
+ tmplen = num;
+ for (i = 0; i < sk_OPENSSL_STRING_num(osk); i++) {
+ ASN1_TYPE *atmp;
+ int typ;
+ j = atoi(sk_OPENSSL_STRING_value(osk, i));
+ if (j == 0) {
+ BIO_printf(bio_err, "'%s' is an invalid number\n",
+ sk_OPENSSL_STRING_value(osk, i));
+ continue;
+ }
+ tmpbuf += j;
+ tmplen -= j;
+ atmp = at;
+ ctmpbuf = tmpbuf;
+ at = d2i_ASN1_TYPE(NULL, &ctmpbuf, tmplen);
+ ASN1_TYPE_free(atmp);
+ if (!at) {
+ BIO_printf(bio_err, "Error parsing structure\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ typ = ASN1_TYPE_get(at);
+ if ((typ == V_ASN1_OBJECT)
+ || (typ == V_ASN1_NULL)) {
+ BIO_printf(bio_err, "Can't parse %s type\n",
+ typ == V_ASN1_NULL ? "NULL" : "OBJECT");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ /* hmm... this is a little evil but it works */
+ tmpbuf = at->value.asn1_string->data;
+ tmplen = at->value.asn1_string->length;
+ }
+ str = (char *)tmpbuf;
+ num = tmplen;
+ }
+
+ if (offset >= num) {
+ BIO_printf(bio_err, "Error: offset too large\n");
+ goto end;
+ }
+
+ num -= offset;
+
+ if ((length == 0) || ((long)length > num))
+ length = (unsigned int)num;
+ if (derout) {
+ if (BIO_write(derout, str + offset, length) != (int)length) {
+ BIO_printf(bio_err, "Error writing output\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+ if (!noout &&
+ !ASN1_parse_dump(out, (unsigned char *)&(str[offset]), length,
+ indent, dump)) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ ret = 0;
+ end:
+ BIO_free(derout);
+ if (in != NULL)
+ BIO_free(in);
+ if (out != NULL)
+ BIO_free_all(out);
+ if (b64 != NULL)
+ BIO_free(b64);
+ if (ret != 0)
+ ERR_print_errors(bio_err);
+ if (buf != NULL)
+ BUF_MEM_free(buf);
+ if (at != NULL)
+ ASN1_TYPE_free(at);
+ if (osk != NULL)
+ sk_OPENSSL_STRING_free(osk);
+ OBJ_cleanup();
+ apps_shutdown();
+ OPENSSL_EXIT(ret);
+}
static int do_generate(BIO *bio, char *genstr, char *genconf, BUF_MEM *buf)
- {
- CONF *cnf = NULL;
- int len;
- long errline;
- unsigned char *p;
- ASN1_TYPE *atyp = NULL;
+{
+ CONF *cnf = NULL;
+ int len;
+ long errline;
+ unsigned char *p;
+ ASN1_TYPE *atyp = NULL;
- if (genconf)
- {
- cnf = NCONF_new(NULL);
- if (!NCONF_load(cnf, genconf, &errline))
- goto conferr;
- if (!genstr)
- genstr = NCONF_get_string(cnf, "default", "asn1");
- if (!genstr)
- {
- BIO_printf(bio, "Can't find 'asn1' in '%s'\n", genconf);
- goto err;
- }
- }
+ if (genconf) {
+ cnf = NCONF_new(NULL);
+ if (!NCONF_load(cnf, genconf, &errline))
+ goto conferr;
+ if (!genstr)
+ genstr = NCONF_get_string(cnf, "default", "asn1");
+ if (!genstr) {
+ BIO_printf(bio, "Can't find 'asn1' in '%s'\n", genconf);
+ goto err;
+ }
+ }
- atyp = ASN1_generate_nconf(genstr, cnf);
- NCONF_free(cnf);
- cnf = NULL;
+ atyp = ASN1_generate_nconf(genstr, cnf);
+ NCONF_free(cnf);
+ cnf = NULL;
- if (!atyp)
- return -1;
+ if (!atyp)
+ return -1;
- len = i2d_ASN1_TYPE(atyp, NULL);
+ len = i2d_ASN1_TYPE(atyp, NULL);
- if (len <= 0)
- goto err;
+ if (len <= 0)
+ goto err;
- if (!BUF_MEM_grow(buf,len))
- goto err;
+ if (!BUF_MEM_grow(buf, len))
+ goto err;
- p=(unsigned char *)buf->data;
+ p = (unsigned char *)buf->data;
- i2d_ASN1_TYPE(atyp, &p);
+ i2d_ASN1_TYPE(atyp, &p);
- ASN1_TYPE_free(atyp);
- return len;
+ ASN1_TYPE_free(atyp);
+ return len;
- conferr:
+ conferr:
- if (errline > 0)
- BIO_printf(bio, "Error on line %ld of config file '%s'\n",
- errline, genconf);
- else
- BIO_printf(bio, "Error loading config file '%s'\n", genconf);
+ if (errline > 0)
+ BIO_printf(bio, "Error on line %ld of config file '%s'\n",
+ errline, genconf);
+ else
+ BIO_printf(bio, "Error loading config file '%s'\n", genconf);
- err:
- NCONF_free(cnf);
- ASN1_TYPE_free(atyp);
+ err:
+ NCONF_free(cnf);
+ ASN1_TYPE_free(atyp);
- return -1;
+ return -1;
- }
+}
diff --git a/apps/ca.c b/apps/ca.c
index 613f5bee5cc3..5d29a64c57a0 100644
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -5,21 +5,21 @@
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -34,10 +34,10 @@
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -49,7 +49,7 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
@@ -76,117 +76,117 @@
#include <openssl/pem.h>
#ifndef W_OK
-# ifdef OPENSSL_SYS_VMS
-# if defined(__DECC)
-# include <unistd.h>
-# else
-# include <unixlib.h>
-# endif
-# elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_NETWARE)
-# include <sys/file.h>
+# ifdef OPENSSL_SYS_VMS
+# if defined(__DECC)
+# include <unistd.h>
+# else
+# include <unixlib.h>
# endif
+# elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_NETWARE)
+# include <sys/file.h>
+# endif
#endif
#include "apps.h"
#ifndef W_OK
-# define F_OK 0
-# define X_OK 1
-# define W_OK 2
-# define R_OK 4
+# define F_OK 0
+# define X_OK 1
+# define W_OK 2
+# define R_OK 4
#endif
#undef PROG
#define PROG ca_main
-#define BASE_SECTION "ca"
+#define BASE_SECTION "ca"
#define CONFIG_FILE "openssl.cnf"
-#define ENV_DEFAULT_CA "default_ca"
-
-#define STRING_MASK "string_mask"
-#define UTF8_IN "utf8"
-
-#define ENV_DIR "dir"
-#define ENV_CERTS "certs"
-#define ENV_CRL_DIR "crl_dir"
-#define ENV_CA_DB "CA_DB"
-#define ENV_NEW_CERTS_DIR "new_certs_dir"
-#define ENV_CERTIFICATE "certificate"
-#define ENV_SERIAL "serial"
-#define ENV_CRLNUMBER "crlnumber"
-#define ENV_CRL "crl"
-#define ENV_PRIVATE_KEY "private_key"
-#define ENV_RANDFILE "RANDFILE"
-#define ENV_DEFAULT_DAYS "default_days"
-#define ENV_DEFAULT_STARTDATE "default_startdate"
-#define ENV_DEFAULT_ENDDATE "default_enddate"
-#define ENV_DEFAULT_CRL_DAYS "default_crl_days"
-#define ENV_DEFAULT_CRL_HOURS "default_crl_hours"
-#define ENV_DEFAULT_MD "default_md"
-#define ENV_DEFAULT_EMAIL_DN "email_in_dn"
-#define ENV_PRESERVE "preserve"
-#define ENV_POLICY "policy"
-#define ENV_EXTENSIONS "x509_extensions"
-#define ENV_CRLEXT "crl_extensions"
-#define ENV_MSIE_HACK "msie_hack"
-#define ENV_NAMEOPT "name_opt"
-#define ENV_CERTOPT "cert_opt"
-#define ENV_EXTCOPY "copy_extensions"
-#define ENV_UNIQUE_SUBJECT "unique_subject"
-
-#define ENV_DATABASE "database"
+#define ENV_DEFAULT_CA "default_ca"
+
+#define STRING_MASK "string_mask"
+#define UTF8_IN "utf8"
+
+#define ENV_DIR "dir"
+#define ENV_CERTS "certs"
+#define ENV_CRL_DIR "crl_dir"
+#define ENV_CA_DB "CA_DB"
+#define ENV_NEW_CERTS_DIR "new_certs_dir"
+#define ENV_CERTIFICATE "certificate"
+#define ENV_SERIAL "serial"
+#define ENV_CRLNUMBER "crlnumber"
+#define ENV_CRL "crl"
+#define ENV_PRIVATE_KEY "private_key"
+#define ENV_RANDFILE "RANDFILE"
+#define ENV_DEFAULT_DAYS "default_days"
+#define ENV_DEFAULT_STARTDATE "default_startdate"
+#define ENV_DEFAULT_ENDDATE "default_enddate"
+#define ENV_DEFAULT_CRL_DAYS "default_crl_days"
+#define ENV_DEFAULT_CRL_HOURS "default_crl_hours"
+#define ENV_DEFAULT_MD "default_md"
+#define ENV_DEFAULT_EMAIL_DN "email_in_dn"
+#define ENV_PRESERVE "preserve"
+#define ENV_POLICY "policy"
+#define ENV_EXTENSIONS "x509_extensions"
+#define ENV_CRLEXT "crl_extensions"
+#define ENV_MSIE_HACK "msie_hack"
+#define ENV_NAMEOPT "name_opt"
+#define ENV_CERTOPT "cert_opt"
+#define ENV_EXTCOPY "copy_extensions"
+#define ENV_UNIQUE_SUBJECT "unique_subject"
+
+#define ENV_DATABASE "database"
/* Additional revocation information types */
-#define REV_NONE 0 /* No addditional information */
-#define REV_CRL_REASON 1 /* Value is CRL reason code */
-#define REV_HOLD 2 /* Value is hold instruction */
-#define REV_KEY_COMPROMISE 3 /* Value is cert key compromise time */
-#define REV_CA_COMPROMISE 4 /* Value is CA key compromise time */
-
-static const char *ca_usage[]={
-"usage: ca args\n",
-"\n",
-" -verbose - Talk alot while doing things\n",
-" -config file - A config file\n",
-" -name arg - The particular CA definition to use\n",
-" -gencrl - Generate a new CRL\n",
-" -crldays days - Days is when the next CRL is due\n",
-" -crlhours hours - Hours is when the next CRL is due\n",
-" -startdate YYMMDDHHMMSSZ - certificate validity notBefore\n",
-" -enddate YYMMDDHHMMSSZ - certificate validity notAfter (overrides -days)\n",
-" -days arg - number of days to certify the certificate for\n",
-" -md arg - md to use, one of md2, md5, sha or sha1\n",
-" -policy arg - The CA 'policy' to support\n",
-" -keyfile arg - private key file\n",
-" -keyform arg - private key file format (PEM or ENGINE)\n",
-" -key arg - key to decode the private key if it is encrypted\n",
-" -cert file - The CA certificate\n",
-" -selfsign - sign a certificate with the key associated with it\n",
-" -in file - The input PEM encoded certificate request(s)\n",
-" -out file - Where to put the output file(s)\n",
-" -outdir dir - Where to put output certificates\n",
-" -infiles .... - The last argument, requests to process\n",
-" -spkac file - File contains DN and signed public key and challenge\n",
-" -ss_cert file - File contains a self signed cert to sign\n",
-" -preserveDN - Don't re-order the DN\n",
-" -noemailDN - Don't add the EMAIL field into certificate' subject\n",
-" -batch - Don't ask questions\n",
-" -msie_hack - msie modifications to handle all those universal strings\n",
-" -revoke file - Revoke a certificate (given in file)\n",
-" -subj arg - Use arg instead of request's subject\n",
-" -utf8 - input characters are UTF8 (default ASCII)\n",
-" -multivalue-rdn - enable support for multivalued RDNs\n",
-" -extensions .. - Extension section (override value in config file)\n",
-" -extfile file - Configuration file with X509v3 extentions to add\n",
-" -crlexts .. - CRL extension section (override value in config file)\n",
+#define REV_NONE 0 /* No addditional information */
+#define REV_CRL_REASON 1 /* Value is CRL reason code */
+#define REV_HOLD 2 /* Value is hold instruction */
+#define REV_KEY_COMPROMISE 3 /* Value is cert key compromise time */
+#define REV_CA_COMPROMISE 4 /* Value is CA key compromise time */
+
+static const char *ca_usage[] = {
+ "usage: ca args\n",
+ "\n",
+ " -verbose - Talk alot while doing things\n",
+ " -config file - A config file\n",
+ " -name arg - The particular CA definition to use\n",
+ " -gencrl - Generate a new CRL\n",
+ " -crldays days - Days is when the next CRL is due\n",
+ " -crlhours hours - Hours is when the next CRL is due\n",
+ " -startdate YYMMDDHHMMSSZ - certificate validity notBefore\n",
+ " -enddate YYMMDDHHMMSSZ - certificate validity notAfter (overrides -days)\n",
+ " -days arg - number of days to certify the certificate for\n",
+ " -md arg - md to use, one of md2, md5, sha or sha1\n",
+ " -policy arg - The CA 'policy' to support\n",
+ " -keyfile arg - private key file\n",
+ " -keyform arg - private key file format (PEM or ENGINE)\n",
+ " -key arg - key to decode the private key if it is encrypted\n",
+ " -cert file - The CA certificate\n",
+ " -selfsign - sign a certificate with the key associated with it\n",
+ " -in file - The input PEM encoded certificate request(s)\n",
+ " -out file - Where to put the output file(s)\n",
+ " -outdir dir - Where to put output certificates\n",
+ " -infiles .... - The last argument, requests to process\n",
+ " -spkac file - File contains DN and signed public key and challenge\n",
+ " -ss_cert file - File contains a self signed cert to sign\n",
+ " -preserveDN - Don't re-order the DN\n",
+ " -noemailDN - Don't add the EMAIL field into certificate' subject\n",
+ " -batch - Don't ask questions\n",
+ " -msie_hack - msie modifications to handle all those universal strings\n",
+ " -revoke file - Revoke a certificate (given in file)\n",
+ " -subj arg - Use arg instead of request's subject\n",
+ " -utf8 - input characters are UTF8 (default ASCII)\n",
+ " -multivalue-rdn - enable support for multivalued RDNs\n",
+ " -extensions .. - Extension section (override value in config file)\n",
+ " -extfile file - Configuration file with X509v3 extentions to add\n",
+ " -crlexts .. - CRL extension section (override value in config file)\n",
#ifndef OPENSSL_NO_ENGINE
-" -engine e - use engine e, possibly a hardware device.\n",
+ " -engine e - use engine e, possibly a hardware device.\n",
#endif
-" -status serial - Shows certificate status given the serial number\n",
-" -updatedb - Updates db for expired certificates\n",
-NULL
+ " -status serial - Shows certificate status given the serial number\n",
+ " -updatedb - Updates db for expired certificates\n",
+ NULL
};
#ifdef EFENCE
@@ -196,36 +196,42 @@ extern int EF_ALIGNMENT;
#endif
static void lookup_fail(const char *name, const char *tag);
-static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
- const EVP_MD *dgst,STACK_OF(OPENSSL_STRING) *sigopts,
- STACK_OF(CONF_VALUE) *policy,CA_DB *db,
- BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate,
- char *enddate, long days, int batch, char *ext_sect, CONF *conf,
- int verbose, unsigned long certopt, unsigned long nameopt,
- int default_op, int ext_copy, int selfsign);
-static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
- const EVP_MD *dgst,STACK_OF(OPENSSL_STRING) *sigopts,
- STACK_OF(CONF_VALUE) *policy,
- CA_DB *db, BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn,
- char *startdate, char *enddate, long days, int batch,
- char *ext_sect, CONF *conf,int verbose, unsigned long certopt,
- unsigned long nameopt, int default_op, int ext_copy,
- ENGINE *e);
-static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
- const EVP_MD *dgst,STACK_OF(OPENSSL_STRING) *sigopts,
- STACK_OF(CONF_VALUE) *policy,
- CA_DB *db, BIGNUM *serial,char *subj,unsigned long chtype, int multirdn, int email_dn,
- char *startdate, char *enddate, long days, char *ext_sect,
- CONF *conf, int verbose, unsigned long certopt,
- unsigned long nameopt, int default_op, int ext_copy);
-static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
-static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
- STACK_OF(OPENSSL_STRING) *sigopts,
- STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,char *subj,unsigned long chtype, int multirdn,
- int email_dn, char *startdate, char *enddate, long days, int batch,
- int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
- unsigned long certopt, unsigned long nameopt, int default_op,
- int ext_copy, int selfsign);
+static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
+ const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
+ STACK_OF(CONF_VALUE) *policy, CA_DB *db,
+ BIGNUM *serial, char *subj, unsigned long chtype,
+ int multirdn, int email_dn, char *startdate, char *enddate,
+ long days, int batch, char *ext_sect, CONF *conf,
+ int verbose, unsigned long certopt, unsigned long nameopt,
+ int default_op, int ext_copy, int selfsign);
+static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
+ const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
+ STACK_OF(CONF_VALUE) *policy, CA_DB *db,
+ BIGNUM *serial, char *subj, unsigned long chtype,
+ int multirdn, int email_dn, char *startdate,
+ char *enddate, long days, int batch, char *ext_sect,
+ CONF *conf, int verbose, unsigned long certopt,
+ unsigned long nameopt, int default_op, int ext_copy,
+ ENGINE *e);
+static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey,
+ X509 *x509, const EVP_MD *dgst,
+ STACK_OF(OPENSSL_STRING) *sigopts,
+ STACK_OF(CONF_VALUE) *policy, CA_DB *db,
+ BIGNUM *serial, char *subj, unsigned long chtype,
+ int multirdn, int email_dn, char *startdate,
+ char *enddate, long days, char *ext_sect, CONF *conf,
+ int verbose, unsigned long certopt,
+ unsigned long nameopt, int default_op, int ext_copy);
+static void write_new_certificate(BIO *bp, X509 *x, int output_der,
+ int notext);
+static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
+ const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
+ STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,
+ char *subj, unsigned long chtype, int multirdn,
+ int email_dn, char *startdate, char *enddate, long days,
+ int batch, int verbose, X509_REQ *req, char *ext_sect,
+ CONF *conf, unsigned long certopt, unsigned long nameopt,
+ int default_op, int ext_copy, int selfsign);
static int do_revoke(X509 *x509, CA_DB *db, int ext, char *extval);
static int get_certificate_status(const char *ser_status, CA_DB *db);
static int do_updatedb(CA_DB *db);
@@ -233,2783 +239,2668 @@ static int check_time_format(const char *str);
char *make_revocation_str(int rev_type, char *rev_arg);
int make_revoked(X509_REVOKED *rev, const char *str);
int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
-static CONF *conf=NULL;
-static CONF *extconf=NULL;
-static char *section=NULL;
-
-static int preserve=0;
-static int msie_hack=0;
+static CONF *conf = NULL;
+static CONF *extconf = NULL;
+static char *section = NULL;
+static int preserve = 0;
+static int msie_hack = 0;
int MAIN(int, char **);
int MAIN(int argc, char **argv)
- {
- ENGINE *e = NULL;
- char *key=NULL,*passargin=NULL;
- int create_ser = 0;
- int free_key = 0;
- int total=0;
- int total_done=0;
- int badops=0;
- int ret=1;
- int email_dn=1;
- int req=0;
- int verbose=0;
- int gencrl=0;
- int dorevoke=0;
- int doupdatedb=0;
- long crldays=0;
- long crlhours=0;
- long crlsec=0;
- long errorline= -1;
- char *configfile=NULL;
- char *md=NULL;
- char *policy=NULL;
- char *keyfile=NULL;
- char *certfile=NULL;
- int keyform=FORMAT_PEM;
- char *infile=NULL;
- char *spkac_file=NULL;
- char *ss_cert_file=NULL;
- char *ser_status=NULL;
- EVP_PKEY *pkey=NULL;
- int output_der = 0;
- char *outfile=NULL;
- char *outdir=NULL;
- char *serialfile=NULL;
- char *crlnumberfile=NULL;
- char *extensions=NULL;
- char *extfile=NULL;
- char *subj=NULL;
- unsigned long chtype = MBSTRING_ASC;
- int multirdn = 0;
- char *tmp_email_dn=NULL;
- char *crl_ext=NULL;
- int rev_type = REV_NONE;
- char *rev_arg = NULL;
- BIGNUM *serial=NULL;
- BIGNUM *crlnumber=NULL;
- char *startdate=NULL;
- char *enddate=NULL;
- long days=0;
- int batch=0;
- int notext=0;
- unsigned long nameopt = 0, certopt = 0;
- int default_op = 1;
- int ext_copy = EXT_COPY_NONE;
- int selfsign = 0;
- X509 *x509=NULL, *x509p = NULL;
- X509 *x=NULL;
- BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
- char *dbfile=NULL;
- CA_DB *db=NULL;
- X509_CRL *crl=NULL;
- X509_REVOKED *r=NULL;
- ASN1_TIME *tmptm;
- ASN1_INTEGER *tmpser;
- char *f;
- const char *p;
- char * const *pp;
- int i,j;
- const EVP_MD *dgst=NULL;
- STACK_OF(CONF_VALUE) *attribs=NULL;
- STACK_OF(X509) *cert_sk=NULL;
- STACK_OF(OPENSSL_STRING) *sigopts = NULL;
+{
+ ENGINE *e = NULL;
+ char *key = NULL, *passargin = NULL;
+ int create_ser = 0;
+ int free_key = 0;
+ int total = 0;
+ int total_done = 0;
+ int badops = 0;
+ int ret = 1;
+ int email_dn = 1;
+ int req = 0;
+ int verbose = 0;
+ int gencrl = 0;
+ int dorevoke = 0;
+ int doupdatedb = 0;
+ long crldays = 0;
+ long crlhours = 0;
+ long crlsec = 0;
+ long errorline = -1;
+ char *configfile = NULL;
+ char *md = NULL;
+ char *policy = NULL;
+ char *keyfile = NULL;
+ char *certfile = NULL;
+ int keyform = FORMAT_PEM;
+ char *infile = NULL;
+ char *spkac_file = NULL;
+ char *ss_cert_file = NULL;
+ char *ser_status = NULL;
+ EVP_PKEY *pkey = NULL;
+ int output_der = 0;
+ char *outfile = NULL;
+ char *outdir = NULL;
+ char *serialfile = NULL;
+ char *crlnumberfile = NULL;
+ char *extensions = NULL;
+ char *extfile = NULL;
+ char *subj = NULL;
+ unsigned long chtype = MBSTRING_ASC;
+ int multirdn = 0;
+ char *tmp_email_dn = NULL;
+ char *crl_ext = NULL;
+ int rev_type = REV_NONE;
+ char *rev_arg = NULL;
+ BIGNUM *serial = NULL;
+ BIGNUM *crlnumber = NULL;
+ char *startdate = NULL;
+ char *enddate = NULL;
+ long days = 0;
+ int batch = 0;
+ int notext = 0;
+ unsigned long nameopt = 0, certopt = 0;
+ int default_op = 1;
+ int ext_copy = EXT_COPY_NONE;
+ int selfsign = 0;
+ X509 *x509 = NULL, *x509p = NULL;
+ X509 *x = NULL;
+ BIO *in = NULL, *out = NULL, *Sout = NULL, *Cout = NULL;
+ char *dbfile = NULL;
+ CA_DB *db = NULL;
+ X509_CRL *crl = NULL;
+ X509_REVOKED *r = NULL;
+ ASN1_TIME *tmptm;
+ ASN1_INTEGER *tmpser;
+ char *f;
+ const char *p;
+ char *const *pp;
+ int i, j;
+ const EVP_MD *dgst = NULL;
+ STACK_OF(CONF_VALUE) *attribs = NULL;
+ STACK_OF(X509) *cert_sk = NULL;
+ STACK_OF(OPENSSL_STRING) *sigopts = NULL;
#undef BSIZE
#define BSIZE 256
- MS_STATIC char buf[3][BSIZE];
- char *randfile=NULL;
+ MS_STATIC char buf[3][BSIZE];
+ char *randfile = NULL;
#ifndef OPENSSL_NO_ENGINE
- char *engine = NULL;
+ char *engine = NULL;
#endif
- char *tofree=NULL;
- DB_ATTR db_attr;
+ char *tofree = NULL;
+ DB_ATTR db_attr;
#ifdef EFENCE
-EF_PROTECT_FREE=1;
-EF_PROTECT_BELOW=1;
-EF_ALIGNMENT=0;
+ EF_PROTECT_FREE = 1;
+ EF_PROTECT_BELOW = 1;
+ EF_ALIGNMENT = 0;
#endif
- apps_startup();
-
- conf = NULL;
- key = NULL;
- section = NULL;
-
- preserve=0;
- msie_hack=0;
- if (bio_err == NULL)
- if ((bio_err=BIO_new(BIO_s_file())) != NULL)
- BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
-
- argc--;
- argv++;
- while (argc >= 1)
- {
- if (strcmp(*argv,"-verbose") == 0)
- verbose=1;
- else if (strcmp(*argv,"-config") == 0)
- {
- if (--argc < 1) goto bad;
- configfile= *(++argv);
- }
- else if (strcmp(*argv,"-name") == 0)
- {
- if (--argc < 1) goto bad;
- section= *(++argv);
- }
- else if (strcmp(*argv,"-subj") == 0)
- {
- if (--argc < 1) goto bad;
- subj= *(++argv);
- /* preserve=1; */
- }
- else if (strcmp(*argv,"-utf8") == 0)
- chtype = MBSTRING_UTF8;
- else if (strcmp(*argv,"-create_serial") == 0)
- create_ser = 1;
- else if (strcmp(*argv,"-multivalue-rdn") == 0)
- multirdn=1;
- else if (strcmp(*argv,"-startdate") == 0)
- {
- if (--argc < 1) goto bad;
- startdate= *(++argv);
- }
- else if (strcmp(*argv,"-enddate") == 0)
- {
- if (--argc < 1) goto bad;
- enddate= *(++argv);
- }
- else if (strcmp(*argv,"-days") == 0)
- {
- if (--argc < 1) goto bad;
- days=atoi(*(++argv));
- }
- else if (strcmp(*argv,"-md") == 0)
- {
- if (--argc < 1) goto bad;
- md= *(++argv);
- }
- else if (strcmp(*argv,"-policy") == 0)
- {
- if (--argc < 1) goto bad;
- policy= *(++argv);
- }
- else if (strcmp(*argv,"-keyfile") == 0)
- {
- if (--argc < 1) goto bad;
- keyfile= *(++argv);
- }
- else if (strcmp(*argv,"-keyform") == 0)
- {
- if (--argc < 1) goto bad;
- keyform=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-passin") == 0)
- {
- if (--argc < 1) goto bad;
- passargin= *(++argv);
- }
- else if (strcmp(*argv,"-key") == 0)
- {
- if (--argc < 1) goto bad;
- key= *(++argv);
- }
- else if (strcmp(*argv,"-cert") == 0)
- {
- if (--argc < 1) goto bad;
- certfile= *(++argv);
- }
- else if (strcmp(*argv,"-selfsign") == 0)
- selfsign=1;
- else if (strcmp(*argv,"-in") == 0)
- {
- if (--argc < 1) goto bad;
- infile= *(++argv);
- req=1;
- }
- else if (strcmp(*argv,"-out") == 0)
- {
- if (--argc < 1) goto bad;
- outfile= *(++argv);
- }
- else if (strcmp(*argv,"-outdir") == 0)
- {
- if (--argc < 1) goto bad;
- outdir= *(++argv);
- }
- else if (strcmp(*argv,"-sigopt") == 0)
- {
- if (--argc < 1)
- goto bad;
- if (!sigopts)
- sigopts = sk_OPENSSL_STRING_new_null();
- if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, *(++argv)))
- goto bad;
- }
- else if (strcmp(*argv,"-notext") == 0)
- notext=1;
- else if (strcmp(*argv,"-batch") == 0)
- batch=1;
- else if (strcmp(*argv,"-preserveDN") == 0)
- preserve=1;
- else if (strcmp(*argv,"-noemailDN") == 0)
- email_dn=0;
- else if (strcmp(*argv,"-gencrl") == 0)
- gencrl=1;
- else if (strcmp(*argv,"-msie_hack") == 0)
- msie_hack=1;
- else if (strcmp(*argv,"-crldays") == 0)
- {
- if (--argc < 1) goto bad;
- crldays= atol(*(++argv));
- }
- else if (strcmp(*argv,"-crlhours") == 0)
- {
- if (--argc < 1) goto bad;
- crlhours= atol(*(++argv));
- }
- else if (strcmp(*argv,"-crlsec") == 0)
- {
- if (--argc < 1) goto bad;
- crlsec = atol(*(++argv));
- }
- else if (strcmp(*argv,"-infiles") == 0)
- {
- argc--;
- argv++;
- req=1;
- break;
- }
- else if (strcmp(*argv, "-ss_cert") == 0)
- {
- if (--argc < 1) goto bad;
- ss_cert_file = *(++argv);
- req=1;
- }
- else if (strcmp(*argv, "-spkac") == 0)
- {
- if (--argc < 1) goto bad;
- spkac_file = *(++argv);
- req=1;
- }
- else if (strcmp(*argv,"-revoke") == 0)
- {
- if (--argc < 1) goto bad;
- infile= *(++argv);
- dorevoke=1;
- }
- else if (strcmp(*argv,"-extensions") == 0)
- {
- if (--argc < 1) goto bad;
- extensions= *(++argv);
- }
- else if (strcmp(*argv,"-extfile") == 0)
- {
- if (--argc < 1) goto bad;
- extfile= *(++argv);
- }
- else if (strcmp(*argv,"-status") == 0)
- {
- if (--argc < 1) goto bad;
- ser_status= *(++argv);
- }
- else if (strcmp(*argv,"-updatedb") == 0)
- {
- doupdatedb=1;
- }
- else if (strcmp(*argv,"-crlexts") == 0)
- {
- if (--argc < 1) goto bad;
- crl_ext= *(++argv);
- }
- else if (strcmp(*argv,"-crl_reason") == 0)
- {
- if (--argc < 1) goto bad;
- rev_arg = *(++argv);
- rev_type = REV_CRL_REASON;
- }
- else if (strcmp(*argv,"-crl_hold") == 0)
- {
- if (--argc < 1) goto bad;
- rev_arg = *(++argv);
- rev_type = REV_HOLD;
- }
- else if (strcmp(*argv,"-crl_compromise") == 0)
- {
- if (--argc < 1) goto bad;
- rev_arg = *(++argv);
- rev_type = REV_KEY_COMPROMISE;
- }
- else if (strcmp(*argv,"-crl_CA_compromise") == 0)
- {
- if (--argc < 1) goto bad;
- rev_arg = *(++argv);
- rev_type = REV_CA_COMPROMISE;
- }
+ apps_startup();
+
+ conf = NULL;
+ key = NULL;
+ section = NULL;
+
+ preserve = 0;
+ msie_hack = 0;
+ if (bio_err == NULL)
+ if ((bio_err = BIO_new(BIO_s_file())) != NULL)
+ BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
+
+ argc--;
+ argv++;
+ while (argc >= 1) {
+ if (strcmp(*argv, "-verbose") == 0)
+ verbose = 1;
+ else if (strcmp(*argv, "-config") == 0) {
+ if (--argc < 1)
+ goto bad;
+ configfile = *(++argv);
+ } else if (strcmp(*argv, "-name") == 0) {
+ if (--argc < 1)
+ goto bad;
+ section = *(++argv);
+ } else if (strcmp(*argv, "-subj") == 0) {
+ if (--argc < 1)
+ goto bad;
+ subj = *(++argv);
+ /* preserve=1; */
+ } else if (strcmp(*argv, "-utf8") == 0)
+ chtype = MBSTRING_UTF8;
+ else if (strcmp(*argv, "-create_serial") == 0)
+ create_ser = 1;
+ else if (strcmp(*argv, "-multivalue-rdn") == 0)
+ multirdn = 1;
+ else if (strcmp(*argv, "-startdate") == 0) {
+ if (--argc < 1)
+ goto bad;
+ startdate = *(++argv);
+ } else if (strcmp(*argv, "-enddate") == 0) {
+ if (--argc < 1)
+ goto bad;
+ enddate = *(++argv);
+ } else if (strcmp(*argv, "-days") == 0) {
+ if (--argc < 1)
+ goto bad;
+ days = atoi(*(++argv));
+ } else if (strcmp(*argv, "-md") == 0) {
+ if (--argc < 1)
+ goto bad;
+ md = *(++argv);
+ } else if (strcmp(*argv, "-policy") == 0) {
+ if (--argc < 1)
+ goto bad;
+ policy = *(++argv);
+ } else if (strcmp(*argv, "-keyfile") == 0) {
+ if (--argc < 1)
+ goto bad;
+ keyfile = *(++argv);
+ } else if (strcmp(*argv, "-keyform") == 0) {
+ if (--argc < 1)
+ goto bad;
+ keyform = str2fmt(*(++argv));
+ } else if (strcmp(*argv, "-passin") == 0) {
+ if (--argc < 1)
+ goto bad;
+ passargin = *(++argv);
+ } else if (strcmp(*argv, "-key") == 0) {
+ if (--argc < 1)
+ goto bad;
+ key = *(++argv);
+ } else if (strcmp(*argv, "-cert") == 0) {
+ if (--argc < 1)
+ goto bad;
+ certfile = *(++argv);
+ } else if (strcmp(*argv, "-selfsign") == 0)
+ selfsign = 1;
+ else if (strcmp(*argv, "-in") == 0) {
+ if (--argc < 1)
+ goto bad;
+ infile = *(++argv);
+ req = 1;
+ } else if (strcmp(*argv, "-out") == 0) {
+ if (--argc < 1)
+ goto bad;
+ outfile = *(++argv);
+ } else if (strcmp(*argv, "-outdir") == 0) {
+ if (--argc < 1)
+ goto bad;
+ outdir = *(++argv);
+ } else if (strcmp(*argv, "-sigopt") == 0) {
+ if (--argc < 1)
+ goto bad;
+ if (!sigopts)
+ sigopts = sk_OPENSSL_STRING_new_null();
+ if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, *(++argv)))
+ goto bad;
+ } else if (strcmp(*argv, "-notext") == 0)
+ notext = 1;
+ else if (strcmp(*argv, "-batch") == 0)
+ batch = 1;
+ else if (strcmp(*argv, "-preserveDN") == 0)
+ preserve = 1;
+ else if (strcmp(*argv, "-noemailDN") == 0)
+ email_dn = 0;
+ else if (strcmp(*argv, "-gencrl") == 0)
+ gencrl = 1;
+ else if (strcmp(*argv, "-msie_hack") == 0)
+ msie_hack = 1;
+ else if (strcmp(*argv, "-crldays") == 0) {
+ if (--argc < 1)
+ goto bad;
+ crldays = atol(*(++argv));
+ } else if (strcmp(*argv, "-crlhours") == 0) {
+ if (--argc < 1)
+ goto bad;
+ crlhours = atol(*(++argv));
+ } else if (strcmp(*argv, "-crlsec") == 0) {
+ if (--argc < 1)
+ goto bad;
+ crlsec = atol(*(++argv));
+ } else if (strcmp(*argv, "-infiles") == 0) {
+ argc--;
+ argv++;
+ req = 1;
+ break;
+ } else if (strcmp(*argv, "-ss_cert") == 0) {
+ if (--argc < 1)
+ goto bad;
+ ss_cert_file = *(++argv);
+ req = 1;
+ } else if (strcmp(*argv, "-spkac") == 0) {
+ if (--argc < 1)
+ goto bad;
+ spkac_file = *(++argv);
+ req = 1;
+ } else if (strcmp(*argv, "-revoke") == 0) {
+ if (--argc < 1)
+ goto bad;
+ infile = *(++argv);
+ dorevoke = 1;
+ } else if (strcmp(*argv, "-extensions") == 0) {
+ if (--argc < 1)
+ goto bad;
+ extensions = *(++argv);
+ } else if (strcmp(*argv, "-extfile") == 0) {
+ if (--argc < 1)
+ goto bad;
+ extfile = *(++argv);
+ } else if (strcmp(*argv, "-status") == 0) {
+ if (--argc < 1)
+ goto bad;
+ ser_status = *(++argv);
+ } else if (strcmp(*argv, "-updatedb") == 0) {
+ doupdatedb = 1;
+ } else if (strcmp(*argv, "-crlexts") == 0) {
+ if (--argc < 1)
+ goto bad;
+ crl_ext = *(++argv);
+ } else if (strcmp(*argv, "-crl_reason") == 0) {
+ if (--argc < 1)
+ goto bad;
+ rev_arg = *(++argv);
+ rev_type = REV_CRL_REASON;
+ } else if (strcmp(*argv, "-crl_hold") == 0) {
+ if (--argc < 1)
+ goto bad;
+ rev_arg = *(++argv);
+ rev_type = REV_HOLD;
+ } else if (strcmp(*argv, "-crl_compromise") == 0) {
+ if (--argc < 1)
+ goto bad;
+ rev_arg = *(++argv);
+ rev_type = REV_KEY_COMPROMISE;
+ } else if (strcmp(*argv, "-crl_CA_compromise") == 0) {
+ if (--argc < 1)
+ goto bad;
+ rev_arg = *(++argv);
+ rev_type = REV_CA_COMPROMISE;
+ }
#ifndef OPENSSL_NO_ENGINE
- else if (strcmp(*argv,"-engine") == 0)
- {
- if (--argc < 1) goto bad;
- engine= *(++argv);
- }
+ else if (strcmp(*argv, "-engine") == 0) {
+ if (--argc < 1)
+ goto bad;
+ engine = *(++argv);
+ }
#endif
- else
- {
-bad:
- BIO_printf(bio_err,"unknown option %s\n",*argv);
- badops=1;
- break;
- }
- argc--;
- argv++;
- }
-
- if (badops)
- {
- const char **pp2;
-
- for (pp2=ca_usage; (*pp2 != NULL); pp2++)
- BIO_printf(bio_err,"%s",*pp2);
- goto err;
- }
-
- ERR_load_crypto_strings();
-
- /*****************************************************************/
- tofree=NULL;
- if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
- if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
- if (configfile == NULL)
- {
- const char *s=X509_get_default_cert_area();
- size_t len;
+ else {
+ bad:
+ BIO_printf(bio_err, "unknown option %s\n", *argv);
+ badops = 1;
+ break;
+ }
+ argc--;
+ argv++;
+ }
+
+ if (badops) {
+ const char **pp2;
+
+ for (pp2 = ca_usage; (*pp2 != NULL); pp2++)
+ BIO_printf(bio_err, "%s", *pp2);
+ goto err;
+ }
+
+ ERR_load_crypto_strings();
+
+ /*****************************************************************/
+ tofree = NULL;
+ if (configfile == NULL)
+ configfile = getenv("OPENSSL_CONF");
+ if (configfile == NULL)
+ configfile = getenv("SSLEAY_CONF");
+ if (configfile == NULL) {
+ const char *s = X509_get_default_cert_area();
+ size_t len;
#ifdef OPENSSL_SYS_VMS
- len = strlen(s)+sizeof(CONFIG_FILE);
- tofree=OPENSSL_malloc(len);
- strcpy(tofree,s);
+ len = strlen(s) + sizeof(CONFIG_FILE);
+ tofree = OPENSSL_malloc(len);
+ if(!tofree) {
+ BIO_printf(bio_err, "Out of memory\n");
+ goto err;
+ }
+ strcpy(tofree, s);
#else
- len = strlen(s)+sizeof(CONFIG_FILE)+1;
- tofree=OPENSSL_malloc(len);
- BUF_strlcpy(tofree,s,len);
- BUF_strlcat(tofree,"/",len);
+ len = strlen(s) + sizeof(CONFIG_FILE) + 1;
+ tofree = OPENSSL_malloc(len);
+ if(!tofree) {
+ BIO_printf(bio_err, "Out of memory\n");
+ goto err;
+ }
+ BUF_strlcpy(tofree, s, len);
+ BUF_strlcat(tofree, "/", len);
#endif
- BUF_strlcat(tofree,CONFIG_FILE,len);
- configfile=tofree;
- }
-
- BIO_printf(bio_err,"Using configuration from %s\n",configfile);
- conf = NCONF_new(NULL);
- if (NCONF_load(conf,configfile,&errorline) <= 0)
- {
- if (errorline <= 0)
- BIO_printf(bio_err,"error loading the config file '%s'\n",
- configfile);
- else
- BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
- ,errorline,configfile);
- goto err;
- }
- if(tofree)
- {
- OPENSSL_free(tofree);
- tofree = NULL;
- }
-
- if (!load_config(bio_err, conf))
- goto err;
+ BUF_strlcat(tofree, CONFIG_FILE, len);
+ configfile = tofree;
+ }
+
+ BIO_printf(bio_err, "Using configuration from %s\n", configfile);
+ conf = NCONF_new(NULL);
+ if (NCONF_load(conf, configfile, &errorline) <= 0) {
+ if (errorline <= 0)
+ BIO_printf(bio_err, "error loading the config file '%s'\n",
+ configfile);
+ else
+ BIO_printf(bio_err, "error on line %ld of config file '%s'\n",
+ errorline, configfile);
+ goto err;
+ }
+ if (tofree) {
+ OPENSSL_free(tofree);
+ tofree = NULL;
+ }
+
+ if (!load_config(bio_err, conf))
+ goto err;
#ifndef OPENSSL_NO_ENGINE
- e = setup_engine(bio_err, engine, 0);
+ e = setup_engine(bio_err, engine, 0);
#endif
- /* Lets get the config section we are using */
- if (section == NULL)
- {
- section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
- if (section == NULL)
- {
- lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
- goto err;
- }
- }
-
- if (conf != NULL)
- {
- p=NCONF_get_string(conf,NULL,"oid_file");
- if (p == NULL)
- ERR_clear_error();
- if (p != NULL)
- {
- BIO *oid_bio;
-
- oid_bio=BIO_new_file(p,"r");
- if (oid_bio == NULL)
- {
- /*
- BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
- ERR_print_errors(bio_err);
- */
- ERR_clear_error();
- }
- else
- {
- OBJ_create_objects(oid_bio);
- BIO_free(oid_bio);
- }
- }
- if (!add_oid_section(bio_err,conf))
- {
- ERR_print_errors(bio_err);
- goto err;
- }
- }
-
- randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
- if (randfile == NULL)
- ERR_clear_error();
- app_RAND_load_file(randfile, bio_err, 0);
-
- f = NCONF_get_string(conf, section, STRING_MASK);
- if (!f)
- ERR_clear_error();
-
- if(f && !ASN1_STRING_set_default_mask_asc(f)) {
- BIO_printf(bio_err, "Invalid global string mask setting %s\n", f);
- goto err;
- }
-
- if (chtype != MBSTRING_UTF8){
- f = NCONF_get_string(conf, section, UTF8_IN);
- if (!f)
- ERR_clear_error();
- else if (!strcmp(f, "yes"))
- chtype = MBSTRING_UTF8;
- }
-
- db_attr.unique_subject = 1;
- p = NCONF_get_string(conf, section, ENV_UNIQUE_SUBJECT);
- if (p)
- {
+ /* Lets get the config section we are using */
+ if (section == NULL) {
+ section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_CA);
+ if (section == NULL) {
+ lookup_fail(BASE_SECTION, ENV_DEFAULT_CA);
+ goto err;
+ }
+ }
+
+ if (conf != NULL) {
+ p = NCONF_get_string(conf, NULL, "oid_file");
+ if (p == NULL)
+ ERR_clear_error();
+ if (p != NULL) {
+ BIO *oid_bio;
+
+ oid_bio = BIO_new_file(p, "r");
+ if (oid_bio == NULL) {
+ /*-
+ BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
+ ERR_print_errors(bio_err);
+ */
+ ERR_clear_error();
+ } else {
+ OBJ_create_objects(oid_bio);
+ BIO_free(oid_bio);
+ }
+ }
+ if (!add_oid_section(bio_err, conf)) {
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+ }
+
+ randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
+ if (randfile == NULL)
+ ERR_clear_error();
+ app_RAND_load_file(randfile, bio_err, 0);
+
+ f = NCONF_get_string(conf, section, STRING_MASK);
+ if (!f)
+ ERR_clear_error();
+
+ if (f && !ASN1_STRING_set_default_mask_asc(f)) {
+ BIO_printf(bio_err, "Invalid global string mask setting %s\n", f);
+ goto err;
+ }
+
+ if (chtype != MBSTRING_UTF8) {
+ f = NCONF_get_string(conf, section, UTF8_IN);
+ if (!f)
+ ERR_clear_error();
+ else if (!strcmp(f, "yes"))
+ chtype = MBSTRING_UTF8;
+ }
+
+ db_attr.unique_subject = 1;
+ p = NCONF_get_string(conf, section, ENV_UNIQUE_SUBJECT);
+ if (p) {
#ifdef RL_DEBUG
- BIO_printf(bio_err, "DEBUG: unique_subject = \"%s\"\n", p);
+ BIO_printf(bio_err, "DEBUG: unique_subject = \"%s\"\n", p);
#endif
- db_attr.unique_subject = parse_yesno(p,1);
- }
- else
- ERR_clear_error();
+ db_attr.unique_subject = parse_yesno(p, 1);
+ } else
+ ERR_clear_error();
#ifdef RL_DEBUG
- if (!p)
- BIO_printf(bio_err, "DEBUG: unique_subject undefined\n");
+ if (!p)
+ BIO_printf(bio_err, "DEBUG: unique_subject undefined\n");
#endif
#ifdef RL_DEBUG
- BIO_printf(bio_err, "DEBUG: configured unique_subject is %d\n",
- db_attr.unique_subject);
+ BIO_printf(bio_err, "DEBUG: configured unique_subject is %d\n",
+ db_attr.unique_subject);
#endif
-
- in=BIO_new(BIO_s_file());
- out=BIO_new(BIO_s_file());
- Sout=BIO_new(BIO_s_file());
- Cout=BIO_new(BIO_s_file());
- if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
- {
- ERR_print_errors(bio_err);
- goto err;
- }
-
- /*****************************************************************/
- /* report status of cert with serial number given on command line */
- if (ser_status)
- {
- if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
- {
- lookup_fail(section,ENV_DATABASE);
- goto err;
- }
- db = load_index(dbfile,&db_attr);
- if (db == NULL) goto err;
-
- if (!index_index(db)) goto err;
-
- if (get_certificate_status(ser_status,db) != 1)
- BIO_printf(bio_err,"Error verifying serial %s!\n",
- ser_status);
- goto err;
- }
-
- /*****************************************************************/
- /* we definitely need a private key, so let's get it */
-
- if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
- section,ENV_PRIVATE_KEY)) == NULL))
- {
- lookup_fail(section,ENV_PRIVATE_KEY);
- goto err;
- }
- if (!key)
- {
- free_key = 1;
- if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
- {
- BIO_printf(bio_err,"Error getting password\n");
- goto err;
- }
- }
- pkey = load_key(bio_err, keyfile, keyform, 0, key, e,
- "CA private key");
- if (key) OPENSSL_cleanse(key,strlen(key));
- if (pkey == NULL)
- {
- /* load_key() has already printed an appropriate message */
- goto err;
- }
-
- /*****************************************************************/
- /* we need a certificate */
- if (!selfsign || spkac_file || ss_cert_file || gencrl)
- {
- if ((certfile == NULL)
- && ((certfile=NCONF_get_string(conf,
- section,ENV_CERTIFICATE)) == NULL))
- {
- lookup_fail(section,ENV_CERTIFICATE);
- goto err;
- }
- x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
- "CA certificate");
- if (x509 == NULL)
- goto err;
-
- if (!X509_check_private_key(x509,pkey))
- {
- BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
- goto err;
- }
- }
- if (!selfsign) x509p = x509;
-
- f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
- if (f == NULL)
- ERR_clear_error();
- if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
- preserve=1;
- f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
- if (f == NULL)
- ERR_clear_error();
- if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
- msie_hack=1;
-
- f=NCONF_get_string(conf,section,ENV_NAMEOPT);
-
- if (f)
- {
- if (!set_name_ex(&nameopt, f))
- {
- BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
- goto err;
- }
- default_op = 0;
- }
- else
- ERR_clear_error();
-
- f=NCONF_get_string(conf,section,ENV_CERTOPT);
-
- if (f)
- {
- if (!set_cert_ex(&certopt, f))
- {
- BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
- goto err;
- }
- default_op = 0;
- }
- else
- ERR_clear_error();
-
- f=NCONF_get_string(conf,section,ENV_EXTCOPY);
-
- if (f)
- {
- if (!set_ext_copy(&ext_copy, f))
- {
- BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
- goto err;
- }
- }
- else
- ERR_clear_error();
-
- /*****************************************************************/
- /* lookup where to write new certificates */
- if ((outdir == NULL) && (req))
- {
-
- if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
- == NULL)
- {
- BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
- goto err;
- }
+
+ in = BIO_new(BIO_s_file());
+ out = BIO_new(BIO_s_file());
+ Sout = BIO_new(BIO_s_file());
+ Cout = BIO_new(BIO_s_file());
+ if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL)) {
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+
+ /*****************************************************************/
+ /* report status of cert with serial number given on command line */
+ if (ser_status) {
+ if ((dbfile = NCONF_get_string(conf, section, ENV_DATABASE)) == NULL) {
+ lookup_fail(section, ENV_DATABASE);
+ goto err;
+ }
+ db = load_index(dbfile, &db_attr);
+ if (db == NULL)
+ goto err;
+
+ if (!index_index(db))
+ goto err;
+
+ if (get_certificate_status(ser_status, db) != 1)
+ BIO_printf(bio_err, "Error verifying serial %s!\n", ser_status);
+ goto err;
+ }
+
+ /*****************************************************************/
+ /* we definitely need a private key, so let's get it */
+
+ if ((keyfile == NULL) && ((keyfile = NCONF_get_string(conf,
+ section,
+ ENV_PRIVATE_KEY)) ==
+ NULL)) {
+ lookup_fail(section, ENV_PRIVATE_KEY);
+ goto err;
+ }
+ if (!key) {
+ free_key = 1;
+ if (!app_passwd(bio_err, passargin, NULL, &key, NULL)) {
+ BIO_printf(bio_err, "Error getting password\n");
+ goto err;
+ }
+ }
+ pkey = load_key(bio_err, keyfile, keyform, 0, key, e, "CA private key");
+ if (key)
+ OPENSSL_cleanse(key, strlen(key));
+ if (pkey == NULL) {
+ /* load_key() has already printed an appropriate message */
+ goto err;
+ }
+
+ /*****************************************************************/
+ /* we need a certificate */
+ if (!selfsign || spkac_file || ss_cert_file || gencrl) {
+ if ((certfile == NULL)
+ && ((certfile = NCONF_get_string(conf,
+ section,
+ ENV_CERTIFICATE)) == NULL)) {
+ lookup_fail(section, ENV_CERTIFICATE);
+ goto err;
+ }
+ x509 = load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
+ "CA certificate");
+ if (x509 == NULL)
+ goto err;
+
+ if (!X509_check_private_key(x509, pkey)) {
+ BIO_printf(bio_err,
+ "CA certificate and CA private key do not match\n");
+ goto err;
+ }
+ }
+ if (!selfsign)
+ x509p = x509;
+
+ f = NCONF_get_string(conf, BASE_SECTION, ENV_PRESERVE);
+ if (f == NULL)
+ ERR_clear_error();
+ if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
+ preserve = 1;
+ f = NCONF_get_string(conf, BASE_SECTION, ENV_MSIE_HACK);
+ if (f == NULL)
+ ERR_clear_error();
+ if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
+ msie_hack = 1;
+
+ f = NCONF_get_string(conf, section, ENV_NAMEOPT);
+
+ if (f) {
+ if (!set_name_ex(&nameopt, f)) {
+ BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
+ goto err;
+ }
+ default_op = 0;
+ } else
+ ERR_clear_error();
+
+ f = NCONF_get_string(conf, section, ENV_CERTOPT);
+
+ if (f) {
+ if (!set_cert_ex(&certopt, f)) {
+ BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
+ goto err;
+ }
+ default_op = 0;
+ } else
+ ERR_clear_error();
+
+ f = NCONF_get_string(conf, section, ENV_EXTCOPY);
+
+ if (f) {
+ if (!set_ext_copy(&ext_copy, f)) {
+ BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
+ goto err;
+ }
+ } else
+ ERR_clear_error();
+
+ /*****************************************************************/
+ /* lookup where to write new certificates */
+ if ((outdir == NULL) && (req)) {
+
+ if ((outdir = NCONF_get_string(conf, section, ENV_NEW_CERTS_DIR))
+ == NULL) {
+ BIO_printf(bio_err,
+ "there needs to be defined a directory for new certificate to be placed in\n");
+ goto err;
+ }
#ifndef OPENSSL_SYS_VMS
- /* outdir is a directory spec, but access() for VMS demands a
- filename. In any case, stat(), below, will catch the problem
- if outdir is not a directory spec, and the fopen() or open()
- will catch an error if there is no write access.
-
- Presumably, this problem could also be solved by using the DEC
- C routines to convert the directory syntax to Unixly, and give
- that to access(). However, time's too short to do that just
- now.
- */
-#ifndef _WIN32
- if (access(outdir,R_OK|W_OK|X_OK) != 0)
-#else
- if (_access(outdir,R_OK|W_OK|X_OK) != 0)
-#endif
- {
- BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
- perror(outdir);
- goto err;
- }
-
- if (app_isdir(outdir)<=0)
- {
- BIO_printf(bio_err,"%s need to be a directory\n",outdir);
- perror(outdir);
- goto err;
- }
+ /*
+ * outdir is a directory spec, but access() for VMS demands a
+ * filename. In any case, stat(), below, will catch the problem if
+ * outdir is not a directory spec, and the fopen() or open() will
+ * catch an error if there is no write access.
+ *
+ * Presumably, this problem could also be solved by using the DEC C
+ * routines to convert the directory syntax to Unixly, and give that
+ * to access(). However, time's too short to do that just now.
+ */
+# ifndef _WIN32
+ if (access(outdir, R_OK | W_OK | X_OK) != 0)
+# else
+ if (_access(outdir, R_OK | W_OK | X_OK) != 0)
+# endif
+ {
+ BIO_printf(bio_err, "I am unable to access the %s directory\n",
+ outdir);
+ perror(outdir);
+ goto err;
+ }
+
+ if (app_isdir(outdir) <= 0) {
+ BIO_printf(bio_err, "%s need to be a directory\n", outdir);
+ perror(outdir);
+ goto err;
+ }
#endif
- }
-
- /*****************************************************************/
- /* we need to load the database file */
- if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
- {
- lookup_fail(section,ENV_DATABASE);
- goto err;
- }
- db = load_index(dbfile, &db_attr);
- if (db == NULL) goto err;
-
- /* Lets check some fields */
- for (i=0; i<sk_OPENSSL_PSTRING_num(db->db->data); i++)
- {
- pp=sk_OPENSSL_PSTRING_value(db->db->data,i);
- if ((pp[DB_type][0] != DB_TYPE_REV) &&
- (pp[DB_rev_date][0] != '\0'))
- {
- BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
- goto err;
- }
- if ((pp[DB_type][0] == DB_TYPE_REV) &&
- !make_revoked(NULL, pp[DB_rev_date]))
- {
- BIO_printf(bio_err," in entry %d\n", i+1);
- goto err;
- }
- if (!check_time_format((char *)pp[DB_exp_date]))
- {
- BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
- goto err;
- }
- p=pp[DB_serial];
- j=strlen(p);
- if (*p == '-')
- {
- p++;
- j--;
- }
- if ((j&1) || (j < 2))
- {
- BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
- goto err;
- }
- while (*p)
- {
- if (!( ((*p >= '0') && (*p <= '9')) ||
- ((*p >= 'A') && (*p <= 'F')) ||
- ((*p >= 'a') && (*p <= 'f'))) )
- {
- BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
- goto err;
- }
- p++;
- }
- }
- if (verbose)
- {
- BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
+ }
+
+ /*****************************************************************/
+ /* we need to load the database file */
+ if ((dbfile = NCONF_get_string(conf, section, ENV_DATABASE)) == NULL) {
+ lookup_fail(section, ENV_DATABASE);
+ goto err;
+ }
+ db = load_index(dbfile, &db_attr);
+ if (db == NULL)
+ goto err;
+
+ /* Lets check some fields */
+ for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
+ pp = sk_OPENSSL_PSTRING_value(db->db->data, i);
+ if ((pp[DB_type][0] != DB_TYPE_REV) && (pp[DB_rev_date][0] != '\0')) {
+ BIO_printf(bio_err,
+ "entry %d: not revoked yet, but has a revocation date\n",
+ i + 1);
+ goto err;
+ }
+ if ((pp[DB_type][0] == DB_TYPE_REV) &&
+ !make_revoked(NULL, pp[DB_rev_date])) {
+ BIO_printf(bio_err, " in entry %d\n", i + 1);
+ goto err;
+ }
+ if (!check_time_format((char *)pp[DB_exp_date])) {
+ BIO_printf(bio_err, "entry %d: invalid expiry date\n", i + 1);
+ goto err;
+ }
+ p = pp[DB_serial];
+ j = strlen(p);
+ if (*p == '-') {
+ p++;
+ j--;
+ }
+ if ((j & 1) || (j < 2)) {
+ BIO_printf(bio_err, "entry %d: bad serial number length (%d)\n",
+ i + 1, j);
+ goto err;
+ }
+ while (*p) {
+ if (!(((*p >= '0') && (*p <= '9')) ||
+ ((*p >= 'A') && (*p <= 'F')) ||
+ ((*p >= 'a') && (*p <= 'f')))) {
+ BIO_printf(bio_err,
+ "entry %d: bad serial number characters, char pos %ld, char is '%c'\n",
+ i + 1, (long)(p - pp[DB_serial]), *p);
+ goto err;
+ }
+ p++;
+ }
+ }
+ if (verbose) {
+ BIO_set_fp(out, stdout, BIO_NOCLOSE | BIO_FP_TEXT); /* cannot fail */
#ifdef OPENSSL_SYS_VMS
- {
- BIO *tmpbio = BIO_new(BIO_f_linebuffer());
- out = BIO_push(tmpbio, out);
- }
+ {
+ BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+ out = BIO_push(tmpbio, out);
+ }
#endif
- TXT_DB_write(out,db->db);
- BIO_printf(bio_err,"%d entries loaded from the database\n",
- sk_OPENSSL_PSTRING_num(db->db->data));
- BIO_printf(bio_err,"generating index\n");
- }
-
- if (!index_index(db)) goto err;
-
- /*****************************************************************/
- /* Update the db file for expired certificates */
- if (doupdatedb)
- {
- if (verbose)
- BIO_printf(bio_err, "Updating %s ...\n",
- dbfile);
-
- i = do_updatedb(db);
- if (i == -1)
- {
- BIO_printf(bio_err,"Malloc failure\n");
- goto err;
- }
- else if (i == 0)
- {
- if (verbose) BIO_printf(bio_err,
- "No entries found to mark expired\n");
- }
- else
- {
- if (!save_index(dbfile,"new",db)) goto err;
-
- if (!rotate_index(dbfile,"new","old")) goto err;
-
- if (verbose) BIO_printf(bio_err,
- "Done. %d entries marked as expired\n",i);
- }
- }
-
- /*****************************************************************/
- /* Read extentions config file */
- if (extfile)
- {
- extconf = NCONF_new(NULL);
- if (NCONF_load(extconf,extfile,&errorline) <= 0)
- {
- if (errorline <= 0)
- BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
- extfile);
- else
- BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
- errorline,extfile);
- ret = 1;
- goto err;
- }
-
- if (verbose)
- BIO_printf(bio_err, "Successfully loaded extensions file %s\n", extfile);
-
- /* We can have sections in the ext file */
- if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
- extensions = "default";
- }
-
- /*****************************************************************/
- if (req || gencrl)
- {
- if (outfile != NULL)
- {
- if (BIO_write_filename(Sout,outfile) <= 0)
- {
- perror(outfile);
- goto err;
- }
- }
- else
- {
- BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
+ TXT_DB_write(out, db->db);
+ BIO_printf(bio_err, "%d entries loaded from the database\n",
+ sk_OPENSSL_PSTRING_num(db->db->data));
+ BIO_printf(bio_err, "generating index\n");
+ }
+
+ if (!index_index(db))
+ goto err;
+
+ /*****************************************************************/
+ /* Update the db file for expired certificates */
+ if (doupdatedb) {
+ if (verbose)
+ BIO_printf(bio_err, "Updating %s ...\n", dbfile);
+
+ i = do_updatedb(db);
+ if (i == -1) {
+ BIO_printf(bio_err, "Malloc failure\n");
+ goto err;
+ } else if (i == 0) {
+ if (verbose)
+ BIO_printf(bio_err, "No entries found to mark expired\n");
+ } else {
+ if (!save_index(dbfile, "new", db))
+ goto err;
+
+ if (!rotate_index(dbfile, "new", "old"))
+ goto err;
+
+ if (verbose)
+ BIO_printf(bio_err,
+ "Done. %d entries marked as expired\n", i);
+ }
+ }
+
+ /*****************************************************************/
+ /* Read extentions config file */
+ if (extfile) {
+ extconf = NCONF_new(NULL);
+ if (NCONF_load(extconf, extfile, &errorline) <= 0) {
+ if (errorline <= 0)
+ BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
+ extfile);
+ else
+ BIO_printf(bio_err,
+ "ERROR: on line %ld of config file '%s'\n",
+ errorline, extfile);
+ ret = 1;
+ goto err;
+ }
+
+ if (verbose)
+ BIO_printf(bio_err, "Successfully loaded extensions file %s\n",
+ extfile);
+
+ /* We can have sections in the ext file */
+ if (!extensions
+ && !(extensions =
+ NCONF_get_string(extconf, "default", "extensions")))
+ extensions = "default";
+ }
+
+ /*****************************************************************/
+ if (req || gencrl) {
+ if (outfile != NULL) {
+ if (BIO_write_filename(Sout, outfile) <= 0) {
+ perror(outfile);
+ goto err;
+ }
+ } else {
+ BIO_set_fp(Sout, stdout, BIO_NOCLOSE | BIO_FP_TEXT);
#ifdef OPENSSL_SYS_VMS
- {
- BIO *tmpbio = BIO_new(BIO_f_linebuffer());
- Sout = BIO_push(tmpbio, Sout);
- }
+ {
+ BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+ Sout = BIO_push(tmpbio, Sout);
+ }
#endif
- }
- }
-
- if ((md == NULL) && ((md=NCONF_get_string(conf,
- section,ENV_DEFAULT_MD)) == NULL))
- {
- lookup_fail(section,ENV_DEFAULT_MD);
- goto err;
- }
-
- if (!strcmp(md, "default"))
- {
- int def_nid;
- if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0)
- {
- BIO_puts(bio_err,"no default digest\n");
- goto err;
- }
- md = (char *)OBJ_nid2sn(def_nid);
- }
-
- if ((dgst=EVP_get_digestbyname(md)) == NULL)
- {
- BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
- goto err;
- }
-
- if (req)
- {
- if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
- section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
- {
- if(strcmp(tmp_email_dn,"no") == 0)
- email_dn=0;
- }
- if (verbose)
- BIO_printf(bio_err,"message digest is %s\n",
- OBJ_nid2ln(dgst->type));
- if ((policy == NULL) && ((policy=NCONF_get_string(conf,
- section,ENV_POLICY)) == NULL))
- {
- lookup_fail(section,ENV_POLICY);
- goto err;
- }
- if (verbose)
- BIO_printf(bio_err,"policy is %s\n",policy);
-
- if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
- == NULL)
- {
- lookup_fail(section,ENV_SERIAL);
- goto err;
- }
-
- if (!extconf)
- {
- /* no '-extfile' option, so we look for extensions
- * in the main configuration file */
- if (!extensions)
- {
- extensions=NCONF_get_string(conf,section,
- ENV_EXTENSIONS);
- if (!extensions)
- ERR_clear_error();
- }
- if (extensions)
- {
- /* Check syntax of file */
- X509V3_CTX ctx;
- X509V3_set_ctx_test(&ctx);
- X509V3_set_nconf(&ctx, conf);
- if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
- NULL))
- {
- BIO_printf(bio_err,
- "Error Loading extension section %s\n",
- extensions);
- ret = 1;
- goto err;
- }
- }
- }
-
- if (startdate == NULL)
- {
- startdate=NCONF_get_string(conf,section,
- ENV_DEFAULT_STARTDATE);
- if (startdate == NULL)
- ERR_clear_error();
- }
- if (startdate && !ASN1_TIME_set_string(NULL, startdate))
- {
- BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
- goto err;
- }
- if (startdate == NULL) startdate="today";
-
- if (enddate == NULL)
- {
- enddate=NCONF_get_string(conf,section,
- ENV_DEFAULT_ENDDATE);
- if (enddate == NULL)
- ERR_clear_error();
- }
- if (enddate && !ASN1_TIME_set_string(NULL, enddate))
- {
- BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
- goto err;
- }
-
- if (days == 0)
- {
- if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
- days = 0;
- }
- if (!enddate && (days == 0))
- {
- BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
- goto err;
- }
-
- if ((serial=load_serial(serialfile, create_ser, NULL)) == NULL)
- {
- BIO_printf(bio_err,"error while loading serial number\n");
- goto err;
- }
- if (verbose)
- {
- if (BN_is_zero(serial))
- BIO_printf(bio_err,"next serial number is 00\n");
- else
- {
- if ((f=BN_bn2hex(serial)) == NULL) goto err;
- BIO_printf(bio_err,"next serial number is %s\n",f);
- OPENSSL_free(f);
- }
- }
-
- if ((attribs=NCONF_get_section(conf,policy)) == NULL)
- {
- BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
- goto err;
- }
-
- if ((cert_sk=sk_X509_new_null()) == NULL)
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- if (spkac_file != NULL)
- {
- total++;
- j=certify_spkac(&x,spkac_file,pkey,x509,dgst,sigopts,
- attribs,db, serial,subj,chtype,multirdn,
- email_dn,startdate,enddate,days,extensions,
- conf,verbose,certopt,nameopt,default_op,ext_copy);
- if (j < 0) goto err;
- if (j > 0)
- {
- total_done++;
- BIO_printf(bio_err,"\n");
- if (!BN_add_word(serial,1)) goto err;
- if (!sk_X509_push(cert_sk,x))
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- if (outfile)
- {
- output_der = 1;
- batch = 1;
- }
- }
- }
- if (ss_cert_file != NULL)
- {
- total++;
- j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,sigopts,
- attribs,
- db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
- extensions,conf,verbose, certopt, nameopt,
- default_op, ext_copy, e);
- if (j < 0) goto err;
- if (j > 0)
- {
- total_done++;
- BIO_printf(bio_err,"\n");
- if (!BN_add_word(serial,1)) goto err;
- if (!sk_X509_push(cert_sk,x))
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- }
- }
- if (infile != NULL)
- {
- total++;
- j=certify(&x,infile,pkey,x509p,dgst,sigopts, attribs,db,
- serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
- extensions,conf,verbose, certopt, nameopt,
- default_op, ext_copy, selfsign);
- if (j < 0) goto err;
- if (j > 0)
- {
- total_done++;
- BIO_printf(bio_err,"\n");
- if (!BN_add_word(serial,1)) goto err;
- if (!sk_X509_push(cert_sk,x))
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- }
- }
- for (i=0; i<argc; i++)
- {
- total++;
- j=certify(&x,argv[i],pkey,x509p,dgst,sigopts,attribs,db,
- serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
- extensions,conf,verbose, certopt, nameopt,
- default_op, ext_copy, selfsign);
- if (j < 0) goto err;
- if (j > 0)
- {
- total_done++;
- BIO_printf(bio_err,"\n");
- if (!BN_add_word(serial,1)) goto err;
- if (!sk_X509_push(cert_sk,x))
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- }
- }
- /* we have a stack of newly certified certificates
- * and a data base and serial number that need
- * updating */
-
- if (sk_X509_num(cert_sk) > 0)
- {
- if (!batch)
- {
- BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
- (void)BIO_flush(bio_err);
- buf[0][0]='\0';
- if (!fgets(buf[0],10,stdin))
- {
- BIO_printf(bio_err,"CERTIFICATION CANCELED: I/O error\n");
- ret=0;
- goto err;
- }
- if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
- {
- BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
- ret=0;
- goto err;
- }
- }
-
- BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
-
- if (!save_serial(serialfile,"new",serial,NULL)) goto err;
-
- if (!save_index(dbfile, "new", db)) goto err;
- }
-
- if (verbose)
- BIO_printf(bio_err,"writing new certificates\n");
- for (i=0; i<sk_X509_num(cert_sk); i++)
- {
- int k;
- char *n;
-
- x=sk_X509_value(cert_sk,i);
-
- j=x->cert_info->serialNumber->length;
- p=(const char *)x->cert_info->serialNumber->data;
-
- if(strlen(outdir) >= (size_t)(j ? BSIZE-j*2-6 : BSIZE-8))
- {
- BIO_printf(bio_err,"certificate file name too long\n");
- goto err;
- }
-
- strcpy(buf[2],outdir);
+ }
+ }
+
+ if ((md == NULL) && ((md = NCONF_get_string(conf,
+ section,
+ ENV_DEFAULT_MD)) == NULL)) {
+ lookup_fail(section, ENV_DEFAULT_MD);
+ goto err;
+ }
+
+ if (!strcmp(md, "default")) {
+ int def_nid;
+ if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0) {
+ BIO_puts(bio_err, "no default digest\n");
+ goto err;
+ }
+ md = (char *)OBJ_nid2sn(def_nid);
+ }
+
+ if ((dgst = EVP_get_digestbyname(md)) == NULL) {
+ BIO_printf(bio_err, "%s is an unsupported message digest type\n", md);
+ goto err;
+ }
+
+ if (req) {
+ if ((email_dn == 1) && ((tmp_email_dn = NCONF_get_string(conf,
+ section,
+ ENV_DEFAULT_EMAIL_DN))
+ != NULL)) {
+ if (strcmp(tmp_email_dn, "no") == 0)
+ email_dn = 0;
+ }
+ if (verbose)
+ BIO_printf(bio_err, "message digest is %s\n",
+ OBJ_nid2ln(dgst->type));
+ if ((policy == NULL) && ((policy = NCONF_get_string(conf,
+ section,
+ ENV_POLICY)) ==
+ NULL)) {
+ lookup_fail(section, ENV_POLICY);
+ goto err;
+ }
+ if (verbose)
+ BIO_printf(bio_err, "policy is %s\n", policy);
+
+ if ((serialfile = NCONF_get_string(conf, section, ENV_SERIAL))
+ == NULL) {
+ lookup_fail(section, ENV_SERIAL);
+ goto err;
+ }
+
+ if (!extconf) {
+ /*
+ * no '-extfile' option, so we look for extensions in the main
+ * configuration file
+ */
+ if (!extensions) {
+ extensions = NCONF_get_string(conf, section, ENV_EXTENSIONS);
+ if (!extensions)
+ ERR_clear_error();
+ }
+ if (extensions) {
+ /* Check syntax of file */
+ X509V3_CTX ctx;
+ X509V3_set_ctx_test(&ctx);
+ X509V3_set_nconf(&ctx, conf);
+ if (!X509V3_EXT_add_nconf(conf, &ctx, extensions, NULL)) {
+ BIO_printf(bio_err,
+ "Error Loading extension section %s\n",
+ extensions);
+ ret = 1;
+ goto err;
+ }
+ }
+ }
+
+ if (startdate == NULL) {
+ startdate = NCONF_get_string(conf, section,
+ ENV_DEFAULT_STARTDATE);
+ if (startdate == NULL)
+ ERR_clear_error();
+ }
+ if (startdate && !ASN1_TIME_set_string(NULL, startdate)) {
+ BIO_printf(bio_err,
+ "start date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
+ goto err;
+ }
+ if (startdate == NULL)
+ startdate = "today";
+
+ if (enddate == NULL) {
+ enddate = NCONF_get_string(conf, section, ENV_DEFAULT_ENDDATE);
+ if (enddate == NULL)
+ ERR_clear_error();
+ }
+ if (enddate && !ASN1_TIME_set_string(NULL, enddate)) {
+ BIO_printf(bio_err,
+ "end date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
+ goto err;
+ }
+
+ if (days == 0) {
+ if (!NCONF_get_number(conf, section, ENV_DEFAULT_DAYS, &days))
+ days = 0;
+ }
+ if (!enddate && (days == 0)) {
+ BIO_printf(bio_err,
+ "cannot lookup how many days to certify for\n");
+ goto err;
+ }
+
+ if ((serial = load_serial(serialfile, create_ser, NULL)) == NULL) {
+ BIO_printf(bio_err, "error while loading serial number\n");
+ goto err;
+ }
+ if (verbose) {
+ if (BN_is_zero(serial))
+ BIO_printf(bio_err, "next serial number is 00\n");
+ else {
+ if ((f = BN_bn2hex(serial)) == NULL)
+ goto err;
+ BIO_printf(bio_err, "next serial number is %s\n", f);
+ OPENSSL_free(f);
+ }
+ }
+
+ if ((attribs = NCONF_get_section(conf, policy)) == NULL) {
+ BIO_printf(bio_err, "unable to find 'section' for %s\n", policy);
+ goto err;
+ }
+
+ if ((cert_sk = sk_X509_new_null()) == NULL) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+ if (spkac_file != NULL) {
+ total++;
+ j = certify_spkac(&x, spkac_file, pkey, x509, dgst, sigopts,
+ attribs, db, serial, subj, chtype, multirdn,
+ email_dn, startdate, enddate, days, extensions,
+ conf, verbose, certopt, nameopt, default_op,
+ ext_copy);
+ if (j < 0)
+ goto err;
+ if (j > 0) {
+ total_done++;
+ BIO_printf(bio_err, "\n");
+ if (!BN_add_word(serial, 1))
+ goto err;
+ if (!sk_X509_push(cert_sk, x)) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+ if (outfile) {
+ output_der = 1;
+ batch = 1;
+ }
+ }
+ }
+ if (ss_cert_file != NULL) {
+ total++;
+ j = certify_cert(&x, ss_cert_file, pkey, x509, dgst, sigopts,
+ attribs,
+ db, serial, subj, chtype, multirdn, email_dn,
+ startdate, enddate, days, batch, extensions,
+ conf, verbose, certopt, nameopt, default_op,
+ ext_copy, e);
+ if (j < 0)
+ goto err;
+ if (j > 0) {
+ total_done++;
+ BIO_printf(bio_err, "\n");
+ if (!BN_add_word(serial, 1))
+ goto err;
+ if (!sk_X509_push(cert_sk, x)) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+ }
+ }
+ if (infile != NULL) {
+ total++;
+ j = certify(&x, infile, pkey, x509p, dgst, sigopts, attribs, db,
+ serial, subj, chtype, multirdn, email_dn, startdate,
+ enddate, days, batch, extensions, conf, verbose,
+ certopt, nameopt, default_op, ext_copy, selfsign);
+ if (j < 0)
+ goto err;
+ if (j > 0) {
+ total_done++;
+ BIO_printf(bio_err, "\n");
+ if (!BN_add_word(serial, 1))
+ goto err;
+ if (!sk_X509_push(cert_sk, x)) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+ }
+ }
+ for (i = 0; i < argc; i++) {
+ total++;
+ j = certify(&x, argv[i], pkey, x509p, dgst, sigopts, attribs, db,
+ serial, subj, chtype, multirdn, email_dn, startdate,
+ enddate, days, batch, extensions, conf, verbose,
+ certopt, nameopt, default_op, ext_copy, selfsign);
+ if (j < 0)
+ goto err;
+ if (j > 0) {
+ total_done++;
+ BIO_printf(bio_err, "\n");
+ if (!BN_add_word(serial, 1))
+ goto err;
+ if (!sk_X509_push(cert_sk, x)) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+ }
+ }
+ /*
+ * we have a stack of newly certified certificates and a data base
+ * and serial number that need updating
+ */
+
+ if (sk_X509_num(cert_sk) > 0) {
+ if (!batch) {
+ BIO_printf(bio_err,
+ "\n%d out of %d certificate requests certified, commit? [y/n]",
+ total_done, total);
+ (void)BIO_flush(bio_err);
+ buf[0][0] = '\0';
+ if (!fgets(buf[0], 10, stdin)) {
+ BIO_printf(bio_err,
+ "CERTIFICATION CANCELED: I/O error\n");
+ ret = 0;
+ goto err;
+ }
+ if ((buf[0][0] != 'y') && (buf[0][0] != 'Y')) {
+ BIO_printf(bio_err, "CERTIFICATION CANCELED\n");
+ ret = 0;
+ goto err;
+ }
+ }
+
+ BIO_printf(bio_err, "Write out database with %d new entries\n",
+ sk_X509_num(cert_sk));
+
+ if (!save_serial(serialfile, "new", serial, NULL))
+ goto err;
+
+ if (!save_index(dbfile, "new", db))
+ goto err;
+ }
+
+ if (verbose)
+ BIO_printf(bio_err, "writing new certificates\n");
+ for (i = 0; i < sk_X509_num(cert_sk); i++) {
+ int k;
+ char *n;
+
+ x = sk_X509_value(cert_sk, i);
+
+ j = x->cert_info->serialNumber->length;
+ p = (const char *)x->cert_info->serialNumber->data;
+
+ if (strlen(outdir) >= (size_t)(j ? BSIZE - j * 2 - 6 : BSIZE - 8)) {
+ BIO_printf(bio_err, "certificate file name too long\n");
+ goto err;
+ }
+
+ strcpy(buf[2], outdir);
#ifndef OPENSSL_SYS_VMS
- BUF_strlcat(buf[2],"/",sizeof(buf[2]));
+ BUF_strlcat(buf[2], "/", sizeof(buf[2]));
#endif
- n=(char *)&(buf[2][strlen(buf[2])]);
- if (j > 0)
- {
- for (k=0; k<j; k++)
- {
- if (n >= &(buf[2][sizeof(buf[2])]))
- break;
- BIO_snprintf(n,
- &buf[2][0] + sizeof(buf[2]) - n,
- "%02X",(unsigned char)*(p++));
- n+=2;
- }
- }
- else
- {
- *(n++)='0';
- *(n++)='0';
- }
- *(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
- *n='\0';
- if (verbose)
- BIO_printf(bio_err,"writing %s\n",buf[2]);
-
- if (BIO_write_filename(Cout,buf[2]) <= 0)
- {
- perror(buf[2]);
- goto err;
- }
- write_new_certificate(Cout,x, 0, notext);
- write_new_certificate(Sout,x, output_der, notext);
- }
-
- if (sk_X509_num(cert_sk))
- {
- /* Rename the database and the serial file */
- if (!rotate_serial(serialfile,"new","old")) goto err;
-
- if (!rotate_index(dbfile,"new","old")) goto err;
-
- BIO_printf(bio_err,"Data Base Updated\n");
- }
- }
-
- /*****************************************************************/
- if (gencrl)
- {
- int crl_v2 = 0;
- if (!crl_ext)
- {
- crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
- if (!crl_ext)
- ERR_clear_error();
- }
- if (crl_ext)
- {
- /* Check syntax of file */
- X509V3_CTX ctx;
- X509V3_set_ctx_test(&ctx);
- X509V3_set_nconf(&ctx, conf);
- if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
- {
- BIO_printf(bio_err,
- "Error Loading CRL extension section %s\n",
- crl_ext);
- ret = 1;
- goto err;
- }
- }
-
- if ((crlnumberfile=NCONF_get_string(conf,section,ENV_CRLNUMBER))
- != NULL)
- if ((crlnumber=load_serial(crlnumberfile,0,NULL)) == NULL)
- {
- BIO_printf(bio_err,"error while loading CRL number\n");
- goto err;
- }
-
- if (!crldays && !crlhours && !crlsec)
- {
- if (!NCONF_get_number(conf,section,
- ENV_DEFAULT_CRL_DAYS, &crldays))
- crldays = 0;
- if (!NCONF_get_number(conf,section,
- ENV_DEFAULT_CRL_HOURS, &crlhours))
- crlhours = 0;
- ERR_clear_error();
- }
- if ((crldays == 0) && (crlhours == 0) && (crlsec == 0))
- {
- BIO_printf(bio_err,"cannot lookup how long until the next CRL is issued\n");
- goto err;
- }
-
- if (verbose) BIO_printf(bio_err,"making CRL\n");
- if ((crl=X509_CRL_new()) == NULL) goto err;
- if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509))) goto err;
-
- tmptm = ASN1_TIME_new();
- if (!tmptm) goto err;
- X509_gmtime_adj(tmptm,0);
- X509_CRL_set_lastUpdate(crl, tmptm);
- if (!X509_time_adj_ex(tmptm, crldays, crlhours*60*60 + crlsec,
- NULL))
- {
- BIO_puts(bio_err, "error setting CRL nextUpdate\n");
- goto err;
- }
- X509_CRL_set_nextUpdate(crl, tmptm);
-
- ASN1_TIME_free(tmptm);
-
- for (i=0; i<sk_OPENSSL_PSTRING_num(db->db->data); i++)
- {
- pp=sk_OPENSSL_PSTRING_value(db->db->data,i);
- if (pp[DB_type][0] == DB_TYPE_REV)
- {
- if ((r=X509_REVOKED_new()) == NULL) goto err;
- j = make_revoked(r, pp[DB_rev_date]);
- if (!j) goto err;
- if (j == 2) crl_v2 = 1;
- if (!BN_hex2bn(&serial, pp[DB_serial]))
- goto err;
- tmpser = BN_to_ASN1_INTEGER(serial, NULL);
- BN_free(serial);
- serial = NULL;
- if (!tmpser)
- goto err;
- X509_REVOKED_set_serialNumber(r, tmpser);
- ASN1_INTEGER_free(tmpser);
- X509_CRL_add0_revoked(crl,r);
- }
- }
-
- /* sort the data so it will be written in serial
- * number order */
- X509_CRL_sort(crl);
-
- /* we now have a CRL */
- if (verbose) BIO_printf(bio_err,"signing CRL\n");
-
- /* Add any extensions asked for */
-
- if (crl_ext || crlnumberfile != NULL)
- {
- X509V3_CTX crlctx;
- X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
- X509V3_set_nconf(&crlctx, conf);
-
- if (crl_ext)
- if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
- crl_ext, crl)) goto err;
- if (crlnumberfile != NULL)
- {
- tmpser = BN_to_ASN1_INTEGER(crlnumber, NULL);
- if (!tmpser) goto err;
- X509_CRL_add1_ext_i2d(crl,NID_crl_number,tmpser,0,0);
- ASN1_INTEGER_free(tmpser);
- crl_v2 = 1;
- if (!BN_add_word(crlnumber,1)) goto err;
- }
- }
- if (crl_ext || crl_v2)
- {
- if (!X509_CRL_set_version(crl, 1))
- goto err; /* version 2 CRL */
- }
-
-
- if (crlnumberfile != NULL) /* we have a CRL number that need updating */
- if (!save_serial(crlnumberfile,"new",crlnumber,NULL)) goto err;
-
- if (crlnumber)
- {
- BN_free(crlnumber);
- crlnumber = NULL;
- }
-
- if (!do_X509_CRL_sign(bio_err,crl,pkey,dgst,sigopts)) goto err;
-
- PEM_write_bio_X509_CRL(Sout,crl);
-
- if (crlnumberfile != NULL) /* Rename the crlnumber file */
- if (!rotate_serial(crlnumberfile,"new","old")) goto err;
-
- }
- /*****************************************************************/
- if (dorevoke)
- {
- if (infile == NULL)
- {
- BIO_printf(bio_err,"no input files\n");
- goto err;
- }
- else
- {
- X509 *revcert;
- revcert=load_cert(bio_err, infile, FORMAT_PEM,
- NULL, e, infile);
- if (revcert == NULL)
- goto err;
- j=do_revoke(revcert,db, rev_type, rev_arg);
- if (j <= 0) goto err;
- X509_free(revcert);
-
- if (!save_index(dbfile, "new", db)) goto err;
-
- if (!rotate_index(dbfile, "new", "old")) goto err;
-
- BIO_printf(bio_err,"Data Base Updated\n");
- }
- }
- /*****************************************************************/
- ret=0;
-err:
- if(tofree)
- OPENSSL_free(tofree);
- BIO_free_all(Cout);
- BIO_free_all(Sout);
- BIO_free_all(out);
- BIO_free_all(in);
-
- if (cert_sk)
- sk_X509_pop_free(cert_sk,X509_free);
-
- if (ret) ERR_print_errors(bio_err);
- app_RAND_write_file(randfile, bio_err);
- if (free_key && key)
- OPENSSL_free(key);
- BN_free(serial);
- BN_free(crlnumber);
- free_index(db);
- if (sigopts)
- sk_OPENSSL_STRING_free(sigopts);
- EVP_PKEY_free(pkey);
- if (x509) X509_free(x509);
- X509_CRL_free(crl);
- NCONF_free(conf);
- NCONF_free(extconf);
- OBJ_cleanup();
- apps_shutdown();
- OPENSSL_EXIT(ret);
- }
+ n = (char *)&(buf[2][strlen(buf[2])]);
+ if (j > 0) {
+ for (k = 0; k < j; k++) {
+ if (n >= &(buf[2][sizeof(buf[2])]))
+ break;
+ BIO_snprintf(n,
+ &buf[2][0] + sizeof(buf[2]) - n,
+ "%02X", (unsigned char)*(p++));
+ n += 2;
+ }
+ } else {
+ *(n++) = '0';
+ *(n++) = '0';
+ }
+ *(n++) = '.';
+ *(n++) = 'p';
+ *(n++) = 'e';
+ *(n++) = 'm';
+ *n = '\0';
+ if (verbose)
+ BIO_printf(bio_err, "writing %s\n", buf[2]);
+
+ if (BIO_write_filename(Cout, buf[2]) <= 0) {
+ perror(buf[2]);
+ goto err;
+ }
+ write_new_certificate(Cout, x, 0, notext);
+ write_new_certificate(Sout, x, output_der, notext);
+ }
+
+ if (sk_X509_num(cert_sk)) {
+ /* Rename the database and the serial file */
+ if (!rotate_serial(serialfile, "new", "old"))
+ goto err;
+
+ if (!rotate_index(dbfile, "new", "old"))
+ goto err;
+
+ BIO_printf(bio_err, "Data Base Updated\n");
+ }
+ }
+
+ /*****************************************************************/
+ if (gencrl) {
+ int crl_v2 = 0;
+ if (!crl_ext) {
+ crl_ext = NCONF_get_string(conf, section, ENV_CRLEXT);
+ if (!crl_ext)
+ ERR_clear_error();
+ }
+ if (crl_ext) {
+ /* Check syntax of file */
+ X509V3_CTX ctx;
+ X509V3_set_ctx_test(&ctx);
+ X509V3_set_nconf(&ctx, conf);
+ if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL)) {
+ BIO_printf(bio_err,
+ "Error Loading CRL extension section %s\n",
+ crl_ext);
+ ret = 1;
+ goto err;
+ }
+ }
+
+ if ((crlnumberfile = NCONF_get_string(conf, section, ENV_CRLNUMBER))
+ != NULL)
+ if ((crlnumber = load_serial(crlnumberfile, 0, NULL)) == NULL) {
+ BIO_printf(bio_err, "error while loading CRL number\n");
+ goto err;
+ }
+
+ if (!crldays && !crlhours && !crlsec) {
+ if (!NCONF_get_number(conf, section,
+ ENV_DEFAULT_CRL_DAYS, &crldays))
+ crldays = 0;
+ if (!NCONF_get_number(conf, section,
+ ENV_DEFAULT_CRL_HOURS, &crlhours))
+ crlhours = 0;
+ ERR_clear_error();
+ }
+ if ((crldays == 0) && (crlhours == 0) && (crlsec == 0)) {
+ BIO_printf(bio_err,
+ "cannot lookup how long until the next CRL is issued\n");
+ goto err;
+ }
+
+ if (verbose)
+ BIO_printf(bio_err, "making CRL\n");
+ if ((crl = X509_CRL_new()) == NULL)
+ goto err;
+ if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509)))
+ goto err;
+
+ tmptm = ASN1_TIME_new();
+ if (!tmptm)
+ goto err;
+ X509_gmtime_adj(tmptm, 0);
+ X509_CRL_set_lastUpdate(crl, tmptm);
+ if (!X509_time_adj_ex(tmptm, crldays, crlhours * 60 * 60 + crlsec,
+ NULL)) {
+ BIO_puts(bio_err, "error setting CRL nextUpdate\n");
+ goto err;
+ }
+ X509_CRL_set_nextUpdate(crl, tmptm);
+
+ ASN1_TIME_free(tmptm);
+
+ for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
+ pp = sk_OPENSSL_PSTRING_value(db->db->data, i);
+ if (pp[DB_type][0] == DB_TYPE_REV) {
+ if ((r = X509_REVOKED_new()) == NULL)
+ goto err;
+ j = make_revoked(r, pp[DB_rev_date]);
+ if (!j)
+ goto err;
+ if (j == 2)
+ crl_v2 = 1;
+ if (!BN_hex2bn(&serial, pp[DB_serial]))
+ goto err;
+ tmpser = BN_to_ASN1_INTEGER(serial, NULL);
+ BN_free(serial);
+ serial = NULL;
+ if (!tmpser)
+ goto err;
+ X509_REVOKED_set_serialNumber(r, tmpser);
+ ASN1_INTEGER_free(tmpser);
+ X509_CRL_add0_revoked(crl, r);
+ }
+ }
+
+ /*
+ * sort the data so it will be written in serial number order
+ */
+ X509_CRL_sort(crl);
+
+ /* we now have a CRL */
+ if (verbose)
+ BIO_printf(bio_err, "signing CRL\n");
+
+ /* Add any extensions asked for */
+
+ if (crl_ext || crlnumberfile != NULL) {
+ X509V3_CTX crlctx;
+ X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
+ X509V3_set_nconf(&crlctx, conf);
+
+ if (crl_ext)
+ if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx, crl_ext, crl))
+ goto err;
+ if (crlnumberfile != NULL) {
+ tmpser = BN_to_ASN1_INTEGER(crlnumber, NULL);
+ if (!tmpser)
+ goto err;
+ X509_CRL_add1_ext_i2d(crl, NID_crl_number, tmpser, 0, 0);
+ ASN1_INTEGER_free(tmpser);
+ crl_v2 = 1;
+ if (!BN_add_word(crlnumber, 1))
+ goto err;
+ }
+ }
+ if (crl_ext || crl_v2) {
+ if (!X509_CRL_set_version(crl, 1))
+ goto err; /* version 2 CRL */
+ }
+
+ /* we have a CRL number that need updating */
+ if (crlnumberfile != NULL)
+ if (!save_serial(crlnumberfile, "new", crlnumber, NULL))
+ goto err;
+
+ if (crlnumber) {
+ BN_free(crlnumber);
+ crlnumber = NULL;
+ }
+
+ if (!do_X509_CRL_sign(bio_err, crl, pkey, dgst, sigopts))
+ goto err;
+
+ PEM_write_bio_X509_CRL(Sout, crl);
+
+ if (crlnumberfile != NULL) /* Rename the crlnumber file */
+ if (!rotate_serial(crlnumberfile, "new", "old"))
+ goto err;
+
+ }
+ /*****************************************************************/
+ if (dorevoke) {
+ if (infile == NULL) {
+ BIO_printf(bio_err, "no input files\n");
+ goto err;
+ } else {
+ X509 *revcert;
+ revcert = load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile);
+ if (revcert == NULL)
+ goto err;
+ j = do_revoke(revcert, db, rev_type, rev_arg);
+ if (j <= 0)
+ goto err;
+ X509_free(revcert);
+
+ if (!save_index(dbfile, "new", db))
+ goto err;
+
+ if (!rotate_index(dbfile, "new", "old"))
+ goto err;
+
+ BIO_printf(bio_err, "Data Base Updated\n");
+ }
+ }
+ /*****************************************************************/
+ ret = 0;
+ err:
+ if (tofree)
+ OPENSSL_free(tofree);
+ BIO_free_all(Cout);
+ BIO_free_all(Sout);
+ BIO_free_all(out);
+ BIO_free_all(in);
+
+ if (cert_sk)
+ sk_X509_pop_free(cert_sk, X509_free);
+
+ if (ret)
+ ERR_print_errors(bio_err);
+ app_RAND_write_file(randfile, bio_err);
+ if (free_key && key)
+ OPENSSL_free(key);
+ BN_free(serial);
+ BN_free(crlnumber);
+ free_index(db);
+ if (sigopts)
+ sk_OPENSSL_STRING_free(sigopts);
+ EVP_PKEY_free(pkey);
+ if (x509)
+ X509_free(x509);
+ X509_CRL_free(crl);
+ NCONF_free(conf);
+ NCONF_free(extconf);
+ OBJ_cleanup();
+ apps_shutdown();
+ OPENSSL_EXIT(ret);
+}
static void lookup_fail(const char *name, const char *tag)
- {
- BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
- }
+{
+ BIO_printf(bio_err, "variable lookup failed for %s::%s\n", name, tag);
+}
static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
- const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
- STACK_OF(CONF_VALUE) *policy, CA_DB *db,
- BIGNUM *serial, char *subj,unsigned long chtype, int multirdn,
- int email_dn, char *startdate, char *enddate,
- long days, int batch, char *ext_sect, CONF *lconf, int verbose,
- unsigned long certopt, unsigned long nameopt, int default_op,
- int ext_copy, int selfsign)
- {
- X509_REQ *req=NULL;
- BIO *in=NULL;
- EVP_PKEY *pktmp=NULL;
- int ok= -1,i;
-
- in=BIO_new(BIO_s_file());
-
- if (BIO_read_filename(in,infile) <= 0)
- {
- perror(infile);
- goto err;
- }
- if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
- {
- BIO_printf(bio_err,"Error reading certificate request in %s\n",
- infile);
- goto err;
- }
- if (verbose)
- X509_REQ_print(bio_err,req);
-
- BIO_printf(bio_err,"Check that the request matches the signature\n");
-
- if (selfsign && !X509_REQ_check_private_key(req,pkey))
- {
- BIO_printf(bio_err,"Certificate request and CA private key do not match\n");
- ok=0;
- goto err;
- }
- if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
- {
- BIO_printf(bio_err,"error unpacking public key\n");
- goto err;
- }
- i=X509_REQ_verify(req,pktmp);
- EVP_PKEY_free(pktmp);
- if (i < 0)
- {
- ok=0;
- BIO_printf(bio_err,"Signature verification problems....\n");
- ERR_print_errors(bio_err);
- goto err;
- }
- if (i == 0)
- {
- ok=0;
- BIO_printf(bio_err,"Signature did not match the certificate request\n");
- ERR_print_errors(bio_err);
- goto err;
- }
- else
- BIO_printf(bio_err,"Signature ok\n");
-
- ok=do_body(xret,pkey,x509,dgst,sigopts, policy,db,serial,subj,chtype,
- multirdn, email_dn,
- startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
- certopt, nameopt, default_op, ext_copy, selfsign);
-
-err:
- if (req != NULL) X509_REQ_free(req);
- if (in != NULL) BIO_free(in);
- return(ok);
- }
+ const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
+ STACK_OF(CONF_VALUE) *policy, CA_DB *db,
+ BIGNUM *serial, char *subj, unsigned long chtype,
+ int multirdn, int email_dn, char *startdate, char *enddate,
+ long days, int batch, char *ext_sect, CONF *lconf,
+ int verbose, unsigned long certopt, unsigned long nameopt,
+ int default_op, int ext_copy, int selfsign)
+{
+ X509_REQ *req = NULL;
+ BIO *in = NULL;
+ EVP_PKEY *pktmp = NULL;
+ int ok = -1, i;
+
+ in = BIO_new(BIO_s_file());
+
+ if (BIO_read_filename(in, infile) <= 0) {
+ perror(infile);
+ goto err;
+ }
+ if ((req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL)) == NULL) {
+ BIO_printf(bio_err, "Error reading certificate request in %s\n",
+ infile);
+ goto err;
+ }
+ if (verbose)
+ X509_REQ_print(bio_err, req);
+
+ BIO_printf(bio_err, "Check that the request matches the signature\n");
+
+ if (selfsign && !X509_REQ_check_private_key(req, pkey)) {
+ BIO_printf(bio_err,
+ "Certificate request and CA private key do not match\n");
+ ok = 0;
+ goto err;
+ }
+ if ((pktmp = X509_REQ_get_pubkey(req)) == NULL) {
+ BIO_printf(bio_err, "error unpacking public key\n");
+ goto err;
+ }
+ i = X509_REQ_verify(req, pktmp);
+ EVP_PKEY_free(pktmp);
+ if (i < 0) {
+ ok = 0;
+ BIO_printf(bio_err, "Signature verification problems....\n");
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+ if (i == 0) {
+ ok = 0;
+ BIO_printf(bio_err,
+ "Signature did not match the certificate request\n");
+ ERR_print_errors(bio_err);
+ goto err;
+ } else
+ BIO_printf(bio_err, "Signature ok\n");
+
+ ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
+ chtype, multirdn, email_dn, startdate, enddate, days, batch,
+ verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
+ ext_copy, selfsign);
+
+ err:
+ if (req != NULL)
+ X509_REQ_free(req);
+ if (in != NULL)
+ BIO_free(in);
+ return (ok);
+}
static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
- const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
- STACK_OF(CONF_VALUE) *policy, CA_DB *db,
- BIGNUM *serial, char *subj, unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
- long days, int batch, char *ext_sect, CONF *lconf, int verbose,
- unsigned long certopt, unsigned long nameopt, int default_op,
- int ext_copy, ENGINE *e)
- {
- X509 *req=NULL;
- X509_REQ *rreq=NULL;
- EVP_PKEY *pktmp=NULL;
- int ok= -1,i;
-
- if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
- goto err;
- if (verbose)
- X509_print(bio_err,req);
-
- BIO_printf(bio_err,"Check that the request matches the signature\n");
-
- if ((pktmp=X509_get_pubkey(req)) == NULL)
- {
- BIO_printf(bio_err,"error unpacking public key\n");
- goto err;
- }
- i=X509_verify(req,pktmp);
- EVP_PKEY_free(pktmp);
- if (i < 0)
- {
- ok=0;
- BIO_printf(bio_err,"Signature verification problems....\n");
- goto err;
- }
- if (i == 0)
- {
- ok=0;
- BIO_printf(bio_err,"Signature did not match the certificate\n");
- goto err;
- }
- else
- BIO_printf(bio_err,"Signature ok\n");
-
- if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
- goto err;
-
- ok=do_body(xret,pkey,x509,dgst,sigopts,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
- days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
- ext_copy, 0);
-
-err:
- if (rreq != NULL) X509_REQ_free(rreq);
- if (req != NULL) X509_free(req);
- return(ok);
- }
-
-static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
- STACK_OF(OPENSSL_STRING) *sigopts, STACK_OF(CONF_VALUE) *policy,
- CA_DB *db, BIGNUM *serial, char *subj,
- unsigned long chtype, int multirdn,
- int email_dn, char *startdate, char *enddate, long days, int batch,
- int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
- unsigned long certopt, unsigned long nameopt, int default_op,
- int ext_copy, int selfsign)
- {
- X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
- ASN1_UTCTIME *tm,*tmptm;
- ASN1_STRING *str,*str2;
- ASN1_OBJECT *obj;
- X509 *ret=NULL;
- X509_CINF *ci;
- X509_NAME_ENTRY *ne;
- X509_NAME_ENTRY *tne,*push;
- EVP_PKEY *pktmp;
- int ok= -1,i,j,last,nid;
- const char *p;
- CONF_VALUE *cv;
- OPENSSL_STRING row[DB_NUMBER];
- OPENSSL_STRING *irow=NULL;
- OPENSSL_STRING *rrow=NULL;
- char buf[25];
-
- tmptm=ASN1_UTCTIME_new();
- if (tmptm == NULL)
- {
- BIO_printf(bio_err,"malloc error\n");
- return(0);
- }
-
- for (i=0; i<DB_NUMBER; i++)
- row[i]=NULL;
-
- if (subj)
- {
- X509_NAME *n = parse_name(subj, chtype, multirdn);
-
- if (!n)
- {
- ERR_print_errors(bio_err);
- goto err;
- }
- X509_REQ_set_subject_name(req,n);
- req->req_info->enc.modified = 1;
- X509_NAME_free(n);
- }
-
- if (default_op)
- BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
-
- name=X509_REQ_get_subject_name(req);
- for (i=0; i<X509_NAME_entry_count(name); i++)
- {
- ne= X509_NAME_get_entry(name,i);
- str=X509_NAME_ENTRY_get_data(ne);
- obj=X509_NAME_ENTRY_get_object(ne);
-
- if (msie_hack)
- {
- /* assume all type should be strings */
- nid=OBJ_obj2nid(ne->object);
-
- if (str->type == V_ASN1_UNIVERSALSTRING)
- ASN1_UNIVERSALSTRING_to_string(str);
-
- if ((str->type == V_ASN1_IA5STRING) &&
- (nid != NID_pkcs9_emailAddress))
- str->type=V_ASN1_T61STRING;
-
- if ((nid == NID_pkcs9_emailAddress) &&
- (str->type == V_ASN1_PRINTABLESTRING))
- str->type=V_ASN1_IA5STRING;
- }
-
- /* If no EMAIL is wanted in the subject */
- if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
- continue;
-
- /* check some things */
- if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
- (str->type != V_ASN1_IA5STRING))
- {
- BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
- goto err;
- }
- if ((str->type != V_ASN1_BMPSTRING) && (str->type != V_ASN1_UTF8STRING))
- {
- j=ASN1_PRINTABLE_type(str->data,str->length);
- if ( ((j == V_ASN1_T61STRING) &&
- (str->type != V_ASN1_T61STRING)) ||
- ((j == V_ASN1_IA5STRING) &&
- (str->type == V_ASN1_PRINTABLESTRING)))
- {
- BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
- goto err;
- }
- }
-
- if (default_op)
- old_entry_print(bio_err, obj, str);
- }
-
- /* Ok, now we check the 'policy' stuff. */
- if ((subject=X509_NAME_new()) == NULL)
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
-
- /* take a copy of the issuer name before we mess with it. */
- if (selfsign)
- CAname=X509_NAME_dup(name);
- else
- CAname=X509_NAME_dup(x509->cert_info->subject);
- if (CAname == NULL) goto err;
- str=str2=NULL;
-
- for (i=0; i<sk_CONF_VALUE_num(policy); i++)
- {
- cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
- if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
- {
- BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
- goto err;
- }
- obj=OBJ_nid2obj(j);
-
- last= -1;
- for (;;)
- {
- /* lookup the object in the supplied name list */
- j=X509_NAME_get_index_by_OBJ(name,obj,last);
- if (j < 0)
- {
- if (last != -1) break;
- tne=NULL;
- }
- else
- {
- tne=X509_NAME_get_entry(name,j);
- }
- last=j;
-
- /* depending on the 'policy', decide what to do. */
- push=NULL;
- if (strcmp(cv->value,"optional") == 0)
- {
- if (tne != NULL)
- push=tne;
- }
- else if (strcmp(cv->value,"supplied") == 0)
- {
- if (tne == NULL)
- {
- BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
- goto err;
- }
- else
- push=tne;
- }
- else if (strcmp(cv->value,"match") == 0)
- {
- int last2;
-
- if (tne == NULL)
- {
- BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
- goto err;
- }
-
- last2= -1;
-
-again2:
- j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
- if ((j < 0) && (last2 == -1))
- {
- BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
- goto err;
- }
- if (j >= 0)
- {
- push=X509_NAME_get_entry(CAname,j);
- str=X509_NAME_ENTRY_get_data(tne);
- str2=X509_NAME_ENTRY_get_data(push);
- last2=j;
- if (ASN1_STRING_cmp(str,str2) != 0)
- goto again2;
- }
- if (j < 0)
- {
- BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
- goto err;
- }
- }
- else
- {
- BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
- goto err;
- }
-
- if (push != NULL)
- {
- if (!X509_NAME_add_entry(subject,push, -1, 0))
- {
- if (push != NULL)
- X509_NAME_ENTRY_free(push);
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- }
- if (j < 0) break;
- }
- }
-
- if (preserve)
- {
- X509_NAME_free(subject);
- /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
- subject=X509_NAME_dup(name);
- if (subject == NULL) goto err;
- }
-
- if (verbose)
- BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
-
- /* Build the correct Subject if no e-mail is wanted in the subject */
- /* and add it later on because of the method extensions are added (altName) */
-
- if (email_dn)
- dn_subject = subject;
- else
- {
- X509_NAME_ENTRY *tmpne;
- /* Its best to dup the subject DN and then delete any email
- * addresses because this retains its structure.
- */
- if (!(dn_subject = X509_NAME_dup(subject)))
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- while((i = X509_NAME_get_index_by_NID(dn_subject,
- NID_pkcs9_emailAddress, -1)) >= 0)
- {
- tmpne = X509_NAME_get_entry(dn_subject, i);
- X509_NAME_delete_entry(dn_subject, i);
- X509_NAME_ENTRY_free(tmpne);
- }
- }
-
- if (BN_is_zero(serial))
- row[DB_serial]=BUF_strdup("00");
- else
- row[DB_serial]=BN_bn2hex(serial);
- if (row[DB_serial] == NULL)
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
-
- if (db->attributes.unique_subject)
- {
- OPENSSL_STRING *crow=row;
-
- rrow=TXT_DB_get_by_index(db->db,DB_name,crow);
- if (rrow != NULL)
- {
- BIO_printf(bio_err,
- "ERROR:There is already a certificate for %s\n",
- row[DB_name]);
- }
- }
- if (rrow == NULL)
- {
- rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
- if (rrow != NULL)
- {
- BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
- row[DB_serial]);
- BIO_printf(bio_err," check the database/serial_file for corruption\n");
- }
- }
-
- if (rrow != NULL)
- {
- BIO_printf(bio_err,
- "The matching entry has the following details\n");
- if (rrow[DB_type][0] == 'E')
- p="Expired";
- else if (rrow[DB_type][0] == 'R')
- p="Revoked";
- else if (rrow[DB_type][0] == 'V')
- p="Valid";
- else
- p="\ninvalid type, Data base error\n";
- BIO_printf(bio_err,"Type :%s\n",p);;
- if (rrow[DB_type][0] == 'R')
- {
- p=rrow[DB_exp_date]; if (p == NULL) p="undef";
- BIO_printf(bio_err,"Was revoked on:%s\n",p);
- }
- p=rrow[DB_exp_date]; if (p == NULL) p="undef";
- BIO_printf(bio_err,"Expires on :%s\n",p);
- p=rrow[DB_serial]; if (p == NULL) p="undef";
- BIO_printf(bio_err,"Serial Number :%s\n",p);
- p=rrow[DB_file]; if (p == NULL) p="undef";
- BIO_printf(bio_err,"File name :%s\n",p);
- p=rrow[DB_name]; if (p == NULL) p="undef";
- BIO_printf(bio_err,"Subject Name :%s\n",p);
- ok= -1; /* This is now a 'bad' error. */
- goto err;
- }
-
- /* We are now totally happy, lets make and sign the certificate */
- if (verbose)
- BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
-
- if ((ret=X509_new()) == NULL) goto err;
- ci=ret->cert_info;
+ const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
+ STACK_OF(CONF_VALUE) *policy, CA_DB *db,
+ BIGNUM *serial, char *subj, unsigned long chtype,
+ int multirdn, int email_dn, char *startdate,
+ char *enddate, long days, int batch, char *ext_sect,
+ CONF *lconf, int verbose, unsigned long certopt,
+ unsigned long nameopt, int default_op, int ext_copy,
+ ENGINE *e)
+{
+ X509 *req = NULL;
+ X509_REQ *rreq = NULL;
+ EVP_PKEY *pktmp = NULL;
+ int ok = -1, i;
+
+ if ((req =
+ load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
+ goto err;
+ if (verbose)
+ X509_print(bio_err, req);
+
+ BIO_printf(bio_err, "Check that the request matches the signature\n");
+
+ if ((pktmp = X509_get_pubkey(req)) == NULL) {
+ BIO_printf(bio_err, "error unpacking public key\n");
+ goto err;
+ }
+ i = X509_verify(req, pktmp);
+ EVP_PKEY_free(pktmp);
+ if (i < 0) {
+ ok = 0;
+ BIO_printf(bio_err, "Signature verification problems....\n");
+ goto err;
+ }
+ if (i == 0) {
+ ok = 0;
+ BIO_printf(bio_err, "Signature did not match the certificate\n");
+ goto err;
+ } else
+ BIO_printf(bio_err, "Signature ok\n");
+
+ if ((rreq = X509_to_X509_REQ(req, NULL, EVP_md5())) == NULL)
+ goto err;
+
+ ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
+ chtype, multirdn, email_dn, startdate, enddate, days, batch,
+ verbose, rreq, ext_sect, lconf, certopt, nameopt, default_op,
+ ext_copy, 0);
+
+ err:
+ if (rreq != NULL)
+ X509_REQ_free(rreq);
+ if (req != NULL)
+ X509_free(req);
+ return (ok);
+}
+
+static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
+ const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
+ STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,
+ char *subj, unsigned long chtype, int multirdn,
+ int email_dn, char *startdate, char *enddate, long days,
+ int batch, int verbose, X509_REQ *req, char *ext_sect,
+ CONF *lconf, unsigned long certopt, unsigned long nameopt,
+ int default_op, int ext_copy, int selfsign)
+{
+ X509_NAME *name = NULL, *CAname = NULL, *subject = NULL, *dn_subject =
+ NULL;
+ ASN1_UTCTIME *tm, *tmptm;
+ ASN1_STRING *str, *str2;
+ ASN1_OBJECT *obj;
+ X509 *ret = NULL;
+ X509_CINF *ci;
+ X509_NAME_ENTRY *ne;
+ X509_NAME_ENTRY *tne, *push;
+ EVP_PKEY *pktmp;
+ int ok = -1, i, j, last, nid;
+ const char *p;
+ CONF_VALUE *cv;
+ OPENSSL_STRING row[DB_NUMBER];
+ OPENSSL_STRING *irow = NULL;
+ OPENSSL_STRING *rrow = NULL;
+ char buf[25];
+
+ tmptm = ASN1_UTCTIME_new();
+ if (tmptm == NULL) {
+ BIO_printf(bio_err, "malloc error\n");
+ return (0);
+ }
+
+ for (i = 0; i < DB_NUMBER; i++)
+ row[i] = NULL;
+
+ if (subj) {
+ X509_NAME *n = parse_name(subj, chtype, multirdn);
+
+ if (!n) {
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+ X509_REQ_set_subject_name(req, n);
+ req->req_info->enc.modified = 1;
+ X509_NAME_free(n);
+ }
+
+ if (default_op)
+ BIO_printf(bio_err,
+ "The Subject's Distinguished Name is as follows\n");
+
+ name = X509_REQ_get_subject_name(req);
+ for (i = 0; i < X509_NAME_entry_count(name); i++) {
+ ne = X509_NAME_get_entry(name, i);
+ str = X509_NAME_ENTRY_get_data(ne);
+ obj = X509_NAME_ENTRY_get_object(ne);
+
+ if (msie_hack) {
+ /* assume all type should be strings */
+ nid = OBJ_obj2nid(ne->object);
+
+ if (str->type == V_ASN1_UNIVERSALSTRING)
+ ASN1_UNIVERSALSTRING_to_string(str);
+
+ if ((str->type == V_ASN1_IA5STRING) &&
+ (nid != NID_pkcs9_emailAddress))
+ str->type = V_ASN1_T61STRING;
+
+ if ((nid == NID_pkcs9_emailAddress) &&
+ (str->type == V_ASN1_PRINTABLESTRING))
+ str->type = V_ASN1_IA5STRING;
+ }
+
+ /* If no EMAIL is wanted in the subject */
+ if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
+ continue;
+
+ /* check some things */
+ if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
+ (str->type != V_ASN1_IA5STRING)) {
+ BIO_printf(bio_err,
+ "\nemailAddress type needs to be of type IA5STRING\n");
+ goto err;
+ }
+ if ((str->type != V_ASN1_BMPSTRING)
+ && (str->type != V_ASN1_UTF8STRING)) {
+ j = ASN1_PRINTABLE_type(str->data, str->length);
+ if (((j == V_ASN1_T61STRING) &&
+ (str->type != V_ASN1_T61STRING)) ||
+ ((j == V_ASN1_IA5STRING) &&
+ (str->type == V_ASN1_PRINTABLESTRING))) {
+ BIO_printf(bio_err,
+ "\nThe string contains characters that are illegal for the ASN.1 type\n");
+ goto err;
+ }
+ }
+
+ if (default_op)
+ old_entry_print(bio_err, obj, str);
+ }
+
+ /* Ok, now we check the 'policy' stuff. */
+ if ((subject = X509_NAME_new()) == NULL) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+
+ /* take a copy of the issuer name before we mess with it. */
+ if (selfsign)
+ CAname = X509_NAME_dup(name);
+ else
+ CAname = X509_NAME_dup(x509->cert_info->subject);
+ if (CAname == NULL)
+ goto err;
+ str = str2 = NULL;
+
+ for (i = 0; i < sk_CONF_VALUE_num(policy); i++) {
+ cv = sk_CONF_VALUE_value(policy, i); /* get the object id */
+ if ((j = OBJ_txt2nid(cv->name)) == NID_undef) {
+ BIO_printf(bio_err,
+ "%s:unknown object type in 'policy' configuration\n",
+ cv->name);
+ goto err;
+ }
+ obj = OBJ_nid2obj(j);
+
+ last = -1;
+ for (;;) {
+ /* lookup the object in the supplied name list */
+ j = X509_NAME_get_index_by_OBJ(name, obj, last);
+ if (j < 0) {
+ if (last != -1)
+ break;
+ tne = NULL;
+ } else {
+ tne = X509_NAME_get_entry(name, j);
+ }
+ last = j;
+
+ /* depending on the 'policy', decide what to do. */
+ push = NULL;
+ if (strcmp(cv->value, "optional") == 0) {
+ if (tne != NULL)
+ push = tne;
+ } else if (strcmp(cv->value, "supplied") == 0) {
+ if (tne == NULL) {
+ BIO_printf(bio_err,
+ "The %s field needed to be supplied and was missing\n",
+ cv->name);
+ goto err;
+ } else
+ push = tne;
+ } else if (strcmp(cv->value, "match") == 0) {
+ int last2;
+
+ if (tne == NULL) {
+ BIO_printf(bio_err,
+ "The mandatory %s field was missing\n",
+ cv->name);
+ goto err;
+ }
+
+ last2 = -1;
+
+ again2:
+ j = X509_NAME_get_index_by_OBJ(CAname, obj, last2);
+ if ((j < 0) && (last2 == -1)) {
+ BIO_printf(bio_err,
+ "The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",
+ cv->name);
+ goto err;
+ }
+ if (j >= 0) {
+ push = X509_NAME_get_entry(CAname, j);
+ str = X509_NAME_ENTRY_get_data(tne);
+ str2 = X509_NAME_ENTRY_get_data(push);
+ last2 = j;
+ if (ASN1_STRING_cmp(str, str2) != 0)
+ goto again2;
+ }
+ if (j < 0) {
+ BIO_printf(bio_err,
+ "The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",
+ cv->name,
+ ((str2 == NULL) ? "NULL" : (char *)str2->data),
+ ((str == NULL) ? "NULL" : (char *)str->data));
+ goto err;
+ }
+ } else {
+ BIO_printf(bio_err,
+ "%s:invalid type in 'policy' configuration\n",
+ cv->value);
+ goto err;
+ }
+
+ if (push != NULL) {
+ if (!X509_NAME_add_entry(subject, push, -1, 0)) {
+ if (push != NULL)
+ X509_NAME_ENTRY_free(push);
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+ }
+ if (j < 0)
+ break;
+ }
+ }
+
+ if (preserve) {
+ X509_NAME_free(subject);
+ /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
+ subject = X509_NAME_dup(name);
+ if (subject == NULL)
+ goto err;
+ }
+
+ if (verbose)
+ BIO_printf(bio_err,
+ "The subject name appears to be ok, checking data base for clashes\n");
+
+ /* Build the correct Subject if no e-mail is wanted in the subject */
+ /*
+ * and add it later on because of the method extensions are added
+ * (altName)
+ */
+
+ if (email_dn)
+ dn_subject = subject;
+ else {
+ X509_NAME_ENTRY *tmpne;
+ /*
+ * Its best to dup the subject DN and then delete any email addresses
+ * because this retains its structure.
+ */
+ if (!(dn_subject = X509_NAME_dup(subject))) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+ while ((i = X509_NAME_get_index_by_NID(dn_subject,
+ NID_pkcs9_emailAddress,
+ -1)) >= 0) {
+ tmpne = X509_NAME_get_entry(dn_subject, i);
+ X509_NAME_delete_entry(dn_subject, i);
+ X509_NAME_ENTRY_free(tmpne);
+ }
+ }
+
+ if (BN_is_zero(serial))
+ row[DB_serial] = BUF_strdup("00");
+ else
+ row[DB_serial] = BN_bn2hex(serial);
+ if (row[DB_serial] == NULL) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+
+ if (db->attributes.unique_subject) {
+ OPENSSL_STRING *crow = row;
+
+ rrow = TXT_DB_get_by_index(db->db, DB_name, crow);
+ if (rrow != NULL) {
+ BIO_printf(bio_err,
+ "ERROR:There is already a certificate for %s\n",
+ row[DB_name]);
+ }
+ }
+ if (rrow == NULL) {
+ rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
+ if (rrow != NULL) {
+ BIO_printf(bio_err,
+ "ERROR:Serial number %s has already been issued,\n",
+ row[DB_serial]);
+ BIO_printf(bio_err,
+ " check the database/serial_file for corruption\n");
+ }
+ }
+
+ if (rrow != NULL) {
+ BIO_printf(bio_err, "The matching entry has the following details\n");
+ if (rrow[DB_type][0] == 'E')
+ p = "Expired";
+ else if (rrow[DB_type][0] == 'R')
+ p = "Revoked";
+ else if (rrow[DB_type][0] == 'V')
+ p = "Valid";
+ else
+ p = "\ninvalid type, Data base error\n";
+ BIO_printf(bio_err, "Type :%s\n", p);;
+ if (rrow[DB_type][0] == 'R') {
+ p = rrow[DB_exp_date];
+ if (p == NULL)
+ p = "undef";
+ BIO_printf(bio_err, "Was revoked on:%s\n", p);
+ }
+ p = rrow[DB_exp_date];
+ if (p == NULL)
+ p = "undef";
+ BIO_printf(bio_err, "Expires on :%s\n", p);
+ p = rrow[DB_serial];
+ if (p == NULL)
+ p = "undef";
+ BIO_printf(bio_err, "Serial Number :%s\n", p);
+ p = rrow[DB_file];
+ if (p == NULL)
+ p = "undef";
+ BIO_printf(bio_err, "File name :%s\n", p);
+ p = rrow[DB_name];
+ if (p == NULL)
+ p = "undef";
+ BIO_printf(bio_err, "Subject Name :%s\n", p);
+ ok = -1; /* This is now a 'bad' error. */
+ goto err;
+ }
+
+ /* We are now totally happy, lets make and sign the certificate */
+ if (verbose)
+ BIO_printf(bio_err,
+ "Everything appears to be ok, creating and signing the certificate\n");
+
+ if ((ret = X509_new()) == NULL)
+ goto err;
+ ci = ret->cert_info;
#ifdef X509_V3
- /* Make it an X509 v3 certificate. */
- if (!X509_set_version(ret,2)) goto err;
+ /* Make it an X509 v3 certificate. */
+ if (!X509_set_version(ret, 2))
+ goto err;
#endif
- if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
- goto err;
- if (selfsign)
- {
- if (!X509_set_issuer_name(ret,subject))
- goto err;
- }
- else
- {
- if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
- goto err;
- }
-
- if (strcmp(startdate,"today") == 0)
- X509_gmtime_adj(X509_get_notBefore(ret),0);
- else ASN1_TIME_set_string(X509_get_notBefore(ret),startdate);
-
- if (enddate == NULL)
- X509_time_adj_ex(X509_get_notAfter(ret),days, 0, NULL);
- else ASN1_TIME_set_string(X509_get_notAfter(ret),enddate);
-
- if (!X509_set_subject_name(ret,subject)) goto err;
-
- pktmp=X509_REQ_get_pubkey(req);
- i = X509_set_pubkey(ret,pktmp);
- EVP_PKEY_free(pktmp);
- if (!i) goto err;
-
- /* Lets add the extensions, if there are any */
- if (ext_sect)
- {
- X509V3_CTX ctx;
- if (ci->version == NULL)
- if ((ci->version=ASN1_INTEGER_new()) == NULL)
- goto err;
- ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
-
- /* Free the current entries if any, there should not
- * be any I believe */
- if (ci->extensions != NULL)
- sk_X509_EXTENSION_pop_free(ci->extensions,
- X509_EXTENSION_free);
-
- ci->extensions = NULL;
-
- /* Initialize the context structure */
- if (selfsign)
- X509V3_set_ctx(&ctx, ret, ret, req, NULL, 0);
- else
- X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
-
- if (extconf)
- {
- if (verbose)
- BIO_printf(bio_err, "Extra configuration file found\n");
-
- /* Use the extconf configuration db LHASH */
- X509V3_set_nconf(&ctx, extconf);
-
- /* Test the structure (needed?) */
- /* X509V3_set_ctx_test(&ctx); */
-
- /* Adds exts contained in the configuration file */
- if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
- {
- BIO_printf(bio_err,
- "ERROR: adding extensions in section %s\n",
- ext_sect);
- ERR_print_errors(bio_err);
- goto err;
- }
- if (verbose)
- BIO_printf(bio_err, "Successfully added extensions from file.\n");
- }
- else if (ext_sect)
- {
- /* We found extensions to be set from config file */
- X509V3_set_nconf(&ctx, lconf);
-
- if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
- {
- BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
- ERR_print_errors(bio_err);
- goto err;
- }
-
- if (verbose)
- BIO_printf(bio_err, "Successfully added extensions from config\n");
- }
- }
-
- /* Copy extensions from request (if any) */
-
- if (!copy_extensions(ret, req, ext_copy))
- {
- BIO_printf(bio_err, "ERROR: adding extensions from request\n");
- ERR_print_errors(bio_err);
- goto err;
- }
-
- /* Set the right value for the noemailDN option */
- if( email_dn == 0 )
- {
- if (!X509_set_subject_name(ret,dn_subject)) goto err;
- }
-
- if (!default_op)
- {
- BIO_printf(bio_err, "Certificate Details:\n");
- /* Never print signature details because signature not present */
- certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
- X509_print_ex(bio_err, ret, nameopt, certopt);
- }
-
- BIO_printf(bio_err,"Certificate is to be certified until ");
- ASN1_TIME_print(bio_err,X509_get_notAfter(ret));
- if (days) BIO_printf(bio_err," (%ld days)",days);
- BIO_printf(bio_err, "\n");
-
- if (!batch)
- {
-
- BIO_printf(bio_err,"Sign the certificate? [y/n]:");
- (void)BIO_flush(bio_err);
- buf[0]='\0';
- if (!fgets(buf,sizeof(buf)-1,stdin))
- {
- BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED: I/O error\n");
- ok=0;
- goto err;
- }
- if (!((buf[0] == 'y') || (buf[0] == 'Y')))
- {
- BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
- ok=0;
- goto err;
- }
- }
-
- pktmp=X509_get_pubkey(ret);
- if (EVP_PKEY_missing_parameters(pktmp) &&
- !EVP_PKEY_missing_parameters(pkey))
- EVP_PKEY_copy_parameters(pktmp,pkey);
- EVP_PKEY_free(pktmp);
-
- if (!do_X509_sign(bio_err, ret,pkey,dgst, sigopts))
- goto err;
-
- /* We now just add it to the database */
- row[DB_type]=(char *)OPENSSL_malloc(2);
-
- tm=X509_get_notAfter(ret);
- row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
- memcpy(row[DB_exp_date],tm->data,tm->length);
- row[DB_exp_date][tm->length]='\0';
-
- row[DB_rev_date]=NULL;
-
- /* row[DB_serial] done already */
- row[DB_file]=(char *)OPENSSL_malloc(8);
- row[DB_name]=X509_NAME_oneline(X509_get_subject_name(ret),NULL,0);
-
- if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
- (row[DB_file] == NULL) || (row[DB_name] == NULL))
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- BUF_strlcpy(row[DB_file],"unknown",8);
- row[DB_type][0]='V';
- row[DB_type][1]='\0';
-
- if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
-
- for (i=0; i<DB_NUMBER; i++)
- {
- irow[i]=row[i];
- row[i]=NULL;
- }
- irow[DB_NUMBER]=NULL;
-
- if (!TXT_DB_insert(db->db,irow))
- {
- BIO_printf(bio_err,"failed to update database\n");
- BIO_printf(bio_err,"TXT_DB error number %ld\n",db->db->error);
- goto err;
- }
- ok=1;
-err:
- for (i=0; i<DB_NUMBER; i++)
- if (row[i] != NULL) OPENSSL_free(row[i]);
-
- if (CAname != NULL)
- X509_NAME_free(CAname);
- if (subject != NULL)
- X509_NAME_free(subject);
- if ((dn_subject != NULL) && !email_dn)
- X509_NAME_free(dn_subject);
- if (tmptm != NULL)
- ASN1_UTCTIME_free(tmptm);
- if (ok <= 0)
- {
- if (ret != NULL) X509_free(ret);
- ret=NULL;
- }
- else
- *xret=ret;
- return(ok);
- }
-
-static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
- {
-
- if (output_der)
- {
- (void)i2d_X509_bio(bp,x);
- return;
- }
+ if (BN_to_ASN1_INTEGER(serial, ci->serialNumber) == NULL)
+ goto err;
+ if (selfsign) {
+ if (!X509_set_issuer_name(ret, subject))
+ goto err;
+ } else {
+ if (!X509_set_issuer_name(ret, X509_get_subject_name(x509)))
+ goto err;
+ }
+
+ if (strcmp(startdate, "today") == 0)
+ X509_gmtime_adj(X509_get_notBefore(ret), 0);
+ else
+ ASN1_TIME_set_string(X509_get_notBefore(ret), startdate);
+
+ if (enddate == NULL)
+ X509_time_adj_ex(X509_get_notAfter(ret), days, 0, NULL);
+ else
+ ASN1_TIME_set_string(X509_get_notAfter(ret), enddate);
+
+ if (!X509_set_subject_name(ret, subject))
+ goto err;
+
+ pktmp = X509_REQ_get_pubkey(req);
+ i = X509_set_pubkey(ret, pktmp);
+ EVP_PKEY_free(pktmp);
+ if (!i)
+ goto err;
+
+ /* Lets add the extensions, if there are any */
+ if (ext_sect) {
+ X509V3_CTX ctx;
+ if (ci->version == NULL)
+ if ((ci->version = ASN1_INTEGER_new()) == NULL)
+ goto err;
+ ASN1_INTEGER_set(ci->version, 2); /* version 3 certificate */
+
+ /*
+ * Free the current entries if any, there should not be any I believe
+ */
+ if (ci->extensions != NULL)
+ sk_X509_EXTENSION_pop_free(ci->extensions, X509_EXTENSION_free);
+
+ ci->extensions = NULL;
+
+ /* Initialize the context structure */
+ if (selfsign)
+ X509V3_set_ctx(&ctx, ret, ret, req, NULL, 0);
+ else
+ X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
+
+ if (extconf) {
+ if (verbose)
+ BIO_printf(bio_err, "Extra configuration file found\n");
+
+ /* Use the extconf configuration db LHASH */
+ X509V3_set_nconf(&ctx, extconf);
+
+ /* Test the structure (needed?) */
+ /* X509V3_set_ctx_test(&ctx); */
+
+ /* Adds exts contained in the configuration file */
+ if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect, ret)) {
+ BIO_printf(bio_err,
+ "ERROR: adding extensions in section %s\n",
+ ext_sect);
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+ if (verbose)
+ BIO_printf(bio_err,
+ "Successfully added extensions from file.\n");
+ } else if (ext_sect) {
+ /* We found extensions to be set from config file */
+ X509V3_set_nconf(&ctx, lconf);
+
+ if (!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret)) {
+ BIO_printf(bio_err,
+ "ERROR: adding extensions in section %s\n",
+ ext_sect);
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+
+ if (verbose)
+ BIO_printf(bio_err,
+ "Successfully added extensions from config\n");
+ }
+ }
+
+ /* Copy extensions from request (if any) */
+
+ if (!copy_extensions(ret, req, ext_copy)) {
+ BIO_printf(bio_err, "ERROR: adding extensions from request\n");
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+
+ /* Set the right value for the noemailDN option */
+ if (email_dn == 0) {
+ if (!X509_set_subject_name(ret, dn_subject))
+ goto err;
+ }
+
+ if (!default_op) {
+ BIO_printf(bio_err, "Certificate Details:\n");
+ /*
+ * Never print signature details because signature not present
+ */
+ certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
+ X509_print_ex(bio_err, ret, nameopt, certopt);
+ }
+
+ BIO_printf(bio_err, "Certificate is to be certified until ");
+ ASN1_TIME_print(bio_err, X509_get_notAfter(ret));
+ if (days)
+ BIO_printf(bio_err, " (%ld days)", days);
+ BIO_printf(bio_err, "\n");
+
+ if (!batch) {
+
+ BIO_printf(bio_err, "Sign the certificate? [y/n]:");
+ (void)BIO_flush(bio_err);
+ buf[0] = '\0';
+ if (!fgets(buf, sizeof(buf) - 1, stdin)) {
+ BIO_printf(bio_err,
+ "CERTIFICATE WILL NOT BE CERTIFIED: I/O error\n");
+ ok = 0;
+ goto err;
+ }
+ if (!((buf[0] == 'y') || (buf[0] == 'Y'))) {
+ BIO_printf(bio_err, "CERTIFICATE WILL NOT BE CERTIFIED\n");
+ ok = 0;
+ goto err;
+ }
+ }
+
+ pktmp = X509_get_pubkey(ret);
+ if (EVP_PKEY_missing_parameters(pktmp) &&
+ !EVP_PKEY_missing_parameters(pkey))
+ EVP_PKEY_copy_parameters(pktmp, pkey);
+ EVP_PKEY_free(pktmp);
+
+ if (!do_X509_sign(bio_err, ret, pkey, dgst, sigopts))
+ goto err;
+
+ /* We now just add it to the database */
+ row[DB_type] = (char *)OPENSSL_malloc(2);
+
+ tm = X509_get_notAfter(ret);
+ row[DB_exp_date] = (char *)OPENSSL_malloc(tm->length + 1);
+ memcpy(row[DB_exp_date], tm->data, tm->length);
+ row[DB_exp_date][tm->length] = '\0';
+
+ row[DB_rev_date] = NULL;
+
+ /* row[DB_serial] done already */
+ row[DB_file] = (char *)OPENSSL_malloc(8);
+ row[DB_name] = X509_NAME_oneline(X509_get_subject_name(ret), NULL, 0);
+
+ if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
+ (row[DB_file] == NULL) || (row[DB_name] == NULL)) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+ BUF_strlcpy(row[DB_file], "unknown", 8);
+ row[DB_type][0] = 'V';
+ row[DB_type][1] = '\0';
+
+ if ((irow =
+ (char **)OPENSSL_malloc(sizeof(char *) * (DB_NUMBER + 1))) == NULL) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+
+ for (i = 0; i < DB_NUMBER; i++) {
+ irow[i] = row[i];
+ row[i] = NULL;
+ }
+ irow[DB_NUMBER] = NULL;
+
+ if (!TXT_DB_insert(db->db, irow)) {
+ BIO_printf(bio_err, "failed to update database\n");
+ BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);
+ goto err;
+ }
+ ok = 1;
+ err:
+ for (i = 0; i < DB_NUMBER; i++)
+ if (row[i] != NULL)
+ OPENSSL_free(row[i]);
+
+ if (CAname != NULL)
+ X509_NAME_free(CAname);
+ if (subject != NULL)
+ X509_NAME_free(subject);
+ if ((dn_subject != NULL) && !email_dn)
+ X509_NAME_free(dn_subject);
+ if (tmptm != NULL)
+ ASN1_UTCTIME_free(tmptm);
+ if (ok <= 0) {
+ if (ret != NULL)
+ X509_free(ret);
+ ret = NULL;
+ } else
+ *xret = ret;
+ return (ok);
+}
+
+static void write_new_certificate(BIO *bp, X509 *x, int output_der,
+ int notext)
+{
+
+ if (output_der) {
+ (void)i2d_X509_bio(bp, x);
+ return;
+ }
#if 0
- /* ??? Not needed since X509_print prints all this stuff anyway */
- f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
- BIO_printf(bp,"issuer :%s\n",f);
+ /* ??? Not needed since X509_print prints all this stuff anyway */
+ f = X509_NAME_oneline(X509_get_issuer_name(x), buf, 256);
+ BIO_printf(bp, "issuer :%s\n", f);
- f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
- BIO_printf(bp,"subject:%s\n",f);
+ f = X509_NAME_oneline(X509_get_subject_name(x), buf, 256);
+ BIO_printf(bp, "subject:%s\n", f);
- BIO_puts(bp,"serial :");
- i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
- BIO_puts(bp,"\n\n");
+ BIO_puts(bp, "serial :");
+ i2a_ASN1_INTEGER(bp, x->cert_info->serialNumber);
+ BIO_puts(bp, "\n\n");
#endif
- if (!notext)X509_print(bp,x);
- PEM_write_bio_X509(bp,x);
- }
-
-static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
- const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
- STACK_OF(CONF_VALUE) *policy, CA_DB *db,
- BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
- long days, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
- unsigned long nameopt, int default_op, int ext_copy)
- {
- STACK_OF(CONF_VALUE) *sk=NULL;
- LHASH_OF(CONF_VALUE) *parms=NULL;
- X509_REQ *req=NULL;
- CONF_VALUE *cv=NULL;
- NETSCAPE_SPKI *spki = NULL;
- X509_REQ_INFO *ri;
- char *type,*buf;
- EVP_PKEY *pktmp=NULL;
- X509_NAME *n=NULL;
- X509_NAME_ENTRY *ne=NULL;
- int ok= -1,i,j;
- long errline;
- int nid;
-
- /*
- * Load input file into a hash table. (This is just an easy
- * way to read and parse the file, then put it into a convenient
- * STACK format).
- */
- parms=CONF_load(NULL,infile,&errline);
- if (parms == NULL)
- {
- BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
- ERR_print_errors(bio_err);
- goto err;
- }
-
- sk=CONF_get_section(parms, "default");
- if (sk_CONF_VALUE_num(sk) == 0)
- {
- BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
- CONF_free(parms);
- goto err;
- }
-
- /*
- * Now create a dummy X509 request structure. We don't actually
- * have an X509 request, but we have many of the components
- * (a public key, various DN components). The idea is that we
- * put these components into the right X509 request structure
- * and we can use the same code as if you had a real X509 request.
- */
- req=X509_REQ_new();
- if (req == NULL)
- {
- ERR_print_errors(bio_err);
- goto err;
- }
-
- /*
- * Build up the subject name set.
- */
- ri=req->req_info;
- n = ri->subject;
-
- for (i = 0; ; i++)
- {
- if (sk_CONF_VALUE_num(sk) <= i) break;
-
- cv=sk_CONF_VALUE_value(sk,i);
- type=cv->name;
- /* Skip past any leading X. X: X, etc to allow for
- * multiple instances
- */
- for (buf = cv->name; *buf ; buf++)
- if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
- {
- buf++;
- if (*buf) type = buf;
- break;
- }
-
- buf=cv->value;
- if ((nid=OBJ_txt2nid(type)) == NID_undef)
- {
- if (strcmp(type, "SPKAC") == 0)
- {
- spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
- if (spki == NULL)
- {
- BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
- ERR_print_errors(bio_err);
- goto err;
- }
- }
- continue;
- }
-
- if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
- (unsigned char *)buf, -1, -1, 0))
- goto err;
- }
- if (spki == NULL)
- {
- BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
- infile);
- goto err;
- }
-
- /*
- * Now extract the key from the SPKI structure.
- */
-
- BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
-
- if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
- {
- BIO_printf(bio_err,"error unpacking SPKAC public key\n");
- goto err;
- }
-
- j = NETSCAPE_SPKI_verify(spki, pktmp);
- if (j <= 0)
- {
- BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
- goto err;
- }
- BIO_printf(bio_err,"Signature ok\n");
-
- X509_REQ_set_pubkey(req,pktmp);
- EVP_PKEY_free(pktmp);
- ok=do_body(xret,pkey,x509,dgst,sigopts,policy,db,serial,subj,chtype,
- multirdn,email_dn,startdate,enddate, days,1,verbose,req,
- ext_sect,lconf, certopt, nameopt, default_op, ext_copy, 0);
-err:
- if (req != NULL) X509_REQ_free(req);
- if (parms != NULL) CONF_free(parms);
- if (spki != NULL) NETSCAPE_SPKI_free(spki);
- if (ne != NULL) X509_NAME_ENTRY_free(ne);
-
- return(ok);
- }
+ if (!notext)
+ X509_print(bp, x);
+ PEM_write_bio_X509(bp, x);
+}
+
+static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey,
+ X509 *x509, const EVP_MD *dgst,
+ STACK_OF(OPENSSL_STRING) *sigopts,
+ STACK_OF(CONF_VALUE) *policy, CA_DB *db,
+ BIGNUM *serial, char *subj, unsigned long chtype,
+ int multirdn, int email_dn, char *startdate,
+ char *enddate, long days, char *ext_sect,
+ CONF *lconf, int verbose, unsigned long certopt,
+ unsigned long nameopt, int default_op, int ext_copy)
+{
+ STACK_OF(CONF_VALUE) *sk = NULL;
+ LHASH_OF(CONF_VALUE) *parms = NULL;
+ X509_REQ *req = NULL;
+ CONF_VALUE *cv = NULL;
+ NETSCAPE_SPKI *spki = NULL;
+ X509_REQ_INFO *ri;
+ char *type, *buf;
+ EVP_PKEY *pktmp = NULL;
+ X509_NAME *n = NULL;
+ X509_NAME_ENTRY *ne = NULL;
+ int ok = -1, i, j;
+ long errline;
+ int nid;
+
+ /*
+ * Load input file into a hash table. (This is just an easy
+ * way to read and parse the file, then put it into a convenient
+ * STACK format).
+ */
+ parms = CONF_load(NULL, infile, &errline);
+ if (parms == NULL) {
+ BIO_printf(bio_err, "error on line %ld of %s\n", errline, infile);
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+
+ sk = CONF_get_section(parms, "default");
+ if (sk_CONF_VALUE_num(sk) == 0) {
+ BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
+ CONF_free(parms);
+ goto err;
+ }
+
+ /*
+ * Now create a dummy X509 request structure. We don't actually
+ * have an X509 request, but we have many of the components
+ * (a public key, various DN components). The idea is that we
+ * put these components into the right X509 request structure
+ * and we can use the same code as if you had a real X509 request.
+ */
+ req = X509_REQ_new();
+ if (req == NULL) {
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+
+ /*
+ * Build up the subject name set.
+ */
+ ri = req->req_info;
+ n = ri->subject;
+
+ for (i = 0;; i++) {
+ if (sk_CONF_VALUE_num(sk) <= i)
+ break;
+
+ cv = sk_CONF_VALUE_value(sk, i);
+ type = cv->name;
+ /*
+ * Skip past any leading X. X: X, etc to allow for multiple instances
+ */
+ for (buf = cv->name; *buf; buf++)
+ if ((*buf == ':') || (*buf == ',') || (*buf == '.')) {
+ buf++;
+ if (*buf)
+ type = buf;
+ break;
+ }
+
+ buf = cv->value;
+ if ((nid = OBJ_txt2nid(type)) == NID_undef) {
+ if (strcmp(type, "SPKAC") == 0) {
+ spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
+ if (spki == NULL) {
+ BIO_printf(bio_err,
+ "unable to load Netscape SPKAC structure\n");
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+ }
+ continue;
+ }
+
+ if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
+ (unsigned char *)buf, -1, -1, 0))
+ goto err;
+ }
+ if (spki == NULL) {
+ BIO_printf(bio_err, "Netscape SPKAC structure not found in %s\n",
+ infile);
+ goto err;
+ }
+
+ /*
+ * Now extract the key from the SPKI structure.
+ */
+
+ BIO_printf(bio_err,
+ "Check that the SPKAC request matches the signature\n");
+
+ if ((pktmp = NETSCAPE_SPKI_get_pubkey(spki)) == NULL) {
+ BIO_printf(bio_err, "error unpacking SPKAC public key\n");
+ goto err;
+ }
+
+ j = NETSCAPE_SPKI_verify(spki, pktmp);
+ if (j <= 0) {
+ BIO_printf(bio_err,
+ "signature verification failed on SPKAC public key\n");
+ goto err;
+ }
+ BIO_printf(bio_err, "Signature ok\n");
+
+ X509_REQ_set_pubkey(req, pktmp);
+ EVP_PKEY_free(pktmp);
+ ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
+ chtype, multirdn, email_dn, startdate, enddate, days, 1,
+ verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
+ ext_copy, 0);
+ err:
+ if (req != NULL)
+ X509_REQ_free(req);
+ if (parms != NULL)
+ CONF_free(parms);
+ if (spki != NULL)
+ NETSCAPE_SPKI_free(spki);
+ if (ne != NULL)
+ X509_NAME_ENTRY_free(ne);
+
+ return (ok);
+}
static int check_time_format(const char *str)
- {
- return ASN1_TIME_set_string(NULL, str);
- }
+{
+ return ASN1_TIME_set_string(NULL, str);
+}
static int do_revoke(X509 *x509, CA_DB *db, int type, char *value)
- {
- ASN1_UTCTIME *tm=NULL;
- char *row[DB_NUMBER],**rrow,**irow;
- char *rev_str = NULL;
- BIGNUM *bn = NULL;
- int ok=-1,i;
-
- for (i=0; i<DB_NUMBER; i++)
- row[i]=NULL;
- row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
- bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
- if (!bn)
- goto err;
- if (BN_is_zero(bn))
- row[DB_serial]=BUF_strdup("00");
- else
- row[DB_serial]=BN_bn2hex(bn);
- BN_free(bn);
- if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- /* We have to lookup by serial number because name lookup
- * skips revoked certs
- */
- rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
- if (rrow == NULL)
- {
- BIO_printf(bio_err,"Adding Entry with serial number %s to DB for %s\n", row[DB_serial], row[DB_name]);
-
- /* We now just add it to the database */
- row[DB_type]=(char *)OPENSSL_malloc(2);
-
- tm=X509_get_notAfter(x509);
- row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
- memcpy(row[DB_exp_date],tm->data,tm->length);
- row[DB_exp_date][tm->length]='\0';
-
- row[DB_rev_date]=NULL;
-
- /* row[DB_serial] done already */
- row[DB_file]=(char *)OPENSSL_malloc(8);
-
- /* row[DB_name] done already */
-
- if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
- (row[DB_file] == NULL))
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- BUF_strlcpy(row[DB_file],"unknown",8);
- row[DB_type][0]='V';
- row[DB_type][1]='\0';
-
- if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
-
- for (i=0; i<DB_NUMBER; i++)
- {
- irow[i]=row[i];
- row[i]=NULL;
- }
- irow[DB_NUMBER]=NULL;
-
- if (!TXT_DB_insert(db->db,irow))
- {
- BIO_printf(bio_err,"failed to update database\n");
- BIO_printf(bio_err,"TXT_DB error number %ld\n",db->db->error);
- goto err;
- }
-
- /* Revoke Certificate */
- ok = do_revoke(x509,db, type, value);
-
- goto err;
-
- }
- else if (index_name_cmp_noconst(row, rrow))
- {
- BIO_printf(bio_err,"ERROR:name does not match %s\n",
- row[DB_name]);
- goto err;
- }
- else if (rrow[DB_type][0]=='R')
- {
- BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
- row[DB_serial]);
- goto err;
- }
- else
- {
- BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
- rev_str = make_revocation_str(type, value);
- if (!rev_str)
- {
- BIO_printf(bio_err, "Error in revocation arguments\n");
- goto err;
- }
- rrow[DB_type][0]='R';
- rrow[DB_type][1]='\0';
- rrow[DB_rev_date] = rev_str;
- }
- ok=1;
-err:
- for (i=0; i<DB_NUMBER; i++)
- {
- if (row[i] != NULL)
- OPENSSL_free(row[i]);
- }
- return(ok);
- }
+{
+ ASN1_UTCTIME *tm = NULL;
+ char *row[DB_NUMBER], **rrow, **irow;
+ char *rev_str = NULL;
+ BIGNUM *bn = NULL;
+ int ok = -1, i;
+
+ for (i = 0; i < DB_NUMBER; i++)
+ row[i] = NULL;
+ row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);
+ bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509), NULL);
+ if (!bn)
+ goto err;
+ if (BN_is_zero(bn))
+ row[DB_serial] = BUF_strdup("00");
+ else
+ row[DB_serial] = BN_bn2hex(bn);
+ BN_free(bn);
+ if ((row[DB_name] == NULL) || (row[DB_serial] == NULL)) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+ /*
+ * We have to lookup by serial number because name lookup skips revoked
+ * certs
+ */
+ rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
+ if (rrow == NULL) {
+ BIO_printf(bio_err,
+ "Adding Entry with serial number %s to DB for %s\n",
+ row[DB_serial], row[DB_name]);
+
+ /* We now just add it to the database */
+ row[DB_type] = (char *)OPENSSL_malloc(2);
+
+ tm = X509_get_notAfter(x509);
+ row[DB_exp_date] = (char *)OPENSSL_malloc(tm->length + 1);
+ memcpy(row[DB_exp_date], tm->data, tm->length);
+ row[DB_exp_date][tm->length] = '\0';
+
+ row[DB_rev_date] = NULL;
+
+ /* row[DB_serial] done already */
+ row[DB_file] = (char *)OPENSSL_malloc(8);
+
+ /* row[DB_name] done already */
+
+ if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
+ (row[DB_file] == NULL)) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+ BUF_strlcpy(row[DB_file], "unknown", 8);
+ row[DB_type][0] = 'V';
+ row[DB_type][1] = '\0';
+
+ if ((irow =
+ (char **)OPENSSL_malloc(sizeof(char *) * (DB_NUMBER + 1))) ==
+ NULL) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto err;
+ }
+
+ for (i = 0; i < DB_NUMBER; i++) {
+ irow[i] = row[i];
+ row[i] = NULL;
+ }
+ irow[DB_NUMBER] = NULL;
+
+ if (!TXT_DB_insert(db->db, irow)) {
+ BIO_printf(bio_err, "failed to update database\n");
+ BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);
+ goto err;
+ }
+
+ /* Revoke Certificate */
+ ok = do_revoke(x509, db, type, value);
+
+ goto err;
+
+ } else if (index_name_cmp_noconst(row, rrow)) {
+ BIO_printf(bio_err, "ERROR:name does not match %s\n", row[DB_name]);
+ goto err;
+ } else if (rrow[DB_type][0] == 'R') {
+ BIO_printf(bio_err, "ERROR:Already revoked, serial number %s\n",
+ row[DB_serial]);
+ goto err;
+ } else {
+ BIO_printf(bio_err, "Revoking Certificate %s.\n", rrow[DB_serial]);
+ rev_str = make_revocation_str(type, value);
+ if (!rev_str) {
+ BIO_printf(bio_err, "Error in revocation arguments\n");
+ goto err;
+ }
+ rrow[DB_type][0] = 'R';
+ rrow[DB_type][1] = '\0';
+ rrow[DB_rev_date] = rev_str;
+ }
+ ok = 1;
+ err:
+ for (i = 0; i < DB_NUMBER; i++) {
+ if (row[i] != NULL)
+ OPENSSL_free(row[i]);
+ }
+ return (ok);
+}
static int get_certificate_status(const char *serial, CA_DB *db)
- {
- char *row[DB_NUMBER],**rrow;
- int ok=-1,i;
-
- /* Free Resources */
- for (i=0; i<DB_NUMBER; i++)
- row[i]=NULL;
-
- /* Malloc needed char spaces */
- row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
- if (row[DB_serial] == NULL)
- {
- BIO_printf(bio_err,"Malloc failure\n");
- goto err;
- }
-
- if (strlen(serial) % 2)
- {
- /* Set the first char to 0 */;
- row[DB_serial][0]='0';
-
- /* Copy String from serial to row[DB_serial] */
- memcpy(row[DB_serial]+1, serial, strlen(serial));
- row[DB_serial][strlen(serial)+1]='\0';
- }
- else
- {
- /* Copy String from serial to row[DB_serial] */
- memcpy(row[DB_serial], serial, strlen(serial));
- row[DB_serial][strlen(serial)]='\0';
- }
-
- /* Make it Upper Case */
- for (i=0; row[DB_serial][i] != '\0'; i++)
- row[DB_serial][i] = toupper((unsigned char)row[DB_serial][i]);
-
-
- ok=1;
-
- /* Search for the certificate */
- rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
- if (rrow == NULL)
- {
- BIO_printf(bio_err,"Serial %s not present in db.\n",
- row[DB_serial]);
- ok=-1;
- goto err;
- }
- else if (rrow[DB_type][0]=='V')
- {
- BIO_printf(bio_err,"%s=Valid (%c)\n",
- row[DB_serial], rrow[DB_type][0]);
- goto err;
- }
- else if (rrow[DB_type][0]=='R')
- {
- BIO_printf(bio_err,"%s=Revoked (%c)\n",
- row[DB_serial], rrow[DB_type][0]);
- goto err;
- }
- else if (rrow[DB_type][0]=='E')
- {
- BIO_printf(bio_err,"%s=Expired (%c)\n",
- row[DB_serial], rrow[DB_type][0]);
- goto err;
- }
- else if (rrow[DB_type][0]=='S')
- {
- BIO_printf(bio_err,"%s=Suspended (%c)\n",
- row[DB_serial], rrow[DB_type][0]);
- goto err;
- }
- else
- {
- BIO_printf(bio_err,"%s=Unknown (%c).\n",
- row[DB_serial], rrow[DB_type][0]);
- ok=-1;
- }
-err:
- for (i=0; i<DB_NUMBER; i++)
- {
- if (row[i] != NULL)
- OPENSSL_free(row[i]);
- }
- return(ok);
- }
-
-static int do_updatedb (CA_DB *db)
- {
- ASN1_UTCTIME *a_tm = NULL;
- int i, cnt = 0;
- int db_y2k, a_y2k; /* flags = 1 if y >= 2000 */
- char **rrow, *a_tm_s;
-
- a_tm = ASN1_UTCTIME_new();
-
- /* get actual time and make a string */
- a_tm = X509_gmtime_adj(a_tm, 0);
- a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
- if (a_tm_s == NULL)
- {
- cnt = -1;
- goto err;
- }
-
- memcpy(a_tm_s, a_tm->data, a_tm->length);
- a_tm_s[a_tm->length] = '\0';
-
- if (strncmp(a_tm_s, "49", 2) <= 0)
- a_y2k = 1;
- else
- a_y2k = 0;
-
- for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++)
- {
- rrow = sk_OPENSSL_PSTRING_value(db->db->data, i);
-
- if (rrow[DB_type][0] == 'V')
- {
- /* ignore entries that are not valid */
- if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
- db_y2k = 1;
- else
- db_y2k = 0;
-
- if (db_y2k == a_y2k)
- {
- /* all on the same y2k side */
- if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
- {
- rrow[DB_type][0] = 'E';
- rrow[DB_type][1] = '\0';
- cnt++;
-
- BIO_printf(bio_err, "%s=Expired\n",
- rrow[DB_serial]);
- }
- }
- else if (db_y2k < a_y2k)
- {
- rrow[DB_type][0] = 'E';
- rrow[DB_type][1] = '\0';
- cnt++;
-
- BIO_printf(bio_err, "%s=Expired\n",
- rrow[DB_serial]);
- }
-
- }
- }
-
-err:
-
- ASN1_UTCTIME_free(a_tm);
- OPENSSL_free(a_tm_s);
-
- return (cnt);
- }
+{
+ char *row[DB_NUMBER], **rrow;
+ int ok = -1, i;
+
+ /* Free Resources */
+ for (i = 0; i < DB_NUMBER; i++)
+ row[i] = NULL;
+
+ /* Malloc needed char spaces */
+ row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
+ if (row[DB_serial] == NULL) {
+ BIO_printf(bio_err, "Malloc failure\n");
+ goto err;
+ }
+
+ if (strlen(serial) % 2) {
+ /*
+ * Set the first char to 0
+ */ ;
+ row[DB_serial][0] = '0';
+
+ /* Copy String from serial to row[DB_serial] */
+ memcpy(row[DB_serial] + 1, serial, strlen(serial));
+ row[DB_serial][strlen(serial) + 1] = '\0';
+ } else {
+ /* Copy String from serial to row[DB_serial] */
+ memcpy(row[DB_serial], serial, strlen(serial));
+ row[DB_serial][strlen(serial)] = '\0';
+ }
+
+ /* Make it Upper Case */
+ for (i = 0; row[DB_serial][i] != '\0'; i++)
+ row[DB_serial][i] = toupper((unsigned char)row[DB_serial][i]);
+
+ ok = 1;
+
+ /* Search for the certificate */
+ rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
+ if (rrow == NULL) {
+ BIO_printf(bio_err, "Serial %s not present in db.\n", row[DB_serial]);
+ ok = -1;
+ goto err;
+ } else if (rrow[DB_type][0] == 'V') {
+ BIO_printf(bio_err, "%s=Valid (%c)\n",
+ row[DB_serial], rrow[DB_type][0]);
+ goto err;
+ } else if (rrow[DB_type][0] == 'R') {
+ BIO_printf(bio_err, "%s=Revoked (%c)\n",
+ row[DB_serial], rrow[DB_type][0]);
+ goto err;
+ } else if (rrow[DB_type][0] == 'E') {
+ BIO_printf(bio_err, "%s=Expired (%c)\n",
+ row[DB_serial], rrow[DB_type][0]);
+ goto err;
+ } else if (rrow[DB_type][0] == 'S') {
+ BIO_printf(bio_err, "%s=Suspended (%c)\n",
+ row[DB_serial], rrow[DB_type][0]);
+ goto err;
+ } else {
+ BIO_printf(bio_err, "%s=Unknown (%c).\n",
+ row[DB_serial], rrow[DB_type][0]);
+ ok = -1;
+ }
+ err:
+ for (i = 0; i < DB_NUMBER; i++) {
+ if (row[i] != NULL)
+ OPENSSL_free(row[i]);
+ }
+ return (ok);
+}
+
+static int do_updatedb(CA_DB *db)
+{
+ ASN1_UTCTIME *a_tm = NULL;
+ int i, cnt = 0;
+ int db_y2k, a_y2k; /* flags = 1 if y >= 2000 */
+ char **rrow, *a_tm_s;
+
+ a_tm = ASN1_UTCTIME_new();
+
+ /* get actual time and make a string */
+ a_tm = X509_gmtime_adj(a_tm, 0);
+ a_tm_s = (char *)OPENSSL_malloc(a_tm->length + 1);
+ if (a_tm_s == NULL) {
+ cnt = -1;
+ goto err;
+ }
+
+ memcpy(a_tm_s, a_tm->data, a_tm->length);
+ a_tm_s[a_tm->length] = '\0';
+
+ if (strncmp(a_tm_s, "49", 2) <= 0)
+ a_y2k = 1;
+ else
+ a_y2k = 0;
+
+ for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
+ rrow = sk_OPENSSL_PSTRING_value(db->db->data, i);
+
+ if (rrow[DB_type][0] == 'V') {
+ /* ignore entries that are not valid */
+ if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
+ db_y2k = 1;
+ else
+ db_y2k = 0;
+
+ if (db_y2k == a_y2k) {
+ /* all on the same y2k side */
+ if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0) {
+ rrow[DB_type][0] = 'E';
+ rrow[DB_type][1] = '\0';
+ cnt++;
+
+ BIO_printf(bio_err, "%s=Expired\n", rrow[DB_serial]);
+ }
+ } else if (db_y2k < a_y2k) {
+ rrow[DB_type][0] = 'E';
+ rrow[DB_type][1] = '\0';
+ cnt++;
+
+ BIO_printf(bio_err, "%s=Expired\n", rrow[DB_serial]);
+ }
+
+ }
+ }
+
+ err:
+
+ ASN1_UTCTIME_free(a_tm);
+ OPENSSL_free(a_tm_s);
+
+ return (cnt);
+}
static const char *crl_reasons[] = {
- /* CRL reason strings */
- "unspecified",
- "keyCompromise",
- "CACompromise",
- "affiliationChanged",
- "superseded",
- "cessationOfOperation",
- "certificateHold",
- "removeFromCRL",
- /* Additional pseudo reasons */
- "holdInstruction",
- "keyTime",
- "CAkeyTime"
+ /* CRL reason strings */
+ "unspecified",
+ "keyCompromise",
+ "CACompromise",
+ "affiliationChanged",
+ "superseded",
+ "cessationOfOperation",
+ "certificateHold",
+ "removeFromCRL",
+ /* Additional pseudo reasons */
+ "holdInstruction",
+ "keyTime",
+ "CAkeyTime"
};
#define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
-/* Given revocation information convert to a DB string.
- * The format of the string is:
- * revtime[,reason,extra]. Where 'revtime' is the
- * revocation time (the current time). 'reason' is the
- * optional CRL reason and 'extra' is any additional
- * argument
+/*
+ * Given revocation information convert to a DB string. The format of the
+ * string is: revtime[,reason,extra]. Where 'revtime' is the revocation time
+ * (the current time). 'reason' is the optional CRL reason and 'extra' is any
+ * additional argument
*/
char *make_revocation_str(int rev_type, char *rev_arg)
- {
- char *other = NULL, *str;
- const char *reason = NULL;
- ASN1_OBJECT *otmp;
- ASN1_UTCTIME *revtm = NULL;
- int i;
- switch (rev_type)
- {
- case REV_NONE:
- break;
-
- case REV_CRL_REASON:
- for (i = 0; i < 8; i++)
- {
- if (!strcasecmp(rev_arg, crl_reasons[i]))
- {
- reason = crl_reasons[i];
- break;
- }
- }
- if (reason == NULL)
- {
- BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
- return NULL;
- }
- break;
-
- case REV_HOLD:
- /* Argument is an OID */
-
- otmp = OBJ_txt2obj(rev_arg, 0);
- ASN1_OBJECT_free(otmp);
-
- if (otmp == NULL)
- {
- BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
- return NULL;
- }
-
- reason = "holdInstruction";
- other = rev_arg;
- break;
-
- case REV_KEY_COMPROMISE:
- case REV_CA_COMPROMISE:
-
- /* Argument is the key compromise time */
- if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
- {
- BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
- return NULL;
- }
- other = rev_arg;
- if (rev_type == REV_KEY_COMPROMISE)
- reason = "keyTime";
- else
- reason = "CAkeyTime";
-
- break;
-
- }
-
- revtm = X509_gmtime_adj(NULL, 0);
-
- if (!revtm)
- return NULL;
-
- i = revtm->length + 1;
-
- if (reason) i += strlen(reason) + 1;
- if (other) i += strlen(other) + 1;
-
- str = OPENSSL_malloc(i);
-
- if (!str) return NULL;
-
- BUF_strlcpy(str, (char *)revtm->data, i);
- if (reason)
- {
- BUF_strlcat(str, ",", i);
- BUF_strlcat(str, reason, i);
- }
- if (other)
- {
- BUF_strlcat(str, ",", i);
- BUF_strlcat(str, other, i);
- }
- ASN1_UTCTIME_free(revtm);
- return str;
- }
-
-/* Convert revocation field to X509_REVOKED entry
+{
+ char *other = NULL, *str;
+ const char *reason = NULL;
+ ASN1_OBJECT *otmp;
+ ASN1_UTCTIME *revtm = NULL;
+ int i;
+ switch (rev_type) {
+ case REV_NONE:
+ break;
+
+ case REV_CRL_REASON:
+ for (i = 0; i < 8; i++) {
+ if (!strcasecmp(rev_arg, crl_reasons[i])) {
+ reason = crl_reasons[i];
+ break;
+ }
+ }
+ if (reason == NULL) {
+ BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
+ return NULL;
+ }
+ break;
+
+ case REV_HOLD:
+ /* Argument is an OID */
+
+ otmp = OBJ_txt2obj(rev_arg, 0);
+ ASN1_OBJECT_free(otmp);
+
+ if (otmp == NULL) {
+ BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
+ return NULL;
+ }
+
+ reason = "holdInstruction";
+ other = rev_arg;
+ break;
+
+ case REV_KEY_COMPROMISE:
+ case REV_CA_COMPROMISE:
+
+ /* Argument is the key compromise time */
+ if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg)) {
+ BIO_printf(bio_err,
+ "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n",
+ rev_arg);
+ return NULL;
+ }
+ other = rev_arg;
+ if (rev_type == REV_KEY_COMPROMISE)
+ reason = "keyTime";
+ else
+ reason = "CAkeyTime";
+
+ break;
+
+ }
+
+ revtm = X509_gmtime_adj(NULL, 0);
+
+ if (!revtm)
+ return NULL;
+
+ i = revtm->length + 1;
+
+ if (reason)
+ i += strlen(reason) + 1;
+ if (other)
+ i += strlen(other) + 1;
+
+ str = OPENSSL_malloc(i);
+
+ if (!str)
+ return NULL;
+
+ BUF_strlcpy(str, (char *)revtm->data, i);
+ if (reason) {
+ BUF_strlcat(str, ",", i);
+ BUF_strlcat(str, reason, i);
+ }
+ if (other) {
+ BUF_strlcat(str, ",", i);
+ BUF_strlcat(str, other, i);
+ }
+ ASN1_UTCTIME_free(revtm);
+ return str;
+}
+
+/*-
+ * Convert revocation field to X509_REVOKED entry
* return code:
* 0 error
* 1 OK
* 2 OK and some extensions added (i.e. V2 CRL)
*/
-
int make_revoked(X509_REVOKED *rev, const char *str)
- {
- char *tmp = NULL;
- int reason_code = -1;
- int i, ret = 0;
- ASN1_OBJECT *hold = NULL;
- ASN1_GENERALIZEDTIME *comp_time = NULL;
- ASN1_ENUMERATED *rtmp = NULL;
-
- ASN1_TIME *revDate = NULL;
-
- i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
-
- if (i == 0)
- goto err;
-
- if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
- goto err;
-
- if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
- {
- rtmp = ASN1_ENUMERATED_new();
- if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
- goto err;
- if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
- goto err;
- }
-
- if (rev && comp_time)
- {
- if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
- goto err;
- }
- if (rev && hold)
- {
- if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
- goto err;
- }
-
- if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
- ret = 2;
- else ret = 1;
-
- err:
-
- if (tmp) OPENSSL_free(tmp);
- ASN1_OBJECT_free(hold);
- ASN1_GENERALIZEDTIME_free(comp_time);
- ASN1_ENUMERATED_free(rtmp);
- ASN1_TIME_free(revDate);
-
- return ret;
- }
+{
+ char *tmp = NULL;
+ int reason_code = -1;
+ int i, ret = 0;
+ ASN1_OBJECT *hold = NULL;
+ ASN1_GENERALIZEDTIME *comp_time = NULL;
+ ASN1_ENUMERATED *rtmp = NULL;
+
+ ASN1_TIME *revDate = NULL;
+
+ i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
+
+ if (i == 0)
+ goto err;
+
+ if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
+ goto err;
+
+ if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)) {
+ rtmp = ASN1_ENUMERATED_new();
+ if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
+ goto err;
+ if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
+ goto err;
+ }
+
+ if (rev && comp_time) {
+ if (!X509_REVOKED_add1_ext_i2d
+ (rev, NID_invalidity_date, comp_time, 0, 0))
+ goto err;
+ }
+ if (rev && hold) {
+ if (!X509_REVOKED_add1_ext_i2d
+ (rev, NID_hold_instruction_code, hold, 0, 0))
+ goto err;
+ }
+
+ if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
+ ret = 2;
+ else
+ ret = 1;
+
+ err:
+
+ if (tmp)
+ OPENSSL_free(tmp);
+ ASN1_OBJECT_free(hold);
+ ASN1_GENERALIZEDTIME_free(comp_time);
+ ASN1_ENUMERATED_free(rtmp);
+ ASN1_TIME_free(revDate);
+
+ return ret;
+}
int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
- {
- char buf[25],*pbuf, *p;
- int j;
- j=i2a_ASN1_OBJECT(bp,obj);
- pbuf=buf;
- for (j=22-j; j>0; j--)
- *(pbuf++)=' ';
- *(pbuf++)=':';
- *(pbuf++)='\0';
- BIO_puts(bp,buf);
-
- if (str->type == V_ASN1_PRINTABLESTRING)
- BIO_printf(bp,"PRINTABLE:'");
- else if (str->type == V_ASN1_T61STRING)
- BIO_printf(bp,"T61STRING:'");
- else if (str->type == V_ASN1_IA5STRING)
- BIO_printf(bp,"IA5STRING:'");
- else if (str->type == V_ASN1_UNIVERSALSTRING)
- BIO_printf(bp,"UNIVERSALSTRING:'");
- else
- BIO_printf(bp,"ASN.1 %2d:'",str->type);
-
- p=(char *)str->data;
- for (j=str->length; j>0; j--)
- {
- if ((*p >= ' ') && (*p <= '~'))
- BIO_printf(bp,"%c",*p);
- else if (*p & 0x80)
- BIO_printf(bp,"\\0x%02X",*p);
- else if ((unsigned char)*p == 0xf7)
- BIO_printf(bp,"^?");
- else BIO_printf(bp,"^%c",*p+'@');
- p++;
- }
- BIO_printf(bp,"'\n");
- return 1;
- }
-
-int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)
- {
- char *tmp = NULL;
- char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
- int reason_code = -1;
- int ret = 0;
- unsigned int i;
- ASN1_OBJECT *hold = NULL;
- ASN1_GENERALIZEDTIME *comp_time = NULL;
- tmp = BUF_strdup(str);
-
- p = strchr(tmp, ',');
-
- rtime_str = tmp;
-
- if (p)
- {
- *p = '\0';
- p++;
- reason_str = p;
- p = strchr(p, ',');
- if (p)
- {
- *p = '\0';
- arg_str = p + 1;
- }
- }
-
- if (prevtm)
- {
- *prevtm = ASN1_UTCTIME_new();
- if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))
- {
- BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
- goto err;
- }
- }
- if (reason_str)
- {
- for (i = 0; i < NUM_REASONS; i++)
- {
- if(!strcasecmp(reason_str, crl_reasons[i]))
- {
- reason_code = i;
- break;
- }
- }
- if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
- {
- BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
- goto err;
- }
-
- if (reason_code == 7)
- reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
- else if (reason_code == 8) /* Hold instruction */
- {
- if (!arg_str)
- {
- BIO_printf(bio_err, "missing hold instruction\n");
- goto err;
- }
- reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
- hold = OBJ_txt2obj(arg_str, 0);
-
- if (!hold)
- {
- BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
- goto err;
- }
- if (phold) *phold = hold;
- }
- else if ((reason_code == 9) || (reason_code == 10))
- {
- if (!arg_str)
- {
- BIO_printf(bio_err, "missing compromised time\n");
- goto err;
- }
- comp_time = ASN1_GENERALIZEDTIME_new();
- if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
- {
- BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
- goto err;
- }
- if (reason_code == 9)
- reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
- else
- reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
- }
- }
-
- if (preason) *preason = reason_code;
- if (pinvtm) *pinvtm = comp_time;
- else ASN1_GENERALIZEDTIME_free(comp_time);
-
- ret = 1;
-
- err:
-
- if (tmp) OPENSSL_free(tmp);
- if (!phold) ASN1_OBJECT_free(hold);
- if (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);
-
- return ret;
- }
+{
+ char buf[25], *pbuf, *p;
+ int j;
+ j = i2a_ASN1_OBJECT(bp, obj);
+ pbuf = buf;
+ for (j = 22 - j; j > 0; j--)
+ *(pbuf++) = ' ';
+ *(pbuf++) = ':';
+ *(pbuf++) = '\0';
+ BIO_puts(bp, buf);
+
+ if (str->type == V_ASN1_PRINTABLESTRING)
+ BIO_printf(bp, "PRINTABLE:'");
+ else if (str->type == V_ASN1_T61STRING)
+ BIO_printf(bp, "T61STRING:'");
+ else if (str->type == V_ASN1_IA5STRING)
+ BIO_printf(bp, "IA5STRING:'");
+ else if (str->type == V_ASN1_UNIVERSALSTRING)
+ BIO_printf(bp, "UNIVERSALSTRING:'");
+ else
+ BIO_printf(bp, "ASN.1 %2d:'", str->type);
+
+ p = (char *)str->data;
+ for (j = str->length; j > 0; j--) {
+ if ((*p >= ' ') && (*p <= '~'))
+ BIO_printf(bp, "%c", *p);
+ else if (*p & 0x80)
+ BIO_printf(bp, "\\0x%02X", *p);
+ else if ((unsigned char)*p == 0xf7)
+ BIO_printf(bp, "^?");
+ else
+ BIO_printf(bp, "^%c", *p + '@');
+ p++;
+ }
+ BIO_printf(bp, "'\n");
+ return 1;
+}
+
+int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
+ ASN1_GENERALIZEDTIME **pinvtm, const char *str)
+{
+ char *tmp = NULL;
+ char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
+ int reason_code = -1;
+ int ret = 0;
+ unsigned int i;
+ ASN1_OBJECT *hold = NULL;
+ ASN1_GENERALIZEDTIME *comp_time = NULL;
+ tmp = BUF_strdup(str);
+
+ if(!tmp) {
+ BIO_printf(bio_err, "memory allocation failure\n");
+ goto err;
+ }
+
+ p = strchr(tmp, ',');
+
+ rtime_str = tmp;
+
+ if (p) {
+ *p = '\0';
+ p++;
+ reason_str = p;
+ p = strchr(p, ',');
+ if (p) {
+ *p = '\0';
+ arg_str = p + 1;
+ }
+ }
+
+ if (prevtm) {
+ *prevtm = ASN1_UTCTIME_new();
+ if(!*prevtm) {
+ BIO_printf(bio_err, "memory allocation failure\n");
+ goto err;
+ }
+ if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str)) {
+ BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
+ goto err;
+ }
+ }
+ if (reason_str) {
+ for (i = 0; i < NUM_REASONS; i++) {
+ if (!strcasecmp(reason_str, crl_reasons[i])) {
+ reason_code = i;
+ break;
+ }
+ }
+ if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS) {
+ BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
+ goto err;
+ }
+
+ if (reason_code == 7)
+ reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
+ else if (reason_code == 8) { /* Hold instruction */
+ if (!arg_str) {
+ BIO_printf(bio_err, "missing hold instruction\n");
+ goto err;
+ }
+ reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
+ hold = OBJ_txt2obj(arg_str, 0);
+
+ if (!hold) {
+ BIO_printf(bio_err, "invalid object identifier %s\n",
+ arg_str);
+ goto err;
+ }
+ if (phold)
+ *phold = hold;
+ } else if ((reason_code == 9) || (reason_code == 10)) {
+ if (!arg_str) {
+ BIO_printf(bio_err, "missing compromised time\n");
+ goto err;
+ }
+ comp_time = ASN1_GENERALIZEDTIME_new();
+ if(!comp_time) {
+ BIO_printf(bio_err, "memory allocation failure\n");
+ goto err;
+ }
+ if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str)) {
+ BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
+ goto err;
+ }
+ if (reason_code == 9)
+ reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
+ else
+ reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
+ }
+ }
+
+ if (preason)
+ *preason = reason_code;
+ if (pinvtm)
+ *pinvtm = comp_time;
+ else
+ ASN1_GENERALIZEDTIME_free(comp_time);
+
+ ret = 1;
+
+ err:
+
+ if (tmp)
+ OPENSSL_free(tmp);
+ if (!phold)
+ ASN1_OBJECT_free(hold);
+ if (!pinvtm)
+ ASN1_GENERALIZEDTIME_free(comp_time);
+
+ return ret;
+}
diff --git a/apps/ciphers.c b/apps/ciphers.c
index 93dce1c40b4a..f299175f11e1 100644
--- a/apps/ciphers.c
+++ b/apps/ciphers.c
@@ -5,21 +5,21 @@
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -34,10 +34,10 @@
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -49,7 +49,7 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
@@ -60,166 +60,166 @@
#include <stdlib.h>
#include <string.h>
#ifdef OPENSSL_NO_STDIO
-#define APPS_WIN16
+# define APPS_WIN16
#endif
#include "apps.h"
#include <openssl/err.h>
#include <openssl/ssl.h>
#undef PROG
-#define PROG ciphers_main
-
-static const char *ciphers_usage[]={
-"usage: ciphers args\n",
-" -v - verbose mode, a textual listing of the SSL/TLS ciphers in OpenSSL\n",
-" -V - even more verbose\n",
-" -ssl2 - SSL2 mode\n",
-" -ssl3 - SSL3 mode\n",
-" -tls1 - TLS1 mode\n",
-NULL
+#define PROG ciphers_main
+
+static const char *ciphers_usage[] = {
+ "usage: ciphers args\n",
+ " -v - verbose mode, a textual listing of the SSL/TLS ciphers in OpenSSL\n",
+ " -V - even more verbose\n",
+ " -ssl2 - SSL2 mode\n",
+ " -ssl3 - SSL3 mode\n",
+ " -tls1 - TLS1 mode\n",
+ NULL
};
int MAIN(int, char **);
int MAIN(int argc, char **argv)
- {
- int ret=1,i;
- int verbose=0,Verbose=0;
- const char **pp;
- const char *p;
- int badops=0;
- SSL_CTX *ctx=NULL;
- SSL *ssl=NULL;
- char *ciphers=NULL;
- const SSL_METHOD *meth=NULL;
- STACK_OF(SSL_CIPHER) *sk;
- char buf[512];
- BIO *STDout=NULL;
-
- meth=SSLv23_server_method();
-
- apps_startup();
-
- if (bio_err == NULL)
- bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
- STDout=BIO_new_fp(stdout,BIO_NOCLOSE);
+{
+ int ret = 1, i;
+ int verbose = 0, Verbose = 0;
+ const char **pp;
+ const char *p;
+ int badops = 0;
+ SSL_CTX *ctx = NULL;
+ SSL *ssl = NULL;
+ char *ciphers = NULL;
+ const SSL_METHOD *meth = NULL;
+ STACK_OF(SSL_CIPHER) *sk;
+ char buf[512];
+ BIO *STDout = NULL;
+
+ meth = SSLv23_server_method();
+
+ apps_startup();
+
+ if (bio_err == NULL)
+ bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
+ STDout = BIO_new_fp(stdout, BIO_NOCLOSE);
#ifdef OPENSSL_SYS_VMS
- {
- BIO *tmpbio = BIO_new(BIO_f_linebuffer());
- STDout = BIO_push(tmpbio, STDout);
- }
+ {
+ BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+ STDout = BIO_push(tmpbio, STDout);
+ }
#endif
- if (!load_config(bio_err, NULL))
- goto end;
-
- argc--;
- argv++;
- while (argc >= 1)
- {
- if (strcmp(*argv,"-v") == 0)
- verbose=1;
- else if (strcmp(*argv,"-V") == 0)
- verbose=Verbose=1;
+ if (!load_config(bio_err, NULL))
+ goto end;
+
+ argc--;
+ argv++;
+ while (argc >= 1) {
+ if (strcmp(*argv, "-v") == 0)
+ verbose = 1;
+ else if (strcmp(*argv, "-V") == 0)
+ verbose = Verbose = 1;
#ifndef OPENSSL_NO_SSL2
- else if (strcmp(*argv,"-ssl2") == 0)
- meth=SSLv2_client_method();
+ else if (strcmp(*argv, "-ssl2") == 0)
+ meth = SSLv2_client_method();
#endif
#ifndef OPENSSL_NO_SSL3
- else if (strcmp(*argv,"-ssl3") == 0)
- meth=SSLv3_client_method();
+ else if (strcmp(*argv, "-ssl3") == 0)
+ meth = SSLv3_client_method();
#endif
#ifndef OPENSSL_NO_TLS1
- else if (strcmp(*argv,"-tls1") == 0)
- meth=TLSv1_client_method();
+ else if (strcmp(*argv, "-tls1") == 0)
+ meth = TLSv1_client_method();
#endif
- else if ((strncmp(*argv,"-h",2) == 0) ||
- (strcmp(*argv,"-?") == 0))
- {
- badops=1;
- break;
- }
- else
- {
- ciphers= *argv;
- }
- argc--;
- argv++;
- }
-
- if (badops)
- {
- for (pp=ciphers_usage; (*pp != NULL); pp++)
- BIO_printf(bio_err,"%s",*pp);
- goto end;
- }
-
- OpenSSL_add_ssl_algorithms();
-
- ctx=SSL_CTX_new(meth);
- if (ctx == NULL) goto err;
- if (ciphers != NULL) {
- if(!SSL_CTX_set_cipher_list(ctx,ciphers)) {
- BIO_printf(bio_err, "Error in cipher list\n");
- goto err;
- }
- }
- ssl=SSL_new(ctx);
- if (ssl == NULL) goto err;
-
-
- if (!verbose)
- {
- for (i=0; ; i++)
- {
- p=SSL_get_cipher_list(ssl,i);
- if (p == NULL) break;
- if (i != 0) BIO_printf(STDout,":");
- BIO_printf(STDout,"%s",p);
- }
- BIO_printf(STDout,"\n");
- }
- else /* verbose */
- {
- sk=SSL_get_ciphers(ssl);
-
- for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
- {
- SSL_CIPHER *c;
-
- c = sk_SSL_CIPHER_value(sk,i);
-
- if (Verbose)
- {
- unsigned long id = SSL_CIPHER_get_id(c);
- int id0 = (int)(id >> 24);
- int id1 = (int)((id >> 16) & 0xffL);
- int id2 = (int)((id >> 8) & 0xffL);
- int id3 = (int)(id & 0xffL);
-
- if ((id & 0xff000000L) == 0x02000000L)
- BIO_printf(STDout, " 0x%02X,0x%02X,0x%02X - ", id1, id2, id3); /* SSL2 cipher */
- else if ((id & 0xff000000L) == 0x03000000L)
- BIO_printf(STDout, " 0x%02X,0x%02X - ", id2, id3); /* SSL3 cipher */
- else
- BIO_printf(STDout, "0x%02X,0x%02X,0x%02X,0x%02X - ", id0, id1, id2, id3); /* whatever */
- }
-
- BIO_puts(STDout,SSL_CIPHER_description(c,buf,sizeof buf));
- }
- }
-
- ret=0;
- if (0)
- {
-err:
- SSL_load_error_strings();
- ERR_print_errors(bio_err);
- }
-end:
- if (ctx != NULL) SSL_CTX_free(ctx);
- if (ssl != NULL) SSL_free(ssl);
- if (STDout != NULL) BIO_free_all(STDout);
- apps_shutdown();
- OPENSSL_EXIT(ret);
- }
-
+ else if ((strncmp(*argv, "-h", 2) == 0) || (strcmp(*argv, "-?") == 0)) {
+ badops = 1;
+ break;
+ } else {
+ ciphers = *argv;
+ }
+ argc--;
+ argv++;
+ }
+
+ if (badops) {
+ for (pp = ciphers_usage; (*pp != NULL); pp++)
+ BIO_printf(bio_err, "%s", *pp);
+ goto end;
+ }
+
+ OpenSSL_add_ssl_algorithms();
+
+ ctx = SSL_CTX_new(meth);
+ if (ctx == NULL)
+ goto err;
+ if (ciphers != NULL) {
+ if (!SSL_CTX_set_cipher_list(ctx, ciphers)) {
+ BIO_printf(bio_err, "Error in cipher list\n");
+ goto err;
+ }
+ }
+ ssl = SSL_new(ctx);
+ if (ssl == NULL)
+ goto err;
+
+ if (!verbose) {
+ for (i = 0;; i++) {
+ p = SSL_get_cipher_list(ssl, i);
+ if (p == NULL)
+ break;
+ if (i != 0)
+ BIO_printf(STDout, ":");
+ BIO_printf(STDout, "%s", p);
+ }
+ BIO_printf(STDout, "\n");
+ } else { /* verbose */
+
+ sk = SSL_get_ciphers(ssl);
+
+ for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
+ SSL_CIPHER *c;
+
+ c = sk_SSL_CIPHER_value(sk, i);
+
+ if (Verbose) {
+ unsigned long id = SSL_CIPHER_get_id(c);
+ int id0 = (int)(id >> 24);
+ int id1 = (int)((id >> 16) & 0xffL);
+ int id2 = (int)((id >> 8) & 0xffL);
+ int id3 = (int)(id & 0xffL);
+
+ if ((id & 0xff000000L) == 0x02000000L) {
+ /* SSL2 cipher */
+ BIO_printf(STDout, " 0x%02X,0x%02X,0x%02X - ", id1,
+ id2, id3);
+ } else if ((id & 0xff000000L) == 0x03000000L) {
+ /* SSL3 cipher */
+ BIO_printf(STDout, " 0x%02X,0x%02X - ", id2,
+ id3);
+ } else {
+ /* whatever */
+ BIO_printf(STDout, "0x%02X,0x%02X,0x%02X,0x%02X - ", id0,
+ id1, id2, id3);
+ }
+ }
+
+ BIO_puts(STDout, SSL_CIPHER_description(c, buf, sizeof buf));
+ }
+ }
+
+ ret = 0;
+ if (0) {
+ err:
+ SSL_load_error_strings();
+ ERR_print_errors(bio_err);
+ }
+ end:
+ if (ctx != NULL)
+ SSL_CTX_free(ctx);
+ if (ssl != NULL)
+ SSL_free(ssl);
+ if (STDout != NULL)
+ BIO_free_all(STDout);
+ apps_shutdown();
+ OPENSSL_EXIT(ret);
+}
diff --git a/apps/cms.c b/apps/cms.c
index 5f77f8fbb03f..0cc4b46d8e28 100644
--- a/apps/cms.c
+++ b/apps/cms.c
@@ -1,5 +1,6 @@
/* apps/cms.c */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+/*
+ * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
* project.
*/
/* ====================================================================
@@ -10,7 +11,7 @@
* are met:
*
* 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
+ * notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
@@ -59,1339 +60,1162 @@
#ifndef OPENSSL_NO_CMS
-#include <openssl/crypto.h>
-#include <openssl/pem.h>
-#include <openssl/err.h>
-#include <openssl/x509_vfy.h>
-#include <openssl/x509v3.h>
-#include <openssl/cms.h>
+# include <openssl/crypto.h>
+# include <openssl/pem.h>
+# include <openssl/err.h>
+# include <openssl/x509_vfy.h>
+# include <openssl/x509v3.h>
+# include <openssl/cms.h>
-#undef PROG
-#define PROG cms_main
+# undef PROG
+# define PROG cms_main
static int save_certs(char *signerfile, STACK_OF(X509) *signers);
static int cms_cb(int ok, X509_STORE_CTX *ctx);
static void receipt_request_print(BIO *out, CMS_ContentInfo *cms);
-static CMS_ReceiptRequest *make_receipt_request(STACK_OF(OPENSSL_STRING) *rr_to,
- int rr_allorfirst,
- STACK_OF(OPENSSL_STRING) *rr_from);
-
-#define SMIME_OP 0x10
-#define SMIME_IP 0x20
-#define SMIME_SIGNERS 0x40
-#define SMIME_ENCRYPT (1 | SMIME_OP)
-#define SMIME_DECRYPT (2 | SMIME_IP)
-#define SMIME_SIGN (3 | SMIME_OP | SMIME_SIGNERS)
-#define SMIME_VERIFY (4 | SMIME_IP)
-#define SMIME_CMSOUT (5 | SMIME_IP | SMIME_OP)
-#define SMIME_RESIGN (6 | SMIME_IP | SMIME_OP | SMIME_SIGNERS)
-#define SMIME_DATAOUT (7 | SMIME_IP)
-#define SMIME_DATA_CREATE (8 | SMIME_OP)
-#define SMIME_DIGEST_VERIFY (9 | SMIME_IP)
-#define SMIME_DIGEST_CREATE (10 | SMIME_OP)
-#define SMIME_UNCOMPRESS (11 | SMIME_IP)
-#define SMIME_COMPRESS (12 | SMIME_OP)
-#define SMIME_ENCRYPTED_DECRYPT (13 | SMIME_IP)
-#define SMIME_ENCRYPTED_ENCRYPT (14 | SMIME_OP)
-#define SMIME_SIGN_RECEIPT (15 | SMIME_IP | SMIME_OP)
-#define SMIME_VERIFY_RECEIPT (16 | SMIME_IP)
+static CMS_ReceiptRequest *make_receipt_request(STACK_OF(OPENSSL_STRING)
+ *rr_to, int rr_allorfirst, STACK_OF(OPENSSL_STRING)
+ *rr_from);
+
+# define SMIME_OP 0x10
+# define SMIME_IP 0x20
+# define SMIME_SIGNERS 0x40
+# define SMIME_ENCRYPT (1 | SMIME_OP)
+# define SMIME_DECRYPT (2 | SMIME_IP)
+# define SMIME_SIGN (3 | SMIME_OP | SMIME_SIGNERS)
+# define SMIME_VERIFY (4 | SMIME_IP)
+# define SMIME_CMSOUT (5 | SMIME_IP | SMIME_OP)
+# define SMIME_RESIGN (6 | SMIME_IP | SMIME_OP | SMIME_SIGNERS)
+# define SMIME_DATAOUT (7 | SMIME_IP)
+# define SMIME_DATA_CREATE (8 | SMIME_OP)
+# define SMIME_DIGEST_VERIFY (9 | SMIME_IP)
+# define SMIME_DIGEST_CREATE (10 | SMIME_OP)
+# define SMIME_UNCOMPRESS (11 | SMIME_IP)
+# define SMIME_COMPRESS (12 | SMIME_OP)
+# define SMIME_ENCRYPTED_DECRYPT (13 | SMIME_IP)
+# define SMIME_ENCRYPTED_ENCRYPT (14 | SMIME_OP)
+# define SMIME_SIGN_RECEIPT (15 | SMIME_IP | SMIME_OP)
+# define SMIME_VERIFY_RECEIPT (16 | SMIME_IP)
int verify_err = 0;
int MAIN(int, char **);
int MAIN(int argc, char **argv)
- {
- ENGINE *e = NULL;
- int operation = 0;
- int ret = 0;
- char **args;
- const char *inmode = "r", *outmode = "w";
- char *infile = NULL, *outfile = NULL, *rctfile = NULL;
- char *signerfile = NULL, *recipfile = NULL;
- STACK_OF(OPENSSL_STRING) *sksigners = NULL, *skkeys = NULL;
- char *certfile = NULL, *keyfile = NULL, *contfile=NULL;
- char *certsoutfile = NULL;
- const EVP_CIPHER *cipher = NULL;
- CMS_ContentInfo *cms = NULL, *rcms = NULL;
- X509_STORE *store = NULL;
- X509 *cert = NULL, *recip = NULL, *signer = NULL;
- EVP_PKEY *key = NULL;
- STACK_OF(X509) *encerts = NULL, *other = NULL;
- BIO *in = NULL, *out = NULL, *indata = NULL, *rctin = NULL;
- int badarg = 0;
- int flags = CMS_DETACHED, noout = 0, print = 0;
- int verify_retcode = 0;
- int rr_print = 0, rr_allorfirst = -1;
- STACK_OF(OPENSSL_STRING) *rr_to = NULL, *rr_from = NULL;
- CMS_ReceiptRequest *rr = NULL;
- char *to = NULL, *from = NULL, *subject = NULL;
- char *CAfile = NULL, *CApath = NULL;
- char *passargin = NULL, *passin = NULL;
- char *inrand = NULL;
- int need_rand = 0;
- const EVP_MD *sign_md = NULL;
- int informat = FORMAT_SMIME, outformat = FORMAT_SMIME;
- int rctformat = FORMAT_SMIME, keyform = FORMAT_PEM;
-#ifndef OPENSSL_NO_ENGINE
- char *engine=NULL;
-#endif
- unsigned char *secret_key = NULL, *secret_keyid = NULL;
- unsigned char *pwri_pass = NULL, *pwri_tmp = NULL;
- size_t secret_keylen = 0, secret_keyidlen = 0;
-
- ASN1_OBJECT *econtent_type = NULL;
-
- X509_VERIFY_PARAM *vpm = NULL;
-
- args = argv + 1;
- ret = 1;
-
- apps_startup();
-
- if (bio_err == NULL)
- {
- if ((bio_err = BIO_new(BIO_s_file())) != NULL)
- BIO_set_fp(bio_err, stderr, BIO_NOCLOSE|BIO_FP_TEXT);
- }
-
- if (!load_config(bio_err, NULL))
- goto end;
-
- while (!badarg && *args && *args[0] == '-')
- {
- if (!strcmp (*args, "-encrypt"))
- operation = SMIME_ENCRYPT;
- else if (!strcmp (*args, "-decrypt"))
- operation = SMIME_DECRYPT;
- else if (!strcmp (*args, "-sign"))
- operation = SMIME_SIGN;
- else if (!strcmp (*args, "-sign_receipt"))
- operation = SMIME_SIGN_RECEIPT;
- else if (!strcmp (*args, "-resign"))
- operation = SMIME_RESIGN;
- else if (!strcmp (*args, "-verify"))
- operation = SMIME_VERIFY;
- else if (!strcmp (*args, "-verify_retcode"))
- verify_retcode = 1;
- else if (!strcmp(*args,"-verify_receipt"))
- {
- operation = SMIME_VERIFY_RECEIPT;
- if (!args[1])
- goto argerr;
- args++;
- rctfile = *args;
- }
- else if (!strcmp (*args, "-cmsout"))
- operation = SMIME_CMSOUT;
- else if (!strcmp (*args, "-data_out"))
- operation = SMIME_DATAOUT;
- else if (!strcmp (*args, "-data_create"))
- operation = SMIME_DATA_CREATE;
- else if (!strcmp (*args, "-digest_verify"))
- operation = SMIME_DIGEST_VERIFY;
- else if (!strcmp (*args, "-digest_create"))
- operation = SMIME_DIGEST_CREATE;
- else if (!strcmp (*args, "-compress"))
- operation = SMIME_COMPRESS;
- else if (!strcmp (*args, "-uncompress"))
- operation = SMIME_UNCOMPRESS;
- else if (!strcmp (*args, "-EncryptedData_decrypt"))
- operation = SMIME_ENCRYPTED_DECRYPT;
- else if (!strcmp (*args, "-EncryptedData_encrypt"))
- operation = SMIME_ENCRYPTED_ENCRYPT;
-#ifndef OPENSSL_NO_DES
- else if (!strcmp (*args, "-des3"))
- cipher = EVP_des_ede3_cbc();
- else if (!strcmp (*args, "-des"))
- cipher = EVP_des_cbc();
-#endif
-#ifndef OPENSSL_NO_SEED
- else if (!strcmp (*args, "-seed"))
- cipher = EVP_seed_cbc();
-#endif
-#ifndef OPENSSL_NO_RC2
- else if (!strcmp (*args, "-rc2-40"))
- cipher = EVP_rc2_40_cbc();
- else if (!strcmp (*args, "-rc2-128"))
- cipher = EVP_rc2_cbc();
- else if (!strcmp (*args, "-rc2-64"))
- cipher = EVP_rc2_64_cbc();
-#endif
-#ifndef OPENSSL_NO_AES
- else if (!strcmp(*args,"-aes128"))
- cipher = EVP_aes_128_cbc();
- else if (!strcmp(*args,"-aes192"))
- cipher = EVP_aes_192_cbc();
- else if (!strcmp(*args,"-aes256"))
- cipher = EVP_aes_256_cbc();
-#endif
-#ifndef OPENSSL_NO_CAMELLIA
- else if (!strcmp(*args,"-camellia128"))
- cipher = EVP_camellia_128_cbc();
- else if (!strcmp(*args,"-camellia192"))
- cipher = EVP_camellia_192_cbc();
- else if (!strcmp(*args,"-camellia256"))
- cipher = EVP_camellia_256_cbc();
-#endif
- else if (!strcmp (*args, "-debug_decrypt"))
- flags |= CMS_DEBUG_DECRYPT;
- else if (!strcmp (*args, "-text"))
- flags |= CMS_TEXT;
- else if (!strcmp (*args, "-nointern"))
- flags |= CMS_NOINTERN;
- else if (!strcmp (*args, "-noverify")
- || !strcmp (*args, "-no_signer_cert_verify"))
- flags |= CMS_NO_SIGNER_CERT_VERIFY;
- else if (!strcmp (*args, "-nocerts"))
- flags |= CMS_NOCERTS;
- else if (!strcmp (*args, "-noattr"))
- flags |= CMS_NOATTR;
- else if (!strcmp (*args, "-nodetach"))
- flags &= ~CMS_DETACHED;
- else if (!strcmp (*args, "-nosmimecap"))
- flags |= CMS_NOSMIMECAP;
- else if (!strcmp (*args, "-binary"))
- flags |= CMS_BINARY;
- else if (!strcmp (*args, "-keyid"))
- flags |= CMS_USE_KEYID;
- else if (!strcmp (*args, "-nosigs"))
- flags |= CMS_NOSIGS;
- else if (!strcmp (*args, "-no_content_verify"))
- flags |= CMS_NO_CONTENT_VERIFY;
- else if (!strcmp (*args, "-no_attr_verify"))
- flags |= CMS_NO_ATTR_VERIFY;
- else if (!strcmp (*args, "-stream"))
- flags |= CMS_STREAM;
- else if (!strcmp (*args, "-indef"))
- flags |= CMS_STREAM;
- else if (!strcmp (*args, "-noindef"))
- flags &= ~CMS_STREAM;
- else if (!strcmp (*args, "-nooldmime"))
- flags |= CMS_NOOLDMIMETYPE;
- else if (!strcmp (*args, "-crlfeol"))
- flags |= CMS_CRLFEOL;
- else if (!strcmp (*args, "-noout"))
- noout = 1;
- else if (!strcmp (*args, "-receipt_request_print"))
- rr_print = 1;
- else if (!strcmp (*args, "-receipt_request_all"))
- rr_allorfirst = 0;
- else if (!strcmp (*args, "-receipt_request_first"))
- rr_allorfirst = 1;
- else if (!strcmp(*args,"-receipt_request_from"))
- {
- if (!args[1])
- goto argerr;
- args++;
- if (!rr_from)
- rr_from = sk_OPENSSL_STRING_new_null();
- sk_OPENSSL_STRING_push(rr_from, *args);
- }
- else if (!strcmp(*args,"-receipt_request_to"))
- {
- if (!args[1])
- goto argerr;
- args++;
- if (!rr_to)
- rr_to = sk_OPENSSL_STRING_new_null();
- sk_OPENSSL_STRING_push(rr_to, *args);
- }
- else if (!strcmp (*args, "-print"))
- {
- noout = 1;
- print = 1;
- }
- else if (!strcmp(*args,"-secretkey"))
- {
- long ltmp;
- if (!args[1])
- goto argerr;
- args++;
- secret_key = string_to_hex(*args, &ltmp);
- if (!secret_key)
- {
- BIO_printf(bio_err, "Invalid key %s\n", *args);
- goto argerr;
- }
- secret_keylen = (size_t)ltmp;
- }
- else if (!strcmp(*args,"-secretkeyid"))
- {
- long ltmp;
- if (!args[1])
- goto argerr;
- args++;
- secret_keyid = string_to_hex(*args, &ltmp);
- if (!secret_keyid)
- {
- BIO_printf(bio_err, "Invalid id %s\n", *args);
- goto argerr;
- }
- secret_keyidlen = (size_t)ltmp;
- }
- else if (!strcmp(*args,"-pwri_password"))
- {
- if (!args[1])
- goto argerr;
- args++;
- pwri_pass = (unsigned char *)*args;
- }
- else if (!strcmp(*args,"-econtent_type"))
- {
- if (!args[1])
- goto argerr;
- args++;
- econtent_type = OBJ_txt2obj(*args, 0);
- if (!econtent_type)
- {
- BIO_printf(bio_err, "Invalid OID %s\n", *args);
- goto argerr;
- }
- }
- else if (!strcmp(*args,"-rand"))
- {
- if (!args[1])
- goto argerr;
- args++;
- inrand = *args;
- need_rand = 1;
- }
-#ifndef OPENSSL_NO_ENGINE
- else if (!strcmp(*args,"-engine"))
- {
- if (!args[1])
- goto argerr;
- engine = *++args;
- }
-#endif
- else if (!strcmp(*args,"-passin"))
- {
- if (!args[1])
- goto argerr;
- passargin = *++args;
- }
- else if (!strcmp (*args, "-to"))
- {
- if (!args[1])
- goto argerr;
- to = *++args;
- }
- else if (!strcmp (*args, "-from"))
- {
- if (!args[1])
- goto argerr;
- from = *++args;
- }
- else if (!strcmp (*args, "-subject"))
- {
- if (!args[1])
- goto argerr;
- subject = *++args;
- }
- else if (!strcmp (*args, "-signer"))
- {
- if (!args[1])
- goto argerr;
- /* If previous -signer argument add signer to list */
-
- if (signerfile)
- {
- if (!sksigners)
- sksigners = sk_OPENSSL_STRING_new_null();
- sk_OPENSSL_STRING_push(sksigners, signerfile);
- if (!keyfile)
- keyfile = signerfile;
- if (!skkeys)
- skkeys = sk_OPENSSL_STRING_new_null();
- sk_OPENSSL_STRING_push(skkeys, keyfile);
- keyfile = NULL;
- }
- signerfile = *++args;
- }
- else if (!strcmp (*args, "-recip"))
- {
- if (!args[1])
- goto argerr;
- recipfile = *++args;
- }
- else if (!strcmp (*args, "-certsout"))
- {
- if (!args[1])
- goto argerr;
- certsoutfile = *++args;
- }
- else if (!strcmp (*args, "-md"))
- {
- if (!args[1])
- goto argerr;
- sign_md = EVP_get_digestbyname(*++args);
- if (sign_md == NULL)
- {
- BIO_printf(bio_err, "Unknown digest %s\n",
- *args);
- goto argerr;
- }
- }
- else if (!strcmp (*args, "-inkey"))
- {
- if (!args[1])
- goto argerr;
- /* If previous -inkey arument add signer to list */
- if (keyfile)
- {
- if (!signerfile)
- {
- BIO_puts(bio_err, "Illegal -inkey without -signer\n");
- goto argerr;
- }
- if (!sksigners)
- sksigners = sk_OPENSSL_STRING_new_null();
- sk_OPENSSL_STRING_push(sksigners, signerfile);
- signerfile = NULL;
- if (!skkeys)
- skkeys = sk_OPENSSL_STRING_new_null();
- sk_OPENSSL_STRING_push(skkeys, keyfile);
- }
- keyfile = *++args;
- }
- else if (!strcmp (*args, "-keyform"))
- {
- if (!args[1])
- goto argerr;
- keyform = str2fmt(*++args);
- }
- else if (!strcmp (*args, "-rctform"))
- {
- if (!args[1])
- goto argerr;
- rctformat = str2fmt(*++args);
- }
- else if (!strcmp (*args, "-certfile"))
- {
- if (!args[1])
- goto argerr;
- certfile = *++args;
- }
- else if (!strcmp (*args, "-CAfile"))
- {
- if (!args[1])
- goto argerr;
- CAfile = *++args;
- }
- else if (!strcmp (*args, "-CApath"))
- {
- if (!args[1])
- goto argerr;
- CApath = *++args;
- }
- else if (!strcmp (*args, "-in"))
- {
- if (!args[1])
- goto argerr;
- infile = *++args;
- }
- else if (!strcmp (*args, "-inform"))
- {
- if (!args[1])
- goto argerr;
- informat = str2fmt(*++args);
- }
- else if (!strcmp (*args, "-outform"))
- {
- if (!args[1])
- goto argerr;
- outformat = str2fmt(*++args);
- }
- else if (!strcmp (*args, "-out"))
- {
- if (!args[1])
- goto argerr;
- outfile = *++args;
- }
- else if (!strcmp (*args, "-content"))
- {
- if (!args[1])
- goto argerr;
- contfile = *++args;
- }
- else if (args_verify(&args, NULL, &badarg, bio_err, &vpm))
- continue;
- else if ((cipher = EVP_get_cipherbyname(*args + 1)) == NULL)
- badarg = 1;
- args++;
- }
-
- if (((rr_allorfirst != -1) || rr_from) && !rr_to)
- {
- BIO_puts(bio_err, "No Signed Receipts Recipients\n");
- goto argerr;
- }
-
- if (!(operation & SMIME_SIGNERS) && (rr_to || rr_from))
- {
- BIO_puts(bio_err, "Signed receipts only allowed with -sign\n");
- goto argerr;
- }
- if (!(operation & SMIME_SIGNERS) && (skkeys || sksigners))
- {
- BIO_puts(bio_err, "Multiple signers or keys not allowed\n");
- goto argerr;
- }
-
- if (operation & SMIME_SIGNERS)
- {
- if (keyfile && !signerfile)
- {
- BIO_puts(bio_err, "Illegal -inkey without -signer\n");
- goto argerr;
- }
- /* Check to see if any final signer needs to be appended */
- if (signerfile)
- {
- if (!sksigners)
- sksigners = sk_OPENSSL_STRING_new_null();
- sk_OPENSSL_STRING_push(sksigners, signerfile);
- if (!skkeys)
- skkeys = sk_OPENSSL_STRING_new_null();
- if (!keyfile)
- keyfile = signerfile;
- sk_OPENSSL_STRING_push(skkeys, keyfile);
- }
- if (!sksigners)
- {
- BIO_printf(bio_err, "No signer certificate specified\n");
- badarg = 1;
- }
- signerfile = NULL;
- keyfile = NULL;
- need_rand = 1;
- }
-
- else if (operation == SMIME_DECRYPT)
- {
- if (!recipfile && !keyfile && !secret_key && !pwri_pass)
- {
- BIO_printf(bio_err, "No recipient certificate or key specified\n");
- badarg = 1;
- }
- }
- else if (operation == SMIME_ENCRYPT)
- {
- if (!*args && !secret_key && !pwri_pass)
- {
- BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n");
- badarg = 1;
- }
- need_rand = 1;
- }
- else if (!operation)
- badarg = 1;
-
- if (badarg)
- {
- argerr:
- BIO_printf (bio_err, "Usage cms [options] cert.pem ...\n");
- BIO_printf (bio_err, "where options are\n");
- BIO_printf (bio_err, "-encrypt encrypt message\n");
- BIO_printf (bio_err, "-decrypt decrypt encrypted message\n");
- BIO_printf (bio_err, "-sign sign message\n");
- BIO_printf (bio_err, "-verify verify signed message\n");
- BIO_printf (bio_err, "-cmsout output CMS structure\n");
-#ifndef OPENSSL_NO_DES
- BIO_printf (bio_err, "-des3 encrypt with triple DES\n");
- BIO_printf (bio_err, "-des encrypt with DES\n");
-#endif
-#ifndef OPENSSL_NO_SEED
- BIO_printf (bio_err, "-seed encrypt with SEED\n");
-#endif
-#ifndef OPENSSL_NO_RC2
- BIO_printf (bio_err, "-rc2-40 encrypt with RC2-40 (default)\n");
- BIO_printf (bio_err, "-rc2-64 encrypt with RC2-64\n");
- BIO_printf (bio_err, "-rc2-128 encrypt with RC2-128\n");
-#endif
-#ifndef OPENSSL_NO_AES
- BIO_printf (bio_err, "-aes128, -aes192, -aes256\n");
- BIO_printf (bio_err, " encrypt PEM output with cbc aes\n");
-#endif
-#ifndef OPENSSL_NO_CAMELLIA
- BIO_printf (bio_err, "-camellia128, -camellia192, -camellia256\n");
- BIO_printf (bio_err, " encrypt PEM output with cbc camellia\n");
-#endif
- BIO_printf (bio_err, "-nointern don't search certificates in message for signer\n");
- BIO_printf (bio_err, "-nosigs don't verify message signature\n");
- BIO_printf (bio_err, "-noverify don't verify signers certificate\n");
- BIO_printf (bio_err, "-nocerts don't include signers certificate when signing\n");
- BIO_printf (bio_err, "-nodetach use opaque signing\n");
- BIO_printf (bio_err, "-noattr don't include any signed attributes\n");
- BIO_printf (bio_err, "-binary don't translate message to text\n");
- BIO_printf (bio_err, "-certfile file other certificates file\n");
- BIO_printf (bio_err, "-certsout file certificate output file\n");
- BIO_printf (bio_err, "-signer file signer certificate file\n");
- BIO_printf (bio_err, "-recip file recipient certificate file for decryption\n");
- BIO_printf (bio_err, "-keyid use subject key identifier\n");
- BIO_printf (bio_err, "-in file input file\n");
- BIO_printf (bio_err, "-inform arg input format SMIME (default), PEM or DER\n");
- BIO_printf (bio_err, "-inkey file input private key (if not signer or recipient)\n");
- BIO_printf (bio_err, "-keyform arg input private key format (PEM or ENGINE)\n");
- BIO_printf (bio_err, "-out file output file\n");
- BIO_printf (bio_err, "-outform arg output format SMIME (default), PEM or DER\n");
- BIO_printf (bio_err, "-content file supply or override content for detached signature\n");
- BIO_printf (bio_err, "-to addr to address\n");
- BIO_printf (bio_err, "-from ad from address\n");
- BIO_printf (bio_err, "-subject s subject\n");
- BIO_printf (bio_err, "-text include or delete text MIME headers\n");
- BIO_printf (bio_err, "-CApath dir trusted certificates directory\n");
- BIO_printf (bio_err, "-CAfile file trusted certificates file\n");
- BIO_printf (bio_err, "-crl_check check revocation status of signer's certificate using CRLs\n");
- BIO_printf (bio_err, "-crl_check_all check revocation status of signer's certificate chain using CRLs\n");
-#ifndef OPENSSL_NO_ENGINE
- BIO_printf (bio_err, "-engine e use engine e, possibly a hardware device.\n");
-#endif
- BIO_printf (bio_err, "-passin arg input file pass phrase source\n");
- BIO_printf(bio_err, "-rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
- BIO_printf(bio_err, " load the file (or the files in the directory) into\n");
- BIO_printf(bio_err, " the random number generator\n");
- BIO_printf (bio_err, "cert.pem recipient certificate(s) for encryption\n");
- goto end;
- }
-
-#ifndef OPENSSL_NO_ENGINE
- e = setup_engine(bio_err, engine, 0);
-#endif
-
- if (!app_passwd(bio_err, passargin, NULL, &passin, NULL))
- {
- BIO_printf(bio_err, "Error getting password\n");
- goto end;
- }
-
- if (need_rand)
- {
- app_RAND_load_file(NULL, bio_err, (inrand != NULL));
- if (inrand != NULL)
- BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
- app_RAND_load_files(inrand));
- }
-
- ret = 2;
-
- if (!(operation & SMIME_SIGNERS))
- flags &= ~CMS_DETACHED;
-
- if (operation & SMIME_OP)
- {
- if (outformat == FORMAT_ASN1)
- outmode = "wb";
- }
- else
- {
- if (flags & CMS_BINARY)
- outmode = "wb";
- }
-
- if (operation & SMIME_IP)
- {
- if (informat == FORMAT_ASN1)
- inmode = "rb";
- }
- else
- {
- if (flags & CMS_BINARY)
- inmode = "rb";
- }
-
- if (operation == SMIME_ENCRYPT)
- {
- if (!cipher)
- {
-#ifndef OPENSSL_NO_DES
- cipher = EVP_des_ede3_cbc();
-#else
- BIO_printf(bio_err, "No cipher selected\n");
- goto end;
-#endif
- }
-
- if (secret_key && !secret_keyid)
- {
- BIO_printf(bio_err, "No secret key id\n");
- goto end;
- }
-
- if (*args)
- encerts = sk_X509_new_null();
- while (*args)
- {
- if (!(cert = load_cert(bio_err,*args,FORMAT_PEM,
- NULL, e, "recipient certificate file")))
- goto end;
- sk_X509_push(encerts, cert);
- cert = NULL;
- args++;
- }
- }
-
- if (certfile)
- {
- if (!(other = load_certs(bio_err,certfile,FORMAT_PEM, NULL,
- e, "certificate file")))
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-
- if (recipfile && (operation == SMIME_DECRYPT))
- {
- if (!(recip = load_cert(bio_err,recipfile,FORMAT_PEM,NULL,
- e, "recipient certificate file")))
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-
- if (operation == SMIME_SIGN_RECEIPT)
- {
- if (!(signer = load_cert(bio_err,signerfile,FORMAT_PEM,NULL,
- e, "receipt signer certificate file")))
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-
- if (operation == SMIME_DECRYPT)
- {
- if (!keyfile)
- keyfile = recipfile;
- }
- else if ((operation == SMIME_SIGN) || (operation == SMIME_SIGN_RECEIPT))
- {
- if (!keyfile)
- keyfile = signerfile;
- }
- else keyfile = NULL;
-
- if (keyfile)
- {
- key = load_key(bio_err, keyfile, keyform, 0, passin, e,
- "signing key file");
- if (!key)
- goto end;
- }
-
- if (infile)
- {
- if (!(in = BIO_new_file(infile, inmode)))
- {
- BIO_printf (bio_err,
- "Can't open input file %s\n", infile);
- goto end;
- }
- }
- else
- in = BIO_new_fp(stdin, BIO_NOCLOSE);
-
- if (operation & SMIME_IP)
- {
- if (informat == FORMAT_SMIME)
- cms = SMIME_read_CMS(in, &indata);
- else if (informat == FORMAT_PEM)
- cms = PEM_read_bio_CMS(in, NULL, NULL, NULL);
- else if (informat == FORMAT_ASN1)
- cms = d2i_CMS_bio(in, NULL);
- else
- {
- BIO_printf(bio_err, "Bad input format for CMS file\n");
- goto end;
- }
-
- if (!cms)
- {
- BIO_printf(bio_err, "Error reading S/MIME message\n");
- goto end;
- }
- if (contfile)
- {
- BIO_free(indata);
- if (!(indata = BIO_new_file(contfile, "rb")))
- {
- BIO_printf(bio_err, "Can't read content file %s\n", contfile);
- goto end;
- }
- }
- if (certsoutfile)
- {
- STACK_OF(X509) *allcerts;
- allcerts = CMS_get1_certs(cms);
- if (!save_certs(certsoutfile, allcerts))
- {
- BIO_printf(bio_err,
- "Error writing certs to %s\n",
- certsoutfile);
- ret = 5;
- goto end;
- }
- sk_X509_pop_free(allcerts, X509_free);
- }
- }
-
- if (rctfile)
- {
- char *rctmode = (rctformat == FORMAT_ASN1) ? "rb" : "r";
- if (!(rctin = BIO_new_file(rctfile, rctmode)))
- {
- BIO_printf (bio_err,
- "Can't open receipt file %s\n", rctfile);
- goto end;
- }
-
- if (rctformat == FORMAT_SMIME)
- rcms = SMIME_read_CMS(rctin, NULL);
- else if (rctformat == FORMAT_PEM)
- rcms = PEM_read_bio_CMS(rctin, NULL, NULL, NULL);
- else if (rctformat == FORMAT_ASN1)
- rcms = d2i_CMS_bio(rctin, NULL);
- else
- {
- BIO_printf(bio_err, "Bad input format for receipt\n");
- goto end;
- }
-
- if (!rcms)
- {
- BIO_printf(bio_err, "Error reading receipt\n");
- goto end;
- }
- }
-
- if (outfile)
- {
- if (!(out = BIO_new_file(outfile, outmode)))
- {
- BIO_printf (bio_err,
- "Can't open output file %s\n", outfile);
- goto end;
- }
- }
- else
- {
- out = BIO_new_fp(stdout, BIO_NOCLOSE);
-#ifdef OPENSSL_SYS_VMS
- {
- BIO *tmpbio = BIO_new(BIO_f_linebuffer());
- out = BIO_push(tmpbio, out);
- }
-#endif
- }
-
- if ((operation == SMIME_VERIFY) || (operation == SMIME_VERIFY_RECEIPT))
- {
- if (!(store = setup_verify(bio_err, CAfile, CApath)))
- goto end;
- X509_STORE_set_verify_cb(store, cms_cb);
- if (vpm)
- X509_STORE_set1_param(store, vpm);
- }
-
-
- ret = 3;
-
- if (operation == SMIME_DATA_CREATE)
- {
- cms = CMS_data_create(in, flags);
- }
- else if (operation == SMIME_DIGEST_CREATE)
- {
- cms = CMS_digest_create(in, sign_md, flags);
- }
- else if (operation == SMIME_COMPRESS)
- {
- cms = CMS_compress(in, -1, flags);
- }
- else if (operation == SMIME_ENCRYPT)
- {
- flags |= CMS_PARTIAL;
- cms = CMS_encrypt(encerts, in, cipher, flags);
- if (!cms)
- goto end;
- if (secret_key)
- {
- if (!CMS_add0_recipient_key(cms, NID_undef,
- secret_key, secret_keylen,
- secret_keyid, secret_keyidlen,
- NULL, NULL, NULL))
- goto end;
- /* NULL these because call absorbs them */
- secret_key = NULL;
- secret_keyid = NULL;
- }
- if (pwri_pass)
- {
- pwri_tmp = (unsigned char *)BUF_strdup((char *)pwri_pass);
- if (!pwri_tmp)
- goto end;
- if (!CMS_add0_recipient_password(cms,
- -1, NID_undef, NID_undef,
- pwri_tmp, -1, NULL))
- goto end;
- pwri_tmp = NULL;
- }
- if (!(flags & CMS_STREAM))
- {
- if (!CMS_final(cms, in, NULL, flags))
- goto end;
- }
- }
- else if (operation == SMIME_ENCRYPTED_ENCRYPT)
- {
- cms = CMS_EncryptedData_encrypt(in, cipher,
- secret_key, secret_keylen,
- flags);
-
- }
- else if (operation == SMIME_SIGN_RECEIPT)
- {
- CMS_ContentInfo *srcms = NULL;
- STACK_OF(CMS_SignerInfo) *sis;
- CMS_SignerInfo *si;
- sis = CMS_get0_SignerInfos(cms);
- if (!sis)
- goto end;
- si = sk_CMS_SignerInfo_value(sis, 0);
- srcms = CMS_sign_receipt(si, signer, key, other, flags);
- if (!srcms)
- goto end;
- CMS_ContentInfo_free(cms);
- cms = srcms;
- }
- else if (operation & SMIME_SIGNERS)
- {
- int i;
- /* If detached data content we enable streaming if
- * S/MIME output format.
- */
- if (operation == SMIME_SIGN)
- {
-
- if (flags & CMS_DETACHED)
- {
- if (outformat == FORMAT_SMIME)
- flags |= CMS_STREAM;
- }
- flags |= CMS_PARTIAL;
- cms = CMS_sign(NULL, NULL, other, in, flags);
- if (!cms)
- goto end;
- if (econtent_type)
- CMS_set1_eContentType(cms, econtent_type);
-
- if (rr_to)
- {
- rr = make_receipt_request(rr_to, rr_allorfirst,
- rr_from);
- if (!rr)
- {
- BIO_puts(bio_err,
- "Signed Receipt Request Creation Error\n");
- goto end;
- }
- }
- }
- else
- flags |= CMS_REUSE_DIGEST;
- for (i = 0; i < sk_OPENSSL_STRING_num(sksigners); i++)
- {
- CMS_SignerInfo *si;
- signerfile = sk_OPENSSL_STRING_value(sksigners, i);
- keyfile = sk_OPENSSL_STRING_value(skkeys, i);
- signer = load_cert(bio_err, signerfile,FORMAT_PEM, NULL,
- e, "signer certificate");
- if (!signer)
- goto end;
- key = load_key(bio_err, keyfile, keyform, 0, passin, e,
- "signing key file");
- if (!key)
- goto end;
- si = CMS_add1_signer(cms, signer, key, sign_md, flags);
- if (!si)
- goto end;
- if (rr && !CMS_add1_ReceiptRequest(si, rr))
- goto end;
- X509_free(signer);
- signer = NULL;
- EVP_PKEY_free(key);
- key = NULL;
- }
- /* If not streaming or resigning finalize structure */
- if ((operation == SMIME_SIGN) && !(flags & CMS_STREAM))
- {
- if (!CMS_final(cms, in, NULL, flags))
- goto end;
- }
- }
-
- if (!cms)
- {
- BIO_printf(bio_err, "Error creating CMS structure\n");
- goto end;
- }
-
- ret = 4;
- if (operation == SMIME_DECRYPT)
- {
- if (flags & CMS_DEBUG_DECRYPT)
- CMS_decrypt(cms, NULL, NULL, NULL, NULL, flags);
-
- if (secret_key)
- {
- if (!CMS_decrypt_set1_key(cms,
- secret_key, secret_keylen,
- secret_keyid, secret_keyidlen))
- {
- BIO_puts(bio_err,
- "Error decrypting CMS using secret key\n");
- goto end;
- }
- }
-
- if (key)
- {
- if (!CMS_decrypt_set1_pkey(cms, key, recip))
- {
- BIO_puts(bio_err,
- "Error decrypting CMS using private key\n");
- goto end;
- }
- }
-
- if (pwri_pass)
- {
- if (!CMS_decrypt_set1_password(cms, pwri_pass, -1))
- {
- BIO_puts(bio_err,
- "Error decrypting CMS using password\n");
- goto end;
- }
- }
-
- if (!CMS_decrypt(cms, NULL, NULL, indata, out, flags))
- {
- BIO_printf(bio_err, "Error decrypting CMS structure\n");
- goto end;
- }
- }
- else if (operation == SMIME_DATAOUT)
- {
- if (!CMS_data(cms, out, flags))
- goto end;
- }
- else if (operation == SMIME_UNCOMPRESS)
- {
- if (!CMS_uncompress(cms, indata, out, flags))
- goto end;
- }
- else if (operation == SMIME_DIGEST_VERIFY)
- {
- if (CMS_digest_verify(cms, indata, out, flags) > 0)
- BIO_printf(bio_err, "Verification successful\n");
- else
- {
- BIO_printf(bio_err, "Verification failure\n");
- goto end;
- }
- }
- else if (operation == SMIME_ENCRYPTED_DECRYPT)
- {
- if (!CMS_EncryptedData_decrypt(cms, secret_key, secret_keylen,
- indata, out, flags))
- goto end;
- }
- else if (operation == SMIME_VERIFY)
- {
- if (CMS_verify(cms, other, store, indata, out, flags) > 0)
- BIO_printf(bio_err, "Verification successful\n");
- else
- {
- BIO_printf(bio_err, "Verification failure\n");
- if (verify_retcode)
- ret = verify_err + 32;
- goto end;
- }
- if (signerfile)
- {
- STACK_OF(X509) *signers;
- signers = CMS_get0_signers(cms);
- if (!save_certs(signerfile, signers))
- {
- BIO_printf(bio_err,
- "Error writing signers to %s\n",
- signerfile);
- ret = 5;
- goto end;
- }
- sk_X509_free(signers);
- }
- if (rr_print)
- receipt_request_print(bio_err, cms);
-
- }
- else if (operation == SMIME_VERIFY_RECEIPT)
- {
- if (CMS_verify_receipt(rcms, cms, other, store, flags) > 0)
- BIO_printf(bio_err, "Verification successful\n");
- else
- {
- BIO_printf(bio_err, "Verification failure\n");
- goto end;
- }
- }
- else
- {
- if (noout)
- {
- if (print)
- CMS_ContentInfo_print_ctx(out, cms, 0, NULL);
- }
- else if (outformat == FORMAT_SMIME)
- {
- if (to)
- BIO_printf(out, "To: %s\n", to);
- if (from)
- BIO_printf(out, "From: %s\n", from);
- if (subject)
- BIO_printf(out, "Subject: %s\n", subject);
- if (operation == SMIME_RESIGN)
- ret = SMIME_write_CMS(out, cms, indata, flags);
- else
- ret = SMIME_write_CMS(out, cms, in, flags);
- }
- else if (outformat == FORMAT_PEM)
- ret = PEM_write_bio_CMS_stream(out, cms, in, flags);
- else if (outformat == FORMAT_ASN1)
- ret = i2d_CMS_bio_stream(out,cms, in, flags);
- else
- {
- BIO_printf(bio_err, "Bad output format for CMS file\n");
- goto end;
- }
- if (ret <= 0)
- {
- ret = 6;
- goto end;
- }
- }
- ret = 0;
-end:
- if (ret)
- ERR_print_errors(bio_err);
- if (need_rand)
- app_RAND_write_file(NULL, bio_err);
- sk_X509_pop_free(encerts, X509_free);
- sk_X509_pop_free(other, X509_free);
- if (vpm)
- X509_VERIFY_PARAM_free(vpm);
- if (sksigners)
- sk_OPENSSL_STRING_free(sksigners);
- if (skkeys)
- sk_OPENSSL_STRING_free(skkeys);
- if (secret_key)
- OPENSSL_free(secret_key);
- if (secret_keyid)
- OPENSSL_free(secret_keyid);
- if (pwri_tmp)
- OPENSSL_free(pwri_tmp);
- if (econtent_type)
- ASN1_OBJECT_free(econtent_type);
- if (rr)
- CMS_ReceiptRequest_free(rr);
- if (rr_to)
- sk_OPENSSL_STRING_free(rr_to);
- if (rr_from)
- sk_OPENSSL_STRING_free(rr_from);
- X509_STORE_free(store);
- X509_free(cert);
- X509_free(recip);
- X509_free(signer);
- EVP_PKEY_free(key);
- CMS_ContentInfo_free(cms);
- CMS_ContentInfo_free(rcms);
- BIO_free(rctin);
- BIO_free(in);
- BIO_free(indata);
- BIO_free_all(out);
- if (passin) OPENSSL_free(passin);
- return (ret);
+{
+ ENGINE *e = NULL;
+ int operation = 0;
+ int ret = 0;
+ char **args;
+ const char *inmode = "r", *outmode = "w";
+ char *infile = NULL, *outfile = NULL, *rctfile = NULL;
+ char *signerfile = NULL, *recipfile = NULL;
+ STACK_OF(OPENSSL_STRING) *sksigners = NULL, *skkeys = NULL;
+ char *certfile = NULL, *keyfile = NULL, *contfile = NULL;
+ char *certsoutfile = NULL;
+ const EVP_CIPHER *cipher = NULL;
+ CMS_ContentInfo *cms = NULL, *rcms = NULL;
+ X509_STORE *store = NULL;
+ X509 *cert = NULL, *recip = NULL, *signer = NULL;
+ EVP_PKEY *key = NULL;
+ STACK_OF(X509) *encerts = NULL, *other = NULL;
+ BIO *in = NULL, *out = NULL, *indata = NULL, *rctin = NULL;
+ int badarg = 0;
+ int flags = CMS_DETACHED, noout = 0, print = 0;
+ int verify_retcode = 0;
+ int rr_print = 0, rr_allorfirst = -1;
+ STACK_OF(OPENSSL_STRING) *rr_to = NULL, *rr_from = NULL;
+ CMS_ReceiptRequest *rr = NULL;
+ char *to = NULL, *from = NULL, *subject = NULL;
+ char *CAfile = NULL, *CApath = NULL;
+ char *passargin = NULL, *passin = NULL;
+ char *inrand = NULL;
+ int need_rand = 0;
+ const EVP_MD *sign_md = NULL;
+ int informat = FORMAT_SMIME, outformat = FORMAT_SMIME;
+ int rctformat = FORMAT_SMIME, keyform = FORMAT_PEM;
+# ifndef OPENSSL_NO_ENGINE
+ char *engine = NULL;
+# endif
+ unsigned char *secret_key = NULL, *secret_keyid = NULL;
+ unsigned char *pwri_pass = NULL, *pwri_tmp = NULL;
+ size_t secret_keylen = 0, secret_keyidlen = 0;
+
+ ASN1_OBJECT *econtent_type = NULL;
+
+ X509_VERIFY_PARAM *vpm = NULL;
+
+ args = argv + 1;
+ ret = 1;
+
+ apps_startup();
+
+ if (bio_err == NULL) {
+ if ((bio_err = BIO_new(BIO_s_file())) != NULL)
+ BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
+ }
+
+ if (!load_config(bio_err, NULL))
+ goto end;
+
+ while (!badarg && *args && *args[0] == '-') {
+ if (!strcmp(*args, "-encrypt"))
+ operation = SMIME_ENCRYPT;
+ else if (!strcmp(*args, "-decrypt"))
+ operation = SMIME_DECRYPT;
+ else if (!strcmp(*args, "-sign"))
+ operation = SMIME_SIGN;
+ else if (!strcmp(*args, "-sign_receipt"))
+ operation = SMIME_SIGN_RECEIPT;
+ else if (!strcmp(*args, "-resign"))
+ operation = SMIME_RESIGN;
+ else if (!strcmp(*args, "-verify"))
+ operation = SMIME_VERIFY;
+ else if (!strcmp(*args, "-verify_retcode"))
+ verify_retcode = 1;
+ else if (!strcmp(*args, "-verify_receipt")) {
+ operation = SMIME_VERIFY_RECEIPT;
+ if (!args[1])
+ goto argerr;
+ args++;
+ rctfile = *args;
+ } else if (!strcmp(*args, "-cmsout"))
+ operation = SMIME_CMSOUT;
+ else if (!strcmp(*args, "-data_out"))
+ operation = SMIME_DATAOUT;
+ else if (!strcmp(*args, "-data_create"))
+ operation = SMIME_DATA_CREATE;
+ else if (!strcmp(*args, "-digest_verify"))
+ operation = SMIME_DIGEST_VERIFY;
+ else if (!strcmp(*args, "-digest_create"))
+ operation = SMIME_DIGEST_CREATE;
+ else if (!strcmp(*args, "-compress"))
+ operation = SMIME_COMPRESS;
+ else if (!strcmp(*args, "-uncompress"))
+ operation = SMIME_UNCOMPRESS;
+ else if (!strcmp(*args, "-EncryptedData_decrypt"))
+ operation = SMIME_ENCRYPTED_DECRYPT;
+ else if (!strcmp(*args, "-EncryptedData_encrypt"))
+ operation = SMIME_ENCRYPTED_ENCRYPT;
+# ifndef OPENSSL_NO_DES
+ else if (!strcmp(*args, "-des3"))
+ cipher = EVP_des_ede3_cbc();
+ else if (!strcmp(*args, "-des"))
+ cipher = EVP_des_cbc();
+# endif
+# ifndef OPENSSL_NO_SEED
+ else if (!strcmp(*args, "-seed"))
+ cipher = EVP_seed_cbc();
+# endif
+# ifndef OPENSSL_NO_RC2
+ else if (!strcmp(*args, "-rc2-40"))
+ cipher = EVP_rc2_40_cbc();
+ else if (!strcmp(*args, "-rc2-128"))
+ cipher = EVP_rc2_cbc();
+ else if (!strcmp(*args, "-rc2-64"))
+ cipher = EVP_rc2_64_cbc();
+# endif
+# ifndef OPENSSL_NO_AES
+ else if (!strcmp(*args, "-aes128"))
+ cipher = EVP_aes_128_cbc();
+ else if (!strcmp(*args, "-aes192"))
+ cipher = EVP_aes_192_cbc();
+ else if (!strcmp(*args, "-aes256"))
+ cipher = EVP_aes_256_cbc();
+# endif
+# ifndef OPENSSL_NO_CAMELLIA
+ else if (!strcmp(*args, "-camellia128"))
+ cipher = EVP_camellia_128_cbc();
+ else if (!strcmp(*args, "-camellia192"))
+ cipher = EVP_camellia_192_cbc();
+ else if (!strcmp(*args, "-camellia256"))
+ cipher = EVP_camellia_256_cbc();
+# endif
+ else if (!strcmp(*args, "-debug_decrypt"))
+ flags |= CMS_DEBUG_DECRYPT;
+ else if (!strcmp(*args, "-text"))
+ flags |= CMS_TEXT;
+ else if (!strcmp(*args, "-nointern"))
+ flags |= CMS_NOINTERN;
+ else if (!strcmp(*args, "-noverify")
+ || !strcmp(*args, "-no_signer_cert_verify"))
+ flags |= CMS_NO_SIGNER_CERT_VERIFY;
+ else if (!strcmp(*args, "-nocerts"))
+ flags |= CMS_NOCERTS;
+ else if (!strcmp(*args, "-noattr"))
+ flags |= CMS_NOATTR;
+ else if (!strcmp(*args, "-nodetach"))
+ flags &= ~CMS_DETACHED;
+ else if (!strcmp(*args, "-nosmimecap"))
+ flags |= CMS_NOSMIMECAP;
+ else if (!strcmp(*args, "-binary"))
+ flags |= CMS_BINARY;
+ else if (!strcmp(*args, "-keyid"))
+ flags |= CMS_USE_KEYID;
+ else if (!strcmp(*args, "-nosigs"))
+ flags |= CMS_NOSIGS;
+ else if (!strcmp(*args, "-no_content_verify"))
+ flags |= CMS_NO_CONTENT_VERIFY;
+ else if (!strcmp(*args, "-no_attr_verify"))
+ flags |= CMS_NO_ATTR_VERIFY;
+ else if (!strcmp(*args, "-stream"))
+ flags |= CMS_STREAM;
+ else if (!strcmp(*args, "-indef"))
+ flags |= CMS_STREAM;
+ else if (!strcmp(*args, "-noindef"))
+ flags &= ~CMS_STREAM;
+ else if (!strcmp(*args, "-nooldmime"))
+ flags |= CMS_NOOLDMIMETYPE;
+ else if (!strcmp(*args, "-crlfeol"))
+ flags |= CMS_CRLFEOL;
+ else if (!strcmp(*args, "-noout"))
+ noout = 1;
+ else if (!strcmp(*args, "-receipt_request_print"))
+ rr_print = 1;
+ else if (!strcmp(*args, "-receipt_request_all"))
+ rr_allorfirst = 0;
+ else if (!strcmp(*args, "-receipt_request_first"))
+ rr_allorfirst = 1;
+ else if (!strcmp(*args, "-receipt_request_from")) {
+ if (!args[1])
+ goto argerr;
+ args++;
+ if (!rr_from)
+ rr_from = sk_OPENSSL_STRING_new_null();
+ sk_OPENSSL_STRING_push(rr_from, *args);
+ } else if (!strcmp(*args, "-receipt_request_to")) {
+ if (!args[1])
+ goto argerr;
+ args++;
+ if (!rr_to)
+ rr_to = sk_OPENSSL_STRING_new_null();
+ sk_OPENSSL_STRING_push(rr_to, *args);
+ } else if (!strcmp(*args, "-print")) {
+ noout = 1;
+ print = 1;
+ } else if (!strcmp(*args, "-secretkey")) {
+ long ltmp;
+ if (!args[1])
+ goto argerr;
+ args++;
+ secret_key = string_to_hex(*args, &ltmp);
+ if (!secret_key) {
+ BIO_printf(bio_err, "Invalid key %s\n", *args);
+ goto argerr;
+ }
+ secret_keylen = (size_t)ltmp;
+ } else if (!strcmp(*args, "-secretkeyid")) {
+ long ltmp;
+ if (!args[1])
+ goto argerr;
+ args++;
+ secret_keyid = string_to_hex(*args, &ltmp);
+ if (!secret_keyid) {
+ BIO_printf(bio_err, "Invalid id %s\n", *args);
+ goto argerr;
+ }
+ secret_keyidlen = (size_t)ltmp;
+ } else if (!strcmp(*args, "-pwri_password")) {
+ if (!args[1])
+ goto argerr;
+ args++;
+ pwri_pass = (unsigned char *)*args;
+ } else if (!strcmp(*args, "-econtent_type")) {
+ if (!args[1])
+ goto argerr;
+ args++;
+ econtent_type = OBJ_txt2obj(*args, 0);
+ if (!econtent_type) {
+ BIO_printf(bio_err, "Invalid OID %s\n", *args);
+ goto argerr;
+ }
+ } else if (!strcmp(*args, "-rand")) {
+ if (!args[1])
+ goto argerr;
+ args++;
+ inrand = *args;
+ need_rand = 1;
+ }
+# ifndef OPENSSL_NO_ENGINE
+ else if (!strcmp(*args, "-engine")) {
+ if (!args[1])
+ goto argerr;
+ engine = *++args;
+ }
+# endif
+ else if (!strcmp(*args, "-passin")) {
+ if (!args[1])
+ goto argerr;
+ passargin = *++args;
+ } else if (!strcmp(*args, "-to")) {
+ if (!args[1])
+ goto argerr;
+ to = *++args;
+ } else if (!strcmp(*args, "-from")) {
+ if (!args[1])
+ goto argerr;
+ from = *++args;
+ } else if (!strcmp(*args, "-subject")) {
+ if (!args[1])
+ goto argerr;
+ subject = *++args;
+ } else if (!strcmp(*args, "-signer")) {
+ if (!args[1])
+ goto argerr;
+ /* If previous -signer argument add signer to list */
+
+ if (signerfile) {
+ if (!sksigners)
+ sksigners = sk_OPENSSL_STRING_new_null();
+ sk_OPENSSL_STRING_push(sksigners, signerfile);
+ if (!keyfile)
+ keyfile = signerfile;
+ if (!skkeys)
+ skkeys = sk_OPENSSL_STRING_new_null();
+ sk_OPENSSL_STRING_push(skkeys, keyfile);
+ keyfile = NULL;
+ }
+ signerfile = *++args;
+ } else if (!strcmp(*args, "-recip")) {
+ if (!args[1])
+ goto argerr;
+ recipfile = *++args;
+ } else if (!strcmp(*args, "-certsout")) {
+ if (!args[1])
+ goto argerr;
+ certsoutfile = *++args;
+ } else if (!strcmp(*args, "-md")) {
+ if (!args[1])
+ goto argerr;
+ sign_md = EVP_get_digestbyname(*++args);
+ if (sign_md == NULL) {
+ BIO_printf(bio_err, "Unknown digest %s\n", *args);
+ goto argerr;
+ }
+ } else if (!strcmp(*args, "-inkey")) {
+ if (!args[1])
+ goto argerr;
+ /* If previous -inkey arument add signer to list */
+ if (keyfile) {
+ if (!signerfile) {
+ BIO_puts(bio_err, "Illegal -inkey without -signer\n");
+ goto argerr;
+ }
+ if (!sksigners)
+ sksigners = sk_OPENSSL_STRING_new_null();
+ sk_OPENSSL_STRING_push(sksigners, signerfile);
+ signerfile = NULL;
+ if (!skkeys)
+ skkeys = sk_OPENSSL_STRING_new_null();
+ sk_OPENSSL_STRING_push(skkeys, keyfile);
+ }
+ keyfile = *++args;
+ } else if (!strcmp(*args, "-keyform")) {
+ if (!args[1])
+ goto argerr;
+ keyform = str2fmt(*++args);
+ } else if (!strcmp(*args, "-rctform")) {
+ if (!args[1])
+ goto argerr;
+ rctformat = str2fmt(*++args);
+ } else if (!strcmp(*args, "-certfile")) {
+ if (!args[1])
+ goto argerr;
+ certfile = *++args;
+ } else if (!strcmp(*args, "-CAfile")) {
+ if (!args[1])
+ goto argerr;
+ CAfile = *++args;
+ } else if (!strcmp(*args, "-CApath")) {
+ if (!args[1])
+ goto argerr;
+ CApath = *++args;
+ } else if (!strcmp(*args, "-in")) {
+ if (!args[1])
+ goto argerr;
+ infile = *++args;
+ } else if (!strcmp(*args, "-inform")) {
+ if (!args[1])
+ goto argerr;
+ informat = str2fmt(*++args);
+ } else if (!strcmp(*args, "-outform")) {
+ if (!args[1])
+ goto argerr;
+ outformat = str2fmt(*++args);
+ } else if (!strcmp(*args, "-out")) {
+ if (!args[1])
+ goto argerr;
+ outfile = *++args;
+ } else if (!strcmp(*args, "-content")) {
+ if (!args[1])
+ goto argerr;
+ contfile = *++args;
+ } else if (args_verify(&args, NULL, &badarg, bio_err, &vpm))
+ continue;
+ else if ((cipher = EVP_get_cipherbyname(*args + 1)) == NULL)
+ badarg = 1;
+ args++;
+ }
+
+ if (((rr_allorfirst != -1) || rr_from) && !rr_to) {
+ BIO_puts(bio_err, "No Signed Receipts Recipients\n");
+ goto argerr;
+ }
+
+ if (!(operation & SMIME_SIGNERS) && (rr_to || rr_from)) {
+ BIO_puts(bio_err, "Signed receipts only allowed with -sign\n");
+ goto argerr;
+ }
+ if (!(operation & SMIME_SIGNERS) && (skkeys || sksigners)) {
+ BIO_puts(bio_err, "Multiple signers or keys not allowed\n");
+ goto argerr;
+ }
+
+ if (operation & SMIME_SIGNERS) {
+ if (keyfile && !signerfile) {
+ BIO_puts(bio_err, "Illegal -inkey without -signer\n");
+ goto argerr;
+ }
+ /* Check to see if any final signer needs to be appended */
+ if (signerfile) {
+ if (!sksigners)
+ sksigners = sk_OPENSSL_STRING_new_null();
+ sk_OPENSSL_STRING_push(sksigners, signerfile);
+ if (!skkeys)
+ skkeys = sk_OPENSSL_STRING_new_null();
+ if (!keyfile)
+ keyfile = signerfile;
+ sk_OPENSSL_STRING_push(skkeys, keyfile);
+ }
+ if (!sksigners) {
+ BIO_printf(bio_err, "No signer certificate specified\n");
+ badarg = 1;
+ }
+ signerfile = NULL;
+ keyfile = NULL;
+ need_rand = 1;
+ }
+
+ else if (operation == SMIME_DECRYPT) {
+ if (!recipfile && !keyfile && !secret_key && !pwri_pass) {
+ BIO_printf(bio_err,
+ "No recipient certificate or key specified\n");
+ badarg = 1;
+ }
+ } else if (operation == SMIME_ENCRYPT) {
+ if (!*args && !secret_key && !pwri_pass) {
+ BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n");
+ badarg = 1;
+ }
+ need_rand = 1;
+ } else if (!operation)
+ badarg = 1;
+
+ if (badarg) {
+ argerr:
+ BIO_printf(bio_err, "Usage cms [options] cert.pem ...\n");
+ BIO_printf(bio_err, "where options are\n");
+ BIO_printf(bio_err, "-encrypt encrypt message\n");
+ BIO_printf(bio_err, "-decrypt decrypt encrypted message\n");
+ BIO_printf(bio_err, "-sign sign message\n");
+ BIO_printf(bio_err, "-verify verify signed message\n");
+ BIO_printf(bio_err, "-cmsout output CMS structure\n");
+# ifndef OPENSSL_NO_DES
+ BIO_printf(bio_err, "-des3 encrypt with triple DES\n");
+ BIO_printf(bio_err, "-des encrypt with DES\n");
+# endif
+# ifndef OPENSSL_NO_SEED
+ BIO_printf(bio_err, "-seed encrypt with SEED\n");
+# endif
+# ifndef OPENSSL_NO_RC2
+ BIO_printf(bio_err, "-rc2-40 encrypt with RC2-40 (default)\n");
+ BIO_printf(bio_err, "-rc2-64 encrypt with RC2-64\n");
+ BIO_printf(bio_err, "-rc2-128 encrypt with RC2-128\n");
+# endif
+# ifndef OPENSSL_NO_AES
+ BIO_printf(bio_err, "-aes128, -aes192, -aes256\n");
+ BIO_printf(bio_err,
+ " encrypt PEM output with cbc aes\n");
+# endif
+# ifndef OPENSSL_NO_CAMELLIA
+ BIO_printf(bio_err, "-camellia128, -camellia192, -camellia256\n");
+ BIO_printf(bio_err,
+ " encrypt PEM output with cbc camellia\n");
+# endif
+ BIO_printf(bio_err,
+ "-nointern don't search certificates in message for signer\n");
+ BIO_printf(bio_err,
+ "-nosigs don't verify message signature\n");
+ BIO_printf(bio_err,
+ "-noverify don't verify signers certificate\n");
+ BIO_printf(bio_err,
+ "-nocerts don't include signers certificate when signing\n");
+ BIO_printf(bio_err, "-nodetach use opaque signing\n");
+ BIO_printf(bio_err,
+ "-noattr don't include any signed attributes\n");
+ BIO_printf(bio_err,
+ "-binary don't translate message to text\n");
+ BIO_printf(bio_err, "-certfile file other certificates file\n");
+ BIO_printf(bio_err, "-certsout file certificate output file\n");
+ BIO_printf(bio_err, "-signer file signer certificate file\n");
+ BIO_printf(bio_err,
+ "-recip file recipient certificate file for decryption\n");
+ BIO_printf(bio_err, "-keyid use subject key identifier\n");
+ BIO_printf(bio_err, "-in file input file\n");
+ BIO_printf(bio_err,
+ "-inform arg input format SMIME (default), PEM or DER\n");
+ BIO_printf(bio_err,
+ "-inkey file input private key (if not signer or recipient)\n");
+ BIO_printf(bio_err,
+ "-keyform arg input private key format (PEM or ENGINE)\n");
+ BIO_printf(bio_err, "-out file output file\n");
+ BIO_printf(bio_err,
+ "-outform arg output format SMIME (default), PEM or DER\n");
+ BIO_printf(bio_err,
+ "-content file supply or override content for detached signature\n");
+ BIO_printf(bio_err, "-to addr to address\n");
+ BIO_printf(bio_err, "-from ad from address\n");
+ BIO_printf(bio_err, "-subject s subject\n");
+ BIO_printf(bio_err,
+ "-text include or delete text MIME headers\n");
+ BIO_printf(bio_err,
+ "-CApath dir trusted certificates directory\n");
+ BIO_printf(bio_err, "-CAfile file trusted certificates file\n");
+ BIO_printf(bio_err,
+ "-crl_check check revocation status of signer's certificate using CRLs\n");
+ BIO_printf(bio_err,
+ "-crl_check_all check revocation status of signer's certificate chain using CRLs\n");
+# ifndef OPENSSL_NO_ENGINE
+ BIO_printf(bio_err,
+ "-engine e use engine e, possibly a hardware device.\n");
+# endif
+ BIO_printf(bio_err, "-passin arg input file pass phrase source\n");
+ BIO_printf(bio_err, "-rand file%cfile%c...\n", LIST_SEPARATOR_CHAR,
+ LIST_SEPARATOR_CHAR);
+ BIO_printf(bio_err,
+ " load the file (or the files in the directory) into\n");
+ BIO_printf(bio_err, " the random number generator\n");
+ BIO_printf(bio_err,
+ "cert.pem recipient certificate(s) for encryption\n");
+ goto end;
+ }
+# ifndef OPENSSL_NO_ENGINE
+ e = setup_engine(bio_err, engine, 0);
+# endif
+
+ if (!app_passwd(bio_err, passargin, NULL, &passin, NULL)) {
+ BIO_printf(bio_err, "Error getting password\n");
+ goto end;
+ }
+
+ if (need_rand) {
+ app_RAND_load_file(NULL, bio_err, (inrand != NULL));
+ if (inrand != NULL)
+ BIO_printf(bio_err, "%ld semi-random bytes loaded\n",
+ app_RAND_load_files(inrand));
+ }
+
+ ret = 2;
+
+ if (!(operation & SMIME_SIGNERS))
+ flags &= ~CMS_DETACHED;
+
+ if (operation & SMIME_OP) {
+ if (outformat == FORMAT_ASN1)
+ outmode = "wb";
+ } else {
+ if (flags & CMS_BINARY)
+ outmode = "wb";
+ }
+
+ if (operation & SMIME_IP) {
+ if (informat == FORMAT_ASN1)
+ inmode = "rb";
+ } else {
+ if (flags & CMS_BINARY)
+ inmode = "rb";
+ }
+
+ if (operation == SMIME_ENCRYPT) {
+ if (!cipher) {
+# ifndef OPENSSL_NO_DES
+ cipher = EVP_des_ede3_cbc();
+# else
+ BIO_printf(bio_err, "No cipher selected\n");
+ goto end;
+# endif
+ }
+
+ if (secret_key && !secret_keyid) {
+ BIO_printf(bio_err, "No secret key id\n");
+ goto end;
+ }
+
+ if (*args)
+ encerts = sk_X509_new_null();
+ while (*args) {
+ if (!(cert = load_cert(bio_err, *args, FORMAT_PEM,
+ NULL, e, "recipient certificate file")))
+ goto end;
+ sk_X509_push(encerts, cert);
+ cert = NULL;
+ args++;
+ }
+ }
+
+ if (certfile) {
+ if (!(other = load_certs(bio_err, certfile, FORMAT_PEM, NULL,
+ e, "certificate file"))) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+
+ if (recipfile && (operation == SMIME_DECRYPT)) {
+ if (!(recip = load_cert(bio_err, recipfile, FORMAT_PEM, NULL,
+ e, "recipient certificate file"))) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+
+ if (operation == SMIME_SIGN_RECEIPT) {
+ if (!(signer = load_cert(bio_err, signerfile, FORMAT_PEM, NULL,
+ e, "receipt signer certificate file"))) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+
+ if (operation == SMIME_DECRYPT) {
+ if (!keyfile)
+ keyfile = recipfile;
+ } else if ((operation == SMIME_SIGN) || (operation == SMIME_SIGN_RECEIPT)) {
+ if (!keyfile)
+ keyfile = signerfile;
+ } else
+ keyfile = NULL;
+
+ if (keyfile) {
+ key = load_key(bio_err, keyfile, keyform, 0, passin, e,
+ "signing key file");
+ if (!key)
+ goto end;
+ }
+
+ if (infile) {
+ if (!(in = BIO_new_file(infile, inmode))) {
+ BIO_printf(bio_err, "Can't open input file %s\n", infile);
+ goto end;
+ }
+ } else
+ in = BIO_new_fp(stdin, BIO_NOCLOSE);
+
+ if (operation & SMIME_IP) {
+ if (informat == FORMAT_SMIME)
+ cms = SMIME_read_CMS(in, &indata);
+ else if (informat == FORMAT_PEM)
+ cms = PEM_read_bio_CMS(in, NULL, NULL, NULL);
+ else if (informat == FORMAT_ASN1)
+ cms = d2i_CMS_bio(in, NULL);
+ else {
+ BIO_printf(bio_err, "Bad input format for CMS file\n");
+ goto end;
+ }
+
+ if (!cms) {
+ BIO_printf(bio_err, "Error reading S/MIME message\n");
+ goto end;
+ }
+ if (contfile) {
+ BIO_free(indata);
+ if (!(indata = BIO_new_file(contfile, "rb"))) {
+ BIO_printf(bio_err, "Can't read content file %s\n", contfile);
+ goto end;
+ }
+ }
+ if (certsoutfile) {
+ STACK_OF(X509) *allcerts;
+ allcerts = CMS_get1_certs(cms);
+ if (!save_certs(certsoutfile, allcerts)) {
+ BIO_printf(bio_err,
+ "Error writing certs to %s\n", certsoutfile);
+ ret = 5;
+ goto end;
+ }
+ sk_X509_pop_free(allcerts, X509_free);
+ }
+ }
+
+ if (rctfile) {
+ char *rctmode = (rctformat == FORMAT_ASN1) ? "rb" : "r";
+ if (!(rctin = BIO_new_file(rctfile, rctmode))) {
+ BIO_printf(bio_err, "Can't open receipt file %s\n", rctfile);
+ goto end;
+ }
+
+ if (rctformat == FORMAT_SMIME)
+ rcms = SMIME_read_CMS(rctin, NULL);
+ else if (rctformat == FORMAT_PEM)
+ rcms = PEM_read_bio_CMS(rctin, NULL, NULL, NULL);
+ else if (rctformat == FORMAT_ASN1)
+ rcms = d2i_CMS_bio(rctin, NULL);
+ else {
+ BIO_printf(bio_err, "Bad input format for receipt\n");
+ goto end;
+ }
+
+ if (!rcms) {
+ BIO_printf(bio_err, "Error reading receipt\n");
+ goto end;
+ }
+ }
+
+ if (outfile) {
+ if (!(out = BIO_new_file(outfile, outmode))) {
+ BIO_printf(bio_err, "Can't open output file %s\n", outfile);
+ goto end;
+ }
+ } else {
+ out = BIO_new_fp(stdout, BIO_NOCLOSE);
+# ifdef OPENSSL_SYS_VMS
+ {
+ BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+ out = BIO_push(tmpbio, out);
+ }
+# endif
+ }
+
+ if ((operation == SMIME_VERIFY) || (operation == SMIME_VERIFY_RECEIPT)) {
+ if (!(store = setup_verify(bio_err, CAfile, CApath)))
+ goto end;
+ X509_STORE_set_verify_cb(store, cms_cb);
+ if (vpm)
+ X509_STORE_set1_param(store, vpm);
+ }
+
+ ret = 3;
+
+ if (operation == SMIME_DATA_CREATE) {
+ cms = CMS_data_create(in, flags);
+ } else if (operation == SMIME_DIGEST_CREATE) {
+ cms = CMS_digest_create(in, sign_md, flags);
+ } else if (operation == SMIME_COMPRESS) {
+ cms = CMS_compress(in, -1, flags);
+ } else if (operation == SMIME_ENCRYPT) {
+ flags |= CMS_PARTIAL;
+ cms = CMS_encrypt(encerts, in, cipher, flags);
+ if (!cms)
+ goto end;
+ if (secret_key) {
+ if (!CMS_add0_recipient_key(cms, NID_undef,
+ secret_key, secret_keylen,
+ secret_keyid, secret_keyidlen,
+ NULL, NULL, NULL))
+ goto end;
+ /* NULL these because call absorbs them */
+ secret_key = NULL;
+ secret_keyid = NULL;
+ }
+ if (pwri_pass) {
+ pwri_tmp = (unsigned char *)BUF_strdup((char *)pwri_pass);
+ if (!pwri_tmp)
+ goto end;
+ if (!CMS_add0_recipient_password(cms,
+ -1, NID_undef, NID_undef,
+ pwri_tmp, -1, NULL))
+ goto end;
+ pwri_tmp = NULL;
+ }
+ if (!(flags & CMS_STREAM)) {
+ if (!CMS_final(cms, in, NULL, flags))
+ goto end;
+ }
+ } else if (operation == SMIME_ENCRYPTED_ENCRYPT) {
+ cms = CMS_EncryptedData_encrypt(in, cipher,
+ secret_key, secret_keylen, flags);
+
+ } else if (operation == SMIME_SIGN_RECEIPT) {
+ CMS_ContentInfo *srcms = NULL;
+ STACK_OF(CMS_SignerInfo) *sis;
+ CMS_SignerInfo *si;
+ sis = CMS_get0_SignerInfos(cms);
+ if (!sis)
+ goto end;
+ si = sk_CMS_SignerInfo_value(sis, 0);
+ srcms = CMS_sign_receipt(si, signer, key, other, flags);
+ if (!srcms)
+ goto end;
+ CMS_ContentInfo_free(cms);
+ cms = srcms;
+ } else if (operation & SMIME_SIGNERS) {
+ int i;
+ /*
+ * If detached data content we enable streaming if S/MIME output
+ * format.
+ */
+ if (operation == SMIME_SIGN) {
+
+ if (flags & CMS_DETACHED) {
+ if (outformat == FORMAT_SMIME)
+ flags |= CMS_STREAM;
+ }
+ flags |= CMS_PARTIAL;
+ cms = CMS_sign(NULL, NULL, other, in, flags);
+ if (!cms)
+ goto end;
+ if (econtent_type)
+ CMS_set1_eContentType(cms, econtent_type);
+
+ if (rr_to) {
+ rr = make_receipt_request(rr_to, rr_allorfirst, rr_from);
+ if (!rr) {
+ BIO_puts(bio_err,
+ "Signed Receipt Request Creation Error\n");
+ goto end;
+ }
+ }
+ } else
+ flags |= CMS_REUSE_DIGEST;
+ for (i = 0; i < sk_OPENSSL_STRING_num(sksigners); i++) {
+ CMS_SignerInfo *si;
+ signerfile = sk_OPENSSL_STRING_value(sksigners, i);
+ keyfile = sk_OPENSSL_STRING_value(skkeys, i);
+ signer = load_cert(bio_err, signerfile, FORMAT_PEM, NULL,
+ e, "signer certificate");
+ if (!signer)
+ goto end;
+ key = load_key(bio_err, keyfile, keyform, 0, passin, e,
+ "signing key file");
+ if (!key)
+ goto end;
+ si = CMS_add1_signer(cms, signer, key, sign_md, flags);
+ if (!si)
+ goto end;
+ if (rr && !CMS_add1_ReceiptRequest(si, rr))
+ goto end;
+ X509_free(signer);
+ signer = NULL;
+ EVP_PKEY_free(key);
+ key = NULL;
+ }
+ /* If not streaming or resigning finalize structure */
+ if ((operation == SMIME_SIGN) && !(flags & CMS_STREAM)) {
+ if (!CMS_final(cms, in, NULL, flags))
+ goto end;
+ }
+ }
+
+ if (!cms) {
+ BIO_printf(bio_err, "Error creating CMS structure\n");
+ goto end;
+ }
+
+ ret = 4;
+ if (operation == SMIME_DECRYPT) {
+ if (flags & CMS_DEBUG_DECRYPT)
+ CMS_decrypt(cms, NULL, NULL, NULL, NULL, flags);
+
+ if (secret_key) {
+ if (!CMS_decrypt_set1_key(cms,
+ secret_key, secret_keylen,
+ secret_keyid, secret_keyidlen)) {
+ BIO_puts(bio_err, "Error decrypting CMS using secret key\n");
+ goto end;
+ }
+ }
+
+ if (key) {
+ if (!CMS_decrypt_set1_pkey(cms, key, recip)) {
+ BIO_puts(bio_err, "Error decrypting CMS using private key\n");
+ goto end;
+ }
+ }
+
+ if (pwri_pass) {
+ if (!CMS_decrypt_set1_password(cms, pwri_pass, -1)) {
+ BIO_puts(bio_err, "Error decrypting CMS using password\n");
+ goto end;
+ }
+ }
+
+ if (!CMS_decrypt(cms, NULL, NULL, indata, out, flags)) {
+ BIO_printf(bio_err, "Error decrypting CMS structure\n");
+ goto end;
+ }
+ } else if (operation == SMIME_DATAOUT) {
+ if (!CMS_data(cms, out, flags))
+ goto end;
+ } else if (operation == SMIME_UNCOMPRESS) {
+ if (!CMS_uncompress(cms, indata, out, flags))
+ goto end;
+ } else if (operation == SMIME_DIGEST_VERIFY) {
+ if (CMS_digest_verify(cms, indata, out, flags) > 0)
+ BIO_printf(bio_err, "Verification successful\n");
+ else {
+ BIO_printf(bio_err, "Verification failure\n");
+ goto end;
+ }
+ } else if (operation == SMIME_ENCRYPTED_DECRYPT) {
+ if (!CMS_EncryptedData_decrypt(cms, secret_key, secret_keylen,
+ indata, out, flags))
+ goto end;
+ } else if (operation == SMIME_VERIFY) {
+ if (CMS_verify(cms, other, store, indata, out, flags) > 0)
+ BIO_printf(bio_err, "Verification successful\n");
+ else {
+ BIO_printf(bio_err, "Verification failure\n");
+ if (verify_retcode)
+ ret = verify_err + 32;
+ goto end;
+ }
+ if (signerfile) {
+ STACK_OF(X509) *signers;
+ signers = CMS_get0_signers(cms);
+ if (!save_certs(signerfile, signers)) {
+ BIO_printf(bio_err,
+ "Error writing signers to %s\n", signerfile);
+ ret = 5;
+ goto end;
+ }
+ sk_X509_free(signers);
+ }
+ if (rr_print)
+ receipt_request_print(bio_err, cms);
+
+ } else if (operation == SMIME_VERIFY_RECEIPT) {
+ if (CMS_verify_receipt(rcms, cms, other, store, flags) > 0)
+ BIO_printf(bio_err, "Verification successful\n");
+ else {
+ BIO_printf(bio_err, "Verification failure\n");
+ goto end;
+ }
+ } else {
+ if (noout) {
+ if (print)
+ CMS_ContentInfo_print_ctx(out, cms, 0, NULL);
+ } else if (outformat == FORMAT_SMIME) {
+ if (to)
+ BIO_printf(out, "To: %s\n", to);
+ if (from)
+ BIO_printf(out, "From: %s\n", from);
+ if (subject)
+ BIO_printf(out, "Subject: %s\n", subject);
+ if (operation == SMIME_RESIGN)
+ ret = SMIME_write_CMS(out, cms, indata, flags);
+ else
+ ret = SMIME_write_CMS(out, cms, in, flags);
+ } else if (outformat == FORMAT_PEM)
+ ret = PEM_write_bio_CMS_stream(out, cms, in, flags);
+ else if (outformat == FORMAT_ASN1)
+ ret = i2d_CMS_bio_stream(out, cms, in, flags);
+ else {
+ BIO_printf(bio_err, "Bad output format for CMS file\n");
+ goto end;
+ }
+ if (ret <= 0) {
+ ret = 6;
+ goto end;
+ }
+ }
+ ret = 0;
+ end:
+ if (ret)
+ ERR_print_errors(bio_err);
+ if (need_rand)
+ app_RAND_write_file(NULL, bio_err);
+ sk_X509_pop_free(encerts, X509_free);
+ sk_X509_pop_free(other, X509_free);
+ if (vpm)
+ X509_VERIFY_PARAM_free(vpm);
+ if (sksigners)
+ sk_OPENSSL_STRING_free(sksigners);
+ if (skkeys)
+ sk_OPENSSL_STRING_free(skkeys);
+ if (secret_key)
+ OPENSSL_free(secret_key);
+ if (secret_keyid)
+ OPENSSL_free(secret_keyid);
+ if (pwri_tmp)
+ OPENSSL_free(pwri_tmp);
+ if (econtent_type)
+ ASN1_OBJECT_free(econtent_type);
+ if (rr)
+ CMS_ReceiptRequest_free(rr);
+ if (rr_to)
+ sk_OPENSSL_STRING_free(rr_to);
+ if (rr_from)
+ sk_OPENSSL_STRING_free(rr_from);
+ X509_STORE_free(store);
+ X509_free(cert);
+ X509_free(recip);
+ X509_free(signer);
+ EVP_PKEY_free(key);
+ CMS_ContentInfo_free(cms);
+ CMS_ContentInfo_free(rcms);
+ BIO_free(rctin);
+ BIO_free(in);
+ BIO_free(indata);
+ BIO_free_all(out);
+ if (passin)
+ OPENSSL_free(passin);
+ return (ret);
}
static int save_certs(char *signerfile, STACK_OF(X509) *signers)
- {
- int i;
- BIO *tmp;
- if (!signerfile)
- return 1;
- tmp = BIO_new_file(signerfile, "w");
- if (!tmp) return 0;
- for(i = 0; i < sk_X509_num(signers); i++)
- PEM_write_bio_X509(tmp, sk_X509_value(signers, i));
- BIO_free(tmp);
- return 1;
- }
-
+{
+ int i;
+ BIO *tmp;
+ if (!signerfile)
+ return 1;
+ tmp = BIO_new_file(signerfile, "w");
+ if (!tmp)
+ return 0;
+ for (i = 0; i < sk_X509_num(signers); i++)
+ PEM_write_bio_X509(tmp, sk_X509_value(signers, i));
+ BIO_free(tmp);
+ return 1;
+}
/* Minimal callback just to output policy info (if any) */
static int cms_cb(int ok, X509_STORE_CTX *ctx)
- {
- int error;
+{
+ int error;
- error = X509_STORE_CTX_get_error(ctx);
+ error = X509_STORE_CTX_get_error(ctx);
- verify_err = error;
+ verify_err = error;
- if ((error != X509_V_ERR_NO_EXPLICIT_POLICY)
- && ((error != X509_V_OK) || (ok != 2)))
- return ok;
+ if ((error != X509_V_ERR_NO_EXPLICIT_POLICY)
+ && ((error != X509_V_OK) || (ok != 2)))
+ return ok;
- policies_print(NULL, ctx);
+ policies_print(NULL, ctx);
- return ok;
+ return ok;
- }
+}
static void gnames_stack_print(BIO *out, STACK_OF(GENERAL_NAMES) *gns)
- {
- STACK_OF(GENERAL_NAME) *gens;
- GENERAL_NAME *gen;
- int i, j;
- for (i = 0; i < sk_GENERAL_NAMES_num(gns); i++)
- {
- gens = sk_GENERAL_NAMES_value(gns, i);
- for (j = 0; j < sk_GENERAL_NAME_num(gens); j++)
- {
- gen = sk_GENERAL_NAME_value(gens, j);
- BIO_puts(out, " ");
- GENERAL_NAME_print(out, gen);
- BIO_puts(out, "\n");
- }
- }
- return;
- }
+{
+ STACK_OF(GENERAL_NAME) *gens;
+ GENERAL_NAME *gen;
+ int i, j;
+ for (i = 0; i < sk_GENERAL_NAMES_num(gns); i++) {
+ gens = sk_GENERAL_NAMES_value(gns, i);
+ for (j = 0; j < sk_GENERAL_NAME_num(gens); j++) {
+ gen = sk_GENERAL_NAME_value(gens, j);
+ BIO_puts(out, " ");
+ GENERAL_NAME_print(out, gen);
+ BIO_puts(out, "\n");
+ }
+ }
+ return;
+}
static void receipt_request_print(BIO *out, CMS_ContentInfo *cms)
- {
- STACK_OF(CMS_SignerInfo) *sis;
- CMS_SignerInfo *si;
- CMS_ReceiptRequest *rr;
- int allorfirst;
- STACK_OF(GENERAL_NAMES) *rto, *rlist;
- ASN1_STRING *scid;
- int i, rv;
- sis = CMS_get0_SignerInfos(cms);
- for (i = 0; i < sk_CMS_SignerInfo_num(sis); i++)
- {
- si = sk_CMS_SignerInfo_value(sis, i);
- rv = CMS_get1_ReceiptRequest(si, &rr);
- BIO_printf(bio_err, "Signer %d:\n", i + 1);
- if (rv == 0)
- BIO_puts(bio_err, " No Receipt Request\n");
- else if (rv < 0)
- {
- BIO_puts(bio_err, " Receipt Request Parse Error\n");
- ERR_print_errors(bio_err);
- }
- else
- {
- char *id;
- int idlen;
- CMS_ReceiptRequest_get0_values(rr, &scid, &allorfirst,
- &rlist, &rto);
- BIO_puts(out, " Signed Content ID:\n");
- idlen = ASN1_STRING_length(scid);
- id = (char *)ASN1_STRING_data(scid);
- BIO_dump_indent(out, id, idlen, 4);
- BIO_puts(out, " Receipts From");
- if (rlist)
- {
- BIO_puts(out, " List:\n");
- gnames_stack_print(out, rlist);
- }
- else if (allorfirst == 1)
- BIO_puts(out, ": First Tier\n");
- else if (allorfirst == 0)
- BIO_puts(out, ": All\n");
- else
- BIO_printf(out, " Unknown (%d)\n", allorfirst);
- BIO_puts(out, " Receipts To:\n");
- gnames_stack_print(out, rto);
- }
- if (rr)
- CMS_ReceiptRequest_free(rr);
- }
- }
+{
+ STACK_OF(CMS_SignerInfo) *sis;
+ CMS_SignerInfo *si;
+ CMS_ReceiptRequest *rr;
+ int allorfirst;
+ STACK_OF(GENERAL_NAMES) *rto, *rlist;
+ ASN1_STRING *scid;
+ int i, rv;
+ sis = CMS_get0_SignerInfos(cms);
+ for (i = 0; i < sk_CMS_SignerInfo_num(sis); i++) {
+ si = sk_CMS_SignerInfo_value(sis, i);
+ rv = CMS_get1_ReceiptRequest(si, &rr);
+ BIO_printf(bio_err, "Signer %d:\n", i + 1);
+ if (rv == 0)
+ BIO_puts(bio_err, " No Receipt Request\n");
+ else if (rv < 0) {
+ BIO_puts(bio_err, " Receipt Request Parse Error\n");
+ ERR_print_errors(bio_err);
+ } else {
+ char *id;
+ int idlen;
+ CMS_ReceiptRequest_get0_values(rr, &scid, &allorfirst,
+ &rlist, &rto);
+ BIO_puts(out, " Signed Content ID:\n");
+ idlen = ASN1_STRING_length(scid);
+ id = (char *)ASN1_STRING_data(scid);
+ BIO_dump_indent(out, id, idlen, 4);
+ BIO_puts(out, " Receipts From");
+ if (rlist) {
+ BIO_puts(out, " List:\n");
+ gnames_stack_print(out, rlist);
+ } else if (allorfirst == 1)
+ BIO_puts(out, ": First Tier\n");
+ else if (allorfirst == 0)
+ BIO_puts(out, ": All\n");
+ else
+ BIO_printf(out, " Unknown (%d)\n", allorfirst);
+ BIO_puts(out, " Receipts To:\n");
+ gnames_stack_print(out, rto);
+ }
+ if (rr)
+ CMS_ReceiptRequest_free(rr);
+ }
+}
static STACK_OF(GENERAL_NAMES) *make_names_stack(STACK_OF(OPENSSL_STRING) *ns)
- {
- int i;
- STACK_OF(GENERAL_NAMES) *ret;
- GENERAL_NAMES *gens = NULL;
- GENERAL_NAME *gen = NULL;
- ret = sk_GENERAL_NAMES_new_null();
- if (!ret)
- goto err;
- for (i = 0; i < sk_OPENSSL_STRING_num(ns); i++)
- {
- char *str = sk_OPENSSL_STRING_value(ns, i);
- gen = a2i_GENERAL_NAME(NULL, NULL, NULL, GEN_EMAIL, str, 0);
- if (!gen)
- goto err;
- gens = GENERAL_NAMES_new();
- if (!gens)
- goto err;
- if (!sk_GENERAL_NAME_push(gens, gen))
- goto err;
- gen = NULL;
- if (!sk_GENERAL_NAMES_push(ret, gens))
- goto err;
- gens = NULL;
- }
-
- return ret;
-
- err:
- if (ret)
- sk_GENERAL_NAMES_pop_free(ret, GENERAL_NAMES_free);
- if (gens)
- GENERAL_NAMES_free(gens);
- if (gen)
- GENERAL_NAME_free(gen);
- return NULL;
- }
-
-
-static CMS_ReceiptRequest *make_receipt_request(STACK_OF(OPENSSL_STRING) *rr_to,
- int rr_allorfirst,
- STACK_OF(OPENSSL_STRING) *rr_from)
- {
- STACK_OF(GENERAL_NAMES) *rct_to, *rct_from;
- CMS_ReceiptRequest *rr;
- rct_to = make_names_stack(rr_to);
- if (!rct_to)
- goto err;
- if (rr_from)
- {
- rct_from = make_names_stack(rr_from);
- if (!rct_from)
- goto err;
- }
- else
- rct_from = NULL;
- rr = CMS_ReceiptRequest_create0(NULL, -1, rr_allorfirst, rct_from,
- rct_to);
- return rr;
- err:
- return NULL;
- }
+{
+ int i;
+ STACK_OF(GENERAL_NAMES) *ret;
+ GENERAL_NAMES *gens = NULL;
+ GENERAL_NAME *gen = NULL;
+ ret = sk_GENERAL_NAMES_new_null();
+ if (!ret)
+ goto err;
+ for (i = 0; i < sk_OPENSSL_STRING_num(ns); i++) {
+ char *str = sk_OPENSSL_STRING_value(ns, i);
+ gen = a2i_GENERAL_NAME(NULL, NULL, NULL, GEN_EMAIL, str, 0);
+ if (!gen)
+ goto err;
+ gens = GENERAL_NAMES_new();
+ if (!gens)
+ goto err;
+ if (!sk_GENERAL_NAME_push(gens, gen))
+ goto err;
+ gen = NULL;
+ if (!sk_GENERAL_NAMES_push(ret, gens))
+ goto err;
+ gens = NULL;
+ }
+
+ return ret;
+
+ err:
+ if (ret)
+ sk_GENERAL_NAMES_pop_free(ret, GENERAL_NAMES_free);
+ if (gens)
+ GENERAL_NAMES_free(gens);
+ if (gen)
+ GENERAL_NAME_free(gen);
+ return NULL;
+}
+
+static CMS_ReceiptRequest *make_receipt_request(STACK_OF(OPENSSL_STRING)
+ *rr_to, int rr_allorfirst, STACK_OF(OPENSSL_STRING)
+ *rr_from)
+{
+ STACK_OF(GENERAL_NAMES) *rct_to, *rct_from;
+ CMS_ReceiptRequest *rr;
+ rct_to = make_names_stack(rr_to);
+ if (!rct_to)
+ goto err;
+ if (rr_from) {
+ rct_from = make_names_stack(rr_from);
+ if (!rct_from)
+ goto err;
+ } else
+ rct_from = NULL;
+ rr = CMS_ReceiptRequest_create0(NULL, -1, rr_allorfirst, rct_from,
+ rct_to);
+ return rr;
+ err:
+ return NULL;
+}
#endif
diff --git a/apps/crl.c b/apps/crl.c
index 8797d300cf13..0a05870ca1fc 100644
--- a/apps/crl.c
+++ b/apps/crl.c
@@ -5,21 +5,21 @@
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -34,10 +34,10 @@
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -49,7 +49,7 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
@@ -67,398 +67,368 @@
#include <openssl/pem.h>
#undef PROG
-#define PROG crl_main
+#define PROG crl_main
#undef POSTFIX
-#define POSTFIX ".rvk"
+#define POSTFIX ".rvk"
-static const char *crl_usage[]={
-"usage: crl args\n",
-"\n",
-" -inform arg - input format - default PEM (DER or PEM)\n",
-" -outform arg - output format - default PEM\n",
-" -text - print out a text format version\n",
-" -in arg - input file - default stdin\n",
-" -out arg - output file - default stdout\n",
-" -hash - print hash value\n",
+static const char *crl_usage[] = {
+ "usage: crl args\n",
+ "\n",
+ " -inform arg - input format - default PEM (DER or PEM)\n",
+ " -outform arg - output format - default PEM\n",
+ " -text - print out a text format version\n",
+ " -in arg - input file - default stdin\n",
+ " -out arg - output file - default stdout\n",
+ " -hash - print hash value\n",
#ifndef OPENSSL_NO_MD5
-" -hash_old - print old-style (MD5) hash value\n",
+ " -hash_old - print old-style (MD5) hash value\n",
#endif
-" -fingerprint - print the crl fingerprint\n",
-" -issuer - print issuer DN\n",
-" -lastupdate - lastUpdate field\n",
-" -nextupdate - nextUpdate field\n",
-" -crlnumber - print CRL number\n",
-" -noout - no CRL output\n",
-" -CAfile name - verify CRL using certificates in file \"name\"\n",
-" -CApath dir - verify CRL using certificates in \"dir\"\n",
-" -nameopt arg - various certificate name options\n",
-NULL
+ " -fingerprint - print the crl fingerprint\n",
+ " -issuer - print issuer DN\n",
+ " -lastupdate - lastUpdate field\n",
+ " -nextupdate - nextUpdate field\n",
+ " -crlnumber - print CRL number\n",
+ " -noout - no CRL output\n",
+ " -CAfile name - verify CRL using certificates in file \"name\"\n",
+ " -CApath dir - verify CRL using certificates in \"dir\"\n",
+ " -nameopt arg - various certificate name options\n",
+ NULL
};
static X509_CRL *load_crl(char *file, int format);
-static BIO *bio_out=NULL;
+static BIO *bio_out = NULL;
int MAIN(int, char **);
int MAIN(int argc, char **argv)
- {
- unsigned long nmflag = 0;
- X509_CRL *x=NULL;
- char *CAfile = NULL, *CApath = NULL;
- int ret=1,i,num,badops=0;
- BIO *out=NULL;
- int informat,outformat;
- char *infile=NULL,*outfile=NULL;
- int hash=0,issuer=0,lastupdate=0,nextupdate=0,noout=0,text=0;
+{
+ unsigned long nmflag = 0;
+ X509_CRL *x = NULL;
+ char *CAfile = NULL, *CApath = NULL;
+ int ret = 1, i, num, badops = 0;
+ BIO *out = NULL;
+ int informat, outformat;
+ char *infile = NULL, *outfile = NULL;
+ int hash = 0, issuer = 0, lastupdate = 0, nextupdate = 0, noout =
+ 0, text = 0;
#ifndef OPENSSL_NO_MD5
- int hash_old=0;
+ int hash_old = 0;
#endif
- int fingerprint = 0, crlnumber = 0;
- const char **pp;
- X509_STORE *store = NULL;
- X509_STORE_CTX ctx;
- X509_LOOKUP *lookup = NULL;
- X509_OBJECT xobj;
- EVP_PKEY *pkey;
- int do_ver = 0;
- const EVP_MD *md_alg,*digest=EVP_sha1();
+ int fingerprint = 0, crlnumber = 0;
+ const char **pp;
+ X509_STORE *store = NULL;
+ X509_STORE_CTX ctx;
+ X509_LOOKUP *lookup = NULL;
+ X509_OBJECT xobj;
+ EVP_PKEY *pkey;
+ int do_ver = 0;
+ const EVP_MD *md_alg, *digest = EVP_sha1();
- apps_startup();
+ apps_startup();
- if (bio_err == NULL)
- if ((bio_err=BIO_new(BIO_s_file())) != NULL)
- BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
+ if (bio_err == NULL)
+ if ((bio_err = BIO_new(BIO_s_file())) != NULL)
+ BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
- if (!load_config(bio_err, NULL))
- goto end;
+ if (!load_config(bio_err, NULL))
+ goto end;
- if (bio_out == NULL)
- if ((bio_out=BIO_new(BIO_s_file())) != NULL)
- {
- BIO_set_fp(bio_out,stdout,BIO_NOCLOSE);
+ if (bio_out == NULL)
+ if ((bio_out = BIO_new(BIO_s_file())) != NULL) {
+ BIO_set_fp(bio_out, stdout, BIO_NOCLOSE);
#ifdef OPENSSL_SYS_VMS
- {
- BIO *tmpbio = BIO_new(BIO_f_linebuffer());
- bio_out = BIO_push(tmpbio, bio_out);
- }
+ {
+ BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+ bio_out = BIO_push(tmpbio, bio_out);
+ }
#endif
- }
+ }
- informat=FORMAT_PEM;
- outformat=FORMAT_PEM;
+ informat = FORMAT_PEM;
+ outformat = FORMAT_PEM;
- argc--;
- argv++;
- num=0;
- while (argc >= 1)
- {
+ argc--;
+ argv++;
+ num = 0;
+ while (argc >= 1) {
#ifdef undef
- if (strcmp(*argv,"-p") == 0)
- {
- if (--argc < 1) goto bad;
- if (!args_from_file(++argv,Nargc,Nargv)) { goto end; }*/
- }
+ if (strcmp(*argv, "-p") == 0) {
+ if (--argc < 1)
+ goto bad;
+ if (!args_from_file(++argv, Nargc, Nargv)) {
+ goto end;
+ }
+ */}
#endif
- if (strcmp(*argv,"-inform") == 0)
- {
- if (--argc < 1) goto bad;
- informat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-outform") == 0)
- {
- if (--argc < 1) goto bad;
- outformat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-in") == 0)
- {
- if (--argc < 1) goto bad;
- infile= *(++argv);
- }
- else if (strcmp(*argv,"-out") == 0)
- {
- if (--argc < 1) goto bad;
- outfile= *(++argv);
- }
- else if (strcmp(*argv,"-CApath") == 0)
- {
- if (--argc < 1) goto bad;
- CApath = *(++argv);
- do_ver = 1;
- }
- else if (strcmp(*argv,"-CAfile") == 0)
- {
- if (--argc < 1) goto bad;
- CAfile = *(++argv);
- do_ver = 1;
- }
- else if (strcmp(*argv,"-verify") == 0)
- do_ver = 1;
- else if (strcmp(*argv,"-text") == 0)
- text = 1;
- else if (strcmp(*argv,"-hash") == 0)
- hash= ++num;
+ if (strcmp(*argv, "-inform") == 0) {
+ if (--argc < 1)
+ goto bad;
+ informat = str2fmt(*(++argv));
+ } else if (strcmp(*argv, "-outform") == 0) {
+ if (--argc < 1)
+ goto bad;
+ outformat = str2fmt(*(++argv));
+ } else if (strcmp(*argv, "-in") == 0) {
+ if (--argc < 1)
+ goto bad;
+ infile = *(++argv);
+ } else if (strcmp(*argv, "-out") == 0) {
+ if (--argc < 1)
+ goto bad;
+ outfile = *(++argv);
+ } else if (strcmp(*argv, "-CApath") == 0) {
+ if (--argc < 1)
+ goto bad;
+ CApath = *(++argv);
+ do_ver = 1;
+ } else if (strcmp(*argv, "-CAfile") == 0) {
+ if (--argc < 1)
+ goto bad;
+ CAfile = *(++argv);
+ do_ver = 1;
+ } else if (strcmp(*argv, "-verify") == 0)
+ do_ver = 1;
+ else if (strcmp(*argv, "-text") == 0)
+ text = 1;
+ else if (strcmp(*argv, "-hash") == 0)
+ hash = ++num;
#ifndef OPENSSL_NO_MD5
- else if (strcmp(*argv,"-hash_old") == 0)
- hash_old= ++num;
+ else if (strcmp(*argv, "-hash_old") == 0)
+ hash_old = ++num;
#endif
- else if (strcmp(*argv,"-nameopt") == 0)
- {
- if (--argc < 1) goto bad;
- if (!set_name_ex(&nmflag, *(++argv))) goto bad;
- }
- else if (strcmp(*argv,"-issuer") == 0)
- issuer= ++num;
- else if (strcmp(*argv,"-lastupdate") == 0)
- lastupdate= ++num;
- else if (strcmp(*argv,"-nextupdate") == 0)
- nextupdate= ++num;
- else if (strcmp(*argv,"-noout") == 0)
- noout= ++num;
- else if (strcmp(*argv,"-fingerprint") == 0)
- fingerprint= ++num;
- else if (strcmp(*argv,"-crlnumber") == 0)
- crlnumber= ++num;
- else if ((md_alg=EVP_get_digestbyname(*argv + 1)))
- {
- /* ok */
- digest=md_alg;
- }
- else
- {
- BIO_printf(bio_err,"unknown option %s\n",*argv);
- badops=1;
- break;
- }
- argc--;
- argv++;
- }
+ else if (strcmp(*argv, "-nameopt") == 0) {
+ if (--argc < 1)
+ goto bad;
+ if (!set_name_ex(&nmflag, *(++argv)))
+ goto bad;
+ } else if (strcmp(*argv, "-issuer") == 0)
+ issuer = ++num;
+ else if (strcmp(*argv, "-lastupdate") == 0)
+ lastupdate = ++num;
+ else if (strcmp(*argv, "-nextupdate") == 0)
+ nextupdate = ++num;
+ else if (strcmp(*argv, "-noout") == 0)
+ noout = ++num;
+ else if (strcmp(*argv, "-fingerprint") == 0)
+ fingerprint = ++num;
+ else if (strcmp(*argv, "-crlnumber") == 0)
+ crlnumber = ++num;
+ else if ((md_alg = EVP_get_digestbyname(*argv + 1))) {
+ /* ok */
+ digest = md_alg;
+ } else {
+ BIO_printf(bio_err, "unknown option %s\n", *argv);
+ badops = 1;
+ break;
+ }
+ argc--;
+ argv++;
+ }
+
+ if (badops) {
+ bad:
+ for (pp = crl_usage; (*pp != NULL); pp++)
+ BIO_printf(bio_err, "%s", *pp);
+ goto end;
+ }
- if (badops)
- {
-bad:
- for (pp=crl_usage; (*pp != NULL); pp++)
- BIO_printf(bio_err,"%s",*pp);
- goto end;
- }
+ ERR_load_crypto_strings();
+ x = load_crl(infile, informat);
+ if (x == NULL) {
+ goto end;
+ }
- ERR_load_crypto_strings();
- x=load_crl(infile,informat);
- if (x == NULL) { goto end; }
+ if (do_ver) {
+ store = X509_STORE_new();
+ lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
+ if (lookup == NULL)
+ goto end;
+ if (!X509_LOOKUP_load_file(lookup, CAfile, X509_FILETYPE_PEM))
+ X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);
- if(do_ver) {
- store = X509_STORE_new();
- lookup=X509_STORE_add_lookup(store,X509_LOOKUP_file());
- if (lookup == NULL) goto end;
- if (!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM))
- X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
-
- lookup=X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir());
- if (lookup == NULL) goto end;
- if (!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM))
- X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
- ERR_clear_error();
+ lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
+ if (lookup == NULL)
+ goto end;
+ if (!X509_LOOKUP_add_dir(lookup, CApath, X509_FILETYPE_PEM))
+ X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
+ ERR_clear_error();
- if(!X509_STORE_CTX_init(&ctx, store, NULL, NULL)) {
- BIO_printf(bio_err,
- "Error initialising X509 store\n");
- goto end;
- }
+ if (!X509_STORE_CTX_init(&ctx, store, NULL, NULL)) {
+ BIO_printf(bio_err, "Error initialising X509 store\n");
+ goto end;
+ }
- i = X509_STORE_get_by_subject(&ctx, X509_LU_X509,
- X509_CRL_get_issuer(x), &xobj);
- if(i <= 0) {
- BIO_printf(bio_err,
- "Error getting CRL issuer certificate\n");
- goto end;
- }
- pkey = X509_get_pubkey(xobj.data.x509);
- X509_OBJECT_free_contents(&xobj);
- if(!pkey) {
- BIO_printf(bio_err,
- "Error getting CRL issuer public key\n");
- goto end;
- }
- i = X509_CRL_verify(x, pkey);
- EVP_PKEY_free(pkey);
- if(i < 0) goto end;
- if(i == 0) BIO_printf(bio_err, "verify failure\n");
- else BIO_printf(bio_err, "verify OK\n");
- }
+ i = X509_STORE_get_by_subject(&ctx, X509_LU_X509,
+ X509_CRL_get_issuer(x), &xobj);
+ if (i <= 0) {
+ BIO_printf(bio_err, "Error getting CRL issuer certificate\n");
+ goto end;
+ }
+ pkey = X509_get_pubkey(xobj.data.x509);
+ X509_OBJECT_free_contents(&xobj);
+ if (!pkey) {
+ BIO_printf(bio_err, "Error getting CRL issuer public key\n");
+ goto end;
+ }
+ i = X509_CRL_verify(x, pkey);
+ EVP_PKEY_free(pkey);
+ if (i < 0)
+ goto end;
+ if (i == 0)
+ BIO_printf(bio_err, "verify failure\n");
+ else
+ BIO_printf(bio_err, "verify OK\n");
+ }
- if (num)
- {
- for (i=1; i<=num; i++)
- {
- if (issuer == i)
- {
- print_name(bio_out, "issuer=", X509_CRL_get_issuer(x), nmflag);
- }
- if (crlnumber == i)
- {
- ASN1_INTEGER *crlnum;
- crlnum = X509_CRL_get_ext_d2i(x, NID_crl_number,
- NULL, NULL);
- BIO_printf(bio_out,"crlNumber=");
- if (crlnum)
- {
- i2a_ASN1_INTEGER(bio_out, crlnum);
- ASN1_INTEGER_free(crlnum);
- }
- else
- BIO_puts(bio_out, "<NONE>");
- BIO_printf(bio_out,"\n");
- }
- if (hash == i)
- {
- BIO_printf(bio_out,"%08lx\n",
- X509_NAME_hash(X509_CRL_get_issuer(x)));
- }
+ if (num) {
+ for (i = 1; i <= num; i++) {
+ if (issuer == i) {
+ print_name(bio_out, "issuer=", X509_CRL_get_issuer(x),
+ nmflag);
+ }
+ if (crlnumber == i) {
+ ASN1_INTEGER *crlnum;
+ crlnum = X509_CRL_get_ext_d2i(x, NID_crl_number, NULL, NULL);
+ BIO_printf(bio_out, "crlNumber=");
+ if (crlnum) {
+ i2a_ASN1_INTEGER(bio_out, crlnum);
+ ASN1_INTEGER_free(crlnum);
+ } else
+ BIO_puts(bio_out, "<NONE>");
+ BIO_printf(bio_out, "\n");
+ }
+ if (hash == i) {
+ BIO_printf(bio_out, "%08lx\n",
+ X509_NAME_hash(X509_CRL_get_issuer(x)));
+ }
#ifndef OPENSSL_NO_MD5
- if (hash_old == i)
- {
- BIO_printf(bio_out,"%08lx\n",
- X509_NAME_hash_old(
- X509_CRL_get_issuer(x)));
- }
+ if (hash_old == i) {
+ BIO_printf(bio_out, "%08lx\n",
+ X509_NAME_hash_old(X509_CRL_get_issuer(x)));
+ }
#endif
- if (lastupdate == i)
- {
- BIO_printf(bio_out,"lastUpdate=");
- ASN1_TIME_print(bio_out,
- X509_CRL_get_lastUpdate(x));
- BIO_printf(bio_out,"\n");
- }
- if (nextupdate == i)
- {
- BIO_printf(bio_out,"nextUpdate=");
- if (X509_CRL_get_nextUpdate(x))
- ASN1_TIME_print(bio_out,
- X509_CRL_get_nextUpdate(x));
- else
- BIO_printf(bio_out,"NONE");
- BIO_printf(bio_out,"\n");
- }
- if (fingerprint == i)
- {
- int j;
- unsigned int n;
- unsigned char md[EVP_MAX_MD_SIZE];
+ if (lastupdate == i) {
+ BIO_printf(bio_out, "lastUpdate=");
+ ASN1_TIME_print(bio_out, X509_CRL_get_lastUpdate(x));
+ BIO_printf(bio_out, "\n");
+ }
+ if (nextupdate == i) {
+ BIO_printf(bio_out, "nextUpdate=");
+ if (X509_CRL_get_nextUpdate(x))
+ ASN1_TIME_print(bio_out, X509_CRL_get_nextUpdate(x));
+ else
+ BIO_printf(bio_out, "NONE");
+ BIO_printf(bio_out, "\n");
+ }
+ if (fingerprint == i) {
+ int j;
+ unsigned int n;
+ unsigned char md[EVP_MAX_MD_SIZE];
- if (!X509_CRL_digest(x,digest,md,&n))
- {
- BIO_printf(bio_err,"out of memory\n");
- goto end;
- }
- BIO_printf(bio_out,"%s Fingerprint=",
- OBJ_nid2sn(EVP_MD_type(digest)));
- for (j=0; j<(int)n; j++)
- {
- BIO_printf(bio_out,"%02X%c",md[j],
- (j+1 == (int)n)
- ?'\n':':');
- }
- }
- }
- }
+ if (!X509_CRL_digest(x, digest, md, &n)) {
+ BIO_printf(bio_err, "out of memory\n");
+ goto end;
+ }
+ BIO_printf(bio_out, "%s Fingerprint=",
+ OBJ_nid2sn(EVP_MD_type(digest)));
+ for (j = 0; j < (int)n; j++) {
+ BIO_printf(bio_out, "%02X%c", md[j], (j + 1 == (int)n)
+ ? '\n' : ':');
+ }
+ }
+ }
+ }
- out=BIO_new(BIO_s_file());
- if (out == NULL)
- {
- ERR_print_errors(bio_err);
- goto end;
- }
+ out = BIO_new(BIO_s_file());
+ if (out == NULL) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
- if (outfile == NULL)
- {
- BIO_set_fp(out,stdout,BIO_NOCLOSE);
+ if (outfile == NULL) {
+ BIO_set_fp(out, stdout, BIO_NOCLOSE);
#ifdef OPENSSL_SYS_VMS
- {
- BIO *tmpbio = BIO_new(BIO_f_linebuffer());
- out = BIO_push(tmpbio, out);
- }
+ {
+ BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+ out = BIO_push(tmpbio, out);
+ }
#endif
- }
- else
- {
- if (BIO_write_filename(out,outfile) <= 0)
- {
- perror(outfile);
- goto end;
- }
- }
+ } else {
+ if (BIO_write_filename(out, outfile) <= 0) {
+ perror(outfile);
+ goto end;
+ }
+ }
- if (text) X509_CRL_print(out, x);
+ if (text)
+ X509_CRL_print(out, x);
- if (noout)
- {
- ret = 0;
- goto end;
- }
+ if (noout) {
+ ret = 0;
+ goto end;
+ }
- if (outformat == FORMAT_ASN1)
- i=(int)i2d_X509_CRL_bio(out,x);
- else if (outformat == FORMAT_PEM)
- i=PEM_write_bio_X509_CRL(out,x);
- else
- {
- BIO_printf(bio_err,"bad output format specified for outfile\n");
- goto end;
- }
- if (!i) { BIO_printf(bio_err,"unable to write CRL\n"); goto end; }
- ret=0;
-end:
- BIO_free_all(out);
- BIO_free_all(bio_out);
- bio_out=NULL;
- X509_CRL_free(x);
- if(store) {
- X509_STORE_CTX_cleanup(&ctx);
- X509_STORE_free(store);
- }
- apps_shutdown();
- OPENSSL_EXIT(ret);
- }
+ if (outformat == FORMAT_ASN1)
+ i = (int)i2d_X509_CRL_bio(out, x);
+ else if (outformat == FORMAT_PEM)
+ i = PEM_write_bio_X509_CRL(out, x);
+ else {
+ BIO_printf(bio_err, "bad output format specified for outfile\n");
+ goto end;
+ }
+ if (!i) {
+ BIO_printf(bio_err, "unable to write CRL\n");
+ goto end;
+ }
+ ret = 0;
+ end:
+ BIO_free_all(out);
+ BIO_free_all(bio_out);
+ bio_out = NULL;
+ X509_CRL_free(x);
+ if (store) {
+ X509_STORE_CTX_cleanup(&ctx);
+ X509_STORE_free(store);
+ }
+ apps_shutdown();
+ OPENSSL_EXIT(ret);
+}
static X509_CRL *load_crl(char *infile, int format)
- {
- X509_CRL *x=NULL;
- BIO *in=NULL;
+{
+ X509_CRL *x = NULL;
+ BIO *in = NULL;
- in=BIO_new(BIO_s_file());
- if (in == NULL)
- {
- ERR_print_errors(bio_err);
- goto end;
- }
+ in = BIO_new(BIO_s_file());
+ if (in == NULL) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
- if (infile == NULL)
- BIO_set_fp(in,stdin,BIO_NOCLOSE);
- else
- {
- if (BIO_read_filename(in,infile) <= 0)
- {
- perror(infile);
- goto end;
- }
- }
- if (format == FORMAT_ASN1)
- x=d2i_X509_CRL_bio(in,NULL);
- else if (format == FORMAT_PEM)
- x=PEM_read_bio_X509_CRL(in,NULL,NULL,NULL);
- else {
- BIO_printf(bio_err,"bad input format specified for input crl\n");
- goto end;
- }
- if (x == NULL)
- {
- BIO_printf(bio_err,"unable to load CRL\n");
- ERR_print_errors(bio_err);
- goto end;
- }
-
-end:
- BIO_free(in);
- return(x);
- }
+ if (infile == NULL)
+ BIO_set_fp(in, stdin, BIO_NOCLOSE);
+ else {
+ if (BIO_read_filename(in, infile) <= 0) {
+ perror(infile);
+ goto end;
+ }
+ }
+ if (format == FORMAT_ASN1)
+ x = d2i_X509_CRL_bio(in, NULL);
+ else if (format == FORMAT_PEM)
+ x = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
+ else {
+ BIO_printf(bio_err, "bad input format specified for input crl\n");
+ goto end;
+ }
+ if (x == NULL) {
+ BIO_printf(bio_err, "unable to load CRL\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ end:
+ BIO_free(in);
+ return (x);
+}
diff --git a/apps/crl2p7.c b/apps/crl2p7.c
index 42c6886b83f8..0763817e617b 100644
--- a/apps/crl2p7.c
+++ b/apps/crl2p7.c
@@ -5,21 +5,21 @@
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -34,10 +34,10 @@
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -49,16 +49,18 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
-/* This was written by Gordon Chaffee <chaffee@plateau.cs.berkeley.edu>
- * and donated 'to the cause' along with lots and lots of other fixes to
- * the library. */
+/*
+ * This was written by Gordon Chaffee <chaffee@plateau.cs.berkeley.edu> and
+ * donated 'to the cause' along with lots and lots of other fixes to the
+ * library.
+ */
#include <stdio.h>
#include <string.h>
@@ -73,271 +75,260 @@
static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile);
#undef PROG
-#define PROG crl2pkcs7_main
+#define PROG crl2pkcs7_main
-/* -inform arg - input format - default PEM (DER or PEM)
+/*-
+ * -inform arg - input format - default PEM (DER or PEM)
* -outform arg - output format - default PEM
- * -in arg - input file - default stdin
- * -out arg - output file - default stdout
+ * -in arg - input file - default stdin
+ * -out arg - output file - default stdout
*/
int MAIN(int, char **);
int MAIN(int argc, char **argv)
- {
- int i,badops=0;
- BIO *in=NULL,*out=NULL;
- int informat,outformat;
- char *infile,*outfile,*prog,*certfile;
- PKCS7 *p7 = NULL;
- PKCS7_SIGNED *p7s = NULL;
- X509_CRL *crl=NULL;
- STACK_OF(OPENSSL_STRING) *certflst=NULL;
- STACK_OF(X509_CRL) *crl_stack=NULL;
- STACK_OF(X509) *cert_stack=NULL;
- int ret=1,nocrl=0;
+{
+ int i, badops = 0;
+ BIO *in = NULL, *out = NULL;
+ int informat, outformat;
+ char *infile, *outfile, *prog, *certfile;
+ PKCS7 *p7 = NULL;
+ PKCS7_SIGNED *p7s = NULL;
+ X509_CRL *crl = NULL;
+ STACK_OF(OPENSSL_STRING) *certflst = NULL;
+ STACK_OF(X509_CRL) *crl_stack = NULL;
+ STACK_OF(X509) *cert_stack = NULL;
+ int ret = 1, nocrl = 0;
+
+ apps_startup();
- apps_startup();
+ if (bio_err == NULL)
+ if ((bio_err = BIO_new(BIO_s_file())) != NULL)
+ BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
- if (bio_err == NULL)
- if ((bio_err=BIO_new(BIO_s_file())) != NULL)
- BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
+ infile = NULL;
+ outfile = NULL;
+ informat = FORMAT_PEM;
+ outformat = FORMAT_PEM;
- infile=NULL;
- outfile=NULL;
- informat=FORMAT_PEM;
- outformat=FORMAT_PEM;
+ prog = argv[0];
+ argc--;
+ argv++;
+ while (argc >= 1) {
+ if (strcmp(*argv, "-inform") == 0) {
+ if (--argc < 1)
+ goto bad;
+ informat = str2fmt(*(++argv));
+ } else if (strcmp(*argv, "-outform") == 0) {
+ if (--argc < 1)
+ goto bad;
+ outformat = str2fmt(*(++argv));
+ } else if (strcmp(*argv, "-in") == 0) {
+ if (--argc < 1)
+ goto bad;
+ infile = *(++argv);
+ } else if (strcmp(*argv, "-nocrl") == 0) {
+ nocrl = 1;
+ } else if (strcmp(*argv, "-out") == 0) {
+ if (--argc < 1)
+ goto bad;
+ outfile = *(++argv);
+ } else if (strcmp(*argv, "-certfile") == 0) {
+ if (--argc < 1)
+ goto bad;
+ if (!certflst)
+ certflst = sk_OPENSSL_STRING_new_null();
+ if (!certflst)
+ goto end;
+ if (!sk_OPENSSL_STRING_push(certflst, *(++argv))) {
+ sk_OPENSSL_STRING_free(certflst);
+ goto end;
+ }
+ } else {
+ BIO_printf(bio_err, "unknown option %s\n", *argv);
+ badops = 1;
+ break;
+ }
+ argc--;
+ argv++;
+ }
- prog=argv[0];
- argc--;
- argv++;
- while (argc >= 1)
- {
- if (strcmp(*argv,"-inform") == 0)
- {
- if (--argc < 1) goto bad;
- informat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-outform") == 0)
- {
- if (--argc < 1) goto bad;
- outformat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-in") == 0)
- {
- if (--argc < 1) goto bad;
- infile= *(++argv);
- }
- else if (strcmp(*argv,"-nocrl") == 0)
- {
- nocrl=1;
- }
- else if (strcmp(*argv,"-out") == 0)
- {
- if (--argc < 1) goto bad;
- outfile= *(++argv);
- }
- else if (strcmp(*argv,"-certfile") == 0)
- {
- if (--argc < 1) goto bad;
- if(!certflst) certflst = sk_OPENSSL_STRING_new_null();
- if (!certflst)
- goto end;
- if (!sk_OPENSSL_STRING_push(certflst,*(++argv)))
- {
- sk_OPENSSL_STRING_free(certflst);
- goto end;
- }
- }
- else
- {
- BIO_printf(bio_err,"unknown option %s\n",*argv);
- badops=1;
- break;
- }
- argc--;
- argv++;
- }
+ if (badops) {
+ bad:
+ BIO_printf(bio_err, "%s [options] <infile >outfile\n", prog);
+ BIO_printf(bio_err, "where options are\n");
+ BIO_printf(bio_err, " -inform arg input format - DER or PEM\n");
+ BIO_printf(bio_err, " -outform arg output format - DER or PEM\n");
+ BIO_printf(bio_err, " -in arg input file\n");
+ BIO_printf(bio_err, " -out arg output file\n");
+ BIO_printf(bio_err,
+ " -certfile arg certificates file of chain to a trusted CA\n");
+ BIO_printf(bio_err, " (can be used more than once)\n");
+ BIO_printf(bio_err,
+ " -nocrl no crl to load, just certs from '-certfile'\n");
+ ret = 1;
+ goto end;
+ }
- if (badops)
- {
-bad:
- BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
- BIO_printf(bio_err,"where options are\n");
- BIO_printf(bio_err," -inform arg input format - DER or PEM\n");
- BIO_printf(bio_err," -outform arg output format - DER or PEM\n");
- BIO_printf(bio_err," -in arg input file\n");
- BIO_printf(bio_err," -out arg output file\n");
- BIO_printf(bio_err," -certfile arg certificates file of chain to a trusted CA\n");
- BIO_printf(bio_err," (can be used more than once)\n");
- BIO_printf(bio_err," -nocrl no crl to load, just certs from '-certfile'\n");
- ret = 1;
- goto end;
- }
+ ERR_load_crypto_strings();
- ERR_load_crypto_strings();
+ in = BIO_new(BIO_s_file());
+ out = BIO_new(BIO_s_file());
+ if ((in == NULL) || (out == NULL)) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
- in=BIO_new(BIO_s_file());
- out=BIO_new(BIO_s_file());
- if ((in == NULL) || (out == NULL))
- {
- ERR_print_errors(bio_err);
- goto end;
- }
+ if (!nocrl) {
+ if (infile == NULL)
+ BIO_set_fp(in, stdin, BIO_NOCLOSE);
+ else {
+ if (BIO_read_filename(in, infile) <= 0) {
+ perror(infile);
+ goto end;
+ }
+ }
- if (!nocrl)
- {
- if (infile == NULL)
- BIO_set_fp(in,stdin,BIO_NOCLOSE);
- else
- {
- if (BIO_read_filename(in,infile) <= 0)
- {
- perror(infile);
- goto end;
- }
- }
+ if (informat == FORMAT_ASN1)
+ crl = d2i_X509_CRL_bio(in, NULL);
+ else if (informat == FORMAT_PEM)
+ crl = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
+ else {
+ BIO_printf(bio_err, "bad input format specified for input crl\n");
+ goto end;
+ }
+ if (crl == NULL) {
+ BIO_printf(bio_err, "unable to load CRL\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
- if (informat == FORMAT_ASN1)
- crl=d2i_X509_CRL_bio(in,NULL);
- else if (informat == FORMAT_PEM)
- crl=PEM_read_bio_X509_CRL(in,NULL,NULL,NULL);
- else {
- BIO_printf(bio_err,"bad input format specified for input crl\n");
- goto end;
- }
- if (crl == NULL)
- {
- BIO_printf(bio_err,"unable to load CRL\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-
- if ((p7=PKCS7_new()) == NULL) goto end;
- if ((p7s=PKCS7_SIGNED_new()) == NULL) goto end;
- p7->type=OBJ_nid2obj(NID_pkcs7_signed);
- p7->d.sign=p7s;
- p7s->contents->type=OBJ_nid2obj(NID_pkcs7_data);
+ if ((p7 = PKCS7_new()) == NULL)
+ goto end;
+ if ((p7s = PKCS7_SIGNED_new()) == NULL)
+ goto end;
+ p7->type = OBJ_nid2obj(NID_pkcs7_signed);
+ p7->d.sign = p7s;
+ p7s->contents->type = OBJ_nid2obj(NID_pkcs7_data);
- if (!ASN1_INTEGER_set(p7s->version,1)) goto end;
- if ((crl_stack=sk_X509_CRL_new_null()) == NULL) goto end;
- p7s->crl=crl_stack;
- if (crl != NULL)
- {
- sk_X509_CRL_push(crl_stack,crl);
- crl=NULL; /* now part of p7 for OPENSSL_freeing */
- }
+ if (!ASN1_INTEGER_set(p7s->version, 1))
+ goto end;
+ if ((crl_stack = sk_X509_CRL_new_null()) == NULL)
+ goto end;
+ p7s->crl = crl_stack;
+ if (crl != NULL) {
+ sk_X509_CRL_push(crl_stack, crl);
+ crl = NULL; /* now part of p7 for OPENSSL_freeing */
+ }
- if ((cert_stack=sk_X509_new_null()) == NULL) goto end;
- p7s->cert=cert_stack;
+ if ((cert_stack = sk_X509_new_null()) == NULL)
+ goto end;
+ p7s->cert = cert_stack;
- if(certflst) for(i = 0; i < sk_OPENSSL_STRING_num(certflst); i++) {
- certfile = sk_OPENSSL_STRING_value(certflst, i);
- if (add_certs_from_file(cert_stack,certfile) < 0)
- {
- BIO_printf(bio_err, "error loading certificates\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
+ if (certflst)
+ for (i = 0; i < sk_OPENSSL_STRING_num(certflst); i++) {
+ certfile = sk_OPENSSL_STRING_value(certflst, i);
+ if (add_certs_from_file(cert_stack, certfile) < 0) {
+ BIO_printf(bio_err, "error loading certificates\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
- sk_OPENSSL_STRING_free(certflst);
+ sk_OPENSSL_STRING_free(certflst);
- if (outfile == NULL)
- {
- BIO_set_fp(out,stdout,BIO_NOCLOSE);
+ if (outfile == NULL) {
+ BIO_set_fp(out, stdout, BIO_NOCLOSE);
#ifdef OPENSSL_SYS_VMS
- {
- BIO *tmpbio = BIO_new(BIO_f_linebuffer());
- out = BIO_push(tmpbio, out);
- }
+ {
+ BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+ out = BIO_push(tmpbio, out);
+ }
#endif
- }
- else
- {
- if (BIO_write_filename(out,outfile) <= 0)
- {
- perror(outfile);
- goto end;
- }
- }
+ } else {
+ if (BIO_write_filename(out, outfile) <= 0) {
+ perror(outfile);
+ goto end;
+ }
+ }
- if (outformat == FORMAT_ASN1)
- i=i2d_PKCS7_bio(out,p7);
- else if (outformat == FORMAT_PEM)
- i=PEM_write_bio_PKCS7(out,p7);
- else {
- BIO_printf(bio_err,"bad output format specified for outfile\n");
- goto end;
- }
- if (!i)
- {
- BIO_printf(bio_err,"unable to write pkcs7 object\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- ret=0;
-end:
- if (in != NULL) BIO_free(in);
- if (out != NULL) BIO_free_all(out);
- if (p7 != NULL) PKCS7_free(p7);
- if (crl != NULL) X509_CRL_free(crl);
+ if (outformat == FORMAT_ASN1)
+ i = i2d_PKCS7_bio(out, p7);
+ else if (outformat == FORMAT_PEM)
+ i = PEM_write_bio_PKCS7(out, p7);
+ else {
+ BIO_printf(bio_err, "bad output format specified for outfile\n");
+ goto end;
+ }
+ if (!i) {
+ BIO_printf(bio_err, "unable to write pkcs7 object\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ ret = 0;
+ end:
+ if (in != NULL)
+ BIO_free(in);
+ if (out != NULL)
+ BIO_free_all(out);
+ if (p7 != NULL)
+ PKCS7_free(p7);
+ if (crl != NULL)
+ X509_CRL_free(crl);
- apps_shutdown();
- OPENSSL_EXIT(ret);
- }
+ apps_shutdown();
+ OPENSSL_EXIT(ret);
+}
-/*
+/*-
*----------------------------------------------------------------------
* int add_certs_from_file
*
- * Read a list of certificates to be checked from a file.
+ * Read a list of certificates to be checked from a file.
*
* Results:
- * number of certs added if successful, -1 if not.
+ * number of certs added if successful, -1 if not.
*----------------------------------------------------------------------
*/
static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile)
- {
- BIO *in=NULL;
- int count=0;
- int ret= -1;
- STACK_OF(X509_INFO) *sk=NULL;
- X509_INFO *xi;
-
- in=BIO_new(BIO_s_file());
- if ((in == NULL) || (BIO_read_filename(in,certfile) <= 0))
- {
- BIO_printf(bio_err,"error opening the file, %s\n",certfile);
- goto end;
- }
+{
+ BIO *in = NULL;
+ int count = 0;
+ int ret = -1;
+ STACK_OF(X509_INFO) *sk = NULL;
+ X509_INFO *xi;
- /* This loads from a file, a stack of x509/crl/pkey sets */
- sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL);
- if (sk == NULL) {
- BIO_printf(bio_err,"error reading the file, %s\n",certfile);
- goto end;
- }
+ in = BIO_new(BIO_s_file());
+ if ((in == NULL) || (BIO_read_filename(in, certfile) <= 0)) {
+ BIO_printf(bio_err, "error opening the file, %s\n", certfile);
+ goto end;
+ }
- /* scan over it and pull out the CRL's */
- while (sk_X509_INFO_num(sk))
- {
- xi=sk_X509_INFO_shift(sk);
- if (xi->x509 != NULL)
- {
- sk_X509_push(stack,xi->x509);
- xi->x509=NULL;
- count++;
- }
- X509_INFO_free(xi);
- }
+ /* This loads from a file, a stack of x509/crl/pkey sets */
+ sk = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL);
+ if (sk == NULL) {
+ BIO_printf(bio_err, "error reading the file, %s\n", certfile);
+ goto end;
+ }
- ret=count;
-end:
- /* never need to OPENSSL_free x */
- if (in != NULL) BIO_free(in);
- if (sk != NULL) sk_X509_INFO_free(sk);
- return(ret);
- }
+ /* scan over it and pull out the CRL's */
+ while (sk_X509_INFO_num(sk)) {
+ xi = sk_X509_INFO_shift(sk);
+ if (xi->x509 != NULL) {
+ sk_X509_push(stack, xi->x509);
+ xi->x509 = NULL;
+ count++;
+ }
+ X509_INFO_free(xi);
+ }
+ ret = count;
+ end:
+ /* never need to OPENSSL_free x */
+ if (in != NULL)
+ BIO_free(in);
+ if (sk != NULL)
+ sk_X509_INFO_free(sk);
+ return (ret);
+}
diff --git a/apps/dgst.c b/apps/dgst.c
index e31a6b182eb8..ad2f2348ac09 100644
--- a/apps/dgst.c
+++ b/apps/dgst.c
@@ -5,21 +5,21 @@
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -34,10 +34,10 @@
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -49,7 +49,7 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
@@ -69,578 +69,530 @@
#include <openssl/hmac.h>
#undef BUFSIZE
-#define BUFSIZE 1024*8
+#define BUFSIZE 1024*8
#undef PROG
-#define PROG dgst_main
+#define PROG dgst_main
int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
- EVP_PKEY *key, unsigned char *sigin, int siglen,
- const char *sig_name, const char *md_name,
- const char *file,BIO *bmd);
+ EVP_PKEY *key, unsigned char *sigin, int siglen,
+ const char *sig_name, const char *md_name,
+ const char *file, BIO *bmd);
static void list_md_fn(const EVP_MD *m,
- const char *from, const char *to, void *arg)
- {
- const char *mname;
- /* Skip aliases */
- if (!m)
- return;
- mname = OBJ_nid2ln(EVP_MD_type(m));
- /* Skip shortnames */
- if (strcmp(from, mname))
- return;
- /* Skip clones */
- if (EVP_MD_flags(m) & EVP_MD_FLAG_PKEY_DIGEST)
- return;
- if (strchr(mname, ' '))
- mname= EVP_MD_name(m);
- BIO_printf(arg, "-%-14s to use the %s message digest algorithm\n",
- mname, mname);
- }
+ const char *from, const char *to, void *arg)
+{
+ const char *mname;
+ /* Skip aliases */
+ if (!m)
+ return;
+ mname = OBJ_nid2ln(EVP_MD_type(m));
+ /* Skip shortnames */
+ if (strcmp(from, mname))
+ return;
+ /* Skip clones */
+ if (EVP_MD_flags(m) & EVP_MD_FLAG_PKEY_DIGEST)
+ return;
+ if (strchr(mname, ' '))
+ mname = EVP_MD_name(m);
+ BIO_printf(arg, "-%-14s to use the %s message digest algorithm\n",
+ mname, mname);
+}
int MAIN(int, char **);
int MAIN(int argc, char **argv)
- {
- ENGINE *e = NULL;
- unsigned char *buf=NULL;
- int i,err=1;
- const EVP_MD *md=NULL,*m;
- BIO *in=NULL,*inp;
- BIO *bmd=NULL;
- BIO *out = NULL;
+{
+ ENGINE *e = NULL;
+ unsigned char *buf = NULL;
+ int i, err = 1;
+ const EVP_MD *md = NULL, *m;
+ BIO *in = NULL, *inp;
+ BIO *bmd = NULL;
+ BIO *out = NULL;
#define PROG_NAME_SIZE 39
- char pname[PROG_NAME_SIZE+1];
- int separator=0;
- int debug=0;
- int keyform=FORMAT_PEM;
- const char *outfile = NULL, *keyfile = NULL;
- const char *sigfile = NULL, *randfile = NULL;
- int out_bin = -1, want_pub = 0, do_verify = 0;
- EVP_PKEY *sigkey = NULL;
- unsigned char *sigbuf = NULL;
- int siglen = 0;
- char *passargin = NULL, *passin = NULL;
+ char pname[PROG_NAME_SIZE + 1];
+ int separator = 0;
+ int debug = 0;
+ int keyform = FORMAT_PEM;
+ const char *outfile = NULL, *keyfile = NULL;
+ const char *sigfile = NULL, *randfile = NULL;
+ int out_bin = -1, want_pub = 0, do_verify = 0;
+ EVP_PKEY *sigkey = NULL;
+ unsigned char *sigbuf = NULL;
+ int siglen = 0;
+ char *passargin = NULL, *passin = NULL;
#ifndef OPENSSL_NO_ENGINE
- char *engine=NULL;
+ char *engine = NULL;
#endif
- char *hmac_key=NULL;
- char *mac_name=NULL;
- int non_fips_allow = 0;
- STACK_OF(OPENSSL_STRING) *sigopts = NULL, *macopts = NULL;
-
- apps_startup();
-
- if ((buf=(unsigned char *)OPENSSL_malloc(BUFSIZE)) == NULL)
- {
- BIO_printf(bio_err,"out of memory\n");
- goto end;
- }
- if (bio_err == NULL)
- if ((bio_err=BIO_new(BIO_s_file())) != NULL)
- BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
-
- if (!load_config(bio_err, NULL))
- goto end;
-
- /* first check the program name */
- program_name(argv[0],pname,sizeof pname);
-
- md=EVP_get_digestbyname(pname);
-
- argc--;
- argv++;
- while (argc > 0)
- {
- if ((*argv)[0] != '-') break;
- if (strcmp(*argv,"-c") == 0)
- separator=1;
- else if (strcmp(*argv,"-r") == 0)
- separator=2;
- else if (strcmp(*argv,"-rand") == 0)
- {
- if (--argc < 1) break;
- randfile=*(++argv);
- }
- else if (strcmp(*argv,"-out") == 0)
- {
- if (--argc < 1) break;
- outfile=*(++argv);
- }
- else if (strcmp(*argv,"-sign") == 0)
- {
- if (--argc < 1) break;
- keyfile=*(++argv);
- }
- else if (!strcmp(*argv,"-passin"))
- {
- if (--argc < 1)
- break;
- passargin=*++argv;
- }
- else if (strcmp(*argv,"-verify") == 0)
- {
- if (--argc < 1) break;
- keyfile=*(++argv);
- want_pub = 1;
- do_verify = 1;
- }
- else if (strcmp(*argv,"-prverify") == 0)
- {
- if (--argc < 1) break;
- keyfile=*(++argv);
- do_verify = 1;
- }
- else if (strcmp(*argv,"-signature") == 0)
- {
- if (--argc < 1) break;
- sigfile=*(++argv);
- }
- else if (strcmp(*argv,"-keyform") == 0)
- {
- if (--argc < 1) break;
- keyform=str2fmt(*(++argv));
- }
+ char *hmac_key = NULL;
+ char *mac_name = NULL;
+ int non_fips_allow = 0;
+ STACK_OF(OPENSSL_STRING) *sigopts = NULL, *macopts = NULL;
+
+ apps_startup();
+
+ if ((buf = (unsigned char *)OPENSSL_malloc(BUFSIZE)) == NULL) {
+ BIO_printf(bio_err, "out of memory\n");
+ goto end;
+ }
+ if (bio_err == NULL)
+ if ((bio_err = BIO_new(BIO_s_file())) != NULL)
+ BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
+
+ if (!load_config(bio_err, NULL))
+ goto end;
+
+ /* first check the program name */
+ program_name(argv[0], pname, sizeof pname);
+
+ md = EVP_get_digestbyname(pname);
+
+ argc--;
+ argv++;
+ while (argc > 0) {
+ if ((*argv)[0] != '-')
+ break;
+ if (strcmp(*argv, "-c") == 0)
+ separator = 1;
+ else if (strcmp(*argv, "-r") == 0)
+ separator = 2;
+ else if (strcmp(*argv, "-rand") == 0) {
+ if (--argc < 1)
+ break;
+ randfile = *(++argv);
+ } else if (strcmp(*argv, "-out") == 0) {
+ if (--argc < 1)
+ break;
+ outfile = *(++argv);
+ } else if (strcmp(*argv, "-sign") == 0) {
+ if (--argc < 1)
+ break;
+ keyfile = *(++argv);
+ } else if (!strcmp(*argv, "-passin")) {
+ if (--argc < 1)
+ break;
+ passargin = *++argv;
+ } else if (strcmp(*argv, "-verify") == 0) {
+ if (--argc < 1)
+ break;
+ keyfile = *(++argv);
+ want_pub = 1;
+ do_verify = 1;
+ } else if (strcmp(*argv, "-prverify") == 0) {
+ if (--argc < 1)
+ break;
+ keyfile = *(++argv);
+ do_verify = 1;
+ } else if (strcmp(*argv, "-signature") == 0) {
+ if (--argc < 1)
+ break;
+ sigfile = *(++argv);
+ } else if (strcmp(*argv, "-keyform") == 0) {
+ if (--argc < 1)
+ break;
+ keyform = str2fmt(*(++argv));
+ }
#ifndef OPENSSL_NO_ENGINE
- else if (strcmp(*argv,"-engine") == 0)
- {
- if (--argc < 1) break;
- engine= *(++argv);
- e = setup_engine(bio_err, engine, 0);
- }
+ else if (strcmp(*argv, "-engine") == 0) {
+ if (--argc < 1)
+ break;
+ engine = *(++argv);
+ e = setup_engine(bio_err, engine, 0);
+ }
#endif
- else if (strcmp(*argv,"-hex") == 0)
- out_bin = 0;
- else if (strcmp(*argv,"-binary") == 0)
- out_bin = 1;
- else if (strcmp(*argv,"-d") == 0)
- debug=1;
- else if (!strcmp(*argv,"-fips-fingerprint"))
- hmac_key = "etaonrishdlcupfm";
- else if (strcmp(*argv,"-non-fips-allow") == 0)
- non_fips_allow=1;
- else if (!strcmp(*argv,"-hmac"))
- {
- if (--argc < 1)
- break;
- hmac_key=*++argv;
- }
- else if (!strcmp(*argv,"-mac"))
- {
- if (--argc < 1)
- break;
- mac_name=*++argv;
- }
- else if (strcmp(*argv,"-sigopt") == 0)
- {
- if (--argc < 1)
- break;
- if (!sigopts)
- sigopts = sk_OPENSSL_STRING_new_null();
- if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, *(++argv)))
- break;
- }
- else if (strcmp(*argv,"-macopt") == 0)
- {
- if (--argc < 1)
- break;
- if (!macopts)
- macopts = sk_OPENSSL_STRING_new_null();
- if (!macopts || !sk_OPENSSL_STRING_push(macopts, *(++argv)))
- break;
- }
- else if ((m=EVP_get_digestbyname(&((*argv)[1]))) != NULL)
- md=m;
- else
- break;
- argc--;
- argv++;
- }
-
-
- if(do_verify && !sigfile) {
- BIO_printf(bio_err, "No signature to verify: use the -signature option\n");
- goto end;
- }
-
- if ((argc > 0) && (argv[0][0] == '-')) /* bad option */
- {
- BIO_printf(bio_err,"unknown option '%s'\n",*argv);
- BIO_printf(bio_err,"options are\n");
- BIO_printf(bio_err,"-c to output the digest with separating colons\n");
- BIO_printf(bio_err,"-r to output the digest in coreutils format\n");
- BIO_printf(bio_err,"-d to output debug info\n");
- BIO_printf(bio_err,"-hex output as hex dump\n");
- BIO_printf(bio_err,"-binary output in binary form\n");
- BIO_printf(bio_err,"-hmac arg set the HMAC key to arg\n");
- BIO_printf(bio_err,"-non-fips-allow allow use of non FIPS digest\n");
- BIO_printf(bio_err,"-sign file sign digest using private key in file\n");
- BIO_printf(bio_err,"-verify file verify a signature using public key in file\n");
- BIO_printf(bio_err,"-prverify file verify a signature using private key in file\n");
- BIO_printf(bio_err,"-keyform arg key file format (PEM or ENGINE)\n");
- BIO_printf(bio_err,"-out filename output to filename rather than stdout\n");
- BIO_printf(bio_err,"-signature file signature to verify\n");
- BIO_printf(bio_err,"-sigopt nm:v signature parameter\n");
- BIO_printf(bio_err,"-hmac key create hashed MAC with key\n");
- BIO_printf(bio_err,"-mac algorithm create MAC (not neccessarily HMAC)\n");
- BIO_printf(bio_err,"-macopt nm:v MAC algorithm parameters or key\n");
+ else if (strcmp(*argv, "-hex") == 0)
+ out_bin = 0;
+ else if (strcmp(*argv, "-binary") == 0)
+ out_bin = 1;
+ else if (strcmp(*argv, "-d") == 0)
+ debug = 1;
+ else if (!strcmp(*argv, "-fips-fingerprint"))
+ hmac_key = "etaonrishdlcupfm";
+ else if (strcmp(*argv, "-non-fips-allow") == 0)
+ non_fips_allow = 1;
+ else if (!strcmp(*argv, "-hmac")) {
+ if (--argc < 1)
+ break;
+ hmac_key = *++argv;
+ } else if (!strcmp(*argv, "-mac")) {
+ if (--argc < 1)
+ break;
+ mac_name = *++argv;
+ } else if (strcmp(*argv, "-sigopt") == 0) {
+ if (--argc < 1)
+ break;
+ if (!sigopts)
+ sigopts = sk_OPENSSL_STRING_new_null();
+ if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, *(++argv)))
+ break;
+ } else if (strcmp(*argv, "-macopt") == 0) {
+ if (--argc < 1)
+ break;
+ if (!macopts)
+ macopts = sk_OPENSSL_STRING_new_null();
+ if (!macopts || !sk_OPENSSL_STRING_push(macopts, *(++argv)))
+ break;
+ } else if ((m = EVP_get_digestbyname(&((*argv)[1]))) != NULL)
+ md = m;
+ else
+ break;
+ argc--;
+ argv++;
+ }
+
+ if (do_verify && !sigfile) {
+ BIO_printf(bio_err,
+ "No signature to verify: use the -signature option\n");
+ goto end;
+ }
+
+ if ((argc > 0) && (argv[0][0] == '-')) { /* bad option */
+ BIO_printf(bio_err, "unknown option '%s'\n", *argv);
+ BIO_printf(bio_err, "options are\n");
+ BIO_printf(bio_err,
+ "-c to output the digest with separating colons\n");
+ BIO_printf(bio_err,
+ "-r to output the digest in coreutils format\n");
+ BIO_printf(bio_err, "-d to output debug info\n");
+ BIO_printf(bio_err, "-hex output as hex dump\n");
+ BIO_printf(bio_err, "-binary output in binary form\n");
+ BIO_printf(bio_err, "-hmac arg set the HMAC key to arg\n");
+ BIO_printf(bio_err, "-non-fips-allow allow use of non FIPS digest\n");
+ BIO_printf(bio_err,
+ "-sign file sign digest using private key in file\n");
+ BIO_printf(bio_err,
+ "-verify file verify a signature using public key in file\n");
+ BIO_printf(bio_err,
+ "-prverify file verify a signature using private key in file\n");
+ BIO_printf(bio_err,
+ "-keyform arg key file format (PEM or ENGINE)\n");
+ BIO_printf(bio_err,
+ "-out filename output to filename rather than stdout\n");
+ BIO_printf(bio_err, "-signature file signature to verify\n");
+ BIO_printf(bio_err, "-sigopt nm:v signature parameter\n");
+ BIO_printf(bio_err, "-hmac key create hashed MAC with key\n");
+ BIO_printf(bio_err,
+ "-mac algorithm create MAC (not neccessarily HMAC)\n");
+ BIO_printf(bio_err,
+ "-macopt nm:v MAC algorithm parameters or key\n");
#ifndef OPENSSL_NO_ENGINE
- BIO_printf(bio_err,"-engine e use engine e, possibly a hardware device.\n");
+ BIO_printf(bio_err,
+ "-engine e use engine e, possibly a hardware device.\n");
#endif
- EVP_MD_do_all_sorted(list_md_fn, bio_err);
- goto end;
- }
-
- in=BIO_new(BIO_s_file());
- bmd=BIO_new(BIO_f_md());
- if (debug)
- {
- BIO_set_callback(in,BIO_debug_callback);
- /* needed for windows 3.1 */
- BIO_set_callback_arg(in,(char *)bio_err);
- }
-
- if(!app_passwd(bio_err, passargin, NULL, &passin, NULL))
- {
- BIO_printf(bio_err, "Error getting password\n");
- goto end;
- }
-
- if ((in == NULL) || (bmd == NULL))
- {
- ERR_print_errors(bio_err);
- goto end;
- }
-
- if(out_bin == -1) {
- if(keyfile)
- out_bin = 1;
- else
- out_bin = 0;
- }
-
- if(randfile)
- app_RAND_load_file(randfile, bio_err, 0);
-
- if(outfile) {
- if(out_bin)
- out = BIO_new_file(outfile, "wb");
- else out = BIO_new_file(outfile, "w");
- } else {
- out = BIO_new_fp(stdout, BIO_NOCLOSE);
+ EVP_MD_do_all_sorted(list_md_fn, bio_err);
+ goto end;
+ }
+
+ in = BIO_new(BIO_s_file());
+ bmd = BIO_new(BIO_f_md());
+ if ((in == NULL) || (bmd == NULL)) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
+ if (debug) {
+ BIO_set_callback(in, BIO_debug_callback);
+ /* needed for windows 3.1 */
+ BIO_set_callback_arg(in, (char *)bio_err);
+ }
+
+ if (!app_passwd(bio_err, passargin, NULL, &passin, NULL)) {
+ BIO_printf(bio_err, "Error getting password\n");
+ goto end;
+ }
+
+ if (out_bin == -1) {
+ if (keyfile)
+ out_bin = 1;
+ else
+ out_bin = 0;
+ }
+
+ if (randfile)
+ app_RAND_load_file(randfile, bio_err, 0);
+
+ if (outfile) {
+ if (out_bin)
+ out = BIO_new_file(outfile, "wb");
+ else
+ out = BIO_new_file(outfile, "w");
+ } else {
+ out = BIO_new_fp(stdout, BIO_NOCLOSE);
#ifdef OPENSSL_SYS_VMS
- {
- BIO *tmpbio = BIO_new(BIO_f_linebuffer());
- out = BIO_push(tmpbio, out);
- }
+ {
+ BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+ out = BIO_push(tmpbio, out);
+ }
#endif
- }
-
- if(!out) {
- BIO_printf(bio_err, "Error opening output file %s\n",
- outfile ? outfile : "(stdout)");
- ERR_print_errors(bio_err);
- goto end;
- }
- if ((!!mac_name + !!keyfile + !!hmac_key) > 1)
- {
- BIO_printf(bio_err, "MAC and Signing key cannot both be specified\n");
- goto end;
- }
-
- if(keyfile)
- {
- if (want_pub)
- sigkey = load_pubkey(bio_err, keyfile, keyform, 0, NULL,
- e, "key file");
- else
- sigkey = load_key(bio_err, keyfile, keyform, 0, passin,
- e, "key file");
- if (!sigkey)
- {
- /* load_[pub]key() has already printed an appropriate
- message */
- goto end;
- }
- }
-
- if (mac_name)
- {
- EVP_PKEY_CTX *mac_ctx = NULL;
- int r = 0;
- if (!init_gen_str(bio_err, &mac_ctx, mac_name,e, 0))
- goto mac_end;
- if (macopts)
- {
- char *macopt;
- for (i = 0; i < sk_OPENSSL_STRING_num(macopts); i++)
- {
- macopt = sk_OPENSSL_STRING_value(macopts, i);
- if (pkey_ctrl_string(mac_ctx, macopt) <= 0)
- {
- BIO_printf(bio_err,
- "MAC parameter error \"%s\"\n",
- macopt);
- ERR_print_errors(bio_err);
- goto mac_end;
- }
- }
- }
- if (EVP_PKEY_keygen(mac_ctx, &sigkey) <= 0)
- {
- BIO_puts(bio_err, "Error generating key\n");
- ERR_print_errors(bio_err);
- goto mac_end;
- }
- r = 1;
- mac_end:
- if (mac_ctx)
- EVP_PKEY_CTX_free(mac_ctx);
- if (r == 0)
- goto end;
- }
-
- if (non_fips_allow)
- {
- EVP_MD_CTX *md_ctx;
- BIO_get_md_ctx(bmd,&md_ctx);
- EVP_MD_CTX_set_flags(md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
- }
-
- if (hmac_key)
- {
- sigkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, e,
- (unsigned char *)hmac_key, -1);
- if (!sigkey)
- goto end;
- }
-
- if (sigkey)
- {
- EVP_MD_CTX *mctx = NULL;
- EVP_PKEY_CTX *pctx = NULL;
- int r;
- if (!BIO_get_md_ctx(bmd, &mctx))
- {
- BIO_printf(bio_err, "Error getting context\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- if (do_verify)
- r = EVP_DigestVerifyInit(mctx, &pctx, md, NULL, sigkey);
- else
- r = EVP_DigestSignInit(mctx, &pctx, md, NULL, sigkey);
- if (!r)
- {
- BIO_printf(bio_err, "Error setting context\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- if (sigopts)
- {
- char *sigopt;
- for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++)
- {
- sigopt = sk_OPENSSL_STRING_value(sigopts, i);
- if (pkey_ctrl_string(pctx, sigopt) <= 0)
- {
- BIO_printf(bio_err,
- "parameter error \"%s\"\n",
- sigopt);
- ERR_print_errors(bio_err);
- goto end;
- }
- }
- }
- }
- /* we use md as a filter, reading from 'in' */
- else
- {
- if (md == NULL)
- md = EVP_md5();
- if (!BIO_set_md(bmd,md))
- {
- BIO_printf(bio_err, "Error setting digest %s\n", pname);
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-
- if(sigfile && sigkey) {
- BIO *sigbio;
- sigbio = BIO_new_file(sigfile, "rb");
- siglen = EVP_PKEY_size(sigkey);
- sigbuf = OPENSSL_malloc(siglen);
- if(!sigbio) {
- BIO_printf(bio_err, "Error opening signature file %s\n",
- sigfile);
- ERR_print_errors(bio_err);
- goto end;
- }
- siglen = BIO_read(sigbio, sigbuf, siglen);
- BIO_free(sigbio);
- if(siglen <= 0) {
- BIO_printf(bio_err, "Error reading signature file %s\n",
- sigfile);
- ERR_print_errors(bio_err);
- goto end;
- }
- }
- inp=BIO_push(bmd,in);
-
- if (md == NULL)
- {
- EVP_MD_CTX *tctx;
- BIO_get_md_ctx(bmd, &tctx);
- md = EVP_MD_CTX_md(tctx);
- }
-
- if (argc == 0)
- {
- BIO_set_fp(in,stdin,BIO_NOCLOSE);
- err=do_fp(out, buf,inp,separator, out_bin, sigkey, sigbuf,
- siglen,NULL,NULL,"stdin",bmd);
- }
- else
- {
- const char *md_name = NULL, *sig_name = NULL;
- if(!out_bin)
- {
- if (sigkey)
- {
- const EVP_PKEY_ASN1_METHOD *ameth;
- ameth = EVP_PKEY_get0_asn1(sigkey);
- if (ameth)
- EVP_PKEY_asn1_get0_info(NULL, NULL,
- NULL, NULL, &sig_name, ameth);
- }
- md_name = EVP_MD_name(md);
- }
- err = 0;
- for (i=0; i<argc; i++)
- {
- int r;
- if (BIO_read_filename(in,argv[i]) <= 0)
- {
- perror(argv[i]);
- err++;
- continue;
- }
- else
- r=do_fp(out,buf,inp,separator,out_bin,sigkey,sigbuf,
- siglen,sig_name,md_name, argv[i],bmd);
- if(r)
- err=r;
- (void)BIO_reset(bmd);
- }
- }
-end:
- if (buf != NULL)
- {
- OPENSSL_cleanse(buf,BUFSIZE);
- OPENSSL_free(buf);
- }
- if (in != NULL) BIO_free(in);
- if (passin)
- OPENSSL_free(passin);
- BIO_free_all(out);
- EVP_PKEY_free(sigkey);
- if (sigopts)
- sk_OPENSSL_STRING_free(sigopts);
- if (macopts)
- sk_OPENSSL_STRING_free(macopts);
- if(sigbuf) OPENSSL_free(sigbuf);
- if (bmd != NULL) BIO_free(bmd);
- apps_shutdown();
- OPENSSL_EXIT(err);
- }
+ }
+
+ if (!out) {
+ BIO_printf(bio_err, "Error opening output file %s\n",
+ outfile ? outfile : "(stdout)");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if ((! !mac_name + ! !keyfile + ! !hmac_key) > 1) {
+ BIO_printf(bio_err, "MAC and Signing key cannot both be specified\n");
+ goto end;
+ }
+
+ if (keyfile) {
+ if (want_pub)
+ sigkey = load_pubkey(bio_err, keyfile, keyform, 0, NULL,
+ e, "key file");
+ else
+ sigkey = load_key(bio_err, keyfile, keyform, 0, passin,
+ e, "key file");
+ if (!sigkey) {
+ /*
+ * load_[pub]key() has already printed an appropriate message
+ */
+ goto end;
+ }
+ }
+
+ if (mac_name) {
+ EVP_PKEY_CTX *mac_ctx = NULL;
+ int r = 0;
+ if (!init_gen_str(bio_err, &mac_ctx, mac_name, e, 0))
+ goto mac_end;
+ if (macopts) {
+ char *macopt;
+ for (i = 0; i < sk_OPENSSL_STRING_num(macopts); i++) {
+ macopt = sk_OPENSSL_STRING_value(macopts, i);
+ if (pkey_ctrl_string(mac_ctx, macopt) <= 0) {
+ BIO_printf(bio_err,
+ "MAC parameter error \"%s\"\n", macopt);
+ ERR_print_errors(bio_err);
+ goto mac_end;
+ }
+ }
+ }
+ if (EVP_PKEY_keygen(mac_ctx, &sigkey) <= 0) {
+ BIO_puts(bio_err, "Error generating key\n");
+ ERR_print_errors(bio_err);
+ goto mac_end;
+ }
+ r = 1;
+ mac_end:
+ if (mac_ctx)
+ EVP_PKEY_CTX_free(mac_ctx);
+ if (r == 0)
+ goto end;
+ }
+
+ if (non_fips_allow) {
+ EVP_MD_CTX *md_ctx;
+ BIO_get_md_ctx(bmd, &md_ctx);
+ EVP_MD_CTX_set_flags(md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+ }
+
+ if (hmac_key) {
+ sigkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, e,
+ (unsigned char *)hmac_key, -1);
+ if (!sigkey)
+ goto end;
+ }
+
+ if (sigkey) {
+ EVP_MD_CTX *mctx = NULL;
+ EVP_PKEY_CTX *pctx = NULL;
+ int r;
+ if (!BIO_get_md_ctx(bmd, &mctx)) {
+ BIO_printf(bio_err, "Error getting context\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (do_verify)
+ r = EVP_DigestVerifyInit(mctx, &pctx, md, NULL, sigkey);
+ else
+ r = EVP_DigestSignInit(mctx, &pctx, md, NULL, sigkey);
+ if (!r) {
+ BIO_printf(bio_err, "Error setting context\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (sigopts) {
+ char *sigopt;
+ for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {
+ sigopt = sk_OPENSSL_STRING_value(sigopts, i);
+ if (pkey_ctrl_string(pctx, sigopt) <= 0) {
+ BIO_printf(bio_err, "parameter error \"%s\"\n", sigopt);
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+ }
+ }
+ /* we use md as a filter, reading from 'in' */
+ else {
+ if (md == NULL)
+ md = EVP_md5();
+ if (!BIO_set_md(bmd, md)) {
+ BIO_printf(bio_err, "Error setting digest %s\n", pname);
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+
+ if (sigfile && sigkey) {
+ BIO *sigbio;
+ sigbio = BIO_new_file(sigfile, "rb");
+ siglen = EVP_PKEY_size(sigkey);
+ sigbuf = OPENSSL_malloc(siglen);
+ if (!sigbio) {
+ BIO_printf(bio_err, "Error opening signature file %s\n", sigfile);
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (!sigbuf) {
+ BIO_printf(bio_err, "Out of memory\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ siglen = BIO_read(sigbio, sigbuf, siglen);
+ BIO_free(sigbio);
+ if (siglen <= 0) {
+ BIO_printf(bio_err, "Error reading signature file %s\n", sigfile);
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+ inp = BIO_push(bmd, in);
+
+ if (md == NULL) {
+ EVP_MD_CTX *tctx;
+ BIO_get_md_ctx(bmd, &tctx);
+ md = EVP_MD_CTX_md(tctx);
+ }
+
+ if (argc == 0) {
+ BIO_set_fp(in, stdin, BIO_NOCLOSE);
+ err = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
+ siglen, NULL, NULL, "stdin", bmd);
+ } else {
+ const char *md_name = NULL, *sig_name = NULL;
+ if (!out_bin) {
+ if (sigkey) {
+ const EVP_PKEY_ASN1_METHOD *ameth;
+ ameth = EVP_PKEY_get0_asn1(sigkey);
+ if (ameth)
+ EVP_PKEY_asn1_get0_info(NULL, NULL,
+ NULL, NULL, &sig_name, ameth);
+ }
+ md_name = EVP_MD_name(md);
+ }
+ err = 0;
+ for (i = 0; i < argc; i++) {
+ int r;
+ if (BIO_read_filename(in, argv[i]) <= 0) {
+ perror(argv[i]);
+ err++;
+ continue;
+ } else
+ r = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
+ siglen, sig_name, md_name, argv[i], bmd);
+ if (r)
+ err = r;
+ (void)BIO_reset(bmd);
+ }
+ }
+ end:
+ if (buf != NULL) {
+ OPENSSL_cleanse(buf, BUFSIZE);
+ OPENSSL_free(buf);
+ }
+ if (in != NULL)
+ BIO_free(in);
+ if (passin)
+ OPENSSL_free(passin);
+ BIO_free_all(out);
+ EVP_PKEY_free(sigkey);
+ if (sigopts)
+ sk_OPENSSL_STRING_free(sigopts);
+ if (macopts)
+ sk_OPENSSL_STRING_free(macopts);
+ if (sigbuf)
+ OPENSSL_free(sigbuf);
+ if (bmd != NULL)
+ BIO_free(bmd);
+ apps_shutdown();
+ OPENSSL_EXIT(err);
+}
int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
- EVP_PKEY *key, unsigned char *sigin, int siglen,
- const char *sig_name, const char *md_name,
- const char *file,BIO *bmd)
- {
- size_t len;
- int i;
-
- for (;;)
- {
- i=BIO_read(bp,(char *)buf,BUFSIZE);
- if(i < 0)
- {
- BIO_printf(bio_err, "Read Error in %s\n",file);
- ERR_print_errors(bio_err);
- return 1;
- }
- if (i == 0) break;
- }
- if(sigin)
- {
- EVP_MD_CTX *ctx;
- BIO_get_md_ctx(bp, &ctx);
- i = EVP_DigestVerifyFinal(ctx, sigin, (unsigned int)siglen);
- if(i > 0)
- BIO_printf(out, "Verified OK\n");
- else if(i == 0)
- {
- BIO_printf(out, "Verification Failure\n");
- return 1;
- }
- else
- {
- BIO_printf(bio_err, "Error Verifying Data\n");
- ERR_print_errors(bio_err);
- return 1;
- }
- return 0;
- }
- if(key)
- {
- EVP_MD_CTX *ctx;
- BIO_get_md_ctx(bp, &ctx);
- len = BUFSIZE;
- if(!EVP_DigestSignFinal(ctx, buf, &len))
- {
- BIO_printf(bio_err, "Error Signing Data\n");
- ERR_print_errors(bio_err);
- return 1;
- }
- }
- else
- {
- len=BIO_gets(bp,(char *)buf,BUFSIZE);
- if ((int)len <0)
- {
- ERR_print_errors(bio_err);
- return 1;
- }
- }
-
- if(binout) BIO_write(out, buf, len);
- else if (sep == 2)
- {
- for (i=0; i<(int)len; i++)
- BIO_printf(out, "%02x",buf[i]);
- BIO_printf(out, " *%s\n", file);
- }
- else
- {
- if (sig_name)
- BIO_printf(out, "%s-%s(%s)= ", sig_name, md_name, file);
- else if (md_name)
- BIO_printf(out, "%s(%s)= ", md_name, file);
- else
- BIO_printf(out, "(%s)= ", file);
- for (i=0; i<(int)len; i++)
- {
- if (sep && (i != 0))
- BIO_printf(out, ":");
- BIO_printf(out, "%02x",buf[i]);
- }
- BIO_printf(out, "\n");
- }
- return 0;
- }
-
+ EVP_PKEY *key, unsigned char *sigin, int siglen,
+ const char *sig_name, const char *md_name,
+ const char *file, BIO *bmd)
+{
+ size_t len;
+ int i;
+
+ for (;;) {
+ i = BIO_read(bp, (char *)buf, BUFSIZE);
+ if (i < 0) {
+ BIO_printf(bio_err, "Read Error in %s\n", file);
+ ERR_print_errors(bio_err);
+ return 1;
+ }
+ if (i == 0)
+ break;
+ }
+ if (sigin) {
+ EVP_MD_CTX *ctx;
+ BIO_get_md_ctx(bp, &ctx);
+ i = EVP_DigestVerifyFinal(ctx, sigin, (unsigned int)siglen);
+ if (i > 0)
+ BIO_printf(out, "Verified OK\n");
+ else if (i == 0) {
+ BIO_printf(out, "Verification Failure\n");
+ return 1;
+ } else {
+ BIO_printf(bio_err, "Error Verifying Data\n");
+ ERR_print_errors(bio_err);
+ return 1;
+ }
+ return 0;
+ }
+ if (key) {
+ EVP_MD_CTX *ctx;
+ BIO_get_md_ctx(bp, &ctx);
+ len = BUFSIZE;
+ if (!EVP_DigestSignFinal(ctx, buf, &len)) {
+ BIO_printf(bio_err, "Error Signing Data\n");
+ ERR_print_errors(bio_err);
+ return 1;
+ }
+ } else {
+ len = BIO_gets(bp, (char *)buf, BUFSIZE);
+ if ((int)len < 0) {
+ ERR_print_errors(bio_err);
+ return 1;
+ }
+ }
+
+ if (binout)
+ BIO_write(out, buf, len);
+ else if (sep == 2) {
+ for (i = 0; i < (int)len; i++)
+ BIO_printf(out, "%02x", buf[i]);
+ BIO_printf(out, " *%s\n", file);
+ } else {
+ if (sig_name)
+ BIO_printf(out, "%s-%s(%s)= ", sig_name, md_name, file);
+ else if (md_name)
+ BIO_printf(out, "%s(%s)= ", md_name, file);
+ else
+ BIO_printf(out, "(%s)= ", file);
+ for (i = 0; i < (int)len; i++) {
+ if (sep && (i != 0))
+ BIO_printf(out, ":");
+ BIO_printf(out, "%02x", buf[i]);
+ }
+ BIO_printf(out, "\n");
+ }
+ return 0;
+}
diff --git a/apps/dh.c b/apps/dh.c
index dee9c01fcec1..48fecc996034 100644
--- a/apps/dh.c
+++ b/apps/dh.c
@@ -6,21 +6,21 @@
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -35,10 +35,10 @@
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -50,35 +50,36 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
-#include <openssl/opensslconf.h> /* for OPENSSL_NO_DH */
+#include <openssl/opensslconf.h> /* for OPENSSL_NO_DH */
#ifndef OPENSSL_NO_DH
-#include <stdio.h>
-#include <stdlib.h>
-#include <time.h>
-#include <string.h>
-#include "apps.h"
-#include <openssl/bio.h>
-#include <openssl/err.h>
-#include <openssl/bn.h>
-#include <openssl/dh.h>
-#include <openssl/x509.h>
-#include <openssl/pem.h>
+# include <stdio.h>
+# include <stdlib.h>
+# include <time.h>
+# include <string.h>
+# include "apps.h"
+# include <openssl/bio.h>
+# include <openssl/err.h>
+# include <openssl/bn.h>
+# include <openssl/dh.h>
+# include <openssl/x509.h>
+# include <openssl/pem.h>
-#undef PROG
-#define PROG dh_main
+# undef PROG
+# define PROG dh_main
-/* -inform arg - input format - default PEM (DER or PEM)
+/*-
+ * -inform arg - input format - default PEM (DER or PEM)
* -outform arg - output format - default PEM
- * -in arg - input file - default stdin
- * -out arg - output file - default stdout
- * -check - check the parameters are ok
+ * -in arg - input file - default stdin
+ * -out arg - output file - default stdout
+ * -check - check the parameters are ok
* -noout
* -text
* -C
@@ -87,269 +88,250 @@
int MAIN(int, char **);
int MAIN(int argc, char **argv)
- {
- DH *dh=NULL;
- int i,badops=0,text=0;
- BIO *in=NULL,*out=NULL;
- int informat,outformat,check=0,noout=0,C=0,ret=1;
- char *infile,*outfile,*prog;
-#ifndef OPENSSL_NO_ENGINE
- char *engine;
-#endif
+{
+ DH *dh = NULL;
+ int i, badops = 0, text = 0;
+ BIO *in = NULL, *out = NULL;
+ int informat, outformat, check = 0, noout = 0, C = 0, ret = 1;
+ char *infile, *outfile, *prog;
+# ifndef OPENSSL_NO_ENGINE
+ char *engine;
+# endif
- apps_startup();
+ apps_startup();
- if (bio_err == NULL)
- if ((bio_err=BIO_new(BIO_s_file())) != NULL)
- BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
+ if (bio_err == NULL)
+ if ((bio_err = BIO_new(BIO_s_file())) != NULL)
+ BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
- if (!load_config(bio_err, NULL))
- goto end;
+ if (!load_config(bio_err, NULL))
+ goto end;
-#ifndef OPENSSL_NO_ENGINE
- engine=NULL;
-#endif
- infile=NULL;
- outfile=NULL;
- informat=FORMAT_PEM;
- outformat=FORMAT_PEM;
-
- prog=argv[0];
- argc--;
- argv++;
- while (argc >= 1)
- {
- if (strcmp(*argv,"-inform") == 0)
- {
- if (--argc < 1) goto bad;
- informat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-outform") == 0)
- {
- if (--argc < 1) goto bad;
- outformat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-in") == 0)
- {
- if (--argc < 1) goto bad;
- infile= *(++argv);
- }
- else if (strcmp(*argv,"-out") == 0)
- {
- if (--argc < 1) goto bad;
- outfile= *(++argv);
- }
-#ifndef OPENSSL_NO_ENGINE
- else if (strcmp(*argv,"-engine") == 0)
- {
- if (--argc < 1) goto bad;
- engine= *(++argv);
- }
-#endif
- else if (strcmp(*argv,"-check") == 0)
- check=1;
- else if (strcmp(*argv,"-text") == 0)
- text=1;
- else if (strcmp(*argv,"-C") == 0)
- C=1;
- else if (strcmp(*argv,"-noout") == 0)
- noout=1;
- else
- {
- BIO_printf(bio_err,"unknown option %s\n",*argv);
- badops=1;
- break;
- }
- argc--;
- argv++;
- }
+# ifndef OPENSSL_NO_ENGINE
+ engine = NULL;
+# endif
+ infile = NULL;
+ outfile = NULL;
+ informat = FORMAT_PEM;
+ outformat = FORMAT_PEM;
- if (badops)
- {
-bad:
- BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
- BIO_printf(bio_err,"where options are\n");
- BIO_printf(bio_err," -inform arg input format - one of DER PEM\n");
- BIO_printf(bio_err," -outform arg output format - one of DER PEM\n");
- BIO_printf(bio_err," -in arg input file\n");
- BIO_printf(bio_err," -out arg output file\n");
- BIO_printf(bio_err," -check check the DH parameters\n");
- BIO_printf(bio_err," -text print a text form of the DH parameters\n");
- BIO_printf(bio_err," -C Output C code\n");
- BIO_printf(bio_err," -noout no output\n");
-#ifndef OPENSSL_NO_ENGINE
- BIO_printf(bio_err," -engine e use engine e, possibly a hardware device.\n");
-#endif
- goto end;
- }
+ prog = argv[0];
+ argc--;
+ argv++;
+ while (argc >= 1) {
+ if (strcmp(*argv, "-inform") == 0) {
+ if (--argc < 1)
+ goto bad;
+ informat = str2fmt(*(++argv));
+ } else if (strcmp(*argv, "-outform") == 0) {
+ if (--argc < 1)
+ goto bad;
+ outformat = str2fmt(*(++argv));
+ } else if (strcmp(*argv, "-in") == 0) {
+ if (--argc < 1)
+ goto bad;
+ infile = *(++argv);
+ } else if (strcmp(*argv, "-out") == 0) {
+ if (--argc < 1)
+ goto bad;
+ outfile = *(++argv);
+ }
+# ifndef OPENSSL_NO_ENGINE
+ else if (strcmp(*argv, "-engine") == 0) {
+ if (--argc < 1)
+ goto bad;
+ engine = *(++argv);
+ }
+# endif
+ else if (strcmp(*argv, "-check") == 0)
+ check = 1;
+ else if (strcmp(*argv, "-text") == 0)
+ text = 1;
+ else if (strcmp(*argv, "-C") == 0)
+ C = 1;
+ else if (strcmp(*argv, "-noout") == 0)
+ noout = 1;
+ else {
+ BIO_printf(bio_err, "unknown option %s\n", *argv);
+ badops = 1;
+ break;
+ }
+ argc--;
+ argv++;
+ }
- ERR_load_crypto_strings();
+ if (badops) {
+ bad:
+ BIO_printf(bio_err, "%s [options] <infile >outfile\n", prog);
+ BIO_printf(bio_err, "where options are\n");
+ BIO_printf(bio_err, " -inform arg input format - one of DER PEM\n");
+ BIO_printf(bio_err,
+ " -outform arg output format - one of DER PEM\n");
+ BIO_printf(bio_err, " -in arg input file\n");
+ BIO_printf(bio_err, " -out arg output file\n");
+ BIO_printf(bio_err, " -check check the DH parameters\n");
+ BIO_printf(bio_err,
+ " -text print a text form of the DH parameters\n");
+ BIO_printf(bio_err, " -C Output C code\n");
+ BIO_printf(bio_err, " -noout no output\n");
+# ifndef OPENSSL_NO_ENGINE
+ BIO_printf(bio_err,
+ " -engine e use engine e, possibly a hardware device.\n");
+# endif
+ goto end;
+ }
-#ifndef OPENSSL_NO_ENGINE
- setup_engine(bio_err, engine, 0);
-#endif
+ ERR_load_crypto_strings();
- in=BIO_new(BIO_s_file());
- out=BIO_new(BIO_s_file());
- if ((in == NULL) || (out == NULL))
- {
- ERR_print_errors(bio_err);
- goto end;
- }
+# ifndef OPENSSL_NO_ENGINE
+ setup_engine(bio_err, engine, 0);
+# endif
- if (infile == NULL)
- BIO_set_fp(in,stdin,BIO_NOCLOSE);
- else
- {
- if (BIO_read_filename(in,infile) <= 0)
- {
- perror(infile);
- goto end;
- }
- }
- if (outfile == NULL)
- {
- BIO_set_fp(out,stdout,BIO_NOCLOSE);
-#ifdef OPENSSL_SYS_VMS
- {
- BIO *tmpbio = BIO_new(BIO_f_linebuffer());
- out = BIO_push(tmpbio, out);
- }
-#endif
- }
- else
- {
- if (BIO_write_filename(out,outfile) <= 0)
- {
- perror(outfile);
- goto end;
- }
- }
+ in = BIO_new(BIO_s_file());
+ out = BIO_new(BIO_s_file());
+ if ((in == NULL) || (out == NULL)) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
- if (informat == FORMAT_ASN1)
- dh=d2i_DHparams_bio(in,NULL);
- else if (informat == FORMAT_PEM)
- dh=PEM_read_bio_DHparams(in,NULL,NULL,NULL);
- else
- {
- BIO_printf(bio_err,"bad input format specified\n");
- goto end;
- }
- if (dh == NULL)
- {
- BIO_printf(bio_err,"unable to load DH parameters\n");
- ERR_print_errors(bio_err);
- goto end;
- }
+ if (infile == NULL)
+ BIO_set_fp(in, stdin, BIO_NOCLOSE);
+ else {
+ if (BIO_read_filename(in, infile) <= 0) {
+ perror(infile);
+ goto end;
+ }
+ }
+ if (outfile == NULL) {
+ BIO_set_fp(out, stdout, BIO_NOCLOSE);
+# ifdef OPENSSL_SYS_VMS
+ {
+ BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+ out = BIO_push(tmpbio, out);
+ }
+# endif
+ } else {
+ if (BIO_write_filename(out, outfile) <= 0) {
+ perror(outfile);
+ goto end;
+ }
+ }
-
+ if (informat == FORMAT_ASN1)
+ dh = d2i_DHparams_bio(in, NULL);
+ else if (informat == FORMAT_PEM)
+ dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
+ else {
+ BIO_printf(bio_err, "bad input format specified\n");
+ goto end;
+ }
+ if (dh == NULL) {
+ BIO_printf(bio_err, "unable to load DH parameters\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
- if (text)
- {
- DHparams_print(out,dh);
-#ifdef undef
- printf("p=");
- BN_print(stdout,dh->p);
- printf("\ng=");
- BN_print(stdout,dh->g);
- printf("\n");
- if (dh->length != 0)
- printf("recommended private length=%ld\n",dh->length);
-#endif
- }
-
- if (check)
- {
- if (!DH_check(dh,&i))
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- if (i & DH_CHECK_P_NOT_PRIME)
- printf("p value is not prime\n");
- if (i & DH_CHECK_P_NOT_SAFE_PRIME)
- printf("p value is not a safe prime\n");
- if (i & DH_UNABLE_TO_CHECK_GENERATOR)
- printf("unable to check the generator value\n");
- if (i & DH_NOT_SUITABLE_GENERATOR)
- printf("the g value is not a generator\n");
- if (i == 0)
- printf("DH parameters appear to be ok.\n");
- }
- if (C)
- {
- unsigned char *data;
- int len,l,bits;
+ if (text) {
+ DHparams_print(out, dh);
+# ifdef undef
+ printf("p=");
+ BN_print(stdout, dh->p);
+ printf("\ng=");
+ BN_print(stdout, dh->g);
+ printf("\n");
+ if (dh->length != 0)
+ printf("recommended private length=%ld\n", dh->length);
+# endif
+ }
- len=BN_num_bytes(dh->p);
- bits=BN_num_bits(dh->p);
- data=(unsigned char *)OPENSSL_malloc(len);
- if (data == NULL)
- {
- perror("OPENSSL_malloc");
- goto end;
- }
- l=BN_bn2bin(dh->p,data);
- printf("static unsigned char dh%d_p[]={",bits);
- for (i=0; i<l; i++)
- {
- if ((i%12) == 0) printf("\n\t");
- printf("0x%02X,",data[i]);
- }
- printf("\n\t};\n");
+ if (check) {
+ if (!DH_check(dh, &i)) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (i & DH_CHECK_P_NOT_PRIME)
+ printf("p value is not prime\n");
+ if (i & DH_CHECK_P_NOT_SAFE_PRIME)
+ printf("p value is not a safe prime\n");
+ if (i & DH_UNABLE_TO_CHECK_GENERATOR)
+ printf("unable to check the generator value\n");
+ if (i & DH_NOT_SUITABLE_GENERATOR)
+ printf("the g value is not a generator\n");
+ if (i == 0)
+ printf("DH parameters appear to be ok.\n");
+ }
+ if (C) {
+ unsigned char *data;
+ int len, l, bits;
- l=BN_bn2bin(dh->g,data);
- printf("static unsigned char dh%d_g[]={",bits);
- for (i=0; i<l; i++)
- {
- if ((i%12) == 0) printf("\n\t");
- printf("0x%02X,",data[i]);
- }
- printf("\n\t};\n\n");
+ len = BN_num_bytes(dh->p);
+ bits = BN_num_bits(dh->p);
+ data = (unsigned char *)OPENSSL_malloc(len);
+ if (data == NULL) {
+ perror("OPENSSL_malloc");
+ goto end;
+ }
+ l = BN_bn2bin(dh->p, data);
+ printf("static unsigned char dh%d_p[]={", bits);
+ for (i = 0; i < l; i++) {
+ if ((i % 12) == 0)
+ printf("\n\t");
+ printf("0x%02X,", data[i]);
+ }
+ printf("\n\t};\n");
- printf("DH *get_dh%d()\n\t{\n",bits);
- printf("\tDH *dh;\n\n");
- printf("\tif ((dh=DH_new()) == NULL) return(NULL);\n");
- printf("\tdh->p=BN_bin2bn(dh%d_p,sizeof(dh%d_p),NULL);\n",
- bits,bits);
- printf("\tdh->g=BN_bin2bn(dh%d_g,sizeof(dh%d_g),NULL);\n",
- bits,bits);
- printf("\tif ((dh->p == NULL) || (dh->g == NULL))\n");
- printf("\t\treturn(NULL);\n");
- printf("\treturn(dh);\n\t}\n");
- OPENSSL_free(data);
- }
+ l = BN_bn2bin(dh->g, data);
+ printf("static unsigned char dh%d_g[]={", bits);
+ for (i = 0; i < l; i++) {
+ if ((i % 12) == 0)
+ printf("\n\t");
+ printf("0x%02X,", data[i]);
+ }
+ printf("\n\t};\n\n");
+ printf("DH *get_dh%d()\n\t{\n", bits);
+ printf("\tDH *dh;\n\n");
+ printf("\tif ((dh=DH_new()) == NULL) return(NULL);\n");
+ printf("\tdh->p=BN_bin2bn(dh%d_p,sizeof(dh%d_p),NULL);\n",
+ bits, bits);
+ printf("\tdh->g=BN_bin2bn(dh%d_g,sizeof(dh%d_g),NULL);\n",
+ bits, bits);
+ printf("\tif ((dh->p == NULL) || (dh->g == NULL))\n");
+ printf("\t\treturn(NULL);\n");
+ printf("\treturn(dh);\n\t}\n");
+ OPENSSL_free(data);
+ }
- if (!noout)
- {
- if (outformat == FORMAT_ASN1)
- i=i2d_DHparams_bio(out,dh);
- else if (outformat == FORMAT_PEM)
- i=PEM_write_bio_DHparams(out,dh);
- else {
- BIO_printf(bio_err,"bad output format specified for outfile\n");
- goto end;
- }
- if (!i)
- {
- BIO_printf(bio_err,"unable to write DH parameters\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
- ret=0;
-end:
- if (in != NULL) BIO_free(in);
- if (out != NULL) BIO_free_all(out);
- if (dh != NULL) DH_free(dh);
- apps_shutdown();
- OPENSSL_EXIT(ret);
- }
-#else /* !OPENSSL_NO_DH */
+ if (!noout) {
+ if (outformat == FORMAT_ASN1)
+ i = i2d_DHparams_bio(out, dh);
+ else if (outformat == FORMAT_PEM)
+ i = PEM_write_bio_DHparams(out, dh);
+ else {
+ BIO_printf(bio_err, "bad output format specified for outfile\n");
+ goto end;
+ }
+ if (!i) {
+ BIO_printf(bio_err, "unable to write DH parameters\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+ ret = 0;
+ end:
+ if (in != NULL)
+ BIO_free(in);
+ if (out != NULL)
+ BIO_free_all(out);
+ if (dh != NULL)
+ DH_free(dh);
+ apps_shutdown();
+ OPENSSL_EXIT(ret);
+}
+#else /* !OPENSSL_NO_DH */
# if PEDANTIC
-static void *dummy=&dummy;
+static void *dummy = &dummy;
# endif
#endif
diff --git a/apps/dhparam.c b/apps/dhparam.c
index 1297d6fb5ec9..f86311c28fd3 100644
--- a/apps/dhparam.c
+++ b/apps/dhparam.c
@@ -5,21 +5,21 @@
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -34,10 +34,10 @@
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -49,7 +49,7 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
@@ -63,7 +63,7 @@
* are met:
*
* 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
+ * notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
@@ -109,35 +109,36 @@
*
*/
-#include <openssl/opensslconf.h> /* for OPENSSL_NO_DH */
+#include <openssl/opensslconf.h> /* for OPENSSL_NO_DH */
#ifndef OPENSSL_NO_DH
-#include <stdio.h>
-#include <stdlib.h>
-#include <time.h>
-#include <string.h>
-#include "apps.h"
-#include <openssl/bio.h>
-#include <openssl/err.h>
-#include <openssl/bn.h>
-#include <openssl/dh.h>
-#include <openssl/x509.h>
-#include <openssl/pem.h>
-
-#ifndef OPENSSL_NO_DSA
-#include <openssl/dsa.h>
-#endif
+# include <stdio.h>
+# include <stdlib.h>
+# include <time.h>
+# include <string.h>
+# include "apps.h"
+# include <openssl/bio.h>
+# include <openssl/err.h>
+# include <openssl/bn.h>
+# include <openssl/dh.h>
+# include <openssl/x509.h>
+# include <openssl/pem.h>
+
+# ifndef OPENSSL_NO_DSA
+# include <openssl/dsa.h>
+# endif
-#undef PROG
-#define PROG dhparam_main
+# undef PROG
+# define PROG dhparam_main
-#define DEFBITS 512
+# define DEFBITS 512
-/* -inform arg - input format - default PEM (DER or PEM)
+/*-
+ * -inform arg - input format - default PEM (DER or PEM)
* -outform arg - output format - default PEM
- * -in arg - input file - default stdin
- * -out arg - output file - default stdout
+ * -in arg - input file - default stdin
+ * -out arg - output file - default stdout
* -dsaparam - read or generate DSA parameters, convert to DH
- * -check - check the parameters are ok
+ * -check - check the parameters are ok
* -noout
* -text
* -C
@@ -148,412 +149,395 @@ static int MS_CALLBACK dh_cb(int p, int n, BN_GENCB *cb);
int MAIN(int, char **);
int MAIN(int argc, char **argv)
- {
- DH *dh=NULL;
- int i,badops=0,text=0;
-#ifndef OPENSSL_NO_DSA
- int dsaparam=0;
-#endif
- BIO *in=NULL,*out=NULL;
- int informat,outformat,check=0,noout=0,C=0,ret=1;
- char *infile,*outfile,*prog;
- char *inrand=NULL;
-#ifndef OPENSSL_NO_ENGINE
- char *engine=NULL;
-#endif
- int num = 0, g = 0;
-
- apps_startup();
-
- if (bio_err == NULL)
- if ((bio_err=BIO_new(BIO_s_file())) != NULL)
- BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
-
- if (!load_config(bio_err, NULL))
- goto end;
-
- infile=NULL;
- outfile=NULL;
- informat=FORMAT_PEM;
- outformat=FORMAT_PEM;
-
- prog=argv[0];
- argc--;
- argv++;
- while (argc >= 1)
- {
- if (strcmp(*argv,"-inform") == 0)
- {
- if (--argc < 1) goto bad;
- informat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-outform") == 0)
- {
- if (--argc < 1) goto bad;
- outformat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-in") == 0)
- {
- if (--argc < 1) goto bad;
- infile= *(++argv);
- }
- else if (strcmp(*argv,"-out") == 0)
- {
- if (--argc < 1) goto bad;
- outfile= *(++argv);
- }
-#ifndef OPENSSL_NO_ENGINE
- else if (strcmp(*argv,"-engine") == 0)
- {
- if (--argc < 1) goto bad;
- engine= *(++argv);
- }
-#endif
- else if (strcmp(*argv,"-check") == 0)
- check=1;
- else if (strcmp(*argv,"-text") == 0)
- text=1;
-#ifndef OPENSSL_NO_DSA
- else if (strcmp(*argv,"-dsaparam") == 0)
- dsaparam=1;
-#endif
- else if (strcmp(*argv,"-C") == 0)
- C=1;
- else if (strcmp(*argv,"-noout") == 0)
- noout=1;
- else if (strcmp(*argv,"-2") == 0)
- g=2;
- else if (strcmp(*argv,"-5") == 0)
- g=5;
- else if (strcmp(*argv,"-rand") == 0)
- {
- if (--argc < 1) goto bad;
- inrand= *(++argv);
- }
- else if (((sscanf(*argv,"%d",&num) == 0) || (num <= 0)))
- goto bad;
- argv++;
- argc--;
- }
-
- if (badops)
- {
-bad:
- BIO_printf(bio_err,"%s [options] [numbits]\n",prog);
- BIO_printf(bio_err,"where options are\n");
- BIO_printf(bio_err," -inform arg input format - one of DER PEM\n");
- BIO_printf(bio_err," -outform arg output format - one of DER PEM\n");
- BIO_printf(bio_err," -in arg input file\n");
- BIO_printf(bio_err," -out arg output file\n");
-#ifndef OPENSSL_NO_DSA
- BIO_printf(bio_err," -dsaparam read or generate DSA parameters, convert to DH\n");
-#endif
- BIO_printf(bio_err," -check check the DH parameters\n");
- BIO_printf(bio_err," -text print a text form of the DH parameters\n");
- BIO_printf(bio_err," -C Output C code\n");
- BIO_printf(bio_err," -2 generate parameters using 2 as the generator value\n");
- BIO_printf(bio_err," -5 generate parameters using 5 as the generator value\n");
- BIO_printf(bio_err," numbits number of bits in to generate (default 512)\n");
-#ifndef OPENSSL_NO_ENGINE
- BIO_printf(bio_err," -engine e use engine e, possibly a hardware device.\n");
-#endif
- BIO_printf(bio_err," -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
- BIO_printf(bio_err," - load the file (or the files in the directory) into\n");
- BIO_printf(bio_err," the random number generator\n");
- BIO_printf(bio_err," -noout no output\n");
- goto end;
- }
-
- ERR_load_crypto_strings();
-
-#ifndef OPENSSL_NO_ENGINE
- setup_engine(bio_err, engine, 0);
-#endif
+{
+ DH *dh = NULL;
+ int i, badops = 0, text = 0;
+# ifndef OPENSSL_NO_DSA
+ int dsaparam = 0;
+# endif
+ BIO *in = NULL, *out = NULL;
+ int informat, outformat, check = 0, noout = 0, C = 0, ret = 1;
+ char *infile, *outfile, *prog;
+ char *inrand = NULL;
+# ifndef OPENSSL_NO_ENGINE
+ char *engine = NULL;
+# endif
+ int num = 0, g = 0;
+
+ apps_startup();
+
+ if (bio_err == NULL)
+ if ((bio_err = BIO_new(BIO_s_file())) != NULL)
+ BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
+
+ if (!load_config(bio_err, NULL))
+ goto end;
+
+ infile = NULL;
+ outfile = NULL;
+ informat = FORMAT_PEM;
+ outformat = FORMAT_PEM;
+
+ prog = argv[0];
+ argc--;
+ argv++;
+ while (argc >= 1) {
+ if (strcmp(*argv, "-inform") == 0) {
+ if (--argc < 1)
+ goto bad;
+ informat = str2fmt(*(++argv));
+ } else if (strcmp(*argv, "-outform") == 0) {
+ if (--argc < 1)
+ goto bad;
+ outformat = str2fmt(*(++argv));
+ } else if (strcmp(*argv, "-in") == 0) {
+ if (--argc < 1)
+ goto bad;
+ infile = *(++argv);
+ } else if (strcmp(*argv, "-out") == 0) {
+ if (--argc < 1)
+ goto bad;
+ outfile = *(++argv);
+ }
+# ifndef OPENSSL_NO_ENGINE
+ else if (strcmp(*argv, "-engine") == 0) {
+ if (--argc < 1)
+ goto bad;
+ engine = *(++argv);
+ }
+# endif
+ else if (strcmp(*argv, "-check") == 0)
+ check = 1;
+ else if (strcmp(*argv, "-text") == 0)
+ text = 1;
+# ifndef OPENSSL_NO_DSA
+ else if (strcmp(*argv, "-dsaparam") == 0)
+ dsaparam = 1;
+# endif
+ else if (strcmp(*argv, "-C") == 0)
+ C = 1;
+ else if (strcmp(*argv, "-noout") == 0)
+ noout = 1;
+ else if (strcmp(*argv, "-2") == 0)
+ g = 2;
+ else if (strcmp(*argv, "-5") == 0)
+ g = 5;
+ else if (strcmp(*argv, "-rand") == 0) {
+ if (--argc < 1)
+ goto bad;
+ inrand = *(++argv);
+ } else if (((sscanf(*argv, "%d", &num) == 0) || (num <= 0)))
+ goto bad;
+ argv++;
+ argc--;
+ }
+
+ if (badops) {
+ bad:
+ BIO_printf(bio_err, "%s [options] [numbits]\n", prog);
+ BIO_printf(bio_err, "where options are\n");
+ BIO_printf(bio_err, " -inform arg input format - one of DER PEM\n");
+ BIO_printf(bio_err,
+ " -outform arg output format - one of DER PEM\n");
+ BIO_printf(bio_err, " -in arg input file\n");
+ BIO_printf(bio_err, " -out arg output file\n");
+# ifndef OPENSSL_NO_DSA
+ BIO_printf(bio_err,
+ " -dsaparam read or generate DSA parameters, convert to DH\n");
+# endif
+ BIO_printf(bio_err, " -check check the DH parameters\n");
+ BIO_printf(bio_err,
+ " -text print a text form of the DH parameters\n");
+ BIO_printf(bio_err, " -C Output C code\n");
+ BIO_printf(bio_err,
+ " -2 generate parameters using 2 as the generator value\n");
+ BIO_printf(bio_err,
+ " -5 generate parameters using 5 as the generator value\n");
+ BIO_printf(bio_err,
+ " numbits number of bits in to generate (default 512)\n");
+# ifndef OPENSSL_NO_ENGINE
+ BIO_printf(bio_err,
+ " -engine e use engine e, possibly a hardware device.\n");
+# endif
+ BIO_printf(bio_err, " -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR,
+ LIST_SEPARATOR_CHAR);
+ BIO_printf(bio_err,
+ " - load the file (or the files in the directory) into\n");
+ BIO_printf(bio_err, " the random number generator\n");
+ BIO_printf(bio_err, " -noout no output\n");
+ goto end;
+ }
+
+ ERR_load_crypto_strings();
+
+# ifndef OPENSSL_NO_ENGINE
+ setup_engine(bio_err, engine, 0);
+# endif
- if (g && !num)
- num = DEFBITS;
-
-#ifndef OPENSSL_NO_DSA
- if (dsaparam)
- {
- if (g)
- {
- BIO_printf(bio_err, "generator may not be chosen for DSA parameters\n");
- goto end;
- }
- }
- else
-#endif
- {
- /* DH parameters */
- if (num && !g)
- g = 2;
- }
-
- if(num) {
-
- BN_GENCB cb;
- BN_GENCB_set(&cb, dh_cb, bio_err);
- if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL)
- {
- BIO_printf(bio_err,"warning, not much extra random data, consider using the -rand option\n");
- }
- if (inrand != NULL)
- BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
- app_RAND_load_files(inrand));
-
-#ifndef OPENSSL_NO_DSA
- if (dsaparam)
- {
- DSA *dsa = DSA_new();
-
- BIO_printf(bio_err,"Generating DSA parameters, %d bit long prime\n",num);
- if(!dsa || !DSA_generate_parameters_ex(dsa, num,
- NULL, 0, NULL, NULL, &cb))
- {
- if(dsa) DSA_free(dsa);
- ERR_print_errors(bio_err);
- goto end;
- }
-
- dh = DSA_dup_DH(dsa);
- DSA_free(dsa);
- if (dh == NULL)
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- }
- else
-#endif
- {
- dh = DH_new();
- BIO_printf(bio_err,"Generating DH parameters, %d bit long safe prime, generator %d\n",num,g);
- BIO_printf(bio_err,"This is going to take a long time\n");
- if(!dh || !DH_generate_parameters_ex(dh, num, g, &cb))
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-
- app_RAND_write_file(NULL, bio_err);
- } else {
-
- in=BIO_new(BIO_s_file());
- if (in == NULL)
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- if (infile == NULL)
- BIO_set_fp(in,stdin,BIO_NOCLOSE);
- else
- {
- if (BIO_read_filename(in,infile) <= 0)
- {
- perror(infile);
- goto end;
- }
- }
-
- if (informat != FORMAT_ASN1 && informat != FORMAT_PEM)
- {
- BIO_printf(bio_err,"bad input format specified\n");
- goto end;
- }
-
-#ifndef OPENSSL_NO_DSA
- if (dsaparam)
- {
- DSA *dsa;
-
- if (informat == FORMAT_ASN1)
- dsa=d2i_DSAparams_bio(in,NULL);
- else /* informat == FORMAT_PEM */
- dsa=PEM_read_bio_DSAparams(in,NULL,NULL,NULL);
-
- if (dsa == NULL)
- {
- BIO_printf(bio_err,"unable to load DSA parameters\n");
- ERR_print_errors(bio_err);
- goto end;
- }
-
- dh = DSA_dup_DH(dsa);
- DSA_free(dsa);
- if (dh == NULL)
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- }
- else
-#endif
- {
- if (informat == FORMAT_ASN1)
- dh=d2i_DHparams_bio(in,NULL);
- else /* informat == FORMAT_PEM */
- dh=PEM_read_bio_DHparams(in,NULL,NULL,NULL);
-
- if (dh == NULL)
- {
- BIO_printf(bio_err,"unable to load DH parameters\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-
- /* dh != NULL */
- }
-
- out=BIO_new(BIO_s_file());
- if (out == NULL)
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- if (outfile == NULL)
- {
- BIO_set_fp(out,stdout,BIO_NOCLOSE);
-#ifdef OPENSSL_SYS_VMS
- {
- BIO *tmpbio = BIO_new(BIO_f_linebuffer());
- out = BIO_push(tmpbio, out);
- }
-#endif
- }
- else
- {
- if (BIO_write_filename(out,outfile) <= 0)
- {
- perror(outfile);
- goto end;
- }
- }
-
-
- if (text)
- {
- DHparams_print(out,dh);
- }
-
- if (check)
- {
- if (!DH_check(dh,&i))
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- if (i & DH_CHECK_P_NOT_PRIME)
- printf("p value is not prime\n");
- if (i & DH_CHECK_P_NOT_SAFE_PRIME)
- printf("p value is not a safe prime\n");
- if (i & DH_UNABLE_TO_CHECK_GENERATOR)
- printf("unable to check the generator value\n");
- if (i & DH_NOT_SUITABLE_GENERATOR)
- printf("the g value is not a generator\n");
- if (i == 0)
- printf("DH parameters appear to be ok.\n");
- }
- if (C)
- {
- unsigned char *data;
- int len,l,bits;
-
- len=BN_num_bytes(dh->p);
- bits=BN_num_bits(dh->p);
- data=(unsigned char *)OPENSSL_malloc(len);
- if (data == NULL)
- {
- perror("OPENSSL_malloc");
- goto end;
- }
- printf("#ifndef HEADER_DH_H\n"
- "#include <openssl/dh.h>\n"
- "#endif\n");
- printf("DH *get_dh%d()\n\t{\n",bits);
-
- l=BN_bn2bin(dh->p,data);
- printf("\tstatic unsigned char dh%d_p[]={",bits);
- for (i=0; i<l; i++)
- {
- if ((i%12) == 0) printf("\n\t\t");
- printf("0x%02X,",data[i]);
- }
- printf("\n\t\t};\n");
-
- l=BN_bn2bin(dh->g,data);
- printf("\tstatic unsigned char dh%d_g[]={",bits);
- for (i=0; i<l; i++)
- {
- if ((i%12) == 0) printf("\n\t\t");
- printf("0x%02X,",data[i]);
- }
- printf("\n\t\t};\n");
-
- printf("\tDH *dh;\n\n");
- printf("\tif ((dh=DH_new()) == NULL) return(NULL);\n");
- printf("\tdh->p=BN_bin2bn(dh%d_p,sizeof(dh%d_p),NULL);\n",
- bits,bits);
- printf("\tdh->g=BN_bin2bn(dh%d_g,sizeof(dh%d_g),NULL);\n",
- bits,bits);
- printf("\tif ((dh->p == NULL) || (dh->g == NULL))\n");
- printf("\t\t{ DH_free(dh); return(NULL); }\n");
- if (dh->length)
- printf("\tdh->length = %ld;\n", dh->length);
- printf("\treturn(dh);\n\t}\n");
- OPENSSL_free(data);
- }
-
-
- if (!noout)
- {
- if (outformat == FORMAT_ASN1)
- i=i2d_DHparams_bio(out,dh);
- else if (outformat == FORMAT_PEM)
- i=PEM_write_bio_DHparams(out,dh);
- else {
- BIO_printf(bio_err,"bad output format specified for outfile\n");
- goto end;
- }
- if (!i)
- {
- BIO_printf(bio_err,"unable to write DH parameters\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
- ret=0;
-end:
- if (in != NULL) BIO_free(in);
- if (out != NULL) BIO_free_all(out);
- if (dh != NULL) DH_free(dh);
- apps_shutdown();
- OPENSSL_EXIT(ret);
- }
+ if (g && !num)
+ num = DEFBITS;
+
+# ifndef OPENSSL_NO_DSA
+ if (dsaparam) {
+ if (g) {
+ BIO_printf(bio_err,
+ "generator may not be chosen for DSA parameters\n");
+ goto end;
+ }
+ } else
+# endif
+ {
+ /* DH parameters */
+ if (num && !g)
+ g = 2;
+ }
+
+ if (num) {
+
+ BN_GENCB cb;
+ BN_GENCB_set(&cb, dh_cb, bio_err);
+ if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL) {
+ BIO_printf(bio_err,
+ "warning, not much extra random data, consider using the -rand option\n");
+ }
+ if (inrand != NULL)
+ BIO_printf(bio_err, "%ld semi-random bytes loaded\n",
+ app_RAND_load_files(inrand));
+
+# ifndef OPENSSL_NO_DSA
+ if (dsaparam) {
+ DSA *dsa = DSA_new();
+
+ BIO_printf(bio_err,
+ "Generating DSA parameters, %d bit long prime\n", num);
+ if (!dsa
+ || !DSA_generate_parameters_ex(dsa, num, NULL, 0, NULL, NULL,
+ &cb)) {
+ if (dsa)
+ DSA_free(dsa);
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
+ dh = DSA_dup_DH(dsa);
+ DSA_free(dsa);
+ if (dh == NULL) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ } else
+# endif
+ {
+ dh = DH_new();
+ BIO_printf(bio_err,
+ "Generating DH parameters, %d bit long safe prime, generator %d\n",
+ num, g);
+ BIO_printf(bio_err, "This is going to take a long time\n");
+ if (!dh || !DH_generate_parameters_ex(dh, num, g, &cb)) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+
+ app_RAND_write_file(NULL, bio_err);
+ } else {
+
+ in = BIO_new(BIO_s_file());
+ if (in == NULL) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (infile == NULL)
+ BIO_set_fp(in, stdin, BIO_NOCLOSE);
+ else {
+ if (BIO_read_filename(in, infile) <= 0) {
+ perror(infile);
+ goto end;
+ }
+ }
+
+ if (informat != FORMAT_ASN1 && informat != FORMAT_PEM) {
+ BIO_printf(bio_err, "bad input format specified\n");
+ goto end;
+ }
+# ifndef OPENSSL_NO_DSA
+ if (dsaparam) {
+ DSA *dsa;
+
+ if (informat == FORMAT_ASN1)
+ dsa = d2i_DSAparams_bio(in, NULL);
+ else /* informat == FORMAT_PEM */
+ dsa = PEM_read_bio_DSAparams(in, NULL, NULL, NULL);
+
+ if (dsa == NULL) {
+ BIO_printf(bio_err, "unable to load DSA parameters\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
+ dh = DSA_dup_DH(dsa);
+ DSA_free(dsa);
+ if (dh == NULL) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ } else
+# endif
+ {
+ if (informat == FORMAT_ASN1)
+ dh = d2i_DHparams_bio(in, NULL);
+ else /* informat == FORMAT_PEM */
+ dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
+
+ if (dh == NULL) {
+ BIO_printf(bio_err, "unable to load DH parameters\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+
+ /* dh != NULL */
+ }
+
+ out = BIO_new(BIO_s_file());
+ if (out == NULL) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (outfile == NULL) {
+ BIO_set_fp(out, stdout, BIO_NOCLOSE);
+# ifdef OPENSSL_SYS_VMS
+ {
+ BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+ out = BIO_push(tmpbio, out);
+ }
+# endif
+ } else {
+ if (BIO_write_filename(out, outfile) <= 0) {
+ perror(outfile);
+ goto end;
+ }
+ }
+
+ if (text) {
+ DHparams_print(out, dh);
+ }
+
+ if (check) {
+ if (!DH_check(dh, &i)) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (i & DH_CHECK_P_NOT_PRIME)
+ printf("p value is not prime\n");
+ if (i & DH_CHECK_P_NOT_SAFE_PRIME)
+ printf("p value is not a safe prime\n");
+ if (i & DH_UNABLE_TO_CHECK_GENERATOR)
+ printf("unable to check the generator value\n");
+ if (i & DH_NOT_SUITABLE_GENERATOR)
+ printf("the g value is not a generator\n");
+ if (i == 0)
+ printf("DH parameters appear to be ok.\n");
+ }
+ if (C) {
+ unsigned char *data;
+ int len, l, bits;
+
+ len = BN_num_bytes(dh->p);
+ bits = BN_num_bits(dh->p);
+ data = (unsigned char *)OPENSSL_malloc(len);
+ if (data == NULL) {
+ perror("OPENSSL_malloc");
+ goto end;
+ }
+ printf("#ifndef HEADER_DH_H\n"
+ "#include <openssl/dh.h>\n" "#endif\n");
+ printf("DH *get_dh%d()\n\t{\n", bits);
+
+ l = BN_bn2bin(dh->p, data);
+ printf("\tstatic unsigned char dh%d_p[]={", bits);
+ for (i = 0; i < l; i++) {
+ if ((i % 12) == 0)
+ printf("\n\t\t");
+ printf("0x%02X,", data[i]);
+ }
+ printf("\n\t\t};\n");
+
+ l = BN_bn2bin(dh->g, data);
+ printf("\tstatic unsigned char dh%d_g[]={", bits);
+ for (i = 0; i < l; i++) {
+ if ((i % 12) == 0)
+ printf("\n\t\t");
+ printf("0x%02X,", data[i]);
+ }
+ printf("\n\t\t};\n");
+
+ printf("\tDH *dh;\n\n");
+ printf("\tif ((dh=DH_new()) == NULL) return(NULL);\n");
+ printf("\tdh->p=BN_bin2bn(dh%d_p,sizeof(dh%d_p),NULL);\n",
+ bits, bits);
+ printf("\tdh->g=BN_bin2bn(dh%d_g,sizeof(dh%d_g),NULL);\n",
+ bits, bits);
+ printf("\tif ((dh->p == NULL) || (dh->g == NULL))\n");
+ printf("\t\t{ DH_free(dh); return(NULL); }\n");
+ if (dh->length)
+ printf("\tdh->length = %ld;\n", dh->length);
+ printf("\treturn(dh);\n\t}\n");
+ OPENSSL_free(data);
+ }
+
+ if (!noout) {
+ if (outformat == FORMAT_ASN1)
+ i = i2d_DHparams_bio(out, dh);
+ else if (outformat == FORMAT_PEM)
+ i = PEM_write_bio_DHparams(out, dh);
+ else {
+ BIO_printf(bio_err, "bad output format specified for outfile\n");
+ goto end;
+ }
+ if (!i) {
+ BIO_printf(bio_err, "unable to write DH parameters\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+ ret = 0;
+ end:
+ if (in != NULL)
+ BIO_free(in);
+ if (out != NULL)
+ BIO_free_all(out);
+ if (dh != NULL)
+ DH_free(dh);
+ apps_shutdown();
+ OPENSSL_EXIT(ret);
+}
/* dh_cb is identical to dsa_cb in apps/dsaparam.c */
static int MS_CALLBACK dh_cb(int p, int n, BN_GENCB *cb)
- {
- char c='*';
-
- if (p == 0) c='.';
- if (p == 1) c='+';
- if (p == 2) c='*';
- if (p == 3) c='\n';
- BIO_write(cb->arg,&c,1);
- (void)BIO_flush(cb->arg);
-#ifdef LINT
- p=n;
-#endif
- return 1;
- }
+{
+ char c = '*';
+
+ if (p == 0)
+ c = '.';
+ if (p == 1)
+ c = '+';
+ if (p == 2)
+ c = '*';
+ if (p == 3)
+ c = '\n';
+ BIO_write(cb->arg, &c, 1);
+ (void)BIO_flush(cb->arg);
+# ifdef LINT
+ p = n;
+# endif
+ return 1;
+}
-#else /* !OPENSSL_NO_DH */
+#else /* !OPENSSL_NO_DH */
# if PEDANTIC
-static void *dummy=&dummy;
+static void *dummy = &dummy;
# endif
#endif
diff --git a/apps/dsa.c b/apps/dsa.c
index 5222487ab9cf..dedf8e174a04 100644
--- a/apps/dsa.c
+++ b/apps/dsa.c
@@ -5,21 +5,21 @@
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -34,10 +34,10 @@
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -49,328 +49,326 @@
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
-#include <openssl/opensslconf.h> /* for OPENSSL_NO_DSA */
+#include <openssl/opensslconf.h> /* for OPENSSL_NO_DSA */
#ifndef OPENSSL_NO_DSA
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-#include "apps.h"
-#include <openssl/bio.h>
-#include <openssl/err.h>
-#include <openssl/dsa.h>
-#include <openssl/evp.h>
-#include <openssl/x509.h>
-#include <opens