- {
- int ret=1;
- X509_REQ *req=NULL;
- X509 *x=NULL,*xca=NULL;
- ASN1_OBJECT *objtmp;
- EVP_PKEY *Upkey=NULL,*CApkey=NULL;
- int i,num,badops=0;
- BIO *out=NULL;
- BIO *STDout=NULL;
- STACK_OF(ASN1_OBJECT) *trust = NULL, *reject = NULL;
- int informat,outformat,keyformat,CAformat,CAkeyformat;
- char *infile=NULL,*outfile=NULL,*keyfile=NULL,*CAfile=NULL;
- char *CAkeyfile=NULL,*CAserial=NULL;
- char *alias=NULL;
- int text=0,serial=0,hash=0,subject=0,issuer=0,startdate=0,enddate=0;
- int noout=0,sign_flag=0,CA_flag=0,CA_createserial=0;
- int trustout=0,clrtrust=0,clrreject=0,aliasout=0;
- int C=0;
- int x509req=0,days=DEF_DAYS,modulus=0,pubkey=0;
- int pprint = 0;
- char **pp;
- X509_STORE *ctx=NULL;
- X509_REQ *rq=NULL;
- int fingerprint=0;
- char buf[256];
- const EVP_MD *md_alg,*digest=EVP_md5();
- LHASH *extconf = NULL;
- char *extsect = NULL, *extfile = NULL, *passin = NULL;
- int need_rand = 0;
-
- reqfile=0;
-
- apps_startup();
-
- if (bio_err == NULL)
- bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
- STDout=BIO_new_fp(stdout,BIO_NOCLOSE);
-
- informat=FORMAT_PEM;
- outformat=FORMAT_PEM;
- keyformat=FORMAT_PEM;
- CAformat=FORMAT_PEM;
- CAkeyformat=FORMAT_PEM;
-
- ctx=X509_STORE_new();
- if (ctx == NULL) goto end;
- X509_STORE_set_verify_cb_func(ctx,callb);
-
- argc--;
- argv++;
- num=0;
- while (argc >= 1)
- {
- if (strcmp(*argv,"-inform") == 0)
- {
- if (--argc < 1) goto bad;
- informat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-outform") == 0)
- {
- if (--argc < 1) goto bad;
- outformat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-keyform") == 0)
- {
- if (--argc < 1) goto bad;
- keyformat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-req") == 0)
- {
- reqfile=1;
- need_rand = 1;
- }
- else if (strcmp(*argv,"-CAform") == 0)
- {
- if (--argc < 1) goto bad;
- CAformat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-CAkeyform") == 0)
- {
- if (--argc < 1) goto bad;
- CAformat=str2fmt(*(++argv));
- }
- else if (strcmp(*argv,"-days") == 0)
- {
- if (--argc < 1) goto bad;
- days=atoi(*(++argv));
- if (days == 0)
- {
- BIO_printf(STDout,"bad number of days\n");
- goto bad;
- }
- }
- else if (strcmp(*argv,"-passin") == 0)
- {
- if (--argc < 1) goto bad;
- passin= *(++argv);
- }
- else if (strcmp(*argv,"-envpassin") == 0)
- {
- if (--argc < 1) goto bad;
- if(!(passin= getenv(*(++argv))))
- {
- BIO_printf(bio_err,
- "Can't read environment variable %s\n",
- *argv);
- badops = 1;
- }
- }
- else if (strcmp(*argv,"-extfile") == 0)
- {
- if (--argc < 1) goto bad;
- extfile= *(++argv);
- }
- else if (strcmp(*argv,"-extensions") == 0)
- {
- if (--argc < 1) goto bad;
- extsect= *(++argv);
- }
- else if (strcmp(*argv,"-in") == 0)
- {
- if (--argc < 1) goto bad;
- infile= *(++argv);
- }
- else if (strcmp(*argv,"-out") == 0)
- {
- if (--argc < 1) goto bad;
- outfile= *(++argv);
- }
- else if (strcmp(*argv,"-signkey") == 0)
- {
- if (--argc < 1) goto bad;
- keyfile= *(++argv);
- sign_flag= ++num;
- need_rand = 1;
- }
- else if (strcmp(*argv,"-CA") == 0)
- {
- if (--argc < 1) goto bad;
- CAfile= *(++argv);
- CA_flag= ++num;
- need_rand = 1;
- }
- else if (strcmp(*argv,"-CAkey") == 0)
- {
- if (--argc < 1) goto bad;
- CAkeyfile= *(++argv);
- }
- else if (strcmp(*argv,"-CAserial") == 0)
- {
- if (--argc < 1) goto bad;
- CAserial= *(++argv);
- }
- else if (strcmp(*argv,"-addtrust") == 0)
- {
- if (--argc < 1) goto bad;
- if(!(objtmp = OBJ_txt2obj(*(++argv), 0))) {
- BIO_printf(bio_err,
- "Invalid trust object value %s\n", *argv);
- goto bad;
- }
- if(!trust) trust = sk_ASN1_OBJECT_new_null();
- sk_ASN1_OBJECT_push(trust, objtmp);
- trustout = 1;
- }
- else if (strcmp(*argv,"-addreject") == 0)
- {
- if (--argc < 1) goto bad;
- if(!(objtmp = OBJ_txt2obj(*(++argv), 0))) {
- BIO_printf(bio_err,
- "Invalid reject object value %s\n", *argv);
- goto bad;
- }
- if(!reject) reject = sk_ASN1_OBJECT_new_null();
- sk_ASN1_OBJECT_push(reject, objtmp);
- trustout = 1;
- }
- else if (strcmp(*argv,"-setalias") == 0)
- {
- if (--argc < 1) goto bad;
- alias= *(++argv);
- trustout = 1;
- }
- else if (strcmp(*argv,"-setalias") == 0)
- {
- if (--argc < 1) goto bad;
- alias= *(++argv);
- trustout = 1;
- }
- else if (strcmp(*argv,"-C") == 0)
- C= ++num;
- else if (strcmp(*argv,"-serial") == 0)
- serial= ++num;
- else if (strcmp(*argv,"-modulus") == 0)
- modulus= ++num;
- else if (strcmp(*argv,"-pubkey") == 0)
- pubkey= ++num;
- else if (strcmp(*argv,"-x509toreq") == 0)
- x509req= ++num;
- else if (strcmp(*argv,"-text") == 0)
- text= ++num;
- else if (strcmp(*argv,"-hash") == 0)
- hash= ++num;
- else if (strcmp(*argv,"-subject") == 0)
- subject= ++num;
- else if (strcmp(*argv,"-issuer") == 0)
- issuer= ++num;
- else if (strcmp(*argv,"-fingerprint") == 0)
- fingerprint= ++num;
- else if (strcmp(*argv,"-dates") == 0)
- {
- startdate= ++num;
- enddate= ++num;
- }
- else if (strcmp(*argv,"-purpose") == 0)
- pprint= ++num;
- else if (strcmp(*argv,"-startdate") == 0)
- startdate= ++num;
- else if (strcmp(*argv,"-enddate") == 0)
- enddate= ++num;
- else if (strcmp(*argv,"-noout") == 0)
- noout= ++num;
- else if (strcmp(*argv,"-trustout") == 0)
- trustout= 1;
- else if (strcmp(*argv,"-clrtrust") == 0)
- clrtrust= ++num;
- else if (strcmp(*argv,"-clrreject") == 0)
- clrreject= ++num;
- else if (strcmp(*argv,"-alias") == 0)
- aliasout= ++num;
- else if (strcmp(*argv,"-CAcreateserial") == 0)
- CA_createserial= ++num;
- else if ((md_alg=EVP_get_digestbyname(*argv + 1)))
- {
- /* ok */
- digest=md_alg;
- }
- else
- {
- BIO_printf(bio_err,"unknown option %s\n",*argv);
- badops=1;
- break;
- }
- argc--;
- argv++;
- }
-
- if (badops)
- {
-bad:
- for (pp=x509_usage; (*pp != NULL); pp++)
- BIO_printf(bio_err,*pp);
- goto end;
- }
-
- if (need_rand)
- app_RAND_load_file(NULL, bio_err, 0);
-
- ERR_load_crypto_strings();
-
- if (!X509_STORE_set_default_paths(ctx))
- {
- ERR_print_errors(bio_err);
- goto end;
- }
-
- if ((CAkeyfile == NULL) && (CA_flag) && (CAformat == FORMAT_PEM))
- { CAkeyfile=CAfile; }
- else if ((CA_flag) && (CAkeyfile == NULL))
- {
- BIO_printf(bio_err,"need to specify a CAkey if using the CA command\n");
- goto end;
- }
-
- if (extfile) {
- long errorline;
- X509V3_CTX ctx2;
- if (!(extconf=CONF_load(NULL,extfile,&errorline))) {
- if (errorline <= 0)
- BIO_printf(bio_err,
- "error loading the config file '%s'\n",
- extfile);
- else
- BIO_printf(bio_err,
- "error on line %ld of config file '%s'\n"
- ,errorline,extfile);
- goto end;
- }
- if(!extsect && !(extsect = CONF_get_string(extconf, "default",
- "extensions"))) extsect = "default";
- X509V3_set_ctx_test(&ctx2);
- X509V3_set_conf_lhash(&ctx2, extconf);
- if(!X509V3_EXT_add_conf(extconf, &ctx2, extsect, NULL)) {
- BIO_printf(bio_err,
- "Error Loading extension section %s\n",
- extsect);
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-
-
- if (reqfile)
- {
- EVP_PKEY *pkey;
- X509_CINF *ci;
- BIO *in;
-
- if (!sign_flag && !CA_flag)
- {
- BIO_printf(bio_err,"We need a private key to sign with\n");
- goto end;
- }
- in=BIO_new(BIO_s_file());
- if (in == NULL)
- {
- ERR_print_errors(bio_err);
- goto end;
- }
-
- if (infile == NULL)
- BIO_set_fp(in,stdin,BIO_NOCLOSE|BIO_FP_TEXT);
- else
- {
- if (BIO_read_filename(in,infile) <= 0)
- {
- perror(infile);
- goto end;
- }
- }
- req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL);
- BIO_free(in);
-
- if (req == NULL) { perror(infile); goto end; }
-
- if ( (req->req_info == NULL) ||
- (req->req_info->pubkey == NULL) ||
- (req->req_info->pubkey->public_key == NULL) ||
- (req->req_info->pubkey->public_key->data == NULL))
- {
- BIO_printf(bio_err,"The certificate request appears to corrupted\n");
- BIO_printf(bio_err,"It does not contain a public key\n");
- goto end;
- }
- if ((pkey=X509_REQ_get_pubkey(req)) == NULL)
- {
- BIO_printf(bio_err,"error unpacking public key\n");
- goto end;
- }
- i=X509_REQ_verify(req,pkey);
- EVP_PKEY_free(pkey);
- if (i < 0)
- {
- BIO_printf(bio_err,"Signature verification error\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- if (i == 0)
- {
- BIO_printf(bio_err,"Signature did not match the certificate request\n");
- goto end;
- }
- else
- BIO_printf(bio_err,"Signature ok\n");
-
- X509_NAME_oneline(req->req_info->subject,buf,256);
- BIO_printf(bio_err,"subject=%s\n",buf);
-
- if ((x=X509_new()) == NULL) goto end;
- ci=x->cert_info;
-
- if (!ASN1_INTEGER_set(X509_get_serialNumber(x),0)) goto end;
- if (!X509_set_issuer_name(x,req->req_info->subject)) goto end;
- if (!X509_set_subject_name(x,req->req_info->subject)) goto end;
-
- X509_gmtime_adj(X509_get_notBefore(x),0);
- X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days);
-
- pkey = X509_REQ_get_pubkey(req);
- X509_set_pubkey(x,pkey);
- EVP_PKEY_free(pkey);
- }
- else
- x=load_cert(infile,informat);
-
- if (x == NULL) goto end;
- if (CA_flag)
- {
- xca=load_cert(CAfile,CAformat);
- if (xca == NULL) goto end;
- }
-
- if (!noout || text)
- {
- OBJ_create("2.99999.3",
- "SET.ex3","SET x509v3 extension 3");
-
- out=BIO_new(BIO_s_file());
- if (out == NULL)
- {
- ERR_print_errors(bio_err);
- goto end;
- }
- if (outfile == NULL)
- BIO_set_fp(out,stdout,BIO_NOCLOSE);
- else
- {
- if (BIO_write_filename(out,outfile) <= 0)
- {
- perror(outfile);
- goto end;
- }
- }
- }
-
- if(alias) X509_alias_set(x, (unsigned char *)alias, -1);
-
- if(clrtrust) X509_trust_clear(x);
- if(clrreject) X509_reject_clear(x);
-
- if(trust) {
- for(i = 0; i < sk_ASN1_OBJECT_num(trust); i++) {
- objtmp = sk_ASN1_OBJECT_value(trust, i);
- X509_radd_trust_object(x, objtmp);
- }
- }
-
- if(reject) {
- for(i = 0; i < sk_ASN1_OBJECT_num(reject); i++) {
- objtmp = sk_ASN1_OBJECT_value(reject, i);
- X509_radd_reject_object(x, objtmp);
- }
- }
-
- if (num)
- {
- for (i=1; i<=num; i++)
- {
- if (issuer == i)
- {
- X509_NAME_oneline(X509_get_issuer_name(x),
- buf,256);
- BIO_printf(STDout,"issuer= %s\n",buf);
- }
- else if (subject == i)
- {
- X509_NAME_oneline(X509_get_subject_name(x),
- buf,256);
- BIO_printf(STDout,"subject=%s\n",buf);
- }
- else if (serial == i)
- {
- BIO_printf(STDout,"serial=");
- i2a_ASN1_INTEGER(STDout,x->cert_info->serialNumber);
- BIO_printf(STDout,"\n");
- }
- else if (aliasout == i)
- {
- unsigned char *alstr;
- alstr = X509_alias_get(x, NULL);
- if(alstr) BIO_printf(STDout,"%s\n", alstr);
- else BIO_puts(STDout,"<No Alias>\n");
- }
- else if (hash == i)
- {
- BIO_printf(STDout,"%08lx\n",X509_subject_name_hash(x));
- }
- else if (pprint == i)
- {
- X509_PURPOSE *ptmp;
- int j;
- BIO_printf(STDout, "Certificate purposes:\n");
- for(j = 0; j < X509_PURPOSE_get_count(); j++)
- {
- ptmp = X509_PURPOSE_iget(j);
- purpose_print(STDout, x, ptmp);
- }
- }
- else
- if (modulus == i)
- {
- EVP_PKEY *pkey;
-
- pkey=X509_get_pubkey(x);
- if (pkey == NULL)
- {
- BIO_printf(bio_err,"Modulus=unavailable\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- BIO_printf(STDout,"Modulus=");
-#ifndef NO_RSA
- if (pkey->type == EVP_PKEY_RSA)
- BN_print(STDout,pkey->pkey.rsa->n);
- else