apps/ca.c

   1 /* apps/ca.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58
  59 /* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
  60
  61 #include <stdio.h>
  62 #include <stdlib.h>
  63 #include <string.h>
  64 #include <ctype.h>
  65 #include <sys/types.h>
  66 #include <sys/stat.h>
  67 #include "apps.h"
  68 #include <openssl/conf.h>
  69 #include <openssl/bio.h>
  70 #include <openssl/err.h>
  71 #include <openssl/bn.h>
  72 #include <openssl/txt_db.h>
  73 #include <openssl/evp.h>
  74 #include <openssl/x509.h>
  75 #include <openssl/x509v3.h>
  76 #include <openssl/objects.h>
  77 #include <openssl/ocsp.h>
  78 #include <openssl/pem.h>
  79
  80 #ifdef OPENSSL_SYS_WINDOWS
  81 #define strcasecmp _stricmp
  82 #else
  83 #include <strings.h>
  84 #endif
  85
  86 #ifndef W_OK
  87 #  ifdef OPENSSL_SYS_VMS
  88 #    if defined(__DECC)
  89 #      include <unistd.h>
  90 #    else
  91 #      include <unixlib.h>
  92 #    endif
  93 #  elif !defined(OPENSSL_SYS_VXWORKS)
  94 #    include <sys/file.h>
  95 #  endif
  96 #endif
  97
  98 #ifndef W_OK
  99 #  define F_OK 0
 100 #  define X_OK 1
 101 #  define W_OK 2
 102 #  define R_OK 4
 103 #endif
 104
 105 #undef PROG
 106 #define PROG ca_main
 107
 108 #define BASE_SECTION    "ca"
 109 #define CONFIG_FILE "openssl.cnf"
 110
 111 #define ENV_DEFAULT_CA          "default_ca"
 112
 113 #define ENV_DIR                 "dir"
 114 #define ENV_CERTS               "certs"
 115 #define ENV_CRL_DIR             "crl_dir"
 116 #define ENV_CA_DB               "CA_DB"
 117 #define ENV_NEW_CERTS_DIR       "new_certs_dir"
 118 #define ENV_CERTIFICATE         "certificate"
 119 #define ENV_SERIAL              "serial"
 120 #define ENV_CRL                 "crl"
 121 #define ENV_PRIVATE_KEY         "private_key"
 122 #define ENV_RANDFILE            "RANDFILE"
 123 #define ENV_DEFAULT_DAYS        "default_days"
 124 #define ENV_DEFAULT_STARTDATE   "default_startdate"
 125 #define ENV_DEFAULT_ENDDATE     "default_enddate"
 126 #define ENV_DEFAULT_CRL_DAYS    "default_crl_days"
 127 #define ENV_DEFAULT_CRL_HOURS   "default_crl_hours"
 128 #define ENV_DEFAULT_MD          "default_md"
 129 #define ENV_DEFAULT_EMAIL_DN    "email_in_dn"
 130 #define ENV_PRESERVE            "preserve"
 131 #define ENV_POLICY              "policy"
 132 #define ENV_EXTENSIONS          "x509_extensions"
 133 #define ENV_CRLEXT              "crl_extensions"
 134 #define ENV_MSIE_HACK           "msie_hack"
 135 #define ENV_NAMEOPT             "name_opt"
 136 #define ENV_CERTOPT             "cert_opt"
 137 #define ENV_EXTCOPY             "copy_extensions"
 138
 139 #define ENV_DATABASE            "database"
 140
 141 #define DB_type         0
 142 #define DB_exp_date     1
 143 #define DB_rev_date     2
 144 #define DB_serial       3       /* index - unique */
 145 #define DB_file         4
 146 #define DB_name         5       /* index - unique for active */
 147 #define DB_NUMBER       6
 148
 149 #define DB_TYPE_REV     'R'
 150 #define DB_TYPE_EXP     'E'
 151 #define DB_TYPE_VAL     'V'
 152
 153 /* Additional revocation information types */
 154
 155 #define REV_NONE                0       /* No addditional information */
 156 #define REV_CRL_REASON          1       /* Value is CRL reason code */
 157 #define REV_HOLD                2       /* Value is hold instruction */
 158 #define REV_KEY_COMPROMISE      3       /* Value is cert key compromise time */
 159 #define REV_CA_COMPROMISE       4       /* Value is CA key compromise time */
 160
 161 static char *ca_usage[]={
 162 "usage: ca args\n",
 163 "\n",
 164 " -verbose        - Talk alot while doing things\n",
 165 " -config file    - A config file\n",
 166 " -name arg       - The particular CA definition to use\n",
 167 " -gencrl         - Generate a new CRL\n",
 168 " -crldays days   - Days is when the next CRL is due\n",
 169 " -crlhours hours - Hours is when the next CRL is due\n",
 170 " -startdate YYMMDDHHMMSSZ  - certificate validity notBefore\n",
 171 " -enddate YYMMDDHHMMSSZ    - certificate validity notAfter (overrides -days)\n",
 172 " -days arg       - number of days to certify the certificate for\n",
 173 " -md arg         - md to use, one of md2, md5, sha or sha1\n",
 174 " -policy arg     - The CA 'policy' to support\n",
 175 " -keyfile arg    - private key file\n",
 176 " -keyform arg    - private key file format (PEM or ENGINE)\n",
 177 " -key arg        - key to decode the private key if it is encrypted\n",
 178 " -cert file      - The CA certificate\n",
 179 " -in file        - The input PEM encoded certificate request(s)\n",
 180 " -out file       - Where to put the output file(s)\n",
 181 " -outdir dir     - Where to put output certificates\n",
 182 " -infiles ....   - The last argument, requests to process\n",
 183 " -spkac file     - File contains DN and signed public key and challenge\n",
 184 " -ss_cert file   - File contains a self signed cert to sign\n",
 185 " -preserveDN     - Don't re-order the DN\n",
 186 " -noemailDN      - Don't add the EMAIL field into certificate' subject\n",
 187 " -batch          - Don't ask questions\n",
 188 " -msie_hack      - msie modifications to handle all those universal strings\n",
 189 " -revoke file    - Revoke a certificate (given in file)\n",
 190 " -subj arg       - Use arg instead of request's subject\n",
 191 " -extensions ..  - Extension section (override value in config file)\n",
 192 " -extfile file   - Configuration file with X509v3 extentions to add\n",
 193 " -crlexts ..     - CRL extension section (override value in config file)\n",
 194 " -engine e       - use engine e, possibly a hardware device.\n",
 195 " -status serial  - Shows certificate status given the serial number\n",
 196 " -updatedb       - Updates db for expired certificates\n",
 197 NULL
 198 };
 199
 200 #ifdef EFENCE
 201 extern int EF_PROTECT_FREE;
 202 extern int EF_PROTECT_BELOW;
 203 extern int EF_ALIGNMENT;
 204 #endif
 205
 206 static void lookup_fail(char *name,char *tag);
 207 static unsigned long index_serial_hash(const char **a);
 208 static int index_serial_cmp(const char **a, const char **b);
 209 static unsigned long index_name_hash(const char **a);
 210 static int index_name_qual(char **a);
 211 static int index_name_cmp(const char **a,const char **b);
 212 static BIGNUM *load_serial(char *serialfile);
 213 static int save_serial(char *serialfile, BIGNUM *serial);
 214 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 215                    const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,TXT_DB *db,
 216                    BIGNUM *serial, char *subj, int email_dn, char *startdate,
 217                    char *enddate, long days, int batch, char *ext_sect, CONF *conf,
 218                    int verbose, unsigned long certopt, unsigned long nameopt,
 219                    int default_op, int ext_copy);
 220 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 221                         const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 222                         TXT_DB *db, BIGNUM *serial, char *subj, int email_dn,
 223                         char *startdate, char *enddate, long days, int batch,
 224                         char *ext_sect, CONF *conf,int verbose, unsigned long certopt,
 225                         unsigned long nameopt, int default_op, int ext_copy,
 226                         ENGINE *e);
 227 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 228                          const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 229                          TXT_DB *db, BIGNUM *serial,char *subj, int email_dn,
 230                          char *startdate, char *enddate, long days, char *ext_sect,
 231                          CONF *conf, int verbose, unsigned long certopt,
 232                          unsigned long nameopt, int default_op, int ext_copy);
 233 static int fix_data(int nid, int *type);
 234 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
 235 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
 236         STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,char *subj,
 237         int email_dn, char *startdate, char *enddate, long days, int batch,
 238         int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
 239         unsigned long certopt, unsigned long nameopt, int default_op,
 240         int ext_copy);
 241 static int do_revoke(X509 *x509, TXT_DB *db, int ext, char *extval);
 242 static int get_certificate_status(const char *ser_status, TXT_DB *db);
 243 static int do_updatedb(TXT_DB *db);
 244 static int check_time_format(char *str);
 245 char *make_revocation_str(int rev_type, char *rev_arg);
 246 int make_revoked(X509_REVOKED *rev, char *str);
 247 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
 248 static CONF *conf=NULL;
 249 static CONF *extconf=NULL;
 250 static char *section=NULL;
 251
 252 static int preserve=0;
 253 static int msie_hack=0;
 254
 255 static IMPLEMENT_LHASH_HASH_FN(index_serial_hash,const char **)
 256 static IMPLEMENT_LHASH_COMP_FN(index_serial_cmp,const char **)
 257 static IMPLEMENT_LHASH_HASH_FN(index_name_hash,const char **)
 258 static IMPLEMENT_LHASH_COMP_FN(index_name_cmp,const char **)
 259
 260
 261 int MAIN(int, char **);
 262
 263 int MAIN(int argc, char **argv)
 264         {
 265         ENGINE *e = NULL;
 266         char *key=NULL,*passargin=NULL;
 267         int free_key = 0;
 268         int total=0;
 269         int total_done=0;
 270         int badops=0;
 271         int ret=1;
 272         int email_dn=1;
 273         int req=0;
 274         int verbose=0;
 275         int gencrl=0;
 276         int dorevoke=0;
 277         int doupdatedb=0;
 278         long crldays=0;
 279         long crlhours=0;
 280         long errorline= -1;
 281         char *configfile=NULL;
 282         char *md=NULL;
 283         char *policy=NULL;
 284         char *keyfile=NULL;
 285         char *certfile=NULL;
 286         int keyform=FORMAT_PEM;
 287         char *infile=NULL;
 288         char *spkac_file=NULL;
 289         char *ss_cert_file=NULL;
 290         char *ser_status=NULL;
 291         EVP_PKEY *pkey=NULL;
 292         int output_der = 0;
 293         char *outfile=NULL;
 294         char *outdir=NULL;
 295         char *serialfile=NULL;
 296         char *extensions=NULL;
 297         char *extfile=NULL;
 298         char *subj=NULL;
 299         char *tmp_email_dn=NULL;
 300         char *crl_ext=NULL;
 301         int rev_type = REV_NONE;
 302         char *rev_arg = NULL;
 303         BIGNUM *serial=NULL;
 304         char *startdate=NULL;
 305         char *enddate=NULL;
 306         long days=0;
 307         int batch=0;
 308         int notext=0;
 309         unsigned long nameopt = 0, certopt = 0;
 310         int default_op = 1;
 311         int ext_copy = EXT_COPY_NONE;
 312         X509 *x509=NULL;
 313         X509 *x=NULL;
 314         BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
 315         char *dbfile=NULL;
 316         TXT_DB *db=NULL;
 317         X509_CRL *crl=NULL;
 318         X509_REVOKED *r=NULL;
 319         ASN1_TIME *tmptm;
 320         ASN1_INTEGER *tmpser;
 321         char **pp,*p,*f;
 322         int i,j;
 323         long l;
 324         const EVP_MD *dgst=NULL;
 325         STACK_OF(CONF_VALUE) *attribs=NULL;
 326         STACK_OF(X509) *cert_sk=NULL;
 327 #undef BSIZE
 328 #define BSIZE 256
 329         MS_STATIC char buf[3][BSIZE];
 330         char *randfile=NULL;
 331         char *engine = NULL;
 332
 333 #ifdef EFENCE
 334 EF_PROTECT_FREE=1;
 335 EF_PROTECT_BELOW=1;
 336 EF_ALIGNMENT=0;
 337 #endif
 338
 339         apps_startup();
 340
 341         conf = NULL;
 342         key = NULL;
 343         section = NULL;
 344
 345         preserve=0;
 346         msie_hack=0;
 347         if (bio_err == NULL)
 348                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
 349                         BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 350
 351         argc--;
 352         argv++;
 353         while (argc >= 1)
 354                 {
 355                 if      (strcmp(*argv,"-verbose") == 0)
 356                         verbose=1;
 357                 else if (strcmp(*argv,"-config") == 0)
 358                         {
 359                         if (--argc < 1) goto bad;
 360                         configfile= *(++argv);
 361                         }
 362                 else if (strcmp(*argv,"-name") == 0)
 363                         {
 364                         if (--argc < 1) goto bad;
 365                         section= *(++argv);
 366                         }
 367                 else if (strcmp(*argv,"-subj") == 0)
 368                         {
 369                         if (--argc < 1) goto bad;
 370                         subj= *(++argv);
 371                         /* preserve=1; */
 372                         }
 373                 else if (strcmp(*argv,"-startdate") == 0)
 374                         {
 375                         if (--argc < 1) goto bad;
 376                         startdate= *(++argv);
 377                         }
 378                 else if (strcmp(*argv,"-enddate") == 0)
 379                         {
 380                         if (--argc < 1) goto bad;
 381                         enddate= *(++argv);
 382                         }
 383                 else if (strcmp(*argv,"-days") == 0)
 384                         {
 385                         if (--argc < 1) goto bad;
 386                         days=atoi(*(++argv));
 387                         }
 388                 else if (strcmp(*argv,"-md") == 0)
 389                         {
 390                         if (--argc < 1) goto bad;
 391                         md= *(++argv);
 392                         }
 393                 else if (strcmp(*argv,"-policy") == 0)
 394                         {
 395                         if (--argc < 1) goto bad;
 396                         policy= *(++argv);
 397                         }
 398                 else if (strcmp(*argv,"-keyfile") == 0)
 399                         {
 400                         if (--argc < 1) goto bad;
 401                         keyfile= *(++argv);
 402                         }
 403                 else if (strcmp(*argv,"-keyform") == 0)
 404                         {
 405                         if (--argc < 1) goto bad;
 406                         keyform=str2fmt(*(++argv));
 407                         }
 408                 else if (strcmp(*argv,"-passin") == 0)
 409                         {
 410                         if (--argc < 1) goto bad;
 411                         passargin= *(++argv);
 412                         }
 413                 else if (strcmp(*argv,"-key") == 0)
 414                         {
 415                         if (--argc < 1) goto bad;
 416                         key= *(++argv);
 417                         }
 418                 else if (strcmp(*argv,"-cert") == 0)
 419                         {
 420                         if (--argc < 1) goto bad;
 421                         certfile= *(++argv);
 422                         }
 423                 else if (strcmp(*argv,"-in") == 0)
 424                         {
 425                         if (--argc < 1) goto bad;
 426                         infile= *(++argv);
 427                         req=1;
 428                         }
 429                 else if (strcmp(*argv,"-out") == 0)
 430                         {
 431                         if (--argc < 1) goto bad;
 432                         outfile= *(++argv);
 433                         }
 434                 else if (strcmp(*argv,"-outdir") == 0)
 435                         {
 436                         if (--argc < 1) goto bad;
 437                         outdir= *(++argv);
 438                         }
 439                 else if (strcmp(*argv,"-notext") == 0)
 440                         notext=1;
 441                 else if (strcmp(*argv,"-batch") == 0)
 442                         batch=1;
 443                 else if (strcmp(*argv,"-preserveDN") == 0)
 444                         preserve=1;
 445                 else if (strcmp(*argv,"-noemailDN") == 0)
 446                         email_dn=0;
 447                 else if (strcmp(*argv,"-gencrl") == 0)
 448                         gencrl=1;
 449                 else if (strcmp(*argv,"-msie_hack") == 0)
 450                         msie_hack=1;
 451                 else if (strcmp(*argv,"-crldays") == 0)
 452                         {
 453                         if (--argc < 1) goto bad;
 454                         crldays= atol(*(++argv));
 455                         }
 456                 else if (strcmp(*argv,"-crlhours") == 0)
 457                         {
 458                         if (--argc < 1) goto bad;
 459                         crlhours= atol(*(++argv));
 460                         }
 461                 else if (strcmp(*argv,"-infiles") == 0)
 462                         {
 463                         argc--;
 464                         argv++;
 465                         req=1;
 466                         break;
 467                         }
 468                 else if (strcmp(*argv, "-ss_cert") == 0)
 469                         {
 470                         if (--argc < 1) goto bad;
 471                         ss_cert_file = *(++argv);
 472                         req=1;
 473                         }
 474                 else if (strcmp(*argv, "-spkac") == 0)
 475                         {
 476                         if (--argc < 1) goto bad;
 477                         spkac_file = *(++argv);
 478                         req=1;
 479                         }
 480                 else if (strcmp(*argv,"-revoke") == 0)
 481                         {
 482                         if (--argc < 1) goto bad;
 483                         infile= *(++argv);
 484                         dorevoke=1;
 485                         }
 486                 else if (strcmp(*argv,"-extensions") == 0)
 487                         {
 488                         if (--argc < 1) goto bad;
 489                         extensions= *(++argv);
 490                         }
 491                 else if (strcmp(*argv,"-extfile") == 0)
 492                         {
 493                         if (--argc < 1) goto bad;
 494                         extfile= *(++argv);
 495                         }
 496                 else if (strcmp(*argv,"-status") == 0)
 497                         {
 498                         if (--argc < 1) goto bad;
 499                         ser_status= *(++argv);
 500                         }
 501                 else if (strcmp(*argv,"-updatedb") == 0)
 502                         {
 503                         doupdatedb=1;
 504                         }
 505                 else if (strcmp(*argv,"-crlexts") == 0)
 506                         {
 507                         if (--argc < 1) goto bad;
 508                         crl_ext= *(++argv);
 509                         }
 510                 else if (strcmp(*argv,"-crl_reason") == 0)
 511                         {
 512                         if (--argc < 1) goto bad;
 513                         rev_arg = *(++argv);
 514                         rev_type = REV_CRL_REASON;
 515                         }
 516                 else if (strcmp(*argv,"-crl_hold") == 0)
 517                         {
 518                         if (--argc < 1) goto bad;
 519                         rev_arg = *(++argv);
 520                         rev_type = REV_HOLD;
 521                         }
 522                 else if (strcmp(*argv,"-crl_compromise") == 0)
 523                         {
 524                         if (--argc < 1) goto bad;
 525                         rev_arg = *(++argv);
 526                         rev_type = REV_KEY_COMPROMISE;
 527                         }
 528                 else if (strcmp(*argv,"-crl_CA_compromise") == 0)
 529                         {
 530                         if (--argc < 1) goto bad;
 531                         rev_arg = *(++argv);
 532                         rev_type = REV_CA_COMPROMISE;
 533                         }
 534                 else if (strcmp(*argv,"-engine") == 0)
 535                         {
 536                         if (--argc < 1) goto bad;
 537                         engine= *(++argv);
 538                         }
 539                 else
 540                         {
 541 bad:
 542                         BIO_printf(bio_err,"unknown option %s\n",*argv);
 543                         badops=1;
 544                         break;
 545                         }
 546                 argc--;
 547                 argv++;
 548                 }
 549
 550         if (badops)
 551                 {
 552                 for (pp=ca_usage; (*pp != NULL); pp++)
 553                         BIO_printf(bio_err,"%s",*pp);
 554                 goto err;
 555                 }
 556
 557         ERR_load_crypto_strings();
 558
 559         e = setup_engine(bio_err, engine, 0);
 560
 561         /*****************************************************************/
 562         if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
 563         if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
 564         if (configfile == NULL)
 565                 {
 566                 /* We will just use 'buf[0]' as a temporary buffer.  */
 567 #ifdef OPENSSL_SYS_VMS
 568                 strncpy(buf[0],X509_get_default_cert_area(),
 569                         sizeof(buf[0])-1-sizeof(CONFIG_FILE));
 570 #else
 571                 strncpy(buf[0],X509_get_default_cert_area(),
 572                         sizeof(buf[0])-2-sizeof(CONFIG_FILE));
 573                 buf[0][sizeof(buf[0])-2-sizeof(CONFIG_FILE)]='\0';
 574                 strcat(buf[0],"/");
 575 #endif
 576                 strcat(buf[0],CONFIG_FILE);
 577                 configfile=buf[0];
 578                 }
 579
 580         BIO_printf(bio_err,"Using configuration from %s\n",configfile);
 581         conf = NCONF_new(NULL);
 582         if (NCONF_load(conf,configfile,&errorline) <= 0)
 583                 {
 584                 if (errorline <= 0)
 585                         BIO_printf(bio_err,"error loading the config file '%s'\n",
 586                                 configfile);
 587                 else
 588                         BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
 589                                 ,errorline,configfile);
 590                 goto err;
 591                 }
 592
 593         if (!load_config(bio_err, conf))
 594                 goto err;
 595
 596         /* Lets get the config section we are using */
 597         if (section == NULL)
 598                 {
 599                 section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
 600                 if (section == NULL)
 601                         {
 602                         lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
 603                         goto err;
 604                         }
 605                 }
 606
 607         if (conf != NULL)
 608                 {
 609                 p=NCONF_get_string(conf,NULL,"oid_file");
 610                 if (p == NULL)
 611                         ERR_clear_error();
 612                 if (p != NULL)
 613                         {
 614                         BIO *oid_bio;
 615
 616                         oid_bio=BIO_new_file(p,"r");
 617                         if (oid_bio == NULL)
 618                                 {
 619                                 /*
 620                                 BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
 621                                 ERR_print_errors(bio_err);
 622                                 */
 623                                 ERR_clear_error();
 624                                 }
 625                         else
 626                                 {
 627                                 OBJ_create_objects(oid_bio);
 628                                 BIO_free(oid_bio);
 629                                 }
 630                         }
 631                 if (!add_oid_section(bio_err,conf))
 632                         {
 633                         ERR_print_errors(bio_err);
 634                         goto err;
 635                         }
 636                 }
 637
 638         randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
 639         if (randfile == NULL)
 640                 ERR_clear_error();
 641         app_RAND_load_file(randfile, bio_err, 0);
 642
 643         in=BIO_new(BIO_s_file());
 644         out=BIO_new(BIO_s_file());
 645         Sout=BIO_new(BIO_s_file());
 646         Cout=BIO_new(BIO_s_file());
 647         if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
 648                 {
 649                 ERR_print_errors(bio_err);
 650                 goto err;
 651                 }
 652
 653         /*****************************************************************/
 654         /* report status of cert with serial number given on command line */
 655         if (ser_status)
 656         {
 657                 if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 658                         {
 659                         lookup_fail(section,ENV_DATABASE);
 660                         goto err;
 661                         }
 662                 if (BIO_read_filename(in,dbfile) <= 0)
 663                         {
 664                         perror(dbfile);
 665                         BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
 666                         goto err;
 667                         }
 668                 db=TXT_DB_read(in,DB_NUMBER);
 669                 if (db == NULL) goto err;
 670
 671                 if (!make_serial_index(db))
 672                         goto err;
 673
 674                 if (get_certificate_status(ser_status,db) != 1)
 675                         BIO_printf(bio_err,"Error verifying serial %s!\n",
 676                                  ser_status);
 677                 goto err;
 678         }
 679
 680         /*****************************************************************/
 681         /* we definitely need a public key, so let's get it */
 682
 683         if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
 684                 section,ENV_PRIVATE_KEY)) == NULL))
 685                 {
 686                 lookup_fail(section,ENV_PRIVATE_KEY);
 687                 goto err;
 688                 }
 689         if (!key)
 690                 {
 691                 free_key = 1;
 692                 if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
 693                         {
 694                         BIO_printf(bio_err,"Error getting password\n");
 695                         goto err;
 696                         }
 697                 }
 698         pkey = load_key(bio_err, keyfile, keyform, key, e,
 699                 "CA private key");
 700         if (key) memset(key,0,strlen(key));
 701         if (pkey == NULL)
 702                 {
 703                 /* load_key() has already printed an appropriate message */
 704                 goto err;
 705                 }
 706
 707         /*****************************************************************/
 708         /* we need a certificate */
 709         if ((certfile == NULL) && ((certfile=NCONF_get_string(conf,
 710                 section,ENV_CERTIFICATE)) == NULL))
 711                 {
 712                 lookup_fail(section,ENV_CERTIFICATE);
 713                 goto err;
 714                 }
 715         x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
 716                 "CA certificate");
 717         if (x509 == NULL)
 718                 goto err;
 719
 720         if (!X509_check_private_key(x509,pkey))
 721                 {
 722                 BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
 723                 goto err;
 724                 }
 725
 726         f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
 727         if (f == NULL)
 728                 ERR_clear_error();
 729         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 730                 preserve=1;
 731         f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
 732         if (f == NULL)
 733                 ERR_clear_error();
 734         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 735                 msie_hack=1;
 736
 737         f=NCONF_get_string(conf,section,ENV_NAMEOPT);
 738
 739         if (f)
 740                 {
 741                 if (!set_name_ex(&nameopt, f))
 742                         {
 743                         BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
 744                         goto err;
 745                         }
 746                 default_op = 0;
 747                 }
 748         else
 749                 ERR_clear_error();
 750
 751         f=NCONF_get_string(conf,section,ENV_CERTOPT);
 752
 753         if (f)
 754                 {
 755                 if (!set_cert_ex(&certopt, f))
 756                         {
 757                         BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
 758                         goto err;
 759                         }
 760                 default_op = 0;
 761                 }
 762         else
 763                 ERR_clear_error();
 764
 765         f=NCONF_get_string(conf,section,ENV_EXTCOPY);
 766
 767         if (f)
 768                 {
 769                 if (!set_ext_copy(&ext_copy, f))
 770                         {
 771                         BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
 772                         goto err;
 773                         }
 774                 }
 775         else
 776                 ERR_clear_error();
 777
 778         /*****************************************************************/
 779         /* lookup where to write new certificates */
 780         if ((outdir == NULL) && (req))
 781                 {
 782                 struct stat sb;
 783
 784                 if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
 785                         == NULL)
 786                         {
 787                         BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
 788                         goto err;
 789                         }
 790 #ifndef OPENSSL_SYS_VMS
 791             /* outdir is a directory spec, but access() for VMS demands a
 792                filename.  In any case, stat(), below, will catch the problem
 793                if outdir is not a directory spec, and the fopen() or open()
 794                will catch an error if there is no write access.
 795
 796                Presumably, this problem could also be solved by using the DEC
 797                C routines to convert the directory syntax to Unixly, and give
 798                that to access().  However, time's too short to do that just
 799                now.
 800             */
 801                 if (access(outdir,R_OK|W_OK|X_OK) != 0)
 802                         {
 803                         BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
 804                         perror(outdir);
 805                         goto err;
 806                         }
 807
 808                 if (stat(outdir,&sb) != 0)
 809                         {
 810                         BIO_printf(bio_err,"unable to stat(%s)\n",outdir);
 811                         perror(outdir);
 812                         goto err;
 813                         }
 814 #ifdef S_IFDIR
 815                 if (!(sb.st_mode & S_IFDIR))
 816                         {
 817                         BIO_printf(bio_err,"%s need to be a directory\n",outdir);
 818                         perror(outdir);
 819                         goto err;
 820                         }
 821 #endif
 822 #endif
 823                 }
 824
 825         /*****************************************************************/
 826         /* we need to load the database file */
 827         if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 828                 {
 829                 lookup_fail(section,ENV_DATABASE);
 830                 goto err;
 831                 }
 832         if (BIO_read_filename(in,dbfile) <= 0)
 833                 {
 834                 perror(dbfile);
 835                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
 836                 goto err;
 837                 }
 838         db=TXT_DB_read(in,DB_NUMBER);
 839         if (db == NULL) goto err;
 840
 841         /* Lets check some fields */
 842         for (i=0; i<sk_num(db->data); i++)
 843                 {
 844                 pp=(char **)sk_value(db->data,i);
 845                 if ((pp[DB_type][0] != DB_TYPE_REV) &&
 846                         (pp[DB_rev_date][0] != '\0'))
 847                         {
 848                         BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
 849                         goto err;
 850                         }
 851                 if ((pp[DB_type][0] == DB_TYPE_REV) &&
 852                         !make_revoked(NULL, pp[DB_rev_date]))
 853                         {
 854                         BIO_printf(bio_err," in entry %d\n", i+1);
 855                         goto err;
 856                         }
 857                 if (!check_time_format(pp[DB_exp_date]))
 858                         {
 859                         BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
 860                         goto err;
 861                         }
 862                 p=pp[DB_serial];
 863                 j=strlen(p);
 864                 if (*p == '-')
 865                         {
 866                         p++;
 867                         j--;
 868                         }
 869                 if ((j&1) || (j < 2))
 870                         {
 871                         BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
 872                         goto err;
 873                         }
 874                 while (*p)
 875                         {
 876                         if (!(  ((*p >= '0') && (*p <= '9')) ||
 877                                 ((*p >= 'A') && (*p <= 'F')) ||
 878                                 ((*p >= 'a') && (*p <= 'f')))  )
 879                                 {
 880                                 BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
 881                                 goto err;
 882                                 }
 883                         p++;
 884                         }
 885                 }
 886         if (verbose)
 887                 {
 888                 BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
 889 #ifdef OPENSSL_SYS_VMS
 890                 {
 891                 BIO *tmpbio = BIO_new(BIO_f_linebuffer());
 892                 out = BIO_push(tmpbio, out);
 893                 }
 894 #endif
 895                 TXT_DB_write(out,db);
 896                 BIO_printf(bio_err,"%d entries loaded from the database\n",
 897                         db->data->num);
 898                 BIO_printf(bio_err,"generating index\n");
 899                 }
 900
 901         if (!make_serial_index(db))
 902                 goto err;
 903
 904         if (!TXT_DB_create_index(db, DB_name, index_name_qual,
 905                         LHASH_HASH_FN(index_name_hash),
 906                         LHASH_COMP_FN(index_name_cmp)))
 907                 {
 908                 BIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\n",
 909                         db->error,db->arg1,db->arg2);
 910                 goto err;
 911                 }
 912
 913         /*****************************************************************/
 914         /* Update the db file for expired certificates */
 915         if (doupdatedb)
 916                 {
 917                 if (verbose)
 918                         BIO_printf(bio_err, "Updating %s ...\n",
 919                                                         dbfile);
 920
 921                 i = do_updatedb(db);
 922                 if (i == -1)
 923                         {
 924                         BIO_printf(bio_err,"Malloc failure\n");
 925                         goto err;
 926                         }
 927                 else if (i == 0)
 928                         {
 929                         if (verbose) BIO_printf(bio_err,
 930                                         "No entries found to mark expired\n");
 931                         }
 932                 else
 933                         {
 934                         out = BIO_new(BIO_s_file());
 935                         if (out == NULL)
 936                                 {
 937                                 ERR_print_errors(bio_err);
 938                                 goto err;
 939                                 }
 940
 941 #ifndef OPENSSL_SYS_VMS
 942                         j = BIO_snprintf(buf[0], sizeof buf[0], "%s.new", dbfile);
 943 #else
 944                         j = BIO_snprintf(buf[0], sizeof buf[0], "%s-new", dbfile);
 945 #endif
 946                         if (j < 0 || j >= sizeof buf[0])
 947                                 {
 948                                 BIO_printf(bio_err, "file name too long\n");
 949                                 goto err;
 950                                 }
 951                         if (BIO_write_filename(out,buf[0]) <= 0)
 952                                 {
 953                                 perror(dbfile);
 954                                 BIO_printf(bio_err,"unable to open '%s'\n",
 955                                                                         dbfile);
 956                                 goto err;
 957                                 }
 958                         j=TXT_DB_write(out,db);
 959                         if (j <= 0) goto err;
 960
 961                         BIO_free(out);
 962                         out = NULL;
 963 #ifndef OPENSSL_SYS_VMS
 964                         j = BIO_snprintf(buf[1], sizeof buf[1], "%s.old", dbfile);
 965 #else
 966                         j = BIO_snprintf(buf[1], sizeof buf[1], "%s-old", dbfile);
 967 #endif
 968                         if (j < 0 || j >= sizeof buf[1])
 969                                 {
 970                                 BIO_printf(bio_err, "file name too long\n");
 971                                 goto err;
 972                                 }
 973                         if (rename(dbfile,buf[1]) < 0)
 974                                 {
 975                                 BIO_printf(bio_err,
 976                                                 "unable to rename %s to %s\n",
 977                                                 dbfile, buf[1]);
 978                                 perror("reason");
 979                                 goto err;
 980                                 }
 981                         if (rename(buf[0],dbfile) < 0)
 982                                 {
 983                                 BIO_printf(bio_err,
 984                                                 "unable to rename %s to %s\n",
 985                                                 buf[0],dbfile);
 986                                 perror("reason");
 987                                 rename(buf[1],dbfile);
 988                                 goto err;
 989                                 }
 990
 991                         if (verbose) BIO_printf(bio_err,
 992                                 "Done. %d entries marked as expired\n",i);
 993                         }
 994                         goto err;
 995                 }
 996
 997         /*****************************************************************/
 998         /* Read extentions config file                                   */
 999         if (extfile)
1000                 {
1001                 extconf = NCONF_new(NULL);
1002                 if (NCONF_load(extconf,extfile,&errorline) <= 0)
1003                         {
1004                         if (errorline <= 0)
1005                                 BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
1006                                         extfile);
1007                         else
1008                                 BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
1009                                         errorline,extfile);
1010                         ret = 1;
1011                         goto err;
1012                         }
1013
1014                 if (verbose)
1015                         BIO_printf(bio_err, "Succesfully loaded extensions file %s\n", extfile);
1016
1017                 /* We can have sections in the ext file */
1018                 if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
1019                         extensions = "default";
1020                 }
1021
1022         /*****************************************************************/
1023         if (req || gencrl)
1024                 {
1025                 if (outfile != NULL)
1026                         {
1027                         if (BIO_write_filename(Sout,outfile) <= 0)
1028                                 {
1029                                 perror(outfile);
1030                                 goto err;
1031                                 }
1032                         }
1033                 else
1034                         {
1035                         BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
1036 #ifdef OPENSSL_SYS_VMS
1037                         {
1038                         BIO *tmpbio = BIO_new(BIO_f_linebuffer());
1039                         Sout = BIO_push(tmpbio, Sout);
1040                         }
1041 #endif
1042                         }
1043                 }
1044
1045         if (req)
1046                 {
1047                 if ((md == NULL) && ((md=NCONF_get_string(conf,
1048                         section,ENV_DEFAULT_MD)) == NULL))
1049                         {
1050                         lookup_fail(section,ENV_DEFAULT_MD);
1051                         goto err;
1052                         }
1053                 if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
1054                         section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
1055                         {
1056                         if(strcmp(tmp_email_dn,"no") == 0)
1057                                 email_dn=0;
1058                         }
1059                 if ((dgst=EVP_get_digestbyname(md)) == NULL)
1060                         {
1061                         BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1062                         goto err;
1063                         }
1064                 if (verbose)
1065                         BIO_printf(bio_err,"message digest is %s\n",
1066                                 OBJ_nid2ln(dgst->type));
1067                 if ((policy == NULL) && ((policy=NCONF_get_string(conf,
1068                         section,ENV_POLICY)) == NULL))
1069                         {
1070                         lookup_fail(section,ENV_POLICY);
1071                         goto err;
1072                         }
1073                 if (verbose)
1074                         BIO_printf(bio_err,"policy is %s\n",policy);
1075
1076                 if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
1077                         == NULL)
1078                         {
1079                         lookup_fail(section,ENV_SERIAL);
1080                         goto err;
1081                         }
1082
1083                 if (!extconf)
1084                         {
1085                         /* no '-extfile' option, so we look for extensions
1086                          * in the main configuration file */
1087                         if (!extensions)
1088                                 {
1089                                 extensions=NCONF_get_string(conf,section,
1090                                                                 ENV_EXTENSIONS);
1091                                 if (!extensions)
1092                                         ERR_clear_error();
1093                                 }
1094                         if (extensions)
1095                                 {
1096                                 /* Check syntax of file */
1097                                 X509V3_CTX ctx;
1098                                 X509V3_set_ctx_test(&ctx);
1099                                 X509V3_set_nconf(&ctx, conf);
1100                                 if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
1101                                                                 NULL))
1102                                         {
1103                                         BIO_printf(bio_err,
1104                                         "Error Loading extension section %s\n",
1105                                                                  extensions);
1106                                         ret = 1;
1107                                         goto err;
1108                                         }
1109                                 }
1110                         }
1111
1112                 if (startdate == NULL)
1113                         {
1114                         startdate=NCONF_get_string(conf,section,
1115                                 ENV_DEFAULT_STARTDATE);
1116                         if (startdate == NULL)
1117                                 ERR_clear_error();
1118                         }
1119                 if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))
1120                         {
1121                         BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");
1122                         goto err;
1123                         }
1124                 if (startdate == NULL) startdate="today";
1125
1126                 if (enddate == NULL)
1127                         {
1128                         enddate=NCONF_get_string(conf,section,
1129                                 ENV_DEFAULT_ENDDATE);
1130                         if (enddate == NULL)
1131                                 ERR_clear_error();
1132                         }
1133                 if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))
1134                         {
1135                         BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");
1136                         goto err;
1137                         }
1138
1139                 if (days == 0)
1140                         {
1141                         if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
1142                                 days = 0;
1143                         }
1144                 if (!enddate && (days == 0))
1145                         {
1146                         BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
1147                         goto err;
1148                         }
1149
1150                 if ((serial=load_serial(serialfile)) == NULL)
1151                         {
1152                         BIO_printf(bio_err,"error while loading serial number\n");
1153                         goto err;
1154                         }
1155                 if (verbose)
1156                         {
1157                         if ((f=BN_bn2hex(serial)) == NULL) goto err;
1158                         BIO_printf(bio_err,"next serial number is %s\n",f);
1159                         OPENSSL_free(f);
1160                         }
1161
1162                 if ((attribs=NCONF_get_section(conf,policy)) == NULL)
1163                         {
1164                         BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
1165                         goto err;
1166                         }
1167
1168                 if ((cert_sk=sk_X509_new_null()) == NULL)
1169                         {
1170                         BIO_printf(bio_err,"Memory allocation failure\n");
1171                         goto err;
1172                         }
1173                 if (spkac_file != NULL)
1174                         {
1175                         total++;
1176                         j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
1177                                 serial,subj,email_dn,startdate,enddate,days,extensions,
1178                                 conf,verbose,certopt,nameopt,default_op,ext_copy);
1179                         if (j < 0) goto err;
1180                         if (j > 0)
1181                                 {
1182                                 total_done++;
1183                                 BIO_printf(bio_err,"\n");
1184                                 if (!BN_add_word(serial,1)) goto err;
1185                                 if (!sk_X509_push(cert_sk,x))
1186                                         {
1187                                         BIO_printf(bio_err,"Memory allocation failure\n");
1188                                         goto err;
1189                                         }
1190                                 if (outfile)
1191                                         {
1192                                         output_der = 1;
1193                                         batch = 1;
1194                                         }
1195                                 }
1196                         }
1197                 if (ss_cert_file != NULL)
1198                         {
1199                         total++;
1200                         j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
1201                                 db,serial,subj,email_dn,startdate,enddate,days,batch,
1202                                 extensions,conf,verbose, certopt, nameopt,
1203                                 default_op, ext_copy, e);
1204                         if (j < 0) goto err;
1205                         if (j > 0)
1206                                 {
1207                                 total_done++;
1208                                 BIO_printf(bio_err,"\n");
1209                                 if (!BN_add_word(serial,1)) goto err;
1210                                 if (!sk_X509_push(cert_sk,x))
1211                                         {
1212                                         BIO_printf(bio_err,"Memory allocation failure\n");
1213                                         goto err;
1214                                         }
1215                                 }
1216                         }
1217                 if (infile != NULL)
1218                         {
1219                         total++;
1220                         j=certify(&x,infile,pkey,x509,dgst,attribs,db,
1221                                 serial,subj,email_dn,startdate,enddate,days,batch,
1222                                 extensions,conf,verbose, certopt, nameopt,
1223                                 default_op, ext_copy);
1224                         if (j < 0) goto err;
1225                         if (j > 0)
1226                                 {
1227                                 total_done++;
1228                                 BIO_printf(bio_err,"\n");
1229                                 if (!BN_add_word(serial,1)) goto err;
1230                                 if (!sk_X509_push(cert_sk,x))
1231                                         {
1232                                         BIO_printf(bio_err,"Memory allocation failure\n");
1233                                         goto err;
1234                                         }
1235                                 }
1236                         }
1237                 for (i=0; i<argc; i++)
1238                         {
1239                         total++;
1240                         j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
1241                                 serial,subj,email_dn,startdate,enddate,days,batch,
1242                                 extensions,conf,verbose, certopt, nameopt,
1243                                 default_op, ext_copy);
1244                         if (j < 0) goto err;
1245                         if (j > 0)
1246                                 {
1247                                 total_done++;
1248                                 BIO_printf(bio_err,"\n");
1249                                 if (!BN_add_word(serial,1)) goto err;
1250                                 if (!sk_X509_push(cert_sk,x))
1251                                         {
1252                                         BIO_printf(bio_err,"Memory allocation failure\n");
1253                                         goto err;
1254                                         }
1255                                 }
1256                         }
1257                 /* we have a stack of newly certified certificates
1258                  * and a data base and serial number that need
1259                  * updating */
1260
1261                 if (sk_X509_num(cert_sk) > 0)
1262                         {
1263                         if (!batch)
1264                                 {
1265                                 BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
1266                                 (void)BIO_flush(bio_err);
1267                                 buf[0][0]='\0';
1268                                 fgets(buf[0],10,stdin);
1269                                 if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
1270                                         {
1271                                         BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
1272                                         ret=0;
1273                                         goto err;
1274                                         }
1275                                 }
1276
1277                         BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
1278
1279                         strncpy(buf[0],serialfile,BSIZE-4);
1280                         buf[0][BSIZE-4]='\0';
1281
1282 #ifdef OPENSSL_SYS_VMS
1283                         strcat(buf[0],"-new");
1284 #else
1285                         strcat(buf[0],".new");
1286 #endif
1287
1288                         if (!save_serial(buf[0],serial)) goto err;
1289
1290                         strncpy(buf[1],dbfile,BSIZE-4);
1291                         buf[1][BSIZE-4]='\0';
1292
1293 #ifdef OPENSSL_SYS_VMS
1294                         strcat(buf[1],"-new");
1295 #else
1296                         strcat(buf[1],".new");
1297 #endif
1298
1299                         if (BIO_write_filename(out,buf[1]) <= 0)
1300                                 {
1301                                 perror(dbfile);
1302                                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
1303                                 goto err;
1304                                 }
1305                         l=TXT_DB_write(out,db);
1306                         if (l <= 0) goto err;
1307                         }
1308
1309                 if (verbose)
1310                         BIO_printf(bio_err,"writing new certificates\n");
1311                 for (i=0; i<sk_X509_num(cert_sk); i++)
1312                         {
1313                         int k;
1314                         unsigned char *n;
1315
1316                         x=sk_X509_value(cert_sk,i);
1317
1318                         j=x->cert_info->serialNumber->length;
1319                         p=(char *)x->cert_info->serialNumber->data;
1320
1321                         strncpy(buf[2],outdir,BSIZE-(j*2)-6);
1322                         buf[2][BSIZE-(j*2)-6]='\0';
1323
1324 #ifndef OPENSSL_SYS_VMS
1325                         strcat(buf[2],"/");
1326 #endif
1327
1328                         n=(unsigned char *)&(buf[2][strlen(buf[2])]);
1329                         if (j > 0)
1330                                 {
1331                                 for (k=0; k<j; k++)
1332                                         {
1333                                         sprintf((char *)n,"%02X",(unsigned char)*(p++));
1334                                         n+=2;
1335                                         }
1336                                 }
1337                         else
1338                                 {
1339                                 *(n++)='0';
1340                                 *(n++)='0';
1341                                 }
1342                         *(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
1343                         *n='\0';
1344                         if (verbose)
1345                                 BIO_printf(bio_err,"writing %s\n",buf[2]);
1346
1347                         if (BIO_write_filename(Cout,buf[2]) <= 0)
1348                                 {
1349                                 perror(buf[2]);
1350                                 goto err;
1351                                 }
1352                         write_new_certificate(Cout,x, 0, notext);
1353                         write_new_certificate(Sout,x, output_der, notext);
1354                         }
1355
1356                 if (sk_X509_num(cert_sk))
1357                         {
1358                         /* Rename the database and the serial file */
1359                         strncpy(buf[2],serialfile,BSIZE-4);
1360                         buf[2][BSIZE-4]='\0';
1361
1362 #ifdef OPENSSL_SYS_VMS
1363                         strcat(buf[2],"-old");
1364 #else
1365                         strcat(buf[2],".old");
1366 #endif
1367
1368                         BIO_free(in);
1369                         BIO_free_all(out);
1370                         in=NULL;
1371                         out=NULL;
1372                         if (rename(serialfile,buf[2]) < 0)
1373                                 {
1374                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1375                                         serialfile,buf[2]);
1376                                 perror("reason");
1377                                 goto err;
1378                                 }
1379                         if (rename(buf[0],serialfile) < 0)
1380                                 {
1381                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1382                                         buf[0],serialfile);
1383                                 perror("reason");
1384                                 rename(buf[2],serialfile);
1385                                 goto err;
1386                                 }
1387
1388                         strncpy(buf[2],dbfile,BSIZE-4);
1389                         buf[2][BSIZE-4]='\0';
1390
1391 #ifdef OPENSSL_SYS_VMS
1392                         strcat(buf[2],"-old");
1393 #else
1394                         strcat(buf[2],".old");
1395 #endif
1396
1397                         if (rename(dbfile,buf[2]) < 0)
1398                                 {
1399                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1400                                         dbfile,buf[2]);
1401                                 perror("reason");
1402                                 goto err;
1403                                 }
1404                         if (rename(buf[1],dbfile) < 0)
1405                                 {
1406                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1407                                         buf[1],dbfile);
1408                                 perror("reason");
1409                                 rename(buf[2],dbfile);
1410                                 goto err;
1411                                 }
1412                         BIO_printf(bio_err,"Data Base Updated\n");
1413                         }
1414                 }
1415
1416         /*****************************************************************/
1417         if (gencrl)
1418                 {
1419                 int crl_v2 = 0;
1420                 if (!crl_ext)
1421                         {
1422                         crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
1423                         if (!crl_ext)
1424                                 ERR_clear_error();
1425                         }
1426                 if (crl_ext)
1427                         {
1428                         /* Check syntax of file */
1429                         X509V3_CTX ctx;
1430                         X509V3_set_ctx_test(&ctx);
1431                         X509V3_set_nconf(&ctx, conf);
1432                         if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
1433                                 {
1434                                 BIO_printf(bio_err,
1435                                  "Error Loading CRL extension section %s\n",
1436                                                                  crl_ext);
1437                                 ret = 1;
1438                                 goto err;
1439                                 }
1440                         }
1441
1442                 if (!crldays && !crlhours)
1443                         {
1444                         if (!NCONF_get_number(conf,section,
1445                                 ENV_DEFAULT_CRL_DAYS, &crldays))
1446                                 crldays = 0;
1447                         if (!NCONF_get_number(conf,section,
1448                                 ENV_DEFAULT_CRL_HOURS, &crlhours))
1449                                 crlhours = 0;
1450                         }
1451                 if ((crldays == 0) && (crlhours == 0))
1452                         {
1453                         BIO_printf(bio_err,"cannot lookup how long until the next CRL is issuer\n");
1454                         goto err;
1455                         }
1456
1457                 if (verbose) BIO_printf(bio_err,"making CRL\n");
1458                 if ((crl=X509_CRL_new()) == NULL) goto err;
1459                 if (!X509_CRL_set_issuer_name(crl, X509_get_issuer_name(x509))) goto err;
1460
1461                 tmptm = ASN1_TIME_new();
1462                 if (!tmptm) goto err;
1463                 X509_gmtime_adj(tmptm,0);
1464                 X509_CRL_set_lastUpdate(crl, tmptm);
1465                 X509_gmtime_adj(tmptm,(crldays*24+crlhours)*60*60);
1466                 X509_CRL_set_nextUpdate(crl, tmptm);
1467
1468                 ASN1_TIME_free(tmptm);
1469
1470                 for (i=0; i<sk_num(db->data); i++)
1471                         {
1472                         pp=(char **)sk_value(db->data,i);
1473                         if (pp[DB_type][0] == DB_TYPE_REV)
1474                                 {
1475                                 if ((r=X509_REVOKED_new()) == NULL) goto err;
1476                                 j = make_revoked(r, pp[DB_rev_date]);
1477                                 if (!j) goto err;
1478                                 if (j == 2) crl_v2 = 1;
1479                                 if (!BN_hex2bn(&serial, pp[DB_serial]))
1480                                         goto err;
1481                                 tmpser = BN_to_ASN1_INTEGER(serial, NULL);
1482                                 BN_free(serial);
1483                                 serial = NULL;
1484                                 if (!tmpser)
1485                                         goto err;
1486                                 X509_REVOKED_set_serialNumber(r, tmpser);
1487                                 ASN1_INTEGER_free(tmpser);
1488                                 X509_CRL_add0_revoked(crl,r);
1489                                 }
1490                         }
1491
1492                 /* sort the data so it will be written in serial
1493                  * number order */
1494                 X509_CRL_sort(crl);
1495
1496                 /* we now have a CRL */
1497                 if (verbose) BIO_printf(bio_err,"signing CRL\n");
1498                 if (md != NULL)
1499                         {
1500                         if ((dgst=EVP_get_digestbyname(md)) == NULL)
1501                                 {
1502                                 BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1503                                 goto err;
1504                                 }
1505                         }
1506                 else
1507                         {
1508 #ifndef OPENSSL_NO_DSA
1509                         if (pkey->type == EVP_PKEY_DSA)
1510                                 dgst=EVP_dss1();
1511                         else
1512 #endif
1513 #ifndef OPENSSL_NO_ECDSA
1514                         if (pkey->type == EVP_PKEY_ECDSA)
1515                                 dgst=EVP_ecdsa();
1516                         else
1517 #endif
1518                                 dgst=EVP_md5();
1519                         }
1520
1521                 /* Add any extensions asked for */
1522
1523                 if (crl_ext)
1524                         {
1525                         X509V3_CTX crlctx;
1526                         X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
1527                         X509V3_set_nconf(&crlctx, conf);
1528
1529                         if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
1530                                 crl_ext, crl)) goto err;
1531                         }
1532                 if (crl_ext || crl_v2)
1533                         {
1534                         if (!X509_CRL_set_version(crl, 1))
1535                                 goto err; /* version 2 CRL */
1536                         }
1537
1538                 if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
1539
1540                 PEM_write_bio_X509_CRL(Sout,crl);
1541                 }
1542         /*****************************************************************/
1543         if (dorevoke)
1544                 {
1545                 if (infile == NULL)
1546                         {
1547                         BIO_printf(bio_err,"no input files\n");
1548                         goto err;
1549                         }
1550                 else
1551                         {
1552                         X509 *revcert;
1553                         revcert=load_cert(bio_err, infile, FORMAT_PEM,
1554                                 NULL, e, infile);
1555                         if (revcert == NULL)
1556                                 goto err;
1557                         j=do_revoke(revcert,db, rev_type, rev_arg);
1558                         if (j <= 0) goto err;
1559                         X509_free(revcert);
1560
1561                         strncpy(buf[0],dbfile,BSIZE-4);
1562                         buf[0][BSIZE-4]='\0';
1563 #ifndef OPENSSL_SYS_VMS
1564                         strcat(buf[0],".new");
1565 #else
1566                         strcat(buf[0],"-new");
1567 #endif
1568                         if (BIO_write_filename(out,buf[0]) <= 0)
1569                                 {
1570                                 perror(dbfile);
1571                                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
1572                                 goto err;
1573                                 }
1574                         j=TXT_DB_write(out,db);
1575                         if (j <= 0) goto err;
1576                         strncpy(buf[1],dbfile,BSIZE-4);
1577                         buf[1][BSIZE-4]='\0';
1578 #ifndef OPENSSL_SYS_VMS
1579                         strcat(buf[1],".old");
1580 #else
1581                         strcat(buf[1],"-old");
1582 #endif
1583                         BIO_free(in);
1584                         in = NULL;
1585                         BIO_free(out);
1586                         out = NULL;
1587                         if (rename(dbfile,buf[1]) < 0)
1588                                 {
1589                                 BIO_printf(bio_err,"unable to rename %s to %s\n", dbfile, buf[1]);
1590                                 perror("reason");
1591                                 goto err;
1592                                 }
1593                         if (rename(buf[0],dbfile) < 0)
1594                                 {
1595                                 BIO_printf(bio_err,"unable to rename %s to %s\n", buf[0],dbfile);
1596                                 perror("reason");
1597                                 rename(buf[1],dbfile);
1598                                 goto err;
1599                                 }
1600                         BIO_printf(bio_err,"Data Base Updated\n");
1601                         }
1602                 }
1603         /*****************************************************************/
1604         ret=0;
1605 err:
1606         BIO_free_all(Cout);
1607         BIO_free_all(Sout);
1608         BIO_free_all(out);
1609         BIO_free_all(in);
1610
1611         sk_X509_pop_free(cert_sk,X509_free);
1612
1613         if (ret) ERR_print_errors(bio_err);
1614         app_RAND_write_file(randfile, bio_err);
1615         if (free_key)
1616                 OPENSSL_free(key);
1617         BN_free(serial);
1618         TXT_DB_free(db);
1619         EVP_PKEY_free(pkey);
1620         X509_free(x509);
1621         X509_CRL_free(crl);
1622         NCONF_free(conf);
1623         OBJ_cleanup();
1624         apps_shutdown();
1625         EXIT(ret);
1626         }
1627
1628 static void lookup_fail(char *name, char *tag)
1629         {
1630         BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
1631         }
1632
1633 static unsigned long index_serial_hash(const char **a)
1634         {
1635         const char *n;
1636
1637         n=a[DB_serial];
1638         while (*n == '0') n++;
1639         return(lh_strhash(n));
1640         }
1641
1642 static int index_serial_cmp(const char **a, const char **b)
1643         {
1644         const char *aa,*bb;
1645
1646         for (aa=a[DB_serial]; *aa == '0'; aa++);
1647         for (bb=b[DB_serial]; *bb == '0'; bb++);
1648         return(strcmp(aa,bb));
1649         }
1650
1651 static unsigned long index_name_hash(const char **a)
1652         { return(lh_strhash(a[DB_name])); }
1653
1654 static int index_name_qual(char **a)
1655         { return(a[0][0] == 'V'); }
1656
1657 static int index_name_cmp(const char **a, const char **b)
1658         { return(strcmp(a[DB_name],
1659              b[DB_name])); }
1660
1661 static BIGNUM *load_serial(char *serialfile)
1662         {
1663         BIO *in=NULL;
1664         BIGNUM *ret=NULL;
1665         MS_STATIC char buf[1024];
1666         ASN1_INTEGER *ai=NULL;
1667
1668         if ((in=BIO_new(BIO_s_file())) == NULL)
1669                 {
1670                 ERR_print_errors(bio_err);
1671                 goto err;
1672                 }
1673
1674         if (BIO_read_filename(in,serialfile) <= 0)
1675                 {
1676                 perror(serialfile);
1677                 goto err;
1678                 }
1679         ai=ASN1_INTEGER_new();
1680         if (ai == NULL) goto err;
1681         if (!a2i_ASN1_INTEGER(in,ai,buf,1024))
1682                 {
1683                 BIO_printf(bio_err,"unable to load number from %s\n",
1684                         serialfile);
1685                 goto err;
1686                 }
1687         ret=ASN1_INTEGER_to_BN(ai,NULL);
1688         if (ret == NULL)
1689                 {
1690                 BIO_printf(bio_err,"error converting number from bin to BIGNUM");
1691                 goto err;
1692                 }
1693 err:
1694         if (in != NULL) BIO_free(in);
1695         if (ai != NULL) ASN1_INTEGER_free(ai);
1696         return(ret);
1697         }
1698
1699 static int save_serial(char *serialfile, BIGNUM *serial)
1700         {
1701         BIO *out;
1702         int ret=0;
1703         ASN1_INTEGER *ai=NULL;
1704
1705         out=BIO_new(BIO_s_file());
1706         if (out == NULL)
1707                 {
1708                 ERR_print_errors(bio_err);
1709                 goto err;
1710                 }
1711         if (BIO_write_filename(out,serialfile) <= 0)
1712                 {
1713                 perror(serialfile);
1714                 goto err;
1715                 }
1716
1717         if ((ai=BN_to_ASN1_INTEGER(serial,NULL)) == NULL)
1718                 {
1719                 BIO_printf(bio_err,"error converting serial to ASN.1 format\n");
1720                 goto err;
1721                 }
1722         i2a_ASN1_INTEGER(out,ai);
1723         BIO_puts(out,"\n");
1724         ret=1;
1725 err:
1726         if (out != NULL) BIO_free_all(out);
1727         if (ai != NULL) ASN1_INTEGER_free(ai);
1728         return(ret);
1729         }
1730
1731 static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1732              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
1733              BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
1734              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1735              unsigned long certopt, unsigned long nameopt, int default_op,
1736              int ext_copy)
1737         {
1738         X509_REQ *req=NULL;
1739         BIO *in=NULL;
1740         EVP_PKEY *pktmp=NULL;
1741         int ok= -1,i;
1742
1743         in=BIO_new(BIO_s_file());
1744
1745         if (BIO_read_filename(in,infile) <= 0)
1746                 {
1747                 perror(infile);
1748                 goto err;
1749                 }
1750         if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
1751                 {
1752                 BIO_printf(bio_err,"Error reading certificate request in %s\n",
1753                         infile);
1754                 goto err;
1755                 }
1756         if (verbose)
1757                 X509_REQ_print(bio_err,req);
1758
1759         BIO_printf(bio_err,"Check that the request matches the signature\n");
1760
1761         if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
1762                 {
1763                 BIO_printf(bio_err,"error unpacking public key\n");
1764                 goto err;
1765                 }
1766         i=X509_REQ_verify(req,pktmp);
1767         EVP_PKEY_free(pktmp);
1768         if (i < 0)
1769                 {
1770                 ok=0;
1771                 BIO_printf(bio_err,"Signature verification problems....\n");
1772                 goto err;
1773                 }
1774         if (i == 0)
1775                 {
1776                 ok=0;
1777                 BIO_printf(bio_err,"Signature did not match the certificate request\n");
1778                 goto err;
1779                 }
1780         else
1781                 BIO_printf(bio_err,"Signature ok\n");
1782
1783         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj, email_dn,
1784                 startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
1785                 certopt, nameopt, default_op, ext_copy);
1786
1787 err:
1788         if (req != NULL) X509_REQ_free(req);
1789         if (in != NULL) BIO_free(in);
1790         return(ok);
1791         }
1792
1793 static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1794              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
1795              BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
1796              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1797              unsigned long certopt, unsigned long nameopt, int default_op,
1798              int ext_copy, ENGINE *e)
1799         {
1800         X509 *req=NULL;
1801         X509_REQ *rreq=NULL;
1802         EVP_PKEY *pktmp=NULL;
1803         int ok= -1,i;
1804
1805         if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
1806                 goto err;
1807         if (verbose)
1808                 X509_print(bio_err,req);
1809
1810         BIO_printf(bio_err,"Check that the request matches the signature\n");
1811
1812         if ((pktmp=X509_get_pubkey(req)) == NULL)
1813                 {
1814                 BIO_printf(bio_err,"error unpacking public key\n");
1815                 goto err;
1816                 }
1817         i=X509_verify(req,pktmp);
1818         EVP_PKEY_free(pktmp);
1819         if (i < 0)
1820                 {
1821                 ok=0;
1822                 BIO_printf(bio_err,"Signature verification problems....\n");
1823                 goto err;
1824                 }
1825         if (i == 0)
1826                 {
1827                 ok=0;
1828                 BIO_printf(bio_err,"Signature did not match the certificate\n");
1829                 goto err;
1830                 }
1831         else
1832                 BIO_printf(bio_err,"Signature ok\n");
1833
1834         if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
1835                 goto err;
1836
1837         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
1838                 days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
1839                 ext_copy);
1840
1841 err:
1842         if (rreq != NULL) X509_REQ_free(rreq);
1843         if (req != NULL) X509_free(req);
1844         return(ok);
1845         }
1846
1847 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
1848              STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial, char *subj,
1849              int email_dn, char *startdate, char *enddate, long days, int batch,
1850              int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
1851              unsigned long certopt, unsigned long nameopt, int default_op,
1852              int ext_copy)
1853         {
1854         X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
1855         ASN1_UTCTIME *tm,*tmptm;
1856         ASN1_STRING *str,*str2;
1857         ASN1_OBJECT *obj;
1858         X509 *ret=NULL;
1859         X509_CINF *ci;
1860         X509_NAME_ENTRY *ne;
1861         X509_NAME_ENTRY *tne,*push;
1862         EVP_PKEY *pktmp;
1863         int ok= -1,i,j,last,nid;
1864         char *p;
1865         CONF_VALUE *cv;
1866         char *row[DB_NUMBER],**rrow,**irow=NULL;
1867         char buf[25];
1868
1869         tmptm=ASN1_UTCTIME_new();
1870         if (tmptm == NULL)
1871                 {
1872                 BIO_printf(bio_err,"malloc error\n");
1873                 return(0);
1874                 }
1875
1876         for (i=0; i<DB_NUMBER; i++)
1877                 row[i]=NULL;
1878
1879         if (subj)
1880                 {
1881                 X509_NAME *n = do_subject(subj, MBSTRING_ASC);
1882
1883                 if (!n)
1884                         {
1885                         ERR_print_errors(bio_err);
1886                         goto err;
1887                         }
1888                 X509_REQ_set_subject_name(req,n);
1889                 req->req_info->enc.modified = 1;
1890                 X509_NAME_free(n);
1891                 }
1892
1893         if (default_op)
1894                 BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
1895
1896         name=X509_REQ_get_subject_name(req);
1897         for (i=0; i<X509_NAME_entry_count(name); i++)
1898                 {
1899                 ne= X509_NAME_get_entry(name,i);
1900                 str=X509_NAME_ENTRY_get_data(ne);
1901                 obj=X509_NAME_ENTRY_get_object(ne);
1902
1903                 if (msie_hack)
1904                         {
1905                         /* assume all type should be strings */
1906                         nid=OBJ_obj2nid(ne->object);
1907
1908                         if (str->type == V_ASN1_UNIVERSALSTRING)
1909                                 ASN1_UNIVERSALSTRING_to_string(str);
1910
1911                         if ((str->type == V_ASN1_IA5STRING) &&
1912                                 (nid != NID_pkcs9_emailAddress))
1913                                 str->type=V_ASN1_T61STRING;
1914
1915                         if ((nid == NID_pkcs9_emailAddress) &&
1916                                 (str->type == V_ASN1_PRINTABLESTRING))
1917                                 str->type=V_ASN1_IA5STRING;
1918                         }
1919
1920                 /* If no EMAIL is wanted in the subject */
1921                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
1922                         continue;
1923
1924                 /* check some things */
1925                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
1926                         (str->type != V_ASN1_IA5STRING))
1927                         {
1928                         BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
1929                         goto err;
1930                         }
1931                 if ((str->type != V_ASN1_BMPSTRING) && (str->type != V_ASN1_UTF8STRING))
1932                         {
1933                         j=ASN1_PRINTABLE_type(str->data,str->length);
1934                         if (    ((j == V_ASN1_T61STRING) &&
1935                                  (str->type != V_ASN1_T61STRING)) ||
1936                                 ((j == V_ASN1_IA5STRING) &&
1937                                  (str->type == V_ASN1_PRINTABLESTRING)))
1938                                 {
1939                                 BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
1940                                 goto err;
1941                                 }
1942                         }
1943
1944                 if (default_op)
1945                         old_entry_print(bio_err, obj, str);
1946                 }
1947
1948         /* Ok, now we check the 'policy' stuff. */
1949         if ((subject=X509_NAME_new()) == NULL)
1950                 {
1951                 BIO_printf(bio_err,"Memory allocation failure\n");
1952                 goto err;
1953                 }
1954
1955         /* take a copy of the issuer name before we mess with it. */
1956         CAname=X509_NAME_dup(x509->cert_info->subject);
1957         if (CAname == NULL) goto err;
1958         str=str2=NULL;
1959
1960         for (i=0; i<sk_CONF_VALUE_num(policy); i++)
1961                 {
1962                 cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
1963                 if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
1964                         {
1965                         BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
1966                         goto err;
1967                         }
1968                 obj=OBJ_nid2obj(j);
1969
1970                 last= -1;
1971                 for (;;)
1972                         {
1973                         /* lookup the object in the supplied name list */
1974                         j=X509_NAME_get_index_by_OBJ(name,obj,last);
1975                         if (j < 0)
1976                                 {
1977                                 if (last != -1) break;
1978                                 tne=NULL;
1979                                 }
1980                         else
1981                                 {
1982                                 tne=X509_NAME_get_entry(name,j);
1983                                 }
1984                         last=j;
1985
1986                         /* depending on the 'policy', decide what to do. */
1987                         push=NULL;
1988                         if (strcmp(cv->value,"optional") == 0)
1989                                 {
1990                                 if (tne != NULL)
1991                                         push=tne;
1992                                 }
1993                         else if (strcmp(cv->value,"supplied") == 0)
1994                                 {
1995                                 if (tne == NULL)
1996                                         {
1997                                         BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
1998                                         goto err;
1999                                         }
2000                                 else
2001                                         push=tne;
2002                                 }
2003                         else if (strcmp(cv->value,"match") == 0)
2004                                 {
2005                                 int last2;
2006
2007                                 if (tne == NULL)
2008                                         {
2009                                         BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
2010                                         goto err;
2011                                         }
2012
2013                                 last2= -1;
2014
2015 again2:
2016                                 j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
2017                                 if ((j < 0) && (last2 == -1))
2018                                         {
2019                                         BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
2020                                         goto err;
2021                                         }
2022                                 if (j >= 0)
2023                                         {
2024                                         push=X509_NAME_get_entry(CAname,j);
2025                                         str=X509_NAME_ENTRY_get_data(tne);
2026                                         str2=X509_NAME_ENTRY_get_data(push);
2027                                         last2=j;
2028                                         if (ASN1_STRING_cmp(str,str2) != 0)
2029                                                 goto again2;
2030                                         }
2031                                 if (j < 0)
2032                                         {
2033                                         BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
2034                                         goto err;
2035                                         }
2036                                 }
2037                         else
2038                                 {
2039                                 BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
2040                                 goto err;
2041                                 }
2042
2043                         if (push != NULL)
2044                                 {
2045                                 if (!X509_NAME_add_entry(subject,push, -1, 0))
2046                                         {
2047                                         if (push != NULL)
2048                                                 X509_NAME_ENTRY_free(push);
2049                                         BIO_printf(bio_err,"Memory allocation failure\n");
2050                                         goto err;
2051                                         }
2052                                 }
2053                         if (j < 0) break;
2054                         }
2055                 }
2056
2057         if (preserve)
2058                 {
2059                 X509_NAME_free(subject);
2060                 /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
2061                 subject=X509_NAME_dup(name);
2062                 if (subject == NULL) goto err;
2063                 }
2064
2065         if (verbose)
2066                 BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
2067
2068         /* Build the correct Subject if no e-mail is wanted in the subject */
2069         /* and add it later on because of the method extensions are added (altName) */
2070
2071         if (email_dn)
2072                 dn_subject = subject;
2073         else
2074                 {
2075                 X509_NAME_ENTRY *tmpne;
2076                 /* Its best to dup the subject DN and then delete any email
2077                  * addresses because this retains its structure.
2078                  */
2079                 if (!(dn_subject = X509_NAME_dup(subject)))
2080                         {
2081                         BIO_printf(bio_err,"Memory allocation failure\n");
2082                         goto err;
2083                         }
2084                 while((i = X509_NAME_get_index_by_NID(dn_subject,
2085                                         NID_pkcs9_emailAddress, -1)) >= 0)
2086                         {
2087                         tmpne = X509_NAME_get_entry(dn_subject, i);
2088                         X509_NAME_delete_entry(dn_subject, i);
2089                         X509_NAME_ENTRY_free(tmpne);
2090                         }
2091                 }
2092
2093         row[DB_name]=X509_NAME_oneline(dn_subject,NULL,0);
2094         row[DB_serial]=BN_bn2hex(serial);
2095         if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2096                 {
2097                 BIO_printf(bio_err,"Memory allocation failure\n");
2098                 goto err;
2099                 }
2100
2101         rrow=TXT_DB_get_by_index(db,DB_name,row);
2102         if (rrow != NULL)
2103                 {
2104                 BIO_printf(bio_err,"ERROR:There is already a certificate for %s\n",
2105                         row[DB_name]);
2106                 }
2107         else
2108                 {
2109                 rrow=TXT_DB_get_by_index(db,DB_serial,row);
2110                 if (rrow != NULL)
2111                         {
2112                         BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
2113                                 row[DB_serial]);
2114                         BIO_printf(bio_err,"      check the database/serial_file for corruption\n");
2115                         }
2116                 }
2117
2118         if (rrow != NULL)
2119                 {
2120                 BIO_printf(bio_err,
2121                         "The matching entry has the following details\n");
2122                 if (rrow[DB_type][0] == 'E')
2123                         p="Expired";
2124                 else if (rrow[DB_type][0] == 'R')
2125                         p="Revoked";
2126                 else if (rrow[DB_type][0] == 'V')
2127                         p="Valid";
2128                 else
2129                         p="\ninvalid type, Data base error\n";
2130                 BIO_printf(bio_err,"Type          :%s\n",p);;
2131                 if (rrow[DB_type][0] == 'R')
2132                         {
2133                         p=rrow[DB_exp_date]; if (p == NULL) p="undef";
2134                         BIO_printf(bio_err,"Was revoked on:%s\n",p);
2135                         }
2136                 p=rrow[DB_exp_date]; if (p == NULL) p="undef";
2137                 BIO_printf(bio_err,"Expires on    :%s\n",p);
2138                 p=rrow[DB_serial]; if (p == NULL) p="undef";
2139                 BIO_printf(bio_err,"Serial Number :%s\n",p);
2140                 p=rrow[DB_file]; if (p == NULL) p="undef";
2141                 BIO_printf(bio_err,"File name     :%s\n",p);
2142                 p=rrow[DB_name]; if (p == NULL) p="undef";
2143                 BIO_printf(bio_err,"Subject Name  :%s\n",p);
2144                 ok= -1; /* This is now a 'bad' error. */
2145                 goto err;
2146                 }
2147
2148         /* We are now totally happy, lets make and sign the certificate */
2149         if (verbose)
2150                 BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
2151
2152         if ((ret=X509_new()) == NULL) goto err;
2153         ci=ret->cert_info;
2154
2155 #ifdef X509_V3
2156         /* Make it an X509 v3 certificate. */
2157         if (!X509_set_version(x509,2)) goto err;
2158 #endif
2159
2160         if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
2161                 goto err;
2162         if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
2163                 goto err;
2164
2165         if (strcmp(startdate,"today") == 0)
2166                 X509_gmtime_adj(X509_get_notBefore(ret),0);
2167         else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);
2168
2169         if (enddate == NULL)
2170                 X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);
2171         else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);
2172
2173         if (!X509_set_subject_name(ret,subject)) goto err;
2174
2175         pktmp=X509_REQ_get_pubkey(req);
2176         i = X509_set_pubkey(ret,pktmp);
2177         EVP_PKEY_free(pktmp);
2178         if (!i) goto err;
2179
2180         /* Lets add the extensions, if there are any */
2181         if (ext_sect)
2182                 {
2183                 X509V3_CTX ctx;
2184                 if (ci->version == NULL)
2185                         if ((ci->version=ASN1_INTEGER_new()) == NULL)
2186                                 goto err;
2187                 ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
2188
2189                 /* Free the current entries if any, there should not
2190                  * be any I believe */
2191                 if (ci->extensions != NULL)
2192                         sk_X509_EXTENSION_pop_free(ci->extensions,
2193                                                    X509_EXTENSION_free);
2194
2195                 ci->extensions = NULL;
2196
2197                 /* Initialize the context structure */
2198                 X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
2199
2200                 if (extconf)
2201                         {
2202                         if (verbose)
2203                                 BIO_printf(bio_err, "Extra configuration file found\n");
2204
2205                         /* Use the extconf configuration db LHASH */
2206                         X509V3_set_nconf(&ctx, extconf);
2207
2208                         /* Test the structure (needed?) */
2209                         /* X509V3_set_ctx_test(&ctx); */
2210
2211                         /* Adds exts contained in the configuration file */
2212                         if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
2213                                 {
2214                                 BIO_printf(bio_err,
2215                                     "ERROR: adding extensions in section %s\n",
2216                                                                 ext_sect);
2217                                 ERR_print_errors(bio_err);
2218                                 goto err;
2219                                 }
2220                         if (verbose)
2221                                 BIO_printf(bio_err, "Successfully added extensions from file.\n");
2222                         }
2223                 else if (ext_sect)
2224                         {
2225                         /* We found extensions to be set from config file */
2226                         X509V3_set_nconf(&ctx, lconf);
2227
2228                         if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
2229                                 {
2230                                 BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
2231                                 ERR_print_errors(bio_err);
2232                                 goto err;
2233                                 }
2234
2235                         if (verbose)
2236                                 BIO_printf(bio_err, "Successfully added extensions from config\n");
2237                         }
2238                 }
2239
2240         /* Copy extensions from request (if any) */
2241
2242         if (!copy_extensions(ret, req, ext_copy))
2243                 {
2244                 BIO_printf(bio_err, "ERROR: adding extensions from request\n");
2245                 ERR_print_errors(bio_err);
2246                 goto err;
2247                 }
2248
2249         /* Set the right value for the noemailDN option */
2250         if( email_dn == 0 )
2251                 {
2252                 if (!X509_set_subject_name(ret,dn_subject)) goto err;
2253                 }
2254
2255         if (!default_op)
2256                 {
2257                 BIO_printf(bio_err, "Certificate Details:\n");
2258                 /* Never print signature details because signature not present */
2259                 certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
2260                 X509_print_ex(bio_err, ret, nameopt, certopt);
2261                 }
2262
2263         BIO_printf(bio_err,"Certificate is to be certified until ");
2264         ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
2265         if (days) BIO_printf(bio_err," (%d days)",days);
2266         BIO_printf(bio_err, "\n");
2267
2268         if (!batch)
2269                 {
2270
2271                 BIO_printf(bio_err,"Sign the certificate? [y/n]:");
2272                 (void)BIO_flush(bio_err);
2273                 buf[0]='\0';
2274                 fgets(buf,sizeof(buf)-1,stdin);
2275                 if (!((buf[0] == 'y') || (buf[0] == 'Y')))
2276                         {
2277                         BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
2278                         ok=0;
2279                         goto err;
2280                         }
2281                 }
2282
2283
2284 #ifndef OPENSSL_NO_DSA
2285         if (pkey->type == EVP_PKEY_DSA) dgst=EVP_dss1();
2286         pktmp=X509_get_pubkey(ret);
2287         if (EVP_PKEY_missing_parameters(pktmp) &&
2288                 !EVP_PKEY_missing_parameters(pkey))
2289                 EVP_PKEY_copy_parameters(pktmp,pkey);
2290         EVP_PKEY_free(pktmp);
2291 #endif
2292 #ifndef OPENSSL_NO_ECDSA
2293         if (pkey->type == EVP_PKEY_ECDSA)
2294                 dgst = EVP_ecdsa();
2295         pktmp = X509_get_pubkey(ret);
2296         if (EVP_PKEY_missing_parameters(pktmp) &&
2297                 !EVP_PKEY_missing_parameters(pkey))
2298                 EVP_PKEY_copy_parameters(pktmp, pkey);
2299         EVP_PKEY_free(pktmp);
2300 #endif
2301
2302
2303         if (!X509_sign(ret,pkey,dgst))
2304                 goto err;
2305
2306         /* We now just add it to the database */
2307         row[DB_type]=(char *)OPENSSL_malloc(2);
2308
2309         tm=X509_get_notAfter(ret);
2310         row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2311         memcpy(row[DB_exp_date],tm->data,tm->length);
2312         row[DB_exp_date][tm->length]='\0';
2313
2314         row[DB_rev_date]=NULL;
2315
2316         /* row[DB_serial] done already */
2317         row[DB_file]=(char *)OPENSSL_malloc(8);
2318         /* row[DB_name] done already */
2319
2320         if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2321                 (row[DB_file] == NULL))
2322                 {
2323                 BIO_printf(bio_err,"Memory allocation failure\n");
2324                 goto err;
2325                 }
2326         strcpy(row[DB_file],"unknown");
2327         row[DB_type][0]='V';
2328         row[DB_type][1]='\0';
2329
2330         if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2331                 {
2332                 BIO_printf(bio_err,"Memory allocation failure\n");
2333                 goto err;
2334                 }
2335
2336         for (i=0; i<DB_NUMBER; i++)
2337                 {
2338                 irow[i]=row[i];
2339                 row[i]=NULL;
2340                 }
2341         irow[DB_NUMBER]=NULL;
2342
2343         if (!TXT_DB_insert(db,irow))
2344                 {
2345                 BIO_printf(bio_err,"failed to update database\n");
2346                 BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
2347                 goto err;
2348                 }
2349         ok=1;
2350 err:
2351         for (i=0; i<DB_NUMBER; i++)
2352                 if (row[i] != NULL) OPENSSL_free(row[i]);
2353
2354         if (CAname != NULL)
2355                 X509_NAME_free(CAname);
2356         if (subject != NULL)
2357                 X509_NAME_free(subject);
2358         if ((dn_subject != NULL) && !email_dn)
2359                 X509_NAME_free(dn_subject);
2360         if (tmptm != NULL)
2361                 ASN1_UTCTIME_free(tmptm);
2362         if (ok <= 0)
2363                 {
2364                 if (ret != NULL) X509_free(ret);
2365                 ret=NULL;
2366                 }
2367         else
2368                 *xret=ret;
2369         return(ok);
2370         }
2371
2372 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
2373         {
2374
2375         if (output_der)
2376                 {
2377                 (void)i2d_X509_bio(bp,x);
2378                 return;
2379                 }
2380 #if 0
2381         /* ??? Not needed since X509_print prints all this stuff anyway */
2382         f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
2383         BIO_printf(bp,"issuer :%s\n",f);
2384
2385         f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
2386         BIO_printf(bp,"subject:%s\n",f);
2387
2388         BIO_puts(bp,"serial :");
2389         i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
2390         BIO_puts(bp,"\n\n");
2391 #endif
2392         if (!notext)X509_print(bp,x);
2393         PEM_write_bio_X509(bp,x);
2394         }
2395
2396 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
2397              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
2398              BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
2399              long days, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
2400              unsigned long nameopt, int default_op, int ext_copy)
2401         {
2402         STACK_OF(CONF_VALUE) *sk=NULL;
2403         LHASH *parms=NULL;
2404         X509_REQ *req=NULL;
2405         CONF_VALUE *cv=NULL;
2406         NETSCAPE_SPKI *spki = NULL;
2407         X509_REQ_INFO *ri;
2408         char *type,*buf;
2409         EVP_PKEY *pktmp=NULL;
2410         X509_NAME *n=NULL;
2411         X509_NAME_ENTRY *ne=NULL;
2412         int ok= -1,i,j;
2413         long errline;
2414         int nid;
2415
2416         /*
2417          * Load input file into a hash table.  (This is just an easy
2418          * way to read and parse the file, then put it into a convenient
2419          * STACK format).
2420          */
2421         parms=CONF_load(NULL,infile,&errline);
2422         if (parms == NULL)
2423                 {
2424                 BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
2425                 ERR_print_errors(bio_err);
2426                 goto err;
2427                 }
2428
2429         sk=CONF_get_section(parms, "default");
2430         if (sk_CONF_VALUE_num(sk) == 0)
2431                 {
2432                 BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
2433                 CONF_free(parms);
2434                 goto err;
2435                 }
2436
2437         /*
2438          * Now create a dummy X509 request structure.  We don't actually
2439          * have an X509 request, but we have many of the components
2440          * (a public key, various DN components).  The idea is that we
2441          * put these components into the right X509 request structure
2442          * and we can use the same code as if you had a real X509 request.
2443          */
2444         req=X509_REQ_new();
2445         if (req == NULL)
2446                 {
2447                 ERR_print_errors(bio_err);
2448                 goto err;
2449                 }
2450
2451         /*
2452          * Build up the subject name set.
2453          */
2454         ri=req->req_info;
2455         n = ri->subject;
2456
2457         for (i = 0; ; i++)
2458                 {
2459                 if (sk_CONF_VALUE_num(sk) <= i) break;
2460
2461                 cv=sk_CONF_VALUE_value(sk,i);
2462                 type=cv->name;
2463                 /* Skip past any leading X. X: X, etc to allow for
2464                  * multiple instances
2465                  */
2466                 for (buf = cv->name; *buf ; buf++)
2467                         if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
2468                                 {
2469                                 buf++;
2470                                 if (*buf) type = buf;
2471                                 break;
2472                                 }
2473
2474                 buf=cv->value;
2475                 if ((nid=OBJ_txt2nid(type)) == NID_undef)
2476                         {
2477                         if (strcmp(type, "SPKAC") == 0)
2478                                 {
2479                                 spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
2480                                 if (spki == NULL)
2481                                         {
2482                                         BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
2483                                         ERR_print_errors(bio_err);
2484                                         goto err;
2485                                         }
2486                                 }
2487                         continue;
2488                         }
2489
2490                 /*
2491                 if ((nid == NID_pkcs9_emailAddress) && (email_dn == 0))
2492                         continue;
2493                 */
2494
2495                 j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
2496                 if (fix_data(nid, &j) == 0)
2497                         {
2498                         BIO_printf(bio_err,
2499                                 "invalid characters in string %s\n",buf);
2500                         goto err;
2501                         }
2502
2503                 if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
2504                         (unsigned char *)buf,
2505                         strlen(buf))) == NULL)
2506                         goto err;
2507
2508                 if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
2509                 }
2510         if (spki == NULL)
2511                 {
2512                 BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
2513                         infile);
2514                 goto err;
2515                 }
2516
2517         /*
2518          * Now extract the key from the SPKI structure.
2519          */
2520
2521         BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
2522
2523         if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
2524                 {
2525                 BIO_printf(bio_err,"error unpacking SPKAC public key\n");
2526                 goto err;
2527                 }
2528
2529         j = NETSCAPE_SPKI_verify(spki, pktmp);
2530         if (j <= 0)
2531                 {
2532                 BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
2533                 goto err;
2534                 }
2535         BIO_printf(bio_err,"Signature ok\n");
2536
2537         X509_REQ_set_pubkey(req,pktmp);
2538         EVP_PKEY_free(pktmp);
2539         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
2540                    days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
2541                         ext_copy);
2542 err:
2543         if (req != NULL) X509_REQ_free(req);
2544         if (parms != NULL) CONF_free(parms);
2545         if (spki != NULL) NETSCAPE_SPKI_free(spki);
2546         if (ne != NULL) X509_NAME_ENTRY_free(ne);
2547
2548         return(ok);
2549         }
2550
2551 static int fix_data(int nid, int *type)
2552         {
2553         if (nid == NID_pkcs9_emailAddress)
2554                 *type=V_ASN1_IA5STRING;
2555         if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
2556                 *type=V_ASN1_T61STRING;
2557         if ((nid == NID_pkcs9_challengePassword) && (*type == V_ASN1_IA5STRING))
2558                 *type=V_ASN1_T61STRING;
2559         if ((nid == NID_pkcs9_unstructuredName) && (*type == V_ASN1_T61STRING))
2560                 return(0);
2561         if (nid == NID_pkcs9_unstructuredName)
2562                 *type=V_ASN1_IA5STRING;
2563         return(1);
2564         }
2565
2566 static int check_time_format(char *str)
2567         {
2568         ASN1_UTCTIME tm;
2569
2570         tm.data=(unsigned char *)str;
2571         tm.length=strlen(str);
2572         tm.type=V_ASN1_UTCTIME;
2573         return(ASN1_UTCTIME_check(&tm));
2574         }
2575
2576 static int do_revoke(X509 *x509, TXT_DB *db, int type, char *value)
2577         {
2578         ASN1_UTCTIME *tm=NULL;
2579         char *row[DB_NUMBER],**rrow,**irow;
2580         char *rev_str = NULL;
2581         BIGNUM *bn = NULL;
2582         int ok=-1,i;
2583
2584         for (i=0; i<DB_NUMBER; i++)
2585                 row[i]=NULL;
2586         row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
2587         bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
2588         row[DB_serial]=BN_bn2hex(bn);
2589         BN_free(bn);
2590         if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2591                 {
2592                 BIO_printf(bio_err,"Memory allocation failure\n");
2593                 goto err;
2594                 }
2595         /* We have to lookup by serial number because name lookup
2596          * skips revoked certs
2597          */
2598         rrow=TXT_DB_get_by_index(db,DB_serial,row);
2599         if (rrow == NULL)
2600                 {
2601                 BIO_printf(bio_err,"Adding Entry to DB for %s\n", row[DB_name]);
2602
2603                 /* We now just add it to the database */
2604                 row[DB_type]=(char *)OPENSSL_malloc(2);
2605
2606                 tm=X509_get_notAfter(x509);
2607                 row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2608                 memcpy(row[DB_exp_date],tm->data,tm->length);
2609                 row[DB_exp_date][tm->length]='\0';
2610
2611                 row[DB_rev_date]=NULL;
2612
2613                 /* row[DB_serial] done already */
2614                 row[DB_file]=(char *)OPENSSL_malloc(8);
2615
2616                 /* row[DB_name] done already */
2617
2618                 if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2619                         (row[DB_file] == NULL))
2620                         {
2621                         BIO_printf(bio_err,"Memory allocation failure\n");
2622                         goto err;
2623                         }
2624                 strcpy(row[DB_file],"unknown");
2625                 row[DB_type][0]='V';
2626                 row[DB_type][1]='\0';
2627
2628                 if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2629                         {
2630                         BIO_printf(bio_err,"Memory allocation failure\n");
2631                         goto err;
2632                         }
2633
2634                 for (i=0; i<DB_NUMBER; i++)
2635                         {
2636                         irow[i]=row[i];
2637                         row[i]=NULL;
2638                         }
2639                 irow[DB_NUMBER]=NULL;
2640
2641                 if (!TXT_DB_insert(db,irow))
2642                         {
2643                         BIO_printf(bio_err,"failed to update database\n");
2644                         BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
2645                         goto err;
2646                         }
2647
2648                 /* Revoke Certificate */
2649                 ok = do_revoke(x509,db, type, value);
2650
2651                 goto err;
2652
2653                 }
2654         else if (index_name_cmp((const char **)row,(const char **)rrow))
2655                 {
2656                 BIO_printf(bio_err,"ERROR:name does not match %s\n",
2657                            row[DB_name]);
2658                 goto err;
2659                 }
2660         else if (rrow[DB_type][0]=='R')
2661                 {
2662                 BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
2663                            row[DB_serial]);
2664                 goto err;
2665                 }
2666         else
2667                 {
2668                 BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
2669                 rev_str = make_revocation_str(type, value);
2670                 if (!rev_str)
2671                         {
2672                         BIO_printf(bio_err, "Error in revocation arguments\n");
2673                         goto err;
2674                         }
2675                 rrow[DB_type][0]='R';
2676                 rrow[DB_type][1]='\0';
2677                 rrow[DB_rev_date] = rev_str;
2678                 }
2679         ok=1;
2680 err:
2681         for (i=0; i<DB_NUMBER; i++)
2682                 {
2683                 if (row[i] != NULL)
2684                         OPENSSL_free(row[i]);
2685                 }
2686         return(ok);
2687         }
2688
2689 static int get_certificate_status(const char *serial, TXT_DB *db)
2690         {
2691         char *row[DB_NUMBER],**rrow;
2692         int ok=-1,i;
2693
2694         /* Free Resources */
2695         for (i=0; i<DB_NUMBER; i++)
2696                 row[i]=NULL;
2697
2698         /* Malloc needed char spaces */
2699         row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
2700         if (row[DB_serial] == NULL)
2701                 {
2702                 BIO_printf(bio_err,"Malloc failure\n");
2703                 goto err;
2704                 }
2705
2706         if (strlen(serial) % 2)
2707                 {
2708                 /* Set the first char to 0 */;
2709                 row[DB_serial][0]='0';
2710
2711                 /* Copy String from serial to row[DB_serial] */
2712                 memcpy(row[DB_serial]+1, serial, strlen(serial));
2713                 row[DB_serial][strlen(serial)+1]='\0';
2714                 }
2715         else
2716                 {
2717                 /* Copy String from serial to row[DB_serial] */
2718                 memcpy(row[DB_serial], serial, strlen(serial));
2719                 row[DB_serial][strlen(serial)]='\0';
2720                 }
2721
2722         /* Make it Upper Case */
2723         for (i=0; row[DB_serial][i] != '\0'; i++)
2724                 row[DB_serial][i] = toupper(row[DB_serial][i]);
2725
2726
2727         ok=1;
2728
2729         /* Search for the certificate */
2730         rrow=TXT_DB_get_by_index(db,DB_serial,row);
2731         if (rrow == NULL)
2732                 {
2733                 BIO_printf(bio_err,"Serial %s not present in db.\n",
2734                                  row[DB_serial]);
2735                 ok=-1;
2736                 goto err;
2737                 }
2738         else if (rrow[DB_type][0]=='V')
2739                 {
2740                 BIO_printf(bio_err,"%s=Valid (%c)\n",
2741                         row[DB_serial], rrow[DB_type][0]);
2742                 goto err;
2743                 }
2744         else if (rrow[DB_type][0]=='R')
2745                 {
2746                 BIO_printf(bio_err,"%s=Revoked (%c)\n",
2747                         row[DB_serial], rrow[DB_type][0]);
2748                 goto err;
2749                 }
2750         else if (rrow[DB_type][0]=='E')
2751                 {
2752                 BIO_printf(bio_err,"%s=Expired (%c)\n",
2753                         row[DB_serial], rrow[DB_type][0]);
2754                 goto err;
2755                 }
2756         else if (rrow[DB_type][0]=='S')
2757                 {
2758                 BIO_printf(bio_err,"%s=Suspended (%c)\n",
2759                         row[DB_serial], rrow[DB_type][0]);
2760                 goto err;
2761                 }
2762         else
2763                 {
2764                 BIO_printf(bio_err,"%s=Unknown (%c).\n",
2765                         row[DB_serial], rrow[DB_type][0]);
2766                 ok=-1;
2767                 }
2768 err:
2769         for (i=0; i<DB_NUMBER; i++)
2770                 {
2771                 if (row[i] != NULL)
2772                         OPENSSL_free(row[i]);
2773                 }
2774         return(ok);
2775         }
2776
2777 static int do_updatedb (TXT_DB *db)
2778         {
2779         ASN1_UTCTIME    *a_tm = NULL;
2780         int i, cnt = 0;
2781         int db_y2k, a_y2k;  /* flags = 1 if y >= 2000 */
2782         char **rrow, *a_tm_s;
2783
2784         a_tm = ASN1_UTCTIME_new();
2785
2786         /* get actual time and make a string */
2787         a_tm = X509_gmtime_adj(a_tm, 0);
2788         a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
2789         if (a_tm_s == NULL)
2790                 {
2791                 cnt = -1;
2792                 goto err;
2793                 }
2794
2795         memcpy(a_tm_s, a_tm->data, a_tm->length);
2796         a_tm_s[a_tm->length] = '\0';
2797
2798         if (strncmp(a_tm_s, "49", 2) <= 0)
2799                 a_y2k = 1;
2800         else
2801                 a_y2k = 0;
2802
2803         for (i = 0; i < sk_num(db->data); i++)
2804                 {
2805                 rrow = (char **) sk_value(db->data, i);
2806
2807                 if (rrow[DB_type][0] == 'V')
2808                         {
2809                         /* ignore entries that are not valid */
2810                         if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
2811                                 db_y2k = 1;
2812                         else
2813                                 db_y2k = 0;
2814
2815                         if (db_y2k == a_y2k)
2816                                 {
2817                                 /* all on the same y2k side */
2818                                 if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
2819                                         {
2820                                         rrow[DB_type][0]  = 'E';
2821                                         rrow[DB_type][1]  = '\0';
2822                                         cnt++;
2823
2824                                         BIO_printf(bio_err, "%s=Expired\n",
2825                                                         rrow[DB_serial]);
2826                                         }
2827                                 }
2828                         else if (db_y2k < a_y2k)
2829                                 {
2830                                 rrow[DB_type][0]  = 'E';
2831                                 rrow[DB_type][1]  = '\0';
2832                                 cnt++;
2833
2834                                 BIO_printf(bio_err, "%s=Expired\n",
2835                                                         rrow[DB_serial]);
2836                                 }
2837
2838                         }
2839                 }
2840
2841 err:
2842
2843         ASN1_UTCTIME_free(a_tm);
2844         OPENSSL_free(a_tm_s);
2845
2846         return (cnt);
2847         }
2848
2849 static char *crl_reasons[] = {
2850         /* CRL reason strings */
2851         "unspecified",
2852         "keyCompromise",
2853         "CACompromise",
2854         "affiliationChanged",
2855         "superseded",
2856         "cessationOfOperation",
2857         "certificateHold",
2858         "removeFromCRL",
2859         /* Additional pseudo reasons */
2860         "holdInstruction",
2861         "keyTime",
2862         "CAkeyTime"
2863 };
2864
2865 #define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
2866
2867 /* Given revocation information convert to a DB string.
2868  * The format of the string is:
2869  * revtime[,reason,extra]. Where 'revtime' is the
2870  * revocation time (the current time). 'reason' is the
2871  * optional CRL reason and 'extra' is any additional
2872  * argument
2873  */
2874
2875 char *make_revocation_str(int rev_type, char *rev_arg)
2876         {
2877         char *reason = NULL, *other = NULL, *str;
2878         ASN1_OBJECT *otmp;
2879         ASN1_UTCTIME *revtm = NULL;
2880         int i;
2881         switch (rev_type)
2882                 {
2883         case REV_NONE:
2884                 break;
2885
2886         case REV_CRL_REASON:
2887                 for (i = 0; i < 8; i++)
2888                         {
2889                         if (!strcasecmp(rev_arg, crl_reasons[i]))
2890                                 {
2891                                 reason = crl_reasons[i];
2892                                 break;
2893                                 }
2894                         }
2895                 if (reason == NULL)
2896                         {
2897                         BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
2898                         return NULL;
2899                         }
2900                 break;
2901
2902         case REV_HOLD:
2903                 /* Argument is an OID */
2904
2905                 otmp = OBJ_txt2obj(rev_arg, 0);
2906                 ASN1_OBJECT_free(otmp);
2907
2908                 if (otmp == NULL)
2909                         {
2910                         BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
2911                         return NULL;
2912                         }
2913
2914                 reason = "holdInstruction";
2915                 other = rev_arg;
2916                 break;
2917
2918         case REV_KEY_COMPROMISE:
2919         case REV_CA_COMPROMISE:
2920
2921                 /* Argument is the key compromise time  */
2922                 if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
2923                         {
2924                         BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
2925                         return NULL;
2926                         }
2927                 other = rev_arg;
2928                 if (rev_type == REV_KEY_COMPROMISE)
2929                         reason = "keyTime";
2930                 else
2931                         reason = "CAkeyTime";
2932
2933                 break;
2934
2935                 }
2936
2937         revtm = X509_gmtime_adj(NULL, 0);
2938
2939         i = revtm->length + 1;
2940
2941         if (reason) i += strlen(reason) + 1;
2942         if (other) i += strlen(other) + 1;
2943
2944         str = OPENSSL_malloc(i);
2945
2946         if (!str) return NULL;
2947
2948         strcpy(str, (char *)revtm->data);
2949         if (reason)
2950                 {
2951                 strcat(str, ",");
2952                 strcat(str, reason);
2953                 }
2954         if (other)
2955                 {
2956                 strcat(str, ",");
2957                 strcat(str, other);
2958                 }
2959         ASN1_UTCTIME_free(revtm);
2960         return str;
2961         }
2962
2963 /* Convert revocation field to X509_REVOKED entry
2964  * return code:
2965  * 0 error
2966  * 1 OK
2967  * 2 OK and some extensions added (i.e. V2 CRL)
2968  */
2969
2970
2971 int make_revoked(X509_REVOKED *rev, char *str)
2972         {
2973         char *tmp = NULL;
2974         int reason_code = -1;
2975         int i, ret = 0;
2976         ASN1_OBJECT *hold = NULL;
2977         ASN1_GENERALIZEDTIME *comp_time = NULL;
2978         ASN1_ENUMERATED *rtmp = NULL;
2979
2980         ASN1_TIME *revDate = NULL;
2981
2982         i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
2983
2984         if (i == 0)
2985                 goto err;
2986
2987         if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
2988                 goto err;
2989
2990         if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
2991                 {
2992                 rtmp = ASN1_ENUMERATED_new();
2993                 if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
2994                         goto err;
2995                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
2996                         goto err;
2997                 }
2998
2999         if (rev && comp_time)
3000                 {
3001                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
3002                         goto err;
3003                 }
3004         if (rev && hold)
3005                 {
3006                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
3007                         goto err;
3008                 }
3009
3010         if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
3011                 ret = 2;
3012         else ret = 1;
3013
3014         err:
3015
3016         if (tmp) OPENSSL_free(tmp);
3017         ASN1_OBJECT_free(hold);
3018         ASN1_GENERALIZEDTIME_free(comp_time);
3019         ASN1_ENUMERATED_free(rtmp);
3020         ASN1_TIME_free(revDate);
3021
3022         return ret;
3023         }
3024
3025 /*
3026  * subject is expected to be in the format /type0=value0/type1=value1/type2=...
3027  * where characters may be escaped by \
3028  */
3029 X509_NAME *do_subject(char *subject, long chtype)
3030         {
3031         size_t buflen = strlen(subject)+1; /* to copy the types and values into. due to escaping, the copy can only become shorter */
3032         char *buf = OPENSSL_malloc(buflen);
3033         size_t max_ne = buflen / 2 + 1; /* maximum number of name elements */
3034         char **ne_types = OPENSSL_malloc(max_ne * sizeof (char *));
3035         char **ne_values = OPENSSL_malloc(max_ne * sizeof (char *));
3036
3037         char *sp = subject, *bp = buf;
3038         int i, ne_num = 0;
3039
3040         X509_NAME *n = NULL;
3041         int nid;
3042
3043         if (!buf || !ne_types || !ne_values)
3044         {
3045                 BIO_printf(bio_err, "malloc error\n");
3046                 goto error;
3047         }
3048
3049         if (*subject != '/')
3050         {
3051                 BIO_printf(bio_err, "Subject does not start with '/'.\n");
3052                 goto error;
3053         }
3054         sp++; /* skip leading / */
3055
3056         while (*sp)
3057         {
3058                 /* collect type */
3059                 ne_types[ne_num] = bp;
3060                 while (*sp)
3061                 {
3062                         if (*sp == '\\') /* is there anything to escape in the type...? */
3063                                 if (*++sp)
3064                                         *bp++ = *sp++;
3065                                 else
3066                                 {
3067                                         BIO_printf(bio_err, "escape character at end of string\n");
3068                                         goto error;
3069                                 }
3070                         else if (*sp == '=')
3071                         {
3072                                 sp++;
3073                                 *bp++ = '\0';
3074                                 break;
3075                         }
3076                         else
3077                                 *bp++ = *sp++;
3078                 }
3079                 if (!*sp)
3080                 {
3081                         BIO_printf(bio_err, "end of string encountered while processing type of subject name element #%d\n", ne_num);
3082                         goto error;
3083                 }
3084                 ne_values[ne_num] = bp;
3085                 while (*sp)
3086                 {
3087                         if (*sp == '\\')
3088                                 if (*++sp)
3089                                         *bp++ = *sp++;
3090                                 else
3091                                 {
3092                                         BIO_printf(bio_err, "escape character at end of string\n");
3093                                         goto error;
3094                                 }
3095                         else if (*sp == '/')
3096                         {
3097                                 sp++;
3098                                 break;
3099                         }
3100                         else
3101                                 *bp++ = *sp++;
3102                 }
3103                 *bp++ = '\0';
3104                 ne_num++;
3105         }
3106
3107         if (!(n = X509_NAME_new()))
3108                 goto error;
3109
3110         for (i = 0; i < ne_num; i++)
3111                 {
3112                 if ((nid=OBJ_txt2nid(ne_types[i])) == NID_undef)
3113                         {
3114                         BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_types[i]);
3115                         continue;
3116                         }
3117
3118                 if (!*ne_values[i])
3119                         {
3120                         BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_types[i]);
3121                         continue;
3122                         }
3123
3124                 if (!X509_NAME_add_entry_by_NID(n, nid, chtype, (unsigned char*)ne_values[i], -1,-1,0))
3125                         goto error;
3126                 }
3127
3128         OPENSSL_free(ne_values);
3129         OPENSSL_free(ne_types);
3130         OPENSSL_free(buf);
3131         return n;
3132
3133 error:
3134         X509_NAME_free(n);
3135         if (ne_values)
3136                 OPENSSL_free(ne_values);
3137         if (ne_types)
3138                 OPENSSL_free(ne_types);
3139         if (buf)
3140                 OPENSSL_free(buf);
3141         return NULL;
3142 }
3143
3144 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
3145         {
3146         char buf[25],*pbuf, *p;
3147         int j;
3148         j=i2a_ASN1_OBJECT(bp,obj);
3149         pbuf=buf;
3150         for (j=22-j; j>0; j--)
3151                 *(pbuf++)=' ';
3152         *(pbuf++)=':';
3153         *(pbuf++)='\0';
3154         BIO_puts(bp,buf);
3155
3156         if (str->type == V_ASN1_PRINTABLESTRING)
3157                 BIO_printf(bp,"PRINTABLE:'");
3158         else if (str->type == V_ASN1_T61STRING)
3159                 BIO_printf(bp,"T61STRING:'");
3160         else if (str->type == V_ASN1_IA5STRING)
3161                 BIO_printf(bp,"IA5STRING:'");
3162         else if (str->type == V_ASN1_UNIVERSALSTRING)
3163                 BIO_printf(bp,"UNIVERSALSTRING:'");
3164         else
3165                 BIO_printf(bp,"ASN.1 %2d:'",str->type);
3166
3167         p=(char *)str->data;
3168         for (j=str->length; j>0; j--)
3169                 {
3170                 if ((*p >= ' ') && (*p <= '~'))
3171                         BIO_printf(bp,"%c",*p);
3172                 else if (*p & 0x80)
3173                         BIO_printf(bp,"\\0x%02X",*p);
3174                 else if ((unsigned char)*p == 0xf7)
3175                         BIO_printf(bp,"^?");
3176                 else    BIO_printf(bp,"^%c",*p+'@');
3177                 p++;
3178                 }
3179         BIO_printf(bp,"'\n");
3180         return 1;
3181         }
3182
3183 int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, char *str)
3184         {
3185         char *tmp = NULL;
3186         char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
3187         int reason_code = -1;
3188         int i, ret = 0;
3189         ASN1_OBJECT *hold = NULL;
3190         ASN1_GENERALIZEDTIME *comp_time = NULL;
3191         tmp = BUF_strdup(str);
3192
3193         p = strchr(tmp, ',');
3194
3195         rtime_str = tmp;
3196
3197         if (p)
3198                 {
3199                 *p = '\0';
3200                 p++;
3201                 reason_str = p;
3202                 p = strchr(p, ',');
3203                 if (p)
3204                         {
3205                         *p = '\0';
3206                         arg_str = p + 1;
3207                         }
3208                 }
3209
3210         if (prevtm)
3211                 {
3212                 *prevtm = ASN1_UTCTIME_new();
3213                 if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))
3214                         {
3215                         BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
3216                         goto err;
3217                         }
3218                 }
3219         if (reason_str)
3220                 {
3221                 for (i = 0; i < NUM_REASONS; i++)
3222                         {
3223                         if(!strcasecmp(reason_str, crl_reasons[i]))
3224                                 {
3225                                 reason_code = i;
3226                                 break;
3227                                 }
3228                         }
3229                 if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
3230                         {
3231                         BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
3232                         goto err;
3233                         }
3234
3235                 if (reason_code == 7)
3236                         reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
3237                 else if (reason_code == 8)              /* Hold instruction */
3238                         {
3239                         if (!arg_str)
3240                                 {
3241                                 BIO_printf(bio_err, "missing hold instruction\n");
3242                                 goto err;
3243                                 }
3244                         reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
3245                         hold = OBJ_txt2obj(arg_str, 0);
3246
3247                         if (!hold)
3248                                 {
3249                                 BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
3250                                 goto err;
3251                                 }
3252                         if (phold) *phold = hold;
3253                         }
3254                 else if ((reason_code == 9) || (reason_code == 10))
3255                         {
3256                         if (!arg_str)
3257                                 {
3258                                 BIO_printf(bio_err, "missing compromised time\n");
3259                                 goto err;
3260                                 }
3261                         comp_time = ASN1_GENERALIZEDTIME_new();
3262                         if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
3263                                 {
3264                                 BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
3265                                 goto err;
3266                                 }
3267                         if (reason_code == 9)
3268                                 reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
3269                         else
3270                                 reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
3271                         }
3272                 }
3273
3274         if (preason) *preason = reason_code;
3275         if (pinvtm) *pinvtm = comp_time;
3276         else ASN1_GENERALIZEDTIME_free(comp_time);
3277
3278         ret = 1;
3279
3280         err:
3281
3282         if (tmp) OPENSSL_free(tmp);
3283         if (!phold) ASN1_OBJECT_free(hold);
3284         if (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);
3285
3286         return ret;
3287         }
3288
3289 int make_serial_index(TXT_DB *db)
3290         {
3291         if (!TXT_DB_create_index(db, DB_serial, NULL,
3292                                 LHASH_HASH_FN(index_serial_hash),
3293                                 LHASH_COMP_FN(index_serial_cmp)))
3294                 {
3295                 BIO_printf(bio_err,
3296                   "error creating serial number index:(%ld,%ld,%ld)\n",
3297                                         db->error,db->arg1,db->arg2);
3298                         return 0;
3299                 }
3300         return 1;
3301         }