Strip the engine shared libraries as well.

[openssl.git] / apps / ca.c

diff --git a/apps/ca.c b/apps/ca.c
index 2e8377391aeee7e29444fd77dbf0531274d49abd..987b4d83f64ee2db5fb6eb26e354b09eec59d4cb 100644 (file)
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -143,7 +143,7 @@
 #define REV_KEY_COMPROMISE     3       /* Value is cert key compromise time */
 #define REV_CA_COMPROMISE      4       /* Value is CA key compromise time */
 
-static char *ca_usage[]={
+static const char *ca_usage[]={
 "usage: ca args\n",
 "\n",
 " -verbose        - Talk alot while doing things\n",
@@ -192,7 +192,7 @@ extern int EF_PROTECT_BELOW;
 extern int EF_ALIGNMENT;
 #endif
 
-static void lookup_fail(char *name,char *tag);
+static void lookup_fail(const char *name, const char *tag);
 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
                   const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,CA_DB *db,
                   BIGNUM *serial, char *subj, int multirdn, int email_dn, char *startdate,
@@ -225,7 +225,7 @@ static int get_certificate_status(const char *ser_status, CA_DB *db);
 static int do_updatedb(CA_DB *db);
 static int check_time_format(char *str);
 char *make_revocation_str(int rev_type, char *rev_arg);
-int make_revoked(X509_REVOKED *rev, char *str);
+int make_revoked(X509_REVOKED *rev, const char *str);
 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
 static CONF *conf=NULL;
 static CONF *extconf=NULL;
@@ -241,6 +241,7 @@ int MAIN(int argc, char **argv)
        {
        ENGINE *e = NULL;
        char *key=NULL,*passargin=NULL;
+       int create_ser = 0;
        int free_key = 0;
        int total=0;
        int total_done=0;
@@ -299,7 +300,8 @@ int MAIN(int argc, char **argv)
        X509_REVOKED *r=NULL;
        ASN1_TIME *tmptm;
        ASN1_INTEGER *tmpser;
-       char **pp,*p,*f;
+       char *f;
+       const char *p, **pp;
        int i,j;
        const EVP_MD *dgst=NULL;
        STACK_OF(CONF_VALUE) *attribs=NULL;
@@ -354,6 +356,8 @@ EF_ALIGNMENT=0;
                        subj= *(++argv);
                        /* preserve=1; */
                        }
+               else if (strcmp(*argv,"-create_serial") == 0)
+                       create_ser = 1;
                else if (strcmp(*argv,"-multivalue-rdn") == 0)
                        multirdn=1;
                else if (strcmp(*argv,"-startdate") == 0)
@@ -546,10 +550,6 @@ bad:
 
        ERR_load_crypto_strings();
 
-#ifndef OPENSSL_NO_ENGINE
-       e = setup_engine(bio_err, engine, 0);
-#endif
-
        /*****************************************************************/
        tofree=NULL;
        if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
@@ -594,6 +594,10 @@ bad:
        if (!load_config(bio_err, conf))
                goto err;
 
+#ifndef OPENSSL_NO_ENGINE
+       e = setup_engine(bio_err, engine, 0);
+#endif
+
        /* Lets get the config section we are using */
        if (section == NULL)
                {
@@ -854,7 +858,7 @@ bad:
        /* Lets check some fields */
        for (i=0; i<sk_num(db->db->data); i++)
                {
-               pp=(char **)sk_value(db->db->data,i);
+               pp=(const char **)sk_value(db->db->data,i);
                if ((pp[DB_type][0] != DB_TYPE_REV) &&
                        (pp[DB_rev_date][0] != '\0'))
                        {
@@ -867,7 +871,7 @@ bad:
                        BIO_printf(bio_err," in entry %d\n", i+1);
                        goto err;
                        }
-               if (!check_time_format(pp[DB_exp_date]))
+               if (!check_time_format((char *)pp[DB_exp_date]))
                        {
                        BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
                        goto err;
@@ -992,25 +996,27 @@ bad:
                        }
                }
 
+       if ((md == NULL) && ((md=NCONF_get_string(conf,
+               section,ENV_DEFAULT_MD)) == NULL))
+               {
+               lookup_fail(section,ENV_DEFAULT_MD);
+               goto err;
+               }
+
+       if ((dgst=EVP_get_digestbyname(md)) == NULL)
+               {
+               BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
+               goto err;
+               }
+
        if (req)
                {
-               if ((md == NULL) && ((md=NCONF_get_string(conf,
-                       section,ENV_DEFAULT_MD)) == NULL))
-                       {
-                       lookup_fail(section,ENV_DEFAULT_MD);
-                       goto err;
-                       }
                if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
                        section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
                        {
                        if(strcmp(tmp_email_dn,"no") == 0)
                                email_dn=0;
                        }
-               if ((dgst=EVP_get_digestbyname(md)) == NULL)
-                       {
-                       BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
-                       goto err;
-                       }
                if (verbose)
                        BIO_printf(bio_err,"message digest is %s\n",
                                OBJ_nid2ln(dgst->type));
@@ -1097,7 +1103,7 @@ bad:
                        goto err;
                        }
 
-               if ((serial=load_serial(serialfile, 0, NULL)) == NULL)
+               if ((serial=load_serial(serialfile, create_ser, NULL)) == NULL)
                        {
                        BIO_printf(bio_err,"error while loading serial number\n");
                        goto err;
@@ -1246,7 +1252,7 @@ bad:
                        x=sk_X509_value(cert_sk,i);
 
                        j=x->cert_info->serialNumber->length;
-                       p=(char *)x->cert_info->serialNumber->data;
+                       p=(const char *)x->cert_info->serialNumber->data;
                        
                        if(strlen(outdir) >= (size_t)(j ? BSIZE-j*2-6 : BSIZE-8))
                                {
@@ -1367,7 +1373,7 @@ bad:
 
                for (i=0; i<sk_num(db->db->data); i++)
                        {
-                       pp=(char **)sk_value(db->db->data,i);
+                       pp=(const char **)sk_value(db->db->data,i);
                        if (pp[DB_type][0] == DB_TYPE_REV)
                                {
                                if ((r=X509_REVOKED_new()) == NULL) goto err;
@@ -1393,28 +1399,15 @@ bad:
 
                /* we now have a CRL */
                if (verbose) BIO_printf(bio_err,"signing CRL\n");
-               if (md != NULL)
-                       {
-                       if ((dgst=EVP_get_digestbyname(md)) == NULL)
-                               {
-                               BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
-                               goto err;
-                               }
-                       }
-               else
-                       {
 #ifndef OPENSSL_NO_DSA
-                       if (pkey->type == EVP_PKEY_DSA) 
-                               dgst=EVP_dss1();
-                       else
+               if (pkey->type == EVP_PKEY_DSA) 
+                       dgst=EVP_dss1();
+               else
 #endif
 #ifndef OPENSSL_NO_ECDSA
-                       if (pkey->type == EVP_PKEY_EC)
-                               dgst=EVP_ecdsa();
-                       else
+               if (pkey->type == EVP_PKEY_EC)
+                       dgst=EVP_ecdsa();
 #endif
-                               dgst=EVP_md5();
-                       }
 
                /* Add any extensions asked for */
 
@@ -1509,7 +1502,7 @@ err:
        OPENSSL_EXIT(ret);
        }
 
-static void lookup_fail(char *name, char *tag)
+static void lookup_fail(const char *name, const char *tag)
        {
        BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
        }
@@ -1654,7 +1647,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
        X509_NAME_ENTRY *tne,*push;
        EVP_PKEY *pktmp;
        int ok= -1,i,j,last,nid;
-       char *p;
+       const char *p;
        CONF_VALUE *cv;
        char *row[DB_NUMBER],**rrow=NULL,**irow=NULL;
        char buf[25];
@@ -2662,7 +2655,7 @@ err:
        return (cnt);
        }
 
-static char *crl_reasons[] = {
+static const char *crl_reasons[] = {
        /* CRL reason strings */
        "unspecified",
        "keyCompromise",
@@ -2690,7 +2683,8 @@ static char *crl_reasons[] = {
 
 char *make_revocation_str(int rev_type, char *rev_arg)
        {
-       char *reason = NULL, *other = NULL, *str;
+       char *other = NULL, *str;
+       const char *reason = NULL;
        ASN1_OBJECT *otmp;
        ASN1_UTCTIME *revtm = NULL;
        int i;
@@ -2784,7 +2778,7 @@ char *make_revocation_str(int rev_type, char *rev_arg)
  */
 
 
-int make_revoked(X509_REVOKED *rev, char *str)
+int make_revoked(X509_REVOKED *rev, const char *str)
        {
        char *tmp = NULL;
        int reason_code = -1;
@@ -2877,7 +2871,7 @@ int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
        return 1;
        }
 
-int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, char *str)
+int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)
        {
        char *tmp = NULL;
        char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;