Add functionality to help making self-signed certificate.
[openssl.git] / crypto / x509 / x509_cmp.c
index 16986231710b77c1df6da25a28f5bdb1ade2fd08..5dfdcd41cb4ffe117604c6b3ab005a0f52e15a63 100644 (file)
@@ -57,6 +57,7 @@
  */
 
 #include <stdio.h>
+#include <ctype.h>
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 #include <openssl/objects.h>
@@ -75,24 +76,27 @@ int X509_issuer_and_serial_cmp(const X509 *a, const X509 *b)
        return(X509_NAME_cmp(ai->issuer,bi->issuer));
        }
 
-#ifndef NO_MD5
+#ifndef OPENSSL_NO_MD5
 unsigned long X509_issuer_and_serial_hash(X509 *a)
        {
        unsigned long ret=0;
-       MD5_CTX ctx;
+       EVP_MD_CTX ctx;
        unsigned char md[16];
-       char str[256];
+       char *f;
 
-       X509_NAME_oneline(a->cert_info->issuer,str,256);
-       ret=strlen(str);
-       MD5_Init(&ctx);
-       MD5_Update(&ctx,(unsigned char *)str,ret);
-       MD5_Update(&ctx,(unsigned char *)a->cert_info->serialNumber->data,
+       EVP_MD_CTX_init(&ctx);
+       f=X509_NAME_oneline(a->cert_info->issuer,NULL,0);
+       ret=strlen(f);
+       EVP_DigestInit_ex(&ctx, EVP_md5(), NULL);
+       EVP_DigestUpdate(&ctx,(unsigned char *)f,ret);
+       OPENSSL_free(f);
+       EVP_DigestUpdate(&ctx,(unsigned char *)a->cert_info->serialNumber->data,
                (unsigned long)a->cert_info->serialNumber->length);
-       MD5_Final(&(md[0]),&ctx);
+       EVP_DigestFinal_ex(&ctx,&(md[0]),NULL);
        ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
                )&0xffffffffL;
+       EVP_MD_CTX_cleanup(&ctx);
        return(ret);
        }
 #endif
@@ -137,7 +141,7 @@ unsigned long X509_subject_name_hash(X509 *x)
        return(X509_NAME_hash(x->cert_info->subject));
        }
 
-#ifndef NO_SHA
+#ifndef OPENSSL_NO_SHA
 /* Compare two certificates: they must be identical for
  * this to work. NB: Although "cmp" operations are generally
  * prototyped to take "const" arguments (eg. for use in
@@ -157,6 +161,99 @@ int X509_cmp(const X509 *a, const X509 *b)
 }
 #endif
 
+
+/* Case insensitive string comparision */
+static int nocase_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
+{
+       int i;
+
+       if (a->length != b->length)
+               return (a->length - b->length);
+
+       for (i=0; i<a->length; i++)
+       {
+               int ca, cb;
+
+               ca = tolower(a->data[i]);
+               cb = tolower(b->data[i]);
+
+               if (ca != cb)
+                       return(ca-cb);
+       }
+       return 0;
+}
+
+/* Case insensitive string comparision with space normalization 
+ * Space normalization - ignore leading, trailing spaces, 
+ *       multiple spaces between characters are replaced by single space  
+ */
+static int nocase_spacenorm_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
+{
+       unsigned char *pa = NULL, *pb = NULL;
+       int la, lb;
+       
+       la = a->length;
+       lb = b->length;
+       pa = a->data;
+       pb = b->data;
+
+       /* skip leading spaces */
+       while (la > 0 && isspace(*pa))
+       {
+               la--;
+               pa++;
+       }
+       while (lb > 0 && isspace(*pb))
+       {
+               lb--;
+               pb++;
+       }
+
+       /* skip trailing spaces */
+       while (la > 0 && isspace(pa[la-1]))
+               la--;
+       while (lb > 0 && isspace(pb[lb-1]))
+               lb--;
+
+       /* compare strings with space normalization */
+       while (la > 0 && lb > 0)
+       {
+               int ca, cb;
+
+               /* compare character */
+               ca = tolower(*pa);
+               cb = tolower(*pb);
+               if (ca != cb)
+                       return (ca - cb);
+
+               pa++; pb++;
+               la--; lb--;
+
+               if (la <= 0 || lb <= 0)
+                       break;
+
+               /* is white space next character ? */
+               if (isspace(*pa) && isspace(*pb))
+               {
+                       /* skip remaining white spaces */
+                       while (la > 0 && isspace(*pa))
+                       {
+                               la--;
+                               pa++;
+                       }
+                       while (lb > 0 && isspace(*pb))
+                       {
+                               lb--;
+                               pb++;
+                       }
+               }
+       }
+       if (la > 0 || lb > 0)
+               return la - lb;
+
+       return 0;
+}
+
 int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
        {
        int i,j;
@@ -170,10 +267,20 @@ int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
                {
                na=sk_X509_NAME_ENTRY_value(a->entries,i);
                nb=sk_X509_NAME_ENTRY_value(b->entries,i);
-               j=na->value->length-nb->value->length;
+               j=na->value->type-nb->value->type;
                if (j) return(j);
-               j=memcmp(na->value->data,nb->value->data,
-                       na->value->length);
+               if (na->value->type == V_ASN1_PRINTABLESTRING)
+                       j=nocase_spacenorm_cmp(na->value, nb->value);
+               else if (na->value->type == V_ASN1_IA5STRING
+                       && OBJ_obj2nid(na->object) == NID_pkcs9_emailAddress)
+                       j=nocase_cmp(na->value, nb->value);
+               else
+                       {
+                       j=na->value->length-nb->value->length;
+                       if (j) return(j);
+                       j=memcmp(na->value->data,nb->value->data,
+                               na->value->length);
+                       }
                if (j) return(j);
                j=na->set-nb->set;
                if (j) return(j);
@@ -192,7 +299,7 @@ int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
        return(0);
        }
 
-#ifndef NO_MD5
+#ifndef OPENSSL_NO_MD5
 /* I now DER encode the name and hash it.  Since I cache the DER encoding,
  * this is reasonably efficient. */
 unsigned long X509_NAME_hash(X509_NAME *x)
@@ -202,7 +309,7 @@ unsigned long X509_NAME_hash(X509_NAME *x)
 
        /* Make sure X509_NAME structure contains valid cached encoding */
        i2d_X509_NAME(x,NULL);
-       EVP_Digest(x->bytes->data, x->bytes->length, md, NULL, EVP_md5());
+       EVP_Digest(x->bytes->data, x->bytes->length, md, NULL, EVP_md5(), NULL);
 
        ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
@@ -267,45 +374,36 @@ int X509_check_private_key(X509 *x, EVP_PKEY *k)
        int ok=0;
 
        xk=X509_get_pubkey(x);
-       if (xk->type != k->type)
-           {
-           X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_TYPE_MISMATCH);
-           goto err;
-           }
-       switch (k->type)
+       switch (EVP_PKEY_cmp(xk, k))
                {
-#ifndef NO_RSA
-       case EVP_PKEY_RSA:
-               if (BN_cmp(xk->pkey.rsa->n,k->pkey.rsa->n) != 0
-                   || BN_cmp(xk->pkey.rsa->e,k->pkey.rsa->e) != 0)
-                   {
-                   X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH);
-                   goto err;
-                   }
+       case 1:
+               ok=1;
                break;
-#endif
-#ifndef NO_DSA
-       case EVP_PKEY_DSA:
-               if (BN_cmp(xk->pkey.dsa->pub_key,k->pkey.dsa->pub_key) != 0)
-                   {
-                   X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH);
-                   goto err;
-                   }
+       case 0:
+               X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH);
+               break;
+       case -1:
+               X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_TYPE_MISMATCH);
                break;
+       case -2:
+#ifndef OPENSSL_NO_EC
+               if (k->type == EVP_PKEY_EC)
+                       {
+                       X509err(X509_F_X509_CHECK_PRIVATE_KEY, ERR_R_EC_LIB);
+                       break;
+                       }
 #endif
-#ifndef NO_DH
-       case EVP_PKEY_DH:
-               /* No idea */
-               X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_CANT_CHECK_DH_KEY);
-               goto err;
+#ifndef OPENSSL_NO_DH
+               if (k->type == EVP_PKEY_DH)
+                       {
+                       /* No idea */
+                       X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_CANT_CHECK_DH_KEY);
+                       break;
+                       }
 #endif
-       default:
                X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_UNKNOWN_KEY_TYPE);
-               goto err;
                }
 
-       ok=1;
-err:
        EVP_PKEY_free(xk);
        return(ok);
        }