X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=apps%2Freq.c;h=79a7394088b414642b54d8657f8e771923e43037;hp=cc524de8e22d3eea899ae3280b32fd3431a0334b;hb=8a208cba97b0d08cfc6f07bb2f0e0d1f305a0b13;hpb=87a25f90324aa6f48d903a22852ff2ce1aa9dde0 diff --git a/apps/req.c b/apps/req.c index cc524de8e2..79a7394088 100644 --- a/apps/req.c +++ b/apps/req.c @@ -66,7 +66,6 @@ #include "apps.h" #include #include -#include #include #include #include @@ -79,10 +78,12 @@ #define BITS "default_bits" #define KEYFILE "default_keyfile" +#define PROMPT "prompt" #define DISTINGUISHED_NAME "distinguished_name" #define ATTRIBUTES "attributes" #define V3_EXTENSIONS "x509_extensions" #define REQ_EXTENSIONS "req_extensions" +#define STRING_MASK "string_mask" #define DEFAULT_KEY_LENGTH 512 #define MIN_KEY_LENGTH 384 @@ -90,7 +91,7 @@ #undef PROG #define PROG req_main -/* -inform arg - input format - default PEM (one of DER, TXT or PEM) +/* -inform arg - input format - default PEM (DER or PEM) * -outform arg - output format - default PEM * -in arg - input file - default stdin * -out arg - output file - default stdout @@ -109,13 +110,20 @@ */ static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,int attribs); -static int add_attribute_object(STACK_OF(X509_ATTRIBUTE) *n, char *text, +static int prompt_info(X509_REQ *req, + STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect, + STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs); +static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk, + STACK_OF(CONF_VALUE) *attr, int attribs); +static int add_attribute_object(X509_REQ *req, char *text, char *def, char *value, int nid, int min, int max); static int add_DN_object(X509_NAME *n, char *text, char *def, char *value, int nid,int min,int max); +#ifndef NO_RSA static void MS_CALLBACK req_cb(int p,int n,void *arg); -static int req_fix_data(int nid,int *type,int len,int min,int max); +#endif +static int req_check_len(int len,int min,int max); static int check_end(char *str, char *end); static int add_oid_section(LHASH *conf); #ifndef MONOLITH @@ -128,6 +136,8 @@ static LHASH *req_conf=NULL; #define TYPE_DSA 2 #define TYPE_DH 3 +int MAIN(int, char **); + int MAIN(int argc, char **argv) { #ifndef NO_DSA @@ -140,18 +150,21 @@ int MAIN(int argc, char **argv) int i,badops=0,newreq=0,newkey= -1,pkey_type=0; BIO *in=NULL,*out=NULL; int informat,outformat,verify=0,noout=0,text=0,keyform=FORMAT_PEM; - int nodes=0,kludge=0; + int nodes=0,kludge=0,newhdr=0; char *infile,*outfile,*prog,*keyfile=NULL,*template=NULL,*keyout=NULL; char *extensions = NULL; char *req_exts = NULL; EVP_CIPHER *cipher=NULL; int modulus=0; + char *passargin = NULL, *passargout = NULL; + char *passin = NULL, *passout = NULL; char *p; const EVP_MD *md_alg=NULL,*digest=EVP_md5(); #ifndef MONOLITH MS_STATIC char config_name[256]; #endif + req_conf = NULL; #ifndef NO_DES cipher=EVP_des_ede3_cbc(); #endif @@ -216,6 +229,16 @@ int MAIN(int argc, char **argv) if (--argc < 1) goto bad; keyout= *(++argv); } + else if (strcmp(*argv,"-passin") == 0) + { + if (--argc < 1) goto bad; + passargin= *(++argv); + } + else if (strcmp(*argv,"-passout") == 0) + { + if (--argc < 1) goto bad; + passargout= *(++argv); + } else if (strcmp(*argv,"-newkey") == 0) { int is_numeric; @@ -283,6 +306,8 @@ int MAIN(int argc, char **argv) newreq=1; } + else if (strcmp(*argv,"-newhdr") == 0) + newhdr=1; else if (strcmp(*argv,"-modulus") == 0) modulus=1; else if (strcmp(*argv,"-verify") == 0) @@ -335,8 +360,8 @@ int MAIN(int argc, char **argv) bad: BIO_printf(bio_err,"%s [options] outfile\n",prog); BIO_printf(bio_err,"where options are\n"); - BIO_printf(bio_err," -inform arg input format - one of DER TXT PEM\n"); - BIO_printf(bio_err," -outform arg output format - one of DER TXT PEM\n"); + BIO_printf(bio_err," -inform arg input format - DER or PEM\n"); + BIO_printf(bio_err," -outform arg output format - DER or PEM\n"); BIO_printf(bio_err," -in arg input file\n"); BIO_printf(bio_err," -out arg output file\n"); BIO_printf(bio_err," -text text form of request\n"); @@ -355,18 +380,21 @@ bad: BIO_printf(bio_err," -new new request.\n"); BIO_printf(bio_err," -x509 output a x509 structure instead of a cert. req.\n"); BIO_printf(bio_err," -days number of days a x509 generated by -x509 is valid for.\n"); + BIO_printf(bio_err," -newhdr output \"NEW\" in the header lines\n"); BIO_printf(bio_err," -asn1-kludge Output the 'request' in a format that is wrong but some CA's\n"); BIO_printf(bio_err," have been reported as requiring\n"); - BIO_printf(bio_err," [ It is now always turned on but can be turned off with -no-asn1-kludge ]\n"); BIO_printf(bio_err," -extensions .. specify certificate extension section (override value in config file)\n"); BIO_printf(bio_err," -reqexts .. specify request extension section (override value in config file)\n"); goto end; } ERR_load_crypto_strings(); - X509V3_add_standard_extensions(); + if(!app_passwd(bio_err, passargin, passargout, &passin, &passout)) { + BIO_printf(bio_err, "Error getting passwords\n"); + goto end; + } -#ifndef MONOLITH +#ifndef MONOLITH /* else this has happened in openssl.c (global `config') */ /* Lets load up our environment a little */ p=getenv("OPENSSL_CONF"); if (p == NULL) @@ -380,7 +408,7 @@ bad: strcat(config_name,OPENSSL_CONF); p=config_name; } - default_config_file=p; + default_config_file=p; config=CONF_load(config,p,NULL); #endif @@ -452,6 +480,19 @@ bad: } } + if(!passin) + passin = CONF_get_string(req_conf, SECTION, "input_password"); + + if(!passout) + passout = CONF_get_string(req_conf, SECTION, "output_password"); + + p = CONF_get_string(req_conf, SECTION, STRING_MASK); + + if(p && !ASN1_STRING_set_default_mask_asc(p)) { + BIO_printf(bio_err, "Invalid global string mask setting %s\n", p); + goto end; + } + if(!req_exts) req_exts = CONF_get_string(req_conf, SECTION, REQ_EXTENSIONS); if(req_exts) { @@ -480,11 +521,12 @@ bad: goto end; } -/* if (keyform == FORMAT_ASN1) - rsa=d2i_RSAPrivateKey_bio(in,NULL); - else */ - if (keyform == FORMAT_PEM) - pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,NULL); + if (keyform == FORMAT_ASN1) + pkey=d2i_PrivateKey_bio(in,NULL); + else if (keyform == FORMAT_PEM) + { + pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,passin); + } else { BIO_printf(bio_err,"bad input format specified for X509 request\n"); @@ -500,25 +542,9 @@ bad: if (newreq && (pkey == NULL)) { - char *randfile; - char buffer[200]; - - if ((randfile=CONF_get_string(req_conf,SECTION,"RANDFILE")) == NULL) - randfile=RAND_file_name(buffer,200); -#ifdef WINDOWS - BIO_printf(bio_err,"Loading 'screen' into random state -"); - BIO_flush(bio_err); - RAND_screen(); - BIO_printf(bio_err," done\n"); -#endif - if ((randfile == NULL) || !RAND_load_file(randfile,1024L*1024L)) - { - BIO_printf(bio_err,"unable to load 'random state'\n"); - BIO_printf(bio_err,"What this means is that the random number generator has not been seeded\n"); - BIO_printf(bio_err,"with much random data.\n"); - BIO_printf(bio_err,"Consider setting the RANDFILE environment variable to point at a file that\n"); - BIO_printf(bio_err,"'random' data can be kept in.\n"); - } + char *randfile = CONF_get_string(req_conf,SECTION,"RANDFILE"); + app_RAND_load_file(randfile, bio_err, 0); + if (newkey <= 0) { newkey=(int)CONF_get_number(req_conf,SECTION,BITS); @@ -556,8 +582,7 @@ bad: } #endif - if ((randfile == NULL) || (RAND_write_file(randfile) == 0)) - BIO_printf(bio_err,"unable to write 'random state'\n"); + app_RAND_write_file(randfile, bio_err); if (pkey == NULL) goto end; @@ -589,7 +614,7 @@ bad: i=0; loop: if (!PEM_write_bio_PrivateKey(out,pkey,cipher, - NULL,0,NULL,NULL)) + NULL,0,NULL,passout)) { if ((ERR_GET_REASON(ERR_peek_error()) == PEM_R_PROBLEMS_GETTING_PASSWORD) && (i < 3)) @@ -812,9 +837,10 @@ loop: { if (outformat == FORMAT_ASN1) i=i2d_X509_REQ_bio(out,req); - else if (outformat == FORMAT_PEM) - i=PEM_write_bio_X509_REQ(out,req); - else { + else if (outformat == FORMAT_PEM) { + if(newhdr) i=PEM_write_bio_X509_REQ_NEW(out,req); + else i=PEM_write_bio_X509_REQ(out,req); + } else { BIO_printf(bio_err,"bad output format specified for outfile\n"); goto end; } @@ -852,7 +878,8 @@ end: EVP_PKEY_free(pkey); X509_REQ_free(req); X509_free(x509ss); - X509V3_EXT_cleanup(); + if(passin) Free(passin); + if(passout) Free(passout); OBJ_cleanup(); #ifndef NO_DSA if (dsa_params != NULL) DSA_free(dsa_params); @@ -863,43 +890,67 @@ end: static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, int attribs) { int ret=0,i; - char *p,*q; - X509_REQ_INFO *ri; - char buf[100]; - int nid,min,max; - char *type,*def,*tmp,*value,*tmp_attr; - STACK_OF(CONF_VALUE) *sk, *attr=NULL; - CONF_VALUE *v; - - tmp=CONF_get_string(req_conf,SECTION,DISTINGUISHED_NAME); - if (tmp == NULL) + char no_prompt = 0; + STACK_OF(CONF_VALUE) *dn_sk, *attr_sk = NULL; + char *tmp, *dn_sect,*attr_sect; + + tmp=CONF_get_string(req_conf,SECTION,PROMPT); + if((tmp != NULL) && !strcmp(tmp, "no")) no_prompt = 1; + + dn_sect=CONF_get_string(req_conf,SECTION,DISTINGUISHED_NAME); + if (dn_sect == NULL) { BIO_printf(bio_err,"unable to find '%s' in config\n", DISTINGUISHED_NAME); goto err; } - sk=CONF_get_section(req_conf,tmp); - if (sk == NULL) + dn_sk=CONF_get_section(req_conf,dn_sect); + if (dn_sk == NULL) { - BIO_printf(bio_err,"unable to get '%s' section\n",tmp); + BIO_printf(bio_err,"unable to get '%s' section\n",dn_sect); goto err; } - tmp_attr=CONF_get_string(req_conf,SECTION,ATTRIBUTES); - if (tmp_attr == NULL) - attr=NULL; + attr_sect=CONF_get_string(req_conf,SECTION,ATTRIBUTES); + if (attr_sect == NULL) + attr_sk=NULL; else { - attr=CONF_get_section(req_conf,tmp_attr); - if (attr == NULL) + attr_sk=CONF_get_section(req_conf,attr_sect); + if (attr_sk == NULL) { - BIO_printf(bio_err,"unable to get '%s' section\n",tmp_attr); + BIO_printf(bio_err,"unable to get '%s' section\n",attr_sect); goto err; } } - ri=req->req_info; + /* setup version number */ + if (!X509_REQ_set_version(req,0L)) goto err; /* version 1 */ + + if(no_prompt) i = auto_info(req, dn_sk, attr_sk, attribs); + else i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs); + if(!i) goto err; + + X509_REQ_set_pubkey(req,pkey); + ret=1; +err: + return(ret); + } + + +static int prompt_info(X509_REQ *req, + STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect, + STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs) + { + int i; + char *p,*q; + char buf[100]; + int nid,min,max; + char *type,*def,*value; + CONF_VALUE *v; + X509_NAME *subj; + subj = X509_REQ_get_subject_name(req); BIO_printf(bio_err,"You are about to be asked to enter information that will be incorporated\n"); BIO_printf(bio_err,"into your certificate request.\n"); BIO_printf(bio_err,"What you are about to enter is what is called a Distinguished Name or a DN.\n"); @@ -908,18 +959,16 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, int attribs) BIO_printf(bio_err,"If you enter '.', the field will be left blank.\n"); BIO_printf(bio_err,"-----\n"); - /* setup version number */ - if (!ASN1_INTEGER_set(ri->version,0L)) goto err; /* version 1 */ - if (sk_CONF_VALUE_num(sk)) + if (sk_CONF_VALUE_num(dn_sk)) { i= -1; start: for (;;) { i++; - if (sk_CONF_VALUE_num(sk) <= i) break; + if (sk_CONF_VALUE_num(dn_sk) <= i) break; - v=sk_CONF_VALUE_value(sk,i); + v=sk_CONF_VALUE_value(dn_sk,i); p=q=NULL; type=v->name; if(!check_end(type,"_min") || !check_end(type,"_max") || @@ -938,32 +987,32 @@ start: for (;;) /* If OBJ not recognised ignore it */ if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start; sprintf(buf,"%s_default",v->name); - if ((def=CONF_get_string(req_conf,tmp,buf)) == NULL) + if ((def=CONF_get_string(req_conf,dn_sect,buf)) == NULL) def=""; sprintf(buf,"%s_value",v->name); - if ((value=CONF_get_string(req_conf,tmp,buf)) == NULL) + if ((value=CONF_get_string(req_conf,dn_sect,buf)) == NULL) value=NULL; sprintf(buf,"%s_min",v->name); - min=(int)CONF_get_number(req_conf,tmp,buf); + min=(int)CONF_get_number(req_conf,dn_sect,buf); sprintf(buf,"%s_max",v->name); - max=(int)CONF_get_number(req_conf,tmp,buf); + max=(int)CONF_get_number(req_conf,dn_sect,buf); - if (!add_DN_object(ri->subject,v->value,def,value,nid, + if (!add_DN_object(subj,v->value,def,value,nid, min,max)) - goto err; + return 0; } - if (sk_X509_NAME_ENTRY_num(ri->subject->entries) == 0) + if (X509_NAME_entry_count(subj) == 0) { BIO_printf(bio_err,"error, no objects specified in config file\n"); - goto err; + return 0; } if (attribs) { - if ((attr != NULL) && (sk_CONF_VALUE_num(attr) > 0)) + if ((attr_sk != NULL) && (sk_CONF_VALUE_num(attr_sk) > 0)) { BIO_printf(bio_err,"\nPlease enter the following 'extra' attributes\n"); BIO_printf(bio_err,"to be sent with your certificate request\n"); @@ -973,57 +1022,101 @@ start: for (;;) start2: for (;;) { i++; - if ((attr == NULL) || - (sk_CONF_VALUE_num(attr) <= i)) + if ((attr_sk == NULL) || + (sk_CONF_VALUE_num(attr_sk) <= i)) break; - v=sk_CONF_VALUE_value(attr,i); + v=sk_CONF_VALUE_value(attr_sk,i); type=v->name; if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start2; sprintf(buf,"%s_default",type); - if ((def=CONF_get_string(req_conf,tmp_attr,buf)) + if ((def=CONF_get_string(req_conf,attr_sect,buf)) == NULL) def=""; sprintf(buf,"%s_value",type); - if ((value=CONF_get_string(req_conf,tmp_attr,buf)) + if ((value=CONF_get_string(req_conf,attr_sect,buf)) == NULL) value=NULL; sprintf(buf,"%s_min",type); - min=(int)CONF_get_number(req_conf,tmp_attr,buf); + min=(int)CONF_get_number(req_conf,attr_sect,buf); sprintf(buf,"%s_max",type); - max=(int)CONF_get_number(req_conf,tmp_attr,buf); + max=(int)CONF_get_number(req_conf,attr_sect,buf); - if (!add_attribute_object(ri->attributes, + if (!add_attribute_object(req, v->value,def,value,nid,min,max)) - goto err; + return 0; } } } else { BIO_printf(bio_err,"No template, please set one up.\n"); - goto err; + return 0; } - X509_REQ_set_pubkey(req,pkey); + return 1; - ret=1; -err: - return(ret); } +static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, + STACK_OF(CONF_VALUE) *attr_sk, int attribs) + { + int i; + char *p,*q; + char *type; + CONF_VALUE *v; + X509_NAME *subj; + + subj = X509_REQ_get_subject_name(req); + + for (i = 0; i < sk_CONF_VALUE_num(dn_sk); i++) + { + v=sk_CONF_VALUE_value(dn_sk,i); + p=q=NULL; + type=v->name; + /* Skip past any leading X. X: X, etc to allow for + * multiple instances + */ + for(p = v->name; *p ; p++) + if ((*p == ':') || (*p == ',') || (*p == '.')) { + p++; + if(*p) type = p; + break; + } + if (!X509_NAME_add_entry_by_txt(subj,type, MBSTRING_ASC, + (unsigned char *) v->value,-1,-1,0)) return 0; + + } + + if (!X509_NAME_entry_count(subj)) + { + BIO_printf(bio_err,"error, no objects specified in config file\n"); + return 0; + } + if (attribs) + { + for (i = 0; i < sk_CONF_VALUE_num(attr_sk); i++) + { + v=sk_CONF_VALUE_value(attr_sk,i); + if(!X509_REQ_radd_attr_by_txt(req, v->name, MBSTRING_ASC, + (unsigned char *)v->value, -1)) return 0; + } + } + return 1; + } + + static int add_DN_object(X509_NAME *n, char *text, char *def, char *value, int nid, int min, int max) { - int i,j,ret=0; - X509_NAME_ENTRY *ne=NULL; + int i,ret=0; MS_STATIC char buf[1024]; - +start: BIO_printf(bio_err,"%s [%s]:",text,def); (void)BIO_flush(bio_err); if (value != NULL) @@ -1056,33 +1149,23 @@ static int add_DN_object(X509_NAME *n, char *text, char *def, char *value, } buf[--i]='\0'; - j=ASN1_PRINTABLE_type((unsigned char *)buf,-1); - if (req_fix_data(nid,&j,i,min,max) == 0) - goto err; #ifdef CHARSET_EBCDIC ebcdic2ascii(buf, buf, i); #endif - if ((ne=X509_NAME_ENTRY_create_by_NID(NULL,nid,j,(unsigned char *)buf, - strlen(buf))) - == NULL) goto err; - if (!X509_NAME_add_entry(n,ne,X509_NAME_entry_count(n),0)) - goto err; - + if(!req_check_len(i, min, max)) goto start; + if (!X509_NAME_add_entry_by_NID(n,nid, MBSTRING_ASC, + (unsigned char *) buf, -1,-1,0)) goto err; ret=1; err: - if (ne != NULL) X509_NAME_ENTRY_free(ne); return(ret); } -static int add_attribute_object(STACK_OF(X509_ATTRIBUTE) *n, char *text, +static int add_attribute_object(X509_REQ *req, char *text, char *def, char *value, int nid, int min, int max) { - int i,z; - X509_ATTRIBUTE *xa=NULL; + int i; static char buf[1024]; - ASN1_BIT_STRING *bs=NULL; - ASN1_TYPE *at=NULL; start: BIO_printf(bio_err,"%s [%s]:",text,def); @@ -1116,50 +1199,21 @@ start: return(0); } buf[--i]='\0'; + if(!req_check_len(i, min, max)) goto start; - /* add object plus value */ - if ((xa=X509_ATTRIBUTE_new()) == NULL) - goto err; - if ((xa->value.set=sk_ASN1_TYPE_new_null()) == NULL) + if(!X509_REQ_radd_attr_by_NID(req, nid, MBSTRING_ASC, + (unsigned char *)buf, -1)) { + BIO_printf(bio_err, "Error adding attribute\n"); + ERR_print_errors(bio_err); goto err; - xa->set=1; - - if (xa->object != NULL) ASN1_OBJECT_free(xa->object); - xa->object=OBJ_nid2obj(nid); - - if ((bs=ASN1_BIT_STRING_new()) == NULL) goto err; - - bs->type=ASN1_PRINTABLE_type((unsigned char *)buf,-1); - - z=req_fix_data(nid,&bs->type,i,min,max); - if (z == 0) - { - if (value == NULL) - goto start; - else goto err; - } - - if (!ASN1_STRING_set(bs,(unsigned char *)buf,i+1)) - { BIO_printf(bio_err,"Malloc failure\n"); goto err; } - - if ((at=ASN1_TYPE_new()) == NULL) - { BIO_printf(bio_err,"Malloc failure\n"); goto err; } - - ASN1_TYPE_set(at,bs->type,(char *)bs); - sk_ASN1_TYPE_push(xa->value.set,at); - bs=NULL; - at=NULL; - /* only one item per attribute */ + } - if (!sk_X509_ATTRIBUTE_push(n,xa)) goto err; return(1); err: - if (xa != NULL) X509_ATTRIBUTE_free(xa); - if (at != NULL) ASN1_TYPE_free(at); - if (bs != NULL) ASN1_BIT_STRING_free(bs); return(0); } +#ifndef NO_RSA static void MS_CALLBACK req_cb(int p, int n, void *arg) { char c='*'; @@ -1174,26 +1228,10 @@ static void MS_CALLBACK req_cb(int p, int n, void *arg) p=n; #endif } +#endif -static int req_fix_data(int nid, int *type, int len, int min, int max) +static int req_check_len(int len, int min, int max) { - if (nid == NID_pkcs9_emailAddress) - *type=V_ASN1_IA5STRING; - if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING)) - *type=V_ASN1_T61STRING; - if ((nid == NID_pkcs9_challengePassword) && - (*type == V_ASN1_IA5STRING)) - *type=V_ASN1_T61STRING; - - if ((nid == NID_pkcs9_unstructuredName) && - (*type == V_ASN1_T61STRING)) - { - BIO_printf(bio_err,"invalid characters in string, please re-enter the string\n"); - return(0); - } - if (nid == NID_pkcs9_unstructuredName) - *type=V_ASN1_IA5STRING; - if (len < min) { BIO_printf(bio_err,"string is too short, it needs to be at least %d bytes long\n",min);