- TXT_DB_write(out,db->db);
- BIO_printf(bio_err,"%d entries loaded from the database\n",
- sk_OPENSSL_PSTRING_num(db->db->data));
- BIO_printf(bio_err,"generating index\n");
- }
-
- if (!index_index(db)) goto err;
-
- /*****************************************************************/
- /* Update the db file for expired certificates */
- if (doupdatedb)
- {
- if (verbose)
- BIO_printf(bio_err, "Updating %s ...\n",
- dbfile);
-
- i = do_updatedb(db);
- if (i == -1)
- {
- BIO_printf(bio_err,"Malloc failure\n");
- goto err;
- }
- else if (i == 0)
- {
- if (verbose) BIO_printf(bio_err,
- "No entries found to mark expired\n");
- }
- else
- {
- if (!save_index(dbfile,"new",db)) goto err;
-
- if (!rotate_index(dbfile,"new","old")) goto err;
-
- if (verbose) BIO_printf(bio_err,
- "Done. %d entries marked as expired\n",i);
- }
- }
-
- /*****************************************************************/
- /* Read extensions config file */
- if (extfile)
- {
- extconf = NCONF_new(NULL);
- if (NCONF_load(extconf,extfile,&errorline) <= 0)
- {
- if (errorline <= 0)
- BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
- extfile);
- else
- BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
- errorline,extfile);
- ret = 1;
- goto err;
- }
-
- if (verbose)
- BIO_printf(bio_err, "Successfully loaded extensions file %s\n", extfile);
-
- /* We can have sections in the ext file */
- if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
- extensions = "default";
- }
-
- /*****************************************************************/
- if (req || gencrl)
- {
- if (outfile != NULL)
- {
- if (BIO_write_filename(Sout,outfile) <= 0)
- {
- perror(outfile);
- goto err;
- }
- }
- else
- {
- BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
-#ifdef OPENSSL_SYS_VMS
- {
- BIO *tmpbio = BIO_new(BIO_f_linebuffer());
- Sout = BIO_push(tmpbio, Sout);
- }
-#endif
- }
- }
-
- if ((md == NULL) && ((md=NCONF_get_string(conf,
- section,ENV_DEFAULT_MD)) == NULL))
- {
- lookup_fail(section,ENV_DEFAULT_MD);
- goto err;
- }
-
- if (!strcmp(md, "default"))
- {
- int def_nid;
- if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0)
- {
- BIO_puts(bio_err,"no default digest\n");
- goto err;
- }
- md = (char *)OBJ_nid2sn(def_nid);
- }
-
- if ((dgst=EVP_get_digestbyname(md)) == NULL)
- {
- BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
- goto err;
- }
-
- if (req)
- {
- if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
- section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
- {
- if(strcmp(tmp_email_dn,"no") == 0)
- email_dn=0;
- }
- if (verbose)
- BIO_printf(bio_err,"message digest is %s\n",
- OBJ_nid2ln(dgst->type));
- if ((policy == NULL) && ((policy=NCONF_get_string(conf,
- section,ENV_POLICY)) == NULL))
- {
- lookup_fail(section,ENV_POLICY);
- goto err;
- }
- if (verbose)
- BIO_printf(bio_err,"policy is %s\n",policy);
-
- if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
- == NULL)
- {
- lookup_fail(section,ENV_SERIAL);
- goto err;
- }
-
- if (!extconf)
- {
- /* no '-extfile' option, so we look for extensions
- * in the main configuration file */
- if (!extensions)
- {
- extensions=NCONF_get_string(conf,section,
- ENV_EXTENSIONS);
- if (!extensions)
- ERR_clear_error();
- }
- if (extensions)
- {
- /* Check syntax of file */
- X509V3_CTX ctx;
- X509V3_set_ctx_test(&ctx);
- X509V3_set_nconf(&ctx, conf);
- if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
- NULL))
- {
- BIO_printf(bio_err,
- "Error Loading extension section %s\n",
- extensions);
- ret = 1;
- goto err;
- }
- }
- }
-
- if (startdate == NULL)
- {
- startdate=NCONF_get_string(conf,section,
- ENV_DEFAULT_STARTDATE);
- if (startdate == NULL)
- ERR_clear_error();
- }
- if (startdate && !ASN1_TIME_set_string(NULL, startdate))
- {
- BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
- goto err;
- }
- if (startdate == NULL) startdate="today";
-
- if (enddate == NULL)
- {
- enddate=NCONF_get_string(conf,section,
- ENV_DEFAULT_ENDDATE);
- if (enddate == NULL)
- ERR_clear_error();
- }
- if (enddate && !ASN1_TIME_set_string(NULL, enddate))
- {
- BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
- goto err;
- }
-
- if (days == 0)
- {
- if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
- days = 0;
- }
- if (!enddate && (days == 0))
- {
- BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
- goto err;
- }
-
- if ((serial=load_serial(serialfile, create_ser, NULL)) == NULL)
- {
- BIO_printf(bio_err,"error while loading serial number\n");
- goto err;
- }
- if (verbose)
- {
- if (BN_is_zero(serial))
- BIO_printf(bio_err,"next serial number is 00\n");
- else
- {
- if ((f=BN_bn2hex(serial)) == NULL) goto err;
- BIO_printf(bio_err,"next serial number is %s\n",f);
- OPENSSL_free(f);
- }
- }
-
- if ((attribs=NCONF_get_section(conf,policy)) == NULL)
- {
- BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
- goto err;
- }
-
- if ((cert_sk=sk_X509_new_null()) == NULL)
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- if (spkac_file != NULL)
- {
- total++;
- j=certify_spkac(&x,spkac_file,pkey,x509,dgst,sigopts,
- attribs,db, serial,subj,chtype,multirdn,
- email_dn,startdate,enddate,days,extensions,
- conf,verbose,certopt,nameopt,default_op,ext_copy);
- if (j < 0) goto err;
- if (j > 0)
- {
- total_done++;
- BIO_printf(bio_err,"\n");
- if (!BN_add_word(serial,1)) goto err;
- if (!sk_X509_push(cert_sk,x))
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- if (outfile)
- {
- output_der = 1;
- batch = 1;
- }
- }
- }
- if (ss_cert_file != NULL)
- {
- total++;
- j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,sigopts,
- attribs,
- db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
- extensions,conf,verbose, certopt, nameopt,
- default_op, ext_copy, e);
- if (j < 0) goto err;
- if (j > 0)
- {
- total_done++;
- BIO_printf(bio_err,"\n");
- if (!BN_add_word(serial,1)) goto err;
- if (!sk_X509_push(cert_sk,x))
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- }
- }
- if (infile != NULL)
- {
- total++;
- j=certify(&x,infile,pkey,x509p,dgst,sigopts, attribs,db,
- serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
- extensions,conf,verbose, certopt, nameopt,
- default_op, ext_copy, selfsign);
- if (j < 0) goto err;
- if (j > 0)
- {
- total_done++;
- BIO_printf(bio_err,"\n");
- if (!BN_add_word(serial,1)) goto err;
- if (!sk_X509_push(cert_sk,x))
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- }
- }
- for (i=0; i<argc; i++)
- {
- total++;
- j=certify(&x,argv[i],pkey,x509p,dgst,sigopts,attribs,db,
- serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
- extensions,conf,verbose, certopt, nameopt,
- default_op, ext_copy, selfsign);
- if (j < 0) goto err;
- if (j > 0)
- {
- total_done++;
- BIO_printf(bio_err,"\n");
- if (!BN_add_word(serial,1)) goto err;
- if (!sk_X509_push(cert_sk,x))
- {
- BIO_printf(bio_err,"Memory allocation failure\n");
- goto err;
- }
- }
- }
- /* we have a stack of newly certified certificates
- * and a data base and serial number that need
- * updating */
-
- if (sk_X509_num(cert_sk) > 0)
- {
- if (!batch)
- {
- BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
- (void)BIO_flush(bio_err);
- buf[0][0]='\0';
- if (!fgets(buf[0],10,stdin))
- {
- BIO_printf(bio_err,"CERTIFICATION CANCELED: I/O error\n");
- ret=0;
- goto err;
- }
- if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
- {
- BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
- ret=0;
- goto err;
- }
- }
-
- BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
-
- if (!save_serial(serialfile,"new",serial,NULL)) goto err;
-
- if (!save_index(dbfile, "new", db)) goto err;
- }
-
- if (verbose)
- BIO_printf(bio_err,"writing new certificates\n");
- for (i=0; i<sk_X509_num(cert_sk); i++)
- {
- int k;
- char *n;
-
- x=sk_X509_value(cert_sk,i);
-
- j=x->cert_info->serialNumber->length;
- p=(const char *)x->cert_info->serialNumber->data;
-
- if(strlen(outdir) >= (size_t)(j ? BSIZE-j*2-6 : BSIZE-8))
- {
- BIO_printf(bio_err,"certificate file name too long\n");
- goto err;
- }
-
- strcpy(buf[2],outdir);
+ }
+
+ /*****************************************************************/
+ /* we need to load the database file */
+ if ((dbfile = NCONF_get_string(conf, section, ENV_DATABASE)) == NULL) {
+ lookup_fail(section, ENV_DATABASE);
+ goto end;
+ }
+ db = load_index(dbfile, &db_attr);
+ if (db == NULL)
+ goto end;
+
+ /* Lets check some fields */
+ for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
+ pp = sk_OPENSSL_PSTRING_value(db->db->data, i);
+ if ((pp[DB_type][0] != DB_TYPE_REV) && (pp[DB_rev_date][0] != '\0')) {
+ BIO_printf(bio_err,
+ "entry %d: not revoked yet, but has a revocation date\n",
+ i + 1);
+ goto end;
+ }
+ if ((pp[DB_type][0] == DB_TYPE_REV) &&
+ !make_revoked(NULL, pp[DB_rev_date])) {
+ BIO_printf(bio_err, " in entry %d\n", i + 1);
+ goto end;
+ }
+ if (!check_time_format((char *)pp[DB_exp_date])) {
+ BIO_printf(bio_err, "entry %d: invalid expiry date\n", i + 1);
+ goto end;
+ }
+ p = pp[DB_serial];
+ j = strlen(p);
+ if (*p == '-') {
+ p++;
+ j--;
+ }
+ if ((j & 1) || (j < 2)) {
+ BIO_printf(bio_err, "entry %d: bad serial number length (%d)\n",
+ i + 1, j);
+ goto end;
+ }
+ for ( ; *p; p++) {
+ if (!isxdigit(_UC(*p))) {
+ BIO_printf(bio_err,
+ "entry %d: bad char 0%o '%c' in serial number\n",
+ i + 1, *p, *p);
+ goto end;
+ }
+ }
+ }
+ if (verbose) {
+ TXT_DB_write(bio_out, db->db);
+ BIO_printf(bio_err, "%d entries loaded from the database\n",
+ sk_OPENSSL_PSTRING_num(db->db->data));
+ BIO_printf(bio_err, "generating index\n");
+ }
+
+ if (!index_index(db))
+ goto end;
+
+ /*****************************************************************/
+ /* Update the db file for expired certificates */
+ if (doupdatedb) {
+ if (verbose)
+ BIO_printf(bio_err, "Updating %s ...\n", dbfile);
+
+ i = do_updatedb(db);
+ if (i == -1) {
+ BIO_printf(bio_err, "Malloc failure\n");
+ goto end;
+ } else if (i == 0) {
+ if (verbose)
+ BIO_printf(bio_err, "No entries found to mark expired\n");
+ } else {
+ if (!save_index(dbfile, "new", db))
+ goto end;
+
+ if (!rotate_index(dbfile, "new", "old"))
+ goto end;
+
+ if (verbose)
+ BIO_printf(bio_err,
+ "Done. %d entries marked as expired\n", i);
+ }
+ }
+
+ /*****************************************************************/
+ /* Read extensions config file */
+ if (extfile) {
+ if ((extconf = app_load_config(extfile)) == NULL) {
+ ret = 1;
+ goto end;
+ }
+
+ if (verbose)
+ BIO_printf(bio_err, "Successfully loaded extensions file %s\n",
+ extfile);
+
+ /* We can have sections in the ext file */
+ if (!extensions
+ && !(extensions =
+ NCONF_get_string(extconf, "default", "extensions")))
+ extensions = "default";
+ }
+
+ /*****************************************************************/
+ if (req || gencrl) {
+ /* FIXME: Is it really always text? */
+ Sout = bio_open_default(outfile, 'w', FORMAT_TEXT);
+ if (Sout == NULL)
+ goto end;
+ }
+
+ if ((md == NULL) && ((md = NCONF_get_string(conf,
+ section,
+ ENV_DEFAULT_MD)) == NULL)) {
+ lookup_fail(section, ENV_DEFAULT_MD);
+ goto end;
+ }
+
+ if (strcmp(md, "default") == 0) {
+ int def_nid;
+ if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0) {
+ BIO_puts(bio_err, "no default digest\n");
+ goto end;
+ }
+ md = (char *)OBJ_nid2sn(def_nid);
+ }
+
+ if (!opt_md(md, &dgst)) {
+ goto end;
+ }
+
+ if (req) {
+ if ((email_dn == 1) && ((tmp_email_dn = NCONF_get_string(conf,
+ section,
+ ENV_DEFAULT_EMAIL_DN))
+ != NULL)) {
+ if (strcmp(tmp_email_dn, "no") == 0)
+ email_dn = 0;
+ }
+ if (verbose)
+ BIO_printf(bio_err, "message digest is %s\n",
+ OBJ_nid2ln(EVP_MD_type(dgst)));
+ if ((policy == NULL) && ((policy = NCONF_get_string(conf,
+ section,
+ ENV_POLICY)) ==
+ NULL)) {
+ lookup_fail(section, ENV_POLICY);
+ goto end;
+ }
+ if (verbose)
+ BIO_printf(bio_err, "policy is %s\n", policy);
+
+ if ((serialfile = NCONF_get_string(conf, section, ENV_SERIAL))
+ == NULL) {
+ lookup_fail(section, ENV_SERIAL);
+ goto end;
+ }
+
+ if (!extconf) {
+ /*
+ * no '-extfile' option, so we look for extensions in the main
+ * configuration file
+ */
+ if (!extensions) {
+ extensions = NCONF_get_string(conf, section, ENV_EXTENSIONS);
+ if (!extensions)
+ ERR_clear_error();
+ }
+ if (extensions) {
+ /* Check syntax of file */
+ X509V3_CTX ctx;
+ X509V3_set_ctx_test(&ctx);
+ X509V3_set_nconf(&ctx, conf);
+ if (!X509V3_EXT_add_nconf(conf, &ctx, extensions, NULL)) {
+ BIO_printf(bio_err,
+ "Error Loading extension section %s\n",
+ extensions);
+ ret = 1;
+ goto end;
+ }
+ }
+ }
+
+ if (startdate == NULL) {
+ startdate = NCONF_get_string(conf, section,
+ ENV_DEFAULT_STARTDATE);
+ if (startdate == NULL)
+ ERR_clear_error();
+ }
+ if (startdate && !ASN1_TIME_set_string(NULL, startdate)) {
+ BIO_printf(bio_err,
+ "start date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
+ goto end;
+ }
+ if (startdate == NULL)
+ startdate = "today";
+
+ if (enddate == NULL) {
+ enddate = NCONF_get_string(conf, section, ENV_DEFAULT_ENDDATE);
+ if (enddate == NULL)
+ ERR_clear_error();
+ }
+ if (enddate && !ASN1_TIME_set_string(NULL, enddate)) {
+ BIO_printf(bio_err,
+ "end date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
+ goto end;
+ }
+
+ if (days == 0) {
+ if (!NCONF_get_number(conf, section, ENV_DEFAULT_DAYS, &days))
+ days = 0;
+ }
+ if (!enddate && (days == 0)) {
+ BIO_printf(bio_err,
+ "cannot lookup how many days to certify for\n");
+ goto end;
+ }
+
+ if ((serial = load_serial(serialfile, create_ser, NULL)) == NULL) {
+ BIO_printf(bio_err, "error while loading serial number\n");
+ goto end;
+ }
+ if (verbose) {
+ if (BN_is_zero(serial))
+ BIO_printf(bio_err, "next serial number is 00\n");
+ else {
+ if ((f = BN_bn2hex(serial)) == NULL)
+ goto end;
+ BIO_printf(bio_err, "next serial number is %s\n", f);
+ OPENSSL_free(f);
+ }
+ }
+
+ if ((attribs = NCONF_get_section(conf, policy)) == NULL) {
+ BIO_printf(bio_err, "unable to find 'section' for %s\n", policy);
+ goto end;
+ }
+
+ if ((cert_sk = sk_X509_new_null()) == NULL) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto end;
+ }
+ if (spkac_file != NULL) {
+ total++;
+ j = certify_spkac(&x, spkac_file, pkey, x509, dgst, sigopts,
+ attribs, db, serial, subj, chtype, multirdn,
+ email_dn, startdate, enddate, days, extensions,
+ conf, verbose, certopt, nameopt, default_op,
+ ext_copy);
+ if (j < 0)
+ goto end;
+ if (j > 0) {
+ total_done++;
+ BIO_printf(bio_err, "\n");
+ if (!BN_add_word(serial, 1))
+ goto end;
+ if (!sk_X509_push(cert_sk, x)) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto end;
+ }
+ if (outfile) {
+ output_der = 1;
+ batch = 1;
+ }
+ }
+ }
+ if (ss_cert_file != NULL) {
+ total++;
+ j = certify_cert(&x, ss_cert_file, pkey, x509, dgst, sigopts,
+ attribs,
+ db, serial, subj, chtype, multirdn, email_dn,
+ startdate, enddate, days, batch, extensions,
+ conf, verbose, certopt, nameopt, default_op,
+ ext_copy);
+ if (j < 0)
+ goto end;
+ if (j > 0) {
+ total_done++;
+ BIO_printf(bio_err, "\n");
+ if (!BN_add_word(serial, 1))
+ goto end;
+ if (!sk_X509_push(cert_sk, x)) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto end;
+ }
+ }
+ }
+ if (infile != NULL) {
+ total++;
+ j = certify(&x, infile, pkey, x509p, dgst, sigopts, attribs, db,
+ serial, subj, chtype, multirdn, email_dn, startdate,
+ enddate, days, batch, extensions, conf, verbose,
+ certopt, nameopt, default_op, ext_copy, selfsign);
+ if (j < 0)
+ goto end;
+ if (j > 0) {
+ total_done++;
+ BIO_printf(bio_err, "\n");
+ if (!BN_add_word(serial, 1))
+ goto end;
+ if (!sk_X509_push(cert_sk, x)) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto end;
+ }
+ }
+ }
+ for (i = 0; i < argc; i++) {
+ total++;
+ j = certify(&x, argv[i], pkey, x509p, dgst, sigopts, attribs, db,
+ serial, subj, chtype, multirdn, email_dn, startdate,
+ enddate, days, batch, extensions, conf, verbose,
+ certopt, nameopt, default_op, ext_copy, selfsign);
+ if (j < 0)
+ goto end;
+ if (j > 0) {
+ total_done++;
+ BIO_printf(bio_err, "\n");
+ if (!BN_add_word(serial, 1))
+ goto end;
+ if (!sk_X509_push(cert_sk, x)) {
+ BIO_printf(bio_err, "Memory allocation failure\n");
+ goto end;
+ }
+ }
+ }
+ /*
+ * we have a stack of newly certified certificates and a data base
+ * and serial number that need updating
+ */
+
+ if (sk_X509_num(cert_sk) > 0) {
+ if (!batch) {
+ BIO_printf(bio_err,
+ "\n%d out of %d certificate requests certified, commit? [y/n]",
+ total_done, total);
+ (void)BIO_flush(bio_err);
+ buf[0][0] = '\0';
+ if (!fgets(buf[0], 10, stdin)) {
+ BIO_printf(bio_err,
+ "CERTIFICATION CANCELED: I/O error\n");
+ ret = 0;
+ goto end;
+ }
+ if ((buf[0][0] != 'y') && (buf[0][0] != 'Y')) {
+ BIO_printf(bio_err, "CERTIFICATION CANCELED\n");
+ ret = 0;
+ goto end;
+ }
+ }
+
+ BIO_printf(bio_err, "Write out database with %d new entries\n",
+ sk_X509_num(cert_sk));
+
+ if (!save_serial(serialfile, "new", serial, NULL))
+ goto end;
+
+ if (!save_index(dbfile, "new", db))
+ goto end;
+ }
+
+ if (verbose)
+ BIO_printf(bio_err, "writing new certificates\n");
+ for (i = 0; i < sk_X509_num(cert_sk); i++) {
+ ASN1_INTEGER *serialNumber = X509_get_serialNumber(x);
+ int k;
+ char *n;
+
+ x = sk_X509_value(cert_sk, i);
+
+ j = ASN1_STRING_length(serialNumber);
+ p = (const char *)ASN1_STRING_data(serialNumber);
+
+ if (strlen(outdir) >= (size_t)(j ? BSIZE - j * 2 - 6 : BSIZE - 8)) {
+ BIO_printf(bio_err, "certificate file name too long\n");
+ goto end;
+ }
+
+ strcpy(buf[2], outdir);