apps/apps.c

   1 /* apps/apps.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #ifndef _POSIX_C_SOURCE
 113 #define _POSIX_C_SOURCE 2       /* On VMS, you need to define this to get
 114                                    the declaration of fileno().  The value
 115                                    2 is to make sure no function defined
 116                                    in POSIX-2 is left undefined. */
 117 #endif
 118 #include <stdio.h>
 119 #include <stdlib.h>
 120 #include <string.h>
 121 #if !defined(OPENSSL_SYSNAME_WIN32) && !defined(NETWARE_CLIB)
 122 #include <strings.h>
 123 #endif
 124 #include <sys/types.h>
 125 #include <ctype.h>
 126 #include <errno.h>
 127 #include <assert.h>
 128 #include <openssl/err.h>
 129 #include <openssl/x509.h>
 130 #include <openssl/x509v3.h>
 131 #include <openssl/pem.h>
 132 #include <openssl/pkcs12.h>
 133 #include <openssl/ui.h>
 134 #include <openssl/safestack.h>
 135 #ifndef OPENSSL_NO_ENGINE
 136 #include <openssl/engine.h>
 137 #endif
 138 #ifndef OPENSSL_NO_RSA
 139 #include <openssl/rsa.h>
 140 #endif
 141 #include <openssl/bn.h>
 142 #ifndef OPENSSL_NO_JPAKE
 143 #include <openssl/jpake.h>
 144 #endif
 145
 146 #define NON_MAIN
 147 #include "apps.h"
 148 #undef NON_MAIN
 149
 150 #ifdef _WIN32
 151 static int WIN32_rename(const char *from, const char *to);
 152 #define rename(from,to) WIN32_rename((from),(to))
 153 #endif
 154
 155 typedef struct {
 156         const char *name;
 157         unsigned long flag;
 158         unsigned long mask;
 159 } NAME_EX_TBL;
 160
 161 static UI_METHOD *ui_method = NULL;
 162
 163 static int set_table_opts(unsigned long *flags, const char *arg, const NAME_EX_TBL *in_tbl);
 164 static int set_multi_opts(unsigned long *flags, const char *arg, const NAME_EX_TBL *in_tbl);
 165
 166 #if !defined(OPENSSL_NO_RC4) && !defined(OPENSSL_NO_RSA)
 167 /* Looks like this stuff is worth moving into separate function */
 168 static EVP_PKEY *
 169 load_netscape_key(BIO *err, BIO *key, const char *file,
 170                 const char *key_descrip, int format);
 171 #endif
 172
 173 int app_init(long mesgwin);
 174 #ifdef undef /* never finished - probably never will be :-) */
 175 int args_from_file(char *file, int *argc, char **argv[])
 176         {
 177         FILE *fp;
 178         int num,i;
 179         unsigned int len;
 180         static char *buf=NULL;
 181         static char **arg=NULL;
 182         char *p;
 183
 184         fp=fopen(file,"r");
 185         if (fp == NULL)
 186                 return(0);
 187
 188         if (fseek(fp,0,SEEK_END)==0)
 189                 len=ftell(fp), rewind(fp);
 190         else    len=-1;
 191         if (len<=0)
 192                 {
 193                 fclose(fp);
 194                 return(0);
 195                 }
 196
 197         *argc=0;
 198         *argv=NULL;
 199
 200         if (buf != NULL) OPENSSL_free(buf);
 201         buf=(char *)OPENSSL_malloc(len+1);
 202         if (buf == NULL) return(0);
 203
 204         len=fread(buf,1,len,fp);
 205         if (len <= 1) return(0);
 206         buf[len]='\0';
 207
 208         i=0;
 209         for (p=buf; *p; p++)
 210                 if (*p == '\n') i++;
 211         if (arg != NULL) OPENSSL_free(arg);
 212         arg=(char **)OPENSSL_malloc(sizeof(char *)*(i*2));
 213
 214         *argv=arg;
 215         num=0;
 216         p=buf;
 217         for (;;)
 218                 {
 219                 if (!*p) break;
 220                 if (*p == '#') /* comment line */
 221                         {
 222                         while (*p && (*p != '\n')) p++;
 223                         continue;
 224                         }
 225                 /* else we have a line */
 226                 *(arg++)=p;
 227                 num++;
 228                 while (*p && ((*p != ' ') && (*p != '\t') && (*p != '\n')))
 229                         p++;
 230                 if (!*p) break;
 231                 if (*p == '\n')
 232                         {
 233                         *(p++)='\0';
 234                         continue;
 235                         }
 236                 /* else it is a tab or space */
 237                 p++;
 238                 while (*p && ((*p == ' ') || (*p == '\t') || (*p == '\n')))
 239                         p++;
 240                 if (!*p) break;
 241                 if (*p == '\n')
 242                         {
 243                         p++;
 244                         continue;
 245                         }
 246                 *(arg++)=p++;
 247                 num++;
 248                 while (*p && (*p != '\n')) p++;
 249                 if (!*p) break;
 250                 /* else *p == '\n' */
 251                 *(p++)='\0';
 252                 }
 253         *argc=num;
 254         return(1);
 255         }
 256 #endif
 257
 258 int str2fmt(char *s)
 259         {
 260         if      ((*s == 'D') || (*s == 'd'))
 261                 return(FORMAT_ASN1);
 262         else if ((*s == 'T') || (*s == 't'))
 263                 return(FORMAT_TEXT);
 264         else if ((*s == 'N') || (*s == 'n'))
 265                 return(FORMAT_NETSCAPE);
 266         else if ((*s == 'S') || (*s == 's'))
 267                 return(FORMAT_SMIME);
 268         else if ((*s == 'M') || (*s == 'm'))
 269                 return(FORMAT_MSBLOB);
 270         else if ((*s == '1')
 271                 || (strcmp(s,"PKCS12") == 0) || (strcmp(s,"pkcs12") == 0)
 272                 || (strcmp(s,"P12") == 0) || (strcmp(s,"p12") == 0))
 273                 return(FORMAT_PKCS12);
 274         else if ((*s == 'E') || (*s == 'e'))
 275                 return(FORMAT_ENGINE);
 276         else if ((*s == 'P') || (*s == 'p'))
 277                 {
 278                 if (s[1] == 'V' || s[1] == 'v')
 279                         return FORMAT_PVK;
 280                 else
 281                         return(FORMAT_PEM);
 282                 }
 283         else
 284                 return(FORMAT_UNDEF);
 285         }
 286
 287 #if defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WIN16) || defined(OPENSSL_SYS_NETWARE)
 288 void program_name(char *in, char *out, int size)
 289         {
 290         int i,n;
 291         char *p=NULL;
 292
 293         n=strlen(in);
 294         /* find the last '/', '\' or ':' */
 295         for (i=n-1; i>0; i--)
 296                 {
 297                 if ((in[i] == '/') || (in[i] == '\\') || (in[i] == ':'))
 298                         {
 299                         p= &(in[i+1]);
 300                         break;
 301                         }
 302                 }
 303         if (p == NULL)
 304                 p=in;
 305         n=strlen(p);
 306
 307 #if defined(OPENSSL_SYS_NETWARE)
 308    /* strip off trailing .nlm if present. */
 309    if ((n > 4) && (p[n-4] == '.') &&
 310       ((p[n-3] == 'n') || (p[n-3] == 'N')) &&
 311       ((p[n-2] == 'l') || (p[n-2] == 'L')) &&
 312       ((p[n-1] == 'm') || (p[n-1] == 'M')))
 313       n-=4;
 314 #else
 315         /* strip off trailing .exe if present. */
 316         if ((n > 4) && (p[n-4] == '.') &&
 317                 ((p[n-3] == 'e') || (p[n-3] == 'E')) &&
 318                 ((p[n-2] == 'x') || (p[n-2] == 'X')) &&
 319                 ((p[n-1] == 'e') || (p[n-1] == 'E')))
 320                 n-=4;
 321 #endif
 322
 323         if (n > size-1)
 324                 n=size-1;
 325
 326         for (i=0; i<n; i++)
 327                 {
 328                 if ((p[i] >= 'A') && (p[i] <= 'Z'))
 329                         out[i]=p[i]-'A'+'a';
 330                 else
 331                         out[i]=p[i];
 332                 }
 333         out[n]='\0';
 334         }
 335 #else
 336 #ifdef OPENSSL_SYS_VMS
 337 void program_name(char *in, char *out, int size)
 338         {
 339         char *p=in, *q;
 340         char *chars=":]>";
 341
 342         while(*chars != '\0')
 343                 {
 344                 q=strrchr(p,*chars);
 345                 if (q > p)
 346                         p = q + 1;
 347                 chars++;
 348                 }
 349
 350         q=strrchr(p,'.');
 351         if (q == NULL)
 352                 q = p + strlen(p);
 353         strncpy(out,p,size-1);
 354         if (q-p >= size)
 355                 {
 356                 out[size-1]='\0';
 357                 }
 358         else
 359                 {
 360                 out[q-p]='\0';
 361                 }
 362         }
 363 #else
 364 void program_name(char *in, char *out, int size)
 365         {
 366         char *p;
 367
 368         p=strrchr(in,'/');
 369         if (p != NULL)
 370                 p++;
 371         else
 372                 p=in;
 373         BUF_strlcpy(out,p,size);
 374         }
 375 #endif
 376 #endif
 377
 378 int chopup_args(ARGS *arg, char *buf, int *argc, char **argv[])
 379         {
 380         int num,len,i;
 381         char *p;
 382
 383         *argc=0;
 384         *argv=NULL;
 385
 386         len=strlen(buf);
 387         i=0;
 388         if (arg->count == 0)
 389                 {
 390                 arg->count=20;
 391                 arg->data=(char **)OPENSSL_malloc(sizeof(char *)*arg->count);
 392                 }
 393         for (i=0; i<arg->count; i++)
 394                 arg->data[i]=NULL;
 395
 396         num=0;
 397         p=buf;
 398         for (;;)
 399                 {
 400                 /* first scan over white space */
 401                 if (!*p) break;
 402                 while (*p && ((*p == ' ') || (*p == '\t') || (*p == '\n')))
 403                         p++;
 404                 if (!*p) break;
 405
 406                 /* The start of something good :-) */
 407                 if (num >= arg->count)
 408                         {
 409                         char **tmp_p;
 410                         int tlen = arg->count + 20;
 411                         tmp_p = (char **)OPENSSL_realloc(arg->data,
 412                                 sizeof(char *)*tlen);
 413                         if (tmp_p == NULL)
 414                                 return 0;
 415                         arg->data  = tmp_p;
 416                         arg->count = tlen;
 417                         /* initialize newly allocated data */
 418                         for (i = num; i < arg->count; i++)
 419                                 arg->data[i] = NULL;
 420                         }
 421                 arg->data[num++]=p;
 422
 423                 /* now look for the end of this */
 424                 if ((*p == '\'') || (*p == '\"')) /* scan for closing quote */
 425                         {
 426                         i= *(p++);
 427                         arg->data[num-1]++; /* jump over quote */
 428                         while (*p && (*p != i))
 429                                 p++;
 430                         *p='\0';
 431                         }
 432                 else
 433                         {
 434                         while (*p && ((*p != ' ') &&
 435                                 (*p != '\t') && (*p != '\n')))
 436                                 p++;
 437
 438                         if (*p == '\0')
 439                                 p--;
 440                         else
 441                                 *p='\0';
 442                         }
 443                 p++;
 444                 }
 445         *argc=num;
 446         *argv=arg->data;
 447         return(1);
 448         }
 449
 450 #ifndef APP_INIT
 451 int app_init(long mesgwin)
 452         {
 453         return(1);
 454         }
 455 #endif
 456
 457
 458 int dump_cert_text (BIO *out, X509 *x)
 459 {
 460         char *p;
 461
 462         p=X509_NAME_oneline(X509_get_subject_name(x),NULL,0);
 463         BIO_puts(out,"subject=");
 464         BIO_puts(out,p);
 465         OPENSSL_free(p);
 466
 467         p=X509_NAME_oneline(X509_get_issuer_name(x),NULL,0);
 468         BIO_puts(out,"\nissuer=");
 469         BIO_puts(out,p);
 470         BIO_puts(out,"\n");
 471         OPENSSL_free(p);
 472
 473         return 0;
 474 }
 475
 476 static int ui_open(UI *ui)
 477         {
 478         return UI_method_get_opener(UI_OpenSSL())(ui);
 479         }
 480 static int ui_read(UI *ui, UI_STRING *uis)
 481         {
 482         if (UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD
 483                 && UI_get0_user_data(ui))
 484                 {
 485                 switch(UI_get_string_type(uis))
 486                         {
 487                 case UIT_PROMPT:
 488                 case UIT_VERIFY:
 489                         {
 490                         const char *password =
 491                                 ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
 492                         if (password && password[0] != '\0')
 493                                 {
 494                                 UI_set_result(ui, uis, password);
 495                                 return 1;
 496                                 }
 497                         }
 498                 default:
 499                         break;
 500                         }
 501                 }
 502         return UI_method_get_reader(UI_OpenSSL())(ui, uis);
 503         }
 504 static int ui_write(UI *ui, UI_STRING *uis)
 505         {
 506         if (UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD
 507                 && UI_get0_user_data(ui))
 508                 {
 509                 switch(UI_get_string_type(uis))
 510                         {
 511                 case UIT_PROMPT:
 512                 case UIT_VERIFY:
 513                         {
 514                         const char *password =
 515                                 ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
 516                         if (password && password[0] != '\0')
 517                                 return 1;
 518                         }
 519                 default:
 520                         break;
 521                         }
 522                 }
 523         return UI_method_get_writer(UI_OpenSSL())(ui, uis);
 524         }
 525 static int ui_close(UI *ui)
 526         {
 527         return UI_method_get_closer(UI_OpenSSL())(ui);
 528         }
 529 int setup_ui_method(void)
 530         {
 531         ui_method = UI_create_method("OpenSSL application user interface");
 532         UI_method_set_opener(ui_method, ui_open);
 533         UI_method_set_reader(ui_method, ui_read);
 534         UI_method_set_writer(ui_method, ui_write);
 535         UI_method_set_closer(ui_method, ui_close);
 536         return 0;
 537         }
 538 void destroy_ui_method(void)
 539         {
 540         if(ui_method)
 541                 {
 542                 UI_destroy_method(ui_method);
 543                 ui_method = NULL;
 544                 }
 545         }
 546 int password_callback(char *buf, int bufsiz, int verify,
 547         PW_CB_DATA *cb_tmp)
 548         {
 549         UI *ui = NULL;
 550         int res = 0;
 551         const char *prompt_info = NULL;
 552         const char *password = NULL;
 553         PW_CB_DATA *cb_data = (PW_CB_DATA *)cb_tmp;
 554
 555         if (cb_data)
 556                 {
 557                 if (cb_data->password)
 558                         password = cb_data->password;
 559                 if (cb_data->prompt_info)
 560                         prompt_info = cb_data->prompt_info;
 561                 }
 562
 563         if (password)
 564                 {
 565                 res = strlen(password);
 566                 if (res > bufsiz)
 567                         res = bufsiz;
 568                 memcpy(buf, password, res);
 569                 return res;
 570                 }
 571
 572         ui = UI_new_method(ui_method);
 573         if (ui)
 574                 {
 575                 int ok = 0;
 576                 char *buff = NULL;
 577                 int ui_flags = 0;
 578                 char *prompt = NULL;
 579
 580                 prompt = UI_construct_prompt(ui, "pass phrase",
 581                         prompt_info);
 582
 583                 ui_flags |= UI_INPUT_FLAG_DEFAULT_PWD;
 584                 UI_ctrl(ui, UI_CTRL_PRINT_ERRORS, 1, 0, 0);
 585
 586                 if (ok >= 0)
 587                         ok = UI_add_input_string(ui,prompt,ui_flags,buf,
 588                                 PW_MIN_LENGTH,BUFSIZ-1);
 589                 if (ok >= 0 && verify)
 590                         {
 591                         buff = (char *)OPENSSL_malloc(bufsiz);
 592                         ok = UI_add_verify_string(ui,prompt,ui_flags,buff,
 593                                 PW_MIN_LENGTH,BUFSIZ-1, buf);
 594                         }
 595                 if (ok >= 0)
 596                         do
 597                                 {
 598                                 ok = UI_process(ui);
 599                                 }
 600                         while (ok < 0 && UI_ctrl(ui, UI_CTRL_IS_REDOABLE, 0, 0, 0));
 601
 602                 if (buff)
 603                         {
 604                         OPENSSL_cleanse(buff,(unsigned int)bufsiz);
 605                         OPENSSL_free(buff);
 606                         }
 607
 608                 if (ok >= 0)
 609                         res = strlen(buf);
 610                 if (ok == -1)
 611                         {
 612                         BIO_printf(bio_err, "User interface error\n");
 613                         ERR_print_errors(bio_err);
 614                         OPENSSL_cleanse(buf,(unsigned int)bufsiz);
 615                         res = 0;
 616                         }
 617                 if (ok == -2)
 618                         {
 619                         BIO_printf(bio_err,"aborted!\n");
 620                         OPENSSL_cleanse(buf,(unsigned int)bufsiz);
 621                         res = 0;
 622                         }
 623                 UI_free(ui);
 624                 OPENSSL_free(prompt);
 625                 }
 626         return res;
 627         }
 628
 629 static char *app_get_pass(BIO *err, char *arg, int keepbio);
 630
 631 int app_passwd(BIO *err, char *arg1, char *arg2, char **pass1, char **pass2)
 632 {
 633         int same;
 634         if(!arg2 || !arg1 || strcmp(arg1, arg2)) same = 0;
 635         else same = 1;
 636         if(arg1) {
 637                 *pass1 = app_get_pass(err, arg1, same);
 638                 if(!*pass1) return 0;
 639         } else if(pass1) *pass1 = NULL;
 640         if(arg2) {
 641                 *pass2 = app_get_pass(err, arg2, same ? 2 : 0);
 642                 if(!*pass2) return 0;
 643         } else if(pass2) *pass2 = NULL;
 644         return 1;
 645 }
 646
 647 static char *app_get_pass(BIO *err, char *arg, int keepbio)
 648 {
 649         char *tmp, tpass[APP_PASS_LEN];
 650         static BIO *pwdbio = NULL;
 651         int i;
 652         if(!strncmp(arg, "pass:", 5)) return BUF_strdup(arg + 5);
 653         if(!strncmp(arg, "env:", 4)) {
 654                 tmp = getenv(arg + 4);
 655                 if(!tmp) {
 656                         BIO_printf(err, "Can't read environment variable %s\n", arg + 4);
 657                         return NULL;
 658                 }
 659                 return BUF_strdup(tmp);
 660         }
 661         if(!keepbio || !pwdbio) {
 662                 if(!strncmp(arg, "file:", 5)) {
 663                         pwdbio = BIO_new_file(arg + 5, "r");
 664                         if(!pwdbio) {
 665                                 BIO_printf(err, "Can't open file %s\n", arg + 5);
 666                                 return NULL;
 667                         }
 668 #if !defined(_WIN32)
 669                 /*
 670                  * Under _WIN32, which covers even Win64 and CE, file
 671                  * descriptors referenced by BIO_s_fd are not inherited
 672                  * by child process and therefore below is not an option.
 673                  * It could have been an option if bss_fd.c was operating
 674                  * on real Windows descriptors, such as those obtained
 675                  * with CreateFile.
 676                  */
 677                 } else if(!strncmp(arg, "fd:", 3)) {
 678                         BIO *btmp;
 679                         i = atoi(arg + 3);
 680                         if(i >= 0) pwdbio = BIO_new_fd(i, BIO_NOCLOSE);
 681                         if((i < 0) || !pwdbio) {
 682                                 BIO_printf(err, "Can't access file descriptor %s\n", arg + 3);
 683                                 return NULL;
 684                         }
 685                         /* Can't do BIO_gets on an fd BIO so add a buffering BIO */
 686                         btmp = BIO_new(BIO_f_buffer());
 687                         pwdbio = BIO_push(btmp, pwdbio);
 688 #endif
 689                 } else if(!strcmp(arg, "stdin")) {
 690                         pwdbio = BIO_new_fp(stdin, BIO_NOCLOSE);
 691                         if(!pwdbio) {
 692                                 BIO_printf(err, "Can't open BIO for stdin\n");
 693                                 return NULL;
 694                         }
 695                 } else {
 696                         BIO_printf(err, "Invalid password argument \"%s\"\n", arg);
 697                         return NULL;
 698                 }
 699         }
 700         i = BIO_gets(pwdbio, tpass, APP_PASS_LEN);
 701         if(keepbio != 1) {
 702                 BIO_free_all(pwdbio);
 703                 pwdbio = NULL;
 704         }
 705         if(i <= 0) {
 706                 BIO_printf(err, "Error reading password from BIO\n");
 707                 return NULL;
 708         }
 709         tmp = strchr(tpass, '\n');
 710         if(tmp) *tmp = 0;
 711         return BUF_strdup(tpass);
 712 }
 713
 714 int add_oid_section(BIO *err, CONF *conf)
 715 {
 716         char *p;
 717         STACK_OF(CONF_VALUE) *sktmp;
 718         CONF_VALUE *cnf;
 719         int i;
 720         if(!(p=NCONF_get_string(conf,NULL,"oid_section")))
 721                 {
 722                 ERR_clear_error();
 723                 return 1;
 724                 }
 725         if(!(sktmp = NCONF_get_section(conf, p))) {
 726                 BIO_printf(err, "problem loading oid section %s\n", p);
 727                 return 0;
 728         }
 729         for(i = 0; i < sk_CONF_VALUE_num(sktmp); i++) {
 730                 cnf = sk_CONF_VALUE_value(sktmp, i);
 731                 if(OBJ_create(cnf->value, cnf->name, cnf->name) == NID_undef) {
 732                         BIO_printf(err, "problem creating object %s=%s\n",
 733                                                          cnf->name, cnf->value);
 734                         return 0;
 735                 }
 736         }
 737         return 1;
 738 }
 739
 740 static int load_pkcs12(BIO *err, BIO *in, const char *desc,
 741                 pem_password_cb *pem_cb,  void *cb_data,
 742                 EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
 743         {
 744         const char *pass;
 745         char tpass[PEM_BUFSIZE];
 746         int len, ret = 0;
 747         PKCS12 *p12;
 748         p12 = d2i_PKCS12_bio(in, NULL);
 749         if (p12 == NULL)
 750                 {
 751                 BIO_printf(err, "Error loading PKCS12 file for %s\n", desc);
 752                 goto die;
 753                 }
 754         /* See if an empty password will do */
 755         if (PKCS12_verify_mac(p12, "", 0) || PKCS12_verify_mac(p12, NULL, 0))
 756                 pass = "";
 757         else
 758                 {
 759                 if (!pem_cb)
 760                         pem_cb = (pem_password_cb *)password_callback;
 761                 len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data);
 762                 if (len < 0)
 763                         {
 764                         BIO_printf(err, "Passpharse callback error for %s\n",
 765                                         desc);
 766                         goto die;
 767                         }
 768                 if (len < PEM_BUFSIZE)
 769                         tpass[len] = 0;
 770                 if (!PKCS12_verify_mac(p12, tpass, len))
 771                         {
 772                         BIO_printf(err,
 773         "Mac verify error (wrong password?) in PKCS12 file for %s\n", desc);
 774                         goto die;
 775                         }
 776                 pass = tpass;
 777                 }
 778         ret = PKCS12_parse(p12, pass, pkey, cert, ca);
 779         die:
 780         if (p12)
 781                 PKCS12_free(p12);
 782         return ret;
 783         }
 784
 785 X509 *load_cert(BIO *err, const char *file, int format,
 786         const char *pass, ENGINE *e, const char *cert_descrip)
 787         {
 788         X509 *x=NULL;
 789         BIO *cert;
 790
 791         if ((cert=BIO_new(BIO_s_file())) == NULL)
 792                 {
 793                 ERR_print_errors(err);
 794                 goto end;
 795                 }
 796
 797         if (file == NULL)
 798                 {
 799 #ifdef _IONBF
 800                 setvbuf(stdin, NULL, _IONBF, 0);
 801 #endif
 802                 BIO_set_fp(cert,stdin,BIO_NOCLOSE);
 803                 }
 804         else
 805                 {
 806                 if (BIO_read_filename(cert,file) <= 0)
 807                         {
 808                         BIO_printf(err, "Error opening %s %s\n",
 809                                 cert_descrip, file);
 810                         ERR_print_errors(err);
 811                         goto end;
 812                         }
 813                 }
 814
 815         if      (format == FORMAT_ASN1)
 816                 x=d2i_X509_bio(cert,NULL);
 817         else if (format == FORMAT_NETSCAPE)
 818                 {
 819                 NETSCAPE_X509 *nx;
 820                 nx=ASN1_item_d2i_bio(ASN1_ITEM_rptr(NETSCAPE_X509),cert,NULL);
 821                 if (nx == NULL)
 822                                 goto end;
 823
 824                 if ((strncmp(NETSCAPE_CERT_HDR,(char *)nx->header->data,
 825                         nx->header->length) != 0))
 826                         {
 827                         NETSCAPE_X509_free(nx);
 828                         BIO_printf(err,"Error reading header on certificate\n");
 829                         goto end;
 830                         }
 831                 x=nx->cert;
 832                 nx->cert = NULL;
 833                 NETSCAPE_X509_free(nx);
 834                 }
 835         else if (format == FORMAT_PEM)
 836                 x=PEM_read_bio_X509_AUX(cert,NULL,
 837                         (pem_password_cb *)password_callback, NULL);
 838         else if (format == FORMAT_PKCS12)
 839                 {
 840                 if (!load_pkcs12(err, cert,cert_descrip, NULL, NULL,
 841                                         NULL, &x, NULL))
 842                         goto end;
 843                 }
 844         else    {
 845                 BIO_printf(err,"bad input format specified for %s\n",
 846                         cert_descrip);
 847                 goto end;
 848                 }
 849 end:
 850         if (x == NULL)
 851                 {
 852                 BIO_printf(err,"unable to load certificate\n");
 853                 ERR_print_errors(err);
 854                 }
 855         if (cert != NULL) BIO_free(cert);
 856         return(x);
 857         }
 858
 859 EVP_PKEY *load_key(BIO *err, const char *file, int format, int maybe_stdin,
 860         const char *pass, ENGINE *e, const char *key_descrip)
 861         {
 862         BIO *key=NULL;
 863         EVP_PKEY *pkey=NULL;
 864         PW_CB_DATA cb_data;
 865
 866         cb_data.password = pass;
 867         cb_data.prompt_info = file;
 868
 869         if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE))
 870                 {
 871                 BIO_printf(err,"no keyfile specified\n");
 872                 goto end;
 873                 }
 874 #ifndef OPENSSL_NO_ENGINE
 875         if (format == FORMAT_ENGINE)
 876                 {
 877                 if (!e)
 878                         BIO_printf(bio_err,"no engine specified\n");
 879                 else
 880                         pkey = ENGINE_load_private_key(e, file,
 881                                 ui_method, &cb_data);
 882                 goto end;
 883                 }
 884 #endif
 885         key=BIO_new(BIO_s_file());
 886         if (key == NULL)
 887                 {
 888                 ERR_print_errors(err);
 889                 goto end;
 890                 }
 891         if (file == NULL && maybe_stdin)
 892                 {
 893 #ifdef _IONBF
 894                 setvbuf(stdin, NULL, _IONBF, 0);
 895 #endif
 896                 BIO_set_fp(key,stdin,BIO_NOCLOSE);
 897                 }
 898         else
 899                 if (BIO_read_filename(key,file) <= 0)
 900                         {
 901                         BIO_printf(err, "Error opening %s %s\n",
 902                                 key_descrip, file);
 903                         ERR_print_errors(err);
 904                         goto end;
 905                         }
 906         if (format == FORMAT_ASN1)
 907                 {
 908                 pkey=d2i_PrivateKey_bio(key, NULL);
 909                 }
 910         else if (format == FORMAT_PEM)
 911                 {
 912                 pkey=PEM_read_bio_PrivateKey(key,NULL,
 913                         (pem_password_cb *)password_callback, &cb_data);
 914                 }
 915 #if !defined(OPENSSL_NO_RC4) && !defined(OPENSSL_NO_RSA)
 916         else if (format == FORMAT_NETSCAPE || format == FORMAT_IISSGC)
 917                 pkey = load_netscape_key(err, key, file, key_descrip, format);
 918 #endif
 919         else if (format == FORMAT_PKCS12)
 920                 {
 921                 if (!load_pkcs12(err, key, key_descrip,
 922                                 (pem_password_cb *)password_callback, &cb_data,
 923                                 &pkey, NULL, NULL))
 924                         goto end;
 925                 }
 926 #if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DSA) && !defined (OPENSSL_NO_RC4)
 927         else if (format == FORMAT_MSBLOB)
 928                 pkey = b2i_PrivateKey_bio(key);
 929         else if (format == FORMAT_PVK)
 930                 pkey = b2i_PVK_bio(key, (pem_password_cb *)password_callback,
 931                                                                 &cb_data);
 932 #endif
 933         else
 934                 {
 935                 BIO_printf(err,"bad input format specified for key file\n");
 936                 goto end;
 937                 }
 938  end:
 939         if (key != NULL) BIO_free(key);
 940         if (pkey == NULL)
 941                 BIO_printf(err,"unable to load %s\n", key_descrip);
 942         return(pkey);
 943         }
 944
 945 EVP_PKEY *load_pubkey(BIO *err, const char *file, int format, int maybe_stdin,
 946         const char *pass, ENGINE *e, const char *key_descrip)
 947         {
 948         BIO *key=NULL;
 949         EVP_PKEY *pkey=NULL;
 950         PW_CB_DATA cb_data;
 951
 952         cb_data.password = pass;
 953         cb_data.prompt_info = file;
 954
 955         if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE))
 956                 {
 957                 BIO_printf(err,"no keyfile specified\n");
 958                 goto end;
 959                 }
 960 #ifndef OPENSSL_NO_ENGINE
 961         if (format == FORMAT_ENGINE)
 962                 {
 963                 if (!e)
 964                         BIO_printf(bio_err,"no engine specified\n");
 965                 else
 966                         pkey = ENGINE_load_public_key(e, file,
 967                                 ui_method, &cb_data);
 968                 goto end;
 969                 }
 970 #endif
 971         key=BIO_new(BIO_s_file());
 972         if (key == NULL)
 973                 {
 974                 ERR_print_errors(err);
 975                 goto end;
 976                 }
 977         if (file == NULL && maybe_stdin)
 978                 {
 979 #ifdef _IONBF
 980                 setvbuf(stdin, NULL, _IONBF, 0);
 981 #endif
 982                 BIO_set_fp(key,stdin,BIO_NOCLOSE);
 983                 }
 984         else
 985                 if (BIO_read_filename(key,file) <= 0)
 986                         {
 987                         BIO_printf(err, "Error opening %s %s\n",
 988                                 key_descrip, file);
 989                         ERR_print_errors(err);
 990                         goto end;
 991                 }
 992         if (format == FORMAT_ASN1)
 993                 {
 994                 pkey=d2i_PUBKEY_bio(key, NULL);
 995                 }
 996 #ifndef OPENSSL_NO_RSA
 997         else if (format == FORMAT_ASN1RSA)
 998                 {
 999                 RSA *rsa;
1000                 rsa = d2i_RSAPublicKey_bio(key, NULL);
1001                 if (rsa)
1002                         {
1003                         pkey = EVP_PKEY_new();
1004                         if (pkey)
1005                                 EVP_PKEY_set1_RSA(pkey, rsa);
1006                         RSA_free(rsa);
1007                         }
1008                 else
1009                         pkey = NULL;
1010                 }
1011         else if (format == FORMAT_PEMRSA)
1012                 {
1013                 RSA *rsa;
1014                 rsa = PEM_read_bio_RSAPublicKey(key, NULL,
1015                         (pem_password_cb *)password_callback, &cb_data);
1016                 if (rsa)
1017                         {
1018                         pkey = EVP_PKEY_new();
1019                         if (pkey)
1020                                 EVP_PKEY_set1_RSA(pkey, rsa);
1021                         RSA_free(rsa);
1022                         }
1023                 else
1024                         pkey = NULL;
1025                 }
1026 #endif
1027         else if (format == FORMAT_PEM)
1028                 {
1029                 pkey=PEM_read_bio_PUBKEY(key,NULL,
1030                         (pem_password_cb *)password_callback, &cb_data);
1031                 }
1032 #if !defined(OPENSSL_NO_RC4) && !defined(OPENSSL_NO_RSA)
1033         else if (format == FORMAT_NETSCAPE || format == FORMAT_IISSGC)
1034                 pkey = load_netscape_key(err, key, file, key_descrip, format);
1035 #endif
1036 #if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DSA)
1037         else if (format == FORMAT_MSBLOB)
1038                 pkey = b2i_PublicKey_bio(key);
1039 #endif
1040         else
1041                 {
1042                 BIO_printf(err,"bad input format specified for key file\n");
1043                 goto end;
1044                 }
1045  end:
1046         if (key != NULL) BIO_free(key);
1047         if (pkey == NULL)
1048                 BIO_printf(err,"unable to load %s\n", key_descrip);
1049         return(pkey);
1050         }
1051
1052 #if !defined(OPENSSL_NO_RC4) && !defined(OPENSSL_NO_RSA)
1053 static EVP_PKEY *
1054 load_netscape_key(BIO *err, BIO *key, const char *file,
1055                 const char *key_descrip, int format)
1056         {
1057         EVP_PKEY *pkey;
1058         BUF_MEM *buf;
1059         RSA     *rsa;
1060         const unsigned char *p;
1061         int size, i;
1062
1063         buf=BUF_MEM_new();
1064         pkey = EVP_PKEY_new();
1065         size = 0;
1066         if (buf == NULL || pkey == NULL)
1067                 goto error;
1068         for (;;)
1069                 {
1070                 if (!BUF_MEM_grow_clean(buf,size+1024*10))
1071                         goto error;
1072                 i = BIO_read(key, &(buf->data[size]), 1024*10);
1073                 size += i;
1074                 if (i == 0)
1075                         break;
1076                 if (i < 0)
1077                         {
1078                                 BIO_printf(err, "Error reading %s %s",
1079                                         key_descrip, file);
1080                                 goto error;
1081                         }
1082                 }
1083         p=(unsigned char *)buf->data;
1084         rsa = d2i_RSA_NET(NULL,&p,(long)size,NULL,
1085                 (format == FORMAT_IISSGC ? 1 : 0));
1086         if (rsa == NULL)
1087                 goto error;
1088         BUF_MEM_free(buf);
1089         EVP_PKEY_set1_RSA(pkey, rsa);
1090         return pkey;
1091 error:
1092         BUF_MEM_free(buf);
1093         EVP_PKEY_free(pkey);
1094         return NULL;
1095         }
1096 #endif /* ndef OPENSSL_NO_RC4 */
1097
1098 static int load_certs_crls(BIO *err, const char *file, int format,
1099         const char *pass, ENGINE *e, const char *desc,
1100         STACK_OF(X509) **pcerts, STACK_OF(X509_CRL) **pcrls)
1101         {
1102         int i;
1103         BIO *bio;
1104         STACK_OF(X509_INFO) *xis = NULL;
1105         X509_INFO *xi;
1106         PW_CB_DATA cb_data;
1107         int rv = 0;
1108
1109         cb_data.password = pass;
1110         cb_data.prompt_info = file;
1111
1112         if (format != FORMAT_PEM)
1113                 {
1114                 BIO_printf(err,"bad input format specified for %s\n", desc);
1115                 return 0;
1116                 }
1117
1118         if (file == NULL)
1119                 bio = BIO_new_fp(stdin,BIO_NOCLOSE);
1120         else
1121                 bio = BIO_new_file(file, "r");
1122
1123         if (bio == NULL)
1124                 {
1125                 BIO_printf(err, "Error opening %s %s\n",
1126                                 desc, file ? file : "stdin");
1127                 ERR_print_errors(err);
1128                 return 0;
1129                 }
1130
1131         xis = PEM_X509_INFO_read_bio(bio, NULL,
1132                                 (pem_password_cb *)password_callback, &cb_data);
1133
1134         BIO_free(bio);
1135
1136         if (pcerts)
1137                 {
1138                 *pcerts = sk_X509_new_null();
1139                 if (!*pcerts)
1140                         goto end;
1141                 }
1142
1143         if (pcrls)
1144                 {
1145                 *pcrls = sk_X509_CRL_new_null();
1146                 if (!*pcrls)
1147                         goto end;
1148                 }
1149
1150         for(i = 0; i < sk_X509_INFO_num(xis); i++)
1151                 {
1152                 xi = sk_X509_INFO_value (xis, i);
1153                 if (xi->x509 && pcerts)
1154                         {
1155                         if (!sk_X509_push(*pcerts, xi->x509))
1156                                 goto end;
1157                         xi->x509 = NULL;
1158                         }
1159                 if (xi->crl && pcrls)
1160                         {
1161                         if (!sk_X509_CRL_push(*pcrls, xi->crl))
1162                                 goto end;
1163                         xi->crl = NULL;
1164                         }
1165                 }
1166
1167         if (pcerts && sk_X509_num(*pcerts) > 0)
1168                 rv = 1;
1169
1170         if (pcrls && sk_X509_CRL_num(*pcrls) > 0)
1171                 rv = 1;
1172
1173         end:
1174
1175         if (xis)
1176                 sk_X509_INFO_pop_free(xis, X509_INFO_free);
1177
1178         if (rv == 0)
1179                 {
1180                 if (pcerts)
1181                         {
1182                         sk_X509_pop_free(*pcerts, X509_free);
1183                         *pcerts = NULL;
1184                         }
1185                 if (pcrls)
1186                         {
1187                         sk_X509_CRL_pop_free(*pcrls, X509_CRL_free);
1188                         *pcrls = NULL;
1189                         }
1190                 BIO_printf(err,"unable to load %s\n",
1191                                 pcerts ? "certificates" : "CRLs");
1192                 ERR_print_errors(err);
1193                 }
1194         return rv;
1195         }
1196
1197 STACK_OF(X509) *load_certs(BIO *err, const char *file, int format,
1198         const char *pass, ENGINE *e, const char *desc)
1199         {
1200         STACK_OF(X509) *certs;
1201         load_certs_crls(err, file, format, pass, e, desc, &certs, NULL);
1202         return certs;
1203         }
1204
1205 STACK_OF(X509_CRL) *load_crls(BIO *err, const char *file, int format,
1206         const char *pass, ENGINE *e, const char *desc)
1207         {
1208         STACK_OF(X509_CRL) *crls;
1209         load_certs_crls(err, file, format, pass, e, desc, NULL, &crls);
1210         return crls;
1211         }
1212
1213 #define X509V3_EXT_UNKNOWN_MASK         (0xfL << 16)
1214 /* Return error for unknown extensions */
1215 #define X509V3_EXT_DEFAULT              0
1216 /* Print error for unknown extensions */
1217 #define X509V3_EXT_ERROR_UNKNOWN        (1L << 16)
1218 /* ASN1 parse unknown extensions */
1219 #define X509V3_EXT_PARSE_UNKNOWN        (2L << 16)
1220 /* BIO_dump unknown extensions */
1221 #define X509V3_EXT_DUMP_UNKNOWN         (3L << 16)
1222
1223 #define X509_FLAG_CA (X509_FLAG_NO_ISSUER | X509_FLAG_NO_PUBKEY | \
1224                          X509_FLAG_NO_HEADER | X509_FLAG_NO_VERSION)
1225
1226 int set_cert_ex(unsigned long *flags, const char *arg)
1227 {
1228         static const NAME_EX_TBL cert_tbl[] = {
1229                 { "compatible", X509_FLAG_COMPAT, 0xffffffffl},
1230                 { "ca_default", X509_FLAG_CA, 0xffffffffl},
1231                 { "no_header", X509_FLAG_NO_HEADER, 0},
1232                 { "no_version", X509_FLAG_NO_VERSION, 0},
1233                 { "no_serial", X509_FLAG_NO_SERIAL, 0},
1234                 { "no_signame", X509_FLAG_NO_SIGNAME, 0},
1235                 { "no_validity", X509_FLAG_NO_VALIDITY, 0},
1236                 { "no_subject", X509_FLAG_NO_SUBJECT, 0},
1237                 { "no_issuer", X509_FLAG_NO_ISSUER, 0},
1238                 { "no_pubkey", X509_FLAG_NO_PUBKEY, 0},
1239                 { "no_extensions", X509_FLAG_NO_EXTENSIONS, 0},
1240                 { "no_sigdump", X509_FLAG_NO_SIGDUMP, 0},
1241                 { "no_aux", X509_FLAG_NO_AUX, 0},
1242                 { "no_attributes", X509_FLAG_NO_ATTRIBUTES, 0},
1243                 { "ext_default", X509V3_EXT_DEFAULT, X509V3_EXT_UNKNOWN_MASK},
1244                 { "ext_error", X509V3_EXT_ERROR_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
1245                 { "ext_parse", X509V3_EXT_PARSE_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
1246                 { "ext_dump", X509V3_EXT_DUMP_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
1247                 { NULL, 0, 0}
1248         };
1249         return set_multi_opts(flags, arg, cert_tbl);
1250 }
1251
1252 int set_name_ex(unsigned long *flags, const char *arg)
1253 {
1254         static const NAME_EX_TBL ex_tbl[] = {
1255                 { "esc_2253", ASN1_STRFLGS_ESC_2253, 0},
1256                 { "esc_ctrl", ASN1_STRFLGS_ESC_CTRL, 0},
1257                 { "esc_msb", ASN1_STRFLGS_ESC_MSB, 0},
1258                 { "use_quote", ASN1_STRFLGS_ESC_QUOTE, 0},
1259                 { "utf8", ASN1_STRFLGS_UTF8_CONVERT, 0},
1260                 { "ignore_type", ASN1_STRFLGS_IGNORE_TYPE, 0},
1261                 { "show_type", ASN1_STRFLGS_SHOW_TYPE, 0},
1262                 { "dump_all", ASN1_STRFLGS_DUMP_ALL, 0},
1263                 { "dump_nostr", ASN1_STRFLGS_DUMP_UNKNOWN, 0},
1264                 { "dump_der", ASN1_STRFLGS_DUMP_DER, 0},
1265                 { "compat", XN_FLAG_COMPAT, 0xffffffffL},
1266                 { "sep_comma_plus", XN_FLAG_SEP_COMMA_PLUS, XN_FLAG_SEP_MASK},
1267                 { "sep_comma_plus_space", XN_FLAG_SEP_CPLUS_SPC, XN_FLAG_SEP_MASK},
1268                 { "sep_semi_plus_space", XN_FLAG_SEP_SPLUS_SPC, XN_FLAG_SEP_MASK},
1269                 { "sep_multiline", XN_FLAG_SEP_MULTILINE, XN_FLAG_SEP_MASK},
1270                 { "dn_rev", XN_FLAG_DN_REV, 0},
1271                 { "nofname", XN_FLAG_FN_NONE, XN_FLAG_FN_MASK},
1272                 { "sname", XN_FLAG_FN_SN, XN_FLAG_FN_MASK},
1273                 { "lname", XN_FLAG_FN_LN, XN_FLAG_FN_MASK},
1274                 { "align", XN_FLAG_FN_ALIGN, 0},
1275                 { "oid", XN_FLAG_FN_OID, XN_FLAG_FN_MASK},
1276                 { "space_eq", XN_FLAG_SPC_EQ, 0},
1277                 { "dump_unknown", XN_FLAG_DUMP_UNKNOWN_FIELDS, 0},
1278                 { "RFC2253", XN_FLAG_RFC2253, 0xffffffffL},
1279                 { "oneline", XN_FLAG_ONELINE, 0xffffffffL},
1280                 { "multiline", XN_FLAG_MULTILINE, 0xffffffffL},
1281                 { "ca_default", XN_FLAG_MULTILINE, 0xffffffffL},
1282                 { NULL, 0, 0}
1283         };
1284         return set_multi_opts(flags, arg, ex_tbl);
1285 }
1286
1287 int set_ext_copy(int *copy_type, const char *arg)
1288 {
1289         if (!strcasecmp(arg, "none"))
1290                 *copy_type = EXT_COPY_NONE;
1291         else if (!strcasecmp(arg, "copy"))
1292                 *copy_type = EXT_COPY_ADD;
1293         else if (!strcasecmp(arg, "copyall"))
1294                 *copy_type = EXT_COPY_ALL;
1295         else
1296                 return 0;
1297         return 1;
1298 }
1299
1300 int copy_extensions(X509 *x, X509_REQ *req, int copy_type)
1301 {
1302         STACK_OF(X509_EXTENSION) *exts = NULL;
1303         X509_EXTENSION *ext, *tmpext;
1304         ASN1_OBJECT *obj;
1305         int i, idx, ret = 0;
1306         if (!x || !req || (copy_type == EXT_COPY_NONE))
1307                 return 1;
1308         exts = X509_REQ_get_extensions(req);
1309
1310         for(i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
1311                 ext = sk_X509_EXTENSION_value(exts, i);
1312                 obj = X509_EXTENSION_get_object(ext);
1313                 idx = X509_get_ext_by_OBJ(x, obj, -1);
1314                 /* Does extension exist? */
1315                 if (idx != -1) {
1316                         /* If normal copy don't override existing extension */
1317                         if (copy_type == EXT_COPY_ADD)
1318                                 continue;
1319                         /* Delete all extensions of same type */
1320                         do {
1321                                 tmpext = X509_get_ext(x, idx);
1322                                 X509_delete_ext(x, idx);
1323                                 X509_EXTENSION_free(tmpext);
1324                                 idx = X509_get_ext_by_OBJ(x, obj, -1);
1325                         } while (idx != -1);
1326                 }
1327                 if (!X509_add_ext(x, ext, -1))
1328                         goto end;
1329         }
1330
1331         ret = 1;
1332
1333         end:
1334
1335         sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
1336
1337         return ret;
1338 }
1339
1340
1341
1342
1343 static int set_multi_opts(unsigned long *flags, const char *arg, const NAME_EX_TBL *in_tbl)
1344 {
1345         STACK_OF(CONF_VALUE) *vals;
1346         CONF_VALUE *val;
1347         int i, ret = 1;
1348         if(!arg) return 0;
1349         vals = X509V3_parse_list(arg);
1350         for (i = 0; i < sk_CONF_VALUE_num(vals); i++) {
1351                 val = sk_CONF_VALUE_value(vals, i);
1352                 if (!set_table_opts(flags, val->name, in_tbl))
1353                         ret = 0;
1354         }
1355         sk_CONF_VALUE_pop_free(vals, X509V3_conf_free);
1356         return ret;
1357 }
1358
1359 static int set_table_opts(unsigned long *flags, const char *arg, const NAME_EX_TBL *in_tbl)
1360 {
1361         char c;
1362         const NAME_EX_TBL *ptbl;
1363         c = arg[0];
1364
1365         if(c == '-') {
1366                 c = 0;
1367                 arg++;
1368         } else if (c == '+') {
1369                 c = 1;
1370                 arg++;
1371         } else c = 1;
1372
1373         for(ptbl = in_tbl; ptbl->name; ptbl++) {
1374                 if(!strcasecmp(arg, ptbl->name)) {
1375                         *flags &= ~ptbl->mask;
1376                         if(c) *flags |= ptbl->flag;
1377                         else *flags &= ~ptbl->flag;
1378                         return 1;
1379                 }
1380         }
1381         return 0;
1382 }
1383
1384 void print_name(BIO *out, const char *title, X509_NAME *nm, unsigned long lflags)
1385 {
1386         char *buf;
1387         char mline = 0;
1388         int indent = 0;
1389
1390         if(title) BIO_puts(out, title);
1391         if((lflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) {
1392                 mline = 1;
1393                 indent = 4;
1394         }
1395         if(lflags == XN_FLAG_COMPAT) {
1396                 buf = X509_NAME_oneline(nm, 0, 0);
1397                 BIO_puts(out, buf);
1398                 BIO_puts(out, "\n");
1399                 OPENSSL_free(buf);
1400         } else {
1401                 if(mline) BIO_puts(out, "\n");
1402                 X509_NAME_print_ex(out, nm, indent, lflags);
1403                 BIO_puts(out, "\n");
1404         }
1405 }
1406
1407 X509_STORE *setup_verify(BIO *bp, char *CAfile, char *CApath)
1408 {
1409         X509_STORE *store;
1410         X509_LOOKUP *lookup;
1411         if(!(store = X509_STORE_new())) goto end;
1412         lookup=X509_STORE_add_lookup(store,X509_LOOKUP_file());
1413         if (lookup == NULL) goto end;
1414         if (CAfile) {
1415                 if(!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM)) {
1416                         BIO_printf(bp, "Error loading file %s\n", CAfile);
1417                         goto end;
1418                 }
1419         } else X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
1420
1421         lookup=X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir());
1422         if (lookup == NULL) goto end;
1423         if (CApath) {
1424                 if(!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM)) {
1425                         BIO_printf(bp, "Error loading directory %s\n", CApath);
1426                         goto end;
1427                 }
1428         } else X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
1429
1430         ERR_clear_error();
1431         return store;
1432         end:
1433         X509_STORE_free(store);
1434         return NULL;
1435 }
1436
1437 #ifndef OPENSSL_NO_ENGINE
1438 /* Try to load an engine in a shareable library */
1439 static ENGINE *try_load_engine(BIO *err, const char *engine, int debug)
1440         {
1441         ENGINE *e = ENGINE_by_id("dynamic");
1442         if (e)
1443                 {
1444                 if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine, 0)
1445                         || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0))
1446                         {
1447                         ENGINE_free(e);
1448                         e = NULL;
1449                         }
1450                 }
1451         return e;
1452         }
1453
1454 ENGINE *setup_engine(BIO *err, const char *engine, int debug)
1455         {
1456         ENGINE *e = NULL;
1457
1458         if (engine)
1459                 {
1460                 if(strcmp(engine, "auto") == 0)
1461                         {
1462                         BIO_printf(err,"enabling auto ENGINE support\n");
1463                         ENGINE_register_all_complete();
1464                         return NULL;
1465                         }
1466                 if((e = ENGINE_by_id(engine)) == NULL
1467                         && (e = try_load_engine(err, engine, debug)) == NULL)
1468                         {
1469                         BIO_printf(err,"invalid engine \"%s\"\n", engine);
1470                         ERR_print_errors(err);
1471                         return NULL;
1472                         }
1473                 if (debug)
1474                         {
1475                         ENGINE_ctrl(e, ENGINE_CTRL_SET_LOGSTREAM,
1476                                 0, err, 0);
1477                         }
1478                 ENGINE_ctrl_cmd(e, "SET_USER_INTERFACE", 0, ui_method, 0, 1);
1479                 if(!ENGINE_set_default(e, ENGINE_METHOD_ALL))
1480                         {
1481                         BIO_printf(err,"can't use that engine\n");
1482                         ERR_print_errors(err);
1483                         ENGINE_free(e);
1484                         return NULL;
1485                         }
1486
1487                 BIO_printf(err,"engine \"%s\" set.\n", ENGINE_get_id(e));
1488
1489                 /* Free our "structural" reference. */
1490                 ENGINE_free(e);
1491                 }
1492         return e;
1493         }
1494 #endif
1495
1496 int load_config(BIO *err, CONF *cnf)
1497         {
1498         static int load_config_called = 0;
1499         if (load_config_called)
1500                 return 1;
1501         load_config_called = 1;
1502         if (!cnf)
1503                 cnf = config;
1504         if (!cnf)
1505                 return 1;
1506
1507         OPENSSL_load_builtin_modules();
1508
1509         if (CONF_modules_load(cnf, NULL, 0) <= 0)
1510                 {
1511                 BIO_printf(err, "Error configuring OpenSSL\n");
1512                 ERR_print_errors(err);
1513                 return 0;
1514                 }
1515         return 1;
1516         }
1517
1518 char *make_config_name()
1519         {
1520         const char *t=X509_get_default_cert_area();
1521         size_t len;
1522         char *p;
1523
1524         len=strlen(t)+strlen(OPENSSL_CONF)+2;
1525         p=OPENSSL_malloc(len);
1526         BUF_strlcpy(p,t,len);
1527 #ifndef OPENSSL_SYS_VMS
1528         BUF_strlcat(p,"/",len);
1529 #endif
1530         BUF_strlcat(p,OPENSSL_CONF,len);
1531
1532         return p;
1533         }
1534
1535 static unsigned long index_serial_hash(const OPENSSL_CSTRING *a)
1536         {
1537         const char *n;
1538
1539         n=a[DB_serial];
1540         while (*n == '0') n++;
1541         return(lh_strhash(n));
1542         }
1543
1544 static int index_serial_cmp(const OPENSSL_CSTRING *a, const OPENSSL_CSTRING *b)
1545         {
1546         const char *aa,*bb;
1547
1548         for (aa=a[DB_serial]; *aa == '0'; aa++);
1549         for (bb=b[DB_serial]; *bb == '0'; bb++);
1550         return(strcmp(aa,bb));
1551         }
1552
1553 static int index_name_qual(char **a)
1554         { return(a[0][0] == 'V'); }
1555
1556 static unsigned long index_name_hash(const OPENSSL_CSTRING *a)
1557         { return(lh_strhash(a[DB_name])); }
1558
1559 int index_name_cmp(const OPENSSL_CSTRING *a, const OPENSSL_CSTRING *b)
1560         { return(strcmp(a[DB_name], b[DB_name])); }
1561
1562 static IMPLEMENT_LHASH_HASH_FN(index_serial, OPENSSL_CSTRING)
1563 static IMPLEMENT_LHASH_COMP_FN(index_serial, OPENSSL_CSTRING)
1564 static IMPLEMENT_LHASH_HASH_FN(index_name, OPENSSL_CSTRING)
1565 static IMPLEMENT_LHASH_COMP_FN(index_name, OPENSSL_CSTRING)
1566
1567 #undef BSIZE
1568 #define BSIZE 256
1569
1570 BIGNUM *load_serial(char *serialfile, int create, ASN1_INTEGER **retai)
1571         {
1572         BIO *in=NULL;
1573         BIGNUM *ret=NULL;
1574         MS_STATIC char buf[1024];
1575         ASN1_INTEGER *ai=NULL;
1576
1577         ai=ASN1_INTEGER_new();
1578         if (ai == NULL) goto err;
1579
1580         if ((in=BIO_new(BIO_s_file())) == NULL)
1581                 {
1582                 ERR_print_errors(bio_err);
1583                 goto err;
1584                 }
1585
1586         if (BIO_read_filename(in,serialfile) <= 0)
1587                 {
1588                 if (!create)
1589                         {
1590                         perror(serialfile);
1591                         goto err;
1592                         }
1593                 else
1594                         {
1595                         ret=BN_new();
1596                         if (ret == NULL || !rand_serial(ret, ai))
1597                                 BIO_printf(bio_err, "Out of memory\n");
1598                         }
1599                 }
1600         else
1601                 {
1602                 if (!a2i_ASN1_INTEGER(in,ai,buf,1024))
1603                         {
1604                         BIO_printf(bio_err,"unable to load number from %s\n",
1605                                 serialfile);
1606                         goto err;
1607                         }
1608                 ret=ASN1_INTEGER_to_BN(ai,NULL);
1609                 if (ret == NULL)
1610                         {
1611                         BIO_printf(bio_err,"error converting number from bin to BIGNUM\n");
1612                         goto err;
1613                         }
1614                 }
1615
1616         if (ret && retai)
1617                 {
1618                 *retai = ai;
1619                 ai = NULL;
1620                 }
1621  err:
1622         if (in != NULL) BIO_free(in);
1623         if (ai != NULL) ASN1_INTEGER_free(ai);
1624         return(ret);
1625         }
1626
1627 int save_serial(char *serialfile, char *suffix, BIGNUM *serial, ASN1_INTEGER **retai)
1628         {
1629         char buf[1][BSIZE];
1630         BIO *out = NULL;
1631         int ret=0;
1632         ASN1_INTEGER *ai=NULL;
1633         int j;
1634
1635         if (suffix == NULL)
1636                 j = strlen(serialfile);
1637         else
1638                 j = strlen(serialfile) + strlen(suffix) + 1;
1639         if (j >= BSIZE)
1640                 {
1641                 BIO_printf(bio_err,"file name too long\n");
1642                 goto err;
1643                 }
1644
1645         if (suffix == NULL)
1646                 BUF_strlcpy(buf[0], serialfile, BSIZE);
1647         else
1648                 {
1649 #ifndef OPENSSL_SYS_VMS
1650                 j = BIO_snprintf(buf[0], sizeof buf[0], "%s.%s", serialfile, suffix);
1651 #else
1652                 j = BIO_snprintf(buf[0], sizeof buf[0], "%s-%s", serialfile, suffix);
1653 #endif
1654                 }
1655 #ifdef RL_DEBUG
1656         BIO_printf(bio_err, "DEBUG: writing \"%s\"\n", buf[0]);
1657 #endif
1658         out=BIO_new(BIO_s_file());
1659         if (out == NULL)
1660                 {
1661                 ERR_print_errors(bio_err);
1662                 goto err;
1663                 }
1664         if (BIO_write_filename(out,buf[0]) <= 0)
1665                 {
1666                 perror(serialfile);
1667                 goto err;
1668                 }
1669
1670         if ((ai=BN_to_ASN1_INTEGER(serial,NULL)) == NULL)
1671                 {
1672                 BIO_printf(bio_err,"error converting serial to ASN.1 format\n");
1673                 goto err;
1674                 }
1675         i2a_ASN1_INTEGER(out,ai);
1676         BIO_puts(out,"\n");
1677         ret=1;
1678         if (retai)
1679                 {
1680                 *retai = ai;
1681                 ai = NULL;
1682                 }
1683 err:
1684         if (out != NULL) BIO_free_all(out);
1685         if (ai != NULL) ASN1_INTEGER_free(ai);
1686         return(ret);
1687         }
1688
1689 int rotate_serial(char *serialfile, char *new_suffix, char *old_suffix)
1690         {
1691         char buf[5][BSIZE];
1692         int i,j;
1693
1694         i = strlen(serialfile) + strlen(old_suffix);
1695         j = strlen(serialfile) + strlen(new_suffix);
1696         if (i > j) j = i;
1697         if (j + 1 >= BSIZE)
1698                 {
1699                 BIO_printf(bio_err,"file name too long\n");
1700                 goto err;
1701                 }
1702
1703 #ifndef OPENSSL_SYS_VMS
1704         j = BIO_snprintf(buf[0], sizeof buf[0], "%s.%s",
1705                 serialfile, new_suffix);
1706 #else
1707         j = BIO_snprintf(buf[0], sizeof buf[0], "%s-%s",
1708                 serialfile, new_suffix);
1709 #endif
1710 #ifndef OPENSSL_SYS_VMS
1711         j = BIO_snprintf(buf[1], sizeof buf[1], "%s.%s",
1712                 serialfile, old_suffix);
1713 #else
1714         j = BIO_snprintf(buf[1], sizeof buf[1], "%s-%s",
1715                 serialfile, old_suffix);
1716 #endif
1717 #ifdef RL_DEBUG
1718         BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
1719                 serialfile, buf[1]);
1720 #endif
1721         if (rename(serialfile,buf[1]) < 0 && errno != ENOENT
1722 #ifdef ENOTDIR
1723                         && errno != ENOTDIR
1724 #endif
1725            )            {
1726                         BIO_printf(bio_err,
1727                                 "unable to rename %s to %s\n",
1728                                 serialfile, buf[1]);
1729                         perror("reason");
1730                         goto err;
1731                         }
1732 #ifdef RL_DEBUG
1733         BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
1734                 buf[0],serialfile);
1735 #endif
1736         if (rename(buf[0],serialfile) < 0)
1737                 {
1738                 BIO_printf(bio_err,
1739                         "unable to rename %s to %s\n",
1740                         buf[0],serialfile);
1741                 perror("reason");
1742                 rename(buf[1],serialfile);
1743                 goto err;
1744                 }
1745         return 1;
1746  err:
1747         return 0;
1748         }
1749
1750 int rand_serial(BIGNUM *b, ASN1_INTEGER *ai)
1751         {
1752         BIGNUM *btmp;
1753         int ret = 0;
1754         if (b)
1755                 btmp = b;
1756         else
1757                 btmp = BN_new();
1758
1759         if (!btmp)
1760                 return 0;
1761
1762         if (!BN_pseudo_rand(btmp, SERIAL_RAND_BITS, 0, 0))
1763                 goto error;
1764         if (ai && !BN_to_ASN1_INTEGER(btmp, ai))
1765                 goto error;
1766
1767         ret = 1;
1768
1769         error:
1770
1771         if (!b)
1772                 BN_free(btmp);
1773
1774         return ret;
1775         }
1776
1777 CA_DB *load_index(char *dbfile, DB_ATTR *db_attr)
1778         {
1779         CA_DB *retdb = NULL;
1780         TXT_DB *tmpdb = NULL;
1781         BIO *in = BIO_new(BIO_s_file());
1782         CONF *dbattr_conf = NULL;
1783         char buf[1][BSIZE];
1784         long errorline= -1;
1785
1786         if (in == NULL)
1787                 {
1788                 ERR_print_errors(bio_err);
1789                 goto err;
1790                 }
1791         if (BIO_read_filename(in,dbfile) <= 0)
1792                 {
1793                 perror(dbfile);
1794                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
1795                 goto err;
1796                 }
1797         if ((tmpdb = TXT_DB_read(in,DB_NUMBER)) == NULL)
1798                 goto err;
1799
1800 #ifndef OPENSSL_SYS_VMS
1801         BIO_snprintf(buf[0], sizeof buf[0], "%s.attr", dbfile);
1802 #else
1803         BIO_snprintf(buf[0], sizeof buf[0], "%s-attr", dbfile);
1804 #endif
1805         dbattr_conf = NCONF_new(NULL);
1806         if (NCONF_load(dbattr_conf,buf[0],&errorline) <= 0)
1807                 {
1808                 if (errorline > 0)
1809                         {
1810                         BIO_printf(bio_err,
1811                                 "error on line %ld of db attribute file '%s'\n"
1812                                 ,errorline,buf[0]);
1813                         goto err;
1814                         }
1815                 else
1816                         {
1817                         NCONF_free(dbattr_conf);
1818                         dbattr_conf = NULL;
1819                         }
1820                 }
1821
1822         if ((retdb = OPENSSL_malloc(sizeof(CA_DB))) == NULL)
1823                 {
1824                 fprintf(stderr, "Out of memory\n");
1825                 goto err;
1826                 }
1827
1828         retdb->db = tmpdb;
1829         tmpdb = NULL;
1830         if (db_attr)
1831                 retdb->attributes = *db_attr;
1832         else
1833                 {
1834                 retdb->attributes.unique_subject = 1;
1835                 }
1836
1837         if (dbattr_conf)
1838                 {
1839                 char *p = NCONF_get_string(dbattr_conf,NULL,"unique_subject");
1840                 if (p)
1841                         {
1842 #ifdef RL_DEBUG
1843                         BIO_printf(bio_err, "DEBUG[load_index]: unique_subject = \"%s\"\n", p);
1844 #endif
1845                         retdb->attributes.unique_subject = parse_yesno(p,1);
1846                         }
1847                 }
1848
1849  err:
1850         if (dbattr_conf) NCONF_free(dbattr_conf);
1851         if (tmpdb) TXT_DB_free(tmpdb);
1852         if (in) BIO_free_all(in);
1853         return retdb;
1854         }
1855
1856 int index_index(CA_DB *db)
1857         {
1858         if (!TXT_DB_create_index(db->db, DB_serial, NULL,
1859                                 LHASH_HASH_FN(index_serial),
1860                                 LHASH_COMP_FN(index_serial)))
1861                 {
1862                 BIO_printf(bio_err,
1863                   "error creating serial number index:(%ld,%ld,%ld)\n",
1864                                         db->db->error,db->db->arg1,db->db->arg2);
1865                         return 0;
1866                 }
1867
1868         if (db->attributes.unique_subject
1869                 && !TXT_DB_create_index(db->db, DB_name, index_name_qual,
1870                         LHASH_HASH_FN(index_name),
1871                         LHASH_COMP_FN(index_name)))
1872                 {
1873                 BIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\n",
1874                         db->db->error,db->db->arg1,db->db->arg2);
1875                 return 0;
1876                 }
1877         return 1;
1878         }
1879
1880 int save_index(const char *dbfile, const char *suffix, CA_DB *db)
1881         {
1882         char buf[3][BSIZE];
1883         BIO *out = BIO_new(BIO_s_file());
1884         int j;
1885
1886         if (out == NULL)
1887                 {
1888                 ERR_print_errors(bio_err);
1889                 goto err;
1890                 }
1891
1892         j = strlen(dbfile) + strlen(suffix);
1893         if (j + 6 >= BSIZE)
1894                 {
1895                 BIO_printf(bio_err,"file name too long\n");
1896                 goto err;
1897                 }
1898
1899 #ifndef OPENSSL_SYS_VMS
1900         j = BIO_snprintf(buf[2], sizeof buf[2], "%s.attr", dbfile);
1901 #else
1902         j = BIO_snprintf(buf[2], sizeof buf[2], "%s-attr", dbfile);
1903 #endif
1904 #ifndef OPENSSL_SYS_VMS
1905         j = BIO_snprintf(buf[1], sizeof buf[1], "%s.attr.%s", dbfile, suffix);
1906 #else
1907         j = BIO_snprintf(buf[1], sizeof buf[1], "%s-attr-%s", dbfile, suffix);
1908 #endif
1909 #ifndef OPENSSL_SYS_VMS
1910         j = BIO_snprintf(buf[0], sizeof buf[0], "%s.%s", dbfile, suffix);
1911 #else
1912         j = BIO_snprintf(buf[0], sizeof buf[0], "%s-%s", dbfile, suffix);
1913 #endif
1914 #ifdef RL_DEBUG
1915         BIO_printf(bio_err, "DEBUG: writing \"%s\"\n", buf[0]);
1916 #endif
1917         if (BIO_write_filename(out,buf[0]) <= 0)
1918                 {
1919                 perror(dbfile);
1920                 BIO_printf(bio_err,"unable to open '%s'\n", dbfile);
1921                 goto err;
1922                 }
1923         j=TXT_DB_write(out,db->db);
1924         if (j <= 0) goto err;
1925
1926         BIO_free(out);
1927
1928         out = BIO_new(BIO_s_file());
1929 #ifdef RL_DEBUG
1930         BIO_printf(bio_err, "DEBUG: writing \"%s\"\n", buf[1]);
1931 #endif
1932         if (BIO_write_filename(out,buf[1]) <= 0)
1933                 {
1934                 perror(buf[2]);
1935                 BIO_printf(bio_err,"unable to open '%s'\n", buf[2]);
1936                 goto err;
1937                 }
1938         BIO_printf(out,"unique_subject = %s\n",
1939                 db->attributes.unique_subject ? "yes" : "no");
1940         BIO_free(out);
1941
1942         return 1;
1943  err:
1944         return 0;
1945         }
1946
1947 int rotate_index(const char *dbfile, const char *new_suffix, const char *old_suffix)
1948         {
1949         char buf[5][BSIZE];
1950         int i,j;
1951
1952         i = strlen(dbfile) + strlen(old_suffix);
1953         j = strlen(dbfile) + strlen(new_suffix);
1954         if (i > j) j = i;
1955         if (j + 6 >= BSIZE)
1956                 {
1957                 BIO_printf(bio_err,"file name too long\n");
1958                 goto err;
1959                 }
1960
1961 #ifndef OPENSSL_SYS_VMS
1962         j = BIO_snprintf(buf[4], sizeof buf[4], "%s.attr", dbfile);
1963 #else
1964         j = BIO_snprintf(buf[4], sizeof buf[4], "%s-attr", dbfile);
1965 #endif
1966 #ifndef OPENSSL_SYS_VMS
1967         j = BIO_snprintf(buf[2], sizeof buf[2], "%s.attr.%s",
1968                 dbfile, new_suffix);
1969 #else
1970         j = BIO_snprintf(buf[2], sizeof buf[2], "%s-attr-%s",
1971                 dbfile, new_suffix);
1972 #endif
1973 #ifndef OPENSSL_SYS_VMS
1974         j = BIO_snprintf(buf[0], sizeof buf[0], "%s.%s",
1975                 dbfile, new_suffix);
1976 #else
1977         j = BIO_snprintf(buf[0], sizeof buf[0], "%s-%s",
1978                 dbfile, new_suffix);
1979 #endif
1980 #ifndef OPENSSL_SYS_VMS
1981         j = BIO_snprintf(buf[1], sizeof buf[1], "%s.%s",
1982                 dbfile, old_suffix);
1983 #else
1984         j = BIO_snprintf(buf[1], sizeof buf[1], "%s-%s",
1985                 dbfile, old_suffix);
1986 #endif
1987 #ifndef OPENSSL_SYS_VMS
1988         j = BIO_snprintf(buf[3], sizeof buf[3], "%s.attr.%s",
1989                 dbfile, old_suffix);
1990 #else
1991         j = BIO_snprintf(buf[3], sizeof buf[3], "%s-attr-%s",
1992                 dbfile, old_suffix);
1993 #endif
1994 #ifdef RL_DEBUG
1995         BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
1996                 dbfile, buf[1]);
1997 #endif
1998         if (rename(dbfile,buf[1]) < 0 && errno != ENOENT
1999 #ifdef ENOTDIR
2000                 && errno != ENOTDIR
2001 #endif
2002            )            {
2003                         BIO_printf(bio_err,
2004                                 "unable to rename %s to %s\n",
2005                                 dbfile, buf[1]);
2006                         perror("reason");
2007                         goto err;
2008                         }
2009 #ifdef RL_DEBUG
2010         BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
2011                 buf[0],dbfile);
2012 #endif
2013         if (rename(buf[0],dbfile) < 0)
2014                 {
2015                 BIO_printf(bio_err,
2016                         "unable to rename %s to %s\n",
2017                         buf[0],dbfile);
2018                 perror("reason");
2019                 rename(buf[1],dbfile);
2020                 goto err;
2021                 }
2022 #ifdef RL_DEBUG
2023         BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
2024                 buf[4],buf[3]);
2025 #endif
2026         if (rename(buf[4],buf[3]) < 0 && errno != ENOENT
2027 #ifdef ENOTDIR
2028                 && errno != ENOTDIR
2029 #endif
2030            )            {
2031                         BIO_printf(bio_err,
2032                                 "unable to rename %s to %s\n",
2033                                 buf[4], buf[3]);
2034                         perror("reason");
2035                         rename(dbfile,buf[0]);
2036                         rename(buf[1],dbfile);
2037                         goto err;
2038                         }
2039 #ifdef RL_DEBUG
2040         BIO_printf(bio_err, "DEBUG: renaming \"%s\" to \"%s\"\n",
2041                 buf[2],buf[4]);
2042 #endif
2043         if (rename(buf[2],buf[4]) < 0)
2044                 {
2045                 BIO_printf(bio_err,
2046                         "unable to rename %s to %s\n",
2047                         buf[2],buf[4]);
2048                 perror("reason");
2049                 rename(buf[3],buf[4]);
2050                 rename(dbfile,buf[0]);
2051                 rename(buf[1],dbfile);
2052                 goto err;
2053                 }
2054         return 1;
2055  err:
2056         return 0;
2057         }
2058
2059 void free_index(CA_DB *db)
2060         {
2061         if (db)
2062                 {
2063                 if (db->db) TXT_DB_free(db->db);
2064                 OPENSSL_free(db);
2065                 }
2066         }
2067
2068 int parse_yesno(const char *str, int def)
2069         {
2070         int ret = def;
2071         if (str)
2072                 {
2073                 switch (*str)
2074                         {
2075                 case 'f': /* false */
2076                 case 'F': /* FALSE */
2077                 case 'n': /* no */
2078                 case 'N': /* NO */
2079                 case '0': /* 0 */
2080                         ret = 0;
2081                         break;
2082                 case 't': /* true */
2083                 case 'T': /* TRUE */
2084                 case 'y': /* yes */
2085                 case 'Y': /* YES */
2086                 case '1': /* 1 */
2087                         ret = 1;
2088                         break;
2089                 default:
2090                         ret = def;
2091                         break;
2092                         }
2093                 }
2094         return ret;
2095         }
2096
2097 /*
2098  * subject is expected to be in the format /type0=value0/type1=value1/type2=...
2099  * where characters may be escaped by \
2100  */
2101 X509_NAME *parse_name(char *subject, long chtype, int multirdn)
2102         {
2103         size_t buflen = strlen(subject)+1; /* to copy the types and values into. due to escaping, the copy can only become shorter */
2104         char *buf = OPENSSL_malloc(buflen);
2105         size_t max_ne = buflen / 2 + 1; /* maximum number of name elements */
2106         char **ne_types = OPENSSL_malloc(max_ne * sizeof (char *));
2107         char **ne_values = OPENSSL_malloc(max_ne * sizeof (char *));
2108         int *mval = OPENSSL_malloc (max_ne * sizeof (int));
2109
2110         char *sp = subject, *bp = buf;
2111         int i, ne_num = 0;
2112
2113         X509_NAME *n = NULL;
2114         int nid;
2115
2116         if (!buf || !ne_types || !ne_values)
2117                 {
2118                 BIO_printf(bio_err, "malloc error\n");
2119                 goto error;
2120                 }
2121
2122         if (*subject != '/')
2123                 {
2124                 BIO_printf(bio_err, "Subject does not start with '/'.\n");
2125                 goto error;
2126                 }
2127         sp++; /* skip leading / */
2128
2129         /* no multivalued RDN by default */
2130         mval[ne_num] = 0;
2131
2132         while (*sp)
2133                 {
2134                 /* collect type */
2135                 ne_types[ne_num] = bp;
2136                 while (*sp)
2137                         {
2138                         if (*sp == '\\') /* is there anything to escape in the type...? */
2139                                 {
2140                                 if (*++sp)
2141                                         *bp++ = *sp++;
2142                                 else
2143                                         {
2144                                         BIO_printf(bio_err, "escape character at end of string\n");
2145                                         goto error;
2146                                         }
2147                                 }
2148                         else if (*sp == '=')
2149                                 {
2150                                 sp++;
2151                                 *bp++ = '\0';
2152                                 break;
2153                                 }
2154                         else
2155                                 *bp++ = *sp++;
2156                         }
2157                 if (!*sp)
2158                         {
2159                         BIO_printf(bio_err, "end of string encountered while processing type of subject name element #%d\n", ne_num);
2160                         goto error;
2161                         }
2162                 ne_values[ne_num] = bp;
2163                 while (*sp)
2164                         {
2165                         if (*sp == '\\')
2166                                 {
2167                                 if (*++sp)
2168                                         *bp++ = *sp++;
2169                                 else
2170                                         {
2171                                         BIO_printf(bio_err, "escape character at end of string\n");
2172                                         goto error;
2173                                         }
2174                                 }
2175                         else if (*sp == '/')
2176                                 {
2177                                 sp++;
2178                                 /* no multivalued RDN by default */
2179                                 mval[ne_num+1] = 0;
2180                                 break;
2181                                 }
2182                         else if (*sp == '+' && multirdn)
2183                                 {
2184                                 /* a not escaped + signals a mutlivalued RDN */
2185                                 sp++;
2186                                 mval[ne_num+1] = -1;
2187                                 break;
2188                                 }
2189                         else
2190                                 *bp++ = *sp++;
2191                         }
2192                 *bp++ = '\0';
2193                 ne_num++;
2194                 }
2195
2196         if (!(n = X509_NAME_new()))
2197                 goto error;
2198
2199         for (i = 0; i < ne_num; i++)
2200                 {
2201                 if ((nid=OBJ_txt2nid(ne_types[i])) == NID_undef)
2202                         {
2203                         BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_types[i]);
2204                         continue;
2205                         }
2206
2207                 if (!*ne_values[i])
2208                         {
2209                         BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_types[i]);
2210                         continue;
2211                         }
2212
2213                 if (!X509_NAME_add_entry_by_NID(n, nid, chtype, (unsigned char*)ne_values[i], -1,-1,mval[i]))
2214                         goto error;
2215                 }
2216
2217         OPENSSL_free(ne_values);
2218         OPENSSL_free(ne_types);
2219         OPENSSL_free(buf);
2220         return n;
2221
2222 error:
2223         X509_NAME_free(n);
2224         if (ne_values)
2225                 OPENSSL_free(ne_values);
2226         if (ne_types)
2227                 OPENSSL_free(ne_types);
2228         if (buf)
2229                 OPENSSL_free(buf);
2230         return NULL;
2231 }
2232
2233 int args_verify(char ***pargs, int *pargc,
2234                         int *badarg, BIO *err, X509_VERIFY_PARAM **pm)
2235         {
2236         ASN1_OBJECT *otmp = NULL;
2237         unsigned long flags = 0;
2238         int i;
2239         int purpose = 0, depth = -1;
2240         char **oldargs = *pargs;
2241         char *arg = **pargs, *argn = (*pargs)[1];
2242         const X509_VERIFY_PARAM *vpm = NULL;
2243         if (!strcmp(arg, "-policy"))
2244                 {
2245                 if (!argn)
2246                         *badarg = 1;
2247                 else
2248                         {
2249                         otmp = OBJ_txt2obj(argn, 0);
2250                         if (!otmp)
2251                                 {
2252                                 BIO_printf(err, "Invalid Policy \"%s\"\n",
2253                                                                         argn);
2254                                 *badarg = 1;
2255                                 }
2256                         }
2257                 (*pargs)++;
2258                 }
2259         else if (strcmp(arg,"-purpose") == 0)
2260                 {
2261                 X509_PURPOSE *xptmp;
2262                 if (!argn)
2263                         *badarg = 1;
2264                 else
2265                         {
2266                         i = X509_PURPOSE_get_by_sname(argn);
2267                         if(i < 0)
2268                                 {
2269                                 BIO_printf(err, "unrecognized purpose\n");
2270                                 *badarg = 1;
2271                                 }
2272                         else
2273                                 {
2274                                 xptmp = X509_PURPOSE_get0(i);
2275                                 purpose = X509_PURPOSE_get_id(xptmp);
2276                                 }
2277                         }
2278                 (*pargs)++;
2279                 }
2280         else if (strcmp(arg,"-verify_name") == 0)
2281                 {
2282                 if (!argn)
2283                         *badarg = 1;
2284                 else
2285                         {
2286                         vpm = X509_VERIFY_PARAM_lookup(argn);
2287                         if(!vpm)
2288                                 {
2289                                 BIO_printf(err, "unrecognized verify name\n");
2290                                 *badarg = 1;
2291                                 }
2292                         }
2293                 (*pargs)++;
2294                 }
2295         else if (strcmp(arg,"-verify_depth") == 0)
2296                 {
2297                 if (!argn)
2298                         *badarg = 1;
2299                 else
2300                         {
2301                         depth = atoi(argn);
2302                         if(depth < 0)
2303                                 {
2304                                 BIO_printf(err, "invalid depth\n");
2305                                 *badarg = 1;
2306                                 }
2307                         }
2308                 (*pargs)++;
2309                 }
2310         else if (!strcmp(arg, "-ignore_critical"))
2311                 flags |= X509_V_FLAG_IGNORE_CRITICAL;
2312         else if (!strcmp(arg, "-issuer_checks"))
2313                 flags |= X509_V_FLAG_CB_ISSUER_CHECK;
2314         else if (!strcmp(arg, "-crl_check"))
2315                 flags |=  X509_V_FLAG_CRL_CHECK;
2316         else if (!strcmp(arg, "-crl_check_all"))
2317                 flags |= X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL;
2318         else if (!strcmp(arg, "-policy_check"))
2319                 flags |= X509_V_FLAG_POLICY_CHECK;
2320         else if (!strcmp(arg, "-explicit_policy"))
2321                 flags |= X509_V_FLAG_EXPLICIT_POLICY;
2322         else if (!strcmp(arg, "-inhibit_any"))
2323                 flags |= X509_V_FLAG_INHIBIT_ANY;
2324         else if (!strcmp(arg, "-inhibit_map"))
2325                 flags |= X509_V_FLAG_INHIBIT_MAP;
2326         else if (!strcmp(arg, "-x509_strict"))
2327                 flags |= X509_V_FLAG_X509_STRICT;
2328         else if (!strcmp(arg, "-extended_crl"))
2329                 flags |= X509_V_FLAG_EXTENDED_CRL_SUPPORT;
2330         else if (!strcmp(arg, "-use_deltas"))
2331                 flags |= X509_V_FLAG_USE_DELTAS;
2332         else if (!strcmp(arg, "-policy_print"))
2333                 flags |= X509_V_FLAG_NOTIFY_POLICY;
2334         else if (!strcmp(arg, "-check_ss_sig"))
2335                 flags |= X509_V_FLAG_CHECK_SS_SIGNATURE;
2336         else if (!strcmp(arg, "-trusted_first"))
2337                 flags |= X509_V_FLAG_TRUSTED_FIRST;
2338         else
2339                 return 0;
2340
2341         if (*badarg)
2342                 {
2343                 if (*pm)
2344                         X509_VERIFY_PARAM_free(*pm);
2345                 *pm = NULL;
2346                 goto end;
2347                 }
2348
2349         if (!*pm && !(*pm = X509_VERIFY_PARAM_new()))
2350                 {
2351                 *badarg = 1;
2352                 goto end;
2353                 }
2354
2355         if (vpm)
2356                 X509_VERIFY_PARAM_set1(*pm, vpm);
2357
2358         if (otmp)
2359                 X509_VERIFY_PARAM_add0_policy(*pm, otmp);
2360         if (flags)
2361                 X509_VERIFY_PARAM_set_flags(*pm, flags);
2362
2363         if (purpose)
2364                 X509_VERIFY_PARAM_set_purpose(*pm, purpose);
2365
2366         if (depth >= 0)
2367                 X509_VERIFY_PARAM_set_depth(*pm, depth);
2368
2369         end:
2370
2371         (*pargs)++;
2372
2373         if (pargc)
2374                 *pargc -= *pargs - oldargs;
2375
2376         return 1;
2377
2378         }
2379
2380 /* Read whole contents of a BIO into an allocated memory buffer and
2381  * return it.
2382  */
2383
2384 int bio_to_mem(unsigned char **out, int maxlen, BIO *in)
2385         {
2386         BIO *mem;
2387         int len, ret;
2388         unsigned char tbuf[1024];
2389         mem = BIO_new(BIO_s_mem());
2390         if (!mem)
2391                 return -1;
2392         for(;;)
2393                 {
2394                 if ((maxlen != -1) && maxlen < 1024)
2395                         len = maxlen;
2396                 else
2397                         len = 1024;
2398                 len = BIO_read(in, tbuf, len);
2399                 if (len <= 0)
2400                         break;
2401                 if (BIO_write(mem, tbuf, len) != len)
2402                         {
2403                         BIO_free(mem);
2404                         return -1;
2405                         }
2406                 maxlen -= len;
2407
2408                 if (maxlen == 0)
2409                         break;
2410                 }
2411         ret = BIO_get_mem_data(mem, (char **)out);
2412         BIO_set_flags(mem, BIO_FLAGS_MEM_RDONLY);
2413         BIO_free(mem);
2414         return ret;
2415         }
2416
2417 int pkey_ctrl_string(EVP_PKEY_CTX *ctx, char *value)
2418         {
2419         int rv;
2420         char *stmp, *vtmp = NULL;
2421         stmp = BUF_strdup(value);
2422         if (!stmp)
2423                 return -1;
2424         vtmp = strchr(stmp, ':');
2425         if (vtmp)
2426                 {
2427                 *vtmp = 0;
2428                 vtmp++;
2429                 }
2430         rv = EVP_PKEY_CTX_ctrl_str(ctx, stmp, vtmp);
2431         OPENSSL_free(stmp);
2432         return rv;
2433         }
2434
2435 static void nodes_print(BIO *out, const char *name,
2436         STACK_OF(X509_POLICY_NODE) *nodes)
2437         {
2438         X509_POLICY_NODE *node;
2439         int i;
2440         BIO_printf(out, "%s Policies:", name);
2441         if (nodes)
2442                 {
2443                 BIO_puts(out, "\n");
2444                 for (i = 0; i < sk_X509_POLICY_NODE_num(nodes); i++)
2445                         {
2446                         node = sk_X509_POLICY_NODE_value(nodes, i);
2447                         X509_POLICY_NODE_print(out, node, 2);
2448                         }
2449                 }
2450         else
2451                 BIO_puts(out, " <empty>\n");
2452         }
2453
2454 void policies_print(BIO *out, X509_STORE_CTX *ctx)
2455         {
2456         X509_POLICY_TREE *tree;
2457         int explicit_policy;
2458         int free_out = 0;
2459         if (out == NULL)
2460                 {
2461                 out = BIO_new_fp(stderr, BIO_NOCLOSE);
2462                 free_out = 1;
2463                 }
2464         tree = X509_STORE_CTX_get0_policy_tree(ctx);
2465         explicit_policy = X509_STORE_CTX_get_explicit_policy(ctx);
2466
2467         BIO_printf(out, "Require explicit Policy: %s\n",
2468                                 explicit_policy ? "True" : "False");
2469
2470         nodes_print(out, "Authority", X509_policy_tree_get0_policies(tree));
2471         nodes_print(out, "User", X509_policy_tree_get0_user_policies(tree));
2472         if (free_out)
2473                 BIO_free(out);
2474         }
2475
2476 #if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
2477
2478 static JPAKE_CTX *jpake_init(const char *us, const char *them,
2479                                                          const char *secret)
2480         {
2481         BIGNUM *p = NULL;
2482         BIGNUM *g = NULL;
2483         BIGNUM *q = NULL;
2484         BIGNUM *bnsecret = BN_new();
2485         JPAKE_CTX *ctx;
2486
2487         /* Use a safe prime for p (that we found earlier) */
2488         BN_hex2bn(&p, "F9E5B365665EA7A05A9C534502780FEE6F1AB5BD4F49947FD036DBD7E905269AF46EF28B0FC07487EE4F5D20FB3C0AF8E700F3A2FA3414970CBED44FEDFF80CE78D800F184BB82435D137AADA2C6C16523247930A63B85661D1FC817A51ACD96168E95898A1F83A79FFB529368AA7833ABD1B0C3AEDDB14D2E1A2F71D99F763F");
2489         g = BN_new();
2490         BN_set_word(g, 2);
2491         q = BN_new();
2492         BN_rshift1(q, p);
2493
2494         BN_bin2bn((const unsigned char *)secret, strlen(secret), bnsecret);
2495
2496         ctx = JPAKE_CTX_new(us, them, p, g, q, bnsecret);
2497         BN_free(bnsecret);
2498         BN_free(q);
2499         BN_free(g);
2500         BN_free(p);
2501
2502         return ctx;
2503         }
2504
2505 static void jpake_send_part(BIO *conn, const JPAKE_STEP_PART *p)
2506         {
2507         BN_print(conn, p->gx);
2508         BIO_puts(conn, "\n");
2509         BN_print(conn, p->zkpx.gr);
2510         BIO_puts(conn, "\n");
2511         BN_print(conn, p->zkpx.b);
2512         BIO_puts(conn, "\n");
2513         }
2514
2515 static void jpake_send_step1(BIO *bconn, JPAKE_CTX *ctx)
2516         {
2517         JPAKE_STEP1 s1;
2518
2519         JPAKE_STEP1_init(&s1);
2520         JPAKE_STEP1_generate(&s1, ctx);
2521         jpake_send_part(bconn, &s1.p1);
2522         jpake_send_part(bconn, &s1.p2);
2523         (void)BIO_flush(bconn);
2524         JPAKE_STEP1_release(&s1);
2525         }
2526
2527 static void jpake_send_step2(BIO *bconn, JPAKE_CTX *ctx)
2528         {
2529         JPAKE_STEP2 s2;
2530
2531         JPAKE_STEP2_init(&s2);
2532         JPAKE_STEP2_generate(&s2, ctx);
2533         jpake_send_part(bconn, &s2);
2534         (void)BIO_flush(bconn);
2535         JPAKE_STEP2_release(&s2);
2536         }
2537
2538 static void jpake_send_step3a(BIO *bconn, JPAKE_CTX *ctx)
2539         {
2540         JPAKE_STEP3A s3a;
2541
2542         JPAKE_STEP3A_init(&s3a);
2543         JPAKE_STEP3A_generate(&s3a, ctx);
2544         BIO_write(bconn, s3a.hhk, sizeof s3a.hhk);
2545         (void)BIO_flush(bconn);
2546         JPAKE_STEP3A_release(&s3a);
2547         }
2548
2549 static void jpake_send_step3b(BIO *bconn, JPAKE_CTX *ctx)
2550         {
2551         JPAKE_STEP3B s3b;
2552
2553         JPAKE_STEP3B_init(&s3b);
2554         JPAKE_STEP3B_generate(&s3b, ctx);
2555         BIO_write(bconn, s3b.hk, sizeof s3b.hk);
2556         (void)BIO_flush(bconn);
2557         JPAKE_STEP3B_release(&s3b);
2558         }
2559
2560 static void readbn(BIGNUM **bn, BIO *bconn)
2561         {
2562         char buf[10240];
2563         int l;
2564
2565         l = BIO_gets(bconn, buf, sizeof buf);
2566         assert(l > 0);
2567         assert(buf[l-1] == '\n');
2568         buf[l-1] = '\0';
2569         BN_hex2bn(bn, buf);
2570         }
2571
2572 static void jpake_receive_part(JPAKE_STEP_PART *p, BIO *bconn)
2573         {
2574         readbn(&p->gx, bconn);
2575         readbn(&p->zkpx.gr, bconn);
2576         readbn(&p->zkpx.b, bconn);
2577         }
2578
2579 static void jpake_receive_step1(JPAKE_CTX *ctx, BIO *bconn)
2580         {
2581         JPAKE_STEP1 s1;
2582
2583         JPAKE_STEP1_init(&s1);
2584         jpake_receive_part(&s1.p1, bconn);
2585         jpake_receive_part(&s1.p2, bconn);
2586         if(!JPAKE_STEP1_process(ctx, &s1))
2587                 {
2588                 ERR_print_errors(bio_err);
2589                 exit(1);
2590                 }
2591         JPAKE_STEP1_release(&s1);
2592         }
2593
2594 static void jpake_receive_step2(JPAKE_CTX *ctx, BIO *bconn)
2595         {
2596         JPAKE_STEP2 s2;
2597
2598         JPAKE_STEP2_init(&s2);
2599         jpake_receive_part(&s2, bconn);
2600         if(!JPAKE_STEP2_process(ctx, &s2))
2601                 {
2602                 ERR_print_errors(bio_err);
2603                 exit(1);
2604                 }
2605         JPAKE_STEP2_release(&s2);
2606         }
2607
2608 static void jpake_receive_step3a(JPAKE_CTX *ctx, BIO *bconn)
2609         {
2610         JPAKE_STEP3A s3a;
2611         int l;
2612
2613         JPAKE_STEP3A_init(&s3a);
2614         l = BIO_read(bconn, s3a.hhk, sizeof s3a.hhk);
2615         assert(l == sizeof s3a.hhk);
2616         if(!JPAKE_STEP3A_process(ctx, &s3a))
2617                 {
2618                 ERR_print_errors(bio_err);
2619                 exit(1);
2620                 }
2621         JPAKE_STEP3A_release(&s3a);
2622         }
2623
2624 static void jpake_receive_step3b(JPAKE_CTX *ctx, BIO *bconn)
2625         {
2626         JPAKE_STEP3B s3b;
2627         int l;
2628
2629         JPAKE_STEP3B_init(&s3b);
2630         l = BIO_read(bconn, s3b.hk, sizeof s3b.hk);
2631         assert(l == sizeof s3b.hk);
2632         if(!JPAKE_STEP3B_process(ctx, &s3b))
2633                 {
2634                 ERR_print_errors(bio_err);
2635                 exit(1);
2636                 }
2637         JPAKE_STEP3B_release(&s3b);
2638         }
2639
2640 void jpake_client_auth(BIO *out, BIO *conn, const char *secret)
2641         {
2642         JPAKE_CTX *ctx;
2643         BIO *bconn;
2644
2645         BIO_puts(out, "Authenticating with JPAKE\n");
2646
2647         ctx = jpake_init("client", "server", secret);
2648
2649         bconn = BIO_new(BIO_f_buffer());
2650         BIO_push(bconn, conn);
2651
2652         jpake_send_step1(bconn, ctx);
2653         jpake_receive_step1(ctx, bconn);
2654         jpake_send_step2(bconn, ctx);
2655         jpake_receive_step2(ctx, bconn);
2656         jpake_send_step3a(bconn, ctx);
2657         jpake_receive_step3b(ctx, bconn);
2658
2659         BIO_puts(out, "JPAKE authentication succeeded, setting PSK\n");
2660
2661         psk_key = BN_bn2hex(JPAKE_get_shared_key(ctx));
2662
2663         BIO_pop(bconn);
2664         BIO_free(bconn);
2665
2666         JPAKE_CTX_free(ctx);
2667         }
2668
2669 void jpake_server_auth(BIO *out, BIO *conn, const char *secret)
2670         {
2671         JPAKE_CTX *ctx;
2672         BIO *bconn;
2673
2674         BIO_puts(out, "Authenticating with JPAKE\n");
2675
2676         ctx = jpake_init("server", "client", secret);
2677
2678         bconn = BIO_new(BIO_f_buffer());
2679         BIO_push(bconn, conn);
2680
2681         jpake_receive_step1(ctx, bconn);
2682         jpake_send_step1(bconn, ctx);
2683         jpake_receive_step2(ctx, bconn);
2684         jpake_send_step2(bconn, ctx);
2685         jpake_receive_step3a(ctx, bconn);
2686         jpake_send_step3b(bconn, ctx);
2687
2688         BIO_puts(out, "JPAKE authentication succeeded, setting PSK\n");
2689
2690         psk_key = BN_bn2hex(JPAKE_get_shared_key(ctx));
2691
2692         BIO_pop(bconn);
2693         BIO_free(bconn);
2694
2695         JPAKE_CTX_free(ctx);
2696         }
2697
2698 #endif
2699
2700 /*
2701  * Platform-specific sections
2702  */
2703 #if defined(_WIN32)
2704 # ifdef fileno
2705 #  undef fileno
2706 #  define fileno(a) (int)_fileno(a)
2707 # endif
2708
2709 # include <windows.h>
2710 # include <tchar.h>
2711
2712 static int WIN32_rename(const char *from, const char *to)
2713         {
2714         TCHAR  *tfrom=NULL,*tto;
2715         DWORD   err;
2716         int     ret=0;
2717
2718         if (sizeof(TCHAR) == 1)
2719                 {
2720                 tfrom = (TCHAR *)from;
2721                 tto   = (TCHAR *)to;
2722                 }
2723         else    /* UNICODE path */
2724                 {
2725                 size_t i,flen=strlen(from)+1,tlen=strlen(to)+1;
2726                 tfrom = (TCHAR *)malloc(sizeof(TCHAR)*(flen+tlen));
2727                 if (tfrom==NULL) goto err;
2728                 tto=tfrom+flen;
2729 #if !defined(_WIN32_WCE) || _WIN32_WCE>=101
2730                 if (!MultiByteToWideChar(CP_ACP,0,from,flen,(WCHAR *)tfrom,flen))
2731 #endif
2732                         for (i=0;i<flen;i++)    tfrom[i]=(TCHAR)from[i];
2733 #if !defined(_WIN32_WCE) || _WIN32_WCE>=101
2734                 if (!MultiByteToWideChar(CP_ACP,0,to,  tlen,(WCHAR *)tto,  tlen))
2735 #endif
2736                         for (i=0;i<tlen;i++)    tto[i]  =(TCHAR)to[i];
2737                 }
2738
2739         if (MoveFile(tfrom,tto))        goto ok;
2740         err=GetLastError();
2741         if (err==ERROR_ALREADY_EXISTS || err==ERROR_FILE_EXISTS)
2742                 {
2743                 if (DeleteFile(tto) && MoveFile(tfrom,tto))
2744                         goto ok;
2745                 err=GetLastError();
2746                 }
2747         if (err==ERROR_FILE_NOT_FOUND || err==ERROR_PATH_NOT_FOUND)
2748                 errno = ENOENT;
2749         else if (err==ERROR_ACCESS_DENIED)
2750                 errno = EACCES;
2751         else
2752                 errno = EINVAL; /* we could map more codes... */
2753 err:
2754         ret=-1;
2755 ok:
2756         if (tfrom!=NULL && tfrom!=(TCHAR *)from)        free(tfrom);
2757         return ret;
2758         }
2759 #endif
2760
2761 /* app_tminterval section */
2762 #if defined(_WIN32)
2763 double app_tminterval(int stop,int usertime)
2764         {
2765         FILETIME                now;
2766         double                  ret=0;
2767         static ULARGE_INTEGER   tmstart;
2768         static int              warning=1;
2769 #ifdef _WIN32_WINNT
2770         static HANDLE           proc=NULL;
2771
2772         if (proc==NULL)
2773                 {
2774                 if (GetVersion() < 0x80000000)
2775                         proc = OpenProcess(PROCESS_QUERY_INFORMATION,FALSE,
2776                                                 GetCurrentProcessId());
2777                 if (proc==NULL) proc = (HANDLE)-1;
2778                 }
2779
2780         if (usertime && proc!=(HANDLE)-1)
2781                 {
2782                 FILETIME junk;
2783                 GetProcessTimes(proc,&junk,&junk,&junk,&now);
2784                 }
2785         else
2786 #endif
2787                 {
2788                 SYSTEMTIME systime;
2789
2790                 if (usertime && warning)
2791                         {
2792                         BIO_printf(bio_err,"To get meaningful results, run "
2793                                            "this program on idle system.\n");
2794                         warning=0;
2795                         }
2796                 GetSystemTime(&systime);
2797                 SystemTimeToFileTime(&systime,&now);
2798                 }
2799
2800         if (stop==TM_START)
2801                 {
2802                 tmstart.u.LowPart  = now.dwLowDateTime;
2803                 tmstart.u.HighPart = now.dwHighDateTime;
2804                 }
2805         else    {
2806                 ULARGE_INTEGER tmstop;
2807
2808                 tmstop.u.LowPart   = now.dwLowDateTime;
2809                 tmstop.u.HighPart  = now.dwHighDateTime;
2810
2811                 ret = (__int64)(tmstop.QuadPart - tmstart.QuadPart)*1e-7;
2812                 }
2813
2814         return (ret);
2815         }
2816
2817 #elif defined(OPENSSL_SYS_NETWARE)
2818 #include <time.h>
2819
2820 double app_tminterval(int stop,int usertime)
2821         {
2822         double          ret=0;
2823         static clock_t  tmstart;
2824         static int      warning=1;
2825
2826         if (usertime && warning)
2827                 {
2828                 BIO_printf(bio_err,"To get meaningful results, run "
2829                                    "this program on idle system.\n");
2830                 warning=0;
2831                 }
2832
2833         if (stop==TM_START)     tmstart = clock();
2834         else                    ret     = (clock()-tmstart)/(double)CLOCKS_PER_SEC;
2835
2836         return (ret);
2837         }
2838
2839 #elif defined(OPENSSL_SYSTEM_VXWORKS)
2840 #include <time.h>
2841
2842 double app_tminterval(int stop,int usertime)
2843         {
2844         double ret=0;
2845 #ifdef CLOCK_REALTIME
2846         static struct timespec  tmstart;
2847         struct timespec         now;
2848 #else
2849         static unsigned long    tmstart;
2850         unsigned long           now;
2851 #endif
2852         static int warning=1;
2853
2854         if (usertime && warning)
2855                 {
2856                 BIO_printf(bio_err,"To get meaningful results, run "
2857                                    "this program on idle system.\n");
2858                 warning=0;
2859                 }
2860
2861 #ifdef CLOCK_REALTIME
2862         clock_gettime(CLOCK_REALTIME,&now);
2863         if (stop==TM_START)     tmstart = now;
2864         else    ret = ( (now.tv_sec+now.tv_nsec*1e-9)
2865                         - (tmstart.tv_sec+tmstart.tv_nsec*1e-9) );
2866 #else
2867         now = tickGet();
2868         if (stop==TM_START)     tmstart = now;
2869         else                    ret = (now - tmstart)/(double)sysClkRateGet();
2870 #endif
2871         return (ret);
2872         }
2873
2874 #elif defined(OPENSSL_SYSTEM_VMS)
2875 #include <time.h>
2876 #include <times.h>
2877
2878 double app_tminterval(int stop,int usertime)
2879         {
2880         static clock_t  tmstart;
2881         double          ret = 0;
2882         clock_t         now;
2883 #ifdef __TMS
2884         struct tms      rus;
2885
2886         now = times(&rus);
2887         if (usertime)   now = rus.tms_utime;
2888 #else
2889         if (usertime)
2890                 now = clock(); /* sum of user and kernel times */
2891         else    {
2892                 struct timeval tv;
2893                 gettimeofday(&tv,NULL);
2894                 now = (clock_t)(
2895                         (unsigned long long)tv.tv_sec*CLK_TCK +
2896                         (unsigned long long)tv.tv_usec*(1000000/CLK_TCK)
2897                         );
2898                 }
2899 #endif
2900         if (stop==TM_START)     tmstart = now;
2901         else                    ret = (now - tmstart)/(double)(CLK_TCK);
2902
2903         return (ret);
2904         }
2905
2906 #elif defined(_SC_CLK_TCK)      /* by means of unistd.h */
2907 #include <sys/times.h>
2908
2909 double app_tminterval(int stop,int usertime)
2910         {
2911         double          ret = 0;
2912         struct tms      rus;
2913         clock_t         now = times(&rus);
2914         static clock_t  tmstart;
2915
2916         if (usertime)           now = rus.tms_utime;
2917
2918         if (stop==TM_START)     tmstart = now;
2919         else
2920                 {
2921                 long int tck = sysconf(_SC_CLK_TCK);
2922                 ret = (now - tmstart)/(double)tck;
2923                 }
2924
2925         return (ret);
2926         }
2927
2928 #else
2929 #include <sys/time.h>
2930 #include <sys/resource.h>
2931
2932 double app_tminterval(int stop,int usertime)
2933         {
2934         double          ret = 0;
2935         struct rusage   rus;
2936         struct timeval  now;
2937         static struct timeval tmstart;
2938
2939         if (usertime)           getrusage(RUSAGE_SELF,&rus), now = rus.ru_utime;
2940         else                    gettimeofday(&now,NULL);
2941
2942         if (stop==TM_START)     tmstart = now;
2943         else                    ret = ( (now.tv_sec+now.tv_usec*1e-6)
2944                                         - (tmstart.tv_sec+tmstart.tv_usec*1e-6) );
2945
2946         return ret;
2947         }
2948 #endif
2949
2950 /* app_isdir section */
2951 #ifdef _WIN32
2952 int app_isdir(const char *name)
2953         {
2954         HANDLE          hList;
2955         WIN32_FIND_DATA FileData;
2956 #if defined(UNICODE) || defined(_UNICODE)
2957         size_t i, len_0 = strlen(name)+1;
2958
2959         if (len_0 > sizeof(FileData.cFileName)/sizeof(FileData.cFileName[0]))
2960                 return -1;
2961
2962 #if !defined(_WIN32_WCE) || _WIN32_WCE>=101
2963         if (!MultiByteToWideChar(CP_ACP,0,name,len_0,FileData.cFileName,len_0))
2964 #endif
2965                 for (i=0;i<len_0;i++)
2966                         FileData.cFileName[i] = (WCHAR)name[i];
2967
2968         hList = FindFirstFile(FileData.cFileName,&FileData);
2969 #else
2970         hList = FindFirstFile(name,&FileData);
2971 #endif
2972         if (hList == INVALID_HANDLE_VALUE)      return -1;
2973         FindClose(hList);
2974         return ((FileData.dwFileAttributes&FILE_ATTRIBUTE_DIRECTORY)!=0);
2975         }
2976 #else
2977 #include <sys/stat.h>
2978 #ifndef S_ISDIR
2979 # if defined(_S_IFMT) && defined(_S_IFDIR)
2980 #  define S_ISDIR(a)   (((a) & _S_IFMT) == _S_IFDIR)
2981 # else
2982 #  define S_ISDIR(a)   (((a) & S_IFMT) == S_IFDIR)
2983 # endif
2984 #endif
2985
2986 int app_isdir(const char *name)
2987         {
2988 #if defined(S_ISDIR)
2989         struct stat st;
2990
2991         if (stat(name,&st)==0)  return S_ISDIR(st.st_mode);
2992         else                    return -1;
2993 #else
2994         return -1;
2995 #endif
2996         }
2997 #endif
2998
2999 /* raw_read|write section */
3000 #if defined(_WIN32) && defined(STD_INPUT_HANDLE)
3001 int raw_read_stdin(void *buf,int siz)
3002         {
3003         DWORD n;
3004         if (ReadFile(GetStdHandle(STD_INPUT_HANDLE),buf,siz,&n,NULL))
3005                 return (n);
3006         else    return (-1);
3007         }
3008 #else
3009 int raw_read_stdin(void *buf,int siz)
3010         {       return read(fileno(stdin),buf,siz);     }
3011 #endif
3012
3013 #if defined(_WIN32) && defined(STD_OUTPUT_HANDLE)
3014 int raw_write_stdout(const void *buf,int siz)
3015         {
3016         DWORD n;
3017         if (WriteFile(GetStdHandle(STD_OUTPUT_HANDLE),buf,siz,&n,NULL))
3018                 return (n);
3019         else    return (-1);
3020         }
3021 #else
3022 int raw_write_stdout(const void *buf,int siz)
3023         {       return write(fileno(stdout),buf,siz);   }
3024 #endif