apps/ca.c

   1 /* apps/ca.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58
  59 /* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
  60
  61 #include <stdio.h>
  62 #include <stdlib.h>
  63 #include <string.h>
  64 #include <ctype.h>
  65 #include <sys/types.h>
  66 #include <sys/stat.h>
  67 #include "apps.h"
  68 #include <openssl/conf.h>
  69 #include <openssl/bio.h>
  70 #include <openssl/err.h>
  71 #include <openssl/bn.h>
  72 #include <openssl/txt_db.h>
  73 #include <openssl/evp.h>
  74 #include <openssl/x509.h>
  75 #include <openssl/x509v3.h>
  76 #include <openssl/objects.h>
  77 #include <openssl/ocsp.h>
  78 #include <openssl/pem.h>
  79 #include <openssl/engine.h>
  80
  81 #ifndef W_OK
  82 #  ifdef OPENSSL_SYS_VMS
  83 #    if defined(__DECC)
  84 #      include <unistd.h>
  85 #    else
  86 #      include <unixlib.h>
  87 #    endif
  88 #  else
  89 #    include <sys/file.h>
  90 #  endif
  91 #endif
  92
  93 #ifndef W_OK
  94 #  define F_OK 0
  95 #  define X_OK 1
  96 #  define W_OK 2
  97 #  define R_OK 4
  98 #endif
  99
 100 #undef PROG
 101 #define PROG ca_main
 102
 103 #define BASE_SECTION    "ca"
 104 #define CONFIG_FILE "openssl.cnf"
 105
 106 #define ENV_DEFAULT_CA          "default_ca"
 107
 108 #define ENV_DIR                 "dir"
 109 #define ENV_CERTS               "certs"
 110 #define ENV_CRL_DIR             "crl_dir"
 111 #define ENV_CA_DB               "CA_DB"
 112 #define ENV_NEW_CERTS_DIR       "new_certs_dir"
 113 #define ENV_CERTIFICATE         "certificate"
 114 #define ENV_SERIAL              "serial"
 115 #define ENV_CRL                 "crl"
 116 #define ENV_PRIVATE_KEY         "private_key"
 117 #define ENV_RANDFILE            "RANDFILE"
 118 #define ENV_DEFAULT_DAYS        "default_days"
 119 #define ENV_DEFAULT_STARTDATE   "default_startdate"
 120 #define ENV_DEFAULT_ENDDATE     "default_enddate"
 121 #define ENV_DEFAULT_CRL_DAYS    "default_crl_days"
 122 #define ENV_DEFAULT_CRL_HOURS   "default_crl_hours"
 123 #define ENV_DEFAULT_MD          "default_md"
 124 #define ENV_PRESERVE            "preserve"
 125 #define ENV_POLICY              "policy"
 126 #define ENV_EXTENSIONS          "x509_extensions"
 127 #define ENV_CRLEXT              "crl_extensions"
 128 #define ENV_MSIE_HACK           "msie_hack"
 129
 130 #define ENV_DATABASE            "database"
 131
 132 #define DB_type         0
 133 #define DB_exp_date     1
 134 #define DB_rev_date     2
 135 #define DB_serial       3       /* index - unique */
 136 #define DB_file         4
 137 #define DB_name         5       /* index - unique for active */
 138 #define DB_NUMBER       6
 139
 140 #define DB_TYPE_REV     'R'
 141 #define DB_TYPE_EXP     'E'
 142 #define DB_TYPE_VAL     'V'
 143
 144 /* Additional revocation information types */
 145
 146 #define REV_NONE                0       /* No addditional information */
 147 #define REV_CRL_REASON          1       /* Value is CRL reason code */
 148 #define REV_HOLD                2       /* Value is hold instruction */
 149 #define REV_KEY_COMPROMISE      3       /* Value is cert key compromise time */
 150 #define REV_CA_COMPROMISE       4       /* Value is CA key compromise time */
 151
 152 static char *ca_usage[]={
 153 "usage: ca args\n",
 154 "\n",
 155 " -verbose        - Talk alot while doing things\n",
 156 " -config file    - A config file\n",
 157 " -name arg       - The particular CA definition to use\n",
 158 " -gencrl         - Generate a new CRL\n",
 159 " -crldays days   - Days is when the next CRL is due\n",
 160 " -crlhours hours - Hours is when the next CRL is due\n",
 161 " -startdate YYMMDDHHMMSSZ  - certificate validity notBefore\n",
 162 " -enddate YYMMDDHHMMSSZ    - certificate validity notAfter (overrides -days)\n",
 163 " -days arg       - number of days to certify the certificate for\n",
 164 " -md arg         - md to use, one of md2, md5, sha or sha1\n",
 165 " -policy arg     - The CA 'policy' to support\n",
 166 " -keyfile arg    - private key file\n",
 167 " -keyform arg    - private key file format (PEM or ENGINE)\n",
 168 " -key arg        - key to decode the private key if it is encrypted\n",
 169 " -cert file      - The CA certificate\n",
 170 " -in file        - The input PEM encoded certificate request(s)\n",
 171 " -out file       - Where to put the output file(s)\n",
 172 " -outdir dir     - Where to put output certificates\n",
 173 " -infiles ....   - The last argument, requests to process\n",
 174 " -spkac file     - File contains DN and signed public key and challenge\n",
 175 " -ss_cert file   - File contains a self signed cert to sign\n",
 176 " -preserveDN     - Don't re-order the DN\n",
 177 " -batch          - Don't ask questions\n",
 178 " -msie_hack      - msie modifications to handle all those universal strings\n",
 179 " -revoke file    - Revoke a certificate (given in file)\n",
 180 " -extensions ..  - Extension section (override value in config file)\n",
 181 " -extfile file   - Configuration file with X509v3 extentions to add\n",
 182 " -crlexts ..     - CRL extension section (override value in config file)\n",
 183 " -engine e       - use engine e, possibly a hardware device.\n",
 184 " -status serial  - Shows certificate status given the serial number\n",
 185 " -updatedb       - Updates db for expired certificates\n",
 186 NULL
 187 };
 188
 189 #ifdef EFENCE
 190 extern int EF_PROTECT_FREE;
 191 extern int EF_PROTECT_BELOW;
 192 extern int EF_ALIGNMENT;
 193 #endif
 194
 195 static void lookup_fail(char *name,char *tag);
 196 static unsigned long index_serial_hash(const char **a);
 197 static int index_serial_cmp(const char **a, const char **b);
 198 static unsigned long index_name_hash(const char **a);
 199 static int index_name_qual(char **a);
 200 static int index_name_cmp(const char **a,const char **b);
 201 static BIGNUM *load_serial(char *serialfile);
 202 static int save_serial(char *serialfile, BIGNUM *serial);
 203 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 204                    const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,TXT_DB *db,
 205                    BIGNUM *serial, char *startdate,char *enddate, int days,
 206                    int batch, char *ext_sect, LHASH *conf,int verbose);
 207 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 208                         const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 209                         TXT_DB *db, BIGNUM *serial,char *startdate,
 210                         char *enddate, int days, int batch, char *ext_sect,
 211                         LHASH *conf,int verbose);
 212 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 213                          const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 214                          TXT_DB *db, BIGNUM *serial,char *startdate,
 215                          char *enddate, int days, char *ext_sect,LHASH *conf,
 216                                 int verbose);
 217 static int fix_data(int nid, int *type);
 218 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
 219 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
 220         STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,
 221         char *startdate, char *enddate, int days, int batch, int verbose,
 222         X509_REQ *req, char *ext_sect, LHASH *conf);
 223 static int do_revoke(X509 *x509, TXT_DB *db, int ext, char *extval);
 224 static int get_certificate_status(const char *ser_status, TXT_DB *db);
 225 static int do_updatedb(TXT_DB *db);
 226 static int check_time_format(char *str);
 227 char *make_revocation_str(int rev_type, char *rev_arg);
 228 int make_revoked(X509_REVOKED *rev, char *str);
 229 static LHASH *conf=NULL;
 230 static LHASH *extconf=NULL;
 231 static char *section=NULL;
 232
 233 static int preserve=0;
 234 static int msie_hack=0;
 235
 236 static IMPLEMENT_LHASH_HASH_FN(index_serial_hash,const char **)
 237 static IMPLEMENT_LHASH_COMP_FN(index_serial_cmp,const char **)
 238 static IMPLEMENT_LHASH_HASH_FN(index_name_hash,const char **)
 239 static IMPLEMENT_LHASH_COMP_FN(index_name_cmp,const char **)
 240
 241
 242 int MAIN(int, char **);
 243
 244 int MAIN(int argc, char **argv)
 245         {
 246         ENGINE *e = NULL;
 247         char *key=NULL,*passargin=NULL;
 248         int total=0;
 249         int total_done=0;
 250         int badops=0;
 251         int ret=1;
 252         int req=0;
 253         int verbose=0;
 254         int gencrl=0;
 255         int dorevoke=0;
 256         int doupdatedb=0;
 257         long crldays=0;
 258         long crlhours=0;
 259         long errorline= -1;
 260         char *configfile=NULL;
 261         char *md=NULL;
 262         char *policy=NULL;
 263         char *keyfile=NULL;
 264         char *certfile=NULL;
 265         int keyform=FORMAT_PEM;
 266         char *infile=NULL;
 267         char *spkac_file=NULL;
 268         char *ss_cert_file=NULL;
 269         char *ser_status=NULL;
 270         EVP_PKEY *pkey=NULL;
 271         int output_der = 0;
 272         char *outfile=NULL;
 273         char *outdir=NULL;
 274         char *serialfile=NULL;
 275         char *extensions=NULL;
 276         char *extfile=NULL;
 277         char *crl_ext=NULL;
 278         int rev_type = REV_NONE;
 279         char *rev_arg = NULL;
 280         BIGNUM *serial=NULL;
 281         char *startdate=NULL;
 282         char *enddate=NULL;
 283         int days=0;
 284         int batch=0;
 285         int notext=0;
 286         X509 *x509=NULL;
 287         X509 *x=NULL;
 288         BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
 289         char *dbfile=NULL;
 290         TXT_DB *db=NULL;
 291         X509_CRL *crl=NULL;
 292         X509_CRL_INFO *ci=NULL;
 293         X509_REVOKED *r=NULL;
 294         char **pp,*p,*f;
 295         int i,j;
 296         long l;
 297         const EVP_MD *dgst=NULL;
 298         STACK_OF(CONF_VALUE) *attribs=NULL;
 299         STACK_OF(X509) *cert_sk=NULL;
 300 #undef BSIZE
 301 #define BSIZE 256
 302         MS_STATIC char buf[3][BSIZE];
 303         char *randfile=NULL;
 304         char *engine = NULL;
 305
 306 #ifdef EFENCE
 307 EF_PROTECT_FREE=1;
 308 EF_PROTECT_BELOW=1;
 309 EF_ALIGNMENT=0;
 310 #endif
 311
 312         apps_startup();
 313
 314         conf = NULL;
 315         key = NULL;
 316         section = NULL;
 317
 318         preserve=0;
 319         msie_hack=0;
 320         if (bio_err == NULL)
 321                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
 322                         BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 323
 324         argc--;
 325         argv++;
 326         while (argc >= 1)
 327                 {
 328                 if      (strcmp(*argv,"-verbose") == 0)
 329                         verbose=1;
 330                 else if (strcmp(*argv,"-config") == 0)
 331                         {
 332                         if (--argc < 1) goto bad;
 333                         configfile= *(++argv);
 334                         }
 335                 else if (strcmp(*argv,"-name") == 0)
 336                         {
 337                         if (--argc < 1) goto bad;
 338                         section= *(++argv);
 339                         }
 340                 else if (strcmp(*argv,"-startdate") == 0)
 341                         {
 342                         if (--argc < 1) goto bad;
 343                         startdate= *(++argv);
 344                         }
 345                 else if (strcmp(*argv,"-enddate") == 0)
 346                         {
 347                         if (--argc < 1) goto bad;
 348                         enddate= *(++argv);
 349                         }
 350                 else if (strcmp(*argv,"-days") == 0)
 351                         {
 352                         if (--argc < 1) goto bad;
 353                         days=atoi(*(++argv));
 354                         }
 355                 else if (strcmp(*argv,"-md") == 0)
 356                         {
 357                         if (--argc < 1) goto bad;
 358                         md= *(++argv);
 359                         }
 360                 else if (strcmp(*argv,"-policy") == 0)
 361                         {
 362                         if (--argc < 1) goto bad;
 363                         policy= *(++argv);
 364                         }
 365                 else if (strcmp(*argv,"-keyfile") == 0)
 366                         {
 367                         if (--argc < 1) goto bad;
 368                         keyfile= *(++argv);
 369                         }
 370                 else if (strcmp(*argv,"-keyform") == 0)
 371                         {
 372                         if (--argc < 1) goto bad;
 373                         keyform=str2fmt(*(++argv));
 374                         }
 375                 else if (strcmp(*argv,"-passin") == 0)
 376                         {
 377                         if (--argc < 1) goto bad;
 378                         passargin= *(++argv);
 379                         }
 380                 else if (strcmp(*argv,"-key") == 0)
 381                         {
 382                         if (--argc < 1) goto bad;
 383                         key= *(++argv);
 384                         }
 385                 else if (strcmp(*argv,"-cert") == 0)
 386                         {
 387                         if (--argc < 1) goto bad;
 388                         certfile= *(++argv);
 389                         }
 390                 else if (strcmp(*argv,"-in") == 0)
 391                         {
 392                         if (--argc < 1) goto bad;
 393                         infile= *(++argv);
 394                         req=1;
 395                         }
 396                 else if (strcmp(*argv,"-out") == 0)
 397                         {
 398                         if (--argc < 1) goto bad;
 399                         outfile= *(++argv);
 400                         }
 401                 else if (strcmp(*argv,"-outdir") == 0)
 402                         {
 403                         if (--argc < 1) goto bad;
 404                         outdir= *(++argv);
 405                         }
 406                 else if (strcmp(*argv,"-notext") == 0)
 407                         notext=1;
 408                 else if (strcmp(*argv,"-batch") == 0)
 409                         batch=1;
 410                 else if (strcmp(*argv,"-preserveDN") == 0)
 411                         preserve=1;
 412                 else if (strcmp(*argv,"-gencrl") == 0)
 413                         gencrl=1;
 414                 else if (strcmp(*argv,"-msie_hack") == 0)
 415                         msie_hack=1;
 416                 else if (strcmp(*argv,"-crldays") == 0)
 417                         {
 418                         if (--argc < 1) goto bad;
 419                         crldays= atol(*(++argv));
 420                         }
 421                 else if (strcmp(*argv,"-crlhours") == 0)
 422                         {
 423                         if (--argc < 1) goto bad;
 424                         crlhours= atol(*(++argv));
 425                         }
 426                 else if (strcmp(*argv,"-infiles") == 0)
 427                         {
 428                         argc--;
 429                         argv++;
 430                         req=1;
 431                         break;
 432                         }
 433                 else if (strcmp(*argv, "-ss_cert") == 0)
 434                         {
 435                         if (--argc < 1) goto bad;
 436                         ss_cert_file = *(++argv);
 437                         req=1;
 438                         }
 439                 else if (strcmp(*argv, "-spkac") == 0)
 440                         {
 441                         if (--argc < 1) goto bad;
 442                         spkac_file = *(++argv);
 443                         req=1;
 444                         }
 445                 else if (strcmp(*argv,"-revoke") == 0)
 446                         {
 447                         if (--argc < 1) goto bad;
 448                         infile= *(++argv);
 449                         dorevoke=1;
 450                         }
 451                 else if (strcmp(*argv,"-extensions") == 0)
 452                         {
 453                         if (--argc < 1) goto bad;
 454                         extensions= *(++argv);
 455                         }
 456                 else if (strcmp(*argv,"-extfile") == 0)
 457                         {
 458                         if (--argc < 1) goto bad;
 459                         extfile= *(++argv);
 460                         }
 461                 else if (strcmp(*argv,"-status") == 0)
 462                         {
 463                         if (--argc < 1) goto bad;
 464                         ser_status= *(++argv);
 465                         }
 466                 else if (strcmp(*argv,"-updatedb") == 0)
 467                         {
 468                         doupdatedb=1;
 469                         }
 470                 else if (strcmp(*argv,"-crlexts") == 0)
 471                         {
 472                         if (--argc < 1) goto bad;
 473                         crl_ext= *(++argv);
 474                         }
 475                 else if (strcmp(*argv,"-crl_reason") == 0)
 476                         {
 477                         if (--argc < 1) goto bad;
 478                         rev_arg = *(++argv);
 479                         rev_type = REV_CRL_REASON;
 480                         }
 481                 else if (strcmp(*argv,"-crl_hold") == 0)
 482                         {
 483                         if (--argc < 1) goto bad;
 484                         rev_arg = *(++argv);
 485                         rev_type = REV_HOLD;
 486                         }
 487                 else if (strcmp(*argv,"-crl_compromise") == 0)
 488                         {
 489                         if (--argc < 1) goto bad;
 490                         rev_arg = *(++argv);
 491                         rev_type = REV_KEY_COMPROMISE;
 492                         }
 493                 else if (strcmp(*argv,"-crl_CA_compromise") == 0)
 494                         {
 495                         if (--argc < 1) goto bad;
 496                         rev_arg = *(++argv);
 497                         rev_type = REV_CA_COMPROMISE;
 498                         }
 499                 else if (strcmp(*argv,"-engine") == 0)
 500                         {
 501                         if (--argc < 1) goto bad;
 502                         engine= *(++argv);
 503                         }
 504                 else
 505                         {
 506 bad:
 507                         BIO_printf(bio_err,"unknown option %s\n",*argv);
 508                         badops=1;
 509                         break;
 510                         }
 511                 argc--;
 512                 argv++;
 513                 }
 514
 515         if (badops)
 516                 {
 517                 for (pp=ca_usage; (*pp != NULL); pp++)
 518                         BIO_printf(bio_err,"%s",*pp);
 519                 goto err;
 520                 }
 521
 522         ERR_load_crypto_strings();
 523
 524         if (engine != NULL)
 525                 {
 526                 if ((e = ENGINE_by_id(engine)) == NULL)
 527                         {
 528                         BIO_printf(bio_err,"invalid engine \"%s\"\n",
 529                                 engine);
 530                         goto err;
 531                         }
 532                 if (!ENGINE_set_default(e, ENGINE_METHOD_ALL))
 533                         {
 534                         BIO_printf(bio_err,"can't use that engine\n");
 535                         goto err;
 536                         }
 537                 BIO_printf(bio_err,"engine \"%s\" set.\n", engine);
 538                 /* Free our "structural" reference. */
 539                 ENGINE_free(e);
 540                 }
 541
 542         /*****************************************************************/
 543         if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
 544         if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
 545         if (configfile == NULL)
 546                 {
 547                 /* We will just use 'buf[0]' as a temporary buffer.  */
 548 #ifdef OPENSSL_SYS_VMS
 549                 strncpy(buf[0],X509_get_default_cert_area(),
 550                         sizeof(buf[0])-1-sizeof(CONFIG_FILE));
 551 #else
 552                 strncpy(buf[0],X509_get_default_cert_area(),
 553                         sizeof(buf[0])-2-sizeof(CONFIG_FILE));
 554                 strcat(buf[0],"/");
 555 #endif
 556                 strcat(buf[0],CONFIG_FILE);
 557                 configfile=buf[0];
 558                 }
 559
 560         BIO_printf(bio_err,"Using configuration from %s\n",configfile);
 561         if ((conf=CONF_load(NULL,configfile,&errorline)) == NULL)
 562                 {
 563                 if (errorline <= 0)
 564                         BIO_printf(bio_err,"error loading the config file '%s'\n",
 565                                 configfile);
 566                 else
 567                         BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
 568                                 ,errorline,configfile);
 569                 goto err;
 570                 }
 571
 572         /* Lets get the config section we are using */
 573         if (section == NULL)
 574                 {
 575                 section=CONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
 576                 if (section == NULL)
 577                         {
 578                         lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
 579                         goto err;
 580                         }
 581                 }
 582
 583         if (conf != NULL)
 584                 {
 585                 p=CONF_get_string(conf,NULL,"oid_file");
 586                 if (p == NULL)
 587                         ERR_clear_error();
 588                 if (p != NULL)
 589                         {
 590                         BIO *oid_bio;
 591
 592                         oid_bio=BIO_new_file(p,"r");
 593                         if (oid_bio == NULL)
 594                                 {
 595                                 /*
 596                                 BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
 597                                 ERR_print_errors(bio_err);
 598                                 */
 599                                 ERR_clear_error();
 600                                 }
 601                         else
 602                                 {
 603                                 OBJ_create_objects(oid_bio);
 604                                 BIO_free(oid_bio);
 605                                 }
 606                         }
 607                 if (!add_oid_section(bio_err,conf))
 608                         {
 609                         ERR_print_errors(bio_err);
 610                         goto err;
 611                         }
 612                 }
 613
 614         randfile = CONF_get_string(conf, BASE_SECTION, "RANDFILE");
 615         if (randfile == NULL)
 616                 ERR_clear_error();
 617         app_RAND_load_file(randfile, bio_err, 0);
 618
 619         in=BIO_new(BIO_s_file());
 620         out=BIO_new(BIO_s_file());
 621         Sout=BIO_new(BIO_s_file());
 622         Cout=BIO_new(BIO_s_file());
 623         if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
 624                 {
 625                 ERR_print_errors(bio_err);
 626                 goto err;
 627                 }
 628
 629         /*****************************************************************/
 630         /* report status of cert with serial number given on command line */
 631         if (ser_status)
 632         {
 633                 if ((dbfile=CONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 634                         {
 635                         lookup_fail(section,ENV_DATABASE);
 636                         goto err;
 637                         }
 638                 if (BIO_read_filename(in,dbfile) <= 0)
 639                         {
 640                         perror(dbfile);
 641                         BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
 642                         goto err;
 643                         }
 644                 db=TXT_DB_read(in,DB_NUMBER);
 645                 if (db == NULL) goto err;
 646
 647                 if (!TXT_DB_create_index(db, DB_serial, NULL,
 648                                         LHASH_HASH_FN(index_serial_hash),
 649                                         LHASH_COMP_FN(index_serial_cmp)))
 650                         {
 651                         BIO_printf(bio_err,
 652                           "error creating serial number index:(%ld,%ld,%ld)\n",
 653                                                 db->error,db->arg1,db->arg2);
 654                         goto err;
 655                         }
 656
 657                 if (get_certificate_status(ser_status,db) != 1)
 658                         BIO_printf(bio_err,"Error verifying serial %s!\n",
 659                                  ser_status);
 660                 goto err;
 661         }
 662
 663         /*****************************************************************/
 664         /* we definitely need a public key, so let's get it */
 665
 666         if ((keyfile == NULL) && ((keyfile=CONF_get_string(conf,
 667                 section,ENV_PRIVATE_KEY)) == NULL))
 668                 {
 669                 lookup_fail(section,ENV_PRIVATE_KEY);
 670                 goto err;
 671                 }
 672         if (!key && !app_passwd(bio_err, passargin, NULL, &key, NULL))
 673                 {
 674                 BIO_printf(bio_err,"Error getting password\n");
 675                 goto err;
 676                 }
 677         if (keyform == FORMAT_ENGINE)
 678                 {
 679                 if (!e)
 680                         {
 681                         BIO_printf(bio_err,"no engine specified\n");
 682                         goto err;
 683                         }
 684                 pkey = ENGINE_load_private_key(e, keyfile, key);
 685                 }
 686         else if (keyform == FORMAT_PEM)
 687                 {
 688                 if (BIO_read_filename(in,keyfile) <= 0)
 689                         {
 690                         perror(keyfile);
 691                         BIO_printf(bio_err,"trying to load CA private key\n");
 692                         goto err;
 693                         }
 694                 pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,key);
 695                 }
 696         else
 697                 {
 698                 BIO_printf(bio_err,"bad input format specified for key file\n");
 699                 goto err;
 700                 }
 701         if (key) memset(key,0,strlen(key));
 702         if (pkey == NULL)
 703                 {
 704                 BIO_printf(bio_err,"unable to load CA private key\n");
 705                 goto err;
 706                 }
 707
 708         /*****************************************************************/
 709         /* we need a certificate */
 710         if ((certfile == NULL) && ((certfile=CONF_get_string(conf,
 711                 section,ENV_CERTIFICATE)) == NULL))
 712                 {
 713                 lookup_fail(section,ENV_CERTIFICATE);
 714                 goto err;
 715                 }
 716         if (BIO_read_filename(in,certfile) <= 0)
 717                 {
 718                 perror(certfile);
 719                 BIO_printf(bio_err,"trying to load CA certificate\n");
 720                 goto err;
 721                 }
 722         x509=PEM_read_bio_X509(in,NULL,NULL,NULL);
 723         if (x509 == NULL)
 724                 {
 725                 BIO_printf(bio_err,"unable to load CA certificate\n");
 726                 goto err;
 727                 }
 728
 729         if (!X509_check_private_key(x509,pkey))
 730                 {
 731                 BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
 732                 goto err;
 733                 }
 734
 735         f=CONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
 736         if (f == NULL)
 737                 ERR_clear_error();
 738         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 739                 preserve=1;
 740         f=CONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
 741         if (f == NULL)
 742                 ERR_clear_error();
 743         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 744                 msie_hack=1;
 745
 746         /*****************************************************************/
 747         /* lookup where to write new certificates */
 748         if ((outdir == NULL) && (req))
 749                 {
 750                 struct stat sb;
 751
 752                 if ((outdir=CONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
 753                         == NULL)
 754                         {
 755                         BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
 756                         goto err;
 757                         }
 758 #ifndef OPENSSL_SYS_VMS
 759             /* outdir is a directory spec, but access() for VMS demands a
 760                filename.  In any case, stat(), below, will catch the problem
 761                if outdir is not a directory spec, and the fopen() or open()
 762                will catch an error if there is no write access.
 763
 764                Presumably, this problem could also be solved by using the DEC
 765                C routines to convert the directory syntax to Unixly, and give
 766                that to access().  However, time's too short to do that just
 767                now.
 768             */
 769                 if (access(outdir,R_OK|W_OK|X_OK) != 0)
 770                         {
 771                         BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
 772                         perror(outdir);
 773                         goto err;
 774                         }
 775
 776                 if (stat(outdir,&sb) != 0)
 777                         {
 778                         BIO_printf(bio_err,"unable to stat(%s)\n",outdir);
 779                         perror(outdir);
 780                         goto err;
 781                         }
 782 #ifdef S_IFDIR
 783                 if (!(sb.st_mode & S_IFDIR))
 784                         {
 785                         BIO_printf(bio_err,"%s need to be a directory\n",outdir);
 786                         perror(outdir);
 787                         goto err;
 788                         }
 789 #endif
 790 #endif
 791                 }
 792
 793         /*****************************************************************/
 794         /* we need to load the database file */
 795         if ((dbfile=CONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 796                 {
 797                 lookup_fail(section,ENV_DATABASE);
 798                 goto err;
 799                 }
 800         if (BIO_read_filename(in,dbfile) <= 0)
 801                 {
 802                 perror(dbfile);
 803                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
 804                 goto err;
 805                 }
 806         db=TXT_DB_read(in,DB_NUMBER);
 807         if (db == NULL) goto err;
 808
 809         /* Lets check some fields */
 810         for (i=0; i<sk_num(db->data); i++)
 811                 {
 812                 pp=(char **)sk_value(db->data,i);
 813                 if ((pp[DB_type][0] != DB_TYPE_REV) &&
 814                         (pp[DB_rev_date][0] != '\0'))
 815                         {
 816                         BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
 817                         goto err;
 818                         }
 819                 if ((pp[DB_type][0] == DB_TYPE_REV) &&
 820                         !make_revoked(NULL, pp[DB_rev_date]))
 821                         {
 822                         BIO_printf(bio_err," in entry %d\n", i+1);
 823                         goto err;
 824                         }
 825                 if (!check_time_format(pp[DB_exp_date]))
 826                         {
 827                         BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
 828                         goto err;
 829                         }
 830                 p=pp[DB_serial];
 831                 j=strlen(p);
 832                 if (*p == '-')
 833                         {
 834                         p++;
 835                         j--;
 836                         }
 837                 if ((j&1) || (j < 2))
 838                         {
 839                         BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
 840                         goto err;
 841                         }
 842                 while (*p)
 843                         {
 844                         if (!(  ((*p >= '0') && (*p <= '9')) ||
 845                                 ((*p >= 'A') && (*p <= 'F')) ||
 846                                 ((*p >= 'a') && (*p <= 'f')))  )
 847                                 {
 848                                 BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
 849                                 goto err;
 850                                 }
 851                         p++;
 852                         }
 853                 }
 854         if (verbose)
 855                 {
 856                 BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
 857 #ifdef OPENSSL_SYS_VMS
 858                 {
 859                 BIO *tmpbio = BIO_new(BIO_f_linebuffer());
 860                 out = BIO_push(tmpbio, out);
 861                 }
 862 #endif
 863                 TXT_DB_write(out,db);
 864                 BIO_printf(bio_err,"%d entries loaded from the database\n",
 865                         db->data->num);
 866                 BIO_printf(bio_err,"generating index\n");
 867                 }
 868
 869         if (!TXT_DB_create_index(db, DB_serial, NULL,
 870                         LHASH_HASH_FN(index_serial_hash),
 871                         LHASH_COMP_FN(index_serial_cmp)))
 872                 {
 873                 BIO_printf(bio_err,"error creating serial number index:(%ld,%ld,%ld)\n",db->error,db->arg1,db->arg2);
 874                 goto err;
 875                 }
 876
 877         if (!TXT_DB_create_index(db, DB_name, index_name_qual,
 878                         LHASH_HASH_FN(index_name_hash),
 879                         LHASH_COMP_FN(index_name_cmp)))
 880                 {
 881                 BIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\n",
 882                         db->error,db->arg1,db->arg2);
 883                 goto err;
 884                 }
 885
 886         /*****************************************************************/
 887         /* Update the db file for expired certificates */
 888         if (doupdatedb)
 889                 {
 890                 if (verbose)
 891                         BIO_printf(bio_err, "Updating %s ...\n",
 892                                                         dbfile);
 893
 894                 i = do_updatedb(db);
 895                 if (i == -1)
 896                         {
 897                         BIO_printf(bio_err,"Malloc failure\n");
 898                         goto err;
 899                         }
 900                 else if (i == 0)
 901                         {
 902                         if (verbose) BIO_printf(bio_err,
 903                                         "No entries found to mark expired\n");
 904                         }
 905                 else
 906                         {
 907                         out = BIO_new(BIO_s_file());
 908                         if (out == NULL)
 909                                 {
 910                                 ERR_print_errors(bio_err);
 911                                 goto err;
 912                                 }
 913
 914                         j = BIO_snprintf(buf[0], sizeof buf[0], "%s.new", dbfile);
 915                         if (j < 0 || j >= sizeof buf[0])
 916                                 {
 917                                 BIO_printf(bio_err, "file name too long\n");
 918                                 goto err;
 919                                 }
 920                         if (BIO_write_filename(out,buf[0]) <= 0)
 921                                 {
 922                                 perror(dbfile);
 923                                 BIO_printf(bio_err,"unable to open '%s'\n",
 924                                                                         dbfile);
 925                                 goto err;
 926                                 }
 927                         j=TXT_DB_write(out,db);
 928                         if (j <= 0) goto err;
 929
 930                         BIO_free(out);
 931                         out = NULL;
 932                         j = BIO_snprintf(buf[1], sizeof buf[1], "%s.old", dbfile);
 933                         if (j < 0 || j >= sizeof buf[1])
 934                                 {
 935                                 BIO_printf(bio_err, "file name too long\n");
 936                                 goto err;
 937                                 }
 938                         if (rename(dbfile,buf[1]) < 0)
 939                                 {
 940                                 BIO_printf(bio_err,
 941                                                 "unable to rename %s to %s\n",
 942                                                 dbfile, buf[1]);
 943                                 perror("reason");
 944                                 goto err;
 945                                 }
 946                         if (rename(buf[0],dbfile) < 0)
 947                                 {
 948                                 BIO_printf(bio_err,
 949                                                 "unable to rename %s to %s\n",
 950                                                 buf[0],dbfile);
 951                                 perror("reason");
 952                                 rename(buf[1],dbfile);
 953                                 goto err;
 954                                 }
 955
 956                         if (verbose) BIO_printf(bio_err,
 957                                 "Done. %d entries marked as expired\n",i);
 958                         }
 959                         goto err;
 960                 }
 961
 962         /*****************************************************************/
 963         /* Read extentions config file                                   */
 964         if (extfile)
 965                 {
 966                 if (!(extconf=CONF_load(NULL,extfile,&errorline)))
 967                         {
 968                         if (errorline <= 0)
 969                                 BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
 970                                         extfile);
 971                         else
 972                                 BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
 973                                         errorline,extfile);
 974                         ret = 1;
 975                         goto err;
 976                         }
 977
 978                 if (verbose)
 979                         BIO_printf(bio_err, "Succesfully loaded extensions file %s\n", extfile);
 980
 981                 /* We can have sections in the ext file */
 982                 if (!extensions && !(extensions = CONF_get_string(extconf, "default", "extensions")))
 983                         extensions = "default";
 984                 }
 985
 986         /*****************************************************************/
 987         if (req || gencrl)
 988                 {
 989                 if (outfile != NULL)
 990                         {
 991                         if (BIO_write_filename(Sout,outfile) <= 0)
 992                                 {
 993                                 perror(outfile);
 994                                 goto err;
 995                                 }
 996                         }
 997                 else
 998                         {
 999                         BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
1000 #ifdef OPENSSL_SYS_VMS
1001                         {
1002                         BIO *tmpbio = BIO_new(BIO_f_linebuffer());
1003                         Sout = BIO_push(tmpbio, Sout);
1004                         }
1005 #endif
1006                         }
1007                 }
1008
1009         if (req)
1010                 {
1011                 if ((md == NULL) && ((md=CONF_get_string(conf,
1012                         section,ENV_DEFAULT_MD)) == NULL))
1013                         {
1014                         lookup_fail(section,ENV_DEFAULT_MD);
1015                         goto err;
1016                         }
1017                 if ((dgst=EVP_get_digestbyname(md)) == NULL)
1018                         {
1019                         BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1020                         goto err;
1021                         }
1022                 if (verbose)
1023                         BIO_printf(bio_err,"message digest is %s\n",
1024                                 OBJ_nid2ln(dgst->type));
1025                 if ((policy == NULL) && ((policy=CONF_get_string(conf,
1026                         section,ENV_POLICY)) == NULL))
1027                         {
1028                         lookup_fail(section,ENV_POLICY);
1029                         goto err;
1030                         }
1031                 if (verbose)
1032                         BIO_printf(bio_err,"policy is %s\n",policy);
1033
1034                 if ((serialfile=CONF_get_string(conf,section,ENV_SERIAL))
1035                         == NULL)
1036                         {
1037                         lookup_fail(section,ENV_SERIAL);
1038                         goto err;
1039                         }
1040
1041                 if (!extconf)
1042                         {
1043                         /* no '-extfile' option, so we look for extensions
1044                          * in the main configuration file */
1045                         if (!extensions)
1046                                 {
1047                                 extensions=CONF_get_string(conf,section,
1048                                                                 ENV_EXTENSIONS);
1049                                 if (!extensions)
1050                                         ERR_clear_error();
1051                                 }
1052                         if (extensions)
1053                                 {
1054                                 /* Check syntax of file */
1055                                 X509V3_CTX ctx;
1056                                 X509V3_set_ctx_test(&ctx);
1057                                 X509V3_set_conf_lhash(&ctx, conf);
1058                                 if (!X509V3_EXT_add_conf(conf, &ctx, extensions,
1059                                                                 NULL))
1060                                         {
1061                                         BIO_printf(bio_err,
1062                                         "Error Loading extension section %s\n",
1063                                                                  extensions);
1064                                         ret = 1;
1065                                         goto err;
1066                                         }
1067                                 }
1068                         }
1069
1070                 if (startdate == NULL)
1071                         {
1072                         startdate=CONF_get_string(conf,section,
1073                                 ENV_DEFAULT_STARTDATE);
1074                         if (startdate == NULL)
1075                                 ERR_clear_error();
1076                         }
1077                 if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))
1078                         {
1079                         BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");
1080                         goto err;
1081                         }
1082                 if (startdate == NULL) startdate="today";
1083
1084                 if (enddate == NULL)
1085                         {
1086                         enddate=CONF_get_string(conf,section,
1087                                 ENV_DEFAULT_ENDDATE);
1088                         if (enddate == NULL)
1089                                 ERR_clear_error();
1090                         }
1091                 if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))
1092                         {
1093                         BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");
1094                         goto err;
1095                         }
1096
1097                 if (days == 0)
1098                         {
1099                         days=(int)CONF_get_number(conf,section,
1100                                 ENV_DEFAULT_DAYS);
1101                         }
1102                 if (!enddate && (days == 0))
1103                         {
1104                         BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
1105                         goto err;
1106                         }
1107
1108                 if ((serial=load_serial(serialfile)) == NULL)
1109                         {
1110                         BIO_printf(bio_err,"error while loading serial number\n");
1111                         goto err;
1112                         }
1113                 if (verbose)
1114                         {
1115                         if ((f=BN_bn2hex(serial)) == NULL) goto err;
1116                         BIO_printf(bio_err,"next serial number is %s\n",f);
1117                         OPENSSL_free(f);
1118                         }
1119
1120                 if ((attribs=CONF_get_section(conf,policy)) == NULL)
1121                         {
1122                         BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
1123                         goto err;
1124                         }
1125
1126                 if ((cert_sk=sk_X509_new_null()) == NULL)
1127                         {
1128                         BIO_printf(bio_err,"Memory allocation failure\n");
1129                         goto err;
1130                         }
1131                 if (spkac_file != NULL)
1132                         {
1133                         total++;
1134                         j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
1135                                 serial,startdate,enddate, days,extensions,conf,
1136                                 verbose);
1137                         if (j < 0) goto err;
1138                         if (j > 0)
1139                                 {
1140                                 total_done++;
1141                                 BIO_printf(bio_err,"\n");
1142                                 if (!BN_add_word(serial,1)) goto err;
1143                                 if (!sk_X509_push(cert_sk,x))
1144                                         {
1145                                         BIO_printf(bio_err,"Memory allocation failure\n");
1146                                         goto err;
1147                                         }
1148                                 if (outfile)
1149                                         {
1150                                         output_der = 1;
1151                                         batch = 1;
1152                                         }
1153                                 }
1154                         }
1155                 if (ss_cert_file != NULL)
1156                         {
1157                         total++;
1158                         j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
1159                                 db,serial,startdate,enddate,days,batch,
1160                                 extensions,conf,verbose);
1161                         if (j < 0) goto err;
1162                         if (j > 0)
1163                                 {
1164                                 total_done++;
1165                                 BIO_printf(bio_err,"\n");
1166                                 if (!BN_add_word(serial,1)) goto err;
1167                                 if (!sk_X509_push(cert_sk,x))
1168                                         {
1169                                         BIO_printf(bio_err,"Memory allocation failure\n");
1170                                         goto err;
1171                                         }
1172                                 }
1173                         }
1174                 if (infile != NULL)
1175                         {
1176                         total++;
1177                         j=certify(&x,infile,pkey,x509,dgst,attribs,db,
1178                                 serial,startdate,enddate,days,batch,
1179                                 extensions,conf,verbose);
1180                         if (j < 0) goto err;
1181                         if (j > 0)
1182                                 {
1183                                 total_done++;
1184                                 BIO_printf(bio_err,"\n");
1185                                 if (!BN_add_word(serial,1)) goto err;
1186                                 if (!sk_X509_push(cert_sk,x))
1187                                         {
1188                                         BIO_printf(bio_err,"Memory allocation failure\n");
1189                                         goto err;
1190                                         }
1191                                 }
1192                         }
1193                 for (i=0; i<argc; i++)
1194                         {
1195                         total++;
1196                         j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
1197                                 serial,startdate,enddate,days,batch,
1198                                 extensions,conf,verbose);
1199                         if (j < 0) goto err;
1200                         if (j > 0)
1201                                 {
1202                                 total_done++;
1203                                 BIO_printf(bio_err,"\n");
1204                                 if (!BN_add_word(serial,1)) goto err;
1205                                 if (!sk_X509_push(cert_sk,x))
1206                                         {
1207                                         BIO_printf(bio_err,"Memory allocation failure\n");
1208                                         goto err;
1209                                         }
1210                                 }
1211                         }
1212                 /* we have a stack of newly certified certificates
1213                  * and a data base and serial number that need
1214                  * updating */
1215
1216                 if (sk_X509_num(cert_sk) > 0)
1217                         {
1218                         if (!batch)
1219                                 {
1220                                 BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
1221                                 (void)BIO_flush(bio_err);
1222                                 buf[0][0]='\0';
1223                                 fgets(buf[0],10,stdin);
1224                                 if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
1225                                         {
1226                                         BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
1227                                         ret=0;
1228                                         goto err;
1229                                         }
1230                                 }
1231
1232                         BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
1233
1234                         strncpy(buf[0],serialfile,BSIZE-4);
1235
1236 #ifdef OPENSSL_SYS_VMS
1237                         strcat(buf[0],"-new");
1238 #else
1239                         strcat(buf[0],".new");
1240 #endif
1241
1242                         if (!save_serial(buf[0],serial)) goto err;
1243
1244                         strncpy(buf[1],dbfile,BSIZE-4);
1245
1246 #ifdef OPENSSL_SYS_VMS
1247                         strcat(buf[1],"-new");
1248 #else
1249                         strcat(buf[1],".new");
1250 #endif
1251
1252                         if (BIO_write_filename(out,buf[1]) <= 0)
1253                                 {
1254                                 perror(dbfile);
1255                                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
1256                                 goto err;
1257                                 }
1258                         l=TXT_DB_write(out,db);
1259                         if (l <= 0) goto err;
1260                         }
1261
1262                 if (verbose)
1263                         BIO_printf(bio_err,"writing new certificates\n");
1264                 for (i=0; i<sk_X509_num(cert_sk); i++)
1265                         {
1266                         int k;
1267                         unsigned char *n;
1268
1269                         x=sk_X509_value(cert_sk,i);
1270
1271                         j=x->cert_info->serialNumber->length;
1272                         p=(char *)x->cert_info->serialNumber->data;
1273
1274                         strncpy(buf[2],outdir,BSIZE-(j*2)-6);
1275
1276 #ifndef OPENSSL_SYS_VMS
1277                         strcat(buf[2],"/");
1278 #endif
1279
1280                         n=(unsigned char *)&(buf[2][strlen(buf[2])]);
1281                         if (j > 0)
1282                                 {
1283                                 for (k=0; k<j; k++)
1284                                         {
1285                                         sprintf((char *)n,"%02X",(unsigned char)*(p++));
1286                                         n+=2;
1287                                         }
1288                                 }
1289                         else
1290                                 {
1291                                 *(n++)='0';
1292                                 *(n++)='0';
1293                                 }
1294                         *(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
1295                         *n='\0';
1296                         if (verbose)
1297                                 BIO_printf(bio_err,"writing %s\n",buf[2]);
1298
1299                         if (BIO_write_filename(Cout,buf[2]) <= 0)
1300                                 {
1301                                 perror(buf[2]);
1302                                 goto err;
1303                                 }
1304                         write_new_certificate(Cout,x, 0, notext);
1305                         write_new_certificate(Sout,x, output_der, notext);
1306                         }
1307
1308                 if (sk_X509_num(cert_sk))
1309                         {
1310                         /* Rename the database and the serial file */
1311                         strncpy(buf[2],serialfile,BSIZE-4);
1312
1313 #ifdef OPENSSL_SYS_VMS
1314                         strcat(buf[2],"-old");
1315 #else
1316                         strcat(buf[2],".old");
1317 #endif
1318
1319                         BIO_free(in);
1320                         BIO_free_all(out);
1321                         in=NULL;
1322                         out=NULL;
1323                         if (rename(serialfile,buf[2]) < 0)
1324                                 {
1325                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1326                                         serialfile,buf[2]);
1327                                 perror("reason");
1328                                 goto err;
1329                                 }
1330                         if (rename(buf[0],serialfile) < 0)
1331                                 {
1332                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1333                                         buf[0],serialfile);
1334                                 perror("reason");
1335                                 rename(buf[2],serialfile);
1336                                 goto err;
1337                                 }
1338
1339                         strncpy(buf[2],dbfile,BSIZE-4);
1340
1341 #ifdef OPENSSL_SYS_VMS
1342                         strcat(buf[2],"-old");
1343 #else
1344                         strcat(buf[2],".old");
1345 #endif
1346
1347                         if (rename(dbfile,buf[2]) < 0)
1348                                 {
1349                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1350                                         dbfile,buf[2]);
1351                                 perror("reason");
1352                                 goto err;
1353                                 }
1354                         if (rename(buf[1],dbfile) < 0)
1355                                 {
1356                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1357                                         buf[1],dbfile);
1358                                 perror("reason");
1359                                 rename(buf[2],dbfile);
1360                                 goto err;
1361                                 }
1362                         BIO_printf(bio_err,"Data Base Updated\n");
1363                         }
1364                 }
1365
1366         /*****************************************************************/
1367         if (gencrl)
1368                 {
1369                 int crl_v2 = 0;
1370                 if (!crl_ext)
1371                         {
1372                         crl_ext=CONF_get_string(conf,section,ENV_CRLEXT);
1373                         if (!crl_ext)
1374                                 ERR_clear_error();
1375                         }
1376                 if (crl_ext)
1377                         {
1378                         /* Check syntax of file */
1379                         X509V3_CTX ctx;
1380                         X509V3_set_ctx_test(&ctx);
1381                         X509V3_set_conf_lhash(&ctx, conf);
1382                         if (!X509V3_EXT_add_conf(conf, &ctx, crl_ext, NULL))
1383                                 {
1384                                 BIO_printf(bio_err,
1385                                  "Error Loading CRL extension section %s\n",
1386                                                                  crl_ext);
1387                                 ret = 1;
1388                                 goto err;
1389                                 }
1390                         }
1391
1392                 if (!crldays && !crlhours)
1393                         {
1394                         crldays=CONF_get_number(conf,section,
1395                                 ENV_DEFAULT_CRL_DAYS);
1396                         crlhours=CONF_get_number(conf,section,
1397                                 ENV_DEFAULT_CRL_HOURS);
1398                         }
1399                 if ((crldays == 0) && (crlhours == 0))
1400                         {
1401                         BIO_printf(bio_err,"cannot lookup how long until the next CRL is issuer\n");
1402                         goto err;
1403                         }
1404
1405                 if (verbose) BIO_printf(bio_err,"making CRL\n");
1406                 if ((crl=X509_CRL_new()) == NULL) goto err;
1407                 ci=crl->crl;
1408                 X509_NAME_free(ci->issuer);
1409                 ci->issuer=X509_NAME_dup(x509->cert_info->subject);
1410                 if (ci->issuer == NULL) goto err;
1411
1412                 X509_gmtime_adj(ci->lastUpdate,0);
1413                 if (ci->nextUpdate == NULL)
1414                         ci->nextUpdate=ASN1_UTCTIME_new();
1415                 X509_gmtime_adj(ci->nextUpdate,(crldays*24+crlhours)*60*60);
1416
1417                 for (i=0; i<sk_num(db->data); i++)
1418                         {
1419                         pp=(char **)sk_value(db->data,i);
1420                         if (pp[DB_type][0] == DB_TYPE_REV)
1421                                 {
1422                                 if ((r=X509_REVOKED_new()) == NULL) goto err;
1423                                 j = make_revoked(r, pp[DB_rev_date]);
1424                                 if (!j) goto err;
1425                                 if (j == 2) crl_v2 = 1;
1426                                 if (!BN_hex2bn(&serial, pp[DB_serial]))
1427                                         goto err;
1428                                 r->serialNumber = BN_to_ASN1_INTEGER(serial, r->serialNumber);
1429                                 BN_free(serial);
1430                                 serial = NULL;
1431                                 if (!r->serialNumber)
1432                                         goto err;
1433                                 X509_CRL_add0_revoked(crl,r);
1434                                 }
1435                         }
1436                 /* sort the data so it will be written in serial
1437                  * number order */
1438                 sk_X509_REVOKED_sort(ci->revoked);
1439                 for (i=0; i<sk_X509_REVOKED_num(ci->revoked); i++)
1440                         {
1441                         r=sk_X509_REVOKED_value(ci->revoked,i);
1442                         r->sequence=i;
1443                         }
1444
1445                 /* we now have a CRL */
1446                 if (verbose) BIO_printf(bio_err,"signing CRL\n");
1447                 if (md != NULL)
1448                         {
1449                         if ((dgst=EVP_get_digestbyname(md)) == NULL)
1450                                 {
1451                                 BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1452                                 goto err;
1453                                 }
1454                         }
1455                 else
1456                         {
1457 #ifndef OPENSSL_NO_DSA
1458                         if (pkey->type == EVP_PKEY_DSA)
1459                                 dgst=EVP_dss1();
1460                         else
1461 #endif
1462                                 dgst=EVP_md5();
1463                         }
1464
1465                 /* Add any extensions asked for */
1466
1467                 if (crl_ext)
1468                         {
1469                         X509V3_CTX crlctx;
1470                         if (ci->version == NULL)
1471                                 if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;
1472                         X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
1473                         X509V3_set_conf_lhash(&crlctx, conf);
1474
1475                         if (!X509V3_EXT_CRL_add_conf(conf, &crlctx,
1476                                 crl_ext, crl)) goto err;
1477                         }
1478                 if (crl_ext || crl_v2)
1479                         {
1480                         if (ci->version == NULL)
1481                                 if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;
1482                         ASN1_INTEGER_set(ci->version,1); /* version 2 CRL */
1483                         }
1484
1485                 if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
1486
1487                 PEM_write_bio_X509_CRL(Sout,crl);
1488                 }
1489         /*****************************************************************/
1490         if (dorevoke)
1491                 {
1492                 if (infile == NULL)
1493                         {
1494                         BIO_printf(bio_err,"no input files\n");
1495                         goto err;
1496                         }
1497                 else
1498                         {
1499                         X509 *revcert;
1500                         if (BIO_read_filename(in,infile) <= 0)
1501                                 {
1502                                 perror(infile);
1503                                 BIO_printf(bio_err,"error trying to load '%s' certificate\n",infile);
1504                                 goto err;
1505                                 }
1506                         revcert=PEM_read_bio_X509(in,NULL,NULL,NULL);
1507                         if (revcert == NULL)
1508                                 {
1509                                 BIO_printf(bio_err,"unable to load '%s' certificate\n",infile);
1510                                 goto err;
1511                                 }
1512                         j=do_revoke(revcert,db, rev_type, rev_arg);
1513                         if (j <= 0) goto err;
1514                         X509_free(revcert);
1515
1516                         strncpy(buf[0],dbfile,BSIZE-4);
1517                         strcat(buf[0],".new");
1518                         if (BIO_write_filename(out,buf[0]) <= 0)
1519                                 {
1520                                 perror(dbfile);
1521                                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
1522                                 goto err;
1523                                 }
1524                         j=TXT_DB_write(out,db);
1525                         if (j <= 0) goto err;
1526                         strncpy(buf[1],dbfile,BSIZE-4);
1527                         strcat(buf[1],".old");
1528                         if (rename(dbfile,buf[1]) < 0)
1529                                 {
1530                                 BIO_printf(bio_err,"unable to rename %s to %s\n", dbfile, buf[1]);
1531                                 perror("reason");
1532                                 goto err;
1533                                 }
1534                         if (rename(buf[0],dbfile) < 0)
1535                                 {
1536                                 BIO_printf(bio_err,"unable to rename %s to %s\n", buf[0],dbfile);
1537                                 perror("reason");
1538                                 rename(buf[1],dbfile);
1539                                 goto err;
1540                                 }
1541                         BIO_printf(bio_err,"Data Base Updated\n");
1542                         }
1543                 }
1544         /*****************************************************************/
1545         ret=0;
1546 err:
1547         BIO_free_all(Cout);
1548         BIO_free_all(Sout);
1549         BIO_free_all(out);
1550         BIO_free(in);
1551
1552         sk_X509_pop_free(cert_sk,X509_free);
1553
1554         if (ret) ERR_print_errors(bio_err);
1555         app_RAND_write_file(randfile, bio_err);
1556         BN_free(serial);
1557         TXT_DB_free(db);
1558         EVP_PKEY_free(pkey);
1559         X509_free(x509);
1560         X509_CRL_free(crl);
1561         CONF_free(conf);
1562         OBJ_cleanup();
1563         EXIT(ret);
1564         }
1565
1566 static void lookup_fail(char *name, char *tag)
1567         {
1568         BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
1569         }
1570
1571 static unsigned long index_serial_hash(const char **a)
1572         {
1573         const char *n;
1574
1575         n=a[DB_serial];
1576         while (*n == '0') n++;
1577         return(lh_strhash(n));
1578         }
1579
1580 static int index_serial_cmp(const char **a, const char **b)
1581         {
1582         const char *aa,*bb;
1583
1584         for (aa=a[DB_serial]; *aa == '0'; aa++);
1585         for (bb=b[DB_serial]; *bb == '0'; bb++);
1586         return(strcmp(aa,bb));
1587         }
1588
1589 static unsigned long index_name_hash(const char **a)
1590         { return(lh_strhash(a[DB_name])); }
1591
1592 static int index_name_qual(char **a)
1593         { return(a[0][0] == 'V'); }
1594
1595 static int index_name_cmp(const char **a, const char **b)
1596         { return(strcmp(a[DB_name],
1597              b[DB_name])); }
1598
1599 static BIGNUM *load_serial(char *serialfile)
1600         {
1601         BIO *in=NULL;
1602         BIGNUM *ret=NULL;
1603         MS_STATIC char buf[1024];
1604         ASN1_INTEGER *ai=NULL;
1605
1606         if ((in=BIO_new(BIO_s_file())) == NULL)
1607                 {
1608                 ERR_print_errors(bio_err);
1609                 goto err;
1610                 }
1611
1612         if (BIO_read_filename(in,serialfile) <= 0)
1613                 {
1614                 perror(serialfile);
1615                 goto err;
1616                 }
1617         ai=ASN1_INTEGER_new();
1618         if (ai == NULL) goto err;
1619         if (!a2i_ASN1_INTEGER(in,ai,buf,1024))
1620                 {
1621                 BIO_printf(bio_err,"unable to load number from %s\n",
1622                         serialfile);
1623                 goto err;
1624                 }
1625         ret=ASN1_INTEGER_to_BN(ai,NULL);
1626         if (ret == NULL)
1627                 {
1628                 BIO_printf(bio_err,"error converting number from bin to BIGNUM");
1629                 goto err;
1630                 }
1631 err:
1632         if (in != NULL) BIO_free(in);
1633         if (ai != NULL) ASN1_INTEGER_free(ai);
1634         return(ret);
1635         }
1636
1637 static int save_serial(char *serialfile, BIGNUM *serial)
1638         {
1639         BIO *out;
1640         int ret=0;
1641         ASN1_INTEGER *ai=NULL;
1642
1643         out=BIO_new(BIO_s_file());
1644         if (out == NULL)
1645                 {
1646                 ERR_print_errors(bio_err);
1647                 goto err;
1648                 }
1649         if (BIO_write_filename(out,serialfile) <= 0)
1650                 {
1651                 perror(serialfile);
1652                 goto err;
1653                 }
1654
1655         if ((ai=BN_to_ASN1_INTEGER(serial,NULL)) == NULL)
1656                 {
1657                 BIO_printf(bio_err,"error converting serial to ASN.1 format\n");
1658                 goto err;
1659                 }
1660         i2a_ASN1_INTEGER(out,ai);
1661         BIO_puts(out,"\n");
1662         ret=1;
1663 err:
1664         if (out != NULL) BIO_free_all(out);
1665         if (ai != NULL) ASN1_INTEGER_free(ai);
1666         return(ret);
1667         }
1668
1669 static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1670              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
1671              BIGNUM *serial, char *startdate, char *enddate, int days,
1672              int batch, char *ext_sect, LHASH *lconf, int verbose)
1673         {
1674         X509_REQ *req=NULL;
1675         BIO *in=NULL;
1676         EVP_PKEY *pktmp=NULL;
1677         int ok= -1,i;
1678
1679         in=BIO_new(BIO_s_file());
1680
1681         if (BIO_read_filename(in,infile) <= 0)
1682                 {
1683                 perror(infile);
1684                 goto err;
1685                 }
1686         if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
1687                 {
1688                 BIO_printf(bio_err,"Error reading certificate request in %s\n",
1689                         infile);
1690                 goto err;
1691                 }
1692         if (verbose)
1693                 X509_REQ_print(bio_err,req);
1694
1695         BIO_printf(bio_err,"Check that the request matches the signature\n");
1696
1697         if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
1698                 {
1699                 BIO_printf(bio_err,"error unpacking public key\n");
1700                 goto err;
1701                 }
1702         i=X509_REQ_verify(req,pktmp);
1703         EVP_PKEY_free(pktmp);
1704         if (i < 0)
1705                 {
1706                 ok=0;
1707                 BIO_printf(bio_err,"Signature verification problems....\n");
1708                 goto err;
1709                 }
1710         if (i == 0)
1711                 {
1712                 ok=0;
1713                 BIO_printf(bio_err,"Signature did not match the certificate request\n");
1714                 goto err;
1715                 }
1716         else
1717                 BIO_printf(bio_err,"Signature ok\n");
1718
1719         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,startdate, enddate,
1720                 days,batch,verbose,req,ext_sect,lconf);
1721
1722 err:
1723         if (req != NULL) X509_REQ_free(req);
1724         if (in != NULL) BIO_free(in);
1725         return(ok);
1726         }
1727
1728 static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1729              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
1730              BIGNUM *serial, char *startdate, char *enddate, int days,
1731              int batch, char *ext_sect, LHASH *lconf, int verbose)
1732         {
1733         X509 *req=NULL;
1734         X509_REQ *rreq=NULL;
1735         BIO *in=NULL;
1736         EVP_PKEY *pktmp=NULL;
1737         int ok= -1,i;
1738
1739         in=BIO_new(BIO_s_file());
1740
1741         if (BIO_read_filename(in,infile) <= 0)
1742                 {
1743                 perror(infile);
1744                 goto err;
1745                 }
1746         if ((req=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL)
1747                 {
1748                 BIO_printf(bio_err,"Error reading self signed certificate in %s\n",infile);
1749                 goto err;
1750                 }
1751         if (verbose)
1752                 X509_print(bio_err,req);
1753
1754         BIO_printf(bio_err,"Check that the request matches the signature\n");
1755
1756         if ((pktmp=X509_get_pubkey(req)) == NULL)
1757                 {
1758                 BIO_printf(bio_err,"error unpacking public key\n");
1759                 goto err;
1760                 }
1761         i=X509_verify(req,pktmp);
1762         EVP_PKEY_free(pktmp);
1763         if (i < 0)
1764                 {
1765                 ok=0;
1766                 BIO_printf(bio_err,"Signature verification problems....\n");
1767                 goto err;
1768                 }
1769         if (i == 0)
1770                 {
1771                 ok=0;
1772                 BIO_printf(bio_err,"Signature did not match the certificate\n");
1773                 goto err;
1774                 }
1775         else
1776                 BIO_printf(bio_err,"Signature ok\n");
1777
1778         if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
1779                 goto err;
1780
1781         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,startdate,enddate,days,
1782                 batch,verbose,rreq,ext_sect,lconf);
1783
1784 err:
1785         if (rreq != NULL) X509_REQ_free(rreq);
1786         if (req != NULL) X509_free(req);
1787         if (in != NULL) BIO_free(in);
1788         return(ok);
1789         }
1790
1791 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
1792              STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,
1793              char *startdate, char *enddate, int days, int batch, int verbose,
1794              X509_REQ *req, char *ext_sect, LHASH *lconf)
1795         {
1796         X509_NAME *name=NULL,*CAname=NULL,*subject=NULL;
1797         ASN1_UTCTIME *tm,*tmptm;
1798         ASN1_STRING *str,*str2;
1799         ASN1_OBJECT *obj;
1800         X509 *ret=NULL;
1801         X509_CINF *ci;
1802         X509_NAME_ENTRY *ne;
1803         X509_NAME_ENTRY *tne,*push;
1804         EVP_PKEY *pktmp;
1805         int ok= -1,i,j,last,nid;
1806         char *p;
1807         CONF_VALUE *cv;
1808         char *row[DB_NUMBER],**rrow,**irow=NULL;
1809         char buf[25],*pbuf;
1810
1811         tmptm=ASN1_UTCTIME_new();
1812         if (tmptm == NULL)
1813                 {
1814                 BIO_printf(bio_err,"malloc error\n");
1815                 return(0);
1816                 }
1817
1818         for (i=0; i<DB_NUMBER; i++)
1819                 row[i]=NULL;
1820
1821         BIO_printf(bio_err,"The Subjects Distinguished Name is as follows\n");
1822         name=X509_REQ_get_subject_name(req);
1823         for (i=0; i<X509_NAME_entry_count(name); i++)
1824                 {
1825                 ne=(X509_NAME_ENTRY *)X509_NAME_get_entry(name,i);
1826                 obj=X509_NAME_ENTRY_get_object(ne);
1827                 j=i2a_ASN1_OBJECT(bio_err,obj);
1828                 str=X509_NAME_ENTRY_get_data(ne);
1829                 pbuf=buf;
1830                 for (j=22-j; j>0; j--)
1831                         *(pbuf++)=' ';
1832                 *(pbuf++)=':';
1833                 *(pbuf++)='\0';
1834                 BIO_puts(bio_err,buf);
1835
1836                 if (msie_hack)
1837                         {
1838                         /* assume all type should be strings */
1839                         nid=OBJ_obj2nid(ne->object);
1840
1841                         if (str->type == V_ASN1_UNIVERSALSTRING)
1842                                 ASN1_UNIVERSALSTRING_to_string(str);
1843
1844                         if ((str->type == V_ASN1_IA5STRING) &&
1845                                 (nid != NID_pkcs9_emailAddress))
1846                                 str->type=V_ASN1_T61STRING;
1847
1848                         if ((nid == NID_pkcs9_emailAddress) &&
1849                                 (str->type == V_ASN1_PRINTABLESTRING))
1850                                 str->type=V_ASN1_IA5STRING;
1851                         }
1852
1853                 if (str->type == V_ASN1_PRINTABLESTRING)
1854                         BIO_printf(bio_err,"PRINTABLE:'");
1855                 else if (str->type == V_ASN1_T61STRING)
1856                         BIO_printf(bio_err,"T61STRING:'");
1857                 else if (str->type == V_ASN1_IA5STRING)
1858                         BIO_printf(bio_err,"IA5STRING:'");
1859                 else if (str->type == V_ASN1_UNIVERSALSTRING)
1860                         BIO_printf(bio_err,"UNIVERSALSTRING:'");
1861                 else
1862                         BIO_printf(bio_err,"ASN.1 %2d:'",str->type);
1863
1864                 /* check some things */
1865                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
1866                         (str->type != V_ASN1_IA5STRING))
1867                         {
1868                         BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
1869                         goto err;
1870                         }
1871                 j=ASN1_PRINTABLE_type(str->data,str->length);
1872                 if (    ((j == V_ASN1_T61STRING) &&
1873                          (str->type != V_ASN1_T61STRING)) ||
1874                         ((j == V_ASN1_IA5STRING) &&
1875                          (str->type == V_ASN1_PRINTABLESTRING)))
1876                         {
1877                         BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
1878                         goto err;
1879                         }
1880
1881                 p=(char *)str->data;
1882                 for (j=str->length; j>0; j--)
1883                         {
1884                         if ((*p >= ' ') && (*p <= '~'))
1885                                 BIO_printf(bio_err,"%c",*p);
1886                         else if (*p & 0x80)
1887                                 BIO_printf(bio_err,"\\0x%02X",*p);
1888                         else if ((unsigned char)*p == 0xf7)
1889                                 BIO_printf(bio_err,"^?");
1890                         else    BIO_printf(bio_err,"^%c",*p+'@');
1891                         p++;
1892                         }
1893                 BIO_printf(bio_err,"'\n");
1894                 }
1895
1896         /* Ok, now we check the 'policy' stuff. */
1897         if ((subject=X509_NAME_new()) == NULL)
1898                 {
1899                 BIO_printf(bio_err,"Memory allocation failure\n");
1900                 goto err;
1901                 }
1902
1903         /* take a copy of the issuer name before we mess with it. */
1904         CAname=X509_NAME_dup(x509->cert_info->subject);
1905         if (CAname == NULL) goto err;
1906         str=str2=NULL;
1907
1908         for (i=0; i<sk_CONF_VALUE_num(policy); i++)
1909                 {
1910                 cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
1911                 if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
1912                         {
1913                         BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
1914                         goto err;
1915                         }
1916                 obj=OBJ_nid2obj(j);
1917
1918                 last= -1;
1919                 for (;;)
1920                         {
1921                         /* lookup the object in the supplied name list */
1922                         j=X509_NAME_get_index_by_OBJ(name,obj,last);
1923                         if (j < 0)
1924                                 {
1925                                 if (last != -1) break;
1926                                 tne=NULL;
1927                                 }
1928                         else
1929                                 {
1930                                 tne=X509_NAME_get_entry(name,j);
1931                                 }
1932                         last=j;
1933
1934                         /* depending on the 'policy', decide what to do. */
1935                         push=NULL;
1936                         if (strcmp(cv->value,"optional") == 0)
1937                                 {
1938                                 if (tne != NULL)
1939                                         push=tne;
1940                                 }
1941                         else if (strcmp(cv->value,"supplied") == 0)
1942                                 {
1943                                 if (tne == NULL)
1944                                         {
1945                                         BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
1946                                         goto err;
1947                                         }
1948                                 else
1949                                         push=tne;
1950                                 }
1951                         else if (strcmp(cv->value,"match") == 0)
1952                                 {
1953                                 int last2;
1954
1955                                 if (tne == NULL)
1956                                         {
1957                                         BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
1958                                         goto err;
1959                                         }
1960
1961                                 last2= -1;
1962
1963 again2:
1964                                 j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
1965                                 if ((j < 0) && (last2 == -1))
1966                                         {
1967                                         BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
1968                                         goto err;
1969                                         }
1970                                 if (j >= 0)
1971                                         {
1972                                         push=X509_NAME_get_entry(CAname,j);
1973                                         str=X509_NAME_ENTRY_get_data(tne);
1974                                         str2=X509_NAME_ENTRY_get_data(push);
1975                                         last2=j;
1976                                         if (ASN1_STRING_cmp(str,str2) != 0)
1977                                                 goto again2;
1978                                         }
1979                                 if (j < 0)
1980                                         {
1981                                         BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
1982                                         goto err;
1983                                         }
1984                                 }
1985                         else
1986                                 {
1987                                 BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
1988                                 goto err;
1989                                 }
1990
1991                         if (push != NULL)
1992                                 {
1993                                 if (!X509_NAME_add_entry(subject,push, -1, 0))
1994                                         {
1995                                         if (push != NULL)
1996                                                 X509_NAME_ENTRY_free(push);
1997                                         BIO_printf(bio_err,"Memory allocation failure\n");
1998                                         goto err;
1999                                         }
2000                                 }
2001                         if (j < 0) break;
2002                         }
2003                 }
2004
2005         if (preserve)
2006                 {
2007                 X509_NAME_free(subject);
2008                 subject=X509_NAME_dup(X509_REQ_get_subject_name(req));
2009                 if (subject == NULL) goto err;
2010                 }
2011
2012         if (verbose)
2013                 BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
2014
2015         row[DB_name]=X509_NAME_oneline(subject,NULL,0);
2016         row[DB_serial]=BN_bn2hex(serial);
2017         if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2018                 {
2019                 BIO_printf(bio_err,"Memory allocation failure\n");
2020                 goto err;
2021                 }
2022
2023         rrow=TXT_DB_get_by_index(db,DB_name,row);
2024         if (rrow != NULL)
2025                 {
2026                 BIO_printf(bio_err,"ERROR:There is already a certificate for %s\n",
2027                         row[DB_name]);
2028                 }
2029         else
2030                 {
2031                 rrow=TXT_DB_get_by_index(db,DB_serial,row);
2032                 if (rrow != NULL)
2033                         {
2034                         BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
2035                                 row[DB_serial]);
2036                         BIO_printf(bio_err,"      check the database/serial_file for corruption\n");
2037                         }
2038                 }
2039
2040         if (rrow != NULL)
2041                 {
2042                 BIO_printf(bio_err,
2043                         "The matching entry has the following details\n");
2044                 if (rrow[DB_type][0] == 'E')
2045                         p="Expired";
2046                 else if (rrow[DB_type][0] == 'R')
2047                         p="Revoked";
2048                 else if (rrow[DB_type][0] == 'V')
2049                         p="Valid";
2050                 else
2051                         p="\ninvalid type, Data base error\n";
2052                 BIO_printf(bio_err,"Type          :%s\n",p);;
2053                 if (rrow[DB_type][0] == 'R')
2054                         {
2055                         p=rrow[DB_exp_date]; if (p == NULL) p="undef";
2056                         BIO_printf(bio_err,"Was revoked on:%s\n",p);
2057                         }
2058                 p=rrow[DB_exp_date]; if (p == NULL) p="undef";
2059                 BIO_printf(bio_err,"Expires on    :%s\n",p);
2060                 p=rrow[DB_serial]; if (p == NULL) p="undef";
2061                 BIO_printf(bio_err,"Serial Number :%s\n",p);
2062                 p=rrow[DB_file]; if (p == NULL) p="undef";
2063                 BIO_printf(bio_err,"File name     :%s\n",p);
2064                 p=rrow[DB_name]; if (p == NULL) p="undef";
2065                 BIO_printf(bio_err,"Subject Name  :%s\n",p);
2066                 ok= -1; /* This is now a 'bad' error. */
2067                 goto err;
2068                 }
2069
2070         /* We are now totally happy, lets make and sign the certificate */
2071         if (verbose)
2072                 BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
2073
2074         if ((ret=X509_new()) == NULL) goto err;
2075         ci=ret->cert_info;
2076
2077 #ifdef X509_V3
2078         /* Make it an X509 v3 certificate. */
2079         if (!X509_set_version(x509,2)) goto err;
2080 #endif
2081
2082         if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
2083                 goto err;
2084         if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
2085                 goto err;
2086
2087         BIO_printf(bio_err,"Certificate is to be certified until ");
2088         if (strcmp(startdate,"today") == 0)
2089                 X509_gmtime_adj(X509_get_notBefore(ret),0);
2090         else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);
2091
2092         if (enddate == NULL)
2093                 X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);
2094         else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);
2095
2096         ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
2097         if (days) BIO_printf(bio_err," (%d days)",days);
2098         BIO_printf(bio_err, "\n");
2099
2100         if (!X509_set_subject_name(ret,subject)) goto err;
2101
2102         pktmp=X509_REQ_get_pubkey(req);
2103         i = X509_set_pubkey(ret,pktmp);
2104         EVP_PKEY_free(pktmp);
2105         if (!i) goto err;
2106
2107         /* Lets add the extensions, if there are any */
2108         if (ext_sect)
2109                 {
2110                 X509V3_CTX ctx;
2111                 if (ci->version == NULL)
2112                         if ((ci->version=ASN1_INTEGER_new()) == NULL)
2113                                 goto err;
2114                 ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
2115
2116                 /* Free the current entries if any, there should not
2117                  * be any I believe */
2118                 if (ci->extensions != NULL)
2119                         sk_X509_EXTENSION_pop_free(ci->extensions,
2120                                                    X509_EXTENSION_free);
2121
2122                 ci->extensions = NULL;
2123
2124                 /* Initialize the context structure */
2125                 X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
2126
2127                 if (extconf)
2128                         {
2129                         if (verbose)
2130                                 BIO_printf(bio_err, "Extra configuration file found\n");
2131
2132                         /* Use the extconf configuration db LHASH */
2133                         X509V3_set_conf_lhash(&ctx, extconf);
2134
2135                         /* Test the structure (needed?) */
2136                         /* X509V3_set_ctx_test(&ctx); */
2137
2138                         /* Adds exts contained in the configuration file */
2139                         if (!X509V3_EXT_add_conf(extconf, &ctx, ext_sect,ret))
2140                                 {
2141                                 BIO_printf(bio_err,
2142                                     "ERROR: adding extensions in section %s\n",
2143                                                                 ext_sect);
2144                                 ERR_print_errors(bio_err);
2145                                 goto err;
2146                                 }
2147                         if (verbose)
2148                                 BIO_printf(bio_err, "Successfully added extensions from file.\n");
2149                         }
2150                 else if (ext_sect)
2151                         {
2152                         /* We found extensions to be set from config file */
2153                         X509V3_set_conf_lhash(&ctx, lconf);
2154
2155                         if(!X509V3_EXT_add_conf(lconf, &ctx, ext_sect, ret))
2156                                 {
2157                                 BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
2158                                 ERR_print_errors(bio_err);
2159                                 goto err;
2160                                 }
2161
2162                         if (verbose)
2163                                 BIO_printf(bio_err, "Successfully added extensions from config\n");
2164                         }
2165                 }
2166
2167
2168         if (!batch)
2169                 {
2170                 BIO_printf(bio_err,"Sign the certificate? [y/n]:");
2171                 (void)BIO_flush(bio_err);
2172                 buf[0]='\0';
2173                 fgets(buf,sizeof(buf)-1,stdin);
2174                 if (!((buf[0] == 'y') || (buf[0] == 'Y')))
2175                         {
2176                         BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
2177                         ok=0;
2178                         goto err;
2179                         }
2180                 }
2181
2182
2183 #ifndef OPENSSL_NO_DSA
2184         if (pkey->type == EVP_PKEY_DSA) dgst=EVP_dss1();
2185         pktmp=X509_get_pubkey(ret);
2186         if (EVP_PKEY_missing_parameters(pktmp) &&
2187                 !EVP_PKEY_missing_parameters(pkey))
2188                 EVP_PKEY_copy_parameters(pktmp,pkey);
2189         EVP_PKEY_free(pktmp);
2190 #endif
2191
2192         if (!X509_sign(ret,pkey,dgst))
2193                 goto err;
2194
2195         /* We now just add it to the database */
2196         row[DB_type]=(char *)OPENSSL_malloc(2);
2197
2198         tm=X509_get_notAfter(ret);
2199         row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2200         memcpy(row[DB_exp_date],tm->data,tm->length);
2201         row[DB_exp_date][tm->length]='\0';
2202
2203         row[DB_rev_date]=NULL;
2204
2205         /* row[DB_serial] done already */
2206         row[DB_file]=(char *)OPENSSL_malloc(8);
2207         /* row[DB_name] done already */
2208
2209         if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2210                 (row[DB_file] == NULL))
2211                 {
2212                 BIO_printf(bio_err,"Memory allocation failure\n");
2213                 goto err;
2214                 }
2215         strcpy(row[DB_file],"unknown");
2216         row[DB_type][0]='V';
2217         row[DB_type][1]='\0';
2218
2219         if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2220                 {
2221                 BIO_printf(bio_err,"Memory allocation failure\n");
2222                 goto err;
2223                 }
2224
2225         for (i=0; i<DB_NUMBER; i++)
2226                 {
2227                 irow[i]=row[i];
2228                 row[i]=NULL;
2229                 }
2230         irow[DB_NUMBER]=NULL;
2231
2232         if (!TXT_DB_insert(db,irow))
2233                 {
2234                 BIO_printf(bio_err,"failed to update database\n");
2235                 BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
2236                 goto err;
2237                 }
2238         ok=1;
2239 err:
2240         for (i=0; i<DB_NUMBER; i++)
2241                 if (row[i] != NULL) OPENSSL_free(row[i]);
2242
2243         if (CAname != NULL)
2244                 X509_NAME_free(CAname);
2245         if (subject != NULL)
2246                 X509_NAME_free(subject);
2247         if (tmptm != NULL)
2248                 ASN1_UTCTIME_free(tmptm);
2249         if (ok <= 0)
2250                 {
2251                 if (ret != NULL) X509_free(ret);
2252                 ret=NULL;
2253                 }
2254         else
2255                 *xret=ret;
2256         return(ok);
2257         }
2258
2259 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
2260         {
2261
2262         if (output_der)
2263                 {
2264                 (void)i2d_X509_bio(bp,x);
2265                 return;
2266                 }
2267 #if 0
2268         /* ??? Not needed since X509_print prints all this stuff anyway */
2269         f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
2270         BIO_printf(bp,"issuer :%s\n",f);
2271
2272         f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
2273         BIO_printf(bp,"subject:%s\n",f);
2274
2275         BIO_puts(bp,"serial :");
2276         i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
2277         BIO_puts(bp,"\n\n");
2278 #endif
2279         if (!notext)X509_print(bp,x);
2280         PEM_write_bio_X509(bp,x);
2281         }
2282
2283 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
2284              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
2285              BIGNUM *serial, char *startdate, char *enddate, int days,
2286              char *ext_sect, LHASH *lconf, int verbose)
2287         {
2288         STACK_OF(CONF_VALUE) *sk=NULL;
2289         LHASH *parms=NULL;
2290         X509_REQ *req=NULL;
2291         CONF_VALUE *cv=NULL;
2292         NETSCAPE_SPKI *spki = NULL;
2293         X509_REQ_INFO *ri;
2294         char *type,*buf;
2295         EVP_PKEY *pktmp=NULL;
2296         X509_NAME *n=NULL;
2297         X509_NAME_ENTRY *ne=NULL;
2298         int ok= -1,i,j;
2299         long errline;
2300         int nid;
2301
2302         /*
2303          * Load input file into a hash table.  (This is just an easy
2304          * way to read and parse the file, then put it into a convenient
2305          * STACK format).
2306          */
2307         parms=CONF_load(NULL,infile,&errline);
2308         if (parms == NULL)
2309                 {
2310                 BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
2311                 ERR_print_errors(bio_err);
2312                 goto err;
2313                 }
2314
2315         sk=CONF_get_section(parms, "default");
2316         if (sk_CONF_VALUE_num(sk) == 0)
2317                 {
2318                 BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
2319                 CONF_free(parms);
2320                 goto err;
2321                 }
2322
2323         /*
2324          * Now create a dummy X509 request structure.  We don't actually
2325          * have an X509 request, but we have many of the components
2326          * (a public key, various DN components).  The idea is that we
2327          * put these components into the right X509 request structure
2328          * and we can use the same code as if you had a real X509 request.
2329          */
2330         req=X509_REQ_new();
2331         if (req == NULL)
2332                 {
2333                 ERR_print_errors(bio_err);
2334                 goto err;
2335                 }
2336
2337         /*
2338          * Build up the subject name set.
2339          */
2340         ri=req->req_info;
2341         n = ri->subject;
2342
2343         for (i = 0; ; i++)
2344                 {
2345                 if (sk_CONF_VALUE_num(sk) <= i) break;
2346
2347                 cv=sk_CONF_VALUE_value(sk,i);
2348                 type=cv->name;
2349                 /* Skip past any leading X. X: X, etc to allow for
2350                  * multiple instances
2351                  */
2352                 for (buf = cv->name; *buf ; buf++)
2353                         if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
2354                                 {
2355                                 buf++;
2356                                 if (*buf) type = buf;
2357                                 break;
2358                                 }
2359
2360                 buf=cv->value;
2361                 if ((nid=OBJ_txt2nid(type)) == NID_undef)
2362                         {
2363                         if (strcmp(type, "SPKAC") == 0)
2364                                 {
2365                                 spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
2366                                 if (spki == NULL)
2367                                         {
2368                                         BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
2369                                         ERR_print_errors(bio_err);
2370                                         goto err;
2371                                         }
2372                                 }
2373                         continue;
2374                         }
2375
2376                 j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
2377                 if (fix_data(nid, &j) == 0)
2378                         {
2379                         BIO_printf(bio_err,
2380                                 "invalid characters in string %s\n",buf);
2381                         goto err;
2382                         }
2383
2384                 if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
2385                         (unsigned char *)buf,
2386                         strlen(buf))) == NULL)
2387                         goto err;
2388
2389                 if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
2390                 }
2391         if (spki == NULL)
2392                 {
2393                 BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
2394                         infile);
2395                 goto err;
2396                 }
2397
2398         /*
2399          * Now extract the key from the SPKI structure.
2400          */
2401
2402         BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
2403
2404         if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
2405                 {
2406                 BIO_printf(bio_err,"error unpacking SPKAC public key\n");
2407                 goto err;
2408                 }
2409
2410         j = NETSCAPE_SPKI_verify(spki, pktmp);
2411         if (j <= 0)
2412                 {
2413                 BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
2414                 goto err;
2415                 }
2416         BIO_printf(bio_err,"Signature ok\n");
2417
2418         X509_REQ_set_pubkey(req,pktmp);
2419         EVP_PKEY_free(pktmp);
2420         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,startdate,enddate,
2421                    days,1,verbose,req,ext_sect,lconf);
2422 err:
2423         if (req != NULL) X509_REQ_free(req);
2424         if (parms != NULL) CONF_free(parms);
2425         if (spki != NULL) NETSCAPE_SPKI_free(spki);
2426         if (ne != NULL) X509_NAME_ENTRY_free(ne);
2427
2428         return(ok);
2429         }
2430
2431 static int fix_data(int nid, int *type)
2432         {
2433         if (nid == NID_pkcs9_emailAddress)
2434                 *type=V_ASN1_IA5STRING;
2435         if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
2436                 *type=V_ASN1_T61STRING;
2437         if ((nid == NID_pkcs9_challengePassword) && (*type == V_ASN1_IA5STRING))
2438                 *type=V_ASN1_T61STRING;
2439         if ((nid == NID_pkcs9_unstructuredName) && (*type == V_ASN1_T61STRING))
2440                 return(0);
2441         if (nid == NID_pkcs9_unstructuredName)
2442                 *type=V_ASN1_IA5STRING;
2443         return(1);
2444         }
2445
2446 static int check_time_format(char *str)
2447         {
2448         ASN1_UTCTIME tm;
2449
2450         tm.data=(unsigned char *)str;
2451         tm.length=strlen(str);
2452         tm.type=V_ASN1_UTCTIME;
2453         return(ASN1_UTCTIME_check(&tm));
2454         }
2455
2456 static int do_revoke(X509 *x509, TXT_DB *db, int type, char *value)
2457         {
2458         ASN1_UTCTIME *tm=NULL;
2459         char *row[DB_NUMBER],**rrow,**irow;
2460         char *rev_str = NULL;
2461         BIGNUM *bn = NULL;
2462         int ok=-1,i;
2463
2464         for (i=0; i<DB_NUMBER; i++)
2465                 row[i]=NULL;
2466         row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
2467         bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
2468         row[DB_serial]=BN_bn2hex(bn);
2469         BN_free(bn);
2470         if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2471                 {
2472                 BIO_printf(bio_err,"Memory allocation failure\n");
2473                 goto err;
2474                 }
2475         /* We have to lookup by serial number because name lookup
2476          * skips revoked certs
2477          */
2478         rrow=TXT_DB_get_by_index(db,DB_serial,row);
2479         if (rrow == NULL)
2480                 {
2481                 BIO_printf(bio_err,"Adding Entry to DB for %s\n", row[DB_name]);
2482
2483                 /* We now just add it to the database */
2484                 row[DB_type]=(char *)OPENSSL_malloc(2);
2485
2486                 tm=X509_get_notAfter(x509);
2487                 row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2488                 memcpy(row[DB_exp_date],tm->data,tm->length);
2489                 row[DB_exp_date][tm->length]='\0';
2490
2491                 row[DB_rev_date]=NULL;
2492
2493                 /* row[DB_serial] done already */
2494                 row[DB_file]=(char *)OPENSSL_malloc(8);
2495
2496                 /* row[DB_name] done already */
2497
2498                 if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2499                         (row[DB_file] == NULL))
2500                         {
2501                         BIO_printf(bio_err,"Memory allocation failure\n");
2502                         goto err;
2503                         }
2504                 strcpy(row[DB_file],"unknown");
2505                 row[DB_type][0]='V';
2506                 row[DB_type][1]='\0';
2507
2508                 if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2509                         {
2510                         BIO_printf(bio_err,"Memory allocation failure\n");
2511                         goto err;
2512                         }
2513
2514                 for (i=0; i<DB_NUMBER; i++)
2515                         {
2516                         irow[i]=row[i];
2517                         row[i]=NULL;
2518                         }
2519                 irow[DB_NUMBER]=NULL;
2520
2521                 if (!TXT_DB_insert(db,irow))
2522                         {
2523                         BIO_printf(bio_err,"failed to update database\n");
2524                         BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
2525                         goto err;
2526                         }
2527
2528                 /* Revoke Certificate */
2529                 ok = do_revoke(x509,db, type, value);
2530
2531                 goto err;
2532
2533                 }
2534         else if (index_name_cmp((const char **)row,(const char **)rrow))
2535                 {
2536                 BIO_printf(bio_err,"ERROR:name does not match %s\n",
2537                            row[DB_name]);
2538                 goto err;
2539                 }
2540         else if (rrow[DB_type][0]=='R')
2541                 {
2542                 BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
2543                            row[DB_serial]);
2544                 goto err;
2545                 }
2546         else
2547                 {
2548                 BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
2549                 rev_str = make_revocation_str(type, value);
2550                 if (!rev_str)
2551                         {
2552                         BIO_printf(bio_err, "Error in revocation arguments\n");
2553                         goto err;
2554                         }
2555                 rrow[DB_type][0]='R';
2556                 rrow[DB_type][1]='\0';
2557                 rrow[DB_rev_date] = rev_str;
2558                 }
2559         ok=1;
2560 err:
2561         for (i=0; i<DB_NUMBER; i++)
2562                 {
2563                 if (row[i] != NULL)
2564                         OPENSSL_free(row[i]);
2565                 }
2566         return(ok);
2567         }
2568
2569 static int get_certificate_status(const char *serial, TXT_DB *db)
2570         {
2571         char *row[DB_NUMBER],**rrow;
2572         int ok=-1,i;
2573
2574         /* Free Resources */
2575         for (i=0; i<DB_NUMBER; i++)
2576                 row[i]=NULL;
2577
2578         /* Malloc needed char spaces */
2579         row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
2580         if (row[DB_serial] == NULL)
2581                 {
2582                 BIO_printf(bio_err,"Malloc failure\n");
2583                 goto err;
2584                 }
2585
2586         if (strlen(serial) % 2)
2587                 {
2588                 /* Set the first char to 0 */;
2589                 row[DB_serial][0]='0';
2590
2591                 /* Copy String from serial to row[DB_serial] */
2592                 memcpy(row[DB_serial]+1, serial, strlen(serial));
2593                 row[DB_serial][strlen(serial)+1]='\0';
2594                 }
2595         else
2596                 {
2597                 /* Copy String from serial to row[DB_serial] */
2598                 memcpy(row[DB_serial], serial, strlen(serial));
2599                 row[DB_serial][strlen(serial)]='\0';
2600                 }
2601
2602         /* Make it Upper Case */
2603         for (i=0; row[DB_serial][i] != '\0'; i++)
2604                 row[DB_serial][i] = toupper(row[DB_serial][i]);
2605
2606
2607         ok=1;
2608
2609         /* Search for the certificate */
2610         rrow=TXT_DB_get_by_index(db,DB_serial,row);
2611         if (rrow == NULL)
2612                 {
2613                 BIO_printf(bio_err,"Serial %s not present in db.\n",
2614                                  row[DB_serial]);
2615                 ok=-1;
2616                 goto err;
2617                 }
2618         else if (rrow[DB_type][0]=='V')
2619                 {
2620                 BIO_printf(bio_err,"%s=Valid (%c)\n",
2621                         row[DB_serial], rrow[DB_type][0]);
2622                 goto err;
2623                 }
2624         else if (rrow[DB_type][0]=='R')
2625                 {
2626                 BIO_printf(bio_err,"%s=Revoked (%c)\n",
2627                         row[DB_serial], rrow[DB_type][0]);
2628                 goto err;
2629                 }
2630         else if (rrow[DB_type][0]=='E')
2631                 {
2632                 BIO_printf(bio_err,"%s=Expired (%c)\n",
2633                         row[DB_serial], rrow[DB_type][0]);
2634                 goto err;
2635                 }
2636         else if (rrow[DB_type][0]=='S')
2637                 {
2638                 BIO_printf(bio_err,"%s=Suspended (%c)\n",
2639                         row[DB_serial], rrow[DB_type][0]);
2640                 goto err;
2641                 }
2642         else
2643                 {
2644                 BIO_printf(bio_err,"%s=Unknown (%c).\n",
2645                         row[DB_serial], rrow[DB_type][0]);
2646                 ok=-1;
2647                 }
2648 err:
2649         for (i=0; i<DB_NUMBER; i++)
2650                 {
2651                 if (row[i] != NULL)
2652                         OPENSSL_free(row[i]);
2653                 }
2654         return(ok);
2655         }
2656
2657 static int do_updatedb (TXT_DB *db)
2658         {
2659         ASN1_UTCTIME    *a_tm = NULL;
2660         int i, cnt = 0;
2661         int db_y2k, a_y2k;  /* flags = 1 if y >= 2000 */
2662         char **rrow, *a_tm_s;
2663
2664         a_tm = ASN1_UTCTIME_new();
2665
2666         /* get actual time and make a string */
2667         a_tm = X509_gmtime_adj(a_tm, 0);
2668         a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
2669         if (a_tm_s == NULL)
2670                 {
2671                 cnt = -1;
2672                 goto err;
2673                 }
2674
2675         memcpy(a_tm_s, a_tm->data, a_tm->length);
2676         a_tm_s[a_tm->length] = '\0';
2677
2678         if (strncmp(a_tm_s, "49", 2) <= 0)
2679                 a_y2k = 1;
2680         else
2681                 a_y2k = 0;
2682
2683         for (i = 0; i < sk_num(db->data); i++)
2684                 {
2685                 rrow = (char **) sk_value(db->data, i);
2686
2687                 if (rrow[DB_type][0] == 'V')
2688                         {
2689                         /* ignore entries that are not valid */
2690                         if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
2691                                 db_y2k = 1;
2692                         else
2693                                 db_y2k = 0;
2694
2695                         if (db_y2k == a_y2k)
2696                                 {
2697                                 /* all on the same y2k side */
2698                                 if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
2699                                         {
2700                                         rrow[DB_type][0]  = 'E';
2701                                         rrow[DB_type][1]  = '\0';
2702                                         cnt++;
2703
2704                                         BIO_printf(bio_err, "%s=Expired\n",
2705                                                         rrow[DB_serial]);
2706                                         }
2707                                 }
2708                         else if (db_y2k < a_y2k)
2709                                 {
2710                                 rrow[DB_type][0]  = 'E';
2711                                 rrow[DB_type][1]  = '\0';
2712                                 cnt++;
2713
2714                                 BIO_printf(bio_err, "%s=Expired\n",
2715                                                         rrow[DB_serial]);
2716                                 }
2717
2718                         }
2719                 }
2720
2721 err:
2722
2723         ASN1_UTCTIME_free(a_tm);
2724         OPENSSL_free(a_tm_s);
2725
2726         return (cnt);
2727         }
2728
2729 static char *crl_reasons[] = {
2730         /* CRL reason strings */
2731         "unspecified",
2732         "keyCompromise",
2733         "CACompromise",
2734         "affiliationChanged",
2735         "superseded",
2736         "cessationOfOperation",
2737         "certificateHold",
2738         "removeFromCRL",
2739         /* Additional pseudo reasons */
2740         "holdInstruction",
2741         "keyTime",
2742         "CAkeyTime"
2743 };
2744
2745 #define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
2746
2747 /* Given revocation information convert to a DB string.
2748  * The format of the string is:
2749  * revtime[,reason,extra]. Where 'revtime' is the
2750  * revocation time (the current time). 'reason' is the
2751  * optional CRL reason and 'extra' is any additional
2752  * argument
2753  */
2754
2755 char *make_revocation_str(int rev_type, char *rev_arg)
2756         {
2757         char *reason = NULL, *other = NULL, *str;
2758         ASN1_OBJECT *otmp;
2759         ASN1_UTCTIME *revtm = NULL;
2760         int i;
2761         switch (rev_type)
2762                 {
2763         case REV_NONE:
2764                 break;
2765
2766         case REV_CRL_REASON:
2767                 for (i = 0; i < 8; i++)
2768                         {
2769                         if (!strcasecmp(rev_arg, crl_reasons[i]))
2770                                 {
2771                                 reason = crl_reasons[i];
2772                                 break;
2773                                 }
2774                         }
2775                 if (reason == NULL)
2776                         {
2777                         BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
2778                         return NULL;
2779                         }
2780                 break;
2781
2782         case REV_HOLD:
2783                 /* Argument is an OID */
2784
2785                 otmp = OBJ_txt2obj(rev_arg, 0);
2786                 ASN1_OBJECT_free(otmp);
2787
2788                 if (otmp == NULL)
2789                         {
2790                         BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
2791                         return NULL;
2792                         }
2793
2794                 reason = "holdInstruction";
2795                 other = rev_arg;
2796                 break;
2797
2798         case REV_KEY_COMPROMISE:
2799         case REV_CA_COMPROMISE:
2800
2801                 /* Argument is the key compromise time  */
2802                 if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
2803                         {
2804                         BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
2805                         return NULL;
2806                         }
2807                 other = rev_arg;
2808                 if (rev_type == REV_KEY_COMPROMISE)
2809                         reason = "keyTime";
2810                 else
2811                         reason = "CAkeyTime";
2812
2813                 break;
2814
2815                 }
2816
2817         revtm = X509_gmtime_adj(NULL, 0);
2818
2819         i = revtm->length + 1;
2820
2821         if (reason) i += strlen(reason) + 1;
2822         if (other) i += strlen(other) + 1;
2823
2824         str = OPENSSL_malloc(i);
2825
2826         if (!str) return NULL;
2827
2828         strcpy(str, (char *)revtm->data);
2829         if (reason)
2830                 {
2831                 strcat(str, ",");
2832                 strcat(str, reason);
2833                 }
2834         if (other)
2835                 {
2836                 strcat(str, ",");
2837                 strcat(str, other);
2838                 }
2839         ASN1_UTCTIME_free(revtm);
2840         return str;
2841         }
2842
2843 /* Convert revocation field to X509_REVOKED entry
2844  * return code:
2845  * 0 error
2846  * 1 OK
2847  * 2 OK and some extensions added (i.e. V2 CRL)
2848  */
2849
2850 int make_revoked(X509_REVOKED *rev, char *str)
2851         {
2852         char *tmp = NULL;
2853         char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2854         int reason_code = -1;
2855         int i, ret = 0;
2856         ASN1_OBJECT *hold = NULL;
2857         ASN1_GENERALIZEDTIME *comp_time = NULL;
2858         ASN1_ENUMERATED *rtmp = NULL;
2859         tmp = BUF_strdup(str);
2860
2861         p = strchr(tmp, ',');
2862
2863         rtime_str = tmp;
2864
2865         if (p)
2866                 {
2867                 *p = '\0';
2868                 p++;
2869                 reason_str = p;
2870                 p = strchr(p, ',');
2871                 if (p)
2872                         {
2873                         *p = '\0';
2874                         arg_str = p + 1;
2875                         }
2876                 }
2877
2878         if (rev && !ASN1_UTCTIME_set_string(rev->revocationDate, rtime_str))
2879                 {
2880                 BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
2881                 goto err;
2882                 }
2883         if (reason_str)
2884                 {
2885                 for (i = 0; i < NUM_REASONS; i++)
2886                         {
2887                         if(!strcasecmp(reason_str, crl_reasons[i]))
2888                                 {
2889                                 reason_code = i;
2890                                 break;
2891                                 }
2892                         }
2893                 if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
2894                         {
2895                         BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
2896                         goto err;
2897                         }
2898
2899                 if (reason_code == 7)
2900                         reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
2901                 else if (reason_code == 8)              /* Hold instruction */
2902                         {
2903                         if (!arg_str)
2904                                 {
2905                                 BIO_printf(bio_err, "missing hold instruction\n");
2906                                 goto err;
2907                                 }
2908                         reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
2909                         hold = OBJ_txt2obj(arg_str, 0);
2910
2911                         if (!hold)
2912                                 {
2913                                 BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
2914                                 goto err;
2915                                 }
2916                         }
2917                 else if ((reason_code == 9) || (reason_code == 10))
2918                         {
2919                         if (!arg_str)
2920                                 {
2921                                 BIO_printf(bio_err, "missing compromised time\n");
2922                                 goto err;
2923                                 }
2924                         comp_time = ASN1_GENERALIZEDTIME_new();
2925                         if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
2926                                 {
2927                                 BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
2928                                 goto err;
2929                                 }
2930                         if (reason_code == 9)
2931                                 reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
2932                         else
2933                                 reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
2934                         }
2935                 }
2936
2937         if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
2938                 {
2939                 rtmp = ASN1_ENUMERATED_new();
2940                 if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
2941                         goto err;
2942                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
2943                         goto err;
2944                 }
2945
2946         if (rev && comp_time)
2947                 {
2948                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
2949                         goto err;
2950                 }
2951         if (rev && hold)
2952                 {
2953                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
2954                         goto err;
2955                 }
2956
2957         if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
2958                 ret = 2;
2959         else ret = 1;
2960
2961         err:
2962
2963         if (tmp) OPENSSL_free(tmp);
2964         ASN1_OBJECT_free(hold);
2965         ASN1_GENERALIZEDTIME_free(comp_time);
2966         ASN1_ENUMERATED_free(rtmp);
2967
2968         return ret;
2969         }