apps/ca.c

   1 /* apps/ca.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58
  59 /* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
  60
  61 #include <stdio.h>
  62 #include <stdlib.h>
  63 #include <string.h>
  64 #include <ctype.h>
  65 #include <sys/types.h>
  66 #include <sys/stat.h>
  67 #include <openssl/conf.h>
  68 #include <openssl/bio.h>
  69 #include <openssl/err.h>
  70 #include <openssl/bn.h>
  71 #include <openssl/txt_db.h>
  72 #include <openssl/evp.h>
  73 #include <openssl/x509.h>
  74 #include <openssl/x509v3.h>
  75 #include <openssl/objects.h>
  76 #include <openssl/ocsp.h>
  77 #include <openssl/pem.h>
  78
  79 #ifndef W_OK
  80 #  ifdef OPENSSL_SYS_VMS
  81 #    if defined(__DECC)
  82 #      include <unistd.h>
  83 #    else
  84 #      include <unixlib.h>
  85 #    endif
  86 #  elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_NETWARE) && !defined(__TANDEM)
  87 #    include <sys/file.h>
  88 #  endif
  89 #endif
  90
  91 #include "apps.h"
  92
  93 #ifndef W_OK
  94 #  define F_OK 0
  95 #  define X_OK 1
  96 #  define W_OK 2
  97 #  define R_OK 4
  98 #endif
  99
 100 #undef PROG
 101 #define PROG ca_main
 102
 103 #define BASE_SECTION    "ca"
 104 #define CONFIG_FILE "openssl.cnf"
 105
 106 #define ENV_DEFAULT_CA          "default_ca"
 107
 108 #define STRING_MASK     "string_mask"
 109 #define UTF8_IN                 "utf8"
 110
 111 #define ENV_DIR                 "dir"
 112 #define ENV_CERTS               "certs"
 113 #define ENV_CRL_DIR             "crl_dir"
 114 #define ENV_CA_DB               "CA_DB"
 115 #define ENV_NEW_CERTS_DIR       "new_certs_dir"
 116 #define ENV_CERTIFICATE         "certificate"
 117 #define ENV_SERIAL              "serial"
 118 #define ENV_CRLNUMBER           "crlnumber"
 119 #define ENV_CRL                 "crl"
 120 #define ENV_PRIVATE_KEY         "private_key"
 121 #define ENV_RANDFILE            "RANDFILE"
 122 #define ENV_DEFAULT_DAYS        "default_days"
 123 #define ENV_DEFAULT_STARTDATE   "default_startdate"
 124 #define ENV_DEFAULT_ENDDATE     "default_enddate"
 125 #define ENV_DEFAULT_CRL_DAYS    "default_crl_days"
 126 #define ENV_DEFAULT_CRL_HOURS   "default_crl_hours"
 127 #define ENV_DEFAULT_MD          "default_md"
 128 #define ENV_DEFAULT_EMAIL_DN    "email_in_dn"
 129 #define ENV_PRESERVE            "preserve"
 130 #define ENV_POLICY              "policy"
 131 #define ENV_EXTENSIONS          "x509_extensions"
 132 #define ENV_CRLEXT              "crl_extensions"
 133 #define ENV_MSIE_HACK           "msie_hack"
 134 #define ENV_NAMEOPT             "name_opt"
 135 #define ENV_CERTOPT             "cert_opt"
 136 #define ENV_EXTCOPY             "copy_extensions"
 137 #define ENV_UNIQUE_SUBJECT      "unique_subject"
 138
 139 #define ENV_DATABASE            "database"
 140
 141 /* Additional revocation information types */
 142
 143 #define REV_NONE                0       /* No addditional information */
 144 #define REV_CRL_REASON          1       /* Value is CRL reason code */
 145 #define REV_HOLD                2       /* Value is hold instruction */
 146 #define REV_KEY_COMPROMISE      3       /* Value is cert key compromise time */
 147 #define REV_CA_COMPROMISE       4       /* Value is CA key compromise time */
 148
 149 static const char *ca_usage[]={
 150 "usage: ca args\n",
 151 "\n",
 152 " -verbose        - Talk alot while doing things\n",
 153 " -config file    - A config file\n",
 154 " -name arg       - The particular CA definition to use\n",
 155 " -gencrl         - Generate a new CRL\n",
 156 " -crldays days   - Days is when the next CRL is due\n",
 157 " -crlhours hours - Hours is when the next CRL is due\n",
 158 " -startdate YYMMDDHHMMSSZ  - certificate validity notBefore\n",
 159 " -enddate YYMMDDHHMMSSZ    - certificate validity notAfter (overrides -days)\n",
 160 " -days arg       - number of days to certify the certificate for\n",
 161 " -md arg         - md to use, one of md2, md5, sha or sha1\n",
 162 " -policy arg     - The CA 'policy' to support\n",
 163 " -keyfile arg    - private key file\n",
 164 " -keyform arg    - private key file format (PEM or ENGINE)\n",
 165 " -key arg        - key to decode the private key if it is encrypted\n",
 166 " -cert file      - The CA certificate\n",
 167 " -selfsign       - sign a certificate with the key associated with it\n",
 168 " -in file        - The input PEM encoded certificate request(s)\n",
 169 " -out file       - Where to put the output file(s)\n",
 170 " -outdir dir     - Where to put output certificates\n",
 171 " -infiles ....   - The last argument, requests to process\n",
 172 " -spkac file     - File contains DN and signed public key and challenge\n",
 173 " -ss_cert file   - File contains a self signed cert to sign\n",
 174 " -preserveDN     - Don't re-order the DN\n",
 175 " -noemailDN      - Don't add the EMAIL field into certificate' subject\n",
 176 " -batch          - Don't ask questions\n",
 177 " -msie_hack      - msie modifications to handle all those universal strings\n",
 178 " -revoke file    - Revoke a certificate (given in file)\n",
 179 " -subj arg       - Use arg instead of request's subject\n",
 180 " -utf8           - input characters are UTF8 (default ASCII)\n",
 181 " -multivalue-rdn - enable support for multivalued RDNs\n",
 182 " -extensions ..  - Extension section (override value in config file)\n",
 183 " -extfile file   - Configuration file with X509v3 extentions to add\n",
 184 " -crlexts ..     - CRL extension section (override value in config file)\n",
 185 #ifndef OPENSSL_NO_ENGINE
 186 " -engine e       - use engine e, possibly a hardware device.\n",
 187 #endif
 188 " -status serial  - Shows certificate status given the serial number\n",
 189 " -updatedb       - Updates db for expired certificates\n",
 190 NULL
 191 };
 192
 193 #ifdef EFENCE
 194 extern int EF_PROTECT_FREE;
 195 extern int EF_PROTECT_BELOW;
 196 extern int EF_ALIGNMENT;
 197 #endif
 198
 199 static void lookup_fail(const char *name, const char *tag);
 200 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 201                    const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,CA_DB *db,
 202                    BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate,
 203                    char *enddate, long days, int batch, char *ext_sect, CONF *conf,
 204                    int verbose, unsigned long certopt, unsigned long nameopt,
 205                    int default_op, int ext_copy, int selfsign);
 206 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 207                         const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 208                         CA_DB *db, BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn,
 209                         char *startdate, char *enddate, long days, int batch,
 210                         char *ext_sect, CONF *conf,int verbose, unsigned long certopt,
 211                         unsigned long nameopt, int default_op, int ext_copy,
 212                         ENGINE *e);
 213 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 214                          const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 215                          CA_DB *db, BIGNUM *serial,char *subj,unsigned long chtype, int multirdn, int email_dn,
 216                          char *startdate, char *enddate, long days, char *ext_sect,
 217                          CONF *conf, int verbose, unsigned long certopt,
 218                          unsigned long nameopt, int default_op, int ext_copy);
 219 static int fix_data(int nid, int *type);
 220 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
 221 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
 222         STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,char *subj,unsigned long chtype, int multirdn,
 223         int email_dn, char *startdate, char *enddate, long days, int batch,
 224         int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
 225         unsigned long certopt, unsigned long nameopt, int default_op,
 226         int ext_copy, int selfsign);
 227 static int do_revoke(X509 *x509, CA_DB *db, int ext, char *extval);
 228 static int get_certificate_status(const char *ser_status, CA_DB *db);
 229 static int do_updatedb(CA_DB *db);
 230 static int check_time_format(const char *str);
 231 char *make_revocation_str(int rev_type, char *rev_arg);
 232 int make_revoked(X509_REVOKED *rev, const char *str);
 233 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
 234 static CONF *conf=NULL;
 235 static CONF *extconf=NULL;
 236 static char *section=NULL;
 237
 238 static int preserve=0;
 239 static int msie_hack=0;
 240
 241
 242 int MAIN(int, char **);
 243
 244 int MAIN(int argc, char **argv)
 245         {
 246         ENGINE *e = NULL;
 247         char *key=NULL,*passargin=NULL;
 248         int create_ser = 0;
 249         int free_key = 0;
 250         int total=0;
 251         int total_done=0;
 252         int badops=0;
 253         int ret=1;
 254         int email_dn=1;
 255         int req=0;
 256         int verbose=0;
 257         int gencrl=0;
 258         int dorevoke=0;
 259         int doupdatedb=0;
 260         long crldays=0;
 261         long crlhours=0;
 262         long errorline= -1;
 263         char *configfile=NULL;
 264         char *md=NULL;
 265         char *policy=NULL;
 266         char *keyfile=NULL;
 267         char *certfile=NULL;
 268         int keyform=FORMAT_PEM;
 269         char *infile=NULL;
 270         char *spkac_file=NULL;
 271         char *ss_cert_file=NULL;
 272         char *ser_status=NULL;
 273         EVP_PKEY *pkey=NULL;
 274         int output_der = 0;
 275         char *outfile=NULL;
 276         char *outdir=NULL;
 277         char *serialfile=NULL;
 278         char *crlnumberfile=NULL;
 279         char *extensions=NULL;
 280         char *extfile=NULL;
 281         char *subj=NULL;
 282         unsigned long chtype = MBSTRING_ASC;
 283         int multirdn = 0;
 284         char *tmp_email_dn=NULL;
 285         char *crl_ext=NULL;
 286         int rev_type = REV_NONE;
 287         char *rev_arg = NULL;
 288         BIGNUM *serial=NULL;
 289         BIGNUM *crlnumber=NULL;
 290         char *startdate=NULL;
 291         char *enddate=NULL;
 292         long days=0;
 293         int batch=0;
 294         int notext=0;
 295         unsigned long nameopt = 0, certopt = 0;
 296         int default_op = 1;
 297         int ext_copy = EXT_COPY_NONE;
 298         int selfsign = 0;
 299         X509 *x509=NULL, *x509p = NULL;
 300         X509 *x=NULL;
 301         BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
 302         char *dbfile=NULL;
 303         CA_DB *db=NULL;
 304         X509_CRL *crl=NULL;
 305         X509_REVOKED *r=NULL;
 306         ASN1_TIME *tmptm;
 307         ASN1_INTEGER *tmpser;
 308         char *f;
 309         const char *p, **pp;
 310         int i,j;
 311         const EVP_MD *dgst=NULL;
 312         STACK_OF(CONF_VALUE) *attribs=NULL;
 313         STACK_OF(X509) *cert_sk=NULL;
 314 #undef BSIZE
 315 #define BSIZE 256
 316         MS_STATIC char buf[3][BSIZE];
 317         char *randfile=NULL;
 318 #ifndef OPENSSL_NO_ENGINE
 319         char *engine = NULL;
 320 #endif
 321         char *tofree=NULL;
 322         DB_ATTR db_attr;
 323
 324 #ifdef EFENCE
 325 EF_PROTECT_FREE=1;
 326 EF_PROTECT_BELOW=1;
 327 EF_ALIGNMENT=0;
 328 #endif
 329
 330         apps_startup();
 331
 332         conf = NULL;
 333         key = NULL;
 334         section = NULL;
 335
 336         preserve=0;
 337         msie_hack=0;
 338         if (bio_err == NULL)
 339                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
 340                         BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 341
 342         argc--;
 343         argv++;
 344         while (argc >= 1)
 345                 {
 346                 if      (strcmp(*argv,"-verbose") == 0)
 347                         verbose=1;
 348                 else if (strcmp(*argv,"-config") == 0)
 349                         {
 350                         if (--argc < 1) goto bad;
 351                         configfile= *(++argv);
 352                         }
 353                 else if (strcmp(*argv,"-name") == 0)
 354                         {
 355                         if (--argc < 1) goto bad;
 356                         section= *(++argv);
 357                         }
 358                 else if (strcmp(*argv,"-subj") == 0)
 359                         {
 360                         if (--argc < 1) goto bad;
 361                         subj= *(++argv);
 362                         /* preserve=1; */
 363                         }
 364                 else if (strcmp(*argv,"-utf8") == 0)
 365                         chtype = MBSTRING_UTF8;
 366                 else if (strcmp(*argv,"-create_serial") == 0)
 367                         create_ser = 1;
 368                 else if (strcmp(*argv,"-multivalue-rdn") == 0)
 369                         multirdn=1;
 370                 else if (strcmp(*argv,"-startdate") == 0)
 371                         {
 372                         if (--argc < 1) goto bad;
 373                         startdate= *(++argv);
 374                         }
 375                 else if (strcmp(*argv,"-enddate") == 0)
 376                         {
 377                         if (--argc < 1) goto bad;
 378                         enddate= *(++argv);
 379                         }
 380                 else if (strcmp(*argv,"-days") == 0)
 381                         {
 382                         if (--argc < 1) goto bad;
 383                         days=atoi(*(++argv));
 384                         }
 385                 else if (strcmp(*argv,"-md") == 0)
 386                         {
 387                         if (--argc < 1) goto bad;
 388                         md= *(++argv);
 389                         }
 390                 else if (strcmp(*argv,"-policy") == 0)
 391                         {
 392                         if (--argc < 1) goto bad;
 393                         policy= *(++argv);
 394                         }
 395                 else if (strcmp(*argv,"-keyfile") == 0)
 396                         {
 397                         if (--argc < 1) goto bad;
 398                         keyfile= *(++argv);
 399                         }
 400                 else if (strcmp(*argv,"-keyform") == 0)
 401                         {
 402                         if (--argc < 1) goto bad;
 403                         keyform=str2fmt(*(++argv));
 404                         }
 405                 else if (strcmp(*argv,"-passin") == 0)
 406                         {
 407                         if (--argc < 1) goto bad;
 408                         passargin= *(++argv);
 409                         }
 410                 else if (strcmp(*argv,"-key") == 0)
 411                         {
 412                         if (--argc < 1) goto bad;
 413                         key= *(++argv);
 414                         }
 415                 else if (strcmp(*argv,"-cert") == 0)
 416                         {
 417                         if (--argc < 1) goto bad;
 418                         certfile= *(++argv);
 419                         }
 420                 else if (strcmp(*argv,"-selfsign") == 0)
 421                         selfsign=1;
 422                 else if (strcmp(*argv,"-in") == 0)
 423                         {
 424                         if (--argc < 1) goto bad;
 425                         infile= *(++argv);
 426                         req=1;
 427                         }
 428                 else if (strcmp(*argv,"-out") == 0)
 429                         {
 430                         if (--argc < 1) goto bad;
 431                         outfile= *(++argv);
 432                         }
 433                 else if (strcmp(*argv,"-outdir") == 0)
 434                         {
 435                         if (--argc < 1) goto bad;
 436                         outdir= *(++argv);
 437                         }
 438                 else if (strcmp(*argv,"-notext") == 0)
 439                         notext=1;
 440                 else if (strcmp(*argv,"-batch") == 0)
 441                         batch=1;
 442                 else if (strcmp(*argv,"-preserveDN") == 0)
 443                         preserve=1;
 444                 else if (strcmp(*argv,"-noemailDN") == 0)
 445                         email_dn=0;
 446                 else if (strcmp(*argv,"-gencrl") == 0)
 447                         gencrl=1;
 448                 else if (strcmp(*argv,"-msie_hack") == 0)
 449                         msie_hack=1;
 450                 else if (strcmp(*argv,"-crldays") == 0)
 451                         {
 452                         if (--argc < 1) goto bad;
 453                         crldays= atol(*(++argv));
 454                         }
 455                 else if (strcmp(*argv,"-crlhours") == 0)
 456                         {
 457                         if (--argc < 1) goto bad;
 458                         crlhours= atol(*(++argv));
 459                         }
 460                 else if (strcmp(*argv,"-infiles") == 0)
 461                         {
 462                         argc--;
 463                         argv++;
 464                         req=1;
 465                         break;
 466                         }
 467                 else if (strcmp(*argv, "-ss_cert") == 0)
 468                         {
 469                         if (--argc < 1) goto bad;
 470                         ss_cert_file = *(++argv);
 471                         req=1;
 472                         }
 473                 else if (strcmp(*argv, "-spkac") == 0)
 474                         {
 475                         if (--argc < 1) goto bad;
 476                         spkac_file = *(++argv);
 477                         req=1;
 478                         }
 479                 else if (strcmp(*argv,"-revoke") == 0)
 480                         {
 481                         if (--argc < 1) goto bad;
 482                         infile= *(++argv);
 483                         dorevoke=1;
 484                         }
 485                 else if (strcmp(*argv,"-extensions") == 0)
 486                         {
 487                         if (--argc < 1) goto bad;
 488                         extensions= *(++argv);
 489                         }
 490                 else if (strcmp(*argv,"-extfile") == 0)
 491                         {
 492                         if (--argc < 1) goto bad;
 493                         extfile= *(++argv);
 494                         }
 495                 else if (strcmp(*argv,"-status") == 0)
 496                         {
 497                         if (--argc < 1) goto bad;
 498                         ser_status= *(++argv);
 499                         }
 500                 else if (strcmp(*argv,"-updatedb") == 0)
 501                         {
 502                         doupdatedb=1;
 503                         }
 504                 else if (strcmp(*argv,"-crlexts") == 0)
 505                         {
 506                         if (--argc < 1) goto bad;
 507                         crl_ext= *(++argv);
 508                         }
 509                 else if (strcmp(*argv,"-crl_reason") == 0)
 510                         {
 511                         if (--argc < 1) goto bad;
 512                         rev_arg = *(++argv);
 513                         rev_type = REV_CRL_REASON;
 514                         }
 515                 else if (strcmp(*argv,"-crl_hold") == 0)
 516                         {
 517                         if (--argc < 1) goto bad;
 518                         rev_arg = *(++argv);
 519                         rev_type = REV_HOLD;
 520                         }
 521                 else if (strcmp(*argv,"-crl_compromise") == 0)
 522                         {
 523                         if (--argc < 1) goto bad;
 524                         rev_arg = *(++argv);
 525                         rev_type = REV_KEY_COMPROMISE;
 526                         }
 527                 else if (strcmp(*argv,"-crl_CA_compromise") == 0)
 528                         {
 529                         if (--argc < 1) goto bad;
 530                         rev_arg = *(++argv);
 531                         rev_type = REV_CA_COMPROMISE;
 532                         }
 533 #ifndef OPENSSL_NO_ENGINE
 534                 else if (strcmp(*argv,"-engine") == 0)
 535                         {
 536                         if (--argc < 1) goto bad;
 537                         engine= *(++argv);
 538                         }
 539 #endif
 540                 else
 541                         {
 542 bad:
 543                         BIO_printf(bio_err,"unknown option %s\n",*argv);
 544                         badops=1;
 545                         break;
 546                         }
 547                 argc--;
 548                 argv++;
 549                 }
 550
 551         if (badops)
 552                 {
 553                 for (pp=ca_usage; (*pp != NULL); pp++)
 554                         BIO_printf(bio_err,"%s",*pp);
 555                 goto err;
 556                 }
 557
 558         ERR_load_crypto_strings();
 559
 560         /*****************************************************************/
 561         tofree=NULL;
 562         if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
 563         if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
 564         if (configfile == NULL)
 565                 {
 566                 const char *s=X509_get_default_cert_area();
 567                 size_t len;
 568
 569 #ifdef OPENSSL_SYS_VMS
 570                 len = strlen(s)+sizeof(CONFIG_FILE);
 571                 tofree=OPENSSL_malloc(len);
 572                 strcpy(tofree,s);
 573 #else
 574                 len = strlen(s)+sizeof(CONFIG_FILE)+1;
 575                 tofree=OPENSSL_malloc(len);
 576                 BUF_strlcpy(tofree,s,len);
 577                 BUF_strlcat(tofree,"/",len);
 578 #endif
 579                 BUF_strlcat(tofree,CONFIG_FILE,len);
 580                 configfile=tofree;
 581                 }
 582
 583         BIO_printf(bio_err,"Using configuration from %s\n",configfile);
 584         conf = NCONF_new(NULL);
 585         if (NCONF_load(conf,configfile,&errorline) <= 0)
 586                 {
 587                 if (errorline <= 0)
 588                         BIO_printf(bio_err,"error loading the config file '%s'\n",
 589                                 configfile);
 590                 else
 591                         BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
 592                                 ,errorline,configfile);
 593                 goto err;
 594                 }
 595         if(tofree)
 596                 {
 597                 OPENSSL_free(tofree);
 598                 tofree = NULL;
 599                 }
 600
 601         if (!load_config(bio_err, conf))
 602                 goto err;
 603
 604 #ifndef OPENSSL_NO_ENGINE
 605         e = setup_engine(bio_err, engine, 0);
 606 #endif
 607
 608         /* Lets get the config section we are using */
 609         if (section == NULL)
 610                 {
 611                 section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
 612                 if (section == NULL)
 613                         {
 614                         lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
 615                         goto err;
 616                         }
 617                 }
 618
 619         if (conf != NULL)
 620                 {
 621                 p=NCONF_get_string(conf,NULL,"oid_file");
 622                 if (p == NULL)
 623                         ERR_clear_error();
 624                 if (p != NULL)
 625                         {
 626                         BIO *oid_bio;
 627
 628                         oid_bio=BIO_new_file(p,"r");
 629                         if (oid_bio == NULL)
 630                                 {
 631                                 /*
 632                                 BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
 633                                 ERR_print_errors(bio_err);
 634                                 */
 635                                 ERR_clear_error();
 636                                 }
 637                         else
 638                                 {
 639                                 OBJ_create_objects(oid_bio);
 640                                 BIO_free(oid_bio);
 641                                 }
 642                         }
 643                 if (!add_oid_section(bio_err,conf))
 644                         {
 645                         ERR_print_errors(bio_err);
 646                         goto err;
 647                         }
 648                 }
 649
 650         randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
 651         if (randfile == NULL)
 652                 ERR_clear_error();
 653         app_RAND_load_file(randfile, bio_err, 0);
 654
 655         f = NCONF_get_string(conf, section, STRING_MASK);
 656         if (!f)
 657                 ERR_clear_error();
 658
 659         if(f && !ASN1_STRING_set_default_mask_asc(f)) {
 660                 BIO_printf(bio_err, "Invalid global string mask setting %s\n", f);
 661                 goto err;
 662         }
 663
 664         if (chtype != MBSTRING_UTF8){
 665                 f = NCONF_get_string(conf, section, UTF8_IN);
 666                 if (!f)
 667                         ERR_clear_error();
 668                 else if (!strcmp(f, "yes"))
 669                         chtype = MBSTRING_UTF8;
 670         }
 671
 672         db_attr.unique_subject = 1;
 673         p = NCONF_get_string(conf, section, ENV_UNIQUE_SUBJECT);
 674         if (p)
 675                 {
 676 #ifdef RL_DEBUG
 677                 BIO_printf(bio_err, "DEBUG: unique_subject = \"%s\"\n", p);
 678 #endif
 679                 db_attr.unique_subject = parse_yesno(p,1);
 680                 }
 681         else
 682                 ERR_clear_error();
 683 #ifdef RL_DEBUG
 684         if (!p)
 685                 BIO_printf(bio_err, "DEBUG: unique_subject undefined\n", p);
 686 #endif
 687 #ifdef RL_DEBUG
 688         BIO_printf(bio_err, "DEBUG: configured unique_subject is %d\n",
 689                 db_attr.unique_subject);
 690 #endif
 691
 692         in=BIO_new(BIO_s_file());
 693         out=BIO_new(BIO_s_file());
 694         Sout=BIO_new(BIO_s_file());
 695         Cout=BIO_new(BIO_s_file());
 696         if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
 697                 {
 698                 ERR_print_errors(bio_err);
 699                 goto err;
 700                 }
 701
 702         /*****************************************************************/
 703         /* report status of cert with serial number given on command line */
 704         if (ser_status)
 705         {
 706                 if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 707                         {
 708                         lookup_fail(section,ENV_DATABASE);
 709                         goto err;
 710                         }
 711                 db = load_index(dbfile,&db_attr);
 712                 if (db == NULL) goto err;
 713
 714                 if (!index_index(db)) goto err;
 715
 716                 if (get_certificate_status(ser_status,db) != 1)
 717                         BIO_printf(bio_err,"Error verifying serial %s!\n",
 718                                  ser_status);
 719                 goto err;
 720         }
 721
 722         /*****************************************************************/
 723         /* we definitely need a private key, so let's get it */
 724
 725         if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
 726                 section,ENV_PRIVATE_KEY)) == NULL))
 727                 {
 728                 lookup_fail(section,ENV_PRIVATE_KEY);
 729                 goto err;
 730                 }
 731         if (!key)
 732                 {
 733                 free_key = 1;
 734                 if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
 735                         {
 736                         BIO_printf(bio_err,"Error getting password\n");
 737                         goto err;
 738                         }
 739                 }
 740         pkey = load_key(bio_err, keyfile, keyform, 0, key, e,
 741                 "CA private key");
 742         if (key) OPENSSL_cleanse(key,strlen(key));
 743         if (pkey == NULL)
 744                 {
 745                 /* load_key() has already printed an appropriate message */
 746                 goto err;
 747                 }
 748
 749         /*****************************************************************/
 750         /* we need a certificate */
 751         if (!selfsign || spkac_file || ss_cert_file || gencrl)
 752                 {
 753                 if ((certfile == NULL)
 754                         && ((certfile=NCONF_get_string(conf,
 755                                      section,ENV_CERTIFICATE)) == NULL))
 756                         {
 757                         lookup_fail(section,ENV_CERTIFICATE);
 758                         goto err;
 759                         }
 760                 x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
 761                         "CA certificate");
 762                 if (x509 == NULL)
 763                         goto err;
 764
 765                 if (!X509_check_private_key(x509,pkey))
 766                         {
 767                         BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
 768                         goto err;
 769                         }
 770                 }
 771         if (!selfsign) x509p = x509;
 772
 773         f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
 774         if (f == NULL)
 775                 ERR_clear_error();
 776         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 777                 preserve=1;
 778         f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
 779         if (f == NULL)
 780                 ERR_clear_error();
 781         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 782                 msie_hack=1;
 783
 784         f=NCONF_get_string(conf,section,ENV_NAMEOPT);
 785
 786         if (f)
 787                 {
 788                 if (!set_name_ex(&nameopt, f))
 789                         {
 790                         BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
 791                         goto err;
 792                         }
 793                 default_op = 0;
 794                 }
 795         else
 796                 ERR_clear_error();
 797
 798         f=NCONF_get_string(conf,section,ENV_CERTOPT);
 799
 800         if (f)
 801                 {
 802                 if (!set_cert_ex(&certopt, f))
 803                         {
 804                         BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
 805                         goto err;
 806                         }
 807                 default_op = 0;
 808                 }
 809         else
 810                 ERR_clear_error();
 811
 812         f=NCONF_get_string(conf,section,ENV_EXTCOPY);
 813
 814         if (f)
 815                 {
 816                 if (!set_ext_copy(&ext_copy, f))
 817                         {
 818                         BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
 819                         goto err;
 820                         }
 821                 }
 822         else
 823                 ERR_clear_error();
 824
 825         /*****************************************************************/
 826         /* lookup where to write new certificates */
 827         if ((outdir == NULL) && (req))
 828                 {
 829                 struct stat sb;
 830
 831                 if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
 832                         == NULL)
 833                         {
 834                         BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
 835                         goto err;
 836                         }
 837 #ifndef OPENSSL_SYS_VMS
 838             /* outdir is a directory spec, but access() for VMS demands a
 839                filename.  In any case, stat(), below, will catch the problem
 840                if outdir is not a directory spec, and the fopen() or open()
 841                will catch an error if there is no write access.
 842
 843                Presumably, this problem could also be solved by using the DEC
 844                C routines to convert the directory syntax to Unixly, and give
 845                that to access().  However, time's too short to do that just
 846                now.
 847             */
 848                 if (access(outdir,R_OK|W_OK|X_OK) != 0)
 849                         {
 850                         BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
 851                         perror(outdir);
 852                         goto err;
 853                         }
 854
 855                 if (stat(outdir,&sb) != 0)
 856                         {
 857                         BIO_printf(bio_err,"unable to stat(%s)\n",outdir);
 858                         perror(outdir);
 859                         goto err;
 860                         }
 861 #ifdef S_ISDIR
 862                 if (!S_ISDIR(sb.st_mode))
 863                         {
 864                         BIO_printf(bio_err,"%s need to be a directory\n",outdir);
 865                         perror(outdir);
 866                         goto err;
 867                         }
 868 #endif
 869 #endif
 870                 }
 871
 872         /*****************************************************************/
 873         /* we need to load the database file */
 874         if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 875                 {
 876                 lookup_fail(section,ENV_DATABASE);
 877                 goto err;
 878                 }
 879         db = load_index(dbfile, &db_attr);
 880         if (db == NULL) goto err;
 881
 882         /* Lets check some fields */
 883         for (i=0; i<sk_num(db->db->data); i++)
 884                 {
 885                 pp=(const char **)sk_value(db->db->data,i);
 886                 if ((pp[DB_type][0] != DB_TYPE_REV) &&
 887                         (pp[DB_rev_date][0] != '\0'))
 888                         {
 889                         BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
 890                         goto err;
 891                         }
 892                 if ((pp[DB_type][0] == DB_TYPE_REV) &&
 893                         !make_revoked(NULL, pp[DB_rev_date]))
 894                         {
 895                         BIO_printf(bio_err," in entry %d\n", i+1);
 896                         goto err;
 897                         }
 898                 if (!check_time_format(pp[DB_exp_date]))
 899                         {
 900                         BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
 901                         goto err;
 902                         }
 903                 p=pp[DB_serial];
 904                 j=strlen(p);
 905                 if (*p == '-')
 906                         {
 907                         p++;
 908                         j--;
 909                         }
 910                 if ((j&1) || (j < 2))
 911                         {
 912                         BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
 913                         goto err;
 914                         }
 915                 while (*p)
 916                         {
 917                         if (!(  ((*p >= '0') && (*p <= '9')) ||
 918                                 ((*p >= 'A') && (*p <= 'F')) ||
 919                                 ((*p >= 'a') && (*p <= 'f')))  )
 920                                 {
 921                                 BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
 922                                 goto err;
 923                                 }
 924                         p++;
 925                         }
 926                 }
 927         if (verbose)
 928                 {
 929                 BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
 930 #ifdef OPENSSL_SYS_VMS
 931                 {
 932                 BIO *tmpbio = BIO_new(BIO_f_linebuffer());
 933                 out = BIO_push(tmpbio, out);
 934                 }
 935 #endif
 936                 TXT_DB_write(out,db->db);
 937                 BIO_printf(bio_err,"%d entries loaded from the database\n",
 938                         db->db->data->num);
 939                 BIO_printf(bio_err,"generating index\n");
 940                 }
 941
 942         if (!index_index(db)) goto err;
 943
 944         /*****************************************************************/
 945         /* Update the db file for expired certificates */
 946         if (doupdatedb)
 947                 {
 948                 if (verbose)
 949                         BIO_printf(bio_err, "Updating %s ...\n",
 950                                                         dbfile);
 951
 952                 i = do_updatedb(db);
 953                 if (i == -1)
 954                         {
 955                         BIO_printf(bio_err,"Malloc failure\n");
 956                         goto err;
 957                         }
 958                 else if (i == 0)
 959                         {
 960                         if (verbose) BIO_printf(bio_err,
 961                                         "No entries found to mark expired\n");
 962                         }
 963                 else
 964                         {
 965                         if (!save_index(dbfile,"new",db)) goto err;
 966
 967                         if (!rotate_index(dbfile,"new","old")) goto err;
 968
 969                         if (verbose) BIO_printf(bio_err,
 970                                 "Done. %d entries marked as expired\n",i);
 971                         }
 972                 }
 973
 974         /*****************************************************************/
 975         /* Read extentions config file                                   */
 976         if (extfile)
 977                 {
 978                 extconf = NCONF_new(NULL);
 979                 if (NCONF_load(extconf,extfile,&errorline) <= 0)
 980                         {
 981                         if (errorline <= 0)
 982                                 BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
 983                                         extfile);
 984                         else
 985                                 BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
 986                                         errorline,extfile);
 987                         ret = 1;
 988                         goto err;
 989                         }
 990
 991                 if (verbose)
 992                         BIO_printf(bio_err, "Successfully loaded extensions file %s\n", extfile);
 993
 994                 /* We can have sections in the ext file */
 995                 if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
 996                         extensions = "default";
 997                 }
 998
 999         /*****************************************************************/
1000         if (req || gencrl)
1001                 {
1002                 if (outfile != NULL)
1003                         {
1004                         if (BIO_write_filename(Sout,outfile) <= 0)
1005                                 {
1006                                 perror(outfile);
1007                                 goto err;
1008                                 }
1009                         }
1010                 else
1011                         {
1012                         BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
1013 #ifdef OPENSSL_SYS_VMS
1014                         {
1015                         BIO *tmpbio = BIO_new(BIO_f_linebuffer());
1016                         Sout = BIO_push(tmpbio, Sout);
1017                         }
1018 #endif
1019                         }
1020                 }
1021
1022         if ((md == NULL) && ((md=NCONF_get_string(conf,
1023                 section,ENV_DEFAULT_MD)) == NULL))
1024                 {
1025                 lookup_fail(section,ENV_DEFAULT_MD);
1026                 goto err;
1027                 }
1028
1029         if ((dgst=EVP_get_digestbyname(md)) == NULL)
1030                 {
1031                 BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1032                 goto err;
1033                 }
1034
1035         if (req)
1036                 {
1037                 if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
1038                         section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
1039                         {
1040                         if(strcmp(tmp_email_dn,"no") == 0)
1041                                 email_dn=0;
1042                         }
1043                 if (verbose)
1044                         BIO_printf(bio_err,"message digest is %s\n",
1045                                 OBJ_nid2ln(dgst->type));
1046                 if ((policy == NULL) && ((policy=NCONF_get_string(conf,
1047                         section,ENV_POLICY)) == NULL))
1048                         {
1049                         lookup_fail(section,ENV_POLICY);
1050                         goto err;
1051                         }
1052                 if (verbose)
1053                         BIO_printf(bio_err,"policy is %s\n",policy);
1054
1055                 if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
1056                         == NULL)
1057                         {
1058                         lookup_fail(section,ENV_SERIAL);
1059                         goto err;
1060                         }
1061
1062                 if (!extconf)
1063                         {
1064                         /* no '-extfile' option, so we look for extensions
1065                          * in the main configuration file */
1066                         if (!extensions)
1067                                 {
1068                                 extensions=NCONF_get_string(conf,section,
1069                                                                 ENV_EXTENSIONS);
1070                                 if (!extensions)
1071                                         ERR_clear_error();
1072                                 }
1073                         if (extensions)
1074                                 {
1075                                 /* Check syntax of file */
1076                                 X509V3_CTX ctx;
1077                                 X509V3_set_ctx_test(&ctx);
1078                                 X509V3_set_nconf(&ctx, conf);
1079                                 if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
1080                                                                 NULL))
1081                                         {
1082                                         BIO_printf(bio_err,
1083                                         "Error Loading extension section %s\n",
1084                                                                  extensions);
1085                                         ret = 1;
1086                                         goto err;
1087                                         }
1088                                 }
1089                         }
1090
1091                 if (startdate == NULL)
1092                         {
1093                         startdate=NCONF_get_string(conf,section,
1094                                 ENV_DEFAULT_STARTDATE);
1095                         if (startdate == NULL)
1096                                 ERR_clear_error();
1097                         }
1098                 if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))
1099                         {
1100                         BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");
1101                         goto err;
1102                         }
1103                 if (startdate == NULL) startdate="today";
1104
1105                 if (enddate == NULL)
1106                         {
1107                         enddate=NCONF_get_string(conf,section,
1108                                 ENV_DEFAULT_ENDDATE);
1109                         if (enddate == NULL)
1110                                 ERR_clear_error();
1111                         }
1112                 if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))
1113                         {
1114                         BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");
1115                         goto err;
1116                         }
1117
1118                 if (days == 0)
1119                         {
1120                         if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
1121                                 days = 0;
1122                         }
1123                 if (!enddate && (days == 0))
1124                         {
1125                         BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
1126                         goto err;
1127                         }
1128
1129                 if ((serial=load_serial(serialfile, create_ser, NULL)) == NULL)
1130                         {
1131                         BIO_printf(bio_err,"error while loading serial number\n");
1132                         goto err;
1133                         }
1134                 if (verbose)
1135                         {
1136                         if (BN_is_zero(serial))
1137                                 BIO_printf(bio_err,"next serial number is 00\n");
1138                         else
1139                                 {
1140                                 if ((f=BN_bn2hex(serial)) == NULL) goto err;
1141                                 BIO_printf(bio_err,"next serial number is %s\n",f);
1142                                 OPENSSL_free(f);
1143                                 }
1144                         }
1145
1146                 if ((attribs=NCONF_get_section(conf,policy)) == NULL)
1147                         {
1148                         BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
1149                         goto err;
1150                         }
1151
1152                 if ((cert_sk=sk_X509_new_null()) == NULL)
1153                         {
1154                         BIO_printf(bio_err,"Memory allocation failure\n");
1155                         goto err;
1156                         }
1157                 if (spkac_file != NULL)
1158                         {
1159                         total++;
1160                         j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
1161                                 serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,extensions,
1162                                 conf,verbose,certopt,nameopt,default_op,ext_copy);
1163                         if (j < 0) goto err;
1164                         if (j > 0)
1165                                 {
1166                                 total_done++;
1167                                 BIO_printf(bio_err,"\n");
1168                                 if (!BN_add_word(serial,1)) goto err;
1169                                 if (!sk_X509_push(cert_sk,x))
1170                                         {
1171                                         BIO_printf(bio_err,"Memory allocation failure\n");
1172                                         goto err;
1173                                         }
1174                                 if (outfile)
1175                                         {
1176                                         output_der = 1;
1177                                         batch = 1;
1178                                         }
1179                                 }
1180                         }
1181                 if (ss_cert_file != NULL)
1182                         {
1183                         total++;
1184                         j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
1185                                 db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
1186                                 extensions,conf,verbose, certopt, nameopt,
1187                                 default_op, ext_copy, e);
1188                         if (j < 0) goto err;
1189                         if (j > 0)
1190                                 {
1191                                 total_done++;
1192                                 BIO_printf(bio_err,"\n");
1193                                 if (!BN_add_word(serial,1)) goto err;
1194                                 if (!sk_X509_push(cert_sk,x))
1195                                         {
1196                                         BIO_printf(bio_err,"Memory allocation failure\n");
1197                                         goto err;
1198                                         }
1199                                 }
1200                         }
1201                 if (infile != NULL)
1202                         {
1203                         total++;
1204                         j=certify(&x,infile,pkey,x509p,dgst,attribs,db,
1205                                 serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
1206                                 extensions,conf,verbose, certopt, nameopt,
1207                                 default_op, ext_copy, selfsign);
1208                         if (j < 0) goto err;
1209                         if (j > 0)
1210                                 {
1211                                 total_done++;
1212                                 BIO_printf(bio_err,"\n");
1213                                 if (!BN_add_word(serial,1)) goto err;
1214                                 if (!sk_X509_push(cert_sk,x))
1215                                         {
1216                                         BIO_printf(bio_err,"Memory allocation failure\n");
1217                                         goto err;
1218                                         }
1219                                 }
1220                         }
1221                 for (i=0; i<argc; i++)
1222                         {
1223                         total++;
1224                         j=certify(&x,argv[i],pkey,x509p,dgst,attribs,db,
1225                                 serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
1226                                 extensions,conf,verbose, certopt, nameopt,
1227                                 default_op, ext_copy, selfsign);
1228                         if (j < 0) goto err;
1229                         if (j > 0)
1230                                 {
1231                                 total_done++;
1232                                 BIO_printf(bio_err,"\n");
1233                                 if (!BN_add_word(serial,1)) goto err;
1234                                 if (!sk_X509_push(cert_sk,x))
1235                                         {
1236                                         BIO_printf(bio_err,"Memory allocation failure\n");
1237                                         goto err;
1238                                         }
1239                                 }
1240                         }
1241                 /* we have a stack of newly certified certificates
1242                  * and a data base and serial number that need
1243                  * updating */
1244
1245                 if (sk_X509_num(cert_sk) > 0)
1246                         {
1247                         if (!batch)
1248                                 {
1249                                 BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
1250                                 (void)BIO_flush(bio_err);
1251                                 buf[0][0]='\0';
1252                                 if (!fgets(buf[0],10,stdin))
1253                                         {
1254                                         BIO_printf(bio_err,"CERTIFICATION CANCELED: I/O error\n");
1255                                         ret=0;
1256                                         goto err;
1257                                         }
1258                                 if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
1259                                         {
1260                                         BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
1261                                         ret=0;
1262                                         goto err;
1263                                         }
1264                                 }
1265
1266                         BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
1267
1268                         if (!save_serial(serialfile,"new",serial,NULL)) goto err;
1269
1270                         if (!save_index(dbfile, "new", db)) goto err;
1271                         }
1272
1273                 if (verbose)
1274                         BIO_printf(bio_err,"writing new certificates\n");
1275                 for (i=0; i<sk_X509_num(cert_sk); i++)
1276                         {
1277                         int k;
1278                         char *n;
1279
1280                         x=sk_X509_value(cert_sk,i);
1281
1282                         j=x->cert_info->serialNumber->length;
1283                         p=(const char *)x->cert_info->serialNumber->data;
1284
1285                         if(strlen(outdir) >= (size_t)(j ? BSIZE-j*2-6 : BSIZE-8))
1286                                 {
1287                                 BIO_printf(bio_err,"certificate file name too long\n");
1288                                 goto err;
1289                                 }
1290
1291                         strcpy(buf[2],outdir);
1292
1293 #ifndef OPENSSL_SYS_VMS
1294                         BUF_strlcat(buf[2],"/",sizeof(buf[2]));
1295 #endif
1296
1297                         n=(char *)&(buf[2][strlen(buf[2])]);
1298                         if (j > 0)
1299                                 {
1300                                 for (k=0; k<j; k++)
1301                                         {
1302                                         if (n >= &(buf[2][sizeof(buf[2])]))
1303                                                 break;
1304                                         BIO_snprintf(n,
1305                                                      &buf[2][0] + sizeof(buf[2]) - n,
1306                                                      "%02X",(unsigned char)*(p++));
1307                                         n+=2;
1308                                         }
1309                                 }
1310                         else
1311                                 {
1312                                 *(n++)='0';
1313                                 *(n++)='0';
1314                                 }
1315                         *(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
1316                         *n='\0';
1317                         if (verbose)
1318                                 BIO_printf(bio_err,"writing %s\n",buf[2]);
1319
1320                         if (BIO_write_filename(Cout,buf[2]) <= 0)
1321                                 {
1322                                 perror(buf[2]);
1323                                 goto err;
1324                                 }
1325                         write_new_certificate(Cout,x, 0, notext);
1326                         write_new_certificate(Sout,x, output_der, notext);
1327                         }
1328
1329                 if (sk_X509_num(cert_sk))
1330                         {
1331                         /* Rename the database and the serial file */
1332                         if (!rotate_serial(serialfile,"new","old")) goto err;
1333
1334                         if (!rotate_index(dbfile,"new","old")) goto err;
1335
1336                         BIO_printf(bio_err,"Data Base Updated\n");
1337                         }
1338                 }
1339
1340         /*****************************************************************/
1341         if (gencrl)
1342                 {
1343                 int crl_v2 = 0;
1344                 if (!crl_ext)
1345                         {
1346                         crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
1347                         if (!crl_ext)
1348                                 ERR_clear_error();
1349                         }
1350                 if (crl_ext)
1351                         {
1352                         /* Check syntax of file */
1353                         X509V3_CTX ctx;
1354                         X509V3_set_ctx_test(&ctx);
1355                         X509V3_set_nconf(&ctx, conf);
1356                         if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
1357                                 {
1358                                 BIO_printf(bio_err,
1359                                  "Error Loading CRL extension section %s\n",
1360                                                                  crl_ext);
1361                                 ret = 1;
1362                                 goto err;
1363                                 }
1364                         }
1365
1366                 if ((crlnumberfile=NCONF_get_string(conf,section,ENV_CRLNUMBER))
1367                         != NULL)
1368                         if ((crlnumber=load_serial(crlnumberfile,0,NULL)) == NULL)
1369                                 {
1370                                 BIO_printf(bio_err,"error while loading CRL number\n");
1371                                 goto err;
1372                                 }
1373
1374                 if (!crldays && !crlhours)
1375                         {
1376                         if (!NCONF_get_number(conf,section,
1377                                 ENV_DEFAULT_CRL_DAYS, &crldays))
1378                                 crldays = 0;
1379                         if (!NCONF_get_number(conf,section,
1380                                 ENV_DEFAULT_CRL_HOURS, &crlhours))
1381                                 crlhours = 0;
1382                         }
1383                 if ((crldays == 0) && (crlhours == 0))
1384                         {
1385                         BIO_printf(bio_err,"cannot lookup how long until the next CRL is issued\n");
1386                         goto err;
1387                         }
1388
1389                 if (verbose) BIO_printf(bio_err,"making CRL\n");
1390                 if ((crl=X509_CRL_new()) == NULL) goto err;
1391                 if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509))) goto err;
1392
1393                 tmptm = ASN1_TIME_new();
1394                 if (!tmptm) goto err;
1395                 X509_gmtime_adj(tmptm,0);
1396                 X509_CRL_set_lastUpdate(crl, tmptm);
1397                 X509_gmtime_adj(tmptm,(crldays*24+crlhours)*60*60);
1398                 X509_CRL_set_nextUpdate(crl, tmptm);
1399
1400                 ASN1_TIME_free(tmptm);
1401
1402                 for (i=0; i<sk_num(db->db->data); i++)
1403                         {
1404                         pp=(const char **)sk_value(db->db->data,i);
1405                         if (pp[DB_type][0] == DB_TYPE_REV)
1406                                 {
1407                                 if ((r=X509_REVOKED_new()) == NULL) goto err;
1408                                 j = make_revoked(r, pp[DB_rev_date]);
1409                                 if (!j) goto err;
1410                                 if (j == 2) crl_v2 = 1;
1411                                 if (!BN_hex2bn(&serial, pp[DB_serial]))
1412                                         goto err;
1413                                 tmpser = BN_to_ASN1_INTEGER(serial, NULL);
1414                                 BN_free(serial);
1415                                 serial = NULL;
1416                                 if (!tmpser)
1417                                         goto err;
1418                                 X509_REVOKED_set_serialNumber(r, tmpser);
1419                                 ASN1_INTEGER_free(tmpser);
1420                                 X509_CRL_add0_revoked(crl,r);
1421                                 }
1422                         }
1423
1424                 /* sort the data so it will be written in serial
1425                  * number order */
1426                 X509_CRL_sort(crl);
1427
1428                 /* we now have a CRL */
1429                 if (verbose) BIO_printf(bio_err,"signing CRL\n");
1430 #ifndef OPENSSL_NO_DSA
1431                 if (pkey->type == EVP_PKEY_DSA)
1432                         dgst=EVP_dss1();
1433                 else
1434 #endif
1435 #ifndef OPENSSL_NO_ECDSA
1436                 if (pkey->type == EVP_PKEY_EC)
1437                         dgst=EVP_ecdsa();
1438 #endif
1439
1440                 /* Add any extensions asked for */
1441
1442                 if (crl_ext || crlnumberfile != NULL)
1443                         {
1444                         X509V3_CTX crlctx;
1445                         X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
1446                         X509V3_set_nconf(&crlctx, conf);
1447
1448                         if (crl_ext)
1449                                 if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
1450                                         crl_ext, crl)) goto err;
1451                         if (crlnumberfile != NULL)
1452                                 {
1453                                 tmpser = BN_to_ASN1_INTEGER(crlnumber, NULL);
1454                                 if (!tmpser) goto err;
1455                                 X509_CRL_add1_ext_i2d(crl,NID_crl_number,tmpser,0,0);
1456                                 ASN1_INTEGER_free(tmpser);
1457                                 crl_v2 = 1;
1458                                 if (!BN_add_word(crlnumber,1)) goto err;
1459                                 }
1460                         }
1461                 if (crl_ext || crl_v2)
1462                         {
1463                         if (!X509_CRL_set_version(crl, 1))
1464                                 goto err; /* version 2 CRL */
1465                         }
1466
1467
1468                 if (crlnumberfile != NULL)      /* we have a CRL number that need updating */
1469                         if (!save_serial(crlnumberfile,"new",crlnumber,NULL)) goto err;
1470
1471                 if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
1472
1473                 PEM_write_bio_X509_CRL(Sout,crl);
1474
1475                 if (crlnumberfile != NULL)      /* Rename the crlnumber file */
1476                         if (!rotate_serial(crlnumberfile,"new","old")) goto err;
1477
1478                 }
1479         /*****************************************************************/
1480         if (dorevoke)
1481                 {
1482                 if (infile == NULL)
1483                         {
1484                         BIO_printf(bio_err,"no input files\n");
1485                         goto err;
1486                         }
1487                 else
1488                         {
1489                         X509 *revcert;
1490                         revcert=load_cert(bio_err, infile, FORMAT_PEM,
1491                                 NULL, e, infile);
1492                         if (revcert == NULL)
1493                                 goto err;
1494                         j=do_revoke(revcert,db, rev_type, rev_arg);
1495                         if (j <= 0) goto err;
1496                         X509_free(revcert);
1497
1498                         if (!save_index(dbfile, "new", db)) goto err;
1499
1500                         if (!rotate_index(dbfile, "new", "old")) goto err;
1501
1502                         BIO_printf(bio_err,"Data Base Updated\n");
1503                         }
1504                 }
1505         /*****************************************************************/
1506         ret=0;
1507 err:
1508         if(tofree)
1509                 OPENSSL_free(tofree);
1510         BIO_free_all(Cout);
1511         BIO_free_all(Sout);
1512         BIO_free_all(out);
1513         BIO_free_all(in);
1514
1515         if (cert_sk)
1516                 sk_X509_pop_free(cert_sk,X509_free);
1517
1518         if (ret) ERR_print_errors(bio_err);
1519         app_RAND_write_file(randfile, bio_err);
1520         if (free_key && key)
1521                 OPENSSL_free(key);
1522         BN_free(serial);
1523         free_index(db);
1524         EVP_PKEY_free(pkey);
1525         if (x509) X509_free(x509);
1526         X509_CRL_free(crl);
1527         NCONF_free(conf);
1528         NCONF_free(extconf);
1529         OBJ_cleanup();
1530         apps_shutdown();
1531         OPENSSL_EXIT(ret);
1532         }
1533
1534 static void lookup_fail(const char *name, const char *tag)
1535         {
1536         BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
1537         }
1538
1539 static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1540              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
1541              BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
1542              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1543              unsigned long certopt, unsigned long nameopt, int default_op,
1544              int ext_copy, int selfsign)
1545         {
1546         X509_REQ *req=NULL;
1547         BIO *in=NULL;
1548         EVP_PKEY *pktmp=NULL;
1549         int ok= -1,i;
1550
1551         in=BIO_new(BIO_s_file());
1552
1553         if (BIO_read_filename(in,infile) <= 0)
1554                 {
1555                 perror(infile);
1556                 goto err;
1557                 }
1558         if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
1559                 {
1560                 BIO_printf(bio_err,"Error reading certificate request in %s\n",
1561                         infile);
1562                 goto err;
1563                 }
1564         if (verbose)
1565                 X509_REQ_print(bio_err,req);
1566
1567         BIO_printf(bio_err,"Check that the request matches the signature\n");
1568
1569         if (selfsign && !X509_REQ_check_private_key(req,pkey))
1570                 {
1571                 BIO_printf(bio_err,"Certificate request and CA private key do not match\n");
1572                 ok=0;
1573                 goto err;
1574                 }
1575         if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
1576                 {
1577                 BIO_printf(bio_err,"error unpacking public key\n");
1578                 goto err;
1579                 }
1580         i=X509_REQ_verify(req,pktmp);
1581         EVP_PKEY_free(pktmp);
1582         if (i < 0)
1583                 {
1584                 ok=0;
1585                 BIO_printf(bio_err,"Signature verification problems....\n");
1586                 goto err;
1587                 }
1588         if (i == 0)
1589                 {
1590                 ok=0;
1591                 BIO_printf(bio_err,"Signature did not match the certificate request\n");
1592                 goto err;
1593                 }
1594         else
1595                 BIO_printf(bio_err,"Signature ok\n");
1596
1597         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn, email_dn,
1598                 startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
1599                 certopt, nameopt, default_op, ext_copy, selfsign);
1600
1601 err:
1602         if (req != NULL) X509_REQ_free(req);
1603         if (in != NULL) BIO_free(in);
1604         return(ok);
1605         }
1606
1607 static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1608              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
1609              BIGNUM *serial, char *subj, unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
1610              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1611              unsigned long certopt, unsigned long nameopt, int default_op,
1612              int ext_copy, ENGINE *e)
1613         {
1614         X509 *req=NULL;
1615         X509_REQ *rreq=NULL;
1616         EVP_PKEY *pktmp=NULL;
1617         int ok= -1,i;
1618
1619         if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
1620                 goto err;
1621         if (verbose)
1622                 X509_print(bio_err,req);
1623
1624         BIO_printf(bio_err,"Check that the request matches the signature\n");
1625
1626         if ((pktmp=X509_get_pubkey(req)) == NULL)
1627                 {
1628                 BIO_printf(bio_err,"error unpacking public key\n");
1629                 goto err;
1630                 }
1631         i=X509_verify(req,pktmp);
1632         EVP_PKEY_free(pktmp);
1633         if (i < 0)
1634                 {
1635                 ok=0;
1636                 BIO_printf(bio_err,"Signature verification problems....\n");
1637                 goto err;
1638                 }
1639         if (i == 0)
1640                 {
1641                 ok=0;
1642                 BIO_printf(bio_err,"Signature did not match the certificate\n");
1643                 goto err;
1644                 }
1645         else
1646                 BIO_printf(bio_err,"Signature ok\n");
1647
1648         if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
1649                 goto err;
1650
1651         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
1652                 days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
1653                 ext_copy, 0);
1654
1655 err:
1656         if (rreq != NULL) X509_REQ_free(rreq);
1657         if (req != NULL) X509_free(req);
1658         return(ok);
1659         }
1660
1661 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
1662              STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
1663              unsigned long chtype, int multirdn,
1664              int email_dn, char *startdate, char *enddate, long days, int batch,
1665              int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
1666              unsigned long certopt, unsigned long nameopt, int default_op,
1667              int ext_copy, int selfsign)
1668         {
1669         X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
1670         ASN1_UTCTIME *tm,*tmptm;
1671         ASN1_STRING *str,*str2;
1672         ASN1_OBJECT *obj;
1673         X509 *ret=NULL;
1674         X509_CINF *ci;
1675         X509_NAME_ENTRY *ne;
1676         X509_NAME_ENTRY *tne,*push;
1677         EVP_PKEY *pktmp;
1678         int ok= -1,i,j,last,nid;
1679         const char *p;
1680         CONF_VALUE *cv;
1681         char *row[DB_NUMBER],**rrow=NULL,**irow=NULL;
1682         char buf[25];
1683
1684         tmptm=ASN1_UTCTIME_new();
1685         if (tmptm == NULL)
1686                 {
1687                 BIO_printf(bio_err,"malloc error\n");
1688                 return(0);
1689                 }
1690
1691         for (i=0; i<DB_NUMBER; i++)
1692                 row[i]=NULL;
1693
1694         if (subj)
1695                 {
1696                 X509_NAME *n = parse_name(subj, chtype, multirdn);
1697
1698                 if (!n)
1699                         {
1700                         ERR_print_errors(bio_err);
1701                         goto err;
1702                         }
1703                 X509_REQ_set_subject_name(req,n);
1704                 req->req_info->enc.modified = 1;
1705                 X509_NAME_free(n);
1706                 }
1707
1708         if (default_op)
1709                 BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
1710
1711         name=X509_REQ_get_subject_name(req);
1712         for (i=0; i<X509_NAME_entry_count(name); i++)
1713                 {
1714                 ne= X509_NAME_get_entry(name,i);
1715                 str=X509_NAME_ENTRY_get_data(ne);
1716                 obj=X509_NAME_ENTRY_get_object(ne);
1717
1718                 if (msie_hack)
1719                         {
1720                         /* assume all type should be strings */
1721                         nid=OBJ_obj2nid(ne->object);
1722
1723                         if (str->type == V_ASN1_UNIVERSALSTRING)
1724                                 ASN1_UNIVERSALSTRING_to_string(str);
1725
1726                         if ((str->type == V_ASN1_IA5STRING) &&
1727                                 (nid != NID_pkcs9_emailAddress))
1728                                 str->type=V_ASN1_T61STRING;
1729
1730                         if ((nid == NID_pkcs9_emailAddress) &&
1731                                 (str->type == V_ASN1_PRINTABLESTRING))
1732                                 str->type=V_ASN1_IA5STRING;
1733                         }
1734
1735                 /* If no EMAIL is wanted in the subject */
1736                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
1737                         continue;
1738
1739                 /* check some things */
1740                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
1741                         (str->type != V_ASN1_IA5STRING))
1742                         {
1743                         BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
1744                         goto err;
1745                         }
1746                 if ((str->type != V_ASN1_BMPSTRING) && (str->type != V_ASN1_UTF8STRING))
1747                         {
1748                         j=ASN1_PRINTABLE_type(str->data,str->length);
1749                         if (    ((j == V_ASN1_T61STRING) &&
1750                                  (str->type != V_ASN1_T61STRING)) ||
1751                                 ((j == V_ASN1_IA5STRING) &&
1752                                  (str->type == V_ASN1_PRINTABLESTRING)))
1753                                 {
1754                                 BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
1755                                 goto err;
1756                                 }
1757                         }
1758
1759                 if (default_op)
1760                         old_entry_print(bio_err, obj, str);
1761                 }
1762
1763         /* Ok, now we check the 'policy' stuff. */
1764         if ((subject=X509_NAME_new()) == NULL)
1765                 {
1766                 BIO_printf(bio_err,"Memory allocation failure\n");
1767                 goto err;
1768                 }
1769
1770         /* take a copy of the issuer name before we mess with it. */
1771         if (selfsign)
1772                 CAname=X509_NAME_dup(name);
1773         else
1774                 CAname=X509_NAME_dup(x509->cert_info->subject);
1775         if (CAname == NULL) goto err;
1776         str=str2=NULL;
1777
1778         for (i=0; i<sk_CONF_VALUE_num(policy); i++)
1779                 {
1780                 cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
1781                 if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
1782                         {
1783                         BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
1784                         goto err;
1785                         }
1786                 obj=OBJ_nid2obj(j);
1787
1788                 last= -1;
1789                 for (;;)
1790                         {
1791                         /* lookup the object in the supplied name list */
1792                         j=X509_NAME_get_index_by_OBJ(name,obj,last);
1793                         if (j < 0)
1794                                 {
1795                                 if (last != -1) break;
1796                                 tne=NULL;
1797                                 }
1798                         else
1799                                 {
1800                                 tne=X509_NAME_get_entry(name,j);
1801                                 }
1802                         last=j;
1803
1804                         /* depending on the 'policy', decide what to do. */
1805                         push=NULL;
1806                         if (strcmp(cv->value,"optional") == 0)
1807                                 {
1808                                 if (tne != NULL)
1809                                         push=tne;
1810                                 }
1811                         else if (strcmp(cv->value,"supplied") == 0)
1812                                 {
1813                                 if (tne == NULL)
1814                                         {
1815                                         BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
1816                                         goto err;
1817                                         }
1818                                 else
1819                                         push=tne;
1820                                 }
1821                         else if (strcmp(cv->value,"match") == 0)
1822                                 {
1823                                 int last2;
1824
1825                                 if (tne == NULL)
1826                                         {
1827                                         BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
1828                                         goto err;
1829                                         }
1830
1831                                 last2= -1;
1832
1833 again2:
1834                                 j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
1835                                 if ((j < 0) && (last2 == -1))
1836                                         {
1837                                         BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
1838                                         goto err;
1839                                         }
1840                                 if (j >= 0)
1841                                         {
1842                                         push=X509_NAME_get_entry(CAname,j);
1843                                         str=X509_NAME_ENTRY_get_data(tne);
1844                                         str2=X509_NAME_ENTRY_get_data(push);
1845                                         last2=j;
1846                                         if (ASN1_STRING_cmp(str,str2) != 0)
1847                                                 goto again2;
1848                                         }
1849                                 if (j < 0)
1850                                         {
1851                                         BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
1852                                         goto err;
1853                                         }
1854                                 }
1855                         else
1856                                 {
1857                                 BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
1858                                 goto err;
1859                                 }
1860
1861                         if (push != NULL)
1862                                 {
1863                                 if (!X509_NAME_add_entry(subject,push, -1, 0))
1864                                         {
1865                                         if (push != NULL)
1866                                                 X509_NAME_ENTRY_free(push);
1867                                         BIO_printf(bio_err,"Memory allocation failure\n");
1868                                         goto err;
1869                                         }
1870                                 }
1871                         if (j < 0) break;
1872                         }
1873                 }
1874
1875         if (preserve)
1876                 {
1877                 X509_NAME_free(subject);
1878                 /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
1879                 subject=X509_NAME_dup(name);
1880                 if (subject == NULL) goto err;
1881                 }
1882
1883         if (verbose)
1884                 BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
1885
1886         /* Build the correct Subject if no e-mail is wanted in the subject */
1887         /* and add it later on because of the method extensions are added (altName) */
1888
1889         if (email_dn)
1890                 dn_subject = subject;
1891         else
1892                 {
1893                 X509_NAME_ENTRY *tmpne;
1894                 /* Its best to dup the subject DN and then delete any email
1895                  * addresses because this retains its structure.
1896                  */
1897                 if (!(dn_subject = X509_NAME_dup(subject)))
1898                         {
1899                         BIO_printf(bio_err,"Memory allocation failure\n");
1900                         goto err;
1901                         }
1902                 while((i = X509_NAME_get_index_by_NID(dn_subject,
1903                                         NID_pkcs9_emailAddress, -1)) >= 0)
1904                         {
1905                         tmpne = X509_NAME_get_entry(dn_subject, i);
1906                         X509_NAME_delete_entry(dn_subject, i);
1907                         X509_NAME_ENTRY_free(tmpne);
1908                         }
1909                 }
1910
1911         if (BN_is_zero(serial))
1912                 row[DB_serial]=BUF_strdup("00");
1913         else
1914                 row[DB_serial]=BN_bn2hex(serial);
1915         if (row[DB_serial] == NULL)
1916                 {
1917                 BIO_printf(bio_err,"Memory allocation failure\n");
1918                 goto err;
1919                 }
1920
1921         if (db->attributes.unique_subject)
1922                 {
1923                 rrow=TXT_DB_get_by_index(db->db,DB_name,row);
1924                 if (rrow != NULL)
1925                         {
1926                         BIO_printf(bio_err,
1927                                 "ERROR:There is already a certificate for %s\n",
1928                                 row[DB_name]);
1929                         }
1930                 }
1931         if (rrow == NULL)
1932                 {
1933                 rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
1934                 if (rrow != NULL)
1935                         {
1936                         BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
1937                                 row[DB_serial]);
1938                         BIO_printf(bio_err,"      check the database/serial_file for corruption\n");
1939                         }
1940                 }
1941
1942         if (rrow != NULL)
1943                 {
1944                 BIO_printf(bio_err,
1945                         "The matching entry has the following details\n");
1946                 if (rrow[DB_type][0] == 'E')
1947                         p="Expired";
1948                 else if (rrow[DB_type][0] == 'R')
1949                         p="Revoked";
1950                 else if (rrow[DB_type][0] == 'V')
1951                         p="Valid";
1952                 else
1953                         p="\ninvalid type, Data base error\n";
1954                 BIO_printf(bio_err,"Type          :%s\n",p);;
1955                 if (rrow[DB_type][0] == 'R')
1956                         {
1957                         p=rrow[DB_exp_date]; if (p == NULL) p="undef";
1958                         BIO_printf(bio_err,"Was revoked on:%s\n",p);
1959                         }
1960                 p=rrow[DB_exp_date]; if (p == NULL) p="undef";
1961                 BIO_printf(bio_err,"Expires on    :%s\n",p);
1962                 p=rrow[DB_serial]; if (p == NULL) p="undef";
1963                 BIO_printf(bio_err,"Serial Number :%s\n",p);
1964                 p=rrow[DB_file]; if (p == NULL) p="undef";
1965                 BIO_printf(bio_err,"File name     :%s\n",p);
1966                 p=rrow[DB_name]; if (p == NULL) p="undef";
1967                 BIO_printf(bio_err,"Subject Name  :%s\n",p);
1968                 ok= -1; /* This is now a 'bad' error. */
1969                 goto err;
1970                 }
1971
1972         /* We are now totally happy, lets make and sign the certificate */
1973         if (verbose)
1974                 BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
1975
1976         if ((ret=X509_new()) == NULL) goto err;
1977         ci=ret->cert_info;
1978
1979 #ifdef X509_V3
1980         /* Make it an X509 v3 certificate. */
1981         if (!X509_set_version(ret,2)) goto err;
1982 #endif
1983
1984         if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
1985                 goto err;
1986         if (selfsign)
1987                 {
1988                 if (!X509_set_issuer_name(ret,subject))
1989                         goto err;
1990                 }
1991         else
1992                 {
1993                 if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
1994                         goto err;
1995                 }
1996
1997         if (strcmp(startdate,"today") == 0)
1998                 X509_gmtime_adj(X509_get_notBefore(ret),0);
1999         else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);
2000
2001         if (enddate == NULL)
2002                 X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);
2003         else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);
2004
2005         if (!X509_set_subject_name(ret,subject)) goto err;
2006
2007         pktmp=X509_REQ_get_pubkey(req);
2008         i = X509_set_pubkey(ret,pktmp);
2009         EVP_PKEY_free(pktmp);
2010         if (!i) goto err;
2011
2012         /* Lets add the extensions, if there are any */
2013         if (ext_sect)
2014                 {
2015                 X509V3_CTX ctx;
2016                 if (ci->version == NULL)
2017                         if ((ci->version=ASN1_INTEGER_new()) == NULL)
2018                                 goto err;
2019                 ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
2020
2021                 /* Free the current entries if any, there should not
2022                  * be any I believe */
2023                 if (ci->extensions != NULL)
2024                         sk_X509_EXTENSION_pop_free(ci->extensions,
2025                                                    X509_EXTENSION_free);
2026
2027                 ci->extensions = NULL;
2028
2029                 /* Initialize the context structure */
2030                 if (selfsign)
2031                         X509V3_set_ctx(&ctx, ret, ret, req, NULL, 0);
2032                 else
2033                         X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
2034
2035                 if (extconf)
2036                         {
2037                         if (verbose)
2038                                 BIO_printf(bio_err, "Extra configuration file found\n");
2039
2040                         /* Use the extconf configuration db LHASH */
2041                         X509V3_set_nconf(&ctx, extconf);
2042
2043                         /* Test the structure (needed?) */
2044                         /* X509V3_set_ctx_test(&ctx); */
2045
2046                         /* Adds exts contained in the configuration file */
2047                         if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
2048                                 {
2049                                 BIO_printf(bio_err,
2050                                     "ERROR: adding extensions in section %s\n",
2051                                                                 ext_sect);
2052                                 ERR_print_errors(bio_err);
2053                                 goto err;
2054                                 }
2055                         if (verbose)
2056                                 BIO_printf(bio_err, "Successfully added extensions from file.\n");
2057                         }
2058                 else if (ext_sect)
2059                         {
2060                         /* We found extensions to be set from config file */
2061                         X509V3_set_nconf(&ctx, lconf);
2062
2063                         if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
2064                                 {
2065                                 BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
2066                                 ERR_print_errors(bio_err);
2067                                 goto err;
2068                                 }
2069
2070                         if (verbose)
2071                                 BIO_printf(bio_err, "Successfully added extensions from config\n");
2072                         }
2073                 }
2074
2075         /* Copy extensions from request (if any) */
2076
2077         if (!copy_extensions(ret, req, ext_copy))
2078                 {
2079                 BIO_printf(bio_err, "ERROR: adding extensions from request\n");
2080                 ERR_print_errors(bio_err);
2081                 goto err;
2082                 }
2083
2084         /* Set the right value for the noemailDN option */
2085         if( email_dn == 0 )
2086                 {
2087                 if (!X509_set_subject_name(ret,dn_subject)) goto err;
2088                 }
2089
2090         if (!default_op)
2091                 {
2092                 BIO_printf(bio_err, "Certificate Details:\n");
2093                 /* Never print signature details because signature not present */
2094                 certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
2095                 X509_print_ex(bio_err, ret, nameopt, certopt);
2096                 }
2097
2098         BIO_printf(bio_err,"Certificate is to be certified until ");
2099         ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
2100         if (days) BIO_printf(bio_err," (%ld days)",days);
2101         BIO_printf(bio_err, "\n");
2102
2103         if (!batch)
2104                 {
2105
2106                 BIO_printf(bio_err,"Sign the certificate? [y/n]:");
2107                 (void)BIO_flush(bio_err);
2108                 buf[0]='\0';
2109                 if (!fgets(buf,sizeof(buf)-1,stdin))
2110                         {
2111                         BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED: I/O error\n");
2112                         ok=0;
2113                         goto err;
2114                         }
2115                 if (!((buf[0] == 'y') || (buf[0] == 'Y')))
2116                         {
2117                         BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
2118                         ok=0;
2119                         goto err;
2120                         }
2121                 }
2122
2123
2124 #ifndef OPENSSL_NO_DSA
2125         if (pkey->type == EVP_PKEY_DSA) dgst=EVP_dss1();
2126         pktmp=X509_get_pubkey(ret);
2127         if (EVP_PKEY_missing_parameters(pktmp) &&
2128                 !EVP_PKEY_missing_parameters(pkey))
2129                 EVP_PKEY_copy_parameters(pktmp,pkey);
2130         EVP_PKEY_free(pktmp);
2131 #endif
2132 #ifndef OPENSSL_NO_ECDSA
2133         if (pkey->type == EVP_PKEY_EC)
2134                 dgst = EVP_ecdsa();
2135         pktmp = X509_get_pubkey(ret);
2136         if (EVP_PKEY_missing_parameters(pktmp) &&
2137                 !EVP_PKEY_missing_parameters(pkey))
2138                 EVP_PKEY_copy_parameters(pktmp, pkey);
2139         EVP_PKEY_free(pktmp);
2140 #endif
2141
2142
2143         if (!X509_sign(ret,pkey,dgst))
2144                 goto err;
2145
2146         /* We now just add it to the database */
2147         row[DB_type]=(char *)OPENSSL_malloc(2);
2148
2149         tm=X509_get_notAfter(ret);
2150         row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2151         memcpy(row[DB_exp_date],tm->data,tm->length);
2152         row[DB_exp_date][tm->length]='\0';
2153
2154         row[DB_rev_date]=NULL;
2155
2156         /* row[DB_serial] done already */
2157         row[DB_file]=(char *)OPENSSL_malloc(8);
2158         row[DB_name]=X509_NAME_oneline(X509_get_subject_name(ret),NULL,0);
2159
2160         if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2161                 (row[DB_file] == NULL) || (row[DB_name] == NULL))
2162                 {
2163                 BIO_printf(bio_err,"Memory allocation failure\n");
2164                 goto err;
2165                 }
2166         BUF_strlcpy(row[DB_file],"unknown",8);
2167         row[DB_type][0]='V';
2168         row[DB_type][1]='\0';
2169
2170         if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2171                 {
2172                 BIO_printf(bio_err,"Memory allocation failure\n");
2173                 goto err;
2174                 }
2175
2176         for (i=0; i<DB_NUMBER; i++)
2177                 {
2178                 irow[i]=row[i];
2179                 row[i]=NULL;
2180                 }
2181         irow[DB_NUMBER]=NULL;
2182
2183         if (!TXT_DB_insert(db->db,irow))
2184                 {
2185                 BIO_printf(bio_err,"failed to update database\n");
2186                 BIO_printf(bio_err,"TXT_DB error number %ld\n",db->db->error);
2187                 goto err;
2188                 }
2189         ok=1;
2190 err:
2191         for (i=0; i<DB_NUMBER; i++)
2192                 if (row[i] != NULL) OPENSSL_free(row[i]);
2193
2194         if (CAname != NULL)
2195                 X509_NAME_free(CAname);
2196         if (subject != NULL)
2197                 X509_NAME_free(subject);
2198         if ((dn_subject != NULL) && !email_dn)
2199                 X509_NAME_free(dn_subject);
2200         if (tmptm != NULL)
2201                 ASN1_UTCTIME_free(tmptm);
2202         if (ok <= 0)
2203                 {
2204                 if (ret != NULL) X509_free(ret);
2205                 ret=NULL;
2206                 }
2207         else
2208                 *xret=ret;
2209         return(ok);
2210         }
2211
2212 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
2213         {
2214
2215         if (output_der)
2216                 {
2217                 (void)i2d_X509_bio(bp,x);
2218                 return;
2219                 }
2220 #if 0
2221         /* ??? Not needed since X509_print prints all this stuff anyway */
2222         f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
2223         BIO_printf(bp,"issuer :%s\n",f);
2224
2225         f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
2226         BIO_printf(bp,"subject:%s\n",f);
2227
2228         BIO_puts(bp,"serial :");
2229         i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
2230         BIO_puts(bp,"\n\n");
2231 #endif
2232         if (!notext)X509_print(bp,x);
2233         PEM_write_bio_X509(bp,x);
2234         }
2235
2236 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
2237              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
2238              BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
2239              long days, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
2240              unsigned long nameopt, int default_op, int ext_copy)
2241         {
2242         STACK_OF(CONF_VALUE) *sk=NULL;
2243         LHASH *parms=NULL;
2244         X509_REQ *req=NULL;
2245         CONF_VALUE *cv=NULL;
2246         NETSCAPE_SPKI *spki = NULL;
2247         X509_REQ_INFO *ri;
2248         char *type,*buf;
2249         EVP_PKEY *pktmp=NULL;
2250         X509_NAME *n=NULL;
2251         X509_NAME_ENTRY *ne=NULL;
2252         int ok= -1,i,j;
2253         long errline;
2254         int nid;
2255
2256         /*
2257          * Load input file into a hash table.  (This is just an easy
2258          * way to read and parse the file, then put it into a convenient
2259          * STACK format).
2260          */
2261         parms=CONF_load(NULL,infile,&errline);
2262         if (parms == NULL)
2263                 {
2264                 BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
2265                 ERR_print_errors(bio_err);
2266                 goto err;
2267                 }
2268
2269         sk=CONF_get_section(parms, "default");
2270         if (sk_CONF_VALUE_num(sk) == 0)
2271                 {
2272                 BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
2273                 CONF_free(parms);
2274                 goto err;
2275                 }
2276
2277         /*
2278          * Now create a dummy X509 request structure.  We don't actually
2279          * have an X509 request, but we have many of the components
2280          * (a public key, various DN components).  The idea is that we
2281          * put these components into the right X509 request structure
2282          * and we can use the same code as if you had a real X509 request.
2283          */
2284         req=X509_REQ_new();
2285         if (req == NULL)
2286                 {
2287                 ERR_print_errors(bio_err);
2288                 goto err;
2289                 }
2290
2291         /*
2292          * Build up the subject name set.
2293          */
2294         ri=req->req_info;
2295         n = ri->subject;
2296
2297         for (i = 0; ; i++)
2298                 {
2299                 if (sk_CONF_VALUE_num(sk) <= i) break;
2300
2301                 cv=sk_CONF_VALUE_value(sk,i);
2302                 type=cv->name;
2303                 /* Skip past any leading X. X: X, etc to allow for
2304                  * multiple instances
2305                  */
2306                 for (buf = cv->name; *buf ; buf++)
2307                         if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
2308                                 {
2309                                 buf++;
2310                                 if (*buf) type = buf;
2311                                 break;
2312                                 }
2313
2314                 buf=cv->value;
2315                 if ((nid=OBJ_txt2nid(type)) == NID_undef)
2316                         {
2317                         if (strcmp(type, "SPKAC") == 0)
2318                                 {
2319                                 spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
2320                                 if (spki == NULL)
2321                                         {
2322                                         BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
2323                                         ERR_print_errors(bio_err);
2324                                         goto err;
2325                                         }
2326                                 }
2327                         continue;
2328                         }
2329
2330                 /*
2331                 if ((nid == NID_pkcs9_emailAddress) && (email_dn == 0))
2332                         continue;
2333                 */
2334
2335                 j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
2336                 if (fix_data(nid, &j) == 0)
2337                         {
2338                         BIO_printf(bio_err,
2339                                 "invalid characters in string %s\n",buf);
2340                         goto err;
2341                         }
2342
2343                 if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
2344                         (unsigned char *)buf,
2345                         strlen(buf))) == NULL)
2346                         goto err;
2347
2348                 if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
2349                 }
2350         if (spki == NULL)
2351                 {
2352                 BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
2353                         infile);
2354                 goto err;
2355                 }
2356
2357         /*
2358          * Now extract the key from the SPKI structure.
2359          */
2360
2361         BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
2362
2363         if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
2364                 {
2365                 BIO_printf(bio_err,"error unpacking SPKAC public key\n");
2366                 goto err;
2367                 }
2368
2369         j = NETSCAPE_SPKI_verify(spki, pktmp);
2370         if (j <= 0)
2371                 {
2372                 BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
2373                 goto err;
2374                 }
2375         BIO_printf(bio_err,"Signature ok\n");
2376
2377         X509_REQ_set_pubkey(req,pktmp);
2378         EVP_PKEY_free(pktmp);
2379         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
2380                    days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
2381                         ext_copy, 0);
2382 err:
2383         if (req != NULL) X509_REQ_free(req);
2384         if (parms != NULL) CONF_free(parms);
2385         if (spki != NULL) NETSCAPE_SPKI_free(spki);
2386         if (ne != NULL) X509_NAME_ENTRY_free(ne);
2387
2388         return(ok);
2389         }
2390
2391 static int fix_data(int nid, int *type)
2392         {
2393         if (nid == NID_pkcs9_emailAddress)
2394                 *type=V_ASN1_IA5STRING;
2395         if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
2396                 *type=V_ASN1_T61STRING;
2397         if ((nid == NID_pkcs9_challengePassword) && (*type == V_ASN1_IA5STRING))
2398                 *type=V_ASN1_T61STRING;
2399         if ((nid == NID_pkcs9_unstructuredName) && (*type == V_ASN1_T61STRING))
2400                 return(0);
2401         if (nid == NID_pkcs9_unstructuredName)
2402                 *type=V_ASN1_IA5STRING;
2403         return(1);
2404         }
2405
2406 static int check_time_format(const char *str)
2407         {
2408         ASN1_UTCTIME tm;
2409
2410         tm.data=(unsigned char *)str;
2411         tm.length=strlen(str);
2412         tm.type=V_ASN1_UTCTIME;
2413         return(ASN1_UTCTIME_check(&tm));
2414         }
2415
2416 static int do_revoke(X509 *x509, CA_DB *db, int type, char *value)
2417         {
2418         ASN1_UTCTIME *tm=NULL;
2419         char *row[DB_NUMBER],**rrow,**irow;
2420         char *rev_str = NULL;
2421         BIGNUM *bn = NULL;
2422         int ok=-1,i;
2423
2424         for (i=0; i<DB_NUMBER; i++)
2425                 row[i]=NULL;
2426         row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
2427         bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
2428         if (BN_is_zero(bn))
2429                 row[DB_serial]=BUF_strdup("00");
2430         else
2431                 row[DB_serial]=BN_bn2hex(bn);
2432         BN_free(bn);
2433         if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2434                 {
2435                 BIO_printf(bio_err,"Memory allocation failure\n");
2436                 goto err;
2437                 }
2438         /* We have to lookup by serial number because name lookup
2439          * skips revoked certs
2440          */
2441         rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
2442         if (rrow == NULL)
2443                 {
2444                 BIO_printf(bio_err,"Adding Entry with serial number %s to DB for %s\n", row[DB_serial], row[DB_name]);
2445
2446                 /* We now just add it to the database */
2447                 row[DB_type]=(char *)OPENSSL_malloc(2);
2448
2449                 tm=X509_get_notAfter(x509);
2450                 row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2451                 memcpy(row[DB_exp_date],tm->data,tm->length);
2452                 row[DB_exp_date][tm->length]='\0';
2453
2454                 row[DB_rev_date]=NULL;
2455
2456                 /* row[DB_serial] done already */
2457                 row[DB_file]=(char *)OPENSSL_malloc(8);
2458
2459                 /* row[DB_name] done already */
2460
2461                 if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2462                         (row[DB_file] == NULL))
2463                         {
2464                         BIO_printf(bio_err,"Memory allocation failure\n");
2465                         goto err;
2466                         }
2467                 BUF_strlcpy(row[DB_file],"unknown",8);
2468                 row[DB_type][0]='V';
2469                 row[DB_type][1]='\0';
2470
2471                 if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2472                         {
2473                         BIO_printf(bio_err,"Memory allocation failure\n");
2474                         goto err;
2475                         }
2476
2477                 for (i=0; i<DB_NUMBER; i++)
2478                         {
2479                         irow[i]=row[i];
2480                         row[i]=NULL;
2481                         }
2482                 irow[DB_NUMBER]=NULL;
2483
2484                 if (!TXT_DB_insert(db->db,irow))
2485                         {
2486                         BIO_printf(bio_err,"failed to update database\n");
2487                         BIO_printf(bio_err,"TXT_DB error number %ld\n",db->db->error);
2488                         goto err;
2489                         }
2490
2491                 /* Revoke Certificate */
2492                 ok = do_revoke(x509,db, type, value);
2493
2494                 goto err;
2495
2496                 }
2497         else if (index_name_cmp((const char **)row,(const char **)rrow))
2498                 {
2499                 BIO_printf(bio_err,"ERROR:name does not match %s\n",
2500                            row[DB_name]);
2501                 goto err;
2502                 }
2503         else if (rrow[DB_type][0]=='R')
2504                 {
2505                 BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
2506                            row[DB_serial]);
2507                 goto err;
2508                 }
2509         else
2510                 {
2511                 BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
2512                 rev_str = make_revocation_str(type, value);
2513                 if (!rev_str)
2514                         {
2515                         BIO_printf(bio_err, "Error in revocation arguments\n");
2516                         goto err;
2517                         }
2518                 rrow[DB_type][0]='R';
2519                 rrow[DB_type][1]='\0';
2520                 rrow[DB_rev_date] = rev_str;
2521                 }
2522         ok=1;
2523 err:
2524         for (i=0; i<DB_NUMBER; i++)
2525                 {
2526                 if (row[i] != NULL)
2527                         OPENSSL_free(row[i]);
2528                 }
2529         return(ok);
2530         }
2531
2532 static int get_certificate_status(const char *serial, CA_DB *db)
2533         {
2534         char *row[DB_NUMBER],**rrow;
2535         int ok=-1,i;
2536
2537         /* Free Resources */
2538         for (i=0; i<DB_NUMBER; i++)
2539                 row[i]=NULL;
2540
2541         /* Malloc needed char spaces */
2542         row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
2543         if (row[DB_serial] == NULL)
2544                 {
2545                 BIO_printf(bio_err,"Malloc failure\n");
2546                 goto err;
2547                 }
2548
2549         if (strlen(serial) % 2)
2550                 {
2551                 /* Set the first char to 0 */;
2552                 row[DB_serial][0]='0';
2553
2554                 /* Copy String from serial to row[DB_serial] */
2555                 memcpy(row[DB_serial]+1, serial, strlen(serial));
2556                 row[DB_serial][strlen(serial)+1]='\0';
2557                 }
2558         else
2559                 {
2560                 /* Copy String from serial to row[DB_serial] */
2561                 memcpy(row[DB_serial], serial, strlen(serial));
2562                 row[DB_serial][strlen(serial)]='\0';
2563                 }
2564
2565         /* Make it Upper Case */
2566         for (i=0; row[DB_serial][i] != '\0'; i++)
2567                 row[DB_serial][i] = toupper(row[DB_serial][i]);
2568
2569
2570         ok=1;
2571
2572         /* Search for the certificate */
2573         rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
2574         if (rrow == NULL)
2575                 {
2576                 BIO_printf(bio_err,"Serial %s not present in db.\n",
2577                                  row[DB_serial]);
2578                 ok=-1;
2579                 goto err;
2580                 }
2581         else if (rrow[DB_type][0]=='V')
2582                 {
2583                 BIO_printf(bio_err,"%s=Valid (%c)\n",
2584                         row[DB_serial], rrow[DB_type][0]);
2585                 goto err;
2586                 }
2587         else if (rrow[DB_type][0]=='R')
2588                 {
2589                 BIO_printf(bio_err,"%s=Revoked (%c)\n",
2590                         row[DB_serial], rrow[DB_type][0]);
2591                 goto err;
2592                 }
2593         else if (rrow[DB_type][0]=='E')
2594                 {
2595                 BIO_printf(bio_err,"%s=Expired (%c)\n",
2596                         row[DB_serial], rrow[DB_type][0]);
2597                 goto err;
2598                 }
2599         else if (rrow[DB_type][0]=='S')
2600                 {
2601                 BIO_printf(bio_err,"%s=Suspended (%c)\n",
2602                         row[DB_serial], rrow[DB_type][0]);
2603                 goto err;
2604                 }
2605         else
2606                 {
2607                 BIO_printf(bio_err,"%s=Unknown (%c).\n",
2608                         row[DB_serial], rrow[DB_type][0]);
2609                 ok=-1;
2610                 }
2611 err:
2612         for (i=0; i<DB_NUMBER; i++)
2613                 {
2614                 if (row[i] != NULL)
2615                         OPENSSL_free(row[i]);
2616                 }
2617         return(ok);
2618         }
2619
2620 static int do_updatedb (CA_DB *db)
2621         {
2622         ASN1_UTCTIME    *a_tm = NULL;
2623         int i, cnt = 0;
2624         int db_y2k, a_y2k;  /* flags = 1 if y >= 2000 */
2625         char **rrow, *a_tm_s;
2626
2627         a_tm = ASN1_UTCTIME_new();
2628
2629         /* get actual time and make a string */
2630         a_tm = X509_gmtime_adj(a_tm, 0);
2631         a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
2632         if (a_tm_s == NULL)
2633                 {
2634                 cnt = -1;
2635                 goto err;
2636                 }
2637
2638         memcpy(a_tm_s, a_tm->data, a_tm->length);
2639         a_tm_s[a_tm->length] = '\0';
2640
2641         if (strncmp(a_tm_s, "49", 2) <= 0)
2642                 a_y2k = 1;
2643         else
2644                 a_y2k = 0;
2645
2646         for (i = 0; i < sk_num(db->db->data); i++)
2647                 {
2648                 rrow = (char **) sk_value(db->db->data, i);
2649
2650                 if (rrow[DB_type][0] == 'V')
2651                         {
2652                         /* ignore entries that are not valid */
2653                         if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
2654                                 db_y2k = 1;
2655                         else
2656                                 db_y2k = 0;
2657
2658                         if (db_y2k == a_y2k)
2659                                 {
2660                                 /* all on the same y2k side */
2661                                 if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
2662                                         {
2663                                         rrow[DB_type][0]  = 'E';
2664                                         rrow[DB_type][1]  = '\0';
2665                                         cnt++;
2666
2667                                         BIO_printf(bio_err, "%s=Expired\n",
2668                                                         rrow[DB_serial]);
2669                                         }
2670                                 }
2671                         else if (db_y2k < a_y2k)
2672                                 {
2673                                 rrow[DB_type][0]  = 'E';
2674                                 rrow[DB_type][1]  = '\0';
2675                                 cnt++;
2676
2677                                 BIO_printf(bio_err, "%s=Expired\n",
2678                                                         rrow[DB_serial]);
2679                                 }
2680
2681                         }
2682                 }
2683
2684 err:
2685
2686         ASN1_UTCTIME_free(a_tm);
2687         OPENSSL_free(a_tm_s);
2688
2689         return (cnt);
2690         }
2691
2692 static const char *crl_reasons[] = {
2693         /* CRL reason strings */
2694         "unspecified",
2695         "keyCompromise",
2696         "CACompromise",
2697         "affiliationChanged",
2698         "superseded",
2699         "cessationOfOperation",
2700         "certificateHold",
2701         "removeFromCRL",
2702         /* Additional pseudo reasons */
2703         "holdInstruction",
2704         "keyTime",
2705         "CAkeyTime"
2706 };
2707
2708 #define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
2709
2710 /* Given revocation information convert to a DB string.
2711  * The format of the string is:
2712  * revtime[,reason,extra]. Where 'revtime' is the
2713  * revocation time (the current time). 'reason' is the
2714  * optional CRL reason and 'extra' is any additional
2715  * argument
2716  */
2717
2718 char *make_revocation_str(int rev_type, char *rev_arg)
2719         {
2720         char *other = NULL, *str;
2721         const char *reason = NULL;
2722         ASN1_OBJECT *otmp;
2723         ASN1_UTCTIME *revtm = NULL;
2724         int i;
2725         switch (rev_type)
2726                 {
2727         case REV_NONE:
2728                 break;
2729
2730         case REV_CRL_REASON:
2731                 for (i = 0; i < 8; i++)
2732                         {
2733                         if (!strcasecmp(rev_arg, crl_reasons[i]))
2734                                 {
2735                                 reason = crl_reasons[i];
2736                                 break;
2737                                 }
2738                         }
2739                 if (reason == NULL)
2740                         {
2741                         BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
2742                         return NULL;
2743                         }
2744                 break;
2745
2746         case REV_HOLD:
2747                 /* Argument is an OID */
2748
2749                 otmp = OBJ_txt2obj(rev_arg, 0);
2750                 ASN1_OBJECT_free(otmp);
2751
2752                 if (otmp == NULL)
2753                         {
2754                         BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
2755                         return NULL;
2756                         }
2757
2758                 reason = "holdInstruction";
2759                 other = rev_arg;
2760                 break;
2761
2762         case REV_KEY_COMPROMISE:
2763         case REV_CA_COMPROMISE:
2764
2765                 /* Argument is the key compromise time  */
2766                 if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
2767                         {
2768                         BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
2769                         return NULL;
2770                         }
2771                 other = rev_arg;
2772                 if (rev_type == REV_KEY_COMPROMISE)
2773                         reason = "keyTime";
2774                 else
2775                         reason = "CAkeyTime";
2776
2777                 break;
2778
2779                 }
2780
2781         revtm = X509_gmtime_adj(NULL, 0);
2782
2783         i = revtm->length + 1;
2784
2785         if (reason) i += strlen(reason) + 1;
2786         if (other) i += strlen(other) + 1;
2787
2788         str = OPENSSL_malloc(i);
2789
2790         if (!str) return NULL;
2791
2792         BUF_strlcpy(str, (char *)revtm->data, i);
2793         if (reason)
2794                 {
2795                 BUF_strlcat(str, ",", i);
2796                 BUF_strlcat(str, reason, i);
2797                 }
2798         if (other)
2799                 {
2800                 BUF_strlcat(str, ",", i);
2801                 BUF_strlcat(str, other, i);
2802                 }
2803         ASN1_UTCTIME_free(revtm);
2804         return str;
2805         }
2806
2807 /* Convert revocation field to X509_REVOKED entry
2808  * return code:
2809  * 0 error
2810  * 1 OK
2811  * 2 OK and some extensions added (i.e. V2 CRL)
2812  */
2813
2814
2815 int make_revoked(X509_REVOKED *rev, const char *str)
2816         {
2817         char *tmp = NULL;
2818         int reason_code = -1;
2819         int i, ret = 0;
2820         ASN1_OBJECT *hold = NULL;
2821         ASN1_GENERALIZEDTIME *comp_time = NULL;
2822         ASN1_ENUMERATED *rtmp = NULL;
2823
2824         ASN1_TIME *revDate = NULL;
2825
2826         i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
2827
2828         if (i == 0)
2829                 goto err;
2830
2831         if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
2832                 goto err;
2833
2834         if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
2835                 {
2836                 rtmp = ASN1_ENUMERATED_new();
2837                 if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
2838                         goto err;
2839                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
2840                         goto err;
2841                 }
2842
2843         if (rev && comp_time)
2844                 {
2845                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
2846                         goto err;
2847                 }
2848         if (rev && hold)
2849                 {
2850                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
2851                         goto err;
2852                 }
2853
2854         if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
2855                 ret = 2;
2856         else ret = 1;
2857
2858         err:
2859
2860         if (tmp) OPENSSL_free(tmp);
2861         ASN1_OBJECT_free(hold);
2862         ASN1_GENERALIZEDTIME_free(comp_time);
2863         ASN1_ENUMERATED_free(rtmp);
2864         ASN1_TIME_free(revDate);
2865
2866         return ret;
2867         }
2868
2869 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
2870         {
2871         char buf[25],*pbuf, *p;
2872         int j;
2873         j=i2a_ASN1_OBJECT(bp,obj);
2874         pbuf=buf;
2875         for (j=22-j; j>0; j--)
2876                 *(pbuf++)=' ';
2877         *(pbuf++)=':';
2878         *(pbuf++)='\0';
2879         BIO_puts(bp,buf);
2880
2881         if (str->type == V_ASN1_PRINTABLESTRING)
2882                 BIO_printf(bp,"PRINTABLE:'");
2883         else if (str->type == V_ASN1_T61STRING)
2884                 BIO_printf(bp,"T61STRING:'");
2885         else if (str->type == V_ASN1_IA5STRING)
2886                 BIO_printf(bp,"IA5STRING:'");
2887         else if (str->type == V_ASN1_UNIVERSALSTRING)
2888                 BIO_printf(bp,"UNIVERSALSTRING:'");
2889         else
2890                 BIO_printf(bp,"ASN.1 %2d:'",str->type);
2891
2892         p=(char *)str->data;
2893         for (j=str->length; j>0; j--)
2894                 {
2895 #ifdef CHARSET_EBCDIC
2896                 if ((*p >= 0x20) && (*p <= 0x7e))
2897                         BIO_printf(bp,"%c",os_toebcdic[*p]);
2898 #else
2899                 if ((*p >= ' ') && (*p <= '~'))
2900                         BIO_printf(bp,"%c",*p);
2901 #endif
2902                 else if (*p & 0x80)
2903                         BIO_printf(bp,"\\0x%02X",*p);
2904                 else if ((unsigned char)*p == 0xf7)
2905                         BIO_printf(bp,"^?");
2906 #ifdef CHARSET_EBCDIC
2907                 else    BIO_printf(bp,"^%c",os_toebcdic[*p+0x40]);
2908 #else
2909                 else    BIO_printf(bp,"^%c",*p+'@');
2910 #endif
2911                 p++;
2912                 }
2913         BIO_printf(bp,"'\n");
2914         return 1;
2915         }
2916
2917 int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)
2918         {
2919         char *tmp = NULL;
2920         char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2921         int reason_code = -1;
2922         int ret = 0;
2923         unsigned int i;
2924         ASN1_OBJECT *hold = NULL;
2925         ASN1_GENERALIZEDTIME *comp_time = NULL;
2926         tmp = BUF_strdup(str);
2927
2928         p = strchr(tmp, ',');
2929
2930         rtime_str = tmp;
2931
2932         if (p)
2933                 {
2934                 *p = '\0';
2935                 p++;
2936                 reason_str = p;
2937                 p = strchr(p, ',');
2938                 if (p)
2939                         {
2940                         *p = '\0';
2941                         arg_str = p + 1;
2942                         }
2943                 }
2944
2945         if (prevtm)
2946                 {
2947                 *prevtm = ASN1_UTCTIME_new();
2948                 if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))
2949                         {
2950                         BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
2951                         goto err;
2952                         }
2953                 }
2954         if (reason_str)
2955                 {
2956                 for (i = 0; i < NUM_REASONS; i++)
2957                         {
2958                         if(!strcasecmp(reason_str, crl_reasons[i]))
2959                                 {
2960                                 reason_code = i;
2961                                 break;
2962                                 }
2963                         }
2964                 if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
2965                         {
2966                         BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
2967                         goto err;
2968                         }
2969
2970                 if (reason_code == 7)
2971                         reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
2972                 else if (reason_code == 8)              /* Hold instruction */
2973                         {
2974                         if (!arg_str)
2975                                 {
2976                                 BIO_printf(bio_err, "missing hold instruction\n");
2977                                 goto err;
2978                                 }
2979                         reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
2980                         hold = OBJ_txt2obj(arg_str, 0);
2981
2982                         if (!hold)
2983                                 {
2984                                 BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
2985                                 goto err;
2986                                 }
2987                         if (phold) *phold = hold;
2988                         }
2989                 else if ((reason_code == 9) || (reason_code == 10))
2990                         {
2991                         if (!arg_str)
2992                                 {
2993                                 BIO_printf(bio_err, "missing compromised time\n");
2994                                 goto err;
2995                                 }
2996                         comp_time = ASN1_GENERALIZEDTIME_new();
2997                         if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
2998                                 {
2999                                 BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
3000                                 goto err;
3001                                 }
3002                         if (reason_code == 9)
3003                                 reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
3004                         else
3005                                 reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
3006                         }
3007                 }
3008
3009         if (preason) *preason = reason_code;
3010         if (pinvtm) *pinvtm = comp_time;
3011         else ASN1_GENERALIZEDTIME_free(comp_time);
3012
3013         ret = 1;
3014
3015         err:
3016
3017         if (tmp) OPENSSL_free(tmp);
3018         if (!phold) ASN1_OBJECT_free(hold);
3019         if (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);
3020
3021         return ret;
3022         }