Reduce chances of issuer and serial number duplication by use of random

[openssl.git] / apps / apps.c

diff --git a/apps/apps.c b/apps/apps.c
index eae1fedcd33c19543c15cc0d5d1b6d2b7610c6a9..6925ab4cdd84c6ce80b459b151c47f7ec95ab06b 100644 (file)
--- a/apps/apps.c
+++ b/apps/apps.c
@@ -125,6 +125,7 @@
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
+#include <openssl/rsa.h>
 
 #define NON_MAIN
 #include "apps.h"
@@ -341,44 +342,6 @@ void program_name(char *in, char *out, int size)
 #endif
 #endif
 
-#ifdef OPENSSL_SYS_WIN32
-int WIN32_rename(char *from, char *to)
-       {
-#ifndef OPENSSL_SYS_WINCE
-       /* Windows rename gives an error if 'to' exists, so delete it
-        * first and ignore file not found errror
-        */
-       if((remove(to) != 0) && (errno != ENOENT))
-               return -1;
-#undef rename
-       return rename(from, to);
-#else
-       /* convert strings to UNICODE */
-       {
-       BOOL result = FALSE;
-       WCHAR* wfrom;
-       WCHAR* wto;
-       int i;
-       wfrom = malloc((strlen(from)+1)*2);
-       wto = malloc((strlen(to)+1)*2);
-       if (wfrom != NULL && wto != NULL)
-               {
-               for (i=0; i<(int)strlen(from)+1; i++)
-                       wfrom[i] = (short)from[i];
-               for (i=0; i<(int)strlen(to)+1; i++)
-                       wto[i] = (short)to[i];
-               result = MoveFile(wfrom, wto);
-               }
-       if (wfrom != NULL)
-               free(wfrom);
-       if (wto != NULL)
-               free(wto);
-       return result;
-       }
-#endif
-       }
-#endif
-
 int chopup_args(ARGS *arg, char *buf, int *argc, char **argv[])
        {
        int num,len,i;
@@ -1471,12 +1434,9 @@ BIGNUM *load_serial(char *serialfile, int create, ASN1_INTEGER **retai)
                        }
                else
                        {
-                       ASN1_INTEGER_set(ai,1);
                        ret=BN_new();
-                       if (ret == NULL)
+                       if (ret == NULL || !rand_serial(ret, ai))
                                BIO_printf(bio_err, "Out of memory\n");
-                       else
-                               BN_one(ret);
                        }
                }
        else
@@ -1638,6 +1598,33 @@ int rotate_serial(char *serialfile, char *new_suffix, char *old_suffix)
        return 0;
        }
 
+int rand_serial(BIGNUM *b, ASN1_INTEGER *ai)
+       {
+       BIGNUM *btmp;
+       int ret = 0;
+       if (b)
+               btmp = b;
+       else
+               btmp = BN_new();
+
+       if (!btmp)
+               return 0;
+
+       if (!BN_pseudo_rand(btmp, SERIAL_RAND_BITS, 0, 0))
+               goto error;
+       if (ai && !BN_to_ASN1_INTEGER(btmp, ai))
+               goto error;
+
+       ret = 1;
+       
+       error:
+
+       if (!b)
+               BN_free(btmp);
+       
+       return ret;
+       }
+
 CA_DB *load_index(char *dbfile, DB_ATTR *db_attr)
        {
        CA_DB *retdb = NULL;
@@ -2114,3 +2101,41 @@ error:
        return NULL;
 }
 
+/* This code MUST COME AFTER anything that uses rename() */
+#ifdef OPENSSL_SYS_WIN32
+int WIN32_rename(char *from, char *to)
+       {
+#ifndef OPENSSL_SYS_WINCE
+       /* Windows rename gives an error if 'to' exists, so delete it
+        * first and ignore file not found errror
+        */
+       if((remove(to) != 0) && (errno != ENOENT))
+               return -1;
+#undef rename
+       return rename(from, to);
+#else
+       /* convert strings to UNICODE */
+       {
+       BOOL result = FALSE;
+       WCHAR* wfrom;
+       WCHAR* wto;
+       int i;
+       wfrom = malloc((strlen(from)+1)*2);
+       wto = malloc((strlen(to)+1)*2);
+       if (wfrom != NULL && wto != NULL)
+               {
+               for (i=0; i<(int)strlen(from)+1; i++)
+                       wfrom[i] = (short)from[i];
+               for (i=0; i<(int)strlen(to)+1; i++)
+                       wto[i] = (short)to[i];
+               result = MoveFile(wfrom, wto);
+               }
+       if (wfrom != NULL)
+               free(wfrom);
+       if (wto != NULL)
+               free(wto);
+       return result;
+       }
+#endif
+       }
+#endif