/* Additional revocation information types */
-#define REV_NONE 0 /* No addditional information */
+#define REV_NONE 0 /* No additional information */
#define REV_CRL_REASON 1 /* Value is CRL reason code */
#define REV_HOLD 2 /* Value is hold instruction */
#define REV_KEY_COMPROMISE 3 /* Value is cert key compromise time */
#define REV_CA_COMPROMISE 4 /* Value is CA key compromise time */
-static void lookup_fail(const char *name, const char *tag);
+static char *lookup_conf(const CONF *conf, const char *group, const char *tag);
static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
STACK_OF(CONF_VALUE) *policy, CA_DB *db,
static int check_time_format(const char *str);
char *make_revocation_str(int rev_type, char *rev_arg);
int make_revoked(X509_REVOKED *rev, const char *str);
-static int old_entry_print(ASN1_OBJECT *obj, ASN1_STRING *str);
+static int old_entry_print(const ASN1_OBJECT *obj, const ASN1_STRING *str);
static CONF *extconf = NULL;
static int preserve = 0;
{"spkac", OPT_SPKAC, '<',
"File contains DN and signed public key and challenge"},
{"revoke", OPT_REVOKE, '<', "Revoke a cert (given in file)"},
- {"valid", OPT_VALID, 's'},
+ {"valid", OPT_VALID, 's',
+ "Add a Valid(not-revoked) DB entry about a cert (given in file)"},
{"extensions", OPT_EXTENSIONS, 's',
"Extension section (override value in config file)"},
{"extfile", OPT_EXTFILE, '<',
char *extensions = NULL, *extfile = NULL, *key = NULL, *passinarg = NULL;
char *outdir = NULL, *outfile = NULL, *rev_arg = NULL, *ser_status = NULL;
char *serialfile = NULL, *startdate = NULL, *subj = NULL;
- char *prog, *enddate = NULL, *tmp_email_dn = NULL;
- char *dbfile = NULL, *f, *randfile = NULL, *tofree = NULL;
+ char *prog, *enddate = NULL;
+ char *dbfile = NULL, *f, *randfile = NULL;
char buf[3][BSIZE];
char *const *pp;
const char *p;
prog = opt_init(argc, argv, ca_options);
while ((o = opt_next()) != OPT_EOF) {
switch (o) {
- case OPT_EOF:
- case OPT_ERR:
+ case OPT_EOF:
+ case OPT_ERR:
opthelp:
- BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
- goto end;
- case OPT_HELP:
- opt_help(ca_options);
- ret = 0;
- goto end;
- case OPT_IN:
- req = 1;
- infile = opt_arg();
- break;
- case OPT_OUT:
- outfile = opt_arg();
- break;
- case OPT_VERBOSE:
- verbose = 1;
- break;
- case OPT_CONFIG:
- configfile = opt_arg();
- break;
- case OPT_NAME:
- section = opt_arg();
- break;
- case OPT_SUBJ:
- subj = opt_arg();
- /* preserve=1; */
- break;
- case OPT_UTF8:
- chtype = MBSTRING_UTF8;
- break;
+ BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
+ goto end;
+ case OPT_HELP:
+ opt_help(ca_options);
+ ret = 0;
+ goto end;
+ case OPT_IN:
+ req = 1;
+ infile = opt_arg();
+ break;
+ case OPT_OUT:
+ outfile = opt_arg();
+ break;
+ case OPT_VERBOSE:
+ verbose = 1;
+ break;
+ case OPT_CONFIG:
+ configfile = opt_arg();
+ break;
+ case OPT_NAME:
+ section = opt_arg();
+ break;
+ case OPT_SUBJ:
+ subj = opt_arg();
+ /* preserve=1; */
+ break;
+ case OPT_UTF8:
+ chtype = MBSTRING_UTF8;
+ break;
case OPT_CREATE_SERIAL:
create_ser = 1;
break;
goto end;
/* Lets get the config section we are using */
- if (section == NULL) {
- section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_CA);
- if (section == NULL) {
- lookup_fail(BASE_SECTION, ENV_DEFAULT_CA);
- goto end;
- }
- }
+ if (section == NULL
+ && (section = lookup_conf(conf, BASE_SECTION, ENV_DEFAULT_CA)) == NULL)
+ goto end;
if (conf != NULL) {
p = NCONF_get_string(conf, NULL, "oid_file");
} else
ERR_clear_error();
- /*****************************************************************/
+ /*****************************************************************/
/* report status of cert with serial number given on command line */
if (ser_status) {
- if ((dbfile = NCONF_get_string(conf, section, ENV_DATABASE)) == NULL) {
- lookup_fail(section, ENV_DATABASE);
+ dbfile = lookup_conf(conf, section, ENV_DATABASE);
+ if (dbfile == NULL)
goto end;
- }
+
db = load_index(dbfile, &db_attr);
if (db == NULL)
goto end;
goto end;
}
- /*****************************************************************/
+ /*****************************************************************/
/* we definitely need a private key, so let's get it */
- if ((keyfile == NULL) && ((keyfile = NCONF_get_string(conf,
- section,
- ENV_PRIVATE_KEY)) ==
- NULL)) {
- lookup_fail(section, ENV_PRIVATE_KEY);
+ if (keyfile == NULL
+ && (keyfile = lookup_conf(conf, section, ENV_PRIVATE_KEY)) == NULL)
goto end;
- }
+
if (!key) {
free_key = 1;
if (!app_passwd(passinarg, NULL, &key, NULL)) {
goto end;
}
- /*****************************************************************/
+ /*****************************************************************/
/* we need a certificate */
if (!selfsign || spkac_file || ss_cert_file || gencrl) {
- if ((certfile == NULL)
- && ((certfile = NCONF_get_string(conf,
- section,
- ENV_CERTIFICATE)) == NULL)) {
- lookup_fail(section, ENV_CERTIFICATE);
+ if (certfile == NULL
+ && (certfile = lookup_conf(conf, section, ENV_CERTIFICATE)) == NULL)
goto end;
- }
+
x509 = load_cert(certfile, FORMAT_PEM, "CA certificate");
if (x509 == NULL)
goto end;
} else
ERR_clear_error();
- /*****************************************************************/
+ /*****************************************************************/
/* lookup where to write new certificates */
if ((outdir == NULL) && (req)) {
- if ((outdir = NCONF_get_string(conf, section, ENV_NEW_CERTS_DIR))
- == NULL) {
+ outdir = NCONF_get_string(conf, section, ENV_NEW_CERTS_DIR);
+ if (outdir == NULL) {
BIO_printf(bio_err,
"there needs to be defined a directory for new certificate to be placed in\n");
goto end;
#endif
}
- /*****************************************************************/
+ /*****************************************************************/
/* we need to load the database file */
- if ((dbfile = NCONF_get_string(conf, section, ENV_DATABASE)) == NULL) {
- lookup_fail(section, ENV_DATABASE);
+ dbfile = lookup_conf(conf, section, ENV_DATABASE);
+ if (dbfile == NULL)
goto end;
- }
+
db = load_index(dbfile, &db_attr);
if (db == NULL)
goto end;
if (!index_index(db))
goto end;
- /*****************************************************************/
+ /*****************************************************************/
/* Update the db file for expired certificates */
if (doupdatedb) {
if (verbose)
extfile);
/* We can have sections in the ext file */
- if (!extensions
- && !(extensions =
- NCONF_get_string(extconf, "default", "extensions")))
- extensions = "default";
+ if (extensions == NULL) {
+ extensions = NCONF_get_string(extconf, "default", "extensions");
+ if (extensions == NULL)
+ extensions = "default";
+ }
}
/*****************************************************************/
goto end;
}
- if ((md == NULL) && ((md = NCONF_get_string(conf,
- section,
- ENV_DEFAULT_MD)) == NULL)) {
- lookup_fail(section, ENV_DEFAULT_MD);
+ if (md == NULL
+ && (md = lookup_conf(conf, section, ENV_DEFAULT_MD)) == NULL)
goto end;
- }
if (strcmp(md, "default") == 0) {
int def_nid;
}
if (req) {
- if ((email_dn == 1) && ((tmp_email_dn = NCONF_get_string(conf,
- section,
- ENV_DEFAULT_EMAIL_DN))
- != NULL)) {
- if (strcmp(tmp_email_dn, "no") == 0)
+ if (email_dn == 1) {
+ char *tmp_email_dn = NULL;
+
+ tmp_email_dn = NCONF_get_string(conf, section, ENV_DEFAULT_EMAIL_DN);
+ if (tmp_email_dn != NULL && strcmp(tmp_email_dn, "no") == 0)
email_dn = 0;
}
if (verbose)
BIO_printf(bio_err, "message digest is %s\n",
OBJ_nid2ln(EVP_MD_type(dgst)));
- if ((policy == NULL) && ((policy = NCONF_get_string(conf,
- section,
- ENV_POLICY)) ==
- NULL)) {
- lookup_fail(section, ENV_POLICY);
+ if (policy == NULL
+ && (policy = lookup_conf(conf, section, ENV_POLICY)) == NULL)
goto end;
- }
+
if (verbose)
BIO_printf(bio_err, "policy is %s\n", policy);
- if ((serialfile = NCONF_get_string(conf, section, ENV_SERIAL))
- == NULL) {
- lookup_fail(section, ENV_SERIAL);
+ serialfile = lookup_conf(conf, section, ENV_SERIAL);
+ if (serialfile == NULL)
goto end;
- }
if (!extconf) {
/*
x = sk_X509_value(cert_sk, i);
j = ASN1_STRING_length(serialNumber);
- p = (const char *)ASN1_STRING_data(serialNumber);
+ p = (const char *)ASN1_STRING_get0_data(serialNumber);
if (strlen(outdir) >= (size_t)(j ? BSIZE - j * 2 - 6 : BSIZE - 8)) {
BIO_printf(bio_err, "certificate file name too long\n");
}
}
- /*****************************************************************/
+ /*****************************************************************/
if (gencrl) {
int crl_v2 = 0;
if (!crl_ext) {
goto end;
}
- /*****************************************************************/
+ /*****************************************************************/
if (dorevoke) {
if (infile == NULL) {
BIO_printf(bio_err, "no input files\n");
BIO_printf(bio_err, "Data Base Updated\n");
}
}
- /*****************************************************************/
+ /*****************************************************************/
ret = 0;
end:
- OPENSSL_free(tofree);
BIO_free_all(Cout);
BIO_free_all(Sout);
BIO_free_all(out);
return (ret);
}
-static void lookup_fail(const char *name, const char *tag)
+static char *lookup_conf(const CONF *conf, const char *section, const char *tag)
{
- BIO_printf(bio_err, "variable lookup failed for %s::%s\n", name, tag);
+ char *entry = NCONF_get_string(conf, section, tag);
+ if (entry == NULL)
+ BIO_printf(bio_err, "variable lookup failed for %s::%s\n", section, tag);
+ return entry;
}
static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
{
X509_NAME *name = NULL, *CAname = NULL, *subject = NULL, *dn_subject =
NULL;
- ASN1_UTCTIME *tm, *tmptm;
+ ASN1_UTCTIME *tm;
ASN1_STRING *str, *str2;
ASN1_OBJECT *obj;
X509 *ret = NULL;
OPENSSL_STRING *rrow = NULL;
char buf[25];
- tmptm = ASN1_UTCTIME_new();
- if (tmptm == NULL) {
- BIO_printf(bio_err, "malloc error\n");
- return (0);
- }
-
for (i = 0; i < DB_NUMBER; i++)
row[i] = NULL;
j = X509_NAME_get_index_by_OBJ(CAname, obj, last2);
if ((j < 0) && (last2 == -1)) {
BIO_printf(bio_err,
- "The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",
+ "The %s field does not exist in the CA certificate,\n"
+ "the 'policy' is misconfigured\n",
cv->name);
goto end;
}
}
if (j < 0) {
BIO_printf(bio_err,
- "The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",
+ "The %s field is different between\n"
+ "CA certificate (%s) and the request (%s)\n",
cv->name,
((str2 == NULL) ? "NULL" : (char *)str2->data),
((str == NULL) ? "NULL" : (char *)str->data));
X509_NAME_free(subject);
if (dn_subject != subject)
X509_NAME_free(dn_subject);
- ASN1_UTCTIME_free(tmptm);
if (ok <= 0)
X509_free(ret);
else
{
char *row[DB_NUMBER], **rrow;
int ok = -1, i;
+ size_t serial_len = strlen(serial);
/* Free Resources */
for (i = 0; i < DB_NUMBER; i++)
row[i] = NULL;
/* Malloc needed char spaces */
- row[DB_serial] = app_malloc(strlen(serial) + 2, "row serial#");
+ row[DB_serial] = app_malloc(serial_len + 2, "row serial#");
- if (strlen(serial) % 2) {
+ if (serial_len % 2) {
/*
* Set the first char to 0
*/ ;
row[DB_serial][0] = '0';
/* Copy String from serial to row[DB_serial] */
- memcpy(row[DB_serial] + 1, serial, strlen(serial));
- row[DB_serial][strlen(serial) + 1] = '\0';
+ memcpy(row[DB_serial] + 1, serial, serial_len);
+ row[DB_serial][serial_len + 1] = '\0';
} else {
/* Copy String from serial to row[DB_serial] */
- memcpy(row[DB_serial], serial, strlen(serial));
- row[DB_serial][strlen(serial)] = '\0';
+ memcpy(row[DB_serial], serial, serial_len);
+ row[DB_serial][serial_len] = '\0';
}
/* Make it Upper Case */
/* get actual time and make a string */
a_tm = X509_gmtime_adj(a_tm, 0);
- a_tm_s = (char *)app_malloc(a_tm->length + 1, "time string");
+ a_tm_s = app_malloc(a_tm->length + 1, "time string");
memcpy(a_tm_s, a_tm->data, a_tm->length);
a_tm_s[a_tm->length] = '\0';
return ret;
}
-static int old_entry_print(ASN1_OBJECT *obj, ASN1_STRING *str)
+static int old_entry_print(const ASN1_OBJECT *obj, const ASN1_STRING *str)
{
char buf[25], *pbuf, *p;
int j;
projects / openssl.git / blobdiff