Certain reasons aren't really part of the engine framework, so let's

[openssl.git] / apps / ca.c

diff --git a/apps/ca.c b/apps/ca.c
index e96d086b45974fc88a19dd5d5b15864f208da4af..7a168aa9d3bdc0e1ddb3b1618dd230ce587ed585 100644 (file)
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -238,7 +238,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
                int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
        unsigned long certopt, unsigned long nameopt, int default_op,
        int ext_copy);
-static X509_NAME *do_subject(char *subject, int email_dn);
+static X509_NAME *do_subject(char *subject);
 static int do_revoke(X509 *x509, TXT_DB *db, int ext, char *extval);
 static int get_certificate_status(const char *ser_status, TXT_DB *db);
 static int do_updatedb(TXT_DB *db);
@@ -1859,7 +1859,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
 
        if (subj)
                {
-               X509_NAME *n = do_subject(subj, email_dn);
+               X509_NAME *n = do_subject(subj);
 
                if (!n)
                        {
@@ -1909,14 +1909,17 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
                        BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
                        goto err;
                        }
-               j=ASN1_PRINTABLE_type(str->data,str->length);
-               if (    ((j == V_ASN1_T61STRING) &&
-                        (str->type != V_ASN1_T61STRING)) ||
-                       ((j == V_ASN1_IA5STRING) &&
-                        (str->type == V_ASN1_PRINTABLESTRING)))
+               if ((str->type != V_ASN1_BMPSTRING) && (str->type != V_ASN1_UTF8STRING))
                        {
-                       BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
-                       goto err;
+                       j=ASN1_PRINTABLE_type(str->data,str->length);
+                       if (    ((j == V_ASN1_T61STRING) &&
+                                (str->type != V_ASN1_T61STRING)) ||
+                               ((j == V_ASN1_IA5STRING) &&
+                                (str->type == V_ASN1_PRINTABLESTRING)))
+                               {
+                               BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
+                               goto err;
+                               }
                        }
 
                if (default_op)
@@ -2046,29 +2049,25 @@ again2:
        /* Build the correct Subject if no e-mail is wanted in the subject */
        /* and add it later on because of the method extensions are added (altName) */
         
-       if (!email_dn)
+       if (email_dn)
+               dn_subject = subject;
+       else
                {
-               if ((dn_subject=X509_NAME_new()) == NULL)
+               X509_NAME_ENTRY *tmpne;
+               /* Its best to dup the subject DN and then delete any email
+                * addresses because this retains its structure.
+                */
+               if (!(dn_subject = X509_NAME_dup(subject)))
                        {
                        BIO_printf(bio_err,"Memory allocation failure\n");
                        goto err;
                        }
-
-               for (i=0; i<X509_NAME_entry_count(subject); i++)
+               while((i = X509_NAME_get_index_by_NID(dn_subject,
+                                       NID_pkcs9_emailAddress, -1)) >= 0)
                        {
-                       ne= X509_NAME_get_entry(subject,i);
-                       obj=X509_NAME_ENTRY_get_object(ne);
-                       nid=OBJ_obj2nid(obj);
-
-                       str=X509_NAME_ENTRY_get_data(ne);
-
-                       if (nid == NID_pkcs9_emailAddress) continue;
-
-                       if (!X509_NAME_add_entry(dn_subject,ne, -1, 0))
-                               {
-                               BIO_printf(bio_err,"Memory allocation failure\n");
-                               goto err;
-                               }
+                       tmpne = X509_NAME_get_entry(dn_subject, i);
+                       X509_NAME_delete_entry(dn_subject, i);
+                       X509_NAME_ENTRY_free(tmpne);
                        }
                }
 
@@ -2327,6 +2326,8 @@ err:
                X509_NAME_free(CAname);
        if (subject != NULL)
                X509_NAME_free(subject);
+       if ((dn_subject != NULL) && !email_dn)
+               X509_NAME_free(dn_subject);
        if (tmptm != NULL)
                ASN1_UTCTIME_free(tmptm);
        if (ok <= 0)
@@ -2992,7 +2993,7 @@ int make_revoked(X509_REVOKED *rev, char *str)
        return ret;
        }
 
-static X509_NAME *do_subject(char *subject, int email_dn)
+static X509_NAME *do_subject(char *subject)
        {
        X509_NAME *n = NULL;
 
@@ -3041,9 +3042,6 @@ static X509_NAME *do_subject(char *subject, int email_dn)
                        continue;
                        }
 
-               if ((nid == NID_pkcs9_emailAddress) && (email_dn == 0))
-                       continue;
-
                if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC, (unsigned char*)ne_value, -1,-1,0))
                        {
                        X509_NAME_free(n);