GH408 follow-on: update buflen

[openssl.git] / apps / ca.c

diff --git a/apps/ca.c b/apps/ca.c
index bc7c3fd2dd8ee4856258cd04aba3f2e16766b4cd..defbf007f6732ed1537feb92b2673fd6f190b427 100644 (file)
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -99,7 +99,6 @@
 #define BSIZE 256
 
 #define BASE_SECTION    "ca"
 #define BSIZE 256
 
 #define BASE_SECTION    "ca"

-#define CONFIG_FILE "openssl.cnf"

 
 #define ENV_DEFAULT_CA          "default_ca"
 
 
 #define ENV_DEFAULT_CA          "default_ca"
 


@@ -285,7 +284,8 @@ int ca_main(int argc, char **argv)
     STACK_OF(X509) *cert_sk = NULL;
     X509_CRL *crl = NULL;
     const EVP_MD *dgst = NULL;
     STACK_OF(X509) *cert_sk = NULL;
     X509_CRL *crl = NULL;
     const EVP_MD *dgst = NULL;

-    char *configfile = NULL, *md = NULL, *policy = NULL, *keyfile = NULL;
+    char *configfile = default_config_file;
+    char *md = NULL, *policy = NULL, *keyfile = NULL;

     char *certfile = NULL, *crl_ext = NULL, *crlnumberfile = NULL;
     char *infile = NULL, *spkac_file = NULL, *ss_cert_file = NULL;
     char *extensions = NULL, *extfile = NULL, *key = NULL, *passinarg = NULL;
     char *certfile = NULL, *crl_ext = NULL, *crlnumberfile = NULL;
     char *infile = NULL, *spkac_file = NULL, *ss_cert_file = NULL;
     char *extensions = NULL, *extfile = NULL, *key = NULL, *passinarg = NULL;


@@ -301,7 +301,7 @@ int ca_main(int argc, char **argv)
     int keyformat = FORMAT_PEM, multirdn = 0, notext = 0, output_der = 0;
     int ret = 1, email_dn = 1, req = 0, verbose = 0, gencrl = 0, dorevoke = 0;
     int i, j, rev_type = REV_NONE, selfsign = 0;
     int keyformat = FORMAT_PEM, multirdn = 0, notext = 0, output_der = 0;
     int ret = 1, email_dn = 1, req = 0, verbose = 0, gencrl = 0, dorevoke = 0;
     int i, j, rev_type = REV_NONE, selfsign = 0;

-    long crldays = 0, crlhours = 0, crlsec = 0, errorline = -1, days = 0;
+    long crldays = 0, crlhours = 0, crlsec = 0, days = 0;

     unsigned long chtype = MBSTRING_ASC, nameopt = 0, certopt = 0;
     X509 *x509 = NULL, *x509p = NULL, *x = NULL;
     X509_REVOKED *r = NULL;
     unsigned long chtype = MBSTRING_ASC, nameopt = 0, certopt = 0;
     X509 *x509 = NULL, *x509p = NULL, *x = NULL;
     X509_REVOKED *r = NULL;


@@ -325,6 +325,7 @@ opthelp:
                 ret = 0;
                 goto end;
             case OPT_IN:
                 ret = 0;
                 goto end;
             case OPT_IN:

+                req = 1;

                 infile = opt_arg();
                 break;
             case OPT_OUT:
                 infile = opt_arg();
                 break;
             case OPT_OUT:


@@ -482,42 +483,11 @@ end_of_options:
     argc = opt_num_rest();
     argv = opt_rest();
 
     argc = opt_num_rest();
     argv = opt_rest();
 

-    tofree = NULL;
-    if (configfile == NULL)
-        configfile = getenv("OPENSSL_CONF");
-    if (configfile == NULL)
-        configfile = getenv("SSLEAY_CONF");
-    if (configfile == NULL) {
-        const char *s = X509_get_default_cert_area();
-        size_t len;
-
-        len = strlen(s) + 1 + sizeof(CONFIG_FILE);
-        tofree = app_malloc(len, "config filename");
-#ifdef OPENSSL_SYS_VMS
-        strcpy(tofree, s);
-#else
-        BUF_strlcpy(tofree, s, len);
-        BUF_strlcat(tofree, "/", len);
-#endif
-        BUF_strlcat(tofree, CONFIG_FILE, len);
-        configfile = tofree;
-    }
-

     BIO_printf(bio_err, "Using configuration from %s\n", configfile);
     BIO_printf(bio_err, "Using configuration from %s\n", configfile);

-    conf = NCONF_new(NULL);
-    if (NCONF_load(conf, configfile, &errorline) <= 0) {
-        if (errorline <= 0)
-            BIO_printf(bio_err, "error loading the config file '%s'\n",
-                       configfile);
-        else
-            BIO_printf(bio_err, "error on line %ld of config file '%s'\n",
-                       errorline, configfile);
+    if ((conf = app_load_config(configfile)) == NULL)
+        goto end;
+    if (!app_load_modules(conf))

         goto end;
         goto end;

-    }
-    if (tofree) {
-        OPENSSL_free(tofree);
-        tofree = NULL;
-    }

 
     /* Lets get the config section we are using */
     if (section == NULL) {
 
     /* Lets get the config section we are using */
     if (section == NULL) {


@@ -571,7 +541,7 @@ end_of_options:
         f = NCONF_get_string(conf, section, UTF8_IN);
         if (!f)
             ERR_clear_error();
         f = NCONF_get_string(conf, section, UTF8_IN);
         if (!f)
             ERR_clear_error();

-        else if (!strcmp(f, "yes"))
+        else if (strcmp(f, "yes") == 0)

             chtype = MBSTRING_UTF8;
     }
 
             chtype = MBSTRING_UTF8;
     }
 


@@ -668,8 +638,10 @@ end_of_options:
             goto end;
         }
         default_op = 0;
             goto end;
         }
         default_op = 0;

-    } else
+    } else {
+        nameopt = XN_FLAG_ONELINE;

         ERR_clear_error();
         ERR_clear_error();

+    }

 
     f = NCONF_get_string(conf, section, ENV_CERTOPT);
 
 
     f = NCONF_get_string(conf, section, ENV_CERTOPT);
 


@@ -705,24 +677,13 @@ end_of_options:
 #ifndef OPENSSL_SYS_VMS
         /*
          * outdir is a directory spec, but access() for VMS demands a
 #ifndef OPENSSL_SYS_VMS
         /*
          * outdir is a directory spec, but access() for VMS demands a

-         * filename.  In any case, stat(), below, will catch the problem if
-         * outdir is not a directory spec, and the fopen() or open() will
-         * catch an error if there is no write access.
-         *
-         * Presumably, this problem could also be solved by using the DEC C
-         * routines to convert the directory syntax to Unixly, and give that
-         * to access().  However, time's too short to do that just now.
+         * filename.  We could use the DEC C routine to convert the
+         * directory syntax to Unixly, and give that to app_isdir,
+         * but for now the fopen will catch the error if it's not a
+         * directory

          */
          */

-        if (app_access(outdir, R_OK | W_OK | X_OK) != 0)
-        {
-            BIO_printf(bio_err, "I am unable to access the %s directory\n",
-                       outdir);
-            perror(outdir);
-            goto end;
-        }
-

         if (app_isdir(outdir) <= 0) {
         if (app_isdir(outdir) <= 0) {

-            BIO_printf(bio_err, "%s need to be a directory\n", outdir);
+            BIO_printf(bio_err, "%s: %s is not a directory\n", prog, outdir);

             perror(outdir);
             goto end;
         }
             perror(outdir);
             goto end;
         }


@@ -813,18 +774,10 @@ end_of_options:
         }
     }
 
         }
     }
 

-        /*****************************************************************/
+    /*****************************************************************/

     /* Read extensions config file                                   */
     if (extfile) {
     /* Read extensions config file                                   */
     if (extfile) {

-        extconf = NCONF_new(NULL);
-        if (NCONF_load(extconf, extfile, &errorline) <= 0) {
-            if (errorline <= 0)
-                BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
-                           extfile);
-            else
-                BIO_printf(bio_err,
-                           "ERROR: on line %ld of config file '%s'\n",
-                           errorline, extfile);
+        if ((extconf = app_load_config(extfile)) == NULL) {

             ret = 1;
             goto end;
         }
             ret = 1;
             goto end;
         }


@@ -840,9 +793,10 @@ end_of_options:
             extensions = "default";
     }
 
             extensions = "default";
     }
 

-        /*****************************************************************/
+    /*****************************************************************/

     if (req || gencrl) {
     if (req || gencrl) {

-        Sout = bio_open_default(outfile, "w");
+        /* FIXME: Is it really always text? */
+        Sout = bio_open_default(outfile, 'w', FORMAT_TEXT);

         if (Sout == NULL)
             goto end;
     }
         if (Sout == NULL)
             goto end;
     }


@@ -854,7 +808,7 @@ end_of_options:
         goto end;
     }
 
         goto end;
     }
 

-    if (!strcmp(md, "default")) {
+    if (strcmp(md, "default") == 0) {

         int def_nid;
         if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0) {
             BIO_puts(bio_err, "no default digest\n");
         int def_nid;
         if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0) {
             BIO_puts(bio_err, "no default digest\n");


@@ -1099,13 +1053,14 @@ end_of_options:
         if (verbose)
             BIO_printf(bio_err, "writing new certificates\n");
         for (i = 0; i < sk_X509_num(cert_sk); i++) {
         if (verbose)
             BIO_printf(bio_err, "writing new certificates\n");
         for (i = 0; i < sk_X509_num(cert_sk); i++) {

+            ASN1_INTEGER *serialNumber = X509_get_serialNumber(x);

             int k;
             char *n;
 
             x = sk_X509_value(cert_sk, i);
 
             int k;
             char *n;
 
             x = sk_X509_value(cert_sk, i);
 

-            j = x->cert_info->serialNumber->length;
-            p = (const char *)x->cert_info->serialNumber->data;
+            j = ASN1_STRING_length(serialNumber);
+            p = (const char *)ASN1_STRING_data(serialNumber);

 
             if (strlen(outdir) >= (size_t)(j ? BSIZE - j * 2 - 6 : BSIZE - 8)) {
                 BIO_printf(bio_err, "certificate file name too long\n");
 
             if (strlen(outdir) >= (size_t)(j ? BSIZE - j * 2 - 6 : BSIZE - 8)) {
                 BIO_printf(bio_err, "certificate file name too long\n");


@@ -1289,10 +1244,8 @@ end_of_options:
             if (!save_serial(crlnumberfile, "new", crlnumber, NULL))
                 goto end;
 
             if (!save_serial(crlnumberfile, "new", crlnumber, NULL))
                 goto end;
 

-        if (crlnumber) {
-            BN_free(crlnumber);
-            crlnumber = NULL;
-        }
+        BN_free(crlnumber);
+        crlnumber = NULL;

 
         if (!do_X509_CRL_sign(crl, pkey, dgst, sigopts))
             goto end;
 
         if (!do_X509_CRL_sign(crl, pkey, dgst, sigopts))
             goto end;


@@ -1333,8 +1286,7 @@ end_of_options:
         /*****************************************************************/
     ret = 0;
  end:
         /*****************************************************************/
     ret = 0;
  end:

-    if (tofree)
-        OPENSSL_free(tofree);
+    OPENSSL_free(tofree);

     BIO_free_all(Cout);
     BIO_free_all(Sout);
     BIO_free_all(out);
     BIO_free_all(Cout);
     BIO_free_all(Sout);
     BIO_free_all(out);


@@ -1344,13 +1296,12 @@ end_of_options:
     if (ret)
         ERR_print_errors(bio_err);
     app_RAND_write_file(randfile);
     if (ret)
         ERR_print_errors(bio_err);
     app_RAND_write_file(randfile);

-    if (free_key && key)
+    if (free_key)

         OPENSSL_free(key);
     BN_free(serial);
     BN_free(crlnumber);
     free_index(db);
         OPENSSL_free(key);
     BN_free(serial);
     BN_free(crlnumber);
     free_index(db);

-    if (sigopts)
-        sk_OPENSSL_STRING_free(sigopts);
+    sk_OPENSSL_STRING_free(sigopts);

     EVP_PKEY_free(pkey);
     X509_free(x509);
     X509_CRL_free(crl);
     EVP_PKEY_free(pkey);
     X509_free(x509);
     X509_CRL_free(crl);


@@ -1501,7 +1452,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     ASN1_STRING *str, *str2;
     ASN1_OBJECT *obj;
     X509 *ret = NULL;
     ASN1_STRING *str, *str2;
     ASN1_OBJECT *obj;
     X509 *ret = NULL;

-    X509_CINF *ci;

     X509_NAME_ENTRY *ne;
     X509_NAME_ENTRY *tne, *push;
     EVP_PKEY *pktmp;
     X509_NAME_ENTRY *ne;
     X509_NAME_ENTRY *tne, *push;
     EVP_PKEY *pktmp;


@@ -1530,7 +1480,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
             goto end;
         }
         X509_REQ_set_subject_name(req, n);
             goto end;
         }
         X509_REQ_set_subject_name(req, n);

-        req->req_info->enc.modified = 1;

         X509_NAME_free(n);
     }
 
         X509_NAME_free(n);
     }
 


@@ -1598,7 +1547,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     if (selfsign)
         CAname = X509_NAME_dup(name);
     else
     if (selfsign)
         CAname = X509_NAME_dup(name);
     else

-        CAname = X509_NAME_dup(x509->cert_info->subject);
+        CAname = X509_NAME_dup(X509_get_subject_name(x509));

     if (CAname == NULL)
         goto end;
     str = str2 = NULL;
     if (CAname == NULL)
         goto end;
     str = str2 = NULL;


@@ -1720,7 +1669,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
          * Its best to dup the subject DN and then delete any email addresses
          * because this retains its structure.
          */
          * Its best to dup the subject DN and then delete any email addresses
          * because this retains its structure.
          */

-        if (!(dn_subject = X509_NAME_dup(subject))) {
+        if ((dn_subject = X509_NAME_dup(subject)) == NULL) {

             BIO_printf(bio_err, "Memory allocation failure\n");
             goto end;
         }
             BIO_printf(bio_err, "Memory allocation failure\n");
             goto end;
         }


@@ -1807,7 +1756,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
 
     if ((ret = X509_new()) == NULL)
         goto end;
 
     if ((ret = X509_new()) == NULL)
         goto end;

-    ci = ret->cert_info;

 
 #ifdef X509_V3
     /* Make it an X509 v3 certificate. */
 
 #ifdef X509_V3
     /* Make it an X509 v3 certificate. */


@@ -1815,7 +1763,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         goto end;
 #endif
 
         goto end;
 #endif
 

-    if (BN_to_ASN1_INTEGER(serial, ci->serialNumber) == NULL)
+    if (BN_to_ASN1_INTEGER(serial, X509_get_serialNumber(ret)) == NULL)

         goto end;
     if (selfsign) {
         if (!X509_set_issuer_name(ret, subject))
         goto end;
     if (selfsign) {
         if (!X509_set_issuer_name(ret, subject))


@@ -1851,17 +1799,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     /* Lets add the extensions, if there are any */
     if (ext_sect) {
         X509V3_CTX ctx;
     /* Lets add the extensions, if there are any */
     if (ext_sect) {
         X509V3_CTX ctx;

-        if (ci->version == NULL)
-            if ((ci->version = ASN1_INTEGER_new()) == NULL)
-                goto end;
-        ASN1_INTEGER_set(ci->version, 2); /* version 3 certificate */
-
-        /*
-         * Free the current entries if any, there should not be any I believe
-         */
-        sk_X509_EXTENSION_pop_free(ci->extensions, X509_EXTENSION_free);
-
-        ci->extensions = NULL;
+        X509_set_version(ret, 2);

 
         /* Initialize the context structure */
         if (selfsign)
 
         /* Initialize the context structure */
         if (selfsign)


@@ -1987,7 +1925,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     row[DB_type][0] = 'V';
     row[DB_type][1] = '\0';
 
     row[DB_type][0] = 'V';
     row[DB_type][1] = '\0';
 

-    irow = app_malloc(sizeof(char *) * (DB_NUMBER + 1), "row space");
+    irow = app_malloc(sizeof(*irow) * (DB_NUMBER + 1), "row space");

     for (i = 0; i < DB_NUMBER; i++) {
         irow[i] = row[i];
         row[i] = NULL;
     for (i = 0; i < DB_NUMBER; i++) {
         irow[i] = row[i];
         row[i] = NULL;


@@ -2002,8 +1940,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     ok = 1;
  end:
     for (i = 0; i < DB_NUMBER; i++)
     ok = 1;
  end:
     for (i = 0; i < DB_NUMBER; i++)

-        if (row[i] != NULL)
-            OPENSSL_free(row[i]);
+        OPENSSL_free(row[i]);

 
     X509_NAME_free(CAname);
     X509_NAME_free(subject);
 
     X509_NAME_free(CAname);
     X509_NAME_free(subject);


@@ -2045,7 +1982,6 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey,
     X509_REQ *req = NULL;
     CONF_VALUE *cv = NULL;
     NETSCAPE_SPKI *spki = NULL;
     X509_REQ *req = NULL;
     CONF_VALUE *cv = NULL;
     NETSCAPE_SPKI *spki = NULL;

-    X509_REQ_INFO *ri;

     char *type, *buf;
     EVP_PKEY *pktmp = NULL;
     X509_NAME *n = NULL;
     char *type, *buf;
     EVP_PKEY *pktmp = NULL;
     X509_NAME *n = NULL;


@@ -2089,8 +2025,7 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey,
     /*
      * Build up the subject name set.
      */
     /*
      * Build up the subject name set.
      */

-    ri = req->req_info;
-    n = ri->subject;
+    n = X509_REQ_get_subject_name(req);

 
     for (i = 0;; i++) {
         if (sk_CONF_VALUE_num(sk) <= i)
 
     for (i = 0;; i++) {
         if (sk_CONF_VALUE_num(sk) <= i)


@@ -2161,10 +2096,8 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey,
                  ext_copy, 0);
  end:
     X509_REQ_free(req);
                  ext_copy, 0);
  end:
     X509_REQ_free(req);

-    if (parms != NULL)
-        CONF_free(parms);
-    if (spki != NULL)
-        NETSCAPE_SPKI_free(spki);
+    CONF_free(parms);
+    NETSCAPE_SPKI_free(spki);

     X509_NAME_ENTRY_free(ne);
 
     return (ok);
     X509_NAME_ENTRY_free(ne);
 
     return (ok);


@@ -2227,7 +2160,7 @@ static int do_revoke(X509 *x509, CA_DB *db, int type, char *value)
         row[DB_type][0] = 'V';
         row[DB_type][1] = '\0';
 
         row[DB_type][0] = 'V';
         row[DB_type][1] = '\0';
 

-        irow = app_malloc(sizeof(char *) * (DB_NUMBER + 1), "row ptr");
+        irow = app_malloc(sizeof(*irow) * (DB_NUMBER + 1), "row ptr");

         for (i = 0; i < DB_NUMBER; i++) {
             irow[i] = row[i];
             row[i] = NULL;
         for (i = 0; i < DB_NUMBER; i++) {
             irow[i] = row[i];
             row[i] = NULL;


@@ -2273,8 +2206,7 @@ static int do_revoke(X509 *x509, CA_DB *db, int type, char *value)
     ok = 1;
  end:
     for (i = 0; i < DB_NUMBER; i++) {
     ok = 1;
  end:
     for (i = 0; i < DB_NUMBER; i++) {

-        if (row[i] != NULL)
-            OPENSSL_free(row[i]);
+        OPENSSL_free(row[i]);

     }
     return (ok);
 }
     }
     return (ok);
 }


@@ -2341,8 +2273,7 @@ static int get_certificate_status(const char *serial, CA_DB *db)
     }
  end:
     for (i = 0; i < DB_NUMBER; i++) {
     }
  end:
     for (i = 0; i < DB_NUMBER; i++) {

-        if (row[i] != NULL)
-            OPENSSL_free(row[i]);
+        OPENSSL_free(row[i]);

     }
     return (ok);
 }
     }
     return (ok);
 }


@@ -2419,7 +2350,7 @@ static const char *crl_reasons[] = {
     "CAkeyTime"
 };
 
     "CAkeyTime"
 };
 

-#define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
+#define NUM_REASONS OSSL_NELEM(crl_reasons)

 
 /*
  * Given revocation information convert to a DB string. The format of the
 
 /*
  * Given revocation information convert to a DB string. The format of the


@@ -2441,7 +2372,7 @@ char *make_revocation_str(int rev_type, char *rev_arg)
 
     case REV_CRL_REASON:
         for (i = 0; i < 8; i++) {
 
     case REV_CRL_REASON:
         for (i = 0; i < 8; i++) {

-            if (!strcasecmp(rev_arg, crl_reasons[i])) {
+            if (strcasecmp(rev_arg, crl_reasons[i]) == 0) {

                 reason = crl_reasons[i];
                 break;
             }
                 reason = crl_reasons[i];
                 break;
             }


@@ -2566,8 +2497,7 @@ int make_revoked(X509_REVOKED *rev, const char *str)
 
  end:
 
 
  end:
 

-    if (tmp)
-        OPENSSL_free(tmp);
+    OPENSSL_free(tmp);

     ASN1_OBJECT_free(hold);
     ASN1_GENERALIZEDTIME_free(comp_time);
     ASN1_ENUMERATED_free(rtmp);
     ASN1_OBJECT_free(hold);
     ASN1_GENERALIZEDTIME_free(comp_time);
     ASN1_ENUMERATED_free(rtmp);


@@ -2660,7 +2590,7 @@ int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
     }
     if (reason_str) {
         for (i = 0; i < NUM_REASONS; i++) {
     }
     if (reason_str) {
         for (i = 0; i < NUM_REASONS; i++) {

-            if (!strcasecmp(reason_str, crl_reasons[i])) {
+            if (strcasecmp(reason_str, crl_reasons[i]) == 0) {

                 reason_code = i;
                 break;
             }
                 reason_code = i;
                 break;
             }


@@ -2721,8 +2651,7 @@ int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
 
  end:
 
 
  end:
 

-    if (tmp)
-        OPENSSL_free(tmp);
+    OPENSSL_free(tmp);

     ASN1_GENERALIZEDTIME_free(comp_time);
 
     return ret;
     ASN1_GENERALIZEDTIME_free(comp_time);
 
     return ret;