Various randomness handling bugfixes and improvements --

[openssl.git] / apps / x509.c

diff --git a/apps/x509.c b/apps/x509.c
index cc4824786259a559cc57c4f257481cf2086f2e42..d88eb56c044bfaa216422909e4efef0958192b6f 100644 (file)
--- a/apps/x509.c
+++ b/apps/x509.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
+#include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -85,7 +86,7 @@
 static char *x509_usage[]={
 "usage: x509 args\n",
 " -inform arg     - input format - default PEM (one of DER, NET or PEM)\n",
-" -outform arg    - output format - default PEM (one of DER, NET or PEM\n",
+" -outform arg    - output format - default PEM (one of DER, NET or PEM)\n",
 " -keyform arg    - private key format - default PEM\n",
 " -CAform arg     - CA format - default PEM\n",
 " -CAkeyform arg  - CA key format - default PEM\n",
@@ -97,6 +98,7 @@ static char *x509_usage[]={
 " -issuer         - print issuer DN\n",
 " -startdate      - notBefore field\n",
 " -enddate        - notAfter field\n",
+" -purpose        - print out certificate purposes\n",
 " -dates          - both Before and After dates\n",
 " -modulus        - print the RSA key modulus\n",
 " -fingerprint    - print the certificate fingerprint\n",
@@ -115,6 +117,7 @@ static char *x509_usage[]={
 " -C              - print out C code forms\n",
 " -md2/-md5/-sha1/-mdc2 - digest to do an RSA sign with\n",
 " -extfile        - configuration file with X509V3 extensions to add\n",
+" -extensions     - section from config file with X509V3 extensions to add\n",
 NULL
 };
 
@@ -126,8 +129,14 @@ static int sign (X509 *x, EVP_PKEY *pkey,int days,const EVP_MD *digest,
 static int x509_certify (X509_STORE *ctx,char *CAfile,const EVP_MD *digest,
                         X509 *x,X509 *xca,EVP_PKEY *pkey,char *serial,
                         int create,int days, LHASH *conf, char *section);
+static int efunc(X509_PURPOSE *pt, void *arg);
 static int reqfile=0;
 
+typedef struct {
+BIO *bio;
+X509 *cert;
+} X509_PPRINT;
+
 int MAIN(int argc, char **argv)
        {
        int ret=1;
@@ -144,6 +153,7 @@ int MAIN(int argc, char **argv)
        int noout=0,sign_flag=0,CA_flag=0,CA_createserial=0;
        int C=0;
        int x509req=0,days=DEF_DAYS,modulus=0;
+       int pprint = 0;
        char **pp;
        X509_STORE *ctx=NULL;
        X509_REQ *rq=NULL;
@@ -152,6 +162,7 @@ int MAIN(int argc, char **argv)
        const EVP_MD *md_alg,*digest=EVP_md5();
        LHASH *extconf = NULL;
        char *extsect = NULL, *extfile = NULL;
+       int need_rand = 0;
 
        reqfile=0;
 
@@ -192,7 +203,10 @@ int MAIN(int argc, char **argv)
                        keyformat=str2fmt(*(++argv));
                        }
                else if (strcmp(*argv,"-req") == 0)
+                       {
                        reqfile=1;
+                       need_rand = 1;
+                       }
                else if (strcmp(*argv,"-CAform") == 0)
                        {
                        if (--argc < 1) goto bad;
@@ -218,6 +232,11 @@ int MAIN(int argc, char **argv)
                        if (--argc < 1) goto bad;
                        extfile= *(++argv);
                        }
+               else if (strcmp(*argv,"-extensions") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       extsect= *(++argv);
+                       }
                else if (strcmp(*argv,"-in") == 0)
                        {
                        if (--argc < 1) goto bad;
@@ -233,6 +252,7 @@ int MAIN(int argc, char **argv)
                        if (--argc < 1) goto bad;
                        keyfile= *(++argv);
                        sign_flag= ++num;
+                       need_rand = 1;
                        }
                else if (strcmp(*argv,"-CA") == 0)
                        {
@@ -273,6 +293,8 @@ int MAIN(int argc, char **argv)
                        startdate= ++num;
                        enddate= ++num;
                        }
+               else if (strcmp(*argv,"-purpose") == 0)
+                       pprint= ++num;
                else if (strcmp(*argv,"-startdate") == 0)
                        startdate= ++num;
                else if (strcmp(*argv,"-enddate") == 0)
@@ -304,8 +326,12 @@ bad:
                goto end;
                }
 
+       if (need_rand)
+               app_RAND_load_file(NULL, bio_err, 0);
+
        ERR_load_crypto_strings();
        X509V3_add_standard_extensions();
+       X509_PURPOSE_add_standard();
 
        if (!X509_STORE_set_default_paths(ctx))
                {
@@ -335,7 +361,7 @@ bad:
                                                        ,errorline,extfile);
                        goto end;
                }
-               if(!(extsect = CONF_get_string(extconf, "default",
+               if(!extsect && !(extsect = CONF_get_string(extconf, "default",
                                         "extensions"))) extsect = "default";
                X509V3_set_ctx_test(&ctx2);
                X509V3_set_conf_lhash(&ctx2, extconf);
@@ -377,7 +403,7 @@ bad:
                                goto end;
                                }
                        }
-               req=PEM_read_bio_X509_REQ(in,NULL,NULL);
+               req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL);
                BIO_free(in);
 
                if (req == NULL) { perror(infile); goto end; }
@@ -494,6 +520,14 @@ bad:
                                {
                                BIO_printf(STDout,"%08lx\n",X509_subject_name_hash(x));
                                }
+                       else if (pprint == i)
+                               {
+                               X509_PPRINT ptmp;
+                               ptmp.bio = STDout;
+                               ptmp.cert = x;
+                               BIO_printf(STDout, "Certificate purposes:\n");
+                               X509_PURPOSE_enum(efunc, &ptmp);
+                               }
                        else
                                if (modulus == i)
                                {
@@ -626,6 +660,7 @@ bad:
                                        digest=EVP_dss1();
 #endif
 
+                               assert(need_rand);
                                if (!sign(x,Upkey,days,digest,
                                                 extconf, extsect)) goto end;
                                }
@@ -642,6 +677,7 @@ bad:
                                        digest=EVP_dss1();
 #endif
                                
+                               assert(need_rand);
                                if (!x509_certify(ctx,CAfile,digest,x,xca,
                                        CApkey, CAserial,CA_createserial,days,
                                        extconf, extsect))
@@ -717,6 +753,8 @@ bad:
                }
        ret=0;
 end:
+       if (need_rand)
+               app_RAND_write_file(NULL, bio_err);
        OBJ_cleanup();
        CONF_free(extconf);
        BIO_free(out);
@@ -729,6 +767,7 @@ end:
        EVP_PKEY_free(CApkey);
        X509_REQ_free(rq);
        X509V3_EXT_cleanup();
+       X509_PURPOSE_cleanup();
        EXIT(ret);
        }
 
@@ -855,18 +894,6 @@ static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
        if (X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days) == NULL)
                goto end;
 
-       /* don't save DSA parameters in child if parent has them
-        * and the parents and the childs are the same. */
-       upkey=X509_get_pubkey(x);
-       if (!EVP_PKEY_missing_parameters(pkey) &&
-               (EVP_PKEY_cmp_parameters(pkey,upkey) == 0))
-               {
-               EVP_PKEY_save_parameters(upkey,0);
-               /* Force a re-write */
-               X509_set_pubkey(x,upkey);
-               }
-       EVP_PKEY_free(upkey);
-
        if(conf) {
                X509V3_CTX ctx2;
                X509_set_version(x,2); /* version 3 certificate */
@@ -960,7 +987,7 @@ static EVP_PKEY *load_key(char *file, int format)
 #endif
                if (format == FORMAT_PEM)
                {
-               pkey=PEM_read_bio_PrivateKey(key,NULL,NULL);
+               pkey=PEM_read_bio_PrivateKey(key,NULL,NULL,NULL);
                }
        else
                {
@@ -1043,7 +1070,7 @@ static X509 *load_cert(char *file, int format)
                ah->data=NULL;
                }
        else if (format == FORMAT_PEM)
-               x=PEM_read_bio_X509(cert,NULL,NULL);
+               x=PEM_read_bio_X509(cert,NULL,NULL,NULL);
        else    {
                BIO_printf(bio_err,"bad input format specified for input cert\n");
                goto end;
@@ -1096,3 +1123,24 @@ err:
        ERR_print_errors(bio_err);
        return(0);
        }
+
+static int efunc(X509_PURPOSE *pt, void *arg)
+{
+       X509_PPRINT *ptmp;
+       int id, i, idret;
+       char *pname;
+       ptmp = arg;
+       id = X509_PURPOSE_get_id(pt);
+       pname = X509_PURPOSE_get_name(pt);
+       for(i = 0; i < 2; i++) {
+               idret = X509_check_purpose(ptmp->cert, id, i);
+               BIO_printf(ptmp->bio, "%s%s : ", pname, i ? " CA" : ""); 
+               if(idret == 1) BIO_printf(ptmp->bio, "Yes\n");
+               else if (idret == 0) BIO_printf(ptmp->bio, "No\n");
+               else BIO_printf(ptmp->bio, "Yes (WARNING code=%d)\n", idret);
+       }
+       return 1;
+}
+
+
+