X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=apps%2Freq.c;h=4fa5ae6fe8df924dd10a8579b1a422e1783c7275;hp=9611431fe7072a45747b06657a5156112ab91ebc;hb=821951b851a2dfabcd09b5396844d401ac3467d7;hpb=dd5e774664160f19e4828bddbdfbefa7d2b543dd diff --git a/apps/req.c b/apps/req.c index 9611431fe7..4fa5ae6fe8 100644 --- a/apps/req.c +++ b/apps/req.c @@ -56,6 +56,12 @@ * [including the GNU Public Licence.] */ +/* Until the key-gen callbacks are modified to use newer prototypes, we allow + * deprecated functions for openssl-internal code */ +#ifdef OPENSSL_NO_DEPRECATED +#undef OPENSSL_NO_DEPRECATED +#endif + #include #include #include @@ -73,6 +79,7 @@ #include #include #include +#include "../crypto/cryptlib.h" #define SECTION "req" @@ -84,6 +91,7 @@ #define V3_EXTENSIONS "x509_extensions" #define REQ_EXTENSIONS "req_extensions" #define STRING_MASK "string_mask" +#define UTF8_IN "utf8" #define DEFAULT_KEY_LENGTH 512 #define MIN_KEY_LENGTH 384 @@ -105,23 +113,27 @@ * -rand file(s) - load the file(s) into the PRNG. * -newkey - make a key and a request. * -modulus - print RSA modulus. + * -pubkey - output Public Key. * -x509 - output a self signed X509 structure instead. * -asn1-kludge - output new certificate request in a format that some CA's * require. This format is wrong */ -static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,char *dn,int attribs); -static int build_subject(X509_REQ *req, char *subj); +static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,char *dn,int attribs, + unsigned long chtype); +static int build_subject(X509_REQ *req, char *subj, unsigned long chtype); static int prompt_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect, - STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs); + STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs, + unsigned long chtype); static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk, - STACK_OF(CONF_VALUE) *attr, int attribs); + STACK_OF(CONF_VALUE) *attr, int attribs, + unsigned long chtype); static int add_attribute_object(X509_REQ *req, char *text, char *def, char *value, int nid, int n_min, - int n_max); + int n_max, unsigned long chtype); static int add_DN_object(X509_NAME *n, char *text, char *def, char *value, - int nid,int n_min,int n_max); + int nid,int n_min,int n_max, unsigned long chtype); #ifndef OPENSSL_NO_RSA static void MS_CALLBACK req_cb(int p,int n,void *arg); #endif @@ -129,7 +141,6 @@ static int req_check_len(int len,int n_min,int n_max); static int check_end(char *str, char *end); #ifndef MONOLITH static char *default_config_file=NULL; -static CONF *config=NULL; #endif static CONF *req_conf=NULL; static int batch=0; @@ -137,6 +148,7 @@ static int batch=0; #define TYPE_RSA 1 #define TYPE_DSA 2 #define TYPE_DH 3 +#define TYPE_EC 4 int MAIN(int, char **); @@ -146,7 +158,10 @@ int MAIN(int argc, char **argv) #ifndef OPENSSL_NO_DSA DSA *dsa_params=NULL; #endif - unsigned long nmflag = 0; +#ifndef OPENSSL_NO_ECDSA + EC_KEY *ec_params = NULL; +#endif + unsigned long nmflag = 0, reqflag = 0; int ex=1,x509=0,days=30; X509 *x509ss=NULL; X509_REQ *req=NULL; @@ -155,7 +170,7 @@ int MAIN(int argc, char **argv) long newkey = -1; BIO *in=NULL,*out=NULL; int informat,outformat,verify=0,noout=0,text=0,keyform=FORMAT_PEM; - int nodes=0,kludge=0,newhdr=0,subject=0; + int nodes=0,kludge=0,newhdr=0,subject=0,pubkey=0; char *infile,*outfile,*prog,*keyfile=NULL,*template=NULL,*keyout=NULL; char *engine=NULL; char *extensions = NULL; @@ -169,8 +184,10 @@ int MAIN(int argc, char **argv) char *p; char *subj = NULL; const EVP_MD *md_alg=NULL,*digest=EVP_md5(); + unsigned long chtype = MBSTRING_ASC; #ifndef MONOLITH - MS_STATIC char config_name[256]; + char *to_free; + long errline; #endif req_conf = NULL; @@ -213,6 +230,10 @@ int MAIN(int argc, char **argv) if (--argc < 1) goto bad; keyfile= *(++argv); } + else if (strcmp(*argv,"-pubkey") == 0) + { + pubkey=1; + } else if (strcmp(*argv,"-new") == 0) { newreq=1; @@ -295,7 +316,7 @@ int MAIN(int argc, char **argv) goto end; } - dtmp=X509_get_pubkey(xtmp); + if ((dtmp=X509_get_pubkey(xtmp)) == NULL) goto end; if (dtmp->type == EVP_PKEY_DSA) dsa_params=DSAparams_dup(dtmp->pkey.dsa); EVP_PKEY_free(dtmp); @@ -307,11 +328,59 @@ int MAIN(int argc, char **argv) } } BIO_free(in); - newkey=BN_num_bits(dsa_params->p); in=NULL; + newkey=BN_num_bits(dsa_params->p); } else #endif +#ifndef OPENSSL_NO_ECDSA + if (strncmp("ec:",p,3) == 0) + { + X509 *xtmp=NULL; + EVP_PKEY *dtmp; + + pkey_type=TYPE_EC; + p+=3; + if ((in=BIO_new_file(p,"r")) == NULL) + { + perror(p); + goto end; + } + if ((ec_params = EC_KEY_new()) == NULL) + goto end; + if ((ec_params->group = PEM_read_bio_ECPKParameters(in, NULL, NULL, NULL)) == NULL) + { + if (ec_params) + EC_KEY_free(ec_params); + ERR_clear_error(); + (void)BIO_reset(in); + if ((xtmp=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL) + { + BIO_printf(bio_err,"unable to load EC parameters from file\n"); + goto end; + } + + if ((dtmp=X509_get_pubkey(xtmp))==NULL) + goto end; + if (dtmp->type == EVP_PKEY_EC) + ec_params = ECParameters_dup(dtmp->pkey.eckey); + EVP_PKEY_free(dtmp); + X509_free(xtmp); + if (ec_params == NULL) + { + BIO_printf(bio_err,"Certificate does not contain EC parameters\n"); + goto end; + } + } + + BIO_free(in); + in=NULL; + + newkey = EC_GROUP_get_degree(ec_params->group); + + } + else +#endif #ifndef OPENSSL_NO_DH if (strncmp("dh:",p,4) == 0) { @@ -320,7 +389,9 @@ int MAIN(int argc, char **argv) } else #endif - pkey_type=TYPE_RSA; + { + goto bad; + } newreq=1; } @@ -338,11 +409,18 @@ int MAIN(int argc, char **argv) noout=1; else if (strcmp(*argv,"-verbose") == 0) verbose=1; + else if (strcmp(*argv,"-utf8") == 0) + chtype = MBSTRING_UTF8; else if (strcmp(*argv,"-nameopt") == 0) { if (--argc < 1) goto bad; if (!set_name_ex(&nmflag, *(++argv))) goto bad; } + else if (strcmp(*argv,"-reqopt") == 0) + { + if (--argc < 1) goto bad; + if (!set_cert_ex(&reqflag, *(++argv))) goto bad; + } else if (strcmp(*argv,"-subject") == 0) subject=1; else if (strcmp(*argv,"-text") == 0) @@ -405,6 +483,7 @@ bad: BIO_printf(bio_err," -in arg input file\n"); BIO_printf(bio_err," -out arg output file\n"); BIO_printf(bio_err," -text text form of request\n"); + BIO_printf(bio_err," -pubkey output public key\n"); BIO_printf(bio_err," -noout do not output REQ\n"); BIO_printf(bio_err," -verify verify signature on REQ\n"); BIO_printf(bio_err," -modulus RSA modulus\n"); @@ -420,6 +499,9 @@ bad: BIO_printf(bio_err," the random number generator\n"); BIO_printf(bio_err," -newkey rsa:bits generate a new RSA key of 'bits' in size\n"); BIO_printf(bio_err," -newkey dsa:file generate a new DSA key, parameters taken from CA in 'file'\n"); +#ifndef OPENSSL_NO_ECDSA + BIO_printf(bio_err," -newkey ec:file generate a new EC key, parameters taken from CA in 'file'\n"); +#endif BIO_printf(bio_err," -[digest] Digest to sign with (md5, sha1, md2, mdc2, md4)\n"); BIO_printf(bio_err," -config file request template file.\n"); BIO_printf(bio_err," -subj arg set or modify request subject\n"); @@ -433,6 +515,9 @@ bad: BIO_printf(bio_err," have been reported as requiring\n"); BIO_printf(bio_err," -extensions .. specify certificate extension section (override value in config file)\n"); BIO_printf(bio_err," -reqexts .. specify request extension section (override value in config file)\n"); + BIO_printf(bio_err," -utf8 input characters are UTF8 (default ASCII)\n"); + BIO_printf(bio_err," -nameopt arg - various certificate name options\n"); + BIO_printf(bio_err," -reqopt arg - various request text options\n\n"); goto end; } @@ -448,24 +533,18 @@ bad: if (p == NULL) p=getenv("SSLEAY_CONF"); if (p == NULL) - { - strcpy(config_name,X509_get_default_cert_area()); -#ifndef OPENSSL_SYS_VMS - strcat(config_name,"/"); -#endif - strcat(config_name,OPENSSL_CONF); - p=config_name; - } + p=to_free=make_config_name(); default_config_file=p; config=NCONF_new(NULL); - i=NCONF_load(config, p); + i=NCONF_load(config, p, &errline); #endif if (template != NULL) { - long errline; + long errline = -1; - BIO_printf(bio_err,"Using configuration from %s\n",template); + if( verbose ) + BIO_printf(bio_err,"Using configuration from %s\n",template); req_conf=NCONF_new(NULL); i=NCONF_load(req_conf,template,&errline); if (i == 0) @@ -477,9 +556,10 @@ bad: else { req_conf=config; - BIO_printf(bio_err,"Using configuration from %s\n", + if( verbose ) + BIO_printf(bio_err,"Using configuration from %s\n", default_config_file); - if (i == 0) + if (req_conf == NULL) { BIO_printf(bio_err,"Unable to load config info\n"); } @@ -487,6 +567,8 @@ bad: if (req_conf != NULL) { + if (!load_config(bio_err, req_conf)) + goto end; p=NCONF_get_string(req_conf,NULL,"oid_file"); if (p == NULL) ERR_clear_error(); @@ -564,6 +646,16 @@ bad: goto end; } + if (chtype != MBSTRING_UTF8) + { + p = NCONF_get_string(req_conf, SECTION, UTF8_IN); + if (!p) + ERR_clear_error(); + else if (!strcmp(p, "yes")) + chtype = MBSTRING_UTF8; + } + + if(!req_exts) { req_exts = NCONF_get_string(req_conf, SECTION, REQ_EXTENSIONS); @@ -592,7 +684,7 @@ bad: if (keyfile != NULL) { - pkey = load_key(bio_err, keyfile, keyform, passin, e, + pkey = load_key(bio_err, keyfile, keyform, 0, passin, e, "Private Key"); if (!pkey) { @@ -600,7 +692,8 @@ bad: message */ goto end; } - if (EVP_PKEY_type(pkey->type) == EVP_PKEY_DSA) + if (EVP_PKEY_type(pkey->type) == EVP_PKEY_DSA || + EVP_PKEY_type(pkey->type) == EVP_PKEY_EC) { char *randfile = NCONF_get_string(req_conf,SECTION,"RANDFILE"); if (randfile == NULL) @@ -624,14 +717,15 @@ bad: newkey=DEFAULT_KEY_LENGTH; } - if (newkey < MIN_KEY_LENGTH) + if (newkey < MIN_KEY_LENGTH && (pkey_type == TYPE_RSA || pkey_type == TYPE_DSA)) { BIO_printf(bio_err,"private key length is too short,\n"); BIO_printf(bio_err,"it needs to be at least %d bits, not %d\n",MIN_KEY_LENGTH,newkey); goto end; } BIO_printf(bio_err,"Generating a %d bit %s private key\n", - newkey,(pkey_type == TYPE_RSA)?"RSA":"DSA"); + newkey,(pkey_type == TYPE_RSA)?"RSA": + (pkey_type == TYPE_DSA)?"DSA":"EC"); if ((pkey=EVP_PKEY_new()) == NULL) goto end; @@ -653,6 +747,15 @@ bad: dsa_params=NULL; } #endif +#ifndef OPENSSL_NO_ECDSA + if (pkey_type == TYPE_EC) + { + if (!EC_KEY_generate_key(ec_params)) goto end; + if (!EVP_PKEY_assign_EC_KEY(pkey, ec_params)) + goto end; + ec_params = NULL; + } +#endif app_RAND_write_file(randfile, bio_err); @@ -758,6 +861,10 @@ loop: #ifndef OPENSSL_NO_DSA if (pkey->type == EVP_PKEY_DSA) digest=EVP_dss1(); +#endif +#ifndef OPENSSL_NO_ECDSA + if (pkey->type == EVP_PKEY_EC) + digest=EVP_ecdsa(); #endif if (req == NULL) { @@ -767,7 +874,7 @@ loop: goto end; } - i=make_REQ(req,pkey,subj,!x509); + i=make_REQ(req,pkey,subj,!x509, chtype); subj=NULL; /* done processing '-subj' option */ if ((kludge > 0) && !sk_X509_ATTRIBUTE_num(req->req_info->attributes)) { @@ -789,19 +896,20 @@ loop: /* Set version to V3 */ if(!X509_set_version(x509ss, 2)) goto end; if (serial) - X509_set_serialNumber(x509ss, serial); + { + if (!X509_set_serialNumber(x509ss, serial)) goto end; + } else - ASN1_INTEGER_set(X509_get_serialNumber(x509ss),0L); - - X509_set_issuer_name(x509ss, - X509_REQ_get_subject_name(req)); - X509_gmtime_adj(X509_get_notBefore(x509ss),0); - X509_gmtime_adj(X509_get_notAfter(x509ss), - (long)60*60*24*days); - X509_set_subject_name(x509ss, - X509_REQ_get_subject_name(req)); + { + if (!ASN1_INTEGER_set(X509_get_serialNumber(x509ss),0L)) goto end; + } + + if (!X509_set_issuer_name(x509ss, X509_REQ_get_subject_name(req))) goto end; + if (!X509_gmtime_adj(X509_get_notBefore(x509ss),0)) goto end; + if (!X509_gmtime_adj(X509_get_notAfter(x509ss), (long)60*60*24*days)) goto end; + if (!X509_set_subject_name(x509ss, X509_REQ_get_subject_name(req))) goto end; tmppkey = X509_REQ_get_pubkey(req); - X509_set_pubkey(x509ss,tmppkey); + if (!tmppkey || !X509_set_pubkey(x509ss,tmppkey)) goto end; EVP_PKEY_free(tmppkey); /* Set up V3 context struct */ @@ -859,7 +967,7 @@ loop: print_name(bio_err, "old subject=", X509_REQ_get_subject_name(req), nmflag); } - if (build_subject(req, subj) == 0) + if (build_subject(req, subj, chtype) == 0) { BIO_printf(bio_err, "ERROR: cannot modify subject\n"); ex=1; @@ -898,12 +1006,13 @@ loop: else if (i == 0) { BIO_printf(bio_err,"verify failure\n"); + ERR_print_errors(bio_err); } else /* if (i > 0) */ BIO_printf(bio_err,"verify OK\n"); } - if (noout && !text && !modulus && !subject) + if (noout && !text && !modulus && !subject && !pubkey) { ex=0; goto end; @@ -932,12 +1041,26 @@ loop: } } + if (pubkey) + { + EVP_PKEY *tpubkey; + tpubkey=X509_REQ_get_pubkey(req); + if (tpubkey == NULL) + { + BIO_printf(bio_err,"Error getting public key\n"); + ERR_print_errors(bio_err); + goto end; + } + PEM_write_bio_PUBKEY(out, tpubkey); + EVP_PKEY_free(tpubkey); + } + if (text) { if (x509) - X509_print(out,x509ss); + X509_print_ex(out, x509ss, nmflag, reqflag); else - X509_REQ_print(out,req); + X509_REQ_print_ex(out, req, nmflag, reqflag); } if(subject) @@ -950,24 +1073,25 @@ loop: if (modulus) { - EVP_PKEY *pubkey; + EVP_PKEY *tpubkey; if (x509) - pubkey=X509_get_pubkey(x509ss); + tpubkey=X509_get_pubkey(x509ss); else - pubkey=X509_REQ_get_pubkey(req); - if (pubkey == NULL) + tpubkey=X509_REQ_get_pubkey(req); + if (tpubkey == NULL) { fprintf(stdout,"Modulus=unavailable\n"); goto end; } fprintf(stdout,"Modulus="); #ifndef OPENSSL_NO_RSA - if (pubkey->type == EVP_PKEY_RSA) - BN_print(out,pubkey->pkey.rsa->n); + if (tpubkey->type == EVP_PKEY_RSA) + BN_print(out,tpubkey->pkey.rsa->n); else #endif fprintf(stdout,"Wrong Algorithm type"); + EVP_PKEY_free(tpubkey); fprintf(stdout,"\n"); } @@ -1006,6 +1130,10 @@ loop: } ex=0; end: +#ifndef MONOLITH + if(to_free) + OPENSSL_free(to_free); +#endif if (ex) { ERR_print_errors(bio_err); @@ -1022,12 +1150,16 @@ end: OBJ_cleanup(); #ifndef OPENSSL_NO_DSA if (dsa_params != NULL) DSA_free(dsa_params); +#endif +#ifndef OPENSSL_NO_ECDSA + if (ec_params != NULL) EC_KEY_free(ec_params); #endif apps_shutdown(); - EXIT(ex); + OPENSSL_EXIT(ex); } -static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs) +static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs, + unsigned long chtype) { int ret=0,i; char no_prompt = 0; @@ -1073,81 +1205,39 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs) if (!X509_REQ_set_version(req,0L)) goto err; /* version 1 */ if (no_prompt) - i = auto_info(req, dn_sk, attr_sk, attribs); + i = auto_info(req, dn_sk, attr_sk, attribs, chtype); else { if (subj) - i = build_subject(req, subj); + i = build_subject(req, subj, chtype); else - i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs); + i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs, chtype); } if(!i) goto err; - X509_REQ_set_pubkey(req,pkey); + if (!X509_REQ_set_pubkey(req,pkey)) goto err; ret=1; err: return(ret); } -static int build_subject(X509_REQ *req, char *subject) +/* + * subject is expected to be in the format /type0=value0/type1=value1/type2=... + * where characters may be escaped by \ + */ +static int build_subject(X509_REQ *req, char *subject, unsigned long chtype) { - X509_NAME *n = NULL; - - int i, nid, ne_num=0; - - char *ne_name = NULL; - char *ne_value = NULL; - - char *tmp = NULL; - char *p[2]; + X509_NAME *n; - char *str_list[256]; - - p[0] = ",/"; - p[1] = "="; - - n = X509_NAME_new(); - - tmp = strtok(subject, p[0]); - while((tmp != NULL) && (ne_num < (sizeof str_list/sizeof *str_list))) - { - char *token = tmp; - - while (token[0] == ' ') - token++; - str_list[ne_num] = token; - - tmp = strtok(NULL, p[0]); - ne_num++; - } - - for(i = 0; i < ne_num; i++) - { - ne_name = strtok(str_list[i], p[1]); - ne_value = strtok(NULL, p[1]); - - if ((nid=OBJ_txt2nid(ne_name)) == NID_undef) - { - BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_name); - continue; - } - - if (ne_value == NULL) - { - BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_name); - continue; - } - - if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC, (unsigned char*)ne_value, -1,-1,0)) - { - X509_NAME_free(n); - return 0; - } - } + if (!(n = do_subject(subject, chtype))) + return 0; if (!X509_REQ_set_subject_name(req, n)) + { + X509_NAME_free(n); return 0; + } X509_NAME_free(n); return 1; } @@ -1155,7 +1245,8 @@ static int build_subject(X509_REQ *req, char *subject) static int prompt_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect, - STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs) + STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs, + unsigned long chtype) { int i; char *p,*q; @@ -1205,13 +1296,19 @@ start: for (;;) } /* If OBJ not recognised ignore it */ if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start; + + if(strlen(v->name) > sizeof buf-9) + { + BIO_printf(bio_err,"Name '%s' too long\n",v->name); + return 0; + } + sprintf(buf,"%s_default",v->name); if ((def=NCONF_get_string(req_conf,dn_sect,buf)) == NULL) { ERR_clear_error(); def=""; } - sprintf(buf,"%s_value",v->name); if ((value=NCONF_get_string(req_conf,dn_sect,buf)) == NULL) { @@ -1228,7 +1325,7 @@ start: for (;;) n_max = -1; if (!add_DN_object(subj,v->value,def,value,nid, - n_min,n_max)) + n_min,n_max, chtype)) return 0; } if (X509_NAME_entry_count(subj) == 0) @@ -1258,6 +1355,12 @@ start2: for (;;) if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start2; + if(strlen(v->name) > sizeof buf-9) + { + BIO_printf(bio_err,"Name '%s' too long\n",v->name); + return 0; + } + sprintf(buf,"%s_default",type); if ((def=NCONF_get_string(req_conf,attr_sect,buf)) == NULL) @@ -1284,7 +1387,7 @@ start2: for (;;) n_max = -1; if (!add_attribute_object(req, - v->value,def,value,nid,n_min,n_max)) + v->value,def,value,nid,n_min,n_max, chtype)) return 0; } } @@ -1300,7 +1403,7 @@ start2: for (;;) } static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, - STACK_OF(CONF_VALUE) *attr_sk, int attribs) + STACK_OF(CONF_VALUE) *attr_sk, int attribs, unsigned long chtype) { int i; char *p,*q; @@ -1328,7 +1431,7 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, if(*p) type = p; break; } - if (!X509_NAME_add_entry_by_txt(subj,type, MBSTRING_ASC, + if (!X509_NAME_add_entry_by_txt(subj,type, chtype, (unsigned char *) v->value,-1,-1,0)) return 0; } @@ -1343,7 +1446,7 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, for (i = 0; i < sk_CONF_VALUE_num(attr_sk); i++) { v=sk_CONF_VALUE_value(attr_sk,i); - if(!X509_REQ_add1_attr_by_txt(req, v->name, MBSTRING_ASC, + if(!X509_REQ_add1_attr_by_txt(req, v->name, chtype, (unsigned char *)v->value, -1)) return 0; } } @@ -1352,7 +1455,7 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, static int add_DN_object(X509_NAME *n, char *text, char *def, char *value, - int nid, int n_min, int n_max) + int nid, int n_min, int n_max, unsigned long chtype) { int i,ret=0; MS_STATIC char buf[1024]; @@ -1361,6 +1464,7 @@ start: (void)BIO_flush(bio_err); if(value != NULL) { + OPENSSL_assert(strlen(value) < sizeof buf-2); strcpy(buf,value); strcat(buf,"\n"); BIO_printf(bio_err,"%s\n",value); @@ -1370,7 +1474,7 @@ start: buf[0]='\0'; if (!batch) { - fgets(buf,1024,stdin); + fgets(buf,sizeof buf,stdin); } else { @@ -1400,7 +1504,7 @@ start: ebcdic2ascii(buf, buf, i); #endif if(!req_check_len(i, n_min, n_max)) goto start; - if (!X509_NAME_add_entry_by_NID(n,nid, MBSTRING_ASC, + if (!X509_NAME_add_entry_by_NID(n,nid, chtype, (unsigned char *) buf, -1,-1,0)) goto err; ret=1; err: @@ -1409,7 +1513,7 @@ err: static int add_attribute_object(X509_REQ *req, char *text, char *def, char *value, int nid, int n_min, - int n_max) + int n_max, unsigned long chtype) { int i; static char buf[1024]; @@ -1419,6 +1523,7 @@ start: (void)BIO_flush(bio_err); if (value != NULL) { + OPENSSL_assert(strlen(value) < sizeof buf-2); strcpy(buf,value); strcat(buf,"\n"); BIO_printf(bio_err,"%s\n",value); @@ -1428,7 +1533,7 @@ start: buf[0]='\0'; if (!batch) { - fgets(buf,1024,stdin); + fgets(buf,sizeof buf,stdin); } else { @@ -1459,7 +1564,7 @@ start: #endif if(!req_check_len(i, n_min, n_max)) goto start; - if(!X509_REQ_add1_attr_by_NID(req, nid, MBSTRING_ASC, + if(!X509_REQ_add1_attr_by_NID(req, nid, chtype, (unsigned char *)buf, -1)) { BIO_printf(bio_err, "Error adding attribute\n"); ERR_print_errors(bio_err);