X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=apps%2Freq.c;h=629a604490cf02cad769e286bde533ba8a0a7e54;hp=9611431fe7072a45747b06657a5156112ab91ebc;hb=1064acafc4b6892a36c016e53256a0590680afe4;hpb=dd5e774664160f19e4828bddbdfbefa7d2b543dd diff --git a/apps/req.c b/apps/req.c index 9611431fe7..629a604490 100644 --- a/apps/req.c +++ b/apps/req.c @@ -84,6 +84,7 @@ #define V3_EXTENSIONS "x509_extensions" #define REQ_EXTENSIONS "req_extensions" #define STRING_MASK "string_mask" +#define UTF8_IN "utf8" #define DEFAULT_KEY_LENGTH 512 #define MIN_KEY_LENGTH 384 @@ -105,23 +106,27 @@ * -rand file(s) - load the file(s) into the PRNG. * -newkey - make a key and a request. * -modulus - print RSA modulus. + * -pubkey - output Public Key. * -x509 - output a self signed X509 structure instead. * -asn1-kludge - output new certificate request in a format that some CA's * require. This format is wrong */ -static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,char *dn,int attribs); -static int build_subject(X509_REQ *req, char *subj); +static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,char *dn,int attribs, + unsigned long chtype); +static int build_subject(X509_REQ *req, char *subj, unsigned long chtype); static int prompt_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect, - STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs); + STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs, + unsigned long chtype); static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk, - STACK_OF(CONF_VALUE) *attr, int attribs); + STACK_OF(CONF_VALUE) *attr, int attribs, + unsigned long chtype); static int add_attribute_object(X509_REQ *req, char *text, char *def, char *value, int nid, int n_min, - int n_max); + int n_max, unsigned long chtype); static int add_DN_object(X509_NAME *n, char *text, char *def, char *value, - int nid,int n_min,int n_max); + int nid,int n_min,int n_max, unsigned long chtype); #ifndef OPENSSL_NO_RSA static void MS_CALLBACK req_cb(int p,int n,void *arg); #endif @@ -137,6 +142,7 @@ static int batch=0; #define TYPE_RSA 1 #define TYPE_DSA 2 #define TYPE_DH 3 +#define TYPE_ECDSA 4 int MAIN(int, char **); @@ -145,6 +151,9 @@ int MAIN(int argc, char **argv) ENGINE *e = NULL; #ifndef OPENSSL_NO_DSA DSA *dsa_params=NULL; +#endif +#ifndef OPENSSL_NO_ECDSA + ECDSA *ecdsa_params = NULL; #endif unsigned long nmflag = 0; int ex=1,x509=0,days=30; @@ -155,7 +164,7 @@ int MAIN(int argc, char **argv) long newkey = -1; BIO *in=NULL,*out=NULL; int informat,outformat,verify=0,noout=0,text=0,keyform=FORMAT_PEM; - int nodes=0,kludge=0,newhdr=0,subject=0; + int nodes=0,kludge=0,newhdr=0,subject=0,pubkey=0; char *infile,*outfile,*prog,*keyfile=NULL,*template=NULL,*keyout=NULL; char *engine=NULL; char *extensions = NULL; @@ -169,8 +178,10 @@ int MAIN(int argc, char **argv) char *p; char *subj = NULL; const EVP_MD *md_alg=NULL,*digest=EVP_md5(); + unsigned long chtype = MBSTRING_ASC; #ifndef MONOLITH MS_STATIC char config_name[256]; + long errline; #endif req_conf = NULL; @@ -213,6 +224,10 @@ int MAIN(int argc, char **argv) if (--argc < 1) goto bad; keyfile= *(++argv); } + else if (strcmp(*argv,"-pubkey") == 0) + { + pubkey=1; + } else if (strcmp(*argv,"-new") == 0) { newreq=1; @@ -295,7 +310,7 @@ int MAIN(int argc, char **argv) goto end; } - dtmp=X509_get_pubkey(xtmp); + if ((dtmp=X509_get_pubkey(xtmp)) == NULL) goto end; if (dtmp->type == EVP_PKEY_DSA) dsa_params=DSAparams_dup(dtmp->pkey.dsa); EVP_PKEY_free(dtmp); @@ -307,11 +322,63 @@ int MAIN(int argc, char **argv) } } BIO_free(in); - newkey=BN_num_bits(dsa_params->p); in=NULL; + newkey=BN_num_bits(dsa_params->p); } else #endif +#ifndef OPENSSL_NO_ECDSA + if (strncmp("ecdsa:",p,4) == 0) + { + X509 *xtmp=NULL; + EVP_PKEY *dtmp; + + pkey_type=TYPE_ECDSA; + p+=6; + if ((in=BIO_new_file(p,"r")) == NULL) + { + perror(p); + goto end; + } + if ((ecdsa_params = PEM_read_bio_ECDSAParameters(in, NULL, NULL, NULL)) == NULL) + { + ERR_clear_error(); + (void)BIO_reset(in); + if ((xtmp=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL) + { + BIO_printf(bio_err,"unable to load ECDSA parameters from file\n"); + goto end; + } + + if ((dtmp=X509_get_pubkey(xtmp)) == NULL) goto end; + if (dtmp->type == EVP_PKEY_ECDSA) + ecdsa_params = ECDSAParameters_dup(dtmp->pkey.ecdsa); + EVP_PKEY_free(dtmp); + X509_free(xtmp); + if (ecdsa_params == NULL) + { + BIO_printf(bio_err,"Certificate does not contain ECDSA parameters\n"); + goto end; + } + } + + BIO_free(in); + in=NULL; + + { + BIGNUM *order = BN_new(); + + if (!order) + goto end; + if (!EC_GROUP_get_order(ecdsa_params->group, order, NULL)) + goto end; + newkey = BN_num_bits(order); + BN_free(order); + } + + } + else +#endif #ifndef OPENSSL_NO_DH if (strncmp("dh:",p,4) == 0) { @@ -338,6 +405,8 @@ int MAIN(int argc, char **argv) noout=1; else if (strcmp(*argv,"-verbose") == 0) verbose=1; + else if (strcmp(*argv,"-utf8") == 0) + chtype = MBSTRING_UTF8; else if (strcmp(*argv,"-nameopt") == 0) { if (--argc < 1) goto bad; @@ -405,6 +474,7 @@ bad: BIO_printf(bio_err," -in arg input file\n"); BIO_printf(bio_err," -out arg output file\n"); BIO_printf(bio_err," -text text form of request\n"); + BIO_printf(bio_err," -pubkey output public key\n"); BIO_printf(bio_err," -noout do not output REQ\n"); BIO_printf(bio_err," -verify verify signature on REQ\n"); BIO_printf(bio_err," -modulus RSA modulus\n"); @@ -420,6 +490,7 @@ bad: BIO_printf(bio_err," the random number generator\n"); BIO_printf(bio_err," -newkey rsa:bits generate a new RSA key of 'bits' in size\n"); BIO_printf(bio_err," -newkey dsa:file generate a new DSA key, parameters taken from CA in 'file'\n"); + BIO_printf(bio_err," -newkey ecdsa:file generate a new ECDSA key, parameters taken from CA in 'file'\n"); BIO_printf(bio_err," -[digest] Digest to sign with (md5, sha1, md2, mdc2, md4)\n"); BIO_printf(bio_err," -config file request template file.\n"); BIO_printf(bio_err," -subj arg set or modify request subject\n"); @@ -433,6 +504,7 @@ bad: BIO_printf(bio_err," have been reported as requiring\n"); BIO_printf(bio_err," -extensions .. specify certificate extension section (override value in config file)\n"); BIO_printf(bio_err," -reqexts .. specify request extension section (override value in config file)\n"); + BIO_printf(bio_err," -utf8 input characters are UTF8 (default ASCII)\n"); goto end; } @@ -458,14 +530,15 @@ bad: } default_config_file=p; config=NCONF_new(NULL); - i=NCONF_load(config, p); + i=NCONF_load(config, p, &errline); #endif if (template != NULL) { long errline; - BIO_printf(bio_err,"Using configuration from %s\n",template); + if( verbose ) + BIO_printf(bio_err,"Using configuration from %s\n",template); req_conf=NCONF_new(NULL); i=NCONF_load(req_conf,template,&errline); if (i == 0) @@ -477,9 +550,10 @@ bad: else { req_conf=config; - BIO_printf(bio_err,"Using configuration from %s\n", + if( verbose ) + BIO_printf(bio_err,"Using configuration from %s\n", default_config_file); - if (i == 0) + if (req_conf == NULL) { BIO_printf(bio_err,"Unable to load config info\n"); } @@ -487,6 +561,8 @@ bad: if (req_conf != NULL) { + if (!load_config(bio_err, req_conf)) + goto end; p=NCONF_get_string(req_conf,NULL,"oid_file"); if (p == NULL) ERR_clear_error(); @@ -564,6 +640,16 @@ bad: goto end; } + if (chtype != MBSTRING_UTF8) + { + p = NCONF_get_string(req_conf, SECTION, UTF8_IN); + if (!p) + ERR_clear_error(); + else if (!strcmp(p, "yes")) + chtype = MBSTRING_UTF8; + } + + if(!req_exts) { req_exts = NCONF_get_string(req_conf, SECTION, REQ_EXTENSIONS); @@ -600,7 +686,7 @@ bad: message */ goto end; } - if (EVP_PKEY_type(pkey->type) == EVP_PKEY_DSA) + if (EVP_PKEY_type(pkey->type) == EVP_PKEY_DSA || EVP_PKEY_type(pkey->type) == EVP_PKEY_ECDSA) { char *randfile = NCONF_get_string(req_conf,SECTION,"RANDFILE"); if (randfile == NULL) @@ -624,14 +710,15 @@ bad: newkey=DEFAULT_KEY_LENGTH; } - if (newkey < MIN_KEY_LENGTH) + if (newkey < MIN_KEY_LENGTH && (pkey_type == TYPE_RSA || pkey_type == TYPE_DSA)) + /* TODO: appropriate minimal keylength for the different algorithm (esp. ECDSA) */ { BIO_printf(bio_err,"private key length is too short,\n"); BIO_printf(bio_err,"it needs to be at least %d bits, not %d\n",MIN_KEY_LENGTH,newkey); goto end; } BIO_printf(bio_err,"Generating a %d bit %s private key\n", - newkey,(pkey_type == TYPE_RSA)?"RSA":"DSA"); + newkey,(pkey_type == TYPE_RSA)?"RSA":(pkey_type == TYPE_DSA)?"DSA":"ECDSA"); if ((pkey=EVP_PKEY_new()) == NULL) goto end; @@ -653,6 +740,14 @@ bad: dsa_params=NULL; } #endif +#ifndef OPENSSL_NO_ECDSA + if (pkey_type == TYPE_ECDSA) + { + if (!ECDSA_generate_key(ecdsa_params)) goto end; + if (!EVP_PKEY_assign_ECDSA(pkey, ecdsa_params)) goto end; + ecdsa_params = NULL; + } +#endif app_RAND_write_file(randfile, bio_err); @@ -758,6 +853,10 @@ loop: #ifndef OPENSSL_NO_DSA if (pkey->type == EVP_PKEY_DSA) digest=EVP_dss1(); +#endif +#ifndef OPENSSL_NO_ECDSA + if (pkey->type == EVP_PKEY_ECDSA) + digest=EVP_ecdsa(); #endif if (req == NULL) { @@ -767,7 +866,7 @@ loop: goto end; } - i=make_REQ(req,pkey,subj,!x509); + i=make_REQ(req,pkey,subj,!x509, chtype); subj=NULL; /* done processing '-subj' option */ if ((kludge > 0) && !sk_X509_ATTRIBUTE_num(req->req_info->attributes)) { @@ -789,19 +888,20 @@ loop: /* Set version to V3 */ if(!X509_set_version(x509ss, 2)) goto end; if (serial) - X509_set_serialNumber(x509ss, serial); + { + if (!X509_set_serialNumber(x509ss, serial)) goto end; + } else - ASN1_INTEGER_set(X509_get_serialNumber(x509ss),0L); - - X509_set_issuer_name(x509ss, - X509_REQ_get_subject_name(req)); - X509_gmtime_adj(X509_get_notBefore(x509ss),0); - X509_gmtime_adj(X509_get_notAfter(x509ss), - (long)60*60*24*days); - X509_set_subject_name(x509ss, - X509_REQ_get_subject_name(req)); + { + if (!ASN1_INTEGER_set(X509_get_serialNumber(x509ss),0L)) goto end; + } + + if (!X509_set_issuer_name(x509ss, X509_REQ_get_subject_name(req))) goto end; + if (!X509_gmtime_adj(X509_get_notBefore(x509ss),0)) goto end; + if (!X509_gmtime_adj(X509_get_notAfter(x509ss), (long)60*60*24*days)) goto end; + if (!X509_set_subject_name(x509ss, X509_REQ_get_subject_name(req))) goto end; tmppkey = X509_REQ_get_pubkey(req); - X509_set_pubkey(x509ss,tmppkey); + if (!tmppkey || !X509_set_pubkey(x509ss,tmppkey)) goto end; EVP_PKEY_free(tmppkey); /* Set up V3 context struct */ @@ -859,7 +959,7 @@ loop: print_name(bio_err, "old subject=", X509_REQ_get_subject_name(req), nmflag); } - if (build_subject(req, subj) == 0) + if (build_subject(req, subj, chtype) == 0) { BIO_printf(bio_err, "ERROR: cannot modify subject\n"); ex=1; @@ -898,12 +998,13 @@ loop: else if (i == 0) { BIO_printf(bio_err,"verify failure\n"); + ERR_print_errors(bio_err); } else /* if (i > 0) */ BIO_printf(bio_err,"verify OK\n"); } - if (noout && !text && !modulus && !subject) + if (noout && !text && !modulus && !subject && !pubkey) { ex=0; goto end; @@ -932,6 +1033,20 @@ loop: } } + if (pubkey) + { + EVP_PKEY *tpubkey; + tpubkey=X509_REQ_get_pubkey(req); + if (tpubkey == NULL) + { + BIO_printf(bio_err,"Error getting public key\n"); + ERR_print_errors(bio_err); + goto end; + } + PEM_write_bio_PUBKEY(out, tpubkey); + EVP_PKEY_free(tpubkey); + } + if (text) { if (x509) @@ -950,24 +1065,25 @@ loop: if (modulus) { - EVP_PKEY *pubkey; + EVP_PKEY *tpubkey; if (x509) - pubkey=X509_get_pubkey(x509ss); + tpubkey=X509_get_pubkey(x509ss); else - pubkey=X509_REQ_get_pubkey(req); - if (pubkey == NULL) + tpubkey=X509_REQ_get_pubkey(req); + if (tpubkey == NULL) { fprintf(stdout,"Modulus=unavailable\n"); goto end; } fprintf(stdout,"Modulus="); #ifndef OPENSSL_NO_RSA - if (pubkey->type == EVP_PKEY_RSA) - BN_print(out,pubkey->pkey.rsa->n); + if (tpubkey->type == EVP_PKEY_RSA) + BN_print(out,tpubkey->pkey.rsa->n); else #endif fprintf(stdout,"Wrong Algorithm type"); + EVP_PKEY_free(tpubkey); fprintf(stdout,"\n"); } @@ -1022,12 +1138,16 @@ end: OBJ_cleanup(); #ifndef OPENSSL_NO_DSA if (dsa_params != NULL) DSA_free(dsa_params); +#endif +#ifndef OPENSSL_NO_ECDSA + if (ecdsa_params != NULL) ECDSA_free(ecdsa_params); #endif apps_shutdown(); EXIT(ex); } -static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs) +static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs, + unsigned long chtype) { int ret=0,i; char no_prompt = 0; @@ -1073,24 +1193,24 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs) if (!X509_REQ_set_version(req,0L)) goto err; /* version 1 */ if (no_prompt) - i = auto_info(req, dn_sk, attr_sk, attribs); + i = auto_info(req, dn_sk, attr_sk, attribs, chtype); else { if (subj) - i = build_subject(req, subj); + i = build_subject(req, subj, chtype); else - i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs); + i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs, chtype); } if(!i) goto err; - X509_REQ_set_pubkey(req,pkey); + if (!X509_REQ_set_pubkey(req,pkey)) goto err; ret=1; err: return(ret); } -static int build_subject(X509_REQ *req, char *subject) +static int build_subject(X509_REQ *req, char *subject, unsigned long chtype) { X509_NAME *n = NULL; @@ -1139,7 +1259,7 @@ static int build_subject(X509_REQ *req, char *subject) continue; } - if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC, (unsigned char*)ne_value, -1,-1,0)) + if (!X509_NAME_add_entry_by_NID(n, nid, chtype, (unsigned char*)ne_value, -1,-1,0)) { X509_NAME_free(n); return 0; @@ -1155,7 +1275,8 @@ static int build_subject(X509_REQ *req, char *subject) static int prompt_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect, - STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs) + STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs, + unsigned long chtype) { int i; char *p,*q; @@ -1228,7 +1349,7 @@ start: for (;;) n_max = -1; if (!add_DN_object(subj,v->value,def,value,nid, - n_min,n_max)) + n_min,n_max, chtype)) return 0; } if (X509_NAME_entry_count(subj) == 0) @@ -1284,7 +1405,7 @@ start2: for (;;) n_max = -1; if (!add_attribute_object(req, - v->value,def,value,nid,n_min,n_max)) + v->value,def,value,nid,n_min,n_max, chtype)) return 0; } } @@ -1300,7 +1421,7 @@ start2: for (;;) } static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, - STACK_OF(CONF_VALUE) *attr_sk, int attribs) + STACK_OF(CONF_VALUE) *attr_sk, int attribs, unsigned long chtype) { int i; char *p,*q; @@ -1328,7 +1449,7 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, if(*p) type = p; break; } - if (!X509_NAME_add_entry_by_txt(subj,type, MBSTRING_ASC, + if (!X509_NAME_add_entry_by_txt(subj,type, chtype, (unsigned char *) v->value,-1,-1,0)) return 0; } @@ -1343,7 +1464,7 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, for (i = 0; i < sk_CONF_VALUE_num(attr_sk); i++) { v=sk_CONF_VALUE_value(attr_sk,i); - if(!X509_REQ_add1_attr_by_txt(req, v->name, MBSTRING_ASC, + if(!X509_REQ_add1_attr_by_txt(req, v->name, chtype, (unsigned char *)v->value, -1)) return 0; } } @@ -1352,7 +1473,7 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk, static int add_DN_object(X509_NAME *n, char *text, char *def, char *value, - int nid, int n_min, int n_max) + int nid, int n_min, int n_max, unsigned long chtype) { int i,ret=0; MS_STATIC char buf[1024]; @@ -1400,7 +1521,7 @@ start: ebcdic2ascii(buf, buf, i); #endif if(!req_check_len(i, n_min, n_max)) goto start; - if (!X509_NAME_add_entry_by_NID(n,nid, MBSTRING_ASC, + if (!X509_NAME_add_entry_by_NID(n,nid, chtype, (unsigned char *) buf, -1,-1,0)) goto err; ret=1; err: @@ -1409,7 +1530,7 @@ err: static int add_attribute_object(X509_REQ *req, char *text, char *def, char *value, int nid, int n_min, - int n_max) + int n_max, unsigned long chtype) { int i; static char buf[1024]; @@ -1459,7 +1580,7 @@ start: #endif if(!req_check_len(i, n_min, n_max)) goto start; - if(!X509_REQ_add1_attr_by_NID(req, nid, MBSTRING_ASC, + if(!X509_REQ_add1_attr_by_NID(req, nid, chtype, (unsigned char *)buf, -1)) { BIO_printf(bio_err, "Error adding attribute\n"); ERR_print_errors(bio_err);