mirrors/openssl
0
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-28 04:25:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

Modify apps to use NCONF code instead of old CONF code.

Browse Source 
Add new extension functions which work with NCONF.

Tidy up extension config routines and remove redundant code.

Fix NCONF_get_number().

Todo: more testing of apps to see they still work...
This commit is contained in:
Dr. Stephen Henson 2001-06-28 11:41:50 +00:00
parent ce16450a89
commit b7a26e6daf
12 changed files with 432 additions and 329 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
CHANGES
View File

@ -11,6 +11,14 @@
*) applies to 0.9.6a (/0.9.6b) and 0.9.7 *) applies to 0.9.6a (/0.9.6b) and 0.9.7
+) applies to 0.9.7 only +) applies to 0.9.7 only
+) Rewrite apps to use NCONF routines instead of the old CONF. New functions
to support NCONF routines in extension code. New function CONF_set_nconf()
to allow functions which take an NCONF to also handle the old LHASH
structure: this means that the old CONF compatible routines can be
retained (in particular wrt extensions) without having to duplicate the
code. New function X509V3_add_ext_nconf_sk to add extensions to a stack.
[Steve Henson]
*) Handle special case when X509_NAME is empty in X509 printing routines. *) Handle special case when X509_NAME is empty in X509 printing routines.
[Steve Henson] [Steve Henson]

6
apps/apps.c
View File

@ -591,18 +591,18 @@ static char *app_get_pass(BIO *err, char *arg, int keepbio)
return BUF_strdup(tpass); return BUF_strdup(tpass);
} }
int add_oid_section(BIO *err, LHASH *conf) int add_oid_section(BIO *err, CONF *conf)
{ {
char *p; char *p;
STACK_OF(CONF_VALUE) *sktmp; STACK_OF(CONF_VALUE) *sktmp;
CONF_VALUE *cnf; CONF_VALUE *cnf;
int i; int i;
if(!(p=CONF_get_string(conf,NULL,"oid_section"))) if(!(p=NCONF_get_string(conf,NULL,"oid_section")))
{ {
ERR_clear_error(); ERR_clear_error();
return 1; return 1;
} }
if(!(sktmp = CONF_get_section(conf, p))) { if(!(sktmp = NCONF_get_section(conf, p))) {
BIO_printf(err, "problem loading oid section %s\n", p); BIO_printf(err, "problem loading oid section %s\n", p);
return 0; return 0;
} }

4
apps/apps.h
View File

@ -101,7 +101,7 @@ extern BIO *bio_err;
#else #else
#define MAIN(a,v) PROG(a,v) #define MAIN(a,v) PROG(a,v)
extern LHASH *config; extern CONF *config;
extern char *default_config_file; extern char *default_config_file;
extern BIO *bio_err; extern BIO *bio_err;
@ -175,7 +175,7 @@ int set_name_ex(unsigned long *flags, const char *arg);
int set_ext_copy(int *copy_type, const char *arg); int set_ext_copy(int *copy_type, const char *arg);
int copy_extensions(X509 *x, X509_REQ *req, int copy_type); int copy_extensions(X509 *x, X509_REQ *req, int copy_type);
int app_passwd(BIO *err, char *arg1, char *arg2, char **pass1, char **pass2); int app_passwd(BIO *err, char *arg1, char *arg2, char **pass1, char **pass2);
int add_oid_section(BIO *err, LHASH *conf); int add_oid_section(BIO *err, CONF *conf);
X509 *load_cert(BIO *err, const char *file, int format, X509 *load_cert(BIO *err, const char *file, int format,
const char *pass, ENGINE *e, const char *cert_descrip); const char *pass, ENGINE *e, const char *cert_descrip);
EVP_PKEY *load_key(BIO *err, const char *file, int format, EVP_PKEY *load_key(BIO *err, const char *file, int format,

120
apps/ca.c
View File

@ -213,28 +213,28 @@ static int save_serial(char *serialfile, BIGNUM *serial);
static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509, static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,TXT_DB *db, const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,TXT_DB *db,
BIGNUM *serial, char *subj, char *startdate,char *enddate, BIGNUM *serial, char *subj, char *startdate,char *enddate,
int days, int batch, char *ext_sect, LHASH *conf,int verbose, long days, int batch, char *ext_sect, CONF *conf,int verbose,
unsigned long certopt, unsigned long nameopt, int default_op, unsigned long certopt, unsigned long nameopt, int default_op,
int ext_copy); int ext_copy);
static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509, static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy, const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
TXT_DB *db, BIGNUM *serial, char *subj, char *startdate, TXT_DB *db, BIGNUM *serial, char *subj, char *startdate,
char *enddate, int days, int batch, char *ext_sect, char *enddate, long days, int batch, char *ext_sect,
LHASH *conf,int verbose, unsigned long certopt, CONF *conf,int verbose, unsigned long certopt,
unsigned long nameopt, int default_op, int ext_copy, unsigned long nameopt, int default_op, int ext_copy,
ENGINE *e); ENGINE *e);
static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509, static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy, const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
TXT_DB *db, BIGNUM *serial,char *subj, char *startdate, TXT_DB *db, BIGNUM *serial,char *subj, char *startdate,
char *enddate, int days, char *ext_sect,LHASH *conf, char *enddate, long days, char *ext_sect,CONF *conf,
int verbose, unsigned long certopt, unsigned long nameopt, int verbose, unsigned long certopt, unsigned long nameopt,
int default_op, int ext_copy); int default_op, int ext_copy);
static int fix_data(int nid, int *type); static int fix_data(int nid, int *type);
static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext); static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst, static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,char *subj, STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,char *subj,
char *startdate, char *enddate, int days, int batch, int verbose, char *startdate, char *enddate, long days, int batch, int verbose,
X509_REQ *req, char *ext_sect, LHASH *conf, X509_REQ *req, char *ext_sect, CONF *conf,
unsigned long certopt, unsigned long nameopt, int default_op, unsigned long certopt, unsigned long nameopt, int default_op,
int ext_copy); int ext_copy);
static X509_NAME *do_subject(char *subject); static X509_NAME *do_subject(char *subject);
@ -245,8 +245,8 @@ static int check_time_format(char *str);
char *make_revocation_str(int rev_type, char *rev_arg); char *make_revocation_str(int rev_type, char *rev_arg);
int make_revoked(X509_REVOKED *rev, char *str); int make_revoked(X509_REVOKED *rev, char *str);
int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str); int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
static LHASH *conf=NULL; static CONF *conf=NULL;
static LHASH *extconf=NULL; static CONF *extconf=NULL;
static char *section=NULL; static char *section=NULL;
static int preserve=0; static int preserve=0;
@ -300,7 +300,7 @@ int MAIN(int argc, char **argv)
BIGNUM *serial=NULL; BIGNUM *serial=NULL;
char *startdate=NULL; char *startdate=NULL;
char *enddate=NULL; char *enddate=NULL;
int days=0; long days=0;
int batch=0; int batch=0;
int notext=0; int notext=0;
unsigned long nameopt = 0, certopt = 0; unsigned long nameopt = 0, certopt = 0;
@ -571,7 +571,8 @@ bad:
} }
BIO_printf(bio_err,"Using configuration from %s\n",configfile); BIO_printf(bio_err,"Using configuration from %s\n",configfile);
if ((conf=CONF_load(NULL,configfile,&errorline)) == NULL) conf = NCONF_new(NULL);
if (NCONF_load(conf,configfile,&errorline) <= 0)
{ {
if (errorline <= 0) if (errorline <= 0)
BIO_printf(bio_err,"error loading the config file '%s'\n", BIO_printf(bio_err,"error loading the config file '%s'\n",
@ -585,7 +586,7 @@ bad:
/* Lets get the config section we are using */ /* Lets get the config section we are using */
if (section == NULL) if (section == NULL)
{ {
section=CONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA); section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
if (section == NULL) if (section == NULL)
{ {
lookup_fail(BASE_SECTION,ENV_DEFAULT_CA); lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
@ -595,7 +596,7 @@ bad:
if (conf != NULL) if (conf != NULL)
{ {
p=CONF_get_string(conf,NULL,"oid_file"); p=NCONF_get_string(conf,NULL,"oid_file");
if (p == NULL) if (p == NULL)
ERR_clear_error(); ERR_clear_error();
if (p != NULL) if (p != NULL)
@ -624,7 +625,7 @@ bad:
} }
} }
randfile = CONF_get_string(conf, BASE_SECTION, "RANDFILE"); randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
if (randfile == NULL) if (randfile == NULL)
ERR_clear_error(); ERR_clear_error();
app_RAND_load_file(randfile, bio_err, 0); app_RAND_load_file(randfile, bio_err, 0);
@ -643,7 +644,7 @@ bad:
/* report status of cert with serial number given on command line */ /* report status of cert with serial number given on command line */
if (ser_status) if (ser_status)
{ {
if ((dbfile=CONF_get_string(conf,section,ENV_DATABASE)) == NULL) if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
{ {
lookup_fail(section,ENV_DATABASE); lookup_fail(section,ENV_DATABASE);
goto err; goto err;
@ -676,7 +677,7 @@ bad:
/*****************************************************************/ /*****************************************************************/
/* we definitely need a public key, so let's get it */ /* we definitely need a public key, so let's get it */
if ((keyfile == NULL) && ((keyfile=CONF_get_string(conf, if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
section,ENV_PRIVATE_KEY)) == NULL)) section,ENV_PRIVATE_KEY)) == NULL))
{ {
lookup_fail(section,ENV_PRIVATE_KEY); lookup_fail(section,ENV_PRIVATE_KEY);
@ -698,7 +699,7 @@ bad:
/*****************************************************************/ /*****************************************************************/
/* we need a certificate */ /* we need a certificate */
if ((certfile == NULL) && ((certfile=CONF_get_string(conf, if ((certfile == NULL) && ((certfile=NCONF_get_string(conf,
section,ENV_CERTIFICATE)) == NULL)) section,ENV_CERTIFICATE)) == NULL))
{ {
lookup_fail(section,ENV_CERTIFICATE); lookup_fail(section,ENV_CERTIFICATE);
@ -715,18 +716,18 @@ bad:
goto err; goto err;
} }
f=CONF_get_string(conf,BASE_SECTION,ENV_PRESERVE); f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
if (f == NULL) if (f == NULL)
ERR_clear_error(); ERR_clear_error();
if ((f != NULL) && ((*f == 'y') || (*f == 'Y'))) if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
preserve=1; preserve=1;
f=CONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK); f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
if (f == NULL) if (f == NULL)
ERR_clear_error(); ERR_clear_error();
if ((f != NULL) && ((*f == 'y') || (*f == 'Y'))) if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
msie_hack=1; msie_hack=1;
f=CONF_get_string(conf,section,ENV_NAMEOPT); f=NCONF_get_string(conf,section,ENV_NAMEOPT);
if (f) if (f)
{ {
@ -740,7 +741,7 @@ bad:
else else
ERR_clear_error(); ERR_clear_error();
f=CONF_get_string(conf,section,ENV_CERTOPT); f=NCONF_get_string(conf,section,ENV_CERTOPT);
if (f) if (f)
{ {
@ -754,7 +755,7 @@ bad:
else else
ERR_clear_error(); ERR_clear_error();
f=CONF_get_string(conf,section,ENV_EXTCOPY); f=NCONF_get_string(conf,section,ENV_EXTCOPY);
if (f) if (f)
{ {
@ -773,7 +774,7 @@ bad:
{ {
struct stat sb; struct stat sb;
if ((outdir=CONF_get_string(conf,section,ENV_NEW_CERTS_DIR)) if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
== NULL) == NULL)
{ {
BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n"); BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
@ -816,7 +817,7 @@ bad:
/*****************************************************************/ /*****************************************************************/
/* we need to load the database file */ /* we need to load the database file */
if ((dbfile=CONF_get_string(conf,section,ENV_DATABASE)) == NULL) if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
{ {
lookup_fail(section,ENV_DATABASE); lookup_fail(section,ENV_DATABASE);
goto err; goto err;
@ -995,7 +996,8 @@ bad:
/* Read extentions config file */ /* Read extentions config file */
if (extfile) if (extfile)
{ {
if (!(extconf=CONF_load(NULL,extfile,&errorline))) extconf = NCONF_new(NULL);
if (NCONF_load(extconf,extfile,&errorline) <= 0)
{ {
if (errorline <= 0) if (errorline <= 0)
BIO_printf(bio_err, "ERROR: loading the config file '%s'\n", BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
@ -1011,7 +1013,7 @@ bad:
BIO_printf(bio_err, "Succesfully loaded extensions file %s\n", extfile); BIO_printf(bio_err, "Succesfully loaded extensions file %s\n", extfile);
/* We can have sections in the ext file */ /* We can have sections in the ext file */
if (!extensions && !(extensions = CONF_get_string(extconf, "default", "extensions"))) if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
extensions = "default"; extensions = "default";
} }
@ -1040,7 +1042,7 @@ bad:
if (req) if (req)
{ {
if ((md == NULL) && ((md=CONF_get_string(conf, if ((md == NULL) && ((md=NCONF_get_string(conf,
section,ENV_DEFAULT_MD)) == NULL)) section,ENV_DEFAULT_MD)) == NULL))
{ {
lookup_fail(section,ENV_DEFAULT_MD); lookup_fail(section,ENV_DEFAULT_MD);
@ -1054,7 +1056,7 @@ bad:
if (verbose) if (verbose)
BIO_printf(bio_err,"message digest is %s\n", BIO_printf(bio_err,"message digest is %s\n",
OBJ_nid2ln(dgst->type)); OBJ_nid2ln(dgst->type));
if ((policy == NULL) && ((policy=CONF_get_string(conf, if ((policy == NULL) && ((policy=NCONF_get_string(conf,
section,ENV_POLICY)) == NULL)) section,ENV_POLICY)) == NULL))
{ {
lookup_fail(section,ENV_POLICY); lookup_fail(section,ENV_POLICY);
@ -1063,7 +1065,7 @@ bad:
if (verbose) if (verbose)
BIO_printf(bio_err,"policy is %s\n",policy); BIO_printf(bio_err,"policy is %s\n",policy);
if ((serialfile=CONF_get_string(conf,section,ENV_SERIAL)) if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
== NULL) == NULL)
{ {
lookup_fail(section,ENV_SERIAL); lookup_fail(section,ENV_SERIAL);
@ -1076,7 +1078,7 @@ bad:
* in the main configuration file */ * in the main configuration file */
if (!extensions) if (!extensions)
{ {
extensions=CONF_get_string(conf,section, extensions=NCONF_get_string(conf,section,
ENV_EXTENSIONS); ENV_EXTENSIONS);
if (!extensions) if (!extensions)
ERR_clear_error(); ERR_clear_error();
@ -1086,8 +1088,8 @@ bad:
/* Check syntax of file */ /* Check syntax of file */
X509V3_CTX ctx; X509V3_CTX ctx;
X509V3_set_ctx_test(&ctx); X509V3_set_ctx_test(&ctx);
X509V3_set_conf_lhash(&ctx, conf); X509V3_set_nconf(&ctx, conf);
if (!X509V3_EXT_add_conf(conf, &ctx, extensions, if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
NULL)) NULL))
{ {
BIO_printf(bio_err, BIO_printf(bio_err,
@ -1101,7 +1103,7 @@ bad:
if (startdate == NULL) if (startdate == NULL)
{ {
startdate=CONF_get_string(conf,section, startdate=NCONF_get_string(conf,section,
ENV_DEFAULT_STARTDATE); ENV_DEFAULT_STARTDATE);
if (startdate == NULL) if (startdate == NULL)
ERR_clear_error(); ERR_clear_error();
@ -1115,7 +1117,7 @@ bad:
if (enddate == NULL) if (enddate == NULL)
{ {
enddate=CONF_get_string(conf,section, enddate=NCONF_get_string(conf,section,
ENV_DEFAULT_ENDDATE); ENV_DEFAULT_ENDDATE);
if (enddate == NULL) if (enddate == NULL)
ERR_clear_error(); ERR_clear_error();
@ -1128,8 +1130,8 @@ bad:
if (days == 0) if (days == 0)
{ {
days=(int)CONF_get_number(conf,section, if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
ENV_DEFAULT_DAYS); days = 0;
} }
if (!enddate && (days == 0)) if (!enddate && (days == 0))
{ {
@ -1149,7 +1151,7 @@ bad:
OPENSSL_free(f); OPENSSL_free(f);
} }
if ((attribs=CONF_get_section(conf,policy)) == NULL) if ((attribs=NCONF_get_section(conf,policy)) == NULL)
{ {
BIO_printf(bio_err,"unable to find 'section' for %s\n",policy); BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
goto err; goto err;
@ -1404,7 +1406,7 @@ bad:
int crl_v2 = 0; int crl_v2 = 0;
if (!crl_ext) if (!crl_ext)
{ {
crl_ext=CONF_get_string(conf,section,ENV_CRLEXT); crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
if (!crl_ext) if (!crl_ext)
ERR_clear_error(); ERR_clear_error();
} }
@ -1413,8 +1415,8 @@ bad:
/* Check syntax of file */ /* Check syntax of file */
X509V3_CTX ctx; X509V3_CTX ctx;
X509V3_set_ctx_test(&ctx); X509V3_set_ctx_test(&ctx);
X509V3_set_conf_lhash(&ctx, conf); X509V3_set_nconf(&ctx, conf);
if (!X509V3_EXT_add_conf(conf, &ctx, crl_ext, NULL)) if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
{ {
BIO_printf(bio_err, BIO_printf(bio_err,
"Error Loading CRL extension section %s\n", "Error Loading CRL extension section %s\n",
@ -1426,10 +1428,12 @@ bad:
if (!crldays && !crlhours) if (!crldays && !crlhours)
{ {
crldays=CONF_get_number(conf,section, if (!NCONF_get_number(conf,section,
ENV_DEFAULT_CRL_DAYS); ENV_DEFAULT_CRL_DAYS, &crldays))
crlhours=CONF_get_number(conf,section, crldays = 0;
ENV_DEFAULT_CRL_HOURS); if (!NCONF_get_number(conf,section,
ENV_DEFAULT_CRL_HOURS, &crlhours))
crlhours = 0;
} }
if ((crldays == 0) && (crlhours == 0)) if ((crldays == 0) && (crlhours == 0))
{ {
@ -1505,9 +1509,9 @@ bad:
if (ci->version == NULL) if (ci->version == NULL)
if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err; if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;
X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0); X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
X509V3_set_conf_lhash(&crlctx, conf); X509V3_set_nconf(&crlctx, conf);
if (!X509V3_EXT_CRL_add_conf(conf, &crlctx, if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
crl_ext, crl)) goto err; crl_ext, crl)) goto err;
} }
if (crl_ext || crl_v2) if (crl_ext || crl_v2)
@ -1593,7 +1597,7 @@ err:
EVP_PKEY_free(pkey); EVP_PKEY_free(pkey);
X509_free(x509); X509_free(x509);
X509_CRL_free(crl); X509_CRL_free(crl);
CONF_free(conf); NCONF_free(conf);
OBJ_cleanup(); OBJ_cleanup();
apps_shutdown(); apps_shutdown();
EXIT(ret); EXIT(ret);
@ -1704,8 +1708,8 @@ err:
static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509, static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db, const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
BIGNUM *serial, char *subj, char *startdate, char *enddate, int days, BIGNUM *serial, char *subj, char *startdate, char *enddate, long days,
int batch, char *ext_sect, LHASH *lconf, int verbose, int batch, char *ext_sect, CONF *lconf, int verbose,
unsigned long certopt, unsigned long nameopt, int default_op, unsigned long certopt, unsigned long nameopt, int default_op,
int ext_copy) int ext_copy)
{ {
@ -1766,8 +1770,8 @@ err:
static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509, static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db, const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
BIGNUM *serial, char *subj, char *startdate, char *enddate, int days, BIGNUM *serial, char *subj, char *startdate, char *enddate, long days,
int batch, char *ext_sect, LHASH *lconf, int verbose, int batch, char *ext_sect, CONF *lconf, int verbose,
unsigned long certopt, unsigned long nameopt, int default_op, unsigned long certopt, unsigned long nameopt, int default_op,
int ext_copy, ENGINE *e) int ext_copy, ENGINE *e)
{ {
@ -1820,8 +1824,8 @@ err:
static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst, static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial, char *subj, STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial, char *subj,
char *startdate, char *enddate, int days, int batch, int verbose, char *startdate, char *enddate, long days, int batch, int verbose,
X509_REQ *req, char *ext_sect, LHASH *lconf, X509_REQ *req, char *ext_sect, CONF *lconf,
unsigned long certopt, unsigned long nameopt, int default_op, unsigned long certopt, unsigned long nameopt, int default_op,
int ext_copy) int ext_copy)
{ {
@ -2143,13 +2147,13 @@ again2:
BIO_printf(bio_err, "Extra configuration file found\n"); BIO_printf(bio_err, "Extra configuration file found\n");
/* Use the extconf configuration db LHASH */ /* Use the extconf configuration db LHASH */
X509V3_set_conf_lhash(&ctx, extconf); X509V3_set_nconf(&ctx, extconf);
/* Test the structure (needed?) */ /* Test the structure (needed?) */
/* X509V3_set_ctx_test(&ctx); */ /* X509V3_set_ctx_test(&ctx); */
/* Adds exts contained in the configuration file */ /* Adds exts contained in the configuration file */
if (!X509V3_EXT_add_conf(extconf, &ctx, ext_sect,ret)) if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
{ {
BIO_printf(bio_err, BIO_printf(bio_err,
"ERROR: adding extensions in section %s\n", "ERROR: adding extensions in section %s\n",
@ -2163,9 +2167,9 @@ again2:
else if (ext_sect) else if (ext_sect)
{ {
/* We found extensions to be set from config file */ /* We found extensions to be set from config file */
X509V3_set_conf_lhash(&ctx, lconf); X509V3_set_nconf(&ctx, lconf);
if(!X509V3_EXT_add_conf(lconf, &ctx, ext_sect, ret)) if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
{ {
BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect); BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
ERR_print_errors(bio_err); ERR_print_errors(bio_err);
@ -2318,8 +2322,8 @@ static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509, static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db, const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
BIGNUM *serial, char *subj, char *startdate, char *enddate, int days, BIGNUM *serial, char *subj, char *startdate, char *enddate, long days,
char *ext_sect, LHASH *lconf, int verbose, unsigned long certopt, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
unsigned long nameopt, int default_op, int ext_copy) unsigned long nameopt, int default_op, int ext_copy)
{ {
STACK_OF(CONF_VALUE) *sk=NULL; STACK_OF(CONF_VALUE) *sk=NULL;

9
apps/openssl.c
View File

@ -138,7 +138,7 @@ static unsigned long MS_CALLBACK hash(const void *a_void);
static int MS_CALLBACK cmp(const void *a_void,const void *b_void); static int MS_CALLBACK cmp(const void *a_void,const void *b_void);
static LHASH *prog_init(void ); static LHASH *prog_init(void );
static int do_cmd(LHASH *prog,int argc,char *argv[]); static int do_cmd(LHASH *prog,int argc,char *argv[]);
LHASH *config=NULL; CONF *config=NULL;
char *default_config_file=NULL; char *default_config_file=NULL;
/* Make sure there is only one when MONOLITH is defined */ /* Make sure there is only one when MONOLITH is defined */
@ -269,8 +269,9 @@ int main(int Argc, char *Argv[])
default_config_file=p; default_config_file=p;
config=CONF_load(config,p,&errline); config=NCONF_new(NULL);
if (config == NULL) ERR_clear_error(); i=NCONF_load(config,p,&errline);
if (i == 0) ERR_clear_error();
prog=prog_init(); prog=prog_init();
@ -339,7 +340,7 @@ int main(int Argc, char *Argv[])
end: end:
if (config != NULL) if (config != NULL)
{ {
CONF_free(config); NCONF_free(config);
config=NULL; config=NULL;
} }
if (prog != NULL) lh_free(prog); if (prog != NULL) lh_free(prog);

127
apps/req.c
View File

@ -119,20 +119,20 @@ static int prompt_info(X509_REQ *req,
static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk, static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk,
STACK_OF(CONF_VALUE) *attr, int attribs); STACK_OF(CONF_VALUE) *attr, int attribs);
static int add_attribute_object(X509_REQ *req, char *text, static int add_attribute_object(X509_REQ *req, char *text,
char *def, char *value, int nid, int min, char *def, char *value, int nid, int n_min,
int max); int n_max);
static int add_DN_object(X509_NAME *n, char *text, char *def, char *value, static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
int nid,int min,int max); int nid,int n_min,int n_max);
#ifndef OPENSSL_NO_RSA #ifndef OPENSSL_NO_RSA
static void MS_CALLBACK req_cb(int p,int n,void *arg); static void MS_CALLBACK req_cb(int p,int n,void *arg);
#endif #endif
static int req_check_len(int len,int min,int max); static int req_check_len(int len,int n_min,int n_max);
static int check_end(char *str, char *end); static int check_end(char *str, char *end);
#ifndef MONOLITH #ifndef MONOLITH
static char *default_config_file=NULL; static char *default_config_file=NULL;
static LHASH *config=NULL; static CONF *config=NULL;
#endif #endif
static LHASH *req_conf=NULL; static CONF *req_conf=NULL;
static int batch=0; static int batch=0;
#define TYPE_RSA 1 #define TYPE_RSA 1
@ -152,7 +152,8 @@ int MAIN(int argc, char **argv)
X509 *x509ss=NULL; X509 *x509ss=NULL;
X509_REQ *req=NULL; X509_REQ *req=NULL;
EVP_PKEY *pkey=NULL; EVP_PKEY *pkey=NULL;
int i,badops=0,newreq=0,newkey= -1,verbose=0,pkey_type=TYPE_RSA; int i,badops=0,newreq=0,verbose=0,pkey_type=TYPE_RSA;
long newkey = -1;
BIO *in=NULL,*out=NULL; BIO *in=NULL,*out=NULL;
int informat,outformat,verify=0,noout=0,text=0,keyform=FORMAT_PEM; int informat,outformat,verify=0,noout=0,text=0,keyform=FORMAT_PEM;
int nodes=0,kludge=0,newhdr=0,subject=0; int nodes=0,kludge=0,newhdr=0,subject=0;
@ -457,7 +458,8 @@ bad:
p=config_name; p=config_name;
} }
default_config_file=p; default_config_file=p;
config=CONF_load(config,p,NULL); config=NCONF_new(NULL);
i=NCONF_load(config, p);
#endif #endif
if (template != NULL) if (template != NULL)
@ -465,8 +467,9 @@ bad:
long errline; long errline;
BIO_printf(bio_err,"Using configuration from %s\n",template); BIO_printf(bio_err,"Using configuration from %s\n",template);
req_conf=CONF_load(NULL,template,&errline); req_conf=NCONF_new(NULL);
if (req_conf == NULL) i=NCONF_load(req_conf,template,&errline);
if (i == 0)
{ {
BIO_printf(bio_err,"error on line %ld of %s\n",errline,template); BIO_printf(bio_err,"error on line %ld of %s\n",errline,template);
goto end; goto end;
@ -477,7 +480,7 @@ bad:
req_conf=config; req_conf=config;
BIO_printf(bio_err,"Using configuration from %s\n", BIO_printf(bio_err,"Using configuration from %s\n",
default_config_file); default_config_file);
if (req_conf == NULL) if (i == 0)
{ {
BIO_printf(bio_err,"Unable to load config info\n"); BIO_printf(bio_err,"Unable to load config info\n");
} }
@ -485,7 +488,7 @@ bad:
if (req_conf != NULL) if (req_conf != NULL)
{ {
p=CONF_get_string(req_conf,NULL,"oid_file"); p=NCONF_get_string(req_conf,NULL,"oid_file");
if (p == NULL) if (p == NULL)
ERR_clear_error(); ERR_clear_error();
if (p != NULL) if (p != NULL)
@ -511,7 +514,7 @@ bad:
if (md_alg == NULL) if (md_alg == NULL)
{ {
p=CONF_get_string(req_conf,SECTION,"default_md"); p=NCONF_get_string(req_conf,SECTION,"default_md");
if (p == NULL) if (p == NULL)
ERR_clear_error(); ERR_clear_error();
if (p != NULL) if (p != NULL)
@ -523,7 +526,7 @@ bad:
if (!extensions) if (!extensions)
{ {
extensions = CONF_get_string(req_conf, SECTION, V3_EXTENSIONS); extensions = NCONF_get_string(req_conf, SECTION, V3_EXTENSIONS);
if (!extensions) if (!extensions)
ERR_clear_error(); ERR_clear_error();
} }
@ -531,8 +534,8 @@ bad:
/* Check syntax of file */ /* Check syntax of file */
X509V3_CTX ctx; X509V3_CTX ctx;
X509V3_set_ctx_test(&ctx); X509V3_set_ctx_test(&ctx);
X509V3_set_conf_lhash(&ctx, req_conf); X509V3_set_nconf(&ctx, req_conf);
if(!X509V3_EXT_add_conf(req_conf, &ctx, extensions, NULL)) { if(!X509V3_EXT_add_nconf(req_conf, &ctx, extensions, NULL)) {
BIO_printf(bio_err, BIO_printf(bio_err,
"Error Loading extension section %s\n", extensions); "Error Loading extension section %s\n", extensions);
goto end; goto end;
@ -541,19 +544,19 @@ bad:
if(!passin) if(!passin)
{ {
passin = CONF_get_string(req_conf, SECTION, "input_password"); passin = NCONF_get_string(req_conf, SECTION, "input_password");
if (!passin) if (!passin)
ERR_clear_error(); ERR_clear_error();
} }
if(!passout) if(!passout)
{ {
passout = CONF_get_string(req_conf, SECTION, "output_password"); passout = NCONF_get_string(req_conf, SECTION, "output_password");
if (!passout) if (!passout)
ERR_clear_error(); ERR_clear_error();
} }
p = CONF_get_string(req_conf, SECTION, STRING_MASK); p = NCONF_get_string(req_conf, SECTION, STRING_MASK);
if (!p) if (!p)
ERR_clear_error(); ERR_clear_error();
@ -564,7 +567,7 @@ bad:
if(!req_exts) if(!req_exts)
{ {
req_exts = CONF_get_string(req_conf, SECTION, REQ_EXTENSIONS); req_exts = NCONF_get_string(req_conf, SECTION, REQ_EXTENSIONS);
if (!req_exts) if (!req_exts)
ERR_clear_error(); ERR_clear_error();
} }
@ -572,8 +575,8 @@ bad:
/* Check syntax of file */ /* Check syntax of file */
X509V3_CTX ctx; X509V3_CTX ctx;
X509V3_set_ctx_test(&ctx); X509V3_set_ctx_test(&ctx);
X509V3_set_conf_lhash(&ctx, req_conf); X509V3_set_nconf(&ctx, req_conf);
if(!X509V3_EXT_add_conf(req_conf, &ctx, req_exts, NULL)) { if(!X509V3_EXT_add_nconf(req_conf, &ctx, req_exts, NULL)) {
BIO_printf(bio_err, BIO_printf(bio_err,
"Error Loading request extension section %s\n", "Error Loading request extension section %s\n",
req_exts); req_exts);
@ -600,7 +603,7 @@ bad:
} }
if (EVP_PKEY_type(pkey->type) == EVP_PKEY_DSA) if (EVP_PKEY_type(pkey->type) == EVP_PKEY_DSA)
{ {
char *randfile = CONF_get_string(req_conf,SECTION,"RANDFILE"); char *randfile = NCONF_get_string(req_conf,SECTION,"RANDFILE");
if (randfile == NULL) if (randfile == NULL)
ERR_clear_error(); ERR_clear_error();
app_RAND_load_file(randfile, bio_err, 0); app_RAND_load_file(randfile, bio_err, 0);
@ -609,7 +612,7 @@ bad:
if (newreq && (pkey == NULL)) if (newreq && (pkey == NULL))
{ {
char *randfile = CONF_get_string(req_conf,SECTION,"RANDFILE"); char *randfile = NCONF_get_string(req_conf,SECTION,"RANDFILE");
if (randfile == NULL) if (randfile == NULL)
ERR_clear_error(); ERR_clear_error();
app_RAND_load_file(randfile, bio_err, 0); app_RAND_load_file(randfile, bio_err, 0);
@ -618,8 +621,7 @@ bad:
if (newkey <= 0) if (newkey <= 0)
{ {
newkey=(int)CONF_get_number(req_conf,SECTION,BITS); if (!NCONF_get_number(req_conf,SECTION,BITS, &newkey))
if (newkey <= 0)
newkey=DEFAULT_KEY_LENGTH; newkey=DEFAULT_KEY_LENGTH;
} }
@ -659,7 +661,7 @@ bad:
if (keyout == NULL) if (keyout == NULL)
{ {
keyout=CONF_get_string(req_conf,SECTION,KEYFILE); keyout=NCONF_get_string(req_conf,SECTION,KEYFILE);
if (keyout == NULL) if (keyout == NULL)
ERR_clear_error(); ERR_clear_error();
} }
@ -685,11 +687,11 @@ bad:
} }
} }
p=CONF_get_string(req_conf,SECTION,"encrypt_rsa_key"); p=NCONF_get_string(req_conf,SECTION,"encrypt_rsa_key");
if (p == NULL) if (p == NULL)
{ {
ERR_clear_error(); ERR_clear_error();
p=CONF_get_string(req_conf,SECTION,"encrypt_key"); p=NCONF_get_string(req_conf,SECTION,"encrypt_key");
if (p == NULL) if (p == NULL)
ERR_clear_error(); ERR_clear_error();
} }
@ -806,10 +808,10 @@ loop:
/* Set up V3 context struct */ /* Set up V3 context struct */
X509V3_set_ctx(&ext_ctx, x509ss, x509ss, NULL, NULL, 0); X509V3_set_ctx(&ext_ctx, x509ss, x509ss, NULL, NULL, 0);
X509V3_set_conf_lhash(&ext_ctx, req_conf); X509V3_set_nconf(&ext_ctx, req_conf);
/* Add extensions */ /* Add extensions */
if(extensions && !X509V3_EXT_add_conf(req_conf, if(extensions && !X509V3_EXT_add_nconf(req_conf,
&ext_ctx, extensions, x509ss)) &ext_ctx, extensions, x509ss))
{ {
BIO_printf(bio_err, BIO_printf(bio_err,
@ -828,10 +830,10 @@ loop:
/* Set up V3 context struct */ /* Set up V3 context struct */
X509V3_set_ctx(&ext_ctx, NULL, NULL, req, NULL, 0); X509V3_set_ctx(&ext_ctx, NULL, NULL, req, NULL, 0);
X509V3_set_conf_lhash(&ext_ctx, req_conf); X509V3_set_nconf(&ext_ctx, req_conf);
/* Add extensions */ /* Add extensions */
if(req_exts && !X509V3_EXT_REQ_add_conf(req_conf, if(req_exts && !X509V3_EXT_REQ_add_nconf(req_conf,
&ext_ctx, req_exts, req)) &ext_ctx, req_exts, req))
{ {
BIO_printf(bio_err, BIO_printf(bio_err,
@ -1009,7 +1011,7 @@ end:
{ {
ERR_print_errors(bio_err); ERR_print_errors(bio_err);
} }
if ((req_conf != NULL) && (req_conf != config)) CONF_free(req_conf); if ((req_conf != NULL) && (req_conf != config)) NCONF_free(req_conf);
BIO_free(in); BIO_free(in);
BIO_free_all(out); BIO_free_all(out);
EVP_PKEY_free(pkey); EVP_PKEY_free(pkey);
@ -1033,26 +1035,26 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs)
STACK_OF(CONF_VALUE) *dn_sk, *attr_sk = NULL; STACK_OF(CONF_VALUE) *dn_sk, *attr_sk = NULL;
char *tmp, *dn_sect,*attr_sect; char *tmp, *dn_sect,*attr_sect;
tmp=CONF_get_string(req_conf,SECTION,PROMPT); tmp=NCONF_get_string(req_conf,SECTION,PROMPT);
if (tmp == NULL) if (tmp == NULL)
ERR_clear_error(); ERR_clear_error();
if((tmp != NULL) && !strcmp(tmp, "no")) no_prompt = 1; if((tmp != NULL) && !strcmp(tmp, "no")) no_prompt = 1;
dn_sect=CONF_get_string(req_conf,SECTION,DISTINGUISHED_NAME); dn_sect=NCONF_get_string(req_conf,SECTION,DISTINGUISHED_NAME);
if (dn_sect == NULL) if (dn_sect == NULL)
{ {
BIO_printf(bio_err,"unable to find '%s' in config\n", BIO_printf(bio_err,"unable to find '%s' in config\n",
DISTINGUISHED_NAME); DISTINGUISHED_NAME);
goto err; goto err;
} }
dn_sk=CONF_get_section(req_conf,dn_sect); dn_sk=NCONF_get_section(req_conf,dn_sect);
if (dn_sk == NULL) if (dn_sk == NULL)
{ {
BIO_printf(bio_err,"unable to get '%s' section\n",dn_sect); BIO_printf(bio_err,"unable to get '%s' section\n",dn_sect);
goto err; goto err;
} }
attr_sect=CONF_get_string(req_conf,SECTION,ATTRIBUTES); attr_sect=NCONF_get_string(req_conf,SECTION,ATTRIBUTES);
if (attr_sect == NULL) if (attr_sect == NULL)
{ {
ERR_clear_error(); ERR_clear_error();
@ -1060,7 +1062,7 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs)
} }
else else
{ {
attr_sk=CONF_get_section(req_conf,attr_sect); attr_sk=NCONF_get_section(req_conf,attr_sect);
if (attr_sk == NULL) if (attr_sk == NULL)
{ {
BIO_printf(bio_err,"unable to get '%s' section\n",attr_sect); BIO_printf(bio_err,"unable to get '%s' section\n",attr_sect);
@ -1159,7 +1161,8 @@ static int prompt_info(X509_REQ *req,
int i; int i;
char *p,*q; char *p,*q;
char buf[100]; char buf[100];
int nid,min,max; int nid;
long n_min,n_max;
char *type,*def,*value; char *type,*def,*value;
CONF_VALUE *v; CONF_VALUE *v;
X509_NAME *subj; X509_NAME *subj;
@ -1204,27 +1207,29 @@ start: for (;;)
/* If OBJ not recognised ignore it */ /* If OBJ not recognised ignore it */
if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start; if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start;
sprintf(buf,"%s_default",v->name); sprintf(buf,"%s_default",v->name);
if ((def=CONF_get_string(req_conf,dn_sect,buf)) == NULL) if ((def=NCONF_get_string(req_conf,dn_sect,buf)) == NULL)
{ {
ERR_clear_error(); ERR_clear_error();
def=""; def="";
} }
sprintf(buf,"%s_value",v->name); sprintf(buf,"%s_value",v->name);
if ((value=CONF_get_string(req_conf,dn_sect,buf)) == NULL) if ((value=NCONF_get_string(req_conf,dn_sect,buf)) == NULL)
{ {
ERR_clear_error(); ERR_clear_error();
value=NULL; value=NULL;
} }
sprintf(buf,"%s_min",v->name); sprintf(buf,"%s_min",v->name);
min=(int)CONF_get_number(req_conf,dn_sect,buf); if (!NCONF_get_number(req_conf,dn_sect,buf, &n_min))
n_min = -1;
sprintf(buf,"%s_max",v->name); sprintf(buf,"%s_max",v->name);
max=(int)CONF_get_number(req_conf,dn_sect,buf); if (!NCONF_get_number(req_conf,dn_sect,buf, &n_max))
n_max = -1;
if (!add_DN_object(subj,v->value,def,value,nid, if (!add_DN_object(subj,v->value,def,value,nid,
min,max)) n_min,n_max))
return 0; return 0;
} }
if (X509_NAME_entry_count(subj) == 0) if (X509_NAME_entry_count(subj) == 0)
@ -1255,7 +1260,7 @@ start2: for (;;)
goto start2; goto start2;
sprintf(buf,"%s_default",type); sprintf(buf,"%s_default",type);
if ((def=CONF_get_string(req_conf,attr_sect,buf)) if ((def=NCONF_get_string(req_conf,attr_sect,buf))
== NULL) == NULL)
{ {
ERR_clear_error(); ERR_clear_error();
@ -1264,7 +1269,7 @@ start2: for (;;)
sprintf(buf,"%s_value",type); sprintf(buf,"%s_value",type);
if ((value=CONF_get_string(req_conf,attr_sect,buf)) if ((value=NCONF_get_string(req_conf,attr_sect,buf))
== NULL) == NULL)
{ {
ERR_clear_error(); ERR_clear_error();
@ -1272,13 +1277,15 @@ start2: for (;;)
} }
sprintf(buf,"%s_min",type); sprintf(buf,"%s_min",type);
min=(int)CONF_get_number(req_conf,attr_sect,buf); if (!NCONF_get_number(req_conf,attr_sect,buf, &n_min))
n_min = -1;
sprintf(buf,"%s_max",type); sprintf(buf,"%s_max",type);
max=(int)CONF_get_number(req_conf,attr_sect,buf); if (!NCONF_get_number(req_conf,attr_sect,buf, &n_max))
n_max = -1;
if (!add_attribute_object(req, if (!add_attribute_object(req,
v->value,def,value,nid,min,max)) v->value,def,value,nid,n_min,n_max))
return 0; return 0;
} }
} }
@ -1346,7 +1353,7 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk,
static int add_DN_object(X509_NAME *n, char *text, char *def, char *value, static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
int nid, int min, int max) int nid, int n_min, int n_max)
{ {
int i,ret=0; int i,ret=0;
MS_STATIC char buf[1024]; MS_STATIC char buf[1024];
@ -1393,7 +1400,7 @@ start:
#ifdef CHARSET_EBCDIC #ifdef CHARSET_EBCDIC
ebcdic2ascii(buf, buf, i); ebcdic2ascii(buf, buf, i);
#endif #endif
if(!req_check_len(i, min, max)) goto start; if(!req_check_len(i, n_min, n_max)) goto start;
if (!X509_NAME_add_entry_by_NID(n,nid, MBSTRING_ASC, if (!X509_NAME_add_entry_by_NID(n,nid, MBSTRING_ASC,
(unsigned char *) buf, -1,-1,0)) goto err; (unsigned char *) buf, -1,-1,0)) goto err;
ret=1; ret=1;
@ -1402,8 +1409,8 @@ err:
} }
static int add_attribute_object(X509_REQ *req, char *text, static int add_attribute_object(X509_REQ *req, char *text,
char *def, char *value, int nid, int min, char *def, char *value, int nid, int n_min,
int max) int n_max)
{ {
int i; int i;
static char buf[1024]; static char buf[1024];
@ -1451,7 +1458,7 @@ start:
#ifdef CHARSET_EBCDIC #ifdef CHARSET_EBCDIC
ebcdic2ascii(buf, buf, i); ebcdic2ascii(buf, buf, i);
#endif #endif
if(!req_check_len(i, min, max)) goto start; if(!req_check_len(i, n_min, n_max)) goto start;
if(!X509_REQ_add1_attr_by_NID(req, nid, MBSTRING_ASC, if(!X509_REQ_add1_attr_by_NID(req, nid, MBSTRING_ASC,
(unsigned char *)buf, -1)) { (unsigned char *)buf, -1)) {
@ -1482,16 +1489,16 @@ static void MS_CALLBACK req_cb(int p, int n, void *arg)
} }
#endif #endif
static int req_check_len(int len, int min, int max) static int req_check_len(int len, int n_min, int n_max)
{ {
if (len < min) if ((n_min > 0) && (len < n_min))
{ {
BIO_printf(bio_err,"string is too short, it needs to be at least %d bytes long\n",min); BIO_printf(bio_err,"string is too short, it needs to be at least %d bytes long\n",n_min);
return(0); return(0);
} }
if ((max != 0) && (len > max)) if ((n_max >= 0) && (len > n_max))
{ {
BIO_printf(bio_err,"string is too long, it needs to be less than %d bytes long\n",max); BIO_printf(bio_err,"string is too long, it needs to be less than %d bytes long\n",n_max);
return(0); return(0);
} }
return(1); return(1);

11
apps/spkac.c
View File

@ -90,7 +90,7 @@ int MAIN(int argc, char **argv)
char *passargin = NULL, *passin = NULL; char *passargin = NULL, *passin = NULL;
char *spkac = "SPKAC", *spksect = "default", *spkstr = NULL; char *spkac = "SPKAC", *spksect = "default", *spkstr = NULL;
char *challenge = NULL, *keyfile = NULL; char *challenge = NULL, *keyfile = NULL;
LHASH *conf = NULL; CONF *conf = NULL;
NETSCAPE_SPKI *spki = NULL; NETSCAPE_SPKI *spki = NULL;
EVP_PKEY *pkey = NULL; EVP_PKEY *pkey = NULL;
char *engine=NULL; char *engine=NULL;
@ -228,15 +228,16 @@ bad:
goto end; goto end;
} }
conf = CONF_load_bio(NULL, in, NULL); conf = NCONF_new(NULL);
i = NCONF_load_bio(conf, in, NULL);
if(!conf) { if(!i) {
BIO_printf(bio_err, "Error parsing config file\n"); BIO_printf(bio_err, "Error parsing config file\n");
ERR_print_errors(bio_err); ERR_print_errors(bio_err);
goto end; goto end;
} }
spkstr = CONF_get_string(conf, spksect, spkac); spkstr = NCONF_get_string(conf, spksect, spkac);
if(!spkstr) { if(!spkstr) {
BIO_printf(bio_err, "Can't find SPKAC called \"%s\"\n", spkac); BIO_printf(bio_err, "Can't find SPKAC called \"%s\"\n", spkac);
@ -285,7 +286,7 @@ bad:
ret = 0; ret = 0;
end: end:
CONF_free(conf); NCONF_free(conf);
NETSCAPE_SPKI_free(spki); NETSCAPE_SPKI_free(spki);
BIO_free(in); BIO_free(in);
BIO_free_all(out); BIO_free_all(out);

29
apps/x509.c
View File

@ -139,10 +139,10 @@ NULL
static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx); static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx);
static int sign (X509 *x, EVP_PKEY *pkey,int days,int clrext, const EVP_MD *digest, static int sign (X509 *x, EVP_PKEY *pkey,int days,int clrext, const EVP_MD *digest,
LHASH *conf, char *section); CONF *conf, char *section);
static int x509_certify (X509_STORE *ctx,char *CAfile,const EVP_MD *digest, static int x509_certify (X509_STORE *ctx,char *CAfile,const EVP_MD *digest,
X509 *x,X509 *xca,EVP_PKEY *pkey,char *serial, X509 *x,X509 *xca,EVP_PKEY *pkey,char *serial,
int create,int days, int clrext, LHASH *conf, char *section, int create,int days, int clrext, CONF *conf, char *section,
ASN1_INTEGER *sno); ASN1_INTEGER *sno);
static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt); static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt);
static int reqfile=0; static int reqfile=0;
@ -179,7 +179,7 @@ int MAIN(int argc, char **argv)
int fingerprint=0; int fingerprint=0;
char buf[256]; char buf[256];
const EVP_MD *md_alg,*digest=EVP_md5(); const EVP_MD *md_alg,*digest=EVP_md5();
LHASH *extconf = NULL; CONF *extconf = NULL;
char *extsect = NULL, *extfile = NULL, *passin = NULL, *passargin = NULL; char *extsect = NULL, *extfile = NULL, *passin = NULL, *passargin = NULL;
int need_rand = 0; int need_rand = 0;
int checkend=0,checkoffset=0; int checkend=0,checkoffset=0;
@ -479,7 +479,8 @@ bad:
{ {
long errorline; long errorline;
X509V3_CTX ctx2; X509V3_CTX ctx2;
if (!(extconf=CONF_load(NULL,extfile,&errorline))) extconf = NCONF_new(NULL);
if (!NCONF_load(extconf, extfile,&errorline))
{ {
if (errorline <= 0) if (errorline <= 0)
BIO_printf(bio_err, BIO_printf(bio_err,
@ -493,7 +494,7 @@ bad:
} }
if (!extsect) if (!extsect)
{ {
extsect = CONF_get_string(extconf, "default", "extensions"); extsect = NCONF_get_string(extconf, "default", "extensions");
if (!extsect) if (!extsect)
{ {
ERR_clear_error(); ERR_clear_error();
@ -501,8 +502,8 @@ bad:
} }
} }
X509V3_set_ctx_test(&ctx2); X509V3_set_ctx_test(&ctx2);
X509V3_set_conf_lhash(&ctx2, extconf); X509V3_set_nconf(&ctx2, extconf);
if (!X509V3_EXT_add_conf(extconf, &ctx2, extsect, NULL)) if (!X509V3_EXT_add_nconf(extconf, &ctx2, extsect, NULL))
{ {
BIO_printf(bio_err, BIO_printf(bio_err,
"Error Loading extension section %s\n", "Error Loading extension section %s\n",
@ -995,7 +996,7 @@ end:
if (need_rand) if (need_rand)
app_RAND_write_file(NULL, bio_err); app_RAND_write_file(NULL, bio_err);
OBJ_cleanup(); OBJ_cleanup();
CONF_free(extconf); NCONF_free(extconf);
BIO_free_all(out); BIO_free_all(out);
BIO_free_all(STDout); BIO_free_all(STDout);
X509_STORE_free(ctx); X509_STORE_free(ctx);
@ -1116,7 +1117,7 @@ static ASN1_INTEGER *load_serial(char *CAfile, char *serialfile, int create)
static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest, static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create, X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,
int days, int clrext, LHASH *conf, char *section, ASN1_INTEGER *sno) int days, int clrext, CONF *conf, char *section, ASN1_INTEGER *sno)
{ {
int ret=0; int ret=0;
ASN1_INTEGER *bs=NULL; ASN1_INTEGER *bs=NULL;
@ -1166,8 +1167,8 @@ static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
X509V3_CTX ctx2; X509V3_CTX ctx2;
X509_set_version(x,2); /* version 3 certificate */ X509_set_version(x,2); /* version 3 certificate */
X509V3_set_ctx(&ctx2, xca, x, NULL, NULL, 0); X509V3_set_ctx(&ctx2, xca, x, NULL, NULL, 0);
X509V3_set_conf_lhash(&ctx2, conf); X509V3_set_nconf(&ctx2, conf);
if (!X509V3_EXT_add_conf(conf, &ctx2, section, x)) goto end; if (!X509V3_EXT_add_nconf(conf, &ctx2, section, x)) goto end;
} }
if (!X509_sign(x,pkey,digest)) goto end; if (!X509_sign(x,pkey,digest)) goto end;
@ -1213,7 +1214,7 @@ static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx)
/* self sign */ /* self sign */
static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, const EVP_MD *digest, static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, const EVP_MD *digest,
LHASH *conf, char *section) CONF *conf, char *section)
{ {
EVP_PKEY *pktmp; EVP_PKEY *pktmp;
@ -1243,8 +1244,8 @@ static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, const EVP_MD *dig
X509V3_CTX ctx; X509V3_CTX ctx;
X509_set_version(x,2); /* version 3 certificate */ X509_set_version(x,2); /* version 3 certificate */
X509V3_set_ctx(&ctx, x, x, NULL, NULL, 0); X509V3_set_ctx(&ctx, x, x, NULL, NULL, 0);
X509V3_set_conf_lhash(&ctx, conf); X509V3_set_nconf(&ctx, conf);
if (!X509V3_EXT_add_conf(conf, &ctx, section, x)) goto err; if (!X509V3_EXT_add_nconf(conf, &ctx, section, x)) goto err;
} }
if (!X509_sign(x,pkey,digest)) goto err; if (!X509_sign(x,pkey,digest)) goto err;
return 1; return 1;

3
crypto/conf/conf.h
View File

@ -98,6 +98,7 @@ struct conf_method_st
}; };
int CONF_set_default_method(CONF_METHOD *meth); int CONF_set_default_method(CONF_METHOD *meth);
void CONF_set_nconf(CONF *conf,LHASH *hash);
LHASH *CONF_load(LHASH *conf,const char *file,long *eline); LHASH *CONF_load(LHASH *conf,const char *file,long *eline);
#ifndef OPENSSL_NO_FP_API #ifndef OPENSSL_NO_FP_API
LHASH *CONF_load_fp(LHASH *conf, FILE *fp,long *eline); LHASH *CONF_load_fp(LHASH *conf, FILE *fp,long *eline);
@ -145,7 +146,7 @@ int NCONF_dump_bio(CONF *conf, BIO *out);
and should therefore be avoided */ and should therefore be avoided */
long NCONF_get_number(CONF *conf,char *group,char *name); long NCONF_get_number(CONF *conf,char *group,char *name);
#else #else
#define NCONF_get_number(c,g,n,r) NCONF_get_number_e(c,g,n,r); #define NCONF_get_number(c,g,n,r) NCONF_get_number_e(c,g,n,r)
#endif #endif

53
crypto/conf/conf_lib.c
View File

@ -67,6 +67,17 @@ const char *CONF_version="CONF" OPENSSL_VERSION_PTEXT;
static CONF_METHOD *default_CONF_method=NULL; static CONF_METHOD *default_CONF_method=NULL;
/* Init a 'CONF' structure from an old LHASH */
void CONF_set_nconf(CONF *conf, LHASH *hash)
{
if (default_CONF_method == NULL)
default_CONF_method = NCONF_default();
default_CONF_method->init(conf);
conf->data = hash;
}
/* The following section contains the "CONF classic" functions, /* The following section contains the "CONF classic" functions,
rewritten in terms of the new CONF interface. */ rewritten in terms of the new CONF interface. */
@ -118,11 +129,8 @@ LHASH *CONF_load_bio(LHASH *conf, BIO *bp,long *eline)
CONF ctmp; CONF ctmp;
int ret; int ret;
if (default_CONF_method == NULL) CONF_set_nconf(&ctmp, conf);
default_CONF_method = NCONF_default();
default_CONF_method->init(&ctmp);
ctmp.data = conf;
ret = NCONF_load_bio(&ctmp, bp, eline); ret = NCONF_load_bio(&ctmp, bp, eline);
if (ret) if (ret)
return ctmp.data; return ctmp.data;
@ -138,12 +146,7 @@ STACK_OF(CONF_VALUE) *CONF_get_section(LHASH *conf,char *section)
else else
{ {
CONF ctmp; CONF ctmp;
CONF_set_nconf(&ctmp, conf);
if (default_CONF_method == NULL)
default_CONF_method = NCONF_default();
default_CONF_method->init(&ctmp);
ctmp.data = conf;
return NCONF_get_section(&ctmp, section); return NCONF_get_section(&ctmp, section);
} }
} }
@ -157,12 +160,7 @@ char *CONF_get_string(LHASH *conf,char *group,char *name)
else else
{ {
CONF ctmp; CONF ctmp;
CONF_set_nconf(&ctmp, conf);
if (default_CONF_method == NULL)
default_CONF_method = NCONF_default();
default_CONF_method->init(&ctmp);
ctmp.data = conf;
return NCONF_get_string(&ctmp, group, name); return NCONF_get_string(&ctmp, group, name);
} }
} }
@ -179,12 +177,7 @@ long CONF_get_number(LHASH *conf,char *group,char *name)
else else
{ {
CONF ctmp; CONF ctmp;
CONF_set_nconf(&ctmp, conf);
if (default_CONF_method == NULL)
default_CONF_method = NCONF_default();
default_CONF_method->init(&ctmp);
ctmp.data = conf;
status = NCONF_get_number_e(&ctmp, group, name, &result); status = NCONF_get_number_e(&ctmp, group, name, &result);
} }
@ -199,12 +192,7 @@ long CONF_get_number(LHASH *conf,char *group,char *name)
void CONF_free(LHASH *conf) void CONF_free(LHASH *conf)
{ {
CONF ctmp; CONF ctmp;
CONF_set_nconf(&ctmp, conf);
if (default_CONF_method == NULL)
default_CONF_method = NCONF_default();
default_CONF_method->init(&ctmp);
ctmp.data = conf;
NCONF_free_data(&ctmp); NCONF_free_data(&ctmp);
} }
@ -227,12 +215,7 @@ int CONF_dump_fp(LHASH *conf, FILE *out)
int CONF_dump_bio(LHASH *conf, BIO *out) int CONF_dump_bio(LHASH *conf, BIO *out)
{ {
CONF ctmp; CONF ctmp;
CONF_set_nconf(&ctmp, conf);
if (default_CONF_method == NULL)
default_CONF_method = NCONF_default();
default_CONF_method->init(&ctmp);
ctmp.data = conf;
return NCONF_dump_bio(&ctmp, out); return NCONF_dump_bio(&ctmp, out);
} }
@ -362,7 +345,7 @@ int NCONF_get_number_e(CONF *conf,char *group,char *name,long *result)
if (str == NULL) if (str == NULL)
return 0; return 0;
for (;conf->meth->is_number(conf, *str);) for (*result = 0;conf->meth->is_number(conf, *str);)
{ {
*result = (*result)*10 + conf->meth->to_int(conf, *str); *result = (*result)*10 + conf->meth->to_int(conf, *str);
str++; str++;

381
crypto/x509v3/v3_conf.c
View File

@ -68,122 +68,137 @@
static int v3_check_critical(char **value); static int v3_check_critical(char **value);
static int v3_check_generic(char **value); static int v3_check_generic(char **value);
static X509_EXTENSION *do_ext_conf(LHASH *conf, X509V3_CTX *ctx, int ext_nid, int crit, char *value); static X509_EXTENSION *do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid, int crit, char *value);
static X509_EXTENSION *v3_generic_extension(const char *ext, char *value, int crit, int type); static X509_EXTENSION *v3_generic_extension(const char *ext, char *value, int crit, int type);
static char *conf_lhash_get_string(void *db, char *section, char *value); static char *conf_lhash_get_string(void *db, char *section, char *value);
static STACK_OF(CONF_VALUE) *conf_lhash_get_section(void *db, char *section); static STACK_OF(CONF_VALUE) *conf_lhash_get_section(void *db, char *section);
static X509_EXTENSION *do_ext_i2d(X509V3_EXT_METHOD *method, int ext_nid, static X509_EXTENSION *do_ext_i2d(X509V3_EXT_METHOD *method, int ext_nid,
int crit, void *ext_struc); int crit, void *ext_struc);
/* LHASH *conf: Config file */ /* CONF *conf: Config file */
/* char *name: Name */ /* char *name: Name */
/* char *value: Value */ /* char *value: Value */
X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name, X509_EXTENSION *X509V3_EXT_nconf(CONF *conf, X509V3_CTX *ctx, char *name,
char *value) char *value)
{ {
int crit; int crit;
int ext_type; int ext_type;
X509_EXTENSION *ret; X509_EXTENSION *ret;
crit = v3_check_critical(&value); crit = v3_check_critical(&value);
if((ext_type = v3_check_generic(&value))) if ((ext_type = v3_check_generic(&value)))
return v3_generic_extension(name, value, crit, ext_type); return v3_generic_extension(name, value, crit, ext_type);
ret = do_ext_conf(conf, ctx, OBJ_sn2nid(name), crit, value); ret = do_ext_nconf(conf, ctx, OBJ_sn2nid(name), crit, value);
if(!ret) { if (!ret)
{
X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_ERROR_IN_EXTENSION); X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_ERROR_IN_EXTENSION);
ERR_add_error_data(4,"name=", name, ", value=", value); ERR_add_error_data(4,"name=", name, ", value=", value);
} }
return ret; return ret;
} }
/* LHASH *conf: Config file */ /* CONF *conf: Config file */
/* char *value: Value */ /* char *value: Value */
X509_EXTENSION *X509V3_EXT_conf_nid(LHASH *conf, X509V3_CTX *ctx, int ext_nid, X509_EXTENSION *X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid,
char *value) char *value)
{ {
int crit; int crit;
int ext_type; int ext_type;
crit = v3_check_critical(&value); crit = v3_check_critical(&value);
if((ext_type = v3_check_generic(&value))) if ((ext_type = v3_check_generic(&value)))
return v3_generic_extension(OBJ_nid2sn(ext_nid), return v3_generic_extension(OBJ_nid2sn(ext_nid),
value, crit, ext_type); value, crit, ext_type);
return do_ext_conf(conf, ctx, ext_nid, crit, value); return do_ext_nconf(conf, ctx, ext_nid, crit, value);
} }
/* LHASH *conf: Config file */ /* CONF *conf: Config file */
/* char *value: Value */ /* char *value: Value */
static X509_EXTENSION *do_ext_conf(LHASH *conf, X509V3_CTX *ctx, int ext_nid, static X509_EXTENSION *do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid,
int crit, char *value) int crit, char *value)
{ {
X509V3_EXT_METHOD *method; X509V3_EXT_METHOD *method;
X509_EXTENSION *ext; X509_EXTENSION *ext;
STACK_OF(CONF_VALUE) *nval; STACK_OF(CONF_VALUE) *nval;
void *ext_struc; void *ext_struc;
if(ext_nid == NID_undef) { if (ext_nid == NID_undef)
{
X509V3err(X509V3_F_DO_EXT_CONF,X509V3_R_UNKNOWN_EXTENSION_NAME); X509V3err(X509V3_F_DO_EXT_CONF,X509V3_R_UNKNOWN_EXTENSION_NAME);
return NULL; return NULL;
} }
if(!(method = X509V3_EXT_get_nid(ext_nid))) { if (!(method = X509V3_EXT_get_nid(ext_nid)))
{
X509V3err(X509V3_F_DO_EXT_CONF,X509V3_R_UNKNOWN_EXTENSION); X509V3err(X509V3_F_DO_EXT_CONF,X509V3_R_UNKNOWN_EXTENSION);
return NULL; return NULL;
} }
/* Now get internal extension representation based on type */ /* Now get internal extension representation based on type */
if(method->v2i) { if (method->v2i)
if(*value == '@') nval = CONF_get_section(conf, value + 1); {
if(*value == '@') nval = NCONF_get_section(conf, value + 1);
else nval = X509V3_parse_list(value); else nval = X509V3_parse_list(value);
if(!nval) { if(!nval)
{
X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_INVALID_EXTENSION_STRING); X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_INVALID_EXTENSION_STRING);
ERR_add_error_data(4, "name=", OBJ_nid2sn(ext_nid), ",section=", value); ERR_add_error_data(4, "name=", OBJ_nid2sn(ext_nid), ",section=", value);
return NULL; return NULL;
} }
ext_struc = method->v2i(method, ctx, nval); ext_struc = method->v2i(method, ctx, nval);
if(*value != '@') sk_CONF_VALUE_pop_free(nval, if(*value != '@') sk_CONF_VALUE_pop_free(nval,
X509V3_conf_free); X509V3_conf_free);
if(!ext_struc) return NULL; if(!ext_struc) return NULL;
} else if(method->s2i) { }
else if(method->s2i)
{
if(!(ext_struc = method->s2i(method, ctx, value))) return NULL; if(!(ext_struc = method->s2i(method, ctx, value))) return NULL;
} else if(method->r2i) { }
if(!ctx->db) { else if(method->r2i)
{
if(!ctx->db)
{
X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_NO_CONFIG_DATABASE); X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_NO_CONFIG_DATABASE);
return NULL; return NULL;
} }
if(!(ext_struc = method->r2i(method, ctx, value))) return NULL; if(!(ext_struc = method->r2i(method, ctx, value))) return NULL;
} else { }
else
{
X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED); X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED);
ERR_add_error_data(2, "name=", OBJ_nid2sn(ext_nid)); ERR_add_error_data(2, "name=", OBJ_nid2sn(ext_nid));
return NULL; return NULL;
} }
ext = do_ext_i2d(method, ext_nid, crit, ext_struc); ext = do_ext_i2d(method, ext_nid, crit, ext_struc);
if(method->it) ASN1_item_free(ext_struc, ASN1_ITEM_ptr(method->it)); if(method->it) ASN1_item_free(ext_struc, ASN1_ITEM_ptr(method->it));
else method->ext_free(ext_struc); else method->ext_free(ext_struc);
return ext; return ext;
} }
static X509_EXTENSION *do_ext_i2d(X509V3_EXT_METHOD *method, int ext_nid, static X509_EXTENSION *do_ext_i2d(X509V3_EXT_METHOD *method, int ext_nid,
int crit, void *ext_struc) int crit, void *ext_struc)
{ {
unsigned char *ext_der; unsigned char *ext_der;
int ext_len; int ext_len;
ASN1_OCTET_STRING *ext_oct; ASN1_OCTET_STRING *ext_oct;
X509_EXTENSION *ext; X509_EXTENSION *ext;
/* Convert internal representation to DER */ /* Convert internal representation to DER */
if(method->it) { if (method->it)
{
ext_der = NULL; ext_der = NULL;
ext_len = ASN1_item_i2d(ext_struc, &ext_der, ASN1_ITEM_ptr(method->it)); ext_len = ASN1_item_i2d(ext_struc, &ext_der, ASN1_ITEM_ptr(method->it));
if(ext_len < 0) goto merr; if (ext_len < 0) goto merr;
} else { }
else
{
unsigned char *p; unsigned char *p;
ext_len = method->i2d(ext_struc, NULL); ext_len = method->i2d(ext_struc, NULL);
if(!(ext_der = OPENSSL_malloc(ext_len))) goto merr; if(!(ext_der = OPENSSL_malloc(ext_len))) goto merr;
p = ext_der; p = ext_der;
method->i2d(ext_struc, &p); method->i2d(ext_struc, &p);
} }
if(!(ext_oct = M_ASN1_OCTET_STRING_new())) goto merr; if (!(ext_oct = M_ASN1_OCTET_STRING_new())) goto merr;
ext_oct->data = ext_der; ext_oct->data = ext_der;
ext_oct->length = ext_len; ext_oct->length = ext_len;
ext = X509_EXTENSION_create_by_NID(NULL, ext_nid, crit, ext_oct); ext = X509_EXTENSION_create_by_NID(NULL, ext_nid, crit, ext_oct);
if(!ext) goto merr; if (!ext) goto merr;
M_ASN1_OCTET_STRING_free(ext_oct); M_ASN1_OCTET_STRING_free(ext_oct);
return ext; return ext;
@ -192,14 +207,14 @@ static X509_EXTENSION *do_ext_i2d(X509V3_EXT_METHOD *method, int ext_nid,
X509V3err(X509V3_F_DO_EXT_I2D,ERR_R_MALLOC_FAILURE); X509V3err(X509V3_F_DO_EXT_I2D,ERR_R_MALLOC_FAILURE);
return NULL; return NULL;
} }
/* Given an internal structure, nid and critical flag create an extension */ /* Given an internal structure, nid and critical flag create an extension */
X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc) X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc)
{ {
X509V3_EXT_METHOD *method; X509V3_EXT_METHOD *method;
if(!(method = X509V3_EXT_get_nid(ext_nid))) { if (!(method = X509V3_EXT_get_nid(ext_nid))) {
X509V3err(X509V3_F_X509V3_EXT_I2D,X509V3_R_UNKNOWN_EXTENSION); X509V3err(X509V3_F_X509V3_EXT_I2D,X509V3_R_UNKNOWN_EXTENSION);
return NULL; return NULL;
} }
@ -210,7 +225,7 @@ X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc)
static int v3_check_critical(char **value) static int v3_check_critical(char **value)
{ {
char *p = *value; char *p = *value;
if((strlen(p) < 9) || strncmp(p, "critical,", 9)) return 0; if ((strlen(p) < 9) || strncmp(p, "critical,", 9)) return 0;
p+=9; p+=9;
while(isspace((unsigned char)*p)) p++; while(isspace((unsigned char)*p)) p++;
*value = p; *value = p;
@ -221,9 +236,9 @@ static int v3_check_critical(char **value)
static int v3_check_generic(char **value) static int v3_check_generic(char **value)
{ {
char *p = *value; char *p = *value;
if((strlen(p) < 4) || strncmp(p, "DER:,", 4)) return 0; if ((strlen(p) < 4) || strncmp(p, "DER:,", 4)) return 0;
p+=4; p+=4;
while(isspace((unsigned char)*p)) p++; while (isspace((unsigned char)*p)) p++;
*value = p; *value = p;
return 1; return 1;
} }
@ -231,148 +246,202 @@ static int v3_check_generic(char **value)
/* Create a generic extension: for now just handle DER type */ /* Create a generic extension: for now just handle DER type */
static X509_EXTENSION *v3_generic_extension(const char *ext, char *value, static X509_EXTENSION *v3_generic_extension(const char *ext, char *value,
int crit, int type) int crit, int type)
{ {
unsigned char *ext_der=NULL; unsigned char *ext_der=NULL;
long ext_len; long ext_len;
ASN1_OBJECT *obj=NULL; ASN1_OBJECT *obj=NULL;
ASN1_OCTET_STRING *oct=NULL; ASN1_OCTET_STRING *oct=NULL;
X509_EXTENSION *extension=NULL; X509_EXTENSION *extension=NULL;
if(!(obj = OBJ_txt2obj(ext, 0))) { if (!(obj = OBJ_txt2obj(ext, 0)))
X509V3err(X509V3_F_V3_GENERIC_EXTENSION,X509V3_R_EXTENSION_NAME_ERROR); {
ERR_add_error_data(2, "name=", ext); X509V3err(X509V3_F_V3_GENERIC_EXTENSION,X509V3_R_EXTENSION_NAME_ERROR);
goto err; ERR_add_error_data(2, "name=", ext);
} goto err;
}
if(!(ext_der = string_to_hex(value, &ext_len))) { if (!(ext_der = string_to_hex(value, &ext_len)))
X509V3err(X509V3_F_V3_GENERIC_EXTENSION,X509V3_R_EXTENSION_VALUE_ERROR); {
ERR_add_error_data(2, "value=", value); X509V3err(X509V3_F_V3_GENERIC_EXTENSION,X509V3_R_EXTENSION_VALUE_ERROR);
goto err; ERR_add_error_data(2, "value=", value);
} goto err;
}
if(!(oct = M_ASN1_OCTET_STRING_new())) { if (!(oct = M_ASN1_OCTET_STRING_new()))
X509V3err(X509V3_F_V3_GENERIC_EXTENSION,ERR_R_MALLOC_FAILURE); {
goto err; X509V3err(X509V3_F_V3_GENERIC_EXTENSION,ERR_R_MALLOC_FAILURE);
} goto err;
}
oct->data = ext_der; oct->data = ext_der;
oct->length = ext_len; oct->length = ext_len;
ext_der = NULL; ext_der = NULL;
extension = X509_EXTENSION_create_by_OBJ(NULL, obj, crit, oct); extension = X509_EXTENSION_create_by_OBJ(NULL, obj, crit, oct);
err: err:
ASN1_OBJECT_free(obj); ASN1_OBJECT_free(obj);
M_ASN1_OCTET_STRING_free(oct); M_ASN1_OCTET_STRING_free(oct);
if(ext_der) OPENSSL_free(ext_der); if(ext_der) OPENSSL_free(ext_der);
return extension; return extension;
}
}
/* This is the main function: add a bunch of extensions based on a config file /* This is the main function: add a bunch of extensions based on a config file
* section * section to an extension STACK.
*/ */
int X509V3_EXT_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section,
X509 *cert) int X509V3_EXT_add_nconf_sk(CONF *conf, X509V3_CTX *ctx, char *section,
{ STACK_OF(X509_EXTENSION) **sk)
{
X509_EXTENSION *ext; X509_EXTENSION *ext;
STACK_OF(CONF_VALUE) *nval; STACK_OF(CONF_VALUE) *nval;
CONF_VALUE *val; CONF_VALUE *val;
int i; int i;
if(!(nval = CONF_get_section(conf, section))) return 0; if (!(nval = NCONF_get_section(conf, section))) return 0;
for(i = 0; i < sk_CONF_VALUE_num(nval); i++) { for (i = 0; i < sk_CONF_VALUE_num(nval); i++)
{
val = sk_CONF_VALUE_value(nval, i); val = sk_CONF_VALUE_value(nval, i);
if(!(ext = X509V3_EXT_conf(conf, ctx, val->name, val->value))) if (!(ext = X509V3_EXT_nconf(conf, ctx, val->name, val->value)))
return 0; return 0;
if(cert) X509_add_ext(cert, ext, -1); if (sk) X509v3_add_ext(sk, ext, -1);
X509_EXTENSION_free(ext); X509_EXTENSION_free(ext);
} }
return 1; return 1;
} }
/* Convenience functions to add extensions to a certificate, CRL and request */
int X509V3_EXT_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section,
X509 *cert)
{
STACK_OF(X509_EXTENSION) **sk = NULL;
if (cert)
sk = &cert->cert_info->extensions;
return X509V3_EXT_add_nconf_sk(conf, ctx, section, sk);
}
/* Same as above but for a CRL */ /* Same as above but for a CRL */
int X509V3_EXT_CRL_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, int X509V3_EXT_CRL_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section,
X509_CRL *crl) X509_CRL *crl)
{ {
X509_EXTENSION *ext; STACK_OF(X509_EXTENSION) **sk = NULL;
STACK_OF(CONF_VALUE) *nval; if (crl)
CONF_VALUE *val; sk = &crl->crl->extensions;
int i; return X509V3_EXT_add_nconf_sk(conf, ctx, section, sk);
if(!(nval = CONF_get_section(conf, section))) return 0;
for(i = 0; i < sk_CONF_VALUE_num(nval); i++) {
val = sk_CONF_VALUE_value(nval, i);
if(!(ext = X509V3_EXT_conf(conf, ctx, val->name, val->value)))
return 0;
if(crl) X509_CRL_add_ext(crl, ext, -1);
X509_EXTENSION_free(ext);
} }
return 1;
}
/* Add extensions to certificate request */ /* Add extensions to certificate request */
int X509V3_EXT_REQ_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, int X509V3_EXT_REQ_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section,
X509_REQ *req) X509_REQ *req)
{ {
X509_EXTENSION *ext; STACK_OF(X509_EXTENSION) *extlist = NULL, **sk = NULL;
STACK_OF(X509_EXTENSION) *extlist = NULL;
STACK_OF(CONF_VALUE) *nval;
CONF_VALUE *val;
int i; int i;
if(!(nval = CONF_get_section(conf, section))) return 0; if (req)
for(i = 0; i < sk_CONF_VALUE_num(nval); i++) { sk = &extlist;
val = sk_CONF_VALUE_value(nval, i); i = X509V3_EXT_add_nconf_sk(conf, ctx, section, sk);
if(!(ext = X509V3_EXT_conf(conf, ctx, val->name, val->value))) if (!i || !sk)
return 0; return i;
if(!extlist) extlist = sk_X509_EXTENSION_new_null(); i = X509_REQ_add_extensions(req, extlist);
sk_X509_EXTENSION_push(extlist, ext);
}
if(req) i = X509_REQ_add_extensions(req, extlist);
else i = 1;
sk_X509_EXTENSION_pop_free(extlist, X509_EXTENSION_free); sk_X509_EXTENSION_pop_free(extlist, X509_EXTENSION_free);
return i; return i;
} }
/* Config database functions */ /* Config database functions */
char * X509V3_get_string(X509V3_CTX *ctx, char *name, char *section) char * X509V3_get_string(X509V3_CTX *ctx, char *name, char *section)
{ {
if(ctx->db_meth->get_string) if (ctx->db_meth->get_string)
return ctx->db_meth->get_string(ctx->db, name, section); return ctx->db_meth->get_string(ctx->db, name, section);
return NULL; return NULL;
} }
STACK_OF(CONF_VALUE) * X509V3_get_section(X509V3_CTX *ctx, char *section) STACK_OF(CONF_VALUE) * X509V3_get_section(X509V3_CTX *ctx, char *section)
{ {
if(ctx->db_meth->get_section) if (ctx->db_meth->get_section)
return ctx->db_meth->get_section(ctx->db, section); return ctx->db_meth->get_section(ctx->db, section);
return NULL; return NULL;
} }
void X509V3_string_free(X509V3_CTX *ctx, char *str) void X509V3_string_free(X509V3_CTX *ctx, char *str)
{ {
if(!str) return; if (!str) return;
if(ctx->db_meth->free_string) if (ctx->db_meth->free_string)
ctx->db_meth->free_string(ctx->db, str); ctx->db_meth->free_string(ctx->db, str);
} }
void X509V3_section_free(X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *section) void X509V3_section_free(X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *section)
{ {
if(!section) return; if (!section) return;
if(ctx->db_meth->free_section) if (ctx->db_meth->free_section)
ctx->db_meth->free_section(ctx->db, section); ctx->db_meth->free_section(ctx->db, section);
} }
static char *nconf_get_string(void *db, char *section, char *value)
{
return NCONF_get_string(db, section, value);
}
static STACK_OF(CONF_VALUE) *nconf_get_section(void *db, char *section)
{
return NCONF_get_section(db, section);
}
static X509V3_CONF_METHOD nconf_method = {
nconf_get_string,
nconf_get_section,
NULL,
NULL
};
void X509V3_set_nconf(X509V3_CTX *ctx, CONF *conf)
{
ctx->db_meth = &nconf_method;
ctx->db = conf;
}
void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subj, X509_REQ *req,
X509_CRL *crl, int flags)
{
ctx->issuer_cert = issuer;
ctx->subject_cert = subj;
ctx->crl = crl;
ctx->subject_req = req;
ctx->flags = flags;
}
/* Old conf compatibility functions */
X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name,
char *value)
{
CONF ctmp;
CONF_set_nconf(&ctmp, conf);
return X509V3_EXT_nconf(&ctmp, ctx, name, value);
}
/* LHASH *conf: Config file */
/* char *value: Value */
X509_EXTENSION *X509V3_EXT_conf_nid(LHASH *conf, X509V3_CTX *ctx, int ext_nid,
char *value)
{
CONF ctmp;
CONF_set_nconf(&ctmp, conf);
return X509V3_EXT_nconf_nid(&ctmp, ctx, ext_nid, value);
}
static char *conf_lhash_get_string(void *db, char *section, char *value) static char *conf_lhash_get_string(void *db, char *section, char *value)
{ {
return CONF_get_string(db, section, value); return CONF_get_string(db, section, value);
} }
static STACK_OF(CONF_VALUE) *conf_lhash_get_section(void *db, char *section) static STACK_OF(CONF_VALUE) *conf_lhash_get_section(void *db, char *section)
{ {
return CONF_get_section(db, section); return CONF_get_section(db, section);
} }
static X509V3_CONF_METHOD conf_lhash_method = { static X509V3_CONF_METHOD conf_lhash_method = {
conf_lhash_get_string, conf_lhash_get_string,
@ -382,17 +451,35 @@ NULL
}; };
void X509V3_set_conf_lhash(X509V3_CTX *ctx, LHASH *lhash) void X509V3_set_conf_lhash(X509V3_CTX *ctx, LHASH *lhash)
{ {
ctx->db_meth = &conf_lhash_method; ctx->db_meth = &conf_lhash_method;
ctx->db = lhash; ctx->db = lhash;
} }
void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subj, X509_REQ *req, int X509V3_EXT_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section,
X509_CRL *crl, int flags) X509 *cert)
{ {
ctx->issuer_cert = issuer; CONF ctmp;
ctx->subject_cert = subj; CONF_set_nconf(&ctmp, conf);
ctx->crl = crl; return X509V3_EXT_add_nconf(&ctmp, ctx, section, cert);
ctx->subject_req = req; }
ctx->flags = flags;
} /* Same as above but for a CRL */
int X509V3_EXT_CRL_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section,
X509_CRL *crl)
{
CONF ctmp;
CONF_set_nconf(&ctmp, conf);
return X509V3_EXT_CRL_add_nconf(&ctmp, ctx, section, crl);
}
/* Add extensions to certificate request */
int X509V3_EXT_REQ_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section,
X509_REQ *req)
{
CONF ctmp;
CONF_set_nconf(&ctmp, conf);
return X509V3_EXT_REQ_add_nconf(&ctmp, ctx, section, req);
}

10
crypto/x509v3/x509v3.h
View File

@ -459,15 +459,25 @@ DECLARE_ASN1_FUNCTIONS(AUTHORITY_INFO_ACCESS)
#ifdef HEADER_CONF_H #ifdef HEADER_CONF_H
GENERAL_NAME *v2i_GENERAL_NAME(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, CONF_VALUE *cnf); GENERAL_NAME *v2i_GENERAL_NAME(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, CONF_VALUE *cnf);
void X509V3_conf_free(CONF_VALUE *val); void X509V3_conf_free(CONF_VALUE *val);
X509_EXTENSION *X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid, char *value);
X509_EXTENSION *X509V3_EXT_nconf(CONF *conf, X509V3_CTX *ctx, char *name, char *value);
int X509V3_EXT_add_nconf_sk(CONF *conf, X509V3_CTX *ctx, char *section, STACK_OF(X509_EXTENSION) **sk);
int X509V3_EXT_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section, X509 *cert);
int X509V3_EXT_REQ_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section, X509_REQ *req);
int X509V3_EXT_CRL_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section, X509_CRL *crl);
X509_EXTENSION *X509V3_EXT_conf_nid(LHASH *conf, X509V3_CTX *ctx, int ext_nid, char *value); X509_EXTENSION *X509V3_EXT_conf_nid(LHASH *conf, X509V3_CTX *ctx, int ext_nid, char *value);
X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name, char *value); X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name, char *value);
int X509V3_EXT_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, X509 *cert); int X509V3_EXT_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, X509 *cert);
int X509V3_EXT_REQ_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, X509_REQ *req); int X509V3_EXT_REQ_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, X509_REQ *req);
int X509V3_EXT_CRL_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, X509_CRL *crl); int X509V3_EXT_CRL_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, X509_CRL *crl);
int X509V3_add_value_bool_nf(char *name, int asn1_bool, int X509V3_add_value_bool_nf(char *name, int asn1_bool,
STACK_OF(CONF_VALUE) **extlist); STACK_OF(CONF_VALUE) **extlist);
int X509V3_get_value_bool(CONF_VALUE *value, int *asn1_bool); int X509V3_get_value_bool(CONF_VALUE *value, int *asn1_bool);
int X509V3_get_value_int(CONF_VALUE *value, ASN1_INTEGER **aint); int X509V3_get_value_int(CONF_VALUE *value, ASN1_INTEGER **aint);
void X509V3_set_nconf(X509V3_CTX *ctx, CONF *conf);
void X509V3_set_conf_lhash(X509V3_CTX *ctx, LHASH *lhash); void X509V3_set_conf_lhash(X509V3_CTX *ctx, LHASH *lhash);
#endif #endif