xref: /openbsd-src/usr.bin/openssl/req.c (revision 4e1ee0786f11cc571bd0be17d38e46f635c719fc)
1 /* $OpenBSD: req.c,v 1.21 2021/10/23 11:36:44 tb Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  *
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  *
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  *
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  *
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58 
59 /* Until the key-gen callbacks are modified to use newer prototypes, we allow
60  * deprecated functions for openssl-internal code */
61 #ifdef OPENSSL_NO_DEPRECATED
62 #undef OPENSSL_NO_DEPRECATED
63 #endif
64 
65 #include <ctype.h>
66 #include <limits.h>
67 #include <stdio.h>
68 #include <stdlib.h>
69 #include <string.h>
70 #include <time.h>
71 
72 #include "apps.h"
73 
74 #include <openssl/asn1.h>
75 #include <openssl/bio.h>
76 #include <openssl/bn.h>
77 #include <openssl/conf.h>
78 #include <openssl/err.h>
79 #include <openssl/evp.h>
80 #include <openssl/objects.h>
81 #include <openssl/pem.h>
82 #include <openssl/x509.h>
83 #include <openssl/x509v3.h>
84 
85 #include <openssl/dsa.h>
86 
87 #include <openssl/rsa.h>
88 
89 #define SECTION		"req"
90 
91 #define BITS		"default_bits"
92 #define KEYFILE		"default_keyfile"
93 #define PROMPT		"prompt"
94 #define DISTINGUISHED_NAME	"distinguished_name"
95 #define ATTRIBUTES	"attributes"
96 #define V3_EXTENSIONS	"x509_extensions"
97 #define REQ_EXTENSIONS	"req_extensions"
98 #define STRING_MASK	"string_mask"
99 #define UTF8_IN		"utf8"
100 
101 #define DEFAULT_KEY_LENGTH	2048
102 #define MIN_KEY_LENGTH		384
103 
104 static int make_REQ(X509_REQ * req, EVP_PKEY * pkey, char *dn, int multirdn,
105     int attribs, unsigned long chtype);
106 static int build_subject(X509_REQ * req, char *subj, unsigned long chtype,
107     int multirdn);
108 static int prompt_info(X509_REQ * req,
109     STACK_OF(CONF_VALUE) * dn_sk, char *dn_sect,
110     STACK_OF(CONF_VALUE) * attr_sk, char *attr_sect, int attribs,
111     unsigned long chtype);
112 static int auto_info(X509_REQ * req, STACK_OF(CONF_VALUE) * sk,
113     STACK_OF(CONF_VALUE) * attr, int attribs,
114     unsigned long chtype);
115 static int add_attribute_object(X509_REQ * req, char *text, const char *def,
116     char *value, int nid, int n_min,
117     int n_max, unsigned long chtype);
118 static int add_DN_object(X509_NAME * n, char *text, const char *def, char *value,
119     int nid, int n_min, int n_max, unsigned long chtype, int mval);
120 static int genpkey_cb(EVP_PKEY_CTX * ctx);
121 static int req_check_len(int len, int n_min, int n_max);
122 static int check_end(const char *str, const char *end);
123 static EVP_PKEY_CTX *set_keygen_ctx(BIO * err, const char *gstr, int *pkey_type,
124     long *pkeylen, char **palgnam);
125 static unsigned long ext_name_hash(const OPENSSL_STRING *a);
126 static int ext_name_cmp(const OPENSSL_STRING *a, const OPENSSL_STRING *b);
127 static void exts_cleanup(OPENSSL_STRING *x);
128 static int duplicated(LHASH_OF(OPENSSL_STRING) *addexts, char *kv);
129 static CONF *req_conf = NULL;
130 static CONF *addext_conf = NULL;
131 
132 struct {
133 	LHASH_OF(OPENSSL_STRING) *addexts;
134 	BIO *addext_bio;
135 	int batch;
136 	unsigned long chtype;
137 	int days;
138 	const EVP_MD *digest;
139 	char *extensions;
140 	char *infile;
141 	int informat;
142 	char *keyalg;
143 	char *keyfile;
144 	int keyform;
145 	char *keyout;
146 	int modulus;
147 	int multirdn;
148 	int newhdr;
149 	long newkey;
150 	int newreq;
151 	unsigned long nmflag;
152 	int nodes;
153 	int noout;
154 	char *outfile;
155 	int outformat;
156 	char *passargin;
157 	char *passargout;
158 	STACK_OF(OPENSSL_STRING) *pkeyopts;
159 	int pubkey;
160 	char *req_exts;
161 	unsigned long reqflag;
162 	ASN1_INTEGER *serial;
163 	STACK_OF(OPENSSL_STRING) *sigopts;
164 	char *subj;
165 	int subject;
166 	char *template;
167 	int text;
168 	int verbose;
169 	int verify;
170 	int x509;
171 } req_config;
172 
173 static int
174 req_opt_addext(char *arg)
175 {
176 	int i;
177 
178 	if (req_config.addexts == NULL) {
179 		req_config.addexts = (LHASH_OF(OPENSSL_STRING) *)lh_new(
180 		    (LHASH_HASH_FN_TYPE)ext_name_hash,
181 		    (LHASH_COMP_FN_TYPE)ext_name_cmp);
182 		req_config.addext_bio = BIO_new(BIO_s_mem());
183 		if (req_config.addexts == NULL ||
184 		    req_config.addext_bio == NULL)
185 			return (1);
186 	}
187 	i = duplicated(req_config.addexts, arg);
188 	if (i == 1)
189 		return (1);
190 	if (i < 0 || BIO_printf(req_config.addext_bio, "%s\n", arg) < 0)
191 		return (1);
192 
193 	return (0);
194 }
195 
196 static int
197 req_opt_days(char *arg)
198 {
199 	const char *errstr;
200 
201 	req_config.days = strtonum(arg, 1, INT_MAX, &errstr);
202 	if (errstr != NULL) {
203 		BIO_printf(bio_err, "bad -days %s, using 0: %s\n",
204 		    arg, errstr);
205 		req_config.days = 30;
206 	}
207 	return (0);
208 }
209 
210 static int
211 req_opt_digest(int argc, char **argv, int *argsused)
212 {
213 	char *name = argv[0];
214 
215 	if (*name++ != '-')
216 		return (1);
217 
218 	if ((req_config.digest = EVP_get_digestbyname(name)) == NULL)
219 		return (1);
220 
221 	*argsused = 1;
222 	return (0);
223 }
224 
225 static int
226 req_opt_newkey(char *arg)
227 {
228 	req_config.keyalg = arg;
229 	req_config.newreq = 1;
230 	return (0);
231 }
232 
233 static int
234 req_opt_nameopt(char *arg)
235 {
236 	if (!set_name_ex(&req_config.nmflag, arg))
237 		return (1);
238 	return (0);
239 }
240 
241 static int
242 req_opt_pkeyopt(char *arg)
243 {
244 	if (req_config.pkeyopts == NULL)
245 		req_config.pkeyopts = sk_OPENSSL_STRING_new_null();
246 	if (req_config.pkeyopts == NULL)
247 		return (1);
248 	if (!sk_OPENSSL_STRING_push(req_config.pkeyopts, arg))
249 		return (1);
250 	return (0);
251 }
252 
253 static int
254 req_opt_reqopt(char *arg)
255 {
256 	if (!set_cert_ex(&req_config.reqflag, arg))
257 		return (1);
258 	return (0);
259 }
260 
261 static int
262 req_opt_set_serial(char *arg)
263 {
264 	req_config.serial = s2i_ASN1_INTEGER(NULL, arg);
265 	if (req_config.serial == NULL)
266 		return (1);
267 	return (0);
268 }
269 
270 static int
271 req_opt_sigopt(char *arg)
272 {
273 	if (req_config.sigopts == NULL)
274 		req_config.sigopts = sk_OPENSSL_STRING_new_null();
275 	if (req_config.sigopts == NULL)
276 		return (1);
277 	if (!sk_OPENSSL_STRING_push(req_config.sigopts, arg))
278 		return (1);
279 	return (0);
280 }
281 
282 static int
283 req_opt_utf8(void)
284 {
285 	req_config.chtype = MBSTRING_UTF8;
286 	return (0);
287 }
288 
289 static const struct option req_options[] = {
290 	{
291 		.name = "addext",
292 		.argname = "key=value",
293 		.desc = "Additional certificate extension (may be repeated)",
294 		.type = OPTION_ARG_FUNC,
295 		.opt.argfunc = req_opt_addext,
296 	},
297 	{
298 		.name = "batch",
299 		.desc = "Operate in batch mode",
300 		.type = OPTION_FLAG,
301 		.opt.flag = &req_config.batch,
302 	},
303 	{
304 		.name = "config",
305 		.argname = "file",
306 		.desc = "Configuration file to use as request template",
307 		.type = OPTION_ARG,
308 		.opt.arg = &req_config.template,
309 	},
310 	{
311 		.name = "days",
312 		.argname = "number",
313 		.desc = "Number of days generated certificate is valid for",
314 		.type = OPTION_ARG_FUNC,
315 		.opt.argfunc = req_opt_days,
316 	},
317 	{
318 		.name = "extensions",
319 		.argname = "section",
320 		.desc = "Config section to use for certificate extensions",
321 		.type = OPTION_ARG,
322 		.opt.arg = &req_config.extensions,
323 	},
324 	{
325 		.name = "in",
326 		.argname = "file",
327 		.desc = "Input file (default stdin)",
328 		.type = OPTION_ARG,
329 		.opt.arg = &req_config.infile,
330 	},
331 	{
332 		.name = "inform",
333 		.argname = "format",
334 		.desc = "Input format (DER or PEM (default))",
335 		.type = OPTION_ARG_FORMAT,
336 		.opt.value = &req_config.informat,
337 	},
338 	{
339 		.name = "key",
340 		.argname = "file",
341 		.desc = "Private key file",
342 		.type = OPTION_ARG,
343 		.opt.arg = &req_config.keyfile,
344 	},
345 	{
346 		.name = "keyform",
347 		.argname = "format",
348 		.desc = "Private key format (DER or PEM (default))",
349 		.type = OPTION_ARG_FORMAT,
350 		.opt.value = &req_config.keyform,
351 	},
352 	{
353 		.name = "keyout",
354 		.argname = "file",
355 		.desc = "Private key output file",
356 		.type = OPTION_ARG,
357 		.opt.arg = &req_config.keyout,
358 	},
359 	{
360 		.name = "modulus",
361 		.desc = "Print RSA modulus",
362 		.type = OPTION_FLAG,
363 		.opt.flag = &req_config.modulus,
364 	},
365 	{
366 		.name = "multivalue-rdn",
367 		.desc = "Enable support for multivalued RDNs",
368 		.type = OPTION_FLAG,
369 		.opt.flag = &req_config.multirdn,
370 	},
371 	{
372 		.name = "nameopt",
373 		.argname = "arg",
374 		.desc = "Certificate name options",
375 		.type = OPTION_ARG_FUNC,
376 		.opt.argfunc = req_opt_nameopt,
377 	},
378 	{
379 		.name = "new",
380 		.desc = "New request",
381 		.type = OPTION_FLAG,
382 		.opt.flag = &req_config.newreq,
383 	},
384 	{
385 		.name = "newhdr",
386 		.desc = "Include 'NEW' in header lines",
387 		.type = OPTION_FLAG,
388 		.opt.flag = &req_config.newhdr,
389 	},
390 	{
391 		.name = "newkey",
392 		.argname = "param",
393 		.desc = "Generate a new key using given parameters",
394 		.type = OPTION_ARG_FUNC,
395 		.opt.argfunc = req_opt_newkey,
396 	},
397 	{
398 		.name = "nodes",
399 		.desc = "Do not encrypt output private key",
400 		.type = OPTION_FLAG,
401 		.opt.flag = &req_config.nodes,
402 	},
403 	{
404 		.name = "noout",
405 		.desc = "Do not output request",
406 		.type = OPTION_FLAG,
407 		.opt.flag = &req_config.noout,
408 	},
409 	{
410 		.name = "out",
411 		.argname = "file",
412 		.desc = "Output file (default stdout)",
413 		.type = OPTION_ARG,
414 		.opt.arg = &req_config.outfile,
415 	},
416 	{
417 		.name = "outform",
418 		.argname = "format",
419 		.desc = "Output format (DER or PEM (default))",
420 		.type = OPTION_ARG_FORMAT,
421 		.opt.value = &req_config.outformat,
422 	},
423 	{
424 		.name = "passin",
425 		.argname = "source",
426 		.desc = "Private key input password source",
427 		.type = OPTION_ARG,
428 		.opt.arg = &req_config.passargin,
429 	},
430 	{
431 		.name = "passout",
432 		.argname = "source",
433 		.desc = "Private key output password source",
434 		.type = OPTION_ARG,
435 		.opt.arg = &req_config.passargout,
436 	},
437 	{
438 		.name = "pkeyopt",
439 		.argname = "opt:val",
440 		.desc = "Set the public key algorithm option opt to val",
441 		.type = OPTION_ARG_FUNC,
442 		.opt.argfunc = req_opt_pkeyopt,
443 	},
444 	{
445 		.name = "pubkey",
446 		.desc = "Output the public key",
447 		.type = OPTION_FLAG,
448 		.opt.flag = &req_config.pubkey,
449 	},
450 	{
451 		.name = "reqexts",
452 		.argname = "section",
453 		.desc = "Config section to use for request extensions",
454 		.type = OPTION_ARG,
455 		.opt.arg = &req_config.req_exts,
456 	},
457 	{
458 		.name = "reqopt",
459 		.argname = "option",
460 		.desc = "Request text options",
461 		.type = OPTION_ARG_FUNC,
462 		.opt.argfunc = req_opt_reqopt,
463 	},
464 	{
465 		.name = "set_serial",
466 		.argname = "serial",
467 		.desc = "Serial number to use for generated certificate",
468 		.type = OPTION_ARG_FUNC,
469 		.opt.argfunc = req_opt_set_serial,
470 	},
471 	{
472 		.name = "sigopt",
473 		.argname = "name:val",
474 		.desc = "Signature options",
475 		.type = OPTION_ARG_FUNC,
476 		.opt.argfunc = req_opt_sigopt,
477 	},
478 	{
479 		.name = "subj",
480 		.argname = "name",
481 		.desc = "Set or modify the request subject",
482 		.type = OPTION_ARG,
483 		.opt.arg = &req_config.subj,
484 	},
485 	{
486 		.name = "subject",
487 		.desc = "Output the subject of the request",
488 		.type = OPTION_FLAG,
489 		.opt.flag = &req_config.subject,
490 	},
491 	{
492 		.name = "text",
493 		.desc = "Print request in text form",
494 		.type = OPTION_FLAG,
495 		.opt.flag = &req_config.text,
496 	},
497 	{
498 		.name = "utf8",
499 		.desc = "Input characters are in UTF-8 (default ASCII)",
500 		.type = OPTION_FUNC,
501 		.opt.func = req_opt_utf8,
502 	},
503 	{
504 		.name = "verbose",
505 		.desc = "Verbose",
506 		.type = OPTION_FLAG,
507 		.opt.flag = &req_config.verbose,
508 	},
509 	{
510 		.name = "verify",
511 		.desc = "Verify signature on request",
512 		.type = OPTION_FLAG,
513 		.opt.flag = &req_config.verify,
514 	},
515 	{
516 		.name = "x509",
517 		.desc = "Output an X.509 structure instead of a certificate request",
518 		.type = OPTION_FLAG,
519 		.opt.flag = &req_config.x509,
520 	},
521 	{
522 		.name = NULL,
523 		.desc = "",
524 		.type = OPTION_ARGV_FUNC,
525 		.opt.argvfunc = req_opt_digest,
526 	},
527 	{ NULL },
528 };
529 
530 static void
531 req_usage(void)
532 {
533 	fprintf(stderr,
534 	    "usage: req [-addext ext] [-batch] [-config file]\n"
535 	    "    [-days n] [-extensions section] [-in file]\n"
536 	    "    [-inform der | pem] [-key keyfile] [-keyform der | pem]\n"
537 	    "    [-keyout file] [-md4 | -md5 | -sha1] [-modulus]\n"
538 	    "    [-multivalue-rdn] [-nameopt option] [-new] [-newhdr]\n"
539 	    "    [-newkey arg] [-nodes] [-noout]\n"
540 	    "    [-out file] [-outform der | pem] [-passin arg]\n"
541 	    "    [-passout arg] [-pkeyopt opt:value] [-pubkey]\n"
542 	    "    [-reqexts section] [-reqopt option] [-set_serial n]\n"
543 	    "    [-sigopt nm:v] [-subj arg] [-subject] [-text] [-utf8]\n"
544 	    "    [-verbose] [-verify] [-x509]\n\n");
545 
546 	options_usage(req_options);
547 	fprintf(stderr, "\n");
548 }
549 
550 int
551 req_main(int argc, char **argv)
552 {
553 	int ex = 1;
554 	X509 *x509ss = NULL;
555 	X509_REQ *req = NULL;
556 	EVP_PKEY_CTX *genctx = NULL;
557 	char *keyalgstr = NULL;
558 	const EVP_CIPHER *cipher = NULL;
559 	EVP_PKEY *pkey = NULL;
560 	int i = 0, pkey_type = -1;
561 	BIO *in = NULL, *out = NULL;
562 	char *passin = NULL, *passout = NULL;
563 	const EVP_MD *md_alg = NULL;
564 	char *p;
565 
566 	if (single_execution) {
567 		if (pledge("stdio cpath wpath rpath tty", NULL) == -1) {
568 			perror("pledge");
569 			exit(1);
570 		}
571 	}
572 
573 	memset(&req_config, 0, sizeof(req_config));
574 
575 	req_config.chtype = MBSTRING_ASC;
576 	req_config.days = 30;
577 	req_config.digest = EVP_sha256();
578 	req_config.newkey = -1;
579 	req_config.informat = FORMAT_PEM;
580 	req_config.keyform = FORMAT_PEM;
581 	req_config.outformat = FORMAT_PEM;
582 
583 	if (options_parse(argc, argv, req_options, NULL, NULL) != 0) {
584 		req_usage();
585 		return (1);
586 	}
587 
588 	req_conf = NULL;
589 	cipher = EVP_aes_256_cbc();
590 
591 	if (!app_passwd(bio_err, req_config.passargin, req_config.passargout, &passin, &passout)) {
592 		BIO_printf(bio_err, "Error getting passwords\n");
593 		goto end;
594 	}
595 	if (req_config.template != NULL) {
596 		long errline = -1;
597 
598 		if (req_config.verbose)
599 			BIO_printf(bio_err, "Using configuration from %s\n", req_config.template);
600 		if ((req_conf = NCONF_new(NULL)) == NULL)
601 			goto end;
602 		if(!NCONF_load(req_conf, req_config.template, &errline)) {
603 			BIO_printf(bio_err, "error on line %ld of %s\n", errline, req_config.template);
604 			goto end;
605 		}
606 	} else {
607 		req_conf = config;
608 
609 		if (req_conf == NULL) {
610 			BIO_printf(bio_err, "Unable to load config info from %s\n", default_config_file);
611 			if (req_config.newreq)
612 				goto end;
613 		} else if (req_config.verbose)
614 			BIO_printf(bio_err, "Using configuration from %s\n",
615 			    default_config_file);
616 	}
617 
618 	if (req_config.addext_bio != NULL) {
619 		long errline = -1;
620 		if (req_config.verbose)
621 			BIO_printf(bio_err,
622 			    "Using additional configuration from command line\n");
623 		if ((addext_conf = NCONF_new(NULL)) == NULL)
624 			goto end;
625 		if (!NCONF_load_bio(addext_conf, req_config.addext_bio, &errline)) {
626 			BIO_printf(bio_err,
627 			    "req: Error on line %ld of config input\n",
628 			    errline);
629 			goto end;
630 		}
631 	}
632 
633 	if (req_conf != NULL) {
634 		if (!load_config(bio_err, req_conf))
635 			goto end;
636 		p = NCONF_get_string(req_conf, NULL, "oid_file");
637 		if (p == NULL)
638 			ERR_clear_error();
639 		if (p != NULL) {
640 			BIO *oid_bio;
641 
642 			oid_bio = BIO_new_file(p, "r");
643 			if (oid_bio == NULL) {
644 				/*
645 				BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
646 				ERR_print_errors(bio_err);
647 				*/
648 			} else {
649 				OBJ_create_objects(oid_bio);
650 				BIO_free(oid_bio);
651 			}
652 		}
653 	}
654 	if (!add_oid_section(bio_err, req_conf))
655 		goto end;
656 
657 	if (md_alg == NULL) {
658 		p = NCONF_get_string(req_conf, SECTION, "default_md");
659 		if (p == NULL)
660 			ERR_clear_error();
661 		if (p != NULL) {
662 			if ((md_alg = EVP_get_digestbyname(p)) != NULL)
663 				req_config.digest = md_alg;
664 		}
665 	}
666 	if (!req_config.extensions) {
667 		req_config.extensions = NCONF_get_string(req_conf, SECTION, V3_EXTENSIONS);
668 		if (!req_config.extensions)
669 			ERR_clear_error();
670 	}
671 	if (req_config.extensions) {
672 		/* Check syntax of file */
673 		X509V3_CTX ctx;
674 		X509V3_set_ctx_test(&ctx);
675 		X509V3_set_nconf(&ctx, req_conf);
676 		if (!X509V3_EXT_add_nconf(req_conf, &ctx, req_config.extensions, NULL)) {
677 			BIO_printf(bio_err,
678 			    "Error Loading extension section %s\n", req_config.extensions);
679 			goto end;
680 		}
681 	}
682 	if (addext_conf != NULL) {
683 		/* Check syntax of command line extensions */
684 		X509V3_CTX ctx;
685 		X509V3_set_ctx_test(&ctx);
686 		X509V3_set_nconf(&ctx, addext_conf);
687 		if (!X509V3_EXT_add_nconf(addext_conf, &ctx, "default", NULL)) {
688 			BIO_printf(bio_err,
689 			    "Error Loading command line extensions\n");
690 			goto end;
691 		}
692 	}
693 	if (!passin) {
694 		passin = NCONF_get_string(req_conf, SECTION, "input_password");
695 		if (!passin)
696 			ERR_clear_error();
697 	}
698 	if (!passout) {
699 		passout = NCONF_get_string(req_conf, SECTION, "output_password");
700 		if (!passout)
701 			ERR_clear_error();
702 	}
703 	p = NCONF_get_string(req_conf, SECTION, STRING_MASK);
704 	if (!p)
705 		ERR_clear_error();
706 
707 	if (p && !ASN1_STRING_set_default_mask_asc(p)) {
708 		BIO_printf(bio_err, "Invalid global string mask setting %s\n", p);
709 		goto end;
710 	}
711 	if (req_config.chtype != MBSTRING_UTF8) {
712 		p = NCONF_get_string(req_conf, SECTION, UTF8_IN);
713 		if (!p)
714 			ERR_clear_error();
715 		else if (!strcmp(p, "yes"))
716 			req_config.chtype = MBSTRING_UTF8;
717 	}
718 	if (!req_config.req_exts) {
719 		req_config.req_exts = NCONF_get_string(req_conf, SECTION, REQ_EXTENSIONS);
720 		if (!req_config.req_exts)
721 			ERR_clear_error();
722 	}
723 	if (req_config.req_exts) {
724 		/* Check syntax of file */
725 		X509V3_CTX ctx;
726 		X509V3_set_ctx_test(&ctx);
727 		X509V3_set_nconf(&ctx, req_conf);
728 		if (!X509V3_EXT_add_nconf(req_conf, &ctx, req_config.req_exts, NULL)) {
729 			BIO_printf(bio_err,
730 			    "Error Loading request extension section %s\n",
731 			    req_config.req_exts);
732 			goto end;
733 		}
734 	}
735 	in = BIO_new(BIO_s_file());
736 	out = BIO_new(BIO_s_file());
737 	if ((in == NULL) || (out == NULL))
738 		goto end;
739 
740 	if (req_config.keyfile != NULL) {
741 		pkey = load_key(bio_err, req_config.keyfile, req_config.keyform, 0, passin,
742 		    "Private Key");
743 		if (!pkey) {
744 			/*
745 			 * load_key() has already printed an appropriate
746 			 * message
747 			 */
748 			goto end;
749 		}
750 	}
751 	if (req_config.newreq && (pkey == NULL)) {
752 		if (!NCONF_get_number(req_conf, SECTION, BITS, &req_config.newkey)) {
753 			req_config.newkey = DEFAULT_KEY_LENGTH;
754 		}
755 		if (req_config.keyalg) {
756 			genctx = set_keygen_ctx(bio_err, req_config.keyalg, &pkey_type, &req_config.newkey,
757 			    &keyalgstr);
758 			if (!genctx)
759 				goto end;
760 		}
761 		if (req_config.newkey < MIN_KEY_LENGTH && (pkey_type == EVP_PKEY_RSA || pkey_type == EVP_PKEY_DSA)) {
762 			BIO_printf(bio_err, "private key length is too short,\n");
763 			BIO_printf(bio_err, "it needs to be at least %d bits, not %ld\n", MIN_KEY_LENGTH, req_config.newkey);
764 			goto end;
765 		}
766 		if (!genctx) {
767 			genctx = set_keygen_ctx(bio_err, NULL, &pkey_type, &req_config.newkey,
768 			    &keyalgstr);
769 			if (!genctx)
770 				goto end;
771 		}
772 		if (req_config.pkeyopts) {
773 			char *genopt;
774 			for (i = 0; i < sk_OPENSSL_STRING_num(req_config.pkeyopts); i++) {
775 				genopt = sk_OPENSSL_STRING_value(req_config.pkeyopts, i);
776 				if (pkey_ctrl_string(genctx, genopt) <= 0) {
777 					BIO_printf(bio_err,
778 					    "parameter error \"%s\"\n",
779 					    genopt);
780 					ERR_print_errors(bio_err);
781 					goto end;
782 				}
783 			}
784 		}
785 		BIO_printf(bio_err, "Generating a %ld bit %s private key\n",
786 		    req_config.newkey, keyalgstr);
787 
788 		EVP_PKEY_CTX_set_cb(genctx, genpkey_cb);
789 		EVP_PKEY_CTX_set_app_data(genctx, bio_err);
790 
791 		if (EVP_PKEY_keygen(genctx, &pkey) <= 0) {
792 			BIO_puts(bio_err, "Error Generating Key\n");
793 			goto end;
794 		}
795 		EVP_PKEY_CTX_free(genctx);
796 		genctx = NULL;
797 
798 		if (req_config.keyout == NULL) {
799 			req_config.keyout = NCONF_get_string(req_conf, SECTION, KEYFILE);
800 			if (req_config.keyout == NULL)
801 				ERR_clear_error();
802 		}
803 		if (req_config.keyout == NULL) {
804 			BIO_printf(bio_err, "writing new private key to stdout\n");
805 			BIO_set_fp(out, stdout, BIO_NOCLOSE);
806 		} else {
807 			BIO_printf(bio_err, "writing new private key to '%s'\n", req_config.keyout);
808 			if (BIO_write_filename(out, req_config.keyout) <= 0) {
809 				perror(req_config.keyout);
810 				goto end;
811 			}
812 		}
813 
814 		p = NCONF_get_string(req_conf, SECTION, "encrypt_rsa_key");
815 		if (p == NULL) {
816 			ERR_clear_error();
817 			p = NCONF_get_string(req_conf, SECTION, "encrypt_key");
818 			if (p == NULL)
819 				ERR_clear_error();
820 		}
821 		if ((p != NULL) && (strcmp(p, "no") == 0))
822 			cipher = NULL;
823 		if (req_config.nodes)
824 			cipher = NULL;
825 
826 		i = 0;
827  loop:
828 		if (!PEM_write_bio_PrivateKey(out, pkey, cipher,
829 			NULL, 0, NULL, passout)) {
830 			if ((ERR_GET_REASON(ERR_peek_error()) ==
831 				PEM_R_PROBLEMS_GETTING_PASSWORD) && (i < 3)) {
832 				ERR_clear_error();
833 				i++;
834 				goto loop;
835 			}
836 			goto end;
837 		}
838 		BIO_printf(bio_err, "-----\n");
839 	}
840 	if (!req_config.newreq) {
841 		if (req_config.infile == NULL)
842 			BIO_set_fp(in, stdin, BIO_NOCLOSE);
843 		else {
844 			if (BIO_read_filename(in, req_config.infile) <= 0) {
845 				perror(req_config.infile);
846 				goto end;
847 			}
848 		}
849 
850 		if (req_config.informat == FORMAT_ASN1)
851 			req = d2i_X509_REQ_bio(in, NULL);
852 		else if (req_config.informat == FORMAT_PEM)
853 			req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL);
854 		else {
855 			BIO_printf(bio_err, "bad input format specified for X509 request\n");
856 			goto end;
857 		}
858 		if (req == NULL) {
859 			BIO_printf(bio_err, "unable to load X509 request\n");
860 			goto end;
861 		}
862 	}
863 	if (req_config.newreq || req_config.x509) {
864 		if (pkey == NULL) {
865 			BIO_printf(bio_err, "you need to specify a private key\n");
866 			goto end;
867 		}
868 		if (req == NULL) {
869 			req = X509_REQ_new();
870 			if (req == NULL) {
871 				goto end;
872 			}
873 			i = make_REQ(req, pkey, req_config.subj, req_config.multirdn, !req_config.x509, req_config.chtype);
874 			req_config.subj = NULL;	/* done processing '-subj' option */
875 			if (!i) {
876 				BIO_printf(bio_err, "problems making Certificate Request\n");
877 				goto end;
878 			}
879 		}
880 		if (req_config.x509) {
881 			EVP_PKEY *tmppkey;
882 			X509V3_CTX ext_ctx;
883 			if ((x509ss = X509_new()) == NULL)
884 				goto end;
885 
886 			/* Set version to V3 */
887 			if ((req_config.extensions != NULL || addext_conf != NULL) &&
888 			    !X509_set_version(x509ss, 2))
889 				goto end;
890 			if (req_config.serial) {
891 				if (!X509_set_serialNumber(x509ss, req_config.serial))
892 					goto end;
893 			} else {
894 				if (!rand_serial(NULL,
895 					X509_get_serialNumber(x509ss)))
896 					goto end;
897 			}
898 
899 			if (!X509_set_issuer_name(x509ss, X509_REQ_get_subject_name(req)))
900 				goto end;
901 			if (!X509_gmtime_adj(X509_get_notBefore(x509ss), 0))
902 				goto end;
903 			if (!X509_time_adj_ex(X509_get_notAfter(x509ss), req_config.days, 0, NULL))
904 				goto end;
905 			if (!X509_set_subject_name(x509ss, X509_REQ_get_subject_name(req)))
906 				goto end;
907 			tmppkey = X509_REQ_get_pubkey(req);
908 			if (!tmppkey || !X509_set_pubkey(x509ss, tmppkey))
909 				goto end;
910 			EVP_PKEY_free(tmppkey);
911 
912 			/* Set up V3 context struct */
913 
914 			X509V3_set_ctx(&ext_ctx, x509ss, x509ss, NULL, NULL, 0);
915 			X509V3_set_nconf(&ext_ctx, req_conf);
916 
917 			/* Add extensions */
918 			if (req_config.extensions && !X509V3_EXT_add_nconf(req_conf,
919 				&ext_ctx, req_config.extensions, x509ss)) {
920 				BIO_printf(bio_err,
921 				    "Error Loading extension section %s\n",
922 				    req_config.extensions);
923 				goto end;
924 			}
925 			if (addext_conf != NULL &&
926 			    !X509V3_EXT_add_nconf(addext_conf, &ext_ctx,
927 				    "default", x509ss)) {
928 				BIO_printf(bio_err,
929 				    "Error Loading command line extensions\n");
930 				goto end;
931 			}
932 			i = do_X509_sign(bio_err, x509ss, pkey, req_config.digest, req_config.sigopts);
933 			if (!i) {
934 				ERR_print_errors(bio_err);
935 				goto end;
936 			}
937 		} else {
938 			X509V3_CTX ext_ctx;
939 
940 			/* Set up V3 context struct */
941 
942 			X509V3_set_ctx(&ext_ctx, NULL, NULL, req, NULL, 0);
943 			X509V3_set_nconf(&ext_ctx, req_conf);
944 
945 			/* Add extensions */
946 			if (req_config.req_exts && !X509V3_EXT_REQ_add_nconf(req_conf,
947 				&ext_ctx, req_config.req_exts, req)) {
948 				BIO_printf(bio_err,
949 				    "Error Loading extension section %s\n",
950 				    req_config.req_exts);
951 				goto end;
952 			}
953 			if (addext_conf != NULL &&
954 			    !X509V3_EXT_REQ_add_nconf(addext_conf, &ext_ctx,
955 				    "default", req)) {
956 				BIO_printf(bio_err,
957 				    "Error Loading command line extensions\n");
958 				goto end;
959 			}
960 			i = do_X509_REQ_sign(bio_err, req, pkey, req_config.digest, req_config.sigopts);
961 			if (!i) {
962 				ERR_print_errors(bio_err);
963 				goto end;
964 			}
965 		}
966 	}
967 	if (req_config.subj && req_config.x509) {
968 		BIO_printf(bio_err, "Cannot modify certificate subject\n");
969 		goto end;
970 	}
971 	if (req_config.subj && !req_config.x509) {
972 		if (req_config.verbose) {
973 			BIO_printf(bio_err, "Modifying Request's Subject\n");
974 			print_name(bio_err, "old subject=", X509_REQ_get_subject_name(req), req_config.nmflag);
975 		}
976 		if (build_subject(req, req_config.subj, req_config.chtype, req_config.multirdn) == 0) {
977 			BIO_printf(bio_err, "ERROR: cannot modify subject\n");
978 			ex = 1;
979 			goto end;
980 		}
981 
982 		if (req_config.verbose) {
983 			print_name(bio_err, "new subject=", X509_REQ_get_subject_name(req), req_config.nmflag);
984 		}
985 	}
986 	if (req_config.verify && !req_config.x509) {
987 		int tmp = 0;
988 
989 		if (pkey == NULL) {
990 			pkey = X509_REQ_get_pubkey(req);
991 			tmp = 1;
992 			if (pkey == NULL)
993 				goto end;
994 		}
995 		i = X509_REQ_verify(req, pkey);
996 		if (tmp) {
997 			EVP_PKEY_free(pkey);
998 			pkey = NULL;
999 		}
1000 		if (i < 0) {
1001 			goto end;
1002 		} else if (i == 0) {
1003 			BIO_printf(bio_err, "verify failure\n");
1004 			ERR_print_errors(bio_err);
1005 		} else		/* if (i > 0) */
1006 			BIO_printf(bio_err, "verify OK\n");
1007 	}
1008 	if (req_config.noout && !req_config.text && !req_config.modulus && !req_config.subject && !req_config.pubkey) {
1009 		ex = 0;
1010 		goto end;
1011 	}
1012 	if (req_config.outfile == NULL) {
1013 		BIO_set_fp(out, stdout, BIO_NOCLOSE);
1014 	} else {
1015 		if ((req_config.keyout != NULL) && (strcmp(req_config.outfile, req_config.keyout) == 0))
1016 			i = (int) BIO_append_filename(out, req_config.outfile);
1017 		else
1018 			i = (int) BIO_write_filename(out, req_config.outfile);
1019 		if (!i) {
1020 			perror(req_config.outfile);
1021 			goto end;
1022 		}
1023 	}
1024 
1025 	if (req_config.pubkey) {
1026 		EVP_PKEY *tpubkey;
1027 		tpubkey = X509_REQ_get_pubkey(req);
1028 		if (tpubkey == NULL) {
1029 			BIO_printf(bio_err, "Error getting public key\n");
1030 			ERR_print_errors(bio_err);
1031 			goto end;
1032 		}
1033 		PEM_write_bio_PUBKEY(out, tpubkey);
1034 		EVP_PKEY_free(tpubkey);
1035 	}
1036 	if (req_config.text) {
1037 		if (req_config.x509)
1038 			X509_print_ex(out, x509ss, req_config.nmflag, req_config.reqflag);
1039 		else
1040 			X509_REQ_print_ex(out, req, req_config.nmflag, req_config.reqflag);
1041 	}
1042 	if (req_config.subject) {
1043 		if (req_config.x509)
1044 			print_name(out, "subject=", X509_get_subject_name(x509ss), req_config.nmflag);
1045 		else
1046 			print_name(out, "subject=", X509_REQ_get_subject_name(req), req_config.nmflag);
1047 	}
1048 	if (req_config.modulus) {
1049 		EVP_PKEY *tpubkey;
1050 
1051 		if (req_config.x509)
1052 			tpubkey = X509_get_pubkey(x509ss);
1053 		else
1054 			tpubkey = X509_REQ_get_pubkey(req);
1055 		if (tpubkey == NULL) {
1056 			fprintf(stdout, "Modulus=unavailable\n");
1057 			goto end;
1058 		}
1059 		fprintf(stdout, "Modulus=");
1060 		if (EVP_PKEY_base_id(tpubkey) == EVP_PKEY_RSA)
1061 			BN_print(out, tpubkey->pkey.rsa->n);
1062 		else
1063 			fprintf(stdout, "Wrong Algorithm type");
1064 		EVP_PKEY_free(tpubkey);
1065 		fprintf(stdout, "\n");
1066 	}
1067 	if (!req_config.noout && !req_config.x509) {
1068 		if (req_config.outformat == FORMAT_ASN1)
1069 			i = i2d_X509_REQ_bio(out, req);
1070 		else if (req_config.outformat == FORMAT_PEM) {
1071 			if (req_config.newhdr)
1072 				i = PEM_write_bio_X509_REQ_NEW(out, req);
1073 			else
1074 				i = PEM_write_bio_X509_REQ(out, req);
1075 		} else {
1076 			BIO_printf(bio_err, "bad output format specified for outfile\n");
1077 			goto end;
1078 		}
1079 		if (!i) {
1080 			BIO_printf(bio_err, "unable to write X509 request\n");
1081 			goto end;
1082 		}
1083 	}
1084 	if (!req_config.noout && req_config.x509 && (x509ss != NULL)) {
1085 		if (req_config.outformat == FORMAT_ASN1)
1086 			i = i2d_X509_bio(out, x509ss);
1087 		else if (req_config.outformat == FORMAT_PEM)
1088 			i = PEM_write_bio_X509(out, x509ss);
1089 		else {
1090 			BIO_printf(bio_err, "bad output format specified for outfile\n");
1091 			goto end;
1092 		}
1093 		if (!i) {
1094 			BIO_printf(bio_err, "unable to write X509 certificate\n");
1095 			goto end;
1096 		}
1097 	}
1098 	ex = 0;
1099  end:
1100 	if (ex) {
1101 		ERR_print_errors(bio_err);
1102 	}
1103 	if ((req_conf != NULL) && (req_conf != config))
1104 		NCONF_free(req_conf);
1105 	NCONF_free(addext_conf);
1106 	BIO_free(req_config.addext_bio);
1107 	BIO_free(in);
1108 	BIO_free_all(out);
1109 	EVP_PKEY_free(pkey);
1110 	if (genctx)
1111 		EVP_PKEY_CTX_free(genctx);
1112 	if (req_config.pkeyopts)
1113 		sk_OPENSSL_STRING_free(req_config.pkeyopts);
1114 	if (req_config.sigopts)
1115 		sk_OPENSSL_STRING_free(req_config.sigopts);
1116 	lh_OPENSSL_STRING_doall(req_config.addexts, (LHASH_DOALL_FN_TYPE)exts_cleanup);
1117 	lh_OPENSSL_STRING_free(req_config.addexts);
1118 	free(keyalgstr);
1119 	X509_REQ_free(req);
1120 	X509_free(x509ss);
1121 	ASN1_INTEGER_free(req_config.serial);
1122 	if (req_config.passargin && passin)
1123 		free(passin);
1124 	if (req_config.passargout && passout)
1125 		free(passout);
1126 	OBJ_cleanup();
1127 
1128 	return (ex);
1129 }
1130 
1131 static int
1132 make_REQ(X509_REQ * req, EVP_PKEY * pkey, char *subj, int multirdn,
1133     int attribs, unsigned long chtype)
1134 {
1135 	int ret = 0, i;
1136 	char no_prompt = 0;
1137 	STACK_OF(CONF_VALUE) * dn_sk, *attr_sk = NULL;
1138 	char *tmp, *dn_sect, *attr_sect;
1139 
1140 	tmp = NCONF_get_string(req_conf, SECTION, PROMPT);
1141 	if (tmp == NULL)
1142 		ERR_clear_error();
1143 	if ((tmp != NULL) && !strcmp(tmp, "no"))
1144 		no_prompt = 1;
1145 
1146 	dn_sect = NCONF_get_string(req_conf, SECTION, DISTINGUISHED_NAME);
1147 	if (dn_sect == NULL) {
1148 		BIO_printf(bio_err, "unable to find '%s' in config\n",
1149 		    DISTINGUISHED_NAME);
1150 		goto err;
1151 	}
1152 	dn_sk = NCONF_get_section(req_conf, dn_sect);
1153 	if (dn_sk == NULL) {
1154 		BIO_printf(bio_err, "unable to get '%s' section\n", dn_sect);
1155 		goto err;
1156 	}
1157 	attr_sect = NCONF_get_string(req_conf, SECTION, ATTRIBUTES);
1158 	if (attr_sect == NULL) {
1159 		ERR_clear_error();
1160 		attr_sk = NULL;
1161 	} else {
1162 		attr_sk = NCONF_get_section(req_conf, attr_sect);
1163 		if (attr_sk == NULL) {
1164 			BIO_printf(bio_err, "unable to get '%s' section\n", attr_sect);
1165 			goto err;
1166 		}
1167 	}
1168 
1169 	/* setup version number */
1170 	if (!X509_REQ_set_version(req, 0L))
1171 		goto err;	/* version 1 */
1172 
1173 	if (no_prompt)
1174 		i = auto_info(req, dn_sk, attr_sk, attribs, chtype);
1175 	else {
1176 		if (subj)
1177 			i = build_subject(req, subj, chtype, multirdn);
1178 		else
1179 			i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs, chtype);
1180 	}
1181 	if (!i)
1182 		goto err;
1183 
1184 	if (!X509_REQ_set_pubkey(req, pkey))
1185 		goto err;
1186 
1187 	ret = 1;
1188  err:
1189 	return (ret);
1190 }
1191 
1192 /*
1193  * subject is expected to be in the format /type0=value0/type1=value1/type2=...
1194  * where characters may be escaped by \
1195  */
1196 static int
1197 build_subject(X509_REQ * req, char *subject, unsigned long chtype, int multirdn)
1198 {
1199 	X509_NAME *n;
1200 
1201 	if (!(n = parse_name(subject, chtype, multirdn)))
1202 		return 0;
1203 
1204 	if (!X509_REQ_set_subject_name(req, n)) {
1205 		X509_NAME_free(n);
1206 		return 0;
1207 	}
1208 	X509_NAME_free(n);
1209 	return 1;
1210 }
1211 
1212 
1213 static int
1214 prompt_info(X509_REQ * req,
1215     STACK_OF(CONF_VALUE) * dn_sk, char *dn_sect,
1216     STACK_OF(CONF_VALUE) * attr_sk, char *attr_sect, int attribs,
1217     unsigned long chtype)
1218 {
1219 	int i;
1220 	char *p, *q;
1221 	char buf[100];
1222 	int nid, mval;
1223 	long n_min, n_max;
1224 	char *type, *value;
1225 	const char *def;
1226 	CONF_VALUE *v;
1227 	X509_NAME *subj;
1228 	subj = X509_REQ_get_subject_name(req);
1229 
1230 	if (!req_config.batch) {
1231 		BIO_printf(bio_err, "You are about to be asked to enter information that will be incorporated\n");
1232 		BIO_printf(bio_err, "into your certificate request.\n");
1233 		BIO_printf(bio_err, "What you are about to enter is what is called a Distinguished Name or a DN.\n");
1234 		BIO_printf(bio_err, "There are quite a few fields but you can leave some blank\n");
1235 		BIO_printf(bio_err, "For some fields there will be a default value,\n");
1236 		BIO_printf(bio_err, "If you enter '.', the field will be left blank.\n");
1237 		BIO_printf(bio_err, "-----\n");
1238 	}
1239 	if (sk_CONF_VALUE_num(dn_sk)) {
1240 		i = -1;
1241  start:		for (;;) {
1242 			int ret;
1243 			i++;
1244 			if (sk_CONF_VALUE_num(dn_sk) <= i)
1245 				break;
1246 
1247 			v = sk_CONF_VALUE_value(dn_sk, i);
1248 			p = q = NULL;
1249 			type = v->name;
1250 			if (!check_end(type, "_min") || !check_end(type, "_max") ||
1251 			    !check_end(type, "_default") ||
1252 			    !check_end(type, "_value"))
1253 				continue;
1254 			/*
1255 			 * Skip past any leading X. X: X, etc to allow for
1256 			 * multiple instances
1257 			 */
1258 			for (p = v->name; *p; p++)
1259 				if ((*p == ':') || (*p == ',') ||
1260 				    (*p == '.')) {
1261 					p++;
1262 					if (*p)
1263 						type = p;
1264 					break;
1265 				}
1266 			if (*type == '+') {
1267 				mval = -1;
1268 				type++;
1269 			} else
1270 				mval = 0;
1271 			/* If OBJ not recognised ignore it */
1272 			if ((nid = OBJ_txt2nid(type)) == NID_undef)
1273 				goto start;
1274 			ret = snprintf(buf, sizeof buf, "%s_default", v->name);
1275 			if (ret < 0 || ret >= sizeof(buf)) {
1276 				BIO_printf(bio_err, "Name '%s' too long for default\n",
1277 				    v->name);
1278 				return 0;
1279 			}
1280 			if ((def = NCONF_get_string(req_conf, dn_sect, buf)) == NULL) {
1281 				ERR_clear_error();
1282 				def = "";
1283 			}
1284 			ret = snprintf(buf, sizeof buf, "%s_value", v->name);
1285 			if (ret < 0 || ret >= sizeof(buf)) {
1286 				BIO_printf(bio_err, "Name '%s' too long for value\n",
1287 				    v->name);
1288 				return 0;
1289 			}
1290 			if ((value = NCONF_get_string(req_conf, dn_sect, buf)) == NULL) {
1291 				ERR_clear_error();
1292 				value = NULL;
1293 			}
1294 			ret = snprintf(buf, sizeof buf, "%s_min", v->name);
1295 			if (ret < 0 || ret >= sizeof(buf)) {
1296 				BIO_printf(bio_err, "Name '%s' too long for min\n",
1297 				    v->name);
1298 				return 0;
1299 			}
1300 			if (!NCONF_get_number(req_conf, dn_sect, buf, &n_min)) {
1301 				ERR_clear_error();
1302 				n_min = -1;
1303 			}
1304 			ret = snprintf(buf, sizeof buf, "%s_max", v->name);
1305 			if (ret < 0 || ret >= sizeof(buf)) {
1306 				BIO_printf(bio_err, "Name '%s' too long for max\n",
1307 				    v->name);
1308 				return 0;
1309 			}
1310 			if (!NCONF_get_number(req_conf, dn_sect, buf, &n_max)) {
1311 				ERR_clear_error();
1312 				n_max = -1;
1313 			}
1314 			if (!add_DN_object(subj, v->value, def, value, nid,
1315 				n_min, n_max, chtype, mval))
1316 				return 0;
1317 		}
1318 		if (X509_NAME_entry_count(subj) == 0) {
1319 			BIO_printf(bio_err, "error, no objects specified in config file\n");
1320 			return 0;
1321 		}
1322 		if (attribs) {
1323 			if ((attr_sk != NULL) && (sk_CONF_VALUE_num(attr_sk) > 0) &&
1324 			    (!req_config.batch)) {
1325 				BIO_printf(bio_err,
1326 				    "\nPlease enter the following 'extra' attributes\n");
1327 				BIO_printf(bio_err,
1328 				    "to be sent with your certificate request\n");
1329 			}
1330 			i = -1;
1331 start2:			for (;;) {
1332 				int ret;
1333 				i++;
1334 				if ((attr_sk == NULL) ||
1335 				    (sk_CONF_VALUE_num(attr_sk) <= i))
1336 					break;
1337 
1338 				v = sk_CONF_VALUE_value(attr_sk, i);
1339 				type = v->name;
1340 				if ((nid = OBJ_txt2nid(type)) == NID_undef)
1341 					goto start2;
1342 				ret = snprintf(buf, sizeof buf, "%s_default", type);
1343 				if (ret < 0 || ret >= sizeof(buf)) {
1344 					BIO_printf(bio_err, "Name '%s' too long for default\n",
1345 					    v->name);
1346 					return 0;
1347 				}
1348 				if ((def = NCONF_get_string(req_conf, attr_sect, buf))
1349 				    == NULL) {
1350 					ERR_clear_error();
1351 					def = "";
1352 				}
1353 				ret = snprintf(buf, sizeof buf, "%s_value", type);
1354 				if (ret < 0 || ret >= sizeof(buf)) {
1355 					BIO_printf(bio_err, "Name '%s' too long for value\n",
1356 					    v->name);
1357 					return 0;
1358 				}
1359 				if ((value = NCONF_get_string(req_conf, attr_sect, buf))
1360 				    == NULL) {
1361 					ERR_clear_error();
1362 					value = NULL;
1363 				}
1364 				ret = snprintf(buf, sizeof buf, "%s_min", type);
1365 				if (ret < 0 || ret >= sizeof(buf)) {
1366 					BIO_printf(bio_err, "Name '%s' too long for min\n",
1367 					    v->name);
1368 					return 0;
1369 				}
1370 				if (!NCONF_get_number(req_conf, attr_sect, buf, &n_min)) {
1371 					ERR_clear_error();
1372 					n_min = -1;
1373 				}
1374 				ret = snprintf(buf, sizeof buf, "%s_max", type);
1375 				if (ret < 0 || ret >= sizeof(buf)) {
1376 					BIO_printf(bio_err, "Name '%s' too long for max\n",
1377 					    v->name);
1378 					return 0;
1379 				}
1380 				if (!NCONF_get_number(req_conf, attr_sect, buf, &n_max)) {
1381 					ERR_clear_error();
1382 					n_max = -1;
1383 				}
1384 				if (!add_attribute_object(req,
1385 					v->value, def, value, nid, n_min, n_max, chtype))
1386 					return 0;
1387 			}
1388 		}
1389 	} else {
1390 		BIO_printf(bio_err, "No template, please set one up.\n");
1391 		return 0;
1392 	}
1393 
1394 	return 1;
1395 
1396 }
1397 
1398 static int
1399 auto_info(X509_REQ * req, STACK_OF(CONF_VALUE) * dn_sk,
1400     STACK_OF(CONF_VALUE) * attr_sk, int attribs, unsigned long chtype)
1401 {
1402 	int i;
1403 	char *p, *q;
1404 	char *type;
1405 	CONF_VALUE *v;
1406 	X509_NAME *subj;
1407 
1408 	subj = X509_REQ_get_subject_name(req);
1409 
1410 	for (i = 0; i < sk_CONF_VALUE_num(dn_sk); i++) {
1411 		int mval;
1412 		v = sk_CONF_VALUE_value(dn_sk, i);
1413 		p = q = NULL;
1414 		type = v->name;
1415 		/*
1416 		 * Skip past any leading X. X: X, etc to allow for multiple
1417 		 * instances
1418 		 */
1419 		for (p = v->name; *p; p++)
1420 			if ((*p == ':') || (*p == ',') || (*p == '.')) {
1421 				p++;
1422 				if (*p)
1423 					type = p;
1424 				break;
1425 			}
1426 		if (*p == '+') {
1427 			p++;
1428 			mval = -1;
1429 		} else
1430 			mval = 0;
1431 		if (!X509_NAME_add_entry_by_txt(subj, type, chtype,
1432 			(unsigned char *) v->value, -1, -1, mval))
1433 			return 0;
1434 
1435 	}
1436 
1437 	if (!X509_NAME_entry_count(subj)) {
1438 		BIO_printf(bio_err, "error, no objects specified in config file\n");
1439 		return 0;
1440 	}
1441 	if (attribs) {
1442 		for (i = 0; i < sk_CONF_VALUE_num(attr_sk); i++) {
1443 			v = sk_CONF_VALUE_value(attr_sk, i);
1444 			if (!X509_REQ_add1_attr_by_txt(req, v->name, chtype,
1445 				(unsigned char *) v->value, -1))
1446 				return 0;
1447 		}
1448 	}
1449 	return 1;
1450 }
1451 
1452 
1453 static int
1454 add_DN_object(X509_NAME * n, char *text, const char *def, char *value,
1455     int nid, int n_min, int n_max, unsigned long chtype, int mval)
1456 {
1457 	int i, ret = 0;
1458 	char buf[1024];
1459  start:
1460 	if (!req_config.batch)
1461 		BIO_printf(bio_err, "%s [%s]:", text, def);
1462 	(void) BIO_flush(bio_err);
1463 	if (value != NULL) {
1464 		strlcpy(buf, value, sizeof buf);
1465 		strlcat(buf, "\n", sizeof buf);
1466 		BIO_printf(bio_err, "%s\n", value);
1467 	} else {
1468 		buf[0] = '\0';
1469 		if (!req_config.batch) {
1470 			if (!fgets(buf, sizeof buf, stdin))
1471 				return 0;
1472 		} else {
1473 			buf[0] = '\n';
1474 			buf[1] = '\0';
1475 		}
1476 	}
1477 
1478 	if (buf[0] == '\0')
1479 		return (0);
1480 	else if (buf[0] == '\n') {
1481 		if ((def == NULL) || (def[0] == '\0'))
1482 			return (1);
1483 		strlcpy(buf, def, sizeof buf);
1484 		strlcat(buf, "\n", sizeof buf);
1485 	} else if ((buf[0] == '.') && (buf[1] == '\n'))
1486 		return (1);
1487 
1488 	i = strlen(buf);
1489 	if (buf[i - 1] != '\n') {
1490 		BIO_printf(bio_err, "weird input :-(\n");
1491 		return (0);
1492 	}
1493 	buf[--i] = '\0';
1494 	if (!req_check_len(i, n_min, n_max))
1495 		goto start;
1496 	if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
1497 		(unsigned char *) buf, -1, -1, mval))
1498 		goto err;
1499 	ret = 1;
1500  err:
1501 	return (ret);
1502 }
1503 
1504 static int
1505 add_attribute_object(X509_REQ * req, char *text, const char *def,
1506     char *value, int nid, int n_min,
1507     int n_max, unsigned long chtype)
1508 {
1509 	int i;
1510 	static char buf[1024];
1511 
1512  start:
1513 	if (!req_config.batch)
1514 		BIO_printf(bio_err, "%s [%s]:", text, def);
1515 	(void) BIO_flush(bio_err);
1516 	if (value != NULL) {
1517 		strlcpy(buf, value, sizeof buf);
1518 		strlcat(buf, "\n", sizeof buf);
1519 		BIO_printf(bio_err, "%s\n", value);
1520 	} else {
1521 		buf[0] = '\0';
1522 		if (!req_config.batch) {
1523 			if (!fgets(buf, sizeof buf, stdin))
1524 				return 0;
1525 		} else {
1526 			buf[0] = '\n';
1527 			buf[1] = '\0';
1528 		}
1529 	}
1530 
1531 	if (buf[0] == '\0')
1532 		return (0);
1533 	else if (buf[0] == '\n') {
1534 		if ((def == NULL) || (def[0] == '\0'))
1535 			return (1);
1536 		strlcpy(buf, def, sizeof buf);
1537 		strlcat(buf, "\n", sizeof buf);
1538 	} else if ((buf[0] == '.') && (buf[1] == '\n'))
1539 		return (1);
1540 
1541 	i = strlen(buf);
1542 	if (buf[i - 1] != '\n') {
1543 		BIO_printf(bio_err, "weird input :-(\n");
1544 		return (0);
1545 	}
1546 	buf[--i] = '\0';
1547 	if (!req_check_len(i, n_min, n_max))
1548 		goto start;
1549 
1550 	if (!X509_REQ_add1_attr_by_NID(req, nid, chtype,
1551 		(unsigned char *) buf, -1)) {
1552 		BIO_printf(bio_err, "Error adding attribute\n");
1553 		ERR_print_errors(bio_err);
1554 		goto err;
1555 	}
1556 	return (1);
1557  err:
1558 	return (0);
1559 }
1560 
1561 static int
1562 req_check_len(int len, int n_min, int n_max)
1563 {
1564 	if ((n_min > 0) && (len < n_min)) {
1565 		BIO_printf(bio_err, "string is too short, it needs to be at least %d bytes long\n", n_min);
1566 		return (0);
1567 	}
1568 	if ((n_max >= 0) && (len > n_max)) {
1569 		BIO_printf(bio_err, "string is too long, it needs to be less than  %d bytes long\n", n_max);
1570 		return (0);
1571 	}
1572 	return (1);
1573 }
1574 
1575 /* Check if the end of a string matches 'end' */
1576 static int
1577 check_end(const char *str, const char *end)
1578 {
1579 	int elen, slen;
1580 	const char *tmp;
1581 	elen = strlen(end);
1582 	slen = strlen(str);
1583 	if (elen > slen)
1584 		return 1;
1585 	tmp = str + slen - elen;
1586 	return strcmp(tmp, end);
1587 }
1588 
1589 static EVP_PKEY_CTX *
1590 set_keygen_ctx(BIO * err, const char *gstr, int *pkey_type,
1591     long *pkeylen, char **palgnam)
1592 {
1593 	EVP_PKEY_CTX *gctx = NULL;
1594 	EVP_PKEY *param = NULL;
1595 	long keylen = -1;
1596 	BIO *pbio = NULL;
1597 	const char *paramfile = NULL;
1598 	const char *errstr;
1599 
1600 	if (gstr == NULL) {
1601 		*pkey_type = EVP_PKEY_RSA;
1602 		keylen = *pkeylen;
1603 	} else if (gstr[0] >= '0' && gstr[0] <= '9') {
1604 		*pkey_type = EVP_PKEY_RSA;
1605 		keylen = strtonum(gstr, 0, LONG_MAX, &errstr);
1606 		if (errstr) {
1607 			BIO_printf(err, "bad algorithm %s: %s\n", gstr, errstr);
1608 			return NULL;
1609 		}
1610 		*pkeylen = keylen;
1611 	} else if (!strncmp(gstr, "param:", 6))
1612 		paramfile = gstr + 6;
1613 	else {
1614 		const char *p = strchr(gstr, ':');
1615 		int len;
1616 		const EVP_PKEY_ASN1_METHOD *ameth;
1617 
1618 		if (p)
1619 			len = p - gstr;
1620 		else
1621 			len = strlen(gstr);
1622 
1623 		ameth = EVP_PKEY_asn1_find_str(NULL, gstr, len);
1624 
1625 		if (!ameth) {
1626 			BIO_printf(err, "Unknown algorithm %.*s\n", len, gstr);
1627 			return NULL;
1628 		}
1629 		EVP_PKEY_asn1_get0_info(NULL, pkey_type, NULL, NULL, NULL,
1630 		    ameth);
1631 		if (*pkey_type == EVP_PKEY_RSA) {
1632 			if (p) {
1633 				keylen = strtonum(p + 1, 0, LONG_MAX, &errstr);
1634 				if (errstr) {
1635 					BIO_printf(err, "bad algorithm %s: %s\n",
1636 					    p + 1, errstr);
1637 					return NULL;
1638 				}
1639 				*pkeylen = keylen;
1640 			} else
1641 				keylen = *pkeylen;
1642 		} else if (p)
1643 			paramfile = p + 1;
1644 	}
1645 
1646 	if (paramfile) {
1647 		pbio = BIO_new_file(paramfile, "r");
1648 		if (!pbio) {
1649 			BIO_printf(err, "Can't open parameter file %s\n",
1650 			    paramfile);
1651 			return NULL;
1652 		}
1653 		param = PEM_read_bio_Parameters(pbio, NULL);
1654 
1655 		if (!param) {
1656 			X509 *x;
1657 			(void) BIO_reset(pbio);
1658 			x = PEM_read_bio_X509(pbio, NULL, NULL, NULL);
1659 			if (x) {
1660 				param = X509_get_pubkey(x);
1661 				X509_free(x);
1662 			}
1663 		}
1664 		BIO_free(pbio);
1665 
1666 		if (!param) {
1667 			BIO_printf(err, "Error reading parameter file %s\n",
1668 			    paramfile);
1669 			return NULL;
1670 		}
1671 		if (*pkey_type == -1)
1672 			*pkey_type = EVP_PKEY_id(param);
1673 		else if (*pkey_type != EVP_PKEY_base_id(param)) {
1674 			BIO_printf(err, "Key Type does not match parameters\n");
1675 			EVP_PKEY_free(param);
1676 			return NULL;
1677 		}
1678 	}
1679 	if (palgnam) {
1680 		const EVP_PKEY_ASN1_METHOD *ameth;
1681 		const char *anam;
1682 		ameth = EVP_PKEY_asn1_find(NULL, *pkey_type);
1683 		if (!ameth) {
1684 			BIO_puts(err, "Internal error: can't find key algorithm\n");
1685 			return NULL;
1686 		}
1687 		EVP_PKEY_asn1_get0_info(NULL, NULL, NULL, NULL, &anam, ameth);
1688 		*palgnam = strdup(anam);
1689 	}
1690 	if (param) {
1691 		gctx = EVP_PKEY_CTX_new(param, NULL);
1692 		*pkeylen = EVP_PKEY_bits(param);
1693 		EVP_PKEY_free(param);
1694 	} else
1695 		gctx = EVP_PKEY_CTX_new_id(*pkey_type, NULL);
1696 
1697 	if (!gctx) {
1698 		BIO_puts(err, "Error allocating keygen context\n");
1699 		ERR_print_errors(err);
1700 		return NULL;
1701 	}
1702 	if (EVP_PKEY_keygen_init(gctx) <= 0) {
1703 		BIO_puts(err, "Error initializing keygen context\n");
1704 		ERR_print_errors(err);
1705 		return NULL;
1706 	}
1707 	if ((*pkey_type == EVP_PKEY_RSA) && (keylen != -1)) {
1708 		if (EVP_PKEY_CTX_set_rsa_keygen_bits(gctx, keylen) <= 0) {
1709 			BIO_puts(err, "Error setting RSA keysize\n");
1710 			ERR_print_errors(err);
1711 			EVP_PKEY_CTX_free(gctx);
1712 			return NULL;
1713 		}
1714 	}
1715 
1716 	return gctx;
1717 }
1718 
1719 static int
1720 genpkey_cb(EVP_PKEY_CTX * ctx)
1721 {
1722 	char c = '*';
1723 	BIO *b = EVP_PKEY_CTX_get_app_data(ctx);
1724 	int p;
1725 	p = EVP_PKEY_CTX_get_keygen_info(ctx, 0);
1726 	if (p == 0)
1727 		c = '.';
1728 	if (p == 1)
1729 		c = '+';
1730 	if (p == 2)
1731 		c = '*';
1732 	if (p == 3)
1733 		c = '\n';
1734 	BIO_write(b, &c, 1);
1735 	(void) BIO_flush(b);
1736 	return 1;
1737 }
1738 
1739 static int
1740 do_sign_init(BIO * err, EVP_MD_CTX * ctx, EVP_PKEY * pkey,
1741     const EVP_MD * md, STACK_OF(OPENSSL_STRING) * sigopts)
1742 {
1743 	EVP_PKEY_CTX *pkctx = NULL;
1744 	int i;
1745 	EVP_MD_CTX_init(ctx);
1746 	if (!EVP_DigestSignInit(ctx, &pkctx, md, NULL, pkey))
1747 		return 0;
1748 	for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {
1749 		char *sigopt = sk_OPENSSL_STRING_value(sigopts, i);
1750 		if (pkey_ctrl_string(pkctx, sigopt) <= 0) {
1751 			BIO_printf(err, "parameter error \"%s\"\n", sigopt);
1752 			ERR_print_errors(bio_err);
1753 			return 0;
1754 		}
1755 	}
1756 	return 1;
1757 }
1758 
1759 int
1760 do_X509_sign(BIO * err, X509 * x, EVP_PKEY * pkey, const EVP_MD * md,
1761     STACK_OF(OPENSSL_STRING) * sigopts)
1762 {
1763 	int rv;
1764 	EVP_MD_CTX mctx;
1765 	EVP_MD_CTX_init(&mctx);
1766 	rv = do_sign_init(err, &mctx, pkey, md, sigopts);
1767 	if (rv > 0)
1768 		rv = X509_sign_ctx(x, &mctx);
1769 	EVP_MD_CTX_cleanup(&mctx);
1770 	return rv > 0 ? 1 : 0;
1771 }
1772 
1773 
1774 int
1775 do_X509_REQ_sign(BIO * err, X509_REQ * x, EVP_PKEY * pkey, const EVP_MD * md,
1776     STACK_OF(OPENSSL_STRING) * sigopts)
1777 {
1778 	int rv;
1779 	EVP_MD_CTX mctx;
1780 	EVP_MD_CTX_init(&mctx);
1781 	rv = do_sign_init(err, &mctx, pkey, md, sigopts);
1782 	if (rv > 0)
1783 		rv = X509_REQ_sign_ctx(x, &mctx);
1784 	EVP_MD_CTX_cleanup(&mctx);
1785 	return rv > 0 ? 1 : 0;
1786 }
1787 
1788 
1789 
1790 int
1791 do_X509_CRL_sign(BIO * err, X509_CRL * x, EVP_PKEY * pkey, const EVP_MD * md,
1792     STACK_OF(OPENSSL_STRING) * sigopts)
1793 {
1794 	int rv;
1795 	EVP_MD_CTX mctx;
1796 	EVP_MD_CTX_init(&mctx);
1797 	rv = do_sign_init(err, &mctx, pkey, md, sigopts);
1798 	if (rv > 0)
1799 		rv = X509_CRL_sign_ctx(x, &mctx);
1800 	EVP_MD_CTX_cleanup(&mctx);
1801 	return rv > 0 ? 1 : 0;
1802 }
1803 
1804 static unsigned long
1805 ext_name_hash(const OPENSSL_STRING *a)
1806 {
1807 	return lh_strhash((const char *)a);
1808 }
1809 
1810 static int
1811 ext_name_cmp(const OPENSSL_STRING *a, const OPENSSL_STRING *b)
1812 {
1813 	return strcmp((const char *)a, (const char *)b);
1814 }
1815 
1816 static void
1817 exts_cleanup(OPENSSL_STRING *x)
1818 {
1819 	free((char *)x);
1820 }
1821 
1822 /*
1823  * Is the |kv| key already duplicated ? This is remarkably tricky to get right.
1824  * Return 0 if unique, -1 on runtime error; 1 if found or a syntax error.
1825  */
1826 static int
1827 duplicated(LHASH_OF(OPENSSL_STRING) *addexts, char *kv)
1828 {
1829 	char *p;
1830 	size_t off;
1831 
1832 	/* Check syntax. */
1833 	/* Skip leading whitespace, make a copy. */
1834 	while (*kv && isspace(*kv))
1835 		if (*++kv == '\0')
1836 			return 1;
1837 	if ((p = strchr(kv, '=')) == NULL)
1838 		return 1;
1839 	off = p - kv;
1840 	if ((kv = strdup(kv)) == NULL)
1841 		return -1;
1842 
1843 	/* Skip trailing space before the equal sign. */
1844 	for (p = kv + off; p > kv; --p)
1845 		if (!isspace(p[-1]))
1846 			break;
1847 	if (p == kv) {
1848 		free(kv);
1849 		return 1;
1850 	}
1851 	*p = '\0';
1852 
1853 	/* See if "key" is there by attempting to add it. */
1854 	if ((p = (char *)lh_OPENSSL_STRING_insert(addexts, (OPENSSL_STRING*)kv))
1855 	    != NULL || lh_OPENSSL_STRING_error(addexts)) {
1856 		free(p != NULL ? p : kv);
1857 		return -1;
1858 	}
1859 
1860 	return 0;
1861 }
1862