| /* This Source Code Form is subject to the terms of the Mozilla Public |
| * License, v. 2.0. If a copy of the MPL was not distributed with this |
| * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| |
| /* Cert-O-Matic CGI */ |
| |
| #include "nspr.h" |
| #include "prtypes.h" |
| #include "prtime.h" |
| #include "prlong.h" |
| |
| #include "pk11func.h" |
| #include "cert.h" |
| #include "cryptohi.h" |
| #include "secoid.h" |
| #include "secder.h" |
| #include "genname.h" |
| #include "xconst.h" |
| #include "secutil.h" |
| #include "pk11pqg.h" |
| #include "certxutl.h" |
| #include "nss.h" |
| |
| /* #define TEST 1 */ |
| /* #define FILEOUT 1 */ |
| /* #define OFFLINE 1 */ |
| #define START_FIELDS 100 |
| #define PREFIX_LEN 6 |
| #define SERIAL_FILE "../serial" |
| #define DB_DIRECTORY ".." |
| |
| static char *progName; |
| |
| typedef struct PairStr Pair; |
| |
| struct PairStr { |
| char *name; |
| char *data; |
| }; |
| |
| char prefix[PREFIX_LEN]; |
| |
| const SEC_ASN1Template CERTIA5TypeTemplate[] = { |
| { SEC_ASN1_IA5_STRING } |
| }; |
| |
| SECKEYPrivateKey *privkeys[9] = { NULL, NULL, NULL, NULL, NULL, NULL, NULL, |
| NULL, NULL }; |
| |
| #ifdef notdef |
| const SEC_ASN1Template CERT_GeneralNameTemplate[] = { |
| { SEC_ASN1_SEQUENCE_OF, 0, SEC_AnyTemplate } |
| }; |
| #endif |
| |
| static void |
| error_out(char *error_string) |
| { |
| printf("Content-type: text/plain\n\n"); |
| printf("%s", error_string); |
| fflush(stderr); |
| fflush(stdout); |
| exit(1); |
| } |
| |
| static void |
| error_allocate(void) |
| { |
| error_out("ERROR: Unable to allocate memory"); |
| } |
| |
| static char * |
| make_copy_string(char *read_pos, |
| int length, |
| char sentinal_value) |
| /* copys string from to a new string it creates and |
| returns a pointer to the new string */ |
| { |
| int remaining = length; |
| char *write_pos; |
| char *new; |
| |
| new = write_pos = (char *)PORT_Alloc(length); |
| if (new == NULL) { |
| error_allocate(); |
| } |
| while (*read_pos != sentinal_value) { |
| if (remaining == 1) { |
| remaining += length; |
| length = length * 2; |
| new = PORT_Realloc(new, length); |
| if (new == NULL) { |
| error_allocate(); |
| } |
| write_pos = new + length - remaining; |
| } |
| *write_pos = *read_pos; |
| ++write_pos; |
| ++read_pos; |
| remaining = remaining - 1; |
| } |
| *write_pos = '\0'; |
| return new; |
| } |
| |
| static SECStatus |
| clean_input(Pair *data) |
| /* converts the non-alphanumeric characters in a form post |
| from hex codes back to characters */ |
| { |
| int length; |
| int hi_digit; |
| int low_digit; |
| char character; |
| char *begin_pos; |
| char *read_pos; |
| char *write_pos; |
| PRBool name = PR_TRUE; |
| |
| begin_pos = data->name; |
| while (begin_pos != NULL) { |
| length = strlen(begin_pos); |
| read_pos = write_pos = begin_pos; |
| while ((read_pos - begin_pos) < length) { |
| if (*read_pos == '+') { |
| *read_pos = ' '; |
| } |
| if (*read_pos == '%') { |
| hi_digit = *(read_pos + 1); |
| low_digit = *(read_pos + 2); |
| read_pos += 3; |
| if (isdigit(hi_digit)) { |
| hi_digit = hi_digit - '0'; |
| } else { |
| hi_digit = toupper(hi_digit); |
| if (isxdigit(hi_digit)) { |
| hi_digit = (hi_digit - 'A') + 10; |
| } else { |
| error_out("ERROR: Form data incorrectly formated"); |
| } |
| } |
| if (isdigit(low_digit)) { |
| low_digit = low_digit - '0'; |
| } else { |
| low_digit = toupper(low_digit); |
| if ((low_digit >= 'A') && (low_digit <= 'F')) { |
| low_digit = (low_digit - 'A') + 10; |
| } else { |
| error_out("ERROR: Form data incorrectly formated"); |
| } |
| } |
| character = (hi_digit << 4) | low_digit; |
| if (character != 10) { |
| *write_pos = character; |
| ++write_pos; |
| } |
| } else { |
| *write_pos = *read_pos; |
| ++write_pos; |
| ++read_pos; |
| } |
| } |
| *write_pos = '\0'; |
| if (name == PR_TRUE) { |
| begin_pos = data->data; |
| name = PR_FALSE; |
| } else { |
| data++; |
| begin_pos = data->name; |
| name = PR_TRUE; |
| } |
| } |
| return SECSuccess; |
| } |
| |
| static char * |
| make_name(char *new_data) |
| /* gets the next field name in the input string and returns |
| a pointer to a string containing a copy of it */ |
| { |
| int length = 20; |
| char *name; |
| |
| name = make_copy_string(new_data, length, '='); |
| return name; |
| } |
| |
| static char * |
| make_data(char *new_data) |
| /* gets the data for the next field in the input string |
| and returns a pointer to a string containing it */ |
| { |
| int length = 100; |
| char *data; |
| char *read_pos; |
| |
| read_pos = new_data; |
| while (*(read_pos - 1) != '=') { |
| ++read_pos; |
| } |
| data = make_copy_string(read_pos, length, '&'); |
| return data; |
| } |
| |
| static Pair |
| make_pair(char *new_data) |
| /* makes a pair name/data pair from the input string */ |
| { |
| Pair temp; |
| |
| temp.name = make_name(new_data); |
| temp.data = make_data(new_data); |
| return temp; |
| } |
| |
| static Pair * |
| make_datastruct(char *data, int len) |
| /* parses the input from the form post into a data |
| structure of field name/data pairs */ |
| { |
| Pair *datastruct; |
| Pair *current; |
| char *curr_pos; |
| int fields = START_FIELDS; |
| int remaining = START_FIELDS; |
| |
| curr_pos = data; |
| datastruct = current = (Pair *)PORT_Alloc(fields * sizeof(Pair)); |
| if (datastruct == NULL) { |
| error_allocate(); |
| } |
| while (curr_pos - data < len) { |
| if (remaining == 1) { |
| remaining += fields; |
| fields = fields * 2; |
| datastruct = (Pair *)PORT_Realloc(datastruct, fields * |
| sizeof(Pair)); |
| if (datastruct == NULL) { |
| error_allocate(); |
| } |
| current = datastruct + (fields - remaining); |
| } |
| *current = make_pair(curr_pos); |
| while (*curr_pos != '&') { |
| ++curr_pos; |
| } |
| ++curr_pos; |
| ++current; |
| remaining = remaining - 1; |
| } |
| current->name = NULL; |
| return datastruct; |
| } |
| |
| static char * |
| return_name(Pair *data_struct, |
| int n) |
| /* returns a pointer to the name of the nth |
| (starting from 0) item in the data structure */ |
| { |
| char *name; |
| |
| if ((data_struct + n)->name != NULL) { |
| name = (data_struct + n)->name; |
| return name; |
| } else { |
| return NULL; |
| } |
| } |
| |
| static char * |
| return_data(Pair *data_struct, int n) |
| /* returns a pointer to the data of the nth (starting from 0) |
| itme in the data structure */ |
| { |
| char *data; |
| |
| data = (data_struct + n)->data; |
| return data; |
| } |
| |
| static char * |
| add_prefix(char *field_name) |
| { |
| extern char prefix[PREFIX_LEN]; |
| int i = 0; |
| char *rv; |
| char *write; |
| |
| rv = write = PORT_Alloc(PORT_Strlen(prefix) + PORT_Strlen(field_name) + 1); |
| for (i = 0; i < PORT_Strlen(prefix); i++) { |
| *write = prefix[i]; |
| write++; |
| } |
| *write = '\0'; |
| rv = PORT_Strcat(rv, field_name); |
| return rv; |
| } |
| |
| static char * |
| find_field(Pair *data, |
| char *field_name, |
| PRBool add_pre) |
| /* returns a pointer to the data of the first pair |
| thats name matches the string it is passed */ |
| { |
| int i = 0; |
| char *retrieved; |
| int found = 0; |
| |
| if (add_pre) { |
| field_name = add_prefix(field_name); |
| } |
| while (return_name(data, i) != NULL) { |
| if (PORT_Strcmp(return_name(data, i), field_name) == 0) { |
| retrieved = return_data(data, i); |
| found = 1; |
| break; |
| } |
| i++; |
| } |
| if (!found) { |
| retrieved = NULL; |
| } |
| return retrieved; |
| } |
| |
| static PRBool |
| find_field_bool(Pair *data, |
| char *fieldname, |
| PRBool add_pre) |
| { |
| char *rv; |
| |
| rv = find_field(data, fieldname, add_pre); |
| |
| if ((rv != NULL) && (PORT_Strcmp(rv, "true")) == 0) { |
| return PR_TRUE; |
| } else { |
| return PR_FALSE; |
| } |
| } |
| |
| static CERTCertificateRequest * |
| makeCertReq(Pair *form_data, |
| int which_priv_key) |
| /* makes and encodes a certrequest */ |
| { |
| |
| PK11SlotInfo *slot; |
| CERTCertificateRequest *certReq = NULL; |
| CERTSubjectPublicKeyInfo *spki; |
| SECKEYPrivateKey *privkey = NULL; |
| SECKEYPublicKey *pubkey = NULL; |
| CERTName *name; |
| char *key; |
| extern SECKEYPrivateKey *privkeys[9]; |
| int keySizeInBits; |
| char *challenge = "foo"; |
| SECStatus rv = SECSuccess; |
| PQGParams *pqgParams = NULL; |
| PQGVerify *pqgVfy = NULL; |
| |
| name = CERT_AsciiToName(find_field(form_data, "subject", PR_TRUE)); |
| if (name == NULL) { |
| error_out("ERROR: Unable to create Subject Name"); |
| } |
| key = find_field(form_data, "key", PR_TRUE); |
| if (key == NULL) { |
| switch (*find_field(form_data, "keysize", PR_TRUE)) { |
| case '0': |
| keySizeInBits = 2048; |
| break; |
| case '1': |
| keySizeInBits = 1024; |
| break; |
| case '2': |
| keySizeInBits = 512; |
| break; |
| default: |
| error_out("ERROR: Unsupported Key length selected"); |
| } |
| if (find_field_bool(form_data, "keyType-dsa", PR_TRUE)) { |
| rv = PK11_PQG_ParamGen(keySizeInBits, &pqgParams, &pqgVfy); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to generate PQG parameters"); |
| } |
| slot = PK11_GetBestSlot(CKM_DSA_KEY_PAIR_GEN, NULL); |
| privkey = PK11_GenerateKeyPair(slot, CKM_DSA_KEY_PAIR_GEN, |
| pqgParams, &pubkey, PR_FALSE, |
| PR_TRUE, NULL); |
| } else { |
| privkey = SECKEY_CreateRSAPrivateKey(keySizeInBits, &pubkey, NULL); |
| } |
| privkeys[which_priv_key] = privkey; |
| spki = SECKEY_CreateSubjectPublicKeyInfo(pubkey); |
| } else { |
| spki = SECKEY_ConvertAndDecodePublicKeyAndChallenge(key, challenge, |
| NULL); |
| if (spki == NULL) { |
| error_out("ERROR: Unable to decode Public Key and Challenge String"); |
| } |
| } |
| certReq = CERT_CreateCertificateRequest(name, spki, NULL); |
| if (certReq == NULL) { |
| error_out("ERROR: Unable to create Certificate Request"); |
| } |
| if (pubkey != NULL) { |
| SECKEY_DestroyPublicKey(pubkey); |
| } |
| if (spki != NULL) { |
| SECKEY_DestroySubjectPublicKeyInfo(spki); |
| } |
| if (pqgParams != NULL) { |
| PK11_PQG_DestroyParams(pqgParams); |
| } |
| if (pqgVfy != NULL) { |
| PK11_PQG_DestroyVerify(pqgVfy); |
| } |
| return certReq; |
| } |
| |
| static CERTCertificate * |
| MakeV1Cert(CERTCertDBHandle *handle, |
| CERTCertificateRequest *req, |
| char *issuerNameStr, |
| PRBool selfsign, |
| int serialNumber, |
| int warpmonths, |
| Pair *data) |
| { |
| CERTCertificate *issuerCert = NULL; |
| CERTValidity *validity; |
| CERTCertificate *cert = NULL; |
| PRExplodedTime printableTime; |
| PRTime now, |
| after; |
| if (!selfsign) { |
| issuerCert = CERT_FindCertByNameString(handle, issuerNameStr); |
| if (!issuerCert) { |
| error_out("ERROR: Could not find issuer's certificate"); |
| return NULL; |
| } |
| } |
| if (find_field_bool(data, "manValidity", PR_TRUE)) { |
| (void)DER_AsciiToTime(&now, find_field(data, "notBefore", PR_TRUE)); |
| } else { |
| now = PR_Now(); |
| } |
| PR_ExplodeTime(now, PR_GMTParameters, &printableTime); |
| if (warpmonths) { |
| printableTime.tm_month += warpmonths; |
| now = PR_ImplodeTime(&printableTime); |
| PR_ExplodeTime(now, PR_GMTParameters, &printableTime); |
| } |
| if (find_field_bool(data, "manValidity", PR_TRUE)) { |
| (void)DER_AsciiToTime(&after, find_field(data, "notAfter", PR_TRUE)); |
| PR_ExplodeTime(after, PR_GMTParameters, &printableTime); |
| } else { |
| printableTime.tm_month += 3; |
| after = PR_ImplodeTime(&printableTime); |
| } |
| /* note that the time is now in micro-second unit */ |
| validity = CERT_CreateValidity(now, after); |
| |
| if (selfsign) { |
| cert = CERT_CreateCertificate(serialNumber, &(req->subject), validity, req); |
| } else { |
| cert = CERT_CreateCertificate(serialNumber, &(issuerCert->subject), validity, req); |
| } |
| |
| CERT_DestroyValidity(validity); |
| if (issuerCert) { |
| CERT_DestroyCertificate(issuerCert); |
| } |
| return (cert); |
| } |
| |
| static int |
| get_serial_number(Pair *data) |
| { |
| int serial = 0; |
| int error; |
| char *filename = SERIAL_FILE; |
| char *SN; |
| FILE *serialFile; |
| |
| if (find_field_bool(data, "serial-auto", PR_TRUE)) { |
| serialFile = fopen(filename, "r"); |
| if (serialFile != NULL) { |
| size_t nread = fread(&serial, sizeof(int), 1, serialFile); |
| if (ferror(serialFile) != 0 || nread != 1) { |
| error_out("Error: Unable to read serial number file"); |
| } |
| if (serial == -1) { |
| serial = 21; |
| } |
| fclose(serialFile); |
| ++serial; |
| serialFile = fopen(filename, "w"); |
| if (serialFile == NULL) { |
| error_out("ERROR: Unable to open serial number file for writing"); |
| } |
| fwrite(&serial, sizeof(int), 1, serialFile); |
| if (ferror(serialFile) != 0) { |
| error_out("Error: Unable to write to serial number file"); |
| } |
| } else { |
| fclose(serialFile); |
| serialFile = fopen(filename, "w"); |
| if (serialFile == NULL) { |
| error_out("ERROR: Unable to open serial number file"); |
| } |
| serial = 21; |
| fwrite(&serial, sizeof(int), 1, serialFile); |
| if (ferror(serialFile) != 0) { |
| error_out("Error: Unable to write to serial number file"); |
| } |
| error = ferror(serialFile); |
| if (error != 0) { |
| error_out("ERROR: Unable to write to serial file"); |
| } |
| } |
| fclose(serialFile); |
| } else { |
| SN = find_field(data, "serial_value", PR_TRUE); |
| while (*SN != '\0') { |
| serial = serial * 16; |
| if ((*SN >= 'A') && (*SN <= 'F')) { |
| serial += *SN - 'A' + 10; |
| } else { |
| if ((*SN >= 'a') && (*SN <= 'f')) { |
| serial += *SN - 'a' + 10; |
| } else { |
| serial += *SN - '0'; |
| } |
| } |
| ++SN; |
| } |
| } |
| return serial; |
| } |
| |
| typedef SECStatus (*EXTEN_VALUE_ENCODER)(PLArenaPool *extHandle, void *value, SECItem *encodedValue); |
| |
| static SECStatus |
| EncodeAndAddExtensionValue( |
| PLArenaPool *arena, |
| void *extHandle, |
| void *value, |
| PRBool criticality, |
| int extenType, |
| EXTEN_VALUE_ENCODER EncodeValueFn) |
| { |
| SECItem encodedValue; |
| SECStatus rv; |
| |
| encodedValue.data = NULL; |
| encodedValue.len = 0; |
| rv = (*EncodeValueFn)(arena, value, &encodedValue); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to encode extension value"); |
| } |
| rv = CERT_AddExtension(extHandle, extenType, &encodedValue, criticality, PR_TRUE); |
| return (rv); |
| } |
| |
| static SECStatus |
| AddKeyUsage(void *extHandle, |
| Pair *data) |
| { |
| SECItem bitStringValue; |
| unsigned char keyUsage = 0x0; |
| |
| if (find_field_bool(data, "keyUsage-digitalSignature", PR_TRUE)) { |
| keyUsage |= (0x80 >> 0); |
| } |
| if (find_field_bool(data, "keyUsage-nonRepudiation", PR_TRUE)) { |
| keyUsage |= (0x80 >> 1); |
| } |
| if (find_field_bool(data, "keyUsage-keyEncipherment", PR_TRUE)) { |
| keyUsage |= (0x80 >> 2); |
| } |
| if (find_field_bool(data, "keyUsage-dataEncipherment", PR_TRUE)) { |
| keyUsage |= (0x80 >> 3); |
| } |
| if (find_field_bool(data, "keyUsage-keyAgreement", PR_TRUE)) { |
| keyUsage |= (0x80 >> 4); |
| } |
| if (find_field_bool(data, "keyUsage-keyCertSign", PR_TRUE)) { |
| keyUsage |= (0x80 >> 5); |
| } |
| if (find_field_bool(data, "keyUsage-cRLSign", PR_TRUE)) { |
| keyUsage |= (0x80 >> 6); |
| } |
| |
| bitStringValue.data = &keyUsage; |
| bitStringValue.len = 1; |
| |
| return (CERT_EncodeAndAddBitStrExtension(extHandle, SEC_OID_X509_KEY_USAGE, &bitStringValue, |
| (find_field_bool(data, "keyUsage-crit", PR_TRUE)))); |
| } |
| |
| static CERTOidSequence * |
| CreateOidSequence(void) |
| { |
| CERTOidSequence *rv = (CERTOidSequence *)NULL; |
| PLArenaPool *arena = (PLArenaPool *)NULL; |
| |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if ((PLArenaPool *)NULL == arena) { |
| goto loser; |
| } |
| |
| rv = (CERTOidSequence *)PORT_ArenaZAlloc(arena, sizeof(CERTOidSequence)); |
| if ((CERTOidSequence *)NULL == rv) { |
| goto loser; |
| } |
| |
| rv->oids = (SECItem **)PORT_ArenaZAlloc(arena, sizeof(SECItem *)); |
| if ((SECItem **)NULL == rv->oids) { |
| goto loser; |
| } |
| |
| rv->arena = arena; |
| return rv; |
| |
| loser: |
| if ((PLArenaPool *)NULL != arena) { |
| PORT_FreeArena(arena, PR_FALSE); |
| } |
| |
| return (CERTOidSequence *)NULL; |
| } |
| |
| static SECStatus |
| AddOidToSequence(CERTOidSequence *os, SECOidTag oidTag) |
| { |
| SECItem **oids; |
| PRUint32 count = 0; |
| SECOidData *od; |
| |
| od = SECOID_FindOIDByTag(oidTag); |
| if ((SECOidData *)NULL == od) { |
| return SECFailure; |
| } |
| |
| for (oids = os->oids; (SECItem *)NULL != *oids; oids++) { |
| count++; |
| } |
| |
| /* ArenaZRealloc */ |
| |
| { |
| PRUint32 i; |
| |
| oids = (SECItem **)PORT_ArenaZAlloc(os->arena, sizeof(SECItem *) * (count + 2)); |
| if ((SECItem **)NULL == oids) { |
| return SECFailure; |
| } |
| |
| for (i = 0; i < count; i++) { |
| oids[i] = os->oids[i]; |
| } |
| |
| /* ArenaZFree(os->oids); */ |
| } |
| |
| os->oids = oids; |
| os->oids[count] = &od->oid; |
| |
| return SECSuccess; |
| } |
| |
| static SECItem * |
| EncodeOidSequence(CERTOidSequence *os) |
| { |
| SECItem *rv; |
| extern const SEC_ASN1Template CERT_OidSeqTemplate[]; |
| |
| rv = (SECItem *)PORT_ArenaZAlloc(os->arena, sizeof(SECItem)); |
| if ((SECItem *)NULL == rv) { |
| goto loser; |
| } |
| |
| if (!SEC_ASN1EncodeItem(os->arena, rv, os, CERT_OidSeqTemplate)) { |
| goto loser; |
| } |
| |
| return rv; |
| |
| loser: |
| return (SECItem *)NULL; |
| } |
| |
| static SECStatus |
| AddExtKeyUsage(void *extHandle, Pair *data) |
| { |
| SECStatus rv; |
| CERTOidSequence *os; |
| SECItem *value; |
| PRBool crit; |
| |
| os = CreateOidSequence(); |
| if ((CERTOidSequence *)NULL == os) { |
| return SECFailure; |
| } |
| |
| if (find_field_bool(data, "extKeyUsage-serverAuth", PR_TRUE)) { |
| rv = AddOidToSequence(os, SEC_OID_EXT_KEY_USAGE_SERVER_AUTH); |
| if (SECSuccess != rv) |
| goto loser; |
| } |
| |
| if (find_field_bool(data, "extKeyUsage-msTrustListSign", PR_TRUE)) { |
| rv = AddOidToSequence(os, SEC_OID_MS_EXT_KEY_USAGE_CTL_SIGNING); |
| if (SECSuccess != rv) |
| goto loser; |
| } |
| |
| if (find_field_bool(data, "extKeyUsage-clientAuth", PR_TRUE)) { |
| rv = AddOidToSequence(os, SEC_OID_EXT_KEY_USAGE_CLIENT_AUTH); |
| if (SECSuccess != rv) |
| goto loser; |
| } |
| |
| if (find_field_bool(data, "extKeyUsage-codeSign", PR_TRUE)) { |
| rv = AddOidToSequence(os, SEC_OID_EXT_KEY_USAGE_CODE_SIGN); |
| if (SECSuccess != rv) |
| goto loser; |
| } |
| |
| if (find_field_bool(data, "extKeyUsage-emailProtect", PR_TRUE)) { |
| rv = AddOidToSequence(os, SEC_OID_EXT_KEY_USAGE_EMAIL_PROTECT); |
| if (SECSuccess != rv) |
| goto loser; |
| } |
| |
| if (find_field_bool(data, "extKeyUsage-timeStamp", PR_TRUE)) { |
| rv = AddOidToSequence(os, SEC_OID_EXT_KEY_USAGE_TIME_STAMP); |
| if (SECSuccess != rv) |
| goto loser; |
| } |
| |
| if (find_field_bool(data, "extKeyUsage-ocspResponder", PR_TRUE)) { |
| rv = AddOidToSequence(os, SEC_OID_OCSP_RESPONDER); |
| if (SECSuccess != rv) |
| goto loser; |
| } |
| |
| if (find_field_bool(data, "extKeyUsage-NS-govtApproved", PR_TRUE)) { |
| rv = AddOidToSequence(os, SEC_OID_NS_KEY_USAGE_GOVT_APPROVED); |
| if (SECSuccess != rv) |
| goto loser; |
| } |
| |
| value = EncodeOidSequence(os); |
| |
| crit = find_field_bool(data, "extKeyUsage-crit", PR_TRUE); |
| |
| rv = CERT_AddExtension(extHandle, SEC_OID_X509_EXT_KEY_USAGE, value, |
| crit, PR_TRUE); |
| /*FALLTHROUGH*/ |
| loser: |
| CERT_DestroyOidSequence(os); |
| return rv; |
| } |
| |
| static SECStatus |
| AddSubKeyID(void *extHandle, |
| Pair *data, |
| CERTCertificate *subjectCert) |
| { |
| SECItem encodedValue; |
| SECStatus rv; |
| char *read; |
| char *write; |
| char *first; |
| char character; |
| int high_digit = 0, |
| low_digit = 0; |
| int len; |
| PRBool odd = PR_FALSE; |
| |
| encodedValue.data = NULL; |
| encodedValue.len = 0; |
| first = read = write = find_field(data, "subjectKeyIdentifier-text", |
| PR_TRUE); |
| len = PORT_Strlen(first); |
| odd = ((len % 2) != 0) ? PR_TRUE : PR_FALSE; |
| if (find_field_bool(data, "subjectKeyIdentifier-radio-hex", PR_TRUE)) { |
| if (odd) { |
| error_out("ERROR: Improperly formated subject key identifier, hex values must be expressed as an octet string"); |
| } |
| while (*read != '\0') { |
| if (!isxdigit(*read)) { |
| error_out("ERROR: Improperly formated subject key identifier"); |
| } |
| *read = toupper(*read); |
| if ((*read >= 'A') && (*read <= 'F')) { |
| high_digit = *read - 'A' + 10; |
| } else { |
| high_digit = *read - '0'; |
| } |
| ++read; |
| if (!isxdigit(*read)) { |
| error_out("ERROR: Improperly formated subject key identifier"); |
| } |
| *read = toupper(*read); |
| if ((*read >= 'A') && (*read <= 'F')) { |
| low_digit = *(read) - 'A' + 10; |
| } else { |
| low_digit = *(read) - '0'; |
| } |
| character = (high_digit << 4) | low_digit; |
| *write = character; |
| ++write; |
| ++read; |
| } |
| *write = '\0'; |
| len = write - first; |
| } |
| subjectCert->subjectKeyID.data = (unsigned char *)find_field(data, "subjectKeyIdentifier-text", PR_TRUE); |
| subjectCert->subjectKeyID.len = len; |
| rv = CERT_EncodeSubjectKeyID(NULL, &subjectCert->subjectKeyID, &encodedValue); |
| if (rv) { |
| return (rv); |
| } |
| return (CERT_AddExtension(extHandle, SEC_OID_X509_SUBJECT_KEY_ID, |
| &encodedValue, PR_FALSE, PR_TRUE)); |
| } |
| |
| static SECStatus |
| AddAuthKeyID(void *extHandle, |
| Pair *data, |
| char *issuerNameStr, |
| CERTCertDBHandle *handle) |
| { |
| CERTAuthKeyID *authKeyID = NULL; |
| PLArenaPool *arena = NULL; |
| SECStatus rv = SECSuccess; |
| CERTCertificate *issuerCert = NULL; |
| CERTGeneralName *genNames; |
| CERTName *directoryName = NULL; |
| |
| issuerCert = CERT_FindCertByNameString(handle, issuerNameStr); |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (!arena) { |
| error_allocate(); |
| } |
| |
| authKeyID = PORT_ArenaZAlloc(arena, sizeof(CERTAuthKeyID)); |
| if (authKeyID == NULL) { |
| error_allocate(); |
| } |
| if (find_field_bool(data, "authorityKeyIdentifier-radio-keyIdentifier", |
| PR_TRUE)) { |
| authKeyID->keyID.data = PORT_ArenaAlloc(arena, PORT_Strlen((char *)issuerCert->subjectKeyID.data)); |
| if (authKeyID->keyID.data == NULL) { |
| error_allocate(); |
| } |
| PORT_Memcpy(authKeyID->keyID.data, issuerCert->subjectKeyID.data, |
| authKeyID->keyID.len = |
| PORT_Strlen((char *)issuerCert->subjectKeyID.data)); |
| } else { |
| |
| PORT_Assert(arena); |
| genNames = (CERTGeneralName *)PORT_ArenaZAlloc(arena, (sizeof(CERTGeneralName))); |
| if (genNames == NULL) { |
| error_allocate(); |
| } |
| genNames->l.next = genNames->l.prev = &(genNames->l); |
| genNames->type = certDirectoryName; |
| |
| directoryName = CERT_AsciiToName(issuerCert->subjectName); |
| if (!directoryName) { |
| error_out("ERROR: Unable to create Directory Name"); |
| } |
| rv = CERT_CopyName(arena, &genNames->name.directoryName, |
| directoryName); |
| CERT_DestroyName(directoryName); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to copy Directory Name"); |
| } |
| authKeyID->authCertIssuer = genNames; |
| if (authKeyID->authCertIssuer == NULL && SECFailure == |
| PORT_GetError()) { |
| error_out("ERROR: Unable to get Issuer General Name for Authority Key ID Extension"); |
| } |
| authKeyID->authCertSerialNumber = issuerCert->serialNumber; |
| } |
| rv = EncodeAndAddExtensionValue(arena, extHandle, authKeyID, PR_FALSE, |
| SEC_OID_X509_AUTH_KEY_ID, |
| (EXTEN_VALUE_ENCODER) |
| CERT_EncodeAuthKeyID); |
| if (arena) { |
| PORT_FreeArena(arena, PR_FALSE); |
| } |
| return (rv); |
| } |
| |
| static SECStatus |
| AddPrivKeyUsagePeriod(void *extHandle, |
| Pair *data, |
| CERTCertificate *cert) |
| { |
| char *notBeforeStr; |
| char *notAfterStr; |
| PLArenaPool *arena = NULL; |
| SECStatus rv = SECSuccess; |
| CERTPrivKeyUsagePeriod *pkup; |
| |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (!arena) { |
| error_allocate(); |
| } |
| pkup = PORT_ArenaZNew(arena, CERTPrivKeyUsagePeriod); |
| if (pkup == NULL) { |
| error_allocate(); |
| } |
| notBeforeStr = (char *)PORT_Alloc(16); |
| if (notBeforeStr == NULL) { |
| error_allocate(); |
| } |
| notAfterStr = (char *)PORT_Alloc(16); |
| if (notAfterStr == NULL) { |
| error_allocate(); |
| } |
| *notBeforeStr = '\0'; |
| *notAfterStr = '\0'; |
| pkup->arena = arena; |
| pkup->notBefore.len = 0; |
| pkup->notBefore.data = NULL; |
| pkup->notAfter.len = 0; |
| pkup->notAfter.data = NULL; |
| if (find_field_bool(data, "privKeyUsagePeriod-radio-notBefore", PR_TRUE) || |
| find_field_bool(data, "privKeyUsagePeriod-radio-both", PR_TRUE)) { |
| pkup->notBefore.len = 15; |
| pkup->notBefore.data = (unsigned char *)notBeforeStr; |
| if (find_field_bool(data, "privKeyUsagePeriod-notBefore-radio-manual", |
| PR_TRUE)) { |
| PORT_Strcat(notBeforeStr, find_field(data, |
| "privKeyUsagePeriod-notBefore-year", |
| PR_TRUE)); |
| PORT_Strcat(notBeforeStr, find_field(data, |
| "privKeyUsagePeriod-notBefore-month", |
| PR_TRUE)); |
| PORT_Strcat(notBeforeStr, find_field(data, |
| "privKeyUsagePeriod-notBefore-day", |
| PR_TRUE)); |
| PORT_Strcat(notBeforeStr, find_field(data, |
| "privKeyUsagePeriod-notBefore-hour", |
| PR_TRUE)); |
| PORT_Strcat(notBeforeStr, find_field(data, |
| "privKeyUsagePeriod-notBefore-minute", |
| PR_TRUE)); |
| PORT_Strcat(notBeforeStr, find_field(data, |
| "privKeyUsagePeriod-notBefore-second", |
| PR_TRUE)); |
| if ((*(notBeforeStr + 14) != '\0') || |
| (!isdigit(*(notBeforeStr + 13))) || |
| (*(notBeforeStr + 12) >= '5' && *(notBeforeStr + 12) <= '0') || |
| (!isdigit(*(notBeforeStr + 11))) || |
| (*(notBeforeStr + 10) >= '5' && *(notBeforeStr + 10) <= '0') || |
| (!isdigit(*(notBeforeStr + 9))) || |
| (*(notBeforeStr + 8) >= '2' && *(notBeforeStr + 8) <= '0') || |
| (!isdigit(*(notBeforeStr + 7))) || |
| (*(notBeforeStr + 6) >= '3' && *(notBeforeStr + 6) <= '0') || |
| (!isdigit(*(notBeforeStr + 5))) || |
| (*(notBeforeStr + 4) >= '1' && *(notBeforeStr + 4) <= '0') || |
| (!isdigit(*(notBeforeStr + 3))) || |
| (!isdigit(*(notBeforeStr + 2))) || |
| (!isdigit(*(notBeforeStr + 1))) || |
| (!isdigit(*(notBeforeStr + 0))) || |
| (*(notBeforeStr + 8) == '2' && *(notBeforeStr + 9) >= '4') || |
| (*(notBeforeStr + 6) == '3' && *(notBeforeStr + 7) >= '1') || |
| (*(notBeforeStr + 4) == '1' && *(notBeforeStr + 5) >= '2')) { |
| error_out("ERROR: Improperly formated private key usage period"); |
| } |
| *(notBeforeStr + 14) = 'Z'; |
| *(notBeforeStr + 15) = '\0'; |
| } else { |
| if ((*(cert->validity.notBefore.data) > '5') || |
| ((*(cert->validity.notBefore.data) == '5') && |
| (*(cert->validity.notBefore.data + 1) != '0'))) { |
| PORT_Strcat(notBeforeStr, "19"); |
| } else { |
| PORT_Strcat(notBeforeStr, "20"); |
| } |
| PORT_Strcat(notBeforeStr, (char *)cert->validity.notBefore.data); |
| } |
| } |
| if (find_field_bool(data, "privKeyUsagePeriod-radio-notAfter", PR_TRUE) || |
| find_field_bool(data, "privKeyUsagePeriod-radio-both", PR_TRUE)) { |
| pkup->notAfter.len = 15; |
| pkup->notAfter.data = (unsigned char *)notAfterStr; |
| PORT_Strcat(notAfterStr, find_field(data, "privKeyUsagePeriod-notAfter-year", |
| PR_TRUE)); |
| PORT_Strcat(notAfterStr, find_field(data, "privKeyUsagePeriod-notAfter-month", |
| PR_TRUE)); |
| PORT_Strcat(notAfterStr, find_field(data, "privKeyUsagePeriod-notAfter-day", |
| PR_TRUE)); |
| PORT_Strcat(notAfterStr, find_field(data, "privKeyUsagePeriod-notAfter-hour", |
| PR_TRUE)); |
| PORT_Strcat(notAfterStr, find_field(data, "privKeyUsagePeriod-notAfter-minute", |
| PR_TRUE)); |
| PORT_Strcat(notAfterStr, find_field(data, "privKeyUsagePeriod-notAfter-second", |
| PR_TRUE)); |
| if ((*(notAfterStr + 14) != '\0') || |
| (!isdigit(*(notAfterStr + 13))) || |
| (*(notAfterStr + 12) >= '5' && *(notAfterStr + 12) <= '0') || |
| (!isdigit(*(notAfterStr + 11))) || |
| (*(notAfterStr + 10) >= '5' && *(notAfterStr + 10) <= '0') || |
| (!isdigit(*(notAfterStr + 9))) || |
| (*(notAfterStr + 8) >= '2' && *(notAfterStr + 8) <= '0') || |
| (!isdigit(*(notAfterStr + 7))) || |
| (*(notAfterStr + 6) >= '3' && *(notAfterStr + 6) <= '0') || |
| (!isdigit(*(notAfterStr + 5))) || |
| (*(notAfterStr + 4) >= '1' && *(notAfterStr + 4) <= '0') || |
| (!isdigit(*(notAfterStr + 3))) || |
| (!isdigit(*(notAfterStr + 2))) || |
| (!isdigit(*(notAfterStr + 1))) || |
| (!isdigit(*(notAfterStr + 0))) || |
| (*(notAfterStr + 8) == '2' && *(notAfterStr + 9) >= '4') || |
| (*(notAfterStr + 6) == '3' && *(notAfterStr + 7) >= '1') || |
| (*(notAfterStr + 4) == '1' && *(notAfterStr + 5) >= '2')) { |
| error_out("ERROR: Improperly formated private key usage period"); |
| } |
| *(notAfterStr + 14) = 'Z'; |
| *(notAfterStr + 15) = '\0'; |
| } |
| |
| PORT_Assert(arena); |
| |
| rv = EncodeAndAddExtensionValue(arena, extHandle, pkup, |
| find_field_bool(data, |
| "privKeyUsagePeriod-crit", |
| PR_TRUE), |
| SEC_OID_X509_PRIVATE_KEY_USAGE_PERIOD, |
| (EXTEN_VALUE_ENCODER) |
| CERT_EncodePrivateKeyUsagePeriod); |
| PORT_FreeArena(arena, PR_FALSE); |
| PORT_Free(notBeforeStr); |
| PORT_Free(notAfterStr); |
| return (rv); |
| } |
| |
| static SECStatus |
| AddBasicConstraint(void *extHandle, |
| Pair *data) |
| { |
| CERTBasicConstraints basicConstraint; |
| SECItem encodedValue; |
| SECStatus rv; |
| |
| encodedValue.data = NULL; |
| encodedValue.len = 0; |
| basicConstraint.pathLenConstraint = CERT_UNLIMITED_PATH_CONSTRAINT; |
| basicConstraint.isCA = (find_field_bool(data, "basicConstraints-cA-radio-CA", |
| PR_TRUE)); |
| if (find_field_bool(data, "basicConstraints-pathLengthConstraint", PR_TRUE)) { |
| basicConstraint.pathLenConstraint = atoi(find_field(data, "basicConstraints-pathLengthConstraint-text", |
| PR_TRUE)); |
| } |
| |
| rv = CERT_EncodeBasicConstraintValue(NULL, &basicConstraint, |
| &encodedValue); |
| if (rv) |
| return (rv); |
| rv = CERT_AddExtension(extHandle, SEC_OID_X509_BASIC_CONSTRAINTS, |
| &encodedValue, |
| (find_field_bool(data, "basicConstraints-crit", |
| PR_TRUE)), |
| PR_TRUE); |
| |
| PORT_Free(encodedValue.data); |
| return (rv); |
| } |
| |
| static SECStatus |
| AddNscpCertType(void *extHandle, |
| Pair *data) |
| { |
| SECItem bitStringValue; |
| unsigned char CertType = 0x0; |
| |
| if (find_field_bool(data, "netscape-cert-type-ssl-client", PR_TRUE)) { |
| CertType |= (0x80 >> 0); |
| } |
| if (find_field_bool(data, "netscape-cert-type-ssl-server", PR_TRUE)) { |
| CertType |= (0x80 >> 1); |
| } |
| if (find_field_bool(data, "netscape-cert-type-smime", PR_TRUE)) { |
| CertType |= (0x80 >> 2); |
| } |
| if (find_field_bool(data, "netscape-cert-type-object-signing", PR_TRUE)) { |
| CertType |= (0x80 >> 3); |
| } |
| if (find_field_bool(data, "netscape-cert-type-reserved", PR_TRUE)) { |
| CertType |= (0x80 >> 4); |
| } |
| if (find_field_bool(data, "netscape-cert-type-ssl-ca", PR_TRUE)) { |
| CertType |= (0x80 >> 5); |
| } |
| if (find_field_bool(data, "netscape-cert-type-smime-ca", PR_TRUE)) { |
| CertType |= (0x80 >> 6); |
| } |
| if (find_field_bool(data, "netscape-cert-type-object-signing-ca", PR_TRUE)) { |
| CertType |= (0x80 >> 7); |
| } |
| |
| bitStringValue.data = &CertType; |
| bitStringValue.len = 1; |
| |
| return (CERT_EncodeAndAddBitStrExtension(extHandle, SEC_OID_NS_CERT_EXT_CERT_TYPE, &bitStringValue, |
| (find_field_bool(data, "netscape-cert-type-crit", PR_TRUE)))); |
| } |
| |
| static SECStatus |
| add_IA5StringExtension(void *extHandle, |
| char *string, |
| PRBool crit, |
| int idtag) |
| { |
| SECItem encodedValue; |
| SECStatus rv; |
| |
| encodedValue.data = NULL; |
| encodedValue.len = 0; |
| |
| rv = CERT_EncodeIA5TypeExtension(NULL, string, &encodedValue); |
| if (rv) { |
| return (rv); |
| } |
| return (CERT_AddExtension(extHandle, idtag, &encodedValue, crit, PR_TRUE)); |
| } |
| |
| static SECItem * |
| string_to_oid(char *string) |
| { |
| int i; |
| int length = 20; |
| int remaining; |
| int first_value; |
| int second_value; |
| int value; |
| int oidLength; |
| unsigned char *oidString; |
| unsigned char *write; |
| unsigned char *read; |
| unsigned char *temp; |
| SECItem *oid; |
| |
| remaining = length; |
| i = 0; |
| while (*string == ' ') { |
| string++; |
| } |
| while (isdigit(*(string + i))) { |
| i++; |
| } |
| if (*(string + i) == '.') { |
| *(string + i) = '\0'; |
| } else { |
| error_out("ERROR: Improperly formated OID"); |
| } |
| first_value = atoi(string); |
| if (first_value < 0 || first_value > 2) { |
| error_out("ERROR: Improperly formated OID"); |
| } |
| string += i + 1; |
| i = 0; |
| while (isdigit(*(string + i))) { |
| i++; |
| } |
| if (*(string + i) == '.') { |
| *(string + i) = '\0'; |
| } else { |
| error_out("ERROR: Improperly formated OID"); |
| } |
| second_value = atoi(string); |
| if (second_value < 0 || second_value > 39) { |
| error_out("ERROR: Improperly formated OID"); |
| } |
| oidString = PORT_ZAlloc(2); |
| *oidString = (first_value * 40) + second_value; |
| *(oidString + 1) = '\0'; |
| oidLength = 1; |
| string += i + 1; |
| i = 0; |
| temp = write = PORT_ZAlloc(length); |
| while (*string != '\0') { |
| value = 0; |
| while (isdigit(*(string + i))) { |
| i++; |
| } |
| if (*(string + i) == '\0') { |
| value = atoi(string); |
| string += i; |
| } else { |
| if (*(string + i) == '.') { |
| *(string + i) = '\0'; |
| value = atoi(string); |
| string += i + 1; |
| } else { |
| *(string + i) = '\0'; |
| i++; |
| value = atoi(string); |
| while (*(string + i) == ' ') |
| i++; |
| if (*(string + i) != '\0') { |
| error_out("ERROR: Improperly formated OID"); |
| } |
| } |
| } |
| i = 0; |
| while (value != 0) { |
| if (remaining < 1) { |
| remaining += length; |
| length = length * 2; |
| temp = PORT_Realloc(temp, length); |
| write = temp + length - remaining; |
| } |
| *write = (value & 0x7f) | (0x80); |
| write++; |
| remaining--; |
| value = value >> 7; |
| } |
| *temp = *temp & (0x7f); |
| oidLength += write - temp; |
| oidString = PORT_Realloc(oidString, (oidLength + 1)); |
| read = write - 1; |
| write = oidLength + oidString - 1; |
| for (i = 0; i < (length - remaining); i++) { |
| *write = *read; |
| write--; |
| read++; |
| } |
| write = temp; |
| remaining = length; |
| } |
| *(oidString + oidLength) = '\0'; |
| oid = (SECItem *)PORT_ZAlloc(sizeof(SECItem)); |
| oid->data = oidString; |
| oid->len = oidLength; |
| PORT_Free(temp); |
| return oid; |
| } |
| |
| static SECItem * |
| string_to_ipaddress(char *string) |
| { |
| int i = 0; |
| int value; |
| int j = 0; |
| SECItem *ipaddress; |
| |
| while (*string == ' ') { |
| string++; |
| } |
| ipaddress = (SECItem *)PORT_ZAlloc(sizeof(SECItem)); |
| ipaddress->data = PORT_ZAlloc(9); |
| while (*string != '\0' && j < 8) { |
| while (isdigit(*(string + i))) { |
| i++; |
| } |
| if (*(string + i) == '.') { |
| *(string + i) = '\0'; |
| value = atoi(string); |
| string = string + i + 1; |
| i = 0; |
| } else { |
| if (*(string + i) == '\0') { |
| value = atoi(string); |
| string = string + i; |
| i = 0; |
| } else { |
| *(string + i) = '\0'; |
| while (*(string + i) == ' ') { |
| i++; |
| } |
| if (*(string + i) == '\0') { |
| value = atoi(string); |
| string = string + i; |
| i = 0; |
| } else { |
| error_out("ERROR: Improperly formated IP Address"); |
| } |
| } |
| } |
| if (value >= 0 && value < 256) { |
| *(ipaddress->data + j) = value; |
| } else { |
| error_out("ERROR: Improperly formated IP Address"); |
| } |
| j++; |
| } |
| *(ipaddress->data + j) = '\0'; |
| if (j != 4 && j != 8) { |
| error_out("ERROR: Improperly formated IP Address"); |
| } |
| ipaddress->len = j; |
| return ipaddress; |
| } |
| |
| static int |
| chr_to_hex(char c) |
| { |
| if (isdigit(c)) { |
| return c - '0'; |
| } |
| if (isxdigit(c)) { |
| return toupper(c) - 'A' + 10; |
| } |
| return -1; |
| } |
| |
| static SECItem * |
| string_to_binary(char *string) |
| { |
| SECItem *rv; |
| |
| rv = (SECItem *)PORT_ZAlloc(sizeof(SECItem)); |
| if (rv == NULL) { |
| error_allocate(); |
| } |
| rv->data = (unsigned char *)PORT_ZAlloc((PORT_Strlen(string)) / 3 + 2); |
| rv->len = 0; |
| while (*string && !isxdigit(*string)) { |
| string++; |
| } |
| while (*string) { |
| int high, low; |
| high = chr_to_hex(*string++); |
| low = chr_to_hex(*string++); |
| if (high < 0 || low < 0) { |
| error_out("ERROR: Improperly formated binary encoding"); |
| } |
| rv->data[(rv->len)++] = high << 4 | low; |
| if (*string != ':') { |
| break; |
| } |
| ++string; |
| } |
| while (*string == ' ') { |
| ++string; |
| } |
| if (*string) { |
| error_out("ERROR: Junk after binary encoding"); |
| } |
| |
| return rv; |
| } |
| |
| static SECStatus |
| MakeGeneralName(char *name, |
| CERTGeneralName *genName, |
| PLArenaPool *arena) |
| { |
| SECItem *oid; |
| SECOidData *oidData; |
| SECItem *ipaddress; |
| SECItem *temp = NULL; |
| int i; |
| int nameType; |
| PRBool binary = PR_FALSE; |
| SECStatus rv = SECSuccess; |
| PRBool nickname = PR_FALSE; |
| |
| PORT_Assert(genName); |
| PORT_Assert(arena); |
| nameType = *(name + PORT_Strlen(name) - 1) - '0'; |
| if (nameType == 0 && *(name + PORT_Strlen(name) - 2) == '1') { |
| nickname = PR_TRUE; |
| nameType = certOtherName; |
| } |
| if (nameType < 1 || nameType > 9) { |
| error_out("ERROR: Unknown General Name Type"); |
| } |
| *(name + PORT_Strlen(name) - 4) = '\0'; |
| genName->type = nameType; |
| |
| switch (genName->type) { |
| case certURI: |
| case certRFC822Name: |
| case certDNSName: { |
| genName->name.other.data = (unsigned char *)name; |
| genName->name.other.len = PORT_Strlen(name); |
| break; |
| } |
| |
| case certIPAddress: { |
| ipaddress = string_to_ipaddress(name); |
| genName->name.other.data = ipaddress->data; |
| genName->name.other.len = ipaddress->len; |
| break; |
| } |
| |
| case certRegisterID: { |
| oid = string_to_oid(name); |
| genName->name.other.data = oid->data; |
| genName->name.other.len = oid->len; |
| break; |
| } |
| |
| case certEDIPartyName: |
| case certX400Address: { |
| |
| genName->name.other.data = PORT_ArenaAlloc(arena, |
| PORT_Strlen(name) + 2); |
| if (genName->name.other.data == NULL) { |
| error_allocate(); |
| } |
| |
| PORT_Memcpy(genName->name.other.data + 2, name, PORT_Strlen(name)); |
| /* This may not be accurate for all cases. |
| For now, use this tag type */ |
| genName->name.other.data[0] = (char)(((genName->type - 1) & |
| 0x1f) | |
| 0x80); |
| genName->name.other.data[1] = (char)PORT_Strlen(name); |
| genName->name.other.len = PORT_Strlen(name) + 2; |
| break; |
| } |
| |
| case certOtherName: { |
| i = 0; |
| if (!nickname) { |
| while (!isdigit(*(name + PORT_Strlen(name) - i))) { |
| i++; |
| } |
| if (*(name + PORT_Strlen(name) - i) == '1') { |
| binary = PR_TRUE; |
| } else { |
| binary = PR_FALSE; |
| } |
| while (*(name + PORT_Strlen(name) - i) != '-') { |
| i++; |
| } |
| *(name + PORT_Strlen(name) - i - 1) = '\0'; |
| i = 0; |
| while (*(name + i) != '-') { |
| i++; |
| } |
| *(name + i - 1) = '\0'; |
| oid = string_to_oid(name + i + 2); |
| } else { |
| oidData = SECOID_FindOIDByTag(SEC_OID_NETSCAPE_NICKNAME); |
| oid = &oidData->oid; |
| while (*(name + PORT_Strlen(name) - i) != '-') { |
| i++; |
| } |
| *(name + PORT_Strlen(name) - i) = '\0'; |
| } |
| genName->name.OthName.oid.data = oid->data; |
| genName->name.OthName.oid.len = oid->len; |
| if (binary) { |
| temp = string_to_binary(name); |
| genName->name.OthName.name.data = temp->data; |
| genName->name.OthName.name.len = temp->len; |
| } else { |
| temp = (SECItem *)PORT_ZAlloc(sizeof(SECItem)); |
| if (temp == NULL) { |
| error_allocate(); |
| } |
| temp->data = (unsigned char *)name; |
| temp->len = PORT_Strlen(name); |
| SEC_ASN1EncodeItem(arena, &(genName->name.OthName.name), temp, |
| CERTIA5TypeTemplate); |
| } |
| PORT_Free(temp); |
| break; |
| } |
| |
| case certDirectoryName: { |
| CERTName *directoryName = NULL; |
| |
| directoryName = CERT_AsciiToName(name); |
| if (!directoryName) { |
| error_out("ERROR: Improperly formated alternative name"); |
| break; |
| } |
| rv = CERT_CopyName(arena, &genName->name.directoryName, |
| directoryName); |
| CERT_DestroyName(directoryName); |
| |
| break; |
| } |
| } |
| genName->l.next = &(genName->l); |
| genName->l.prev = &(genName->l); |
| return rv; |
| } |
| |
| static CERTGeneralName * |
| MakeAltName(Pair *data, |
| char *which, |
| PLArenaPool *arena) |
| { |
| CERTGeneralName *SubAltName; |
| CERTGeneralName *current; |
| CERTGeneralName *newname; |
| char *name = NULL; |
| SECStatus rv = SECSuccess; |
| int len; |
| |
| len = PORT_Strlen(which); |
| name = find_field(data, which, PR_TRUE); |
| SubAltName = current = (CERTGeneralName *)PORT_ZAlloc(sizeof(CERTGeneralName)); |
| if (current == NULL) { |
| error_allocate(); |
| } |
| while (name != NULL) { |
| |
| rv = MakeGeneralName(name, current, arena); |
| |
| if (rv != SECSuccess) { |
| break; |
| } |
| if (*(which + len - 1) < '9') { |
| *(which + len - 1) = *(which + len - 1) + 1; |
| } else { |
| if (isdigit(*(which + len - 2))) { |
| *(which + len - 2) = *(which + len - 2) + 1; |
| *(which + len - 1) = '0'; |
| } else { |
| *(which + len - 1) = '1'; |
| *(which + len) = '0'; |
| *(which + len + 1) = '\0'; |
| len++; |
| } |
| } |
| len = PORT_Strlen(which); |
| name = find_field(data, which, PR_TRUE); |
| if (name != NULL) { |
| newname = (CERTGeneralName *)PORT_ZAlloc(sizeof(CERTGeneralName)); |
| if (newname == NULL) { |
| error_allocate(); |
| } |
| current->l.next = &(newname->l); |
| newname->l.prev = &(current->l); |
| current = newname; |
| newname = NULL; |
| } else { |
| current->l.next = &(SubAltName->l); |
| SubAltName->l.prev = &(current->l); |
| } |
| } |
| if (rv == SECFailure) { |
| return NULL; |
| } |
| return SubAltName; |
| } |
| |
| static CERTNameConstraints * |
| MakeNameConstraints(Pair *data, |
| PLArenaPool *arena) |
| { |
| CERTNameConstraints *NameConstraints; |
| CERTNameConstraint *current = NULL; |
| CERTNameConstraint *last_permited = NULL; |
| CERTNameConstraint *last_excluded = NULL; |
| char *constraint = NULL; |
| char *which; |
| SECStatus rv = SECSuccess; |
| int len; |
| int i; |
| long max; |
| long min; |
| PRBool permited; |
| |
| NameConstraints = (CERTNameConstraints *)PORT_ZAlloc(sizeof(CERTNameConstraints)); |
| which = make_copy_string("NameConstraintSelect0", 25, '\0'); |
| len = PORT_Strlen(which); |
| constraint = find_field(data, which, PR_TRUE); |
| NameConstraints->permited = NameConstraints->excluded = NULL; |
| while (constraint != NULL) { |
| current = (CERTNameConstraint *)PORT_ZAlloc(sizeof(CERTNameConstraint)); |
| if (current == NULL) { |
| error_allocate(); |
| } |
| i = 0; |
| while (*(constraint + PORT_Strlen(constraint) - i) != '-') { |
| i++; |
| } |
| *(constraint + PORT_Strlen(constraint) - i - 1) = '\0'; |
| max = (long)atoi(constraint + PORT_Strlen(constraint) + 3); |
| if (max > 0) { |
| (void)SEC_ASN1EncodeInteger(arena, ¤t->max, max); |
| } |
| i = 0; |
| while (*(constraint + PORT_Strlen(constraint) - i) != '-') { |
| i++; |
| } |
| *(constraint + PORT_Strlen(constraint) - i - 1) = '\0'; |
| min = (long)atoi(constraint + PORT_Strlen(constraint) + 3); |
| (void)SEC_ASN1EncodeInteger(arena, ¤t->min, min); |
| while (*(constraint + PORT_Strlen(constraint) - i) != '-') { |
| i++; |
| } |
| *(constraint + PORT_Strlen(constraint) - i - 1) = '\0'; |
| if (*(constraint + PORT_Strlen(constraint) + 3) == 'p') { |
| permited = PR_TRUE; |
| } else { |
| permited = PR_FALSE; |
| } |
| rv = MakeGeneralName(constraint, &(current->name), arena); |
| |
| if (rv != SECSuccess) { |
| break; |
| } |
| if (*(which + len - 1) < '9') { |
| *(which + len - 1) = *(which + len - 1) + 1; |
| } else { |
| if (isdigit(*(which + len - 2))) { |
| *(which + len - 2) = *(which + len - 2) + 1; |
| *(which + len - 1) = '0'; |
| } else { |
| *(which + len - 1) = '1'; |
| *(which + len) = '0'; |
| *(which + len + 1) = '\0'; |
| len++; |
| } |
| } |
| len = PORT_Strlen(which); |
| if (permited) { |
| if (NameConstraints->permited == NULL) { |
| NameConstraints->permited = last_permited = current; |
| } |
| last_permited->l.next = &(current->l); |
| current->l.prev = &(last_permited->l); |
| last_permited = current; |
| } else { |
| if (NameConstraints->excluded == NULL) { |
| NameConstraints->excluded = last_excluded = current; |
| } |
| last_excluded->l.next = &(current->l); |
| current->l.prev = &(last_excluded->l); |
| last_excluded = current; |
| } |
| constraint = find_field(data, which, PR_TRUE); |
| if (constraint != NULL) { |
| current = (CERTNameConstraint *)PORT_ZAlloc(sizeof(CERTNameConstraint)); |
| if (current == NULL) { |
| error_allocate(); |
| } |
| } |
| } |
| if (NameConstraints->permited != NULL) { |
| last_permited->l.next = &(NameConstraints->permited->l); |
| NameConstraints->permited->l.prev = &(last_permited->l); |
| } |
| if (NameConstraints->excluded != NULL) { |
| last_excluded->l.next = &(NameConstraints->excluded->l); |
| NameConstraints->excluded->l.prev = &(last_excluded->l); |
| } |
| if (which != NULL) { |
| PORT_Free(which); |
| } |
| if (rv == SECFailure) { |
| return NULL; |
| } |
| return NameConstraints; |
| } |
| |
| static SECStatus |
| AddAltName(void *extHandle, |
| Pair *data, |
| char *issuerNameStr, |
| CERTCertDBHandle *handle, |
| int type) |
| { |
| PRBool autoIssuer = PR_FALSE; |
| PLArenaPool *arena = NULL; |
| CERTGeneralName *genName = NULL; |
| char *which = NULL; |
| char *name = NULL; |
| SECStatus rv = SECSuccess; |
| SECItem *issuersAltName = NULL; |
| CERTCertificate *issuerCert = NULL; |
| |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (arena == NULL) { |
| error_allocate(); |
| } |
| if (type == 0) { |
| which = make_copy_string("SubAltNameSelect0", 20, '\0'); |
| genName = MakeAltName(data, which, arena); |
| } else { |
| if (autoIssuer) { |
| autoIssuer = find_field_bool(data, "IssuerAltNameSourceRadio-auto", |
| PR_TRUE); |
| issuerCert = CERT_FindCertByNameString(handle, issuerNameStr); |
| rv = cert_FindExtension((*issuerCert).extensions, |
| SEC_OID_X509_SUBJECT_ALT_NAME, |
| issuersAltName); |
| if (issuersAltName == NULL) { |
| name = PORT_Alloc(PORT_Strlen((*issuerCert).subjectName) + 4); |
| PORT_Strcpy(name, (*issuerCert).subjectName); |
| PORT_Strcat(name, " - 5"); |
| } |
| } else { |
| which = make_copy_string("IssuerAltNameSelect0", 20, '\0'); |
| genName = MakeAltName(data, which, arena); |
| } |
| } |
| if (type == 0) { |
| EncodeAndAddExtensionValue(arena, extHandle, genName, |
| find_field_bool(data, "SubAltName-crit", |
| PR_TRUE), |
| SEC_OID_X509_SUBJECT_ALT_NAME, |
| (EXTEN_VALUE_ENCODER) |
| CERT_EncodeAltNameExtension); |
| |
| } else { |
| if (autoIssuer && (name == NULL)) { |
| rv = CERT_AddExtension(extHandle, SEC_OID_X509_ISSUER_ALT_NAME, issuersAltName, |
| find_field_bool(data, "IssuerAltName-crit", PR_TRUE), PR_TRUE); |
| } else { |
| EncodeAndAddExtensionValue(arena, extHandle, genName, |
| find_field_bool(data, |
| "IssuerAltName-crit", |
| PR_TRUE), |
| SEC_OID_X509_ISSUER_ALT_NAME, |
| (EXTEN_VALUE_ENCODER) |
| CERT_EncodeAltNameExtension); |
| } |
| } |
| if (which != NULL) { |
| PORT_Free(which); |
| } |
| if (issuerCert != NULL) { |
| CERT_DestroyCertificate(issuerCert); |
| } |
| return rv; |
| } |
| |
| static SECStatus |
| AddNameConstraints(void *extHandle, |
| Pair *data) |
| { |
| PLArenaPool *arena = NULL; |
| CERTNameConstraints *constraints = NULL; |
| SECStatus rv = SECSuccess; |
| |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (arena == NULL) { |
| error_allocate(); |
| } |
| constraints = MakeNameConstraints(data, arena); |
| if (constraints != NULL) { |
| EncodeAndAddExtensionValue(arena, extHandle, constraints, PR_TRUE, |
| SEC_OID_X509_NAME_CONSTRAINTS, |
| (EXTEN_VALUE_ENCODER) |
| CERT_EncodeNameConstraintsExtension); |
| } |
| if (arena != NULL) { |
| PORT_ArenaRelease(arena, NULL); |
| } |
| return rv; |
| } |
| |
| static SECStatus |
| add_extensions(CERTCertificate *subjectCert, |
| Pair *data, |
| char *issuerNameStr, |
| CERTCertDBHandle *handle) |
| { |
| void *extHandle; |
| SECStatus rv = SECSuccess; |
| |
| extHandle = CERT_StartCertExtensions(subjectCert); |
| if (extHandle == NULL) { |
| error_out("ERROR: Unable to get certificates extension handle"); |
| } |
| if (find_field_bool(data, "keyUsage", PR_TRUE)) { |
| rv = AddKeyUsage(extHandle, data); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Key Usage extension"); |
| } |
| } |
| |
| if (find_field_bool(data, "extKeyUsage", PR_TRUE)) { |
| rv = AddExtKeyUsage(extHandle, data); |
| if (SECSuccess != rv) { |
| error_out("ERROR: Unable to add Extended Key Usage extension"); |
| } |
| } |
| |
| if (find_field_bool(data, "basicConstraints", PR_TRUE)) { |
| rv = AddBasicConstraint(extHandle, data); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Basic Constraint extension"); |
| } |
| } |
| if (find_field_bool(data, "subjectKeyIdentifier", PR_TRUE)) { |
| rv = AddSubKeyID(extHandle, data, subjectCert); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Subject Key Identifier Extension"); |
| } |
| } |
| if (find_field_bool(data, "authorityKeyIdentifier", PR_TRUE)) { |
| rv = AddAuthKeyID(extHandle, data, issuerNameStr, handle); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Authority Key Identifier extension"); |
| } |
| } |
| if (find_field_bool(data, "privKeyUsagePeriod", PR_TRUE)) { |
| rv = AddPrivKeyUsagePeriod(extHandle, data, subjectCert); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Private Key Usage Period extension"); |
| } |
| } |
| if (find_field_bool(data, "SubAltName", PR_TRUE)) { |
| rv = AddAltName(extHandle, data, NULL, NULL, 0); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Subject Alternative Name extension"); |
| } |
| } |
| if (find_field_bool(data, "IssuerAltName", PR_TRUE)) { |
| rv = AddAltName(extHandle, data, issuerNameStr, handle, 1); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Issuer Alternative Name Extension"); |
| } |
| } |
| if (find_field_bool(data, "NameConstraints", PR_TRUE)) { |
| rv = AddNameConstraints(extHandle, data); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Name Constraints Extension"); |
| } |
| } |
| if (find_field_bool(data, "netscape-cert-type", PR_TRUE)) { |
| rv = AddNscpCertType(extHandle, data); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Netscape Certificate Type Extension"); |
| } |
| } |
| if (find_field_bool(data, "netscape-base-url", PR_TRUE)) { |
| rv = add_IA5StringExtension(extHandle, |
| find_field(data, "netscape-base-url-text", |
| PR_TRUE), |
| find_field_bool(data, |
| "netscape-base-url-crit", |
| PR_TRUE), |
| SEC_OID_NS_CERT_EXT_BASE_URL); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Netscape Base URL Extension"); |
| } |
| } |
| if (find_field_bool(data, "netscape-revocation-url", PR_TRUE)) { |
| rv = add_IA5StringExtension(extHandle, |
| find_field(data, |
| "netscape-revocation-url-text", |
| PR_TRUE), |
| find_field_bool(data, "netscape-revocation-url-crit", |
| PR_TRUE), |
| SEC_OID_NS_CERT_EXT_REVOCATION_URL); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Netscape Revocation URL Extension"); |
| } |
| } |
| if (find_field_bool(data, "netscape-ca-revocation-url", PR_TRUE)) { |
| rv = add_IA5StringExtension(extHandle, |
| find_field(data, |
| "netscape-ca-revocation-url-text", |
| PR_TRUE), |
| find_field_bool(data, "netscape-ca-revocation-url-crit", PR_TRUE), |
| SEC_OID_NS_CERT_EXT_CA_REVOCATION_URL); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Netscape CA Revocation URL Extension"); |
| } |
| } |
| if (find_field_bool(data, "netscape-cert-renewal-url", PR_TRUE)) { |
| rv = add_IA5StringExtension(extHandle, |
| find_field(data, |
| "netscape-cert-renewal-url-text", |
| PR_TRUE), |
| find_field_bool(data, "netscape-cert-renewal-url-crit", |
| PR_TRUE), |
| SEC_OID_NS_CERT_EXT_CERT_RENEWAL_URL); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Netscape Certificate Renewal URL Extension"); |
| } |
| } |
| if (find_field_bool(data, "netscape-ca-policy-url", PR_TRUE)) { |
| rv = add_IA5StringExtension(extHandle, |
| find_field(data, |
| "netscape-ca-policy-url-text", |
| PR_TRUE), |
| find_field_bool(data, "netscape-ca-policy-url-crit", |
| PR_TRUE), |
| SEC_OID_NS_CERT_EXT_CA_POLICY_URL); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Netscape CA Policy URL Extension"); |
| } |
| } |
| if (find_field_bool(data, "netscape-ssl-server-name", PR_TRUE)) { |
| rv = add_IA5StringExtension(extHandle, |
| find_field(data, |
| "netscape-ssl-server-name-text", |
| PR_TRUE), |
| find_field_bool(data, "netscape-ssl-server-name-crit", |
| PR_TRUE), |
| SEC_OID_NS_CERT_EXT_SSL_SERVER_NAME); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Netscape SSL Server Name Extension"); |
| } |
| } |
| if (find_field_bool(data, "netscape-comment", PR_TRUE)) { |
| rv = add_IA5StringExtension(extHandle, |
| find_field(data, "netscape-comment-text", |
| PR_TRUE), |
| find_field_bool(data, |
| "netscape-comment-crit", |
| PR_TRUE), |
| SEC_OID_NS_CERT_EXT_COMMENT); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Unable to add Netscape Comment Extension"); |
| } |
| } |
| CERT_FinishExtensions(extHandle); |
| return (rv); |
| } |
| |
| char * |
| return_dbpasswd(PK11SlotInfo *slot, PRBool retry, void *data) |
| { |
| char *rv; |
| |
| /* don't clobber our poor smart card */ |
| if (retry == PR_TRUE) { |
| return NULL; |
| } |
| rv = PORT_Alloc(4); |
| PORT_Strcpy(rv, "foo"); |
| return rv; |
| } |
| |
| SECKEYPrivateKey * |
| FindPrivateKeyFromNameStr(char *name, |
| CERTCertDBHandle *certHandle) |
| { |
| SECKEYPrivateKey *key; |
| CERTCertificate *cert; |
| CERTCertificate *p11Cert; |
| |
| /* We don't presently have a PK11 function to find a cert by |
| ** subject name. |
| ** We do have a function to find a cert in the internal slot's |
| ** cert db by subject name, but it doesn't setup the slot info. |
| ** So, this HACK works, but should be replaced as soon as we |
| ** have a function to search for certs accross slots by subject name. |
| */ |
| cert = CERT_FindCertByNameString(certHandle, name); |
| if (cert == NULL || cert->nickname == NULL) { |
| error_out("ERROR: Unable to retrieve issuers certificate"); |
| } |
| p11Cert = PK11_FindCertFromNickname(cert->nickname, NULL); |
| if (p11Cert == NULL) { |
| error_out("ERROR: Unable to retrieve issuers certificate"); |
| } |
| key = PK11_FindKeyByAnyCert(p11Cert, NULL); |
| return key; |
| } |
| |
| static SECItem * |
| SignCert(CERTCertificate *cert, |
| char *issuerNameStr, |
| Pair *data, |
| CERTCertDBHandle *handle, |
| int which_key) |
| { |
| SECItem der; |
| SECKEYPrivateKey *caPrivateKey = NULL; |
| SECStatus rv; |
| PLArenaPool *arena; |
| SECOidTag algID; |
| |
| if (which_key == 0) { |
| caPrivateKey = FindPrivateKeyFromNameStr(issuerNameStr, handle); |
| } else { |
| caPrivateKey = privkeys[which_key - 1]; |
| } |
| if (caPrivateKey == NULL) { |
| error_out("ERROR: unable to retrieve issuers key"); |
| } |
| |
| arena = cert->arena; |
| |
| algID = SEC_GetSignatureAlgorithmOidTag(caPrivateKey->keyType, |
| SEC_OID_UNKNOWN); |
| if (algID == SEC_OID_UNKNOWN) { |
| error_out("ERROR: Unknown key type for issuer."); |
| goto done; |
| } |
| |
| rv = SECOID_SetAlgorithmID(arena, &cert->signature, algID, 0); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Could not set signature algorithm id."); |
| } |
| |
| if (find_field_bool(data, "ver-1", PR_TRUE)) { |
| *(cert->version.data) = 0; |
| cert->version.len = 1; |
| } else { |
| *(cert->version.data) = 2; |
| cert->version.len = 1; |
| } |
| der.data = NULL; |
| der.len = 0; |
| (void)SEC_ASN1EncodeItem(arena, &der, cert, CERT_CertificateTemplate); |
| if (der.data == NULL) { |
| error_out("ERROR: Could not encode certificate.\n"); |
| } |
| rv = SEC_DerSignData(arena, &(cert->derCert), der.data, der.len, caPrivateKey, |
| algID); |
| if (rv != SECSuccess) { |
| error_out("ERROR: Could not sign encoded certificate data.\n"); |
| } |
| done: |
| SECKEY_DestroyPrivateKey(caPrivateKey); |
| return &(cert->derCert); |
| } |
| |
| int |
| main(int argc, char **argv) |
| { |
| int length = 500; |
| int remaining = 500; |
| int n; |
| int i; |
| int serial; |
| int chainLen; |
| int which_key; |
| char *pos; |
| #ifdef OFFLINE |
| char *form_output = "key=MIIBPTCBpzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA7" |
| "SLqjWBL9Wl11Vlg%0AaMqZCvcQOL%2FnvSqYPPRP0XZy9SoAeyWzQnBOiCm2t8H5mK7r2" |
| "jnKdAQOmfhjaJil%0A3hNVu3SekHOXF6Ze7bkWa6%2FSGVcY%2FojkydxFSgY43nd1iyd" |
| "zPQDp8WWLL%2BpVpt%2B%2B%0ATRhFtVXbF0fQI03j9h3BoTgP2lkCAwEAARYDZm9vMA0" |
| "GCSqGSIb3DQEBBAUAA4GB%0AAJ8UfRKJ0GtG%2B%2BufCC6tAfTzKrq3CTBHnom55EyXc" |
| "sAsv6WbDqI%2F0rLAPkn2Xo1r%0AnNhtMxIuj441blMt%2Fa3AGLOy5zmC7Qawt8IytvQ" |
| "ikQ1XTpTBCXevytrmLjCmlURr%0ANJryTM48WaMQHiMiJpbXCqVJC1d%2FpEWBtqvALzZ" |
| "aOOIy&subject=CN%3D%22test%22%26serial-auto%3Dtrue%26serial_value%3D%" |
| "26ver-1%3Dtrue%26ver-3%3Dfalse%26caChoiceradio-SignWithDefaultkey%3Dt" |
| "rue%26caChoiceradio-SignWithRandomChain%3Dfalse%26autoCAs%3D%26caChoi" |
| "ceradio-SignWithSpecifiedChain%3Dfalse%26manCAs%3D%26%24"; |
| #else |
| char *form_output; |
| #endif |
| char *issuerNameStr; |
| char *certName; |
| char *DBdir = DB_DIRECTORY; |
| char *prefixs[10] = { "CA#1-", "CA#2-", "CA#3-", |
| "CA#4-", "CA#5-", "CA#6-", |
| "CA#7-", "CA#8-", "CA#9-", "" }; |
| Pair *form_data; |
| CERTCertificate *cert; |
| CERTCertDBHandle *handle; |
| CERTCertificateRequest *certReq = NULL; |
| int warpmonths = 0; |
| SECItem *certDER; |
| #ifdef FILEOUT |
| FILE *outfile; |
| #endif |
| SECStatus status = SECSuccess; |
| extern char prefix[PREFIX_LEN]; |
| SEC_PKCS7ContentInfo *certChain; |
| SECItem *encodedCertChain; |
| PRBool UChain = PR_FALSE; |
| |
| progName = strrchr(argv[0], '/'); |
| progName = progName ? progName + 1 : argv[0]; |
| |
| #ifdef TEST |
| sleep(20); |
| #endif |
| SECU_ConfigDirectory(DBdir); |
| |
| PK11_SetPasswordFunc(return_dbpasswd); |
| status = NSS_InitReadWrite(DBdir); |
| if (status != SECSuccess) { |
| SECU_PrintPRandOSError(progName); |
| return -1; |
| } |
| handle = CERT_GetDefaultCertDB(); |
| |
| prefix[0] = '\0'; |
| #if !defined(OFFLINE) |
| form_output = (char *)PORT_Alloc(length); |
| if (form_output == NULL) { |
| error_allocate(); |
| } |
| pos = form_output; |
| while (feof(stdin) == 0) { |
| if (remaining <= 1) { |
| remaining += length; |
| length = length * 2; |
| form_output = PORT_Realloc(form_output, (length)); |
| if (form_output == NULL) { |
| error_allocate(); |
| } |
| pos = form_output + length - remaining; |
| } |
| n = fread(pos, 1, (size_t)(remaining - 1), stdin); |
| pos += n; |
| remaining -= n; |
| } |
| *pos = '&'; |
| pos++; |
| length = pos - form_output; |
| #else |
| length = PORT_Strlen(form_output); |
| #endif |
| #ifdef FILEOUT |
| printf("Content-type: text/plain\n\n"); |
| fwrite(form_output, 1, (size_t)length, stdout); |
| printf("\n"); |
| #endif |
| #ifdef FILEOUT |
| fwrite(form_output, 1, (size_t)length, stdout); |
| printf("\n"); |
| fflush(stdout); |
| #endif |
| form_data = make_datastruct(form_output, length); |
| status = clean_input(form_data); |
| #if !defined(OFFLINE) |
| PORT_Free(form_output); |
| #endif |
| #ifdef FILEOUT |
| i = 0; |
| while (return_name(form_data, i) != NULL) { |
| printf("%s", return_name(form_data, i)); |
| printf("=\n"); |
| printf("%s", return_data(form_data, i)); |
| printf("\n"); |
| i++; |
| } |
| printf("I got that done, woo hoo\n"); |
| fflush(stdout); |
| #endif |
| issuerNameStr = PORT_Alloc(200); |
| if (find_field_bool(form_data, "caChoiceradio-SignWithSpecifiedChain", |
| PR_FALSE)) { |
| UChain = PR_TRUE; |
| chainLen = atoi(find_field(form_data, "manCAs", PR_FALSE)); |
| PORT_Strcpy(prefix, prefixs[0]); |
| issuerNameStr = PORT_Strcpy(issuerNameStr, |
| "CN=Cert-O-Matic II, O=Cert-O-Matic II"); |
| if (chainLen == 0) { |
| UChain = PR_FALSE; |
| } |
| } else { |
| if (find_field_bool(form_data, "caChoiceradio-SignWithRandomChain", |
| PR_FALSE)) { |
| PORT_Strcpy(prefix, prefixs[9]); |
| chainLen = atoi(find_field(form_data, "autoCAs", PR_FALSE)); |
| if (chainLen < 1 || chainLen > 18) { |
| issuerNameStr = PORT_Strcpy(issuerNameStr, |
| "CN=CA18, O=Cert-O-Matic II"); |
| } |
| issuerNameStr = PORT_Strcpy(issuerNameStr, "CN=CA"); |
| issuerNameStr = PORT_Strcat(issuerNameStr, |
| find_field(form_data, "autoCAs", PR_FALSE)); |
| issuerNameStr = PORT_Strcat(issuerNameStr, ", O=Cert-O-Matic II"); |
| } else { |
| issuerNameStr = PORT_Strcpy(issuerNameStr, |
| "CN=Cert-O-Matic II, O=Cert-O-Matic II"); |
| } |
| chainLen = 0; |
| } |
| |
| i = -1; |
| which_key = 0; |
| do { |
| extern SECStatus cert_GetKeyID(CERTCertificate * cert); |
| i++; |
| if (i != 0 && UChain) { |
| PORT_Strcpy(prefix, prefixs[i]); |
| } |
| /* find_field(form_data,"subject", PR_TRUE); */ |
| certReq = makeCertReq(form_data, which_key); |
| #ifdef OFFLINE |
| serial = 900; |
| #else |
| serial = get_serial_number(form_data); |
| #endif |
| cert = MakeV1Cert(handle, certReq, issuerNameStr, PR_FALSE, |
| serial, warpmonths, form_data); |
| if (certReq != NULL) { |
| CERT_DestroyCertificateRequest(certReq); |
| } |
| if (find_field_bool(form_data, "ver-3", PR_TRUE)) { |
| status = add_extensions(cert, form_data, issuerNameStr, handle); |
| if (status != SECSuccess) { |
| error_out("ERROR: Unable to add extensions"); |
| } |
| } |
| status = cert_GetKeyID(cert); |
| if (status == SECFailure) { |
| error_out("ERROR: Unable to get Key ID."); |
| } |
| certDER = SignCert(cert, issuerNameStr, form_data, handle, which_key); |
| CERT_NewTempCertificate(handle, certDER, NULL, PR_FALSE, PR_TRUE); |
| issuerNameStr = find_field(form_data, "subject", PR_TRUE); |
| /* SECITEM_FreeItem(certDER, PR_TRUE); */ |
| CERT_DestroyCertificate(cert); |
| if (i == (chainLen - 1)) { |
| i = 8; |
| } |
| ++which_key; |
| } while (i < 9 && UChain); |
| |
| #ifdef FILEOUT |
| outfile = fopen("../certout", "wb"); |
| #endif |
| certName = find_field(form_data, "subject", PR_FALSE); |
| cert = CERT_FindCertByNameString(handle, certName); |
| certChain = SEC_PKCS7CreateCertsOnly(cert, PR_TRUE, handle); |
| if (certChain == NULL) { |
| error_out("ERROR: No certificates in cert chain"); |
| } |
| encodedCertChain = SEC_PKCS7EncodeItem(NULL, NULL, certChain, NULL, NULL, |
| NULL); |
| if (encodedCertChain) { |
| #if !defined(FILEOUT) |
| printf("Content-type: application/x-x509-user-cert\r\n"); |
| printf("Content-length: %d\r\n\r\n", encodedCertChain->len); |
| fwrite(encodedCertChain->data, 1, encodedCertChain->len, stdout); |
| #else |
| fwrite(encodedCertChain->data, 1, encodedCertChain->len, outfile); |
| #endif |
| |
| } else { |
| error_out("Error: Unable to DER encode certificate"); |
| } |
| #ifdef FILEOUT |
| printf("\nI got here!\n"); |
| fflush(outfile); |
| fclose(outfile); |
| #endif |
| fflush(stdout); |
| if (NSS_Shutdown() != SECSuccess) { |
| exit(1); |
| } |
| return 0; |
| } |
