OpenSSL 0.9.5 merge

*warning* this bumps shared lib minors for libssl and libcrypto from 2.1 to 2.2
if you are using the ssl26 packages for ssh and other things to work you will
need to get new ones (see ~beck/libsslsnap/<arch>) on cvs or ~beck/src-patent.tar.gz on cvs

1 files changed, 164 insertions, 1 deletions

diff --git a/src/lib/libcrypto/x509/x509_req.c b/src/lib/libcrypto/x509/x509_req.c
index 2ef94decd1..baef8790eb 100644
--- a/src/lib/libcrypto/x509/x509_req.c
+++ b/src/lib/libcrypto/x509/x509_req.c
@@ -66,7 +66,7 @@
 #include <openssl/buffer.h>
 #include <openssl/pem.h>
 
-X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, EVP_MD *md)
+X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
         {
         X509_REQ *ret;
         X509_REQ_INFO *ri;
@@ -113,3 +113,166 @@ EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
         return(X509_PUBKEY_get(req->req_info->pubkey));
         }
 
+/* It seems several organisations had the same idea of including a list of
+ * extensions in a certificate request. There are at least two OIDs that are
+ * used and there may be more: so the list is configurable.
+ */
+
+static int ext_nid_list[] = { NID_ms_ext_req, NID_ext_req, NID_undef};
+
+static int *ext_nids = ext_nid_list;
+
+int X509_REQ_extension_nid(int req_nid)
+{
+        int i, nid;
+        for(i = 0; ; i++) {
+                nid = ext_nids[i];
+                if(nid == NID_undef) return 0;
+                else if (req_nid == nid) return 1;
+        }
+}
+
+int *X509_REQ_get_extension_nids(void)
+{
+        return ext_nids;
+}
+        
+void X509_REQ_set_extension_nids(int *nids)
+{
+        ext_nids = nids;
+}
+
+STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
+{
+        X509_ATTRIBUTE *attr;
+        STACK_OF(X509_ATTRIBUTE) *sk;
+        ASN1_TYPE *ext = NULL;
+        int i;
+        unsigned char *p;
+        if ((req == NULL) || (req->req_info == NULL))
+                return(NULL);
+        sk=req->req_info->attributes;
+        if (!sk) return NULL;
+        for(i = 0; i < sk_X509_ATTRIBUTE_num(sk); i++) {
+                attr = sk_X509_ATTRIBUTE_value(sk, i);
+                if(X509_REQ_extension_nid(OBJ_obj2nid(attr->object))) {
+                        if(attr->set && sk_ASN1_TYPE_num(attr->value.set))
+                                ext = sk_ASN1_TYPE_value(attr->value.set, 0);
+                        else ext = attr->value.single;
+                        break;
+                }
+        }
+        if(!ext || (ext->type != V_ASN1_SEQUENCE)) return NULL;
+        p = ext->value.sequence->data;
+        return d2i_ASN1_SET_OF_X509_EXTENSION(NULL, &p,
+                        ext->value.sequence->length,
+                        d2i_X509_EXTENSION, X509_EXTENSION_free,
+                        V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
+}
+
+/* Add a STACK_OF extensions to a certificate request: allow alternative OIDs
+ * in case we want to create a non standard one.
+ */
+
+int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
+                                int nid)
+{
+        unsigned char *p = NULL, *q;
+        long len;
+        ASN1_TYPE *at = NULL;
+        X509_ATTRIBUTE *attr = NULL;
+        if(!(at = ASN1_TYPE_new()) ||
+                !(at->value.sequence = ASN1_STRING_new())) goto err;
+
+        at->type = V_ASN1_SEQUENCE;
+        /* Generate encoding of extensions */
+        len = i2d_ASN1_SET_OF_X509_EXTENSION(exts, NULL, i2d_X509_EXTENSION,
+                        V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, IS_SEQUENCE);
+        if(!(p = Malloc(len))) goto err;
+        q = p;
+        i2d_ASN1_SET_OF_X509_EXTENSION(exts, &q, i2d_X509_EXTENSION,
+                        V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, IS_SEQUENCE);
+        at->value.sequence->data = p;
+        p = NULL;
+        at->value.sequence->length = len;
+        if(!(attr = X509_ATTRIBUTE_new())) goto err;
+        if(!(attr->value.set = sk_ASN1_TYPE_new_null())) goto err;
+        if(!sk_ASN1_TYPE_push(attr->value.set, at)) goto err;
+        at = NULL;
+        attr->set = 1;
+        attr->object = OBJ_nid2obj(nid);
+        if(!sk_X509_ATTRIBUTE_push(req->req_info->attributes, attr)) goto err;
+        return 1;
+        err:
+        if(p) Free(p);
+        X509_ATTRIBUTE_free(attr);
+        ASN1_TYPE_free(at);
+        return 0;
+}
+/* This is the normal usage: use the "official" OID */
+int X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts)
+{
+        return X509_REQ_add_extensions_nid(req, exts, NID_ext_req);
+}
+
+/* Request attribute functions */
+
+int X509_REQ_get_attr_count(const X509_REQ *req)
+{
+        return X509at_get_attr_count(req->req_info->attributes);
+}
+
+int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid,
+                          int lastpos)
+{
+        return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
+}
+
+int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj,
+                          int lastpos)
+{
+        return X509at_get_attr_by_OBJ(req->req_info->attributes, obj, lastpos);
+}
+
+X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc)
+{
+        return X509at_get_attr(req->req_info->attributes, loc);
+}
+
+X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc)
+{
+        return X509at_delete_attr(req->req_info->attributes, loc);
+}
+
+int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr)
+{
+        if(X509at_add1_attr(&req->req_info->attributes, attr)) return 1;
+        return 0;
+}
+
+int X509_REQ_add1_attr_by_OBJ(X509_REQ *req,
+                        ASN1_OBJECT *obj, int type,
+                        unsigned char *bytes, int len)
+{
+        if(X509at_add1_attr_by_OBJ(&req->req_info->attributes, obj,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+int X509_REQ_add1_attr_by_NID(X509_REQ *req,
+                        int nid, int type,
+                        unsigned char *bytes, int len)
+{
+        if(X509at_add1_attr_by_NID(&req->req_info->attributes, nid,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+int X509_REQ_add1_attr_by_txt(X509_REQ *req,
+                        char *attrname, int type,
+                        unsigned char *bytes, int len)
+{
+        if(X509at_add1_attr_by_txt(&req->req_info->attributes, attrname,
+                                type, bytes, len)) return 1;
+        return 0;
+}