OpenSSL 0.9.5 merge

*warning* this bumps shared lib minors for libssl and libcrypto from 2.1 to 2.2
if you are using the ssl26 packages for ssh and other things to work you will
need to get new ones (see ~beck/libsslsnap/<arch>) on cvs or ~beck/src-patent.tar.gz on cvs

1 files changed, 247 insertions, 164 deletions

diff --git a/src/lib/libssl/src/apps/req.c b/src/lib/libssl/src/apps/req.c
index 463ac156ea..97bb0d0ed8 100644
--- a/src/lib/libssl/src/apps/req.c
+++ b/src/lib/libssl/src/apps/req.c
@@ -66,7 +66,6 @@
 #include "apps.h"
 #include <openssl/bio.h>
 #include <openssl/evp.h>
-#include <openssl/rand.h>
 #include <openssl/conf.h>
 #include <openssl/err.h>
 #include <openssl/asn1.h>
@@ -79,9 +78,12 @@
 
 #define BITS            "default_bits"
 #define KEYFILE         "default_keyfile"
+#define PROMPT          "prompt"
 #define DISTINGUISHED_NAME      "distinguished_name"
 #define ATTRIBUTES      "attributes"
 #define V3_EXTENSIONS   "x509_extensions"
+#define REQ_EXTENSIONS  "req_extensions"
+#define STRING_MASK     "string_mask"
 
 #define DEFAULT_KEY_LENGTH      512
 #define MIN_KEY_LENGTH          384
@@ -89,7 +91,7 @@
 #undef PROG
 #define PROG    req_main
 
-/* -inform arg  - input format - default PEM (one of DER, TXT or PEM)
+/* -inform arg  - input format - default PEM (DER or PEM)
  * -outform arg - output format - default PEM
  * -in arg      - input file - default stdin
  * -out arg     - output file - default stdout
@@ -108,13 +110,20 @@
  */
 
 static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,int attribs);
-static int add_attribute_object(STACK_OF(X509_ATTRIBUTE) *n, char *text,
+static int prompt_info(X509_REQ *req,
+                STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect,
+                STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs);
+static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk,
+                                STACK_OF(CONF_VALUE) *attr, int attribs);
+static int add_attribute_object(X509_REQ *req, char *text,
                                 char *def, char *value, int nid, int min,
                                 int max);
 static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
         int nid,int min,int max);
+#ifndef NO_RSA
 static void MS_CALLBACK req_cb(int p,int n,void *arg);
-static int req_fix_data(int nid,int *type,int len,int min,int max);
+#endif
+static int req_check_len(int len,int min,int max);
 static int check_end(char *str, char *end);
 static int add_oid_section(LHASH *conf);
 #ifndef MONOLITH
@@ -127,6 +136,8 @@ static LHASH *req_conf=NULL;
 #define TYPE_DSA        2
 #define TYPE_DH         3
 
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
         {
 #ifndef NO_DSA
@@ -139,17 +150,21 @@ int MAIN(int argc, char **argv)
         int i,badops=0,newreq=0,newkey= -1,pkey_type=0;
         BIO *in=NULL,*out=NULL;
         int informat,outformat,verify=0,noout=0,text=0,keyform=FORMAT_PEM;
-        int nodes=0,kludge=0;
+        int nodes=0,kludge=0,newhdr=0;
         char *infile,*outfile,*prog,*keyfile=NULL,*template=NULL,*keyout=NULL;
         char *extensions = NULL;
+        char *req_exts = NULL;
         EVP_CIPHER *cipher=NULL;
         int modulus=0;
+        char *passargin = NULL, *passargout = NULL;
+        char *passin = NULL, *passout = NULL;
         char *p;
         const EVP_MD *md_alg=NULL,*digest=EVP_md5();
 #ifndef MONOLITH
         MS_STATIC char config_name[256];
 #endif
 
+        req_conf = NULL;
 #ifndef NO_DES
         cipher=EVP_des_ede3_cbc();
 #endif
@@ -214,6 +229,16 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         keyout= *(++argv);
                         }
+                else if (strcmp(*argv,"-passin") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargin= *(++argv);
+                        }
+                else if (strcmp(*argv,"-passout") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargout= *(++argv);
+                        }
                 else if (strcmp(*argv,"-newkey") == 0)
                         {
                         int is_numeric;
@@ -281,6 +306,8 @@ int MAIN(int argc, char **argv)
 
                         newreq=1;
                         }
+                else if (strcmp(*argv,"-newhdr") == 0)
+                        newhdr=1;
                 else if (strcmp(*argv,"-modulus") == 0)
                         modulus=1;
                 else if (strcmp(*argv,"-verify") == 0)
@@ -308,8 +335,17 @@ int MAIN(int argc, char **argv)
                         /* ok */
                         digest=md_alg;
                         }
+                else if (strcmp(*argv,"-extensions") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        extensions = *(++argv);
+                        }
+                else if (strcmp(*argv,"-reqexts") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        req_exts = *(++argv);
+                        }
                 else
-
                         {
                         BIO_printf(bio_err,"unknown option %s\n",*argv);
                         badops=1;
@@ -324,8 +360,8 @@ int MAIN(int argc, char **argv)
 bad:
                 BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
                 BIO_printf(bio_err,"where options  are\n");
-                BIO_printf(bio_err," -inform arg    input format - one of DER TXT PEM\n");
-                BIO_printf(bio_err," -outform arg   output format - one of DER TXT PEM\n");
+                BIO_printf(bio_err," -inform arg    input format - DER or PEM\n");
+                BIO_printf(bio_err," -outform arg   output format - DER or PEM\n");
                 BIO_printf(bio_err," -in arg        input file\n");
                 BIO_printf(bio_err," -out arg       output file\n");
                 BIO_printf(bio_err," -text          text form of request\n");
@@ -344,16 +380,21 @@ bad:
                 BIO_printf(bio_err," -new           new request.\n");
                 BIO_printf(bio_err," -x509          output a x509 structure instead of a cert. req.\n");
                 BIO_printf(bio_err," -days          number of days a x509 generated by -x509 is valid for.\n");
+                BIO_printf(bio_err," -newhdr        output \"NEW\" in the header lines\n");
                 BIO_printf(bio_err," -asn1-kludge   Output the 'request' in a format that is wrong but some CA's\n");
                 BIO_printf(bio_err,"                have been reported as requiring\n");
-                BIO_printf(bio_err,"                [ It is now always turned on but can be turned off with -no-asn1-kludge ]\n");
+                BIO_printf(bio_err," -extensions .. specify certificate extension section (override value in config file)\n");
+                BIO_printf(bio_err," -reqexts ..    specify request extension section (override value in config file)\n");
                 goto end;
                 }
 
         ERR_load_crypto_strings();
-        X509V3_add_standard_extensions();
+        if(!app_passwd(bio_err, passargin, passargout, &passin, &passout)) {
+                BIO_printf(bio_err, "Error getting passwords\n");
+                goto end;
+        }
 
-#ifndef MONOLITH
+#ifndef MONOLITH /* else this has happened in openssl.c (global `config') */
         /* Lets load up our environment a little */
         p=getenv("OPENSSL_CONF");
         if (p == NULL)
@@ -367,7 +408,7 @@ bad:
                 strcat(config_name,OPENSSL_CONF);
                 p=config_name;
                 }
-        default_config_file=p;
+        default_config_file=p;
         config=CONF_load(config,p,NULL);
 #endif
 
@@ -425,7 +466,8 @@ bad:
                         digest=md_alg;
                 }
 
-        extensions = CONF_get_string(req_conf, SECTION, V3_EXTENSIONS);
+        if(!extensions)
+                extensions = CONF_get_string(req_conf, SECTION, V3_EXTENSIONS);
         if(extensions) {
                 /* Check syntax of file */
                 X509V3_CTX ctx;
@@ -438,6 +480,34 @@ bad:
                 }
         }
 
+        if(!passin)
+                passin = CONF_get_string(req_conf, SECTION, "input_password");
+
+        if(!passout)
+                passout = CONF_get_string(req_conf, SECTION, "output_password");
+
+        p = CONF_get_string(req_conf, SECTION, STRING_MASK);
+
+        if(p && !ASN1_STRING_set_default_mask_asc(p)) {
+                BIO_printf(bio_err, "Invalid global string mask setting %s\n", p);
+                goto end;
+        }
+
+        if(!req_exts)
+                req_exts = CONF_get_string(req_conf, SECTION, REQ_EXTENSIONS);
+        if(req_exts) {
+                /* Check syntax of file */
+                X509V3_CTX ctx;
+                X509V3_set_ctx_test(&ctx);
+                X509V3_set_conf_lhash(&ctx, req_conf);
+                if(!X509V3_EXT_add_conf(req_conf, &ctx, req_exts, NULL)) {
+                        BIO_printf(bio_err,
+                         "Error Loading request extension section %s\n",
+                                                                req_exts);
+                        goto end;
+                }
+        }
+
         in=BIO_new(BIO_s_file());
         out=BIO_new(BIO_s_file());
         if ((in == NULL) || (out == NULL))
@@ -451,11 +521,12 @@ bad:
                         goto end;
                         }
 
-/*              if (keyform == FORMAT_ASN1)
-                        rsa=d2i_RSAPrivateKey_bio(in,NULL);
-                else */
-                if (keyform == FORMAT_PEM)
-                        pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,NULL);
+                if (keyform == FORMAT_ASN1)
+                        pkey=d2i_PrivateKey_bio(in,NULL);
+                else if (keyform == FORMAT_PEM)
+                        {
+                        pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,passin);
+                        }
                 else
                         {
                         BIO_printf(bio_err,"bad input format specified for X509 request\n");
@@ -471,25 +542,9 @@ bad:
 
         if (newreq && (pkey == NULL))
                 {
-                char *randfile;
-                char buffer[200];
-
-                if ((randfile=CONF_get_string(req_conf,SECTION,"RANDFILE")) == NULL)
-                        randfile=RAND_file_name(buffer,200);
-#ifdef WINDOWS
-                BIO_printf(bio_err,"Loading 'screen' into random state -");
-                BIO_flush(bio_err);
-                RAND_screen();
-                BIO_printf(bio_err," done\n");
-#endif
-                if ((randfile == NULL) || !RAND_load_file(randfile,1024L*1024L))
-                        {
-                        BIO_printf(bio_err,"unable to load 'random state'\n");
-                        BIO_printf(bio_err,"What this means is that the random number generator has not been seeded\n");
-                        BIO_printf(bio_err,"with much random data.\n");
-                        BIO_printf(bio_err,"Consider setting the RANDFILE environment variable to point at a file that\n");
-                        BIO_printf(bio_err,"'random' data can be kept in.\n");
-                        }
+                char *randfile = CONF_get_string(req_conf,SECTION,"RANDFILE");
+                app_RAND_load_file(randfile, bio_err, 0);
+        
                 if (newkey <= 0)
                         {
                         newkey=(int)CONF_get_number(req_conf,SECTION,BITS);
@@ -527,8 +582,7 @@ bad:
                         }
 #endif
 
-                if ((randfile == NULL) || (RAND_write_file(randfile) == 0))
-                        BIO_printf(bio_err,"unable to write 'random state'\n");
+                app_RAND_write_file(randfile, bio_err);
 
                 if (pkey == NULL) goto end;
 
@@ -560,7 +614,7 @@ bad:
                 i=0;
 loop:
                 if (!PEM_write_bio_PrivateKey(out,pkey,cipher,
-                        NULL,0,NULL,NULL))
+                        NULL,0,NULL,passout))
                         {
                         if ((ERR_GET_REASON(ERR_peek_error()) ==
                                 PEM_R_PROBLEMS_GETTING_PASSWORD) && (i < 3))
@@ -677,6 +731,22 @@ loop:
                         }
                 else
                         {
+                        X509V3_CTX ext_ctx;
+
+                        /* Set up V3 context struct */
+
+                        X509V3_set_ctx(&ext_ctx, NULL, NULL, req, NULL, 0);
+                        X509V3_set_conf_lhash(&ext_ctx, req_conf);
+
+                        /* Add extensions */
+                        if(req_exts && !X509V3_EXT_REQ_add_conf(req_conf, 
+                                        &ext_ctx, req_exts, req))
+                            {
+                            BIO_printf(bio_err,
+                                       "Error Loading extension section %s\n",
+                                       req_exts);
+                            goto end;
+                            }
                         if (!(i=X509_REQ_sign(req,pkey,digest)))
                                 goto end;
                         }
@@ -767,9 +837,10 @@ loop:
                 {
                 if      (outformat == FORMAT_ASN1)
                         i=i2d_X509_REQ_bio(out,req);
-                else if (outformat == FORMAT_PEM)
-                        i=PEM_write_bio_X509_REQ(out,req);
-                else    {
+                else if (outformat == FORMAT_PEM) {
+                        if(newhdr) i=PEM_write_bio_X509_REQ_NEW(out,req);
+                        else i=PEM_write_bio_X509_REQ(out,req);
+                } else {
                         BIO_printf(bio_err,"bad output format specified for outfile\n");
                         goto end;
                         }
@@ -807,7 +878,8 @@ end:
         EVP_PKEY_free(pkey);
         X509_REQ_free(req);
         X509_free(x509ss);
-        X509V3_EXT_cleanup();
+        if(passin) Free(passin);
+        if(passout) Free(passout);
         OBJ_cleanup();
 #ifndef NO_DSA
         if (dsa_params != NULL) DSA_free(dsa_params);
@@ -818,43 +890,67 @@ end:
 static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, int attribs)
         {
         int ret=0,i;
-        char *p,*q;
-        X509_REQ_INFO *ri;
-        char buf[100];
-        int nid,min,max;
-        char *type,*def,*tmp,*value,*tmp_attr;
-        STACK_OF(CONF_VALUE) *sk, *attr=NULL;
-        CONF_VALUE *v;
-        
-        tmp=CONF_get_string(req_conf,SECTION,DISTINGUISHED_NAME);
-        if (tmp == NULL)
+        char no_prompt = 0;
+        STACK_OF(CONF_VALUE) *dn_sk, *attr_sk = NULL;
+        char *tmp, *dn_sect,*attr_sect;
+
+        tmp=CONF_get_string(req_conf,SECTION,PROMPT);
+        if((tmp != NULL) && !strcmp(tmp, "no")) no_prompt = 1;
+
+        dn_sect=CONF_get_string(req_conf,SECTION,DISTINGUISHED_NAME);
+        if (dn_sect == NULL)
                 {
                 BIO_printf(bio_err,"unable to find '%s' in config\n",
                         DISTINGUISHED_NAME);
                 goto err;
                 }
-        sk=CONF_get_section(req_conf,tmp);
-        if (sk == NULL)
+        dn_sk=CONF_get_section(req_conf,dn_sect);
+        if (dn_sk == NULL)
                 {
-                BIO_printf(bio_err,"unable to get '%s' section\n",tmp);
+                BIO_printf(bio_err,"unable to get '%s' section\n",dn_sect);
                 goto err;
                 }
 
-        tmp_attr=CONF_get_string(req_conf,SECTION,ATTRIBUTES);
-        if (tmp_attr == NULL)
-                attr=NULL;
+        attr_sect=CONF_get_string(req_conf,SECTION,ATTRIBUTES);
+        if (attr_sect == NULL)
+                attr_sk=NULL;
         else
                 {
-                attr=CONF_get_section(req_conf,tmp_attr);
-                if (attr == NULL)
+                attr_sk=CONF_get_section(req_conf,attr_sect);
+                if (attr_sk == NULL)
                         {
-                        BIO_printf(bio_err,"unable to get '%s' section\n",tmp_attr);
+                        BIO_printf(bio_err,"unable to get '%s' section\n",attr_sect);
                         goto err;
                         }
                 }
 
-        ri=req->req_info;
+        /* setup version number */
+        if (!X509_REQ_set_version(req,0L)) goto err; /* version 1 */
+
+        if(no_prompt) i = auto_info(req, dn_sk, attr_sk, attribs);
+        else i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs);
+        if(!i) goto err;
+
+        X509_REQ_set_pubkey(req,pkey);
 
+        ret=1;
+err:
+        return(ret);
+        }
+
+
+static int prompt_info(X509_REQ *req,
+                STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect,
+                STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs)
+        {
+        int i;
+        char *p,*q;
+        char buf[100];
+        int nid,min,max;
+        char *type,*def,*value;
+        CONF_VALUE *v;
+        X509_NAME *subj;
+        subj = X509_REQ_get_subject_name(req);
         BIO_printf(bio_err,"You are about to be asked to enter information that will be incorporated\n");
         BIO_printf(bio_err,"into your certificate request.\n");
         BIO_printf(bio_err,"What you are about to enter is what is called a Distinguished Name or a DN.\n");
@@ -863,18 +959,16 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, int attribs)
         BIO_printf(bio_err,"If you enter '.', the field will be left blank.\n");
         BIO_printf(bio_err,"-----\n");
 
-        /* setup version number */
-        if (!ASN1_INTEGER_set(ri->version,0L)) goto err; /* version 1 */
 
-        if (sk_CONF_VALUE_num(sk))
+        if (sk_CONF_VALUE_num(dn_sk))
                 {
                 i= -1;
 start:          for (;;)
                         {
                         i++;
-                        if (sk_CONF_VALUE_num(sk) <= i) break;
+                        if (sk_CONF_VALUE_num(dn_sk) <= i) break;
 
-                        v=sk_CONF_VALUE_value(sk,i);
+                        v=sk_CONF_VALUE_value(dn_sk,i);
                         p=q=NULL;
                         type=v->name;
                         if(!check_end(type,"_min") || !check_end(type,"_max") ||
@@ -893,32 +987,32 @@ start:		for (;;)
                         /* If OBJ not recognised ignore it */
                         if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start;
                         sprintf(buf,"%s_default",v->name);
-                        if ((def=CONF_get_string(req_conf,tmp,buf)) == NULL)
+                        if ((def=CONF_get_string(req_conf,dn_sect,buf)) == NULL)
                                 def="";
                                 
                         sprintf(buf,"%s_value",v->name);
-                        if ((value=CONF_get_string(req_conf,tmp,buf)) == NULL)
+                        if ((value=CONF_get_string(req_conf,dn_sect,buf)) == NULL)
                                 value=NULL;
 
                         sprintf(buf,"%s_min",v->name);
-                        min=(int)CONF_get_number(req_conf,tmp,buf);
+                        min=(int)CONF_get_number(req_conf,dn_sect,buf);
 
                         sprintf(buf,"%s_max",v->name);
-                        max=(int)CONF_get_number(req_conf,tmp,buf);
+                        max=(int)CONF_get_number(req_conf,dn_sect,buf);
 
-                        if (!add_DN_object(ri->subject,v->value,def,value,nid,
+                        if (!add_DN_object(subj,v->value,def,value,nid,
                                 min,max))
-                                goto err;
+                                return 0;
                         }
-                if (sk_X509_NAME_ENTRY_num(ri->subject->entries) == 0)
+                if (X509_NAME_entry_count(subj) == 0)
                         {
                         BIO_printf(bio_err,"error, no objects specified in config file\n");
-                        goto err;
+                        return 0;
                         }
 
                 if (attribs)
                         {
-                        if ((attr != NULL) && (sk_CONF_VALUE_num(attr) > 0))
+                        if ((attr_sk != NULL) && (sk_CONF_VALUE_num(attr_sk) > 0))
                                 {
                                 BIO_printf(bio_err,"\nPlease enter the following 'extra' attributes\n");
                                 BIO_printf(bio_err,"to be sent with your certificate request\n");
@@ -928,57 +1022,101 @@ start:		for (;;)
 start2:                 for (;;)
                                 {
                                 i++;
-                                if ((attr == NULL) ||
-                                            (sk_CONF_VALUE_num(attr) <= i))
+                                if ((attr_sk == NULL) ||
+                                            (sk_CONF_VALUE_num(attr_sk) <= i))
                                         break;
 
-                                v=sk_CONF_VALUE_value(attr,i);
+                                v=sk_CONF_VALUE_value(attr_sk,i);
                                 type=v->name;
                                 if ((nid=OBJ_txt2nid(type)) == NID_undef)
                                         goto start2;
 
                                 sprintf(buf,"%s_default",type);
-                                if ((def=CONF_get_string(req_conf,tmp_attr,buf))
+                                if ((def=CONF_get_string(req_conf,attr_sect,buf))
                                         == NULL)
                                         def="";
                                 
                                 sprintf(buf,"%s_value",type);
-                                if ((value=CONF_get_string(req_conf,tmp_attr,buf))
+                                if ((value=CONF_get_string(req_conf,attr_sect,buf))
                                         == NULL)
                                         value=NULL;
 
                                 sprintf(buf,"%s_min",type);
-                                min=(int)CONF_get_number(req_conf,tmp_attr,buf);
+                                min=(int)CONF_get_number(req_conf,attr_sect,buf);
 
                                 sprintf(buf,"%s_max",type);
-                                max=(int)CONF_get_number(req_conf,tmp_attr,buf);
+                                max=(int)CONF_get_number(req_conf,attr_sect,buf);
 
-                                if (!add_attribute_object(ri->attributes,
+                                if (!add_attribute_object(req,
                                         v->value,def,value,nid,min,max))
-                                        goto err;
+                                        return 0;
                                 }
                         }
                 }
         else
                 {
                 BIO_printf(bio_err,"No template, please set one up.\n");
-                goto err;
+                return 0;
                 }
 
-        X509_REQ_set_pubkey(req,pkey);
+        return 1;
 
-        ret=1;
-err:
-        return(ret);
         }
 
+static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk,
+                        STACK_OF(CONF_VALUE) *attr_sk, int attribs)
+        {
+        int i;
+        char *p,*q;
+        char *type;
+        CONF_VALUE *v;
+        X509_NAME *subj;
+
+        subj = X509_REQ_get_subject_name(req);
+
+        for (i = 0; i < sk_CONF_VALUE_num(dn_sk); i++)
+                {
+                v=sk_CONF_VALUE_value(dn_sk,i);
+                p=q=NULL;
+                type=v->name;
+                /* Skip past any leading X. X: X, etc to allow for
+                 * multiple instances 
+                 */
+                for(p = v->name; *p ; p++) 
+                        if ((*p == ':') || (*p == ',') || (*p == '.')) {
+                                p++;
+                                if(*p) type = p;
+                                break;
+                        }
+                if (!X509_NAME_add_entry_by_txt(subj,type, MBSTRING_ASC,
+                                (unsigned char *) v->value,-1,-1,0)) return 0;
+
+                }
+
+                if (!X509_NAME_entry_count(subj))
+                        {
+                        BIO_printf(bio_err,"error, no objects specified in config file\n");
+                        return 0;
+                        }
+                if (attribs)
+                        {
+                        for (i = 0; i < sk_CONF_VALUE_num(attr_sk); i++)
+                                {
+                                v=sk_CONF_VALUE_value(attr_sk,i);
+                                if(!X509_REQ_add1_attr_by_txt(req, v->name, MBSTRING_ASC,
+                                        (unsigned char *)v->value, -1)) return 0;
+                                }
+                        }
+        return 1;
+        }
+
+
 static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
              int nid, int min, int max)
         {
-        int i,j,ret=0;
-        X509_NAME_ENTRY *ne=NULL;
+        int i,ret=0;
         MS_STATIC char buf[1024];
-
+start:
         BIO_printf(bio_err,"%s [%s]:",text,def);
         (void)BIO_flush(bio_err);
         if (value != NULL)
@@ -1011,33 +1149,23 @@ static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
                 }
         buf[--i]='\0';
 
-        j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
-        if (req_fix_data(nid,&j,i,min,max) == 0)
-                goto err;
 #ifdef CHARSET_EBCDIC
         ebcdic2ascii(buf, buf, i);
 #endif
-        if ((ne=X509_NAME_ENTRY_create_by_NID(NULL,nid,j,(unsigned char *)buf,
-                strlen(buf)))
-                == NULL) goto err;
-        if (!X509_NAME_add_entry(n,ne,X509_NAME_entry_count(n),0))
-                goto err;
-
+        if(!req_check_len(i, min, max)) goto start;
+        if (!X509_NAME_add_entry_by_NID(n,nid, MBSTRING_ASC,
+                                (unsigned char *) buf, -1,-1,0)) goto err;
         ret=1;
 err:
-        if (ne != NULL) X509_NAME_ENTRY_free(ne);
         return(ret);
         }
 
-static int add_attribute_object(STACK_OF(X509_ATTRIBUTE) *n, char *text,
+static int add_attribute_object(X509_REQ *req, char *text,
                                 char *def, char *value, int nid, int min,
                                 int max)
         {
-        int i,z;
-        X509_ATTRIBUTE *xa=NULL;
+        int i;
         static char buf[1024];
-        ASN1_BIT_STRING *bs=NULL;
-        ASN1_TYPE *at=NULL;
 
 start:
         BIO_printf(bio_err,"%s [%s]:",text,def);
@@ -1071,50 +1199,21 @@ start:
                 return(0);
                 }
         buf[--i]='\0';
+        if(!req_check_len(i, min, max)) goto start;
 
-        /* add object plus value */
-        if ((xa=X509_ATTRIBUTE_new()) == NULL)
-                goto err;
-        if ((xa->value.set=sk_ASN1_TYPE_new_null()) == NULL)
+        if(!X509_REQ_add1_attr_by_NID(req, nid, MBSTRING_ASC,
+                                        (unsigned char *)buf, -1)) {
+                BIO_printf(bio_err, "Error adding attribute\n");
+                ERR_print_errors(bio_err);
                 goto err;
-        xa->set=1;
-
-        if (xa->object != NULL) ASN1_OBJECT_free(xa->object);
-        xa->object=OBJ_nid2obj(nid);
-
-        if ((bs=ASN1_BIT_STRING_new()) == NULL) goto err;
-
-        bs->type=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
-
-        z=req_fix_data(nid,&bs->type,i,min,max);
-        if (z == 0)
-                {
-                if (value == NULL)
-                        goto start;
-                else    goto err;
-                }
-
-        if (!ASN1_STRING_set(bs,(unsigned char *)buf,i+1))
-                { BIO_printf(bio_err,"Malloc failure\n"); goto err; }
-
-        if ((at=ASN1_TYPE_new()) == NULL)
-                { BIO_printf(bio_err,"Malloc failure\n"); goto err; }
-
-        ASN1_TYPE_set(at,bs->type,(char *)bs);
-        sk_ASN1_TYPE_push(xa->value.set,at);
-        bs=NULL;
-        at=NULL;
-        /* only one item per attribute */
+        }
 
-        if (!sk_X509_ATTRIBUTE_push(n,xa)) goto err;
         return(1);
 err:
-        if (xa != NULL) X509_ATTRIBUTE_free(xa);
-        if (at != NULL) ASN1_TYPE_free(at);
-        if (bs != NULL) ASN1_BIT_STRING_free(bs);
         return(0);
         }
 
+#ifndef NO_RSA
 static void MS_CALLBACK req_cb(int p, int n, void *arg)
         {
         char c='*';
@@ -1129,26 +1228,10 @@ static void MS_CALLBACK req_cb(int p, int n, void *arg)
         p=n;
 #endif
         }
+#endif
 
-static int req_fix_data(int nid, int *type, int len, int min, int max)
+static int req_check_len(int len, int min, int max)
         {
-        if (nid == NID_pkcs9_emailAddress)
-                *type=V_ASN1_IA5STRING;
-        if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
-                *type=V_ASN1_T61STRING;
-        if ((nid == NID_pkcs9_challengePassword) &&
-                (*type == V_ASN1_IA5STRING))
-                *type=V_ASN1_T61STRING;
-
-        if ((nid == NID_pkcs9_unstructuredName) &&
-                (*type == V_ASN1_T61STRING))
-                {
-                BIO_printf(bio_err,"invalid characters in string, please re-enter the string\n");
-                return(0);
-                }
-        if (nid == NID_pkcs9_unstructuredName)
-                *type=V_ASN1_IA5STRING;
-
         if (len < min)
                 {
                 BIO_printf(bio_err,"string is too short, it needs to be at least %d bytes long\n",min);