apps/ca.c:449: error: BUFFER_OVERRUN_L1
  Offset: 26 Size: 3.
Showing all 6 steps of the trace


apps/ca.c:445:18: <Offset trace>
443.   			sizeof(buf[0])-1-sizeof(CONFIG_FILE));
444.   #else
445.   		strncpy(buf[0],X509_get_default_cert_area(),
                        ^
446.   			sizeof(buf[0])-2-sizeof(CONFIG_FILE));
447.   		strcat(buf[0],"/");

apps/ca.c:445:18: Call
443.   			sizeof(buf[0])-1-sizeof(CONFIG_FILE));
444.   #else
445.   		strncpy(buf[0],X509_get_default_cert_area(),
                        ^
446.   			sizeof(buf[0])-2-sizeof(CONFIG_FILE));
447.   		strcat(buf[0],"/");

crypto/x509/x509_def.c:68:4: Array declaration
  66.   	
  67.   const char *X509_get_default_cert_area(void)
  68.   	{ return(X509_CERT_AREA); }
           ^
  69.   
  70.   const char *X509_get_default_cert_dir(void)

apps/ca.c:216:1: <Length trace>
214.   static int msie_hack=0;
215.   
216. > int MAIN(int argc, char **argv)
217.   	{
218.   	char *key=NULL;

apps/ca.c:216:1: Array declaration
214.   static int msie_hack=0;
215.   
216. > int MAIN(int argc, char **argv)
217.   	{
218.   	char *key=NULL;

apps/ca.c:449:3: Array access: Offset: 26 Size: 3
447.   		strcat(buf[0],"/");
448.   #endif
449.   		strcat(buf[0],CONFIG_FILE);
         ^
450.   		configfile=buf[0];
451.   		}

int MAIN(int argc, char **argv)
	{
	char *key=NULL;
	int total=0;
	int total_done=0;
	int badops=0;
	int ret=1;
	int req=0;
	int verbose=0;
	int gencrl=0;
	int dorevoke=0;
	long crldays=0;
	long crlhours=0;
	long errorline= -1;
	char *configfile=NULL;
	char *md=NULL;
	char *policy=NULL;
	char *keyfile=NULL;
	char *certfile=NULL;
	char *infile=NULL;
	char *spkac_file=NULL;
	char *ss_cert_file=NULL;
	EVP_PKEY *pkey=NULL;
	int output_der = 0;
	char *outfile=NULL;
	char *outdir=NULL;
	char *serialfile=NULL;
	char *extensions=NULL;
	char *crl_ext=NULL;
	BIGNUM *serial=NULL;
	char *startdate=NULL;
	char *enddate=NULL;
	int days=0;
	int batch=0;
	X509 *x509=NULL;
	X509 *x=NULL;
	BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
	char *dbfile=NULL;
	TXT_DB *db=NULL;
	X509_CRL *crl=NULL;
	X509_CRL_INFO *ci=NULL;
	X509_REVOKED *r=NULL;
	char **pp,*p,*f;
	int i,j;
	long l;
	const EVP_MD *dgst=NULL;
	STACK_OF(CONF_VALUE) *attribs=NULL;
	STACK *cert_sk=NULL;
	BIO *hex=NULL;
#undef BSIZE
#define BSIZE 256
	MS_STATIC char buf[3][BSIZE];
	char *randfile=NULL;
#ifdef EFENCE
EF_PROTECT_FREE=1;
EF_PROTECT_BELOW=1;
EF_ALIGNMENT=0;
#endif
	apps_startup();
	conf = NULL;
	key = NULL;
	section = NULL;
	X509V3_add_standard_extensions();
	preserve=0;
	msie_hack=0;
	if (bio_err == NULL)
		if ((bio_err=BIO_new(BIO_s_file())) != NULL)
			BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
	argc--;
	argv++;
	while (argc >= 1)
		{
		if	(strcmp(*argv,"-verbose") == 0)
			verbose=1;
		else if	(strcmp(*argv,"-config") == 0)
			{
			if (--argc < 1) goto bad;
			configfile= *(++argv);
			}
		else if (strcmp(*argv,"-name") == 0)
			{
			if (--argc < 1) goto bad;
			section= *(++argv);
			}
		else if (strcmp(*argv,"-startdate") == 0)
			{
			if (--argc < 1) goto bad;
			startdate= *(++argv);
			}
		else if (strcmp(*argv,"-enddate") == 0)
			{
			if (--argc < 1) goto bad;
			enddate= *(++argv);
			}
		else if (strcmp(*argv,"-days") == 0)
			{
			if (--argc < 1) goto bad;
			days=atoi(*(++argv));
			}
		else if (strcmp(*argv,"-md") == 0)
			{
			if (--argc < 1) goto bad;
			md= *(++argv);
			}
		else if (strcmp(*argv,"-policy") == 0)
			{
			if (--argc < 1) goto bad;
			policy= *(++argv);
			}
		else if (strcmp(*argv,"-keyfile") == 0)
			{
			if (--argc < 1) goto bad;
			keyfile= *(++argv);
			}
		else if (strcmp(*argv,"-key") == 0)
			{
			if (--argc < 1) goto bad;
			key= *(++argv);
			}
		else if (strcmp(*argv,"-cert") == 0)
			{
			if (--argc < 1) goto bad;
			certfile= *(++argv);
			}
		else if (strcmp(*argv,"-in") == 0)
			{
			if (--argc < 1) goto bad;
			infile= *(++argv);
			req=1;
			}
		else if (strcmp(*argv,"-out") == 0)
			{
			if (--argc < 1) goto bad;
			outfile= *(++argv);
			}
		else if (strcmp(*argv,"-outdir") == 0)
			{
			if (--argc < 1) goto bad;
			outdir= *(++argv);
			}
		else if (strcmp(*argv,"-batch") == 0)
			batch=1;
		else if (strcmp(*argv,"-preserveDN") == 0)
			preserve=1;
		else if (strcmp(*argv,"-gencrl") == 0)
			gencrl=1;
		else if (strcmp(*argv,"-msie_hack") == 0)
			msie_hack=1;
		else if (strcmp(*argv,"-crldays") == 0)
			{
			if (--argc < 1) goto bad;
			crldays= atol(*(++argv));
			}
		else if (strcmp(*argv,"-crlhours") == 0)
			{
			if (--argc < 1) goto bad;
			crlhours= atol(*(++argv));
			}
		else if (strcmp(*argv,"-infiles") == 0)
			{
			argc--;
			argv++;
			req=1;
			break;
			}
		else if (strcmp(*argv, "-ss_cert") == 0)
			{
			if (--argc < 1) goto bad;
			ss_cert_file = *(++argv);
			req=1;
			}
		else if (strcmp(*argv, "-spkac") == 0)
			{
			if (--argc < 1) goto bad;
			spkac_file = *(++argv);
			req=1;
			}
		else if (strcmp(*argv,"-revoke") == 0)
			{
			if (--argc < 1) goto bad;
			infile= *(++argv);
			dorevoke=1;
			}
		else if (strcmp(*argv,"-extensions") == 0)
			{
			if (--argc < 1) goto bad;
			extensions= *(++argv);
			}
		else if (strcmp(*argv,"-crlexts") == 0)
			{
			if (--argc < 1) goto bad;
			crl_ext= *(++argv);
			}
		else
			{
bad:
			BIO_printf(bio_err,"unknown option %s\n",*argv);
			badops=1;
			break;
			}
		argc--;
		argv++;
		}
	if (badops)
		{
		for (pp=ca_usage; (*pp != NULL); pp++)
			BIO_printf(bio_err,*pp);
		goto err;
		}
	ERR_load_crypto_strings();
	if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
	if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
	if (configfile == NULL)
		{
#ifdef VMS
		strncpy(buf[0],X509_get_default_cert_area(),
			sizeof(buf[0])-1-sizeof(CONFIG_FILE));
#else
		strncpy(buf[0],X509_get_default_cert_area(),
			sizeof(buf[0])-2-sizeof(CONFIG_FILE));
		strcat(buf[0],"/");
#endif
		strcat(buf[0],CONFIG_FILE);
		configfile=buf[0];
		}
	BIO_printf(bio_err,"Using configuration from %s\n",configfile);
	if ((conf=CONF_load(NULL,configfile,&errorline)) == NULL)
		{
		if (errorline <= 0)
			BIO_printf(bio_err,"error loading the config file '%s'\n",
				configfile);
		else
			BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
				,errorline,configfile);
		goto err;
		}
	if (section == NULL)
		{
		section=CONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
		if (section == NULL)
			{
			lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
			goto err;
			}
		}
	if (conf != NULL)
		{
		p=CONF_get_string(conf,NULL,"oid_file");
		if (p != NULL)
			{
			BIO *oid_bio;
			oid_bio=BIO_new_file(p,"r");
			if (oid_bio == NULL)
				{
				ERR_clear_error();
				}
			else
				{
				OBJ_create_objects(oid_bio);
				BIO_free(oid_bio);
				}
			}
		if(!add_oid_section(conf))
			{
			ERR_print_errors(bio_err);
			goto err;
			}
		}
	randfile = CONF_get_string(conf, BASE_SECTION, "RANDFILE");
	app_RAND_load_file(randfile, bio_err, 0);
	in=BIO_new(BIO_s_file());
	out=BIO_new(BIO_s_file());
	Sout=BIO_new(BIO_s_file());
	Cout=BIO_new(BIO_s_file());
	if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
		{
		ERR_print_errors(bio_err);
		goto err;
		}
	if ((keyfile == NULL) && ((keyfile=CONF_get_string(conf,
		section,ENV_PRIVATE_KEY)) == NULL))
		{
		lookup_fail(section,ENV_PRIVATE_KEY);
		goto err;
		}
	if (BIO_read_filename(in,keyfile) <= 0)
		{
		perror(keyfile);
		BIO_printf(bio_err,"trying to load CA private key\n");
		goto err;
		}
	if (key == NULL)
		pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,NULL);
	else
		{
		pkey=PEM_read_bio_PrivateKey(in,NULL,key_cb,key);
		memset(key,0,strlen(key));
		}
	if (pkey == NULL)
		{
		BIO_printf(bio_err,"unable to load CA private key\n");
		goto err;
		}
	if ((certfile == NULL) && ((certfile=CONF_get_string(conf,
		section,ENV_CERTIFICATE)) == NULL))
		{
		lookup_fail(section,ENV_CERTIFICATE);
		goto err;
		}
        if (BIO_read_filename(in,certfile) <= 0)
		{
		perror(certfile);
		BIO_printf(bio_err,"trying to load CA certificate\n");
		goto err;
		}
	x509=PEM_read_bio_X509(in,NULL,NULL,NULL);
	if (x509 == NULL)
		{
		BIO_printf(bio_err,"unable to load CA certificate\n");
		goto err;
		}
	if (!X509_check_private_key(x509,pkey))
		{
		BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
		goto err;
		}
	f=CONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
	if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
		preserve=1;
	f=CONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
	if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
		msie_hack=1;
	if ((outdir == NULL) && (req))
		{
		struct stat sb;
		if ((outdir=CONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
			== NULL)
			{
			BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
			goto err;
			}
#ifdef VMS
		if (access(outdir,R_OK|W_OK) != 0)
#else
		if (access(outdir,R_OK|W_OK|X_OK) != 0)
#endif
			{
			BIO_printf(bio_err,"I am unable to acces the %s directory\n",outdir);
			perror(outdir);
			goto err;
			}
		if (stat(outdir,&sb) != 0)
			{
			BIO_printf(bio_err,"unable to stat(%s)\n",outdir);
			perror(outdir);
			goto err;
			}
#ifdef S_IFDIR
		if (!(sb.st_mode & S_IFDIR))
			{
			BIO_printf(bio_err,"%s need to be a directory\n",outdir);
			perror(outdir);
			goto err;
			}
#endif
		}
	if ((dbfile=CONF_get_string(conf,section,ENV_DATABASE)) == NULL)
		{
		lookup_fail(section,ENV_DATABASE);
		goto err;
		}
	if (BIO_read_filename(in,dbfile) <= 0)
		{
		perror(dbfile);
		BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
		goto err;
		}
	db=TXT_DB_read(in,DB_NUMBER);
	if (db == NULL) goto err;
	for (i=0; i<sk_num(db->data); i++)
		{
		pp=(char **)sk_value(db->data,i);
		if ((pp[DB_type][0] != DB_TYPE_REV) &&
			(pp[DB_rev_date][0] != '\0'))
			{
			BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
			goto err;
			}
		if ((pp[DB_type][0] == DB_TYPE_REV) &&
			!check_time_format(pp[DB_rev_date]))
			{
			BIO_printf(bio_err,"entry %d: invalid revocation date\n",
				i+1);
			goto err;
			}
		if (!check_time_format(pp[DB_exp_date]))
			{
			BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
			goto err;
			}
		p=pp[DB_serial];
		j=strlen(p);
		if ((j&1) || (j < 2))
			{
			BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
			goto err;
			}
		while (*p)
			{
			if (!(	((*p >= '0') && (*p <= '9')) ||
				((*p >= 'A') && (*p <= 'F')) ||
				((*p >= 'a') && (*p <= 'f')))  )
				{
				BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
				goto err;
				}
			p++;
			}
		}
	if (verbose)
		{
		BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
		TXT_DB_write(out,db);
		BIO_printf(bio_err,"%d entries loaded from the database\n",
			db->data->num);
		BIO_printf(bio_err,"generating indexs\n");
		}
	if (!TXT_DB_create_index(db,DB_serial,NULL,index_serial_hash,
		index_serial_cmp))
		{
		BIO_printf(bio_err,"error creating serial number index:(%ld,%ld,%ld)\n",db->error,db->arg1,db->arg2);
		goto err;
		}
	if (!TXT_DB_create_index(db,DB_name,index_name_qual,index_name_hash,
		index_name_cmp))
		{
		BIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\n",
			db->error,db->arg1,db->arg2);
		goto err;
		}
	if (req || gencrl)
		{
		if (outfile != NULL)
			{
			if (BIO_write_filename(Sout,outfile) <= 0)
				{
				perror(outfile);
				goto err;
				}
			}
		else
			BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
		}
	if (req)
		{
		if ((md == NULL) && ((md=CONF_get_string(conf,
			section,ENV_DEFAULT_MD)) == NULL))
			{
			lookup_fail(section,ENV_DEFAULT_MD);
			goto err;
			}
		if ((dgst=EVP_get_digestbyname(md)) == NULL)
			{
			BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
			goto err;
			}
		if (verbose)
			BIO_printf(bio_err,"message digest is %s\n",
				OBJ_nid2ln(dgst->type));
		if ((policy == NULL) && ((policy=CONF_get_string(conf,
			section,ENV_POLICY)) == NULL))
			{
			lookup_fail(section,ENV_POLICY);
			goto err;
			}
		if (verbose)
			BIO_printf(bio_err,"policy is %s\n",policy);
		if ((serialfile=CONF_get_string(conf,section,ENV_SERIAL))
			== NULL)
			{
			lookup_fail(section,ENV_SERIAL);
			goto err;
			}
		if(!extensions)
			extensions=CONF_get_string(conf,section,ENV_EXTENSIONS);
		if(extensions) {
			X509V3_CTX ctx;
			X509V3_set_ctx_test(&ctx);
			X509V3_set_conf_lhash(&ctx, conf);
			if(!X509V3_EXT_add_conf(conf, &ctx, extensions, NULL)) {
				BIO_printf(bio_err,
				 "Error Loading extension section %s\n",
								 extensions);
				ret = 1;
				goto err;
			}
		}
		if (startdate == NULL)
			{
			startdate=CONF_get_string(conf,section,
				ENV_DEFAULT_STARTDATE);
			}
		if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))
			{
			BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");
			goto err;
			}
		if (startdate == NULL) startdate="today";
		if (enddate == NULL)
			{
			enddate=CONF_get_string(conf,section,
				ENV_DEFAULT_ENDDATE);
			}
		if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))
			{
			BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");
			goto err;
			}
		if (days == 0)
			{
			days=(int)CONF_get_number(conf,section,
				ENV_DEFAULT_DAYS);
			}
		if (!enddate && (days == 0))
			{
			BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
			goto err;
			}
		if ((serial=load_serial(serialfile)) == NULL)
			{
			BIO_printf(bio_err,"error while loading serial number\n");
			goto err;
			}
		if (verbose)
			{
			if ((f=BN_bn2hex(serial)) == NULL) goto err;
			BIO_printf(bio_err,"next serial number is %s\n",f);
			Free(f);
			}
		if ((attribs=CONF_get_section(conf,policy)) == NULL)
			{
			BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
			goto err;
			}
		if ((cert_sk=sk_new_null()) == NULL)
			{
			BIO_printf(bio_err,"Malloc failure\n");
			goto err;
			}
		if (spkac_file != NULL)
			{
			total++;
			j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
				serial,startdate,enddate, days,extensions,conf,
				verbose);
			if (j < 0) goto err;
			if (j > 0)
				{
				total_done++;
				BIO_printf(bio_err,"\n");
				if (!BN_add_word(serial,1)) goto err;
				if (!sk_push(cert_sk,(char *)x))
					{
					BIO_printf(bio_err,"Malloc failure\n");
					goto err;
					}
				if (outfile)
					{
					output_der = 1;
					batch = 1;
					}
				}
			}
		if (ss_cert_file != NULL)
			{
			total++;
			j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
				db,serial,startdate,enddate,days,batch,
				extensions,conf,verbose);
			if (j < 0) goto err;
			if (j > 0)
				{
				total_done++;
				BIO_printf(bio_err,"\n");
				if (!BN_add_word(serial,1)) goto err;
				if (!sk_push(cert_sk,(char *)x))
					{
					BIO_printf(bio_err,"Malloc failure\n");
					goto err;
					}
				}
			}
		if (infile != NULL)
			{
			total++;
			j=certify(&x,infile,pkey,x509,dgst,attribs,db,
				serial,startdate,enddate,days,batch,
				extensions,conf,verbose);
			if (j < 0) goto err;
			if (j > 0)
				{
				total_done++;
				BIO_printf(bio_err,"\n");
				if (!BN_add_word(serial,1)) goto err;
				if (!sk_push(cert_sk,(char *)x))
					{
					BIO_printf(bio_err,"Malloc failure\n");
					goto err;
					}
				}
			}
		for (i=0; i<argc; i++)
			{
			total++;
			j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
				serial,startdate,enddate,days,batch,
				extensions,conf,verbose);
			if (j < 0) goto err;
			if (j > 0)
				{
				total_done++;
				BIO_printf(bio_err,"\n");
				if (!BN_add_word(serial,1)) goto err;
				if (!sk_push(cert_sk,(char *)x))
					{
					BIO_printf(bio_err,"Malloc failure\n");
					goto err;
					}
				}
			}
		if (sk_num(cert_sk) > 0)
			{
			if (!batch)
				{
				BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
				(void)BIO_flush(bio_err);
				buf[0][0]='\0';
				fgets(buf[0],10,stdin);
				if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
					{
					BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
					ret=0;
					goto err;
					}
				}
			BIO_printf(bio_err,"Write out database with %d new entries\n",sk_num(cert_sk));
			strncpy(buf[0],serialfile,BSIZE-4);
#ifdef VMS
			strcat(buf[0],"-new");
#else
			strcat(buf[0],".new");
#endif
			if (!save_serial(buf[0],serial)) goto err;
			strncpy(buf[1],dbfile,BSIZE-4);
#ifdef VMS
			strcat(buf[1],"-new");
#else
			strcat(buf[1],".new");
#endif
			if (BIO_write_filename(out,buf[1]) <= 0)
				{
				perror(dbfile);
				BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
				goto err;
				}
			l=TXT_DB_write(out,db);
			if (l <= 0) goto err;
			}
		if (verbose)
			BIO_printf(bio_err,"writing new certificates\n");
		for (i=0; i<sk_num(cert_sk); i++)
			{
			int k;
			unsigned char *n;
			x=(X509 *)sk_value(cert_sk,i);
			j=x->cert_info->serialNumber->length;
			p=(char *)x->cert_info->serialNumber->data;
			strncpy(buf[2],outdir,BSIZE-(j*2)-6);
#ifndef VMS
			strcat(buf[2],"/");
#endif
			n=(unsigned char *)&(buf[2][strlen(buf[2])]);
			if (j > 0)
				{
				for (k=0; k<j; k++)
					{
					sprintf((char *)n,"%02X",(unsigned char)*(p++));
					n+=2;
					}
				}
			else
				{
				*(n++)='0';
				*(n++)='0';
				}
			*(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
			*n='\0';
			if (verbose)
				BIO_printf(bio_err,"writing %s\n",buf[2]);
			if (BIO_write_filename(Cout,buf[2]) <= 0)
				{
				perror(buf[2]);
				goto err;
				}
			write_new_certificate(Cout,x, 0);
			write_new_certificate(Sout,x, output_der);
			}
		if (sk_num(cert_sk))
			{
			strncpy(buf[2],serialfile,BSIZE-4);
#ifdef VMS
			strcat(buf[2],"-old");
#else
			strcat(buf[2],".old");
#endif
			BIO_free(in);
			BIO_free(out);
			in=NULL;
			out=NULL;
			if (rename(serialfile,buf[2]) < 0)
				{
				BIO_printf(bio_err,"unabel to rename %s to %s\n",
					serialfile,buf[2]);
				perror("reason");
				goto err;
				}
			if (rename(buf[0],serialfile) < 0)
				{
				BIO_printf(bio_err,"unabel to rename %s to %s\n",
					buf[0],serialfile);
				perror("reason");
				rename(buf[2],serialfile);
				goto err;
				}
			strncpy(buf[2],dbfile,BSIZE-4);
#ifdef VMS
			strcat(buf[2],"-old");
#else
			strcat(buf[2],".old");
#endif
			if (rename(dbfile,buf[2]) < 0)
				{
				BIO_printf(bio_err,"unabel to rename %s to %s\n",
					dbfile,buf[2]);
				perror("reason");
				goto err;
				}
			if (rename(buf[1],dbfile) < 0)
				{
				BIO_printf(bio_err,"unabel to rename %s to %s\n",
					buf[1],dbfile);
				perror("reason");
				rename(buf[2],dbfile);
				goto err;
				}
			BIO_printf(bio_err,"Data Base Updated\n");
			}
		}
	if (gencrl)
		{
		if(!crl_ext) crl_ext=CONF_get_string(conf,section,ENV_CRLEXT);
		if(crl_ext) {
			X509V3_CTX ctx;
			X509V3_set_ctx_test(&ctx);
			X509V3_set_conf_lhash(&ctx, conf);
			if(!X509V3_EXT_add_conf(conf, &ctx, crl_ext, NULL)) {
				BIO_printf(bio_err,
				 "Error Loading CRL extension section %s\n",
								 crl_ext);
				ret = 1;
				goto err;
			}
		}
		if ((hex=BIO_new(BIO_s_mem())) == NULL) goto err;
		if (!crldays && !crlhours)
			{
			crldays=CONF_get_number(conf,section,
				ENV_DEFAULT_CRL_DAYS);
			crlhours=CONF_get_number(conf,section,
				ENV_DEFAULT_CRL_HOURS);
			}
		if ((crldays == 0) && (crlhours == 0))
			{
			BIO_printf(bio_err,"cannot lookup how long until the next CRL is issuer\n");
			goto err;
			}
		if (verbose) BIO_printf(bio_err,"making CRL\n");
		if ((crl=X509_CRL_new()) == NULL) goto err;
		ci=crl->crl;
		X509_NAME_free(ci->issuer);
		ci->issuer=X509_NAME_dup(x509->cert_info->subject);
		if (ci->issuer == NULL) goto err;
		X509_gmtime_adj(ci->lastUpdate,0);
		if (ci->nextUpdate == NULL)
			ci->nextUpdate=ASN1_UTCTIME_new();
		X509_gmtime_adj(ci->nextUpdate,(crldays*24+crlhours)*60*60);
		for (i=0; i<sk_num(db->data); i++)
			{
			pp=(char **)sk_value(db->data,i);
			if (pp[DB_type][0] == DB_TYPE_REV)
				{
				if ((r=X509_REVOKED_new()) == NULL) goto err;
				ASN1_STRING_set((ASN1_STRING *)
					r->revocationDate,
					(unsigned char *)pp[DB_rev_date],
					strlen(pp[DB_rev_date]));
				(void)BIO_reset(hex);
				if (!BIO_puts(hex,pp[DB_serial]))
					goto err;
				if (!a2i_ASN1_INTEGER(hex,r->serialNumber,
					buf[0],BSIZE)) goto err;
				sk_X509_REVOKED_push(ci->revoked,r);
				}
			}
		sk_X509_REVOKED_sort(ci->revoked);
		for (i=0; i<sk_X509_REVOKED_num(ci->revoked); i++)
			{
			r=sk_X509_REVOKED_value(ci->revoked,i);
			r->sequence=i;
			}
		if (verbose) BIO_printf(bio_err,"signing CRL\n");
		if (md != NULL)
			{
			if ((dgst=EVP_get_digestbyname(md)) == NULL)
				{
				BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
				goto err;
				}
			}
		else
		    {
#ifndef NO_DSA
		    if (pkey->type == EVP_PKEY_DSA)
			dgst=EVP_dss1();
		    else
#endif
			dgst=EVP_md5();
		    }
		if(crl_ext) {
		    X509V3_CTX crlctx;
		    if (ci->version == NULL)
		    if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;
		    ASN1_INTEGER_set(ci->version,1);
		    X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
		    X509V3_set_conf_lhash(&crlctx, conf);
		    if(!X509V3_EXT_CRL_add_conf(conf, &crlctx,
						 crl_ext, crl)) goto err;
		}
		if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
		PEM_write_bio_X509_CRL(Sout,crl);
		}
	if (dorevoke)
		{
		if (infile == NULL)
			{
			BIO_printf(bio_err,"no input files\n");
			goto err;
			}
		else
			{
			X509 *revcert;
			if (BIO_read_filename(in,infile) <= 0)
				{
				perror(infile);
				BIO_printf(bio_err,"error trying to load '%s' certificate\n",infile);
				goto err;
				}
			revcert=PEM_read_bio_X509(in,NULL,NULL,NULL);
			if (revcert == NULL)
				{
				BIO_printf(bio_err,"unable to load '%s' certificate\n",infile);
				goto err;
				}
			j=do_revoke(revcert,db);
			if (j <= 0) goto err;
			X509_free(revcert);
			strncpy(buf[0],dbfile,BSIZE-4);
			strcat(buf[0],".new");
			if (BIO_write_filename(out,buf[0]) <= 0)
				{
				perror(dbfile);
				BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
				goto err;
				}
			j=TXT_DB_write(out,db);
			if (j <= 0) goto err;
			strncpy(buf[1],dbfile,BSIZE-4);
			strcat(buf[1],".old");
			if (rename(dbfile,buf[1]) < 0)
				{
				BIO_printf(bio_err,"unable to rename %s to %s\n", dbfile, buf[1]);
				perror("reason");
				goto err;
				}
			if (rename(buf[0],dbfile) < 0)
				{
				BIO_printf(bio_err,"unable to rename %s to %s\n", buf[0],dbfile);
				perror("reason");
				rename(buf[1],dbfile);
				goto err;
				}
			BIO_printf(bio_err,"Data Base Updated\n");
			}
		}
	ret=0;
err:
	BIO_free(hex);
	BIO_free(Cout);
	BIO_free(Sout);
	BIO_free(out);
	BIO_free(in);
	sk_pop_free(cert_sk,X509_free);
	if (ret) ERR_print_errors(bio_err);
	app_RAND_write_file(randfile, bio_err);
	BN_free(serial);
	TXT_DB_free(db);
	EVP_PKEY_free(pkey);
	X509_free(x509);
	X509_CRL_free(crl);
	CONF_free(conf);
	X509V3_EXT_cleanup();
	OBJ_cleanup();
	EXIT(ret);
	}
['int MAIN(int argc, char **argv)\n\t{\n\tchar *key=NULL;\n\tint total=0;\n\tint total_done=0;\n\tint badops=0;\n\tint ret=1;\n\tint req=0;\n\tint verbose=0;\n\tint gencrl=0;\n\tint dorevoke=0;\n\tlong crldays=0;\n\tlong crlhours=0;\n\tlong errorline= -1;\n\tchar *configfile=NULL;\n\tchar *md=NULL;\n\tchar *policy=NULL;\n\tchar *keyfile=NULL;\n\tchar *certfile=NULL;\n\tchar *infile=NULL;\n\tchar *spkac_file=NULL;\n\tchar *ss_cert_file=NULL;\n\tEVP_PKEY *pkey=NULL;\n\tint output_der = 0;\n\tchar *outfile=NULL;\n\tchar *outdir=NULL;\n\tchar *serialfile=NULL;\n\tchar *extensions=NULL;\n\tchar *crl_ext=NULL;\n\tBIGNUM *serial=NULL;\n\tchar *startdate=NULL;\n\tchar *enddate=NULL;\n\tint days=0;\n\tint batch=0;\n\tX509 *x509=NULL;\n\tX509 *x=NULL;\n\tBIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;\n\tchar *dbfile=NULL;\n\tTXT_DB *db=NULL;\n\tX509_CRL *crl=NULL;\n\tX509_CRL_INFO *ci=NULL;\n\tX509_REVOKED *r=NULL;\n\tchar **pp,*p,*f;\n\tint i,j;\n\tlong l;\n\tconst EVP_MD *dgst=NULL;\n\tSTACK_OF(CONF_VALUE) *attribs=NULL;\n\tSTACK *cert_sk=NULL;\n\tBIO *hex=NULL;\n#undef BSIZE\n#define BSIZE 256\n\tMS_STATIC char buf[3][BSIZE];\n\tchar *randfile=NULL;\n#ifdef EFENCE\nEF_PROTECT_FREE=1;\nEF_PROTECT_BELOW=1;\nEF_ALIGNMENT=0;\n#endif\n\tapps_startup();\n\tconf = NULL;\n\tkey = NULL;\n\tsection = NULL;\n\tX509V3_add_standard_extensions();\n\tpreserve=0;\n\tmsie_hack=0;\n\tif (bio_err == NULL)\n\t\tif ((bio_err=BIO_new(BIO_s_file())) != NULL)\n\t\t\tBIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);\n\targc--;\n\targv++;\n\twhile (argc >= 1)\n\t\t{\n\t\tif\t(strcmp(*argv,"-verbose") == 0)\n\t\t\tverbose=1;\n\t\telse if\t(strcmp(*argv,"-config") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tconfigfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-name") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tsection= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-startdate") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tstartdate= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-enddate") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tenddate= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-days") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tdays=atoi(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-md") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tmd= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-policy") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tpolicy= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-keyfile") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tkeyfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-key") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tkey= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-cert") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tcertfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-in") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tinfile= *(++argv);\n\t\t\treq=1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-out") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\toutfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-outdir") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\toutdir= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-batch") == 0)\n\t\t\tbatch=1;\n\t\telse if (strcmp(*argv,"-preserveDN") == 0)\n\t\t\tpreserve=1;\n\t\telse if (strcmp(*argv,"-gencrl") == 0)\n\t\t\tgencrl=1;\n\t\telse if (strcmp(*argv,"-msie_hack") == 0)\n\t\t\tmsie_hack=1;\n\t\telse if (strcmp(*argv,"-crldays") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tcrldays= atol(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-crlhours") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tcrlhours= atol(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-infiles") == 0)\n\t\t\t{\n\t\t\targc--;\n\t\t\targv++;\n\t\t\treq=1;\n\t\t\tbreak;\n\t\t\t}\n\t\telse if (strcmp(*argv, "-ss_cert") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tss_cert_file = *(++argv);\n\t\t\treq=1;\n\t\t\t}\n\t\telse if (strcmp(*argv, "-spkac") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tspkac_file = *(++argv);\n\t\t\treq=1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-revoke") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tinfile= *(++argv);\n\t\t\tdorevoke=1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-extensions") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\textensions= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-crlexts") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tcrl_ext= *(++argv);\n\t\t\t}\n\t\telse\n\t\t\t{\nbad:\n\t\t\tBIO_printf(bio_err,"unknown option %s\\n",*argv);\n\t\t\tbadops=1;\n\t\t\tbreak;\n\t\t\t}\n\t\targc--;\n\t\targv++;\n\t\t}\n\tif (badops)\n\t\t{\n\t\tfor (pp=ca_usage; (*pp != NULL); pp++)\n\t\t\tBIO_printf(bio_err,*pp);\n\t\tgoto err;\n\t\t}\n\tERR_load_crypto_strings();\n\tif (configfile == NULL) configfile = getenv("OPENSSL_CONF");\n\tif (configfile == NULL) configfile = getenv("SSLEAY_CONF");\n\tif (configfile == NULL)\n\t\t{\n#ifdef VMS\n\t\tstrncpy(buf[0],X509_get_default_cert_area(),\n\t\t\tsizeof(buf[0])-1-sizeof(CONFIG_FILE));\n#else\n\t\tstrncpy(buf[0],X509_get_default_cert_area(),\n\t\t\tsizeof(buf[0])-2-sizeof(CONFIG_FILE));\n\t\tstrcat(buf[0],"/");\n#endif\n\t\tstrcat(buf[0],CONFIG_FILE);\n\t\tconfigfile=buf[0];\n\t\t}\n\tBIO_printf(bio_err,"Using configuration from %s\\n",configfile);\n\tif ((conf=CONF_load(NULL,configfile,&errorline)) == NULL)\n\t\t{\n\t\tif (errorline <= 0)\n\t\t\tBIO_printf(bio_err,"error loading the config file \'%s\'\\n",\n\t\t\t\tconfigfile);\n\t\telse\n\t\t\tBIO_printf(bio_err,"error on line %ld of config file \'%s\'\\n"\n\t\t\t\t,errorline,configfile);\n\t\tgoto err;\n\t\t}\n\tif (section == NULL)\n\t\t{\n\t\tsection=CONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);\n\t\tif (section == NULL)\n\t\t\t{\n\t\t\tlookup_fail(BASE_SECTION,ENV_DEFAULT_CA);\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\tif (conf != NULL)\n\t\t{\n\t\tp=CONF_get_string(conf,NULL,"oid_file");\n\t\tif (p != NULL)\n\t\t\t{\n\t\t\tBIO *oid_bio;\n\t\t\toid_bio=BIO_new_file(p,"r");\n\t\t\tif (oid_bio == NULL)\n\t\t\t\t{\n\t\t\t\tERR_clear_error();\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tOBJ_create_objects(oid_bio);\n\t\t\t\tBIO_free(oid_bio);\n\t\t\t\t}\n\t\t\t}\n\t\tif(!add_oid_section(conf))\n\t\t\t{\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\trandfile = CONF_get_string(conf, BASE_SECTION, "RANDFILE");\n\tapp_RAND_load_file(randfile, bio_err, 0);\n\tin=BIO_new(BIO_s_file());\n\tout=BIO_new(BIO_s_file());\n\tSout=BIO_new(BIO_s_file());\n\tCout=BIO_new(BIO_s_file());\n\tif ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))\n\t\t{\n\t\tERR_print_errors(bio_err);\n\t\tgoto err;\n\t\t}\n\tif ((keyfile == NULL) && ((keyfile=CONF_get_string(conf,\n\t\tsection,ENV_PRIVATE_KEY)) == NULL))\n\t\t{\n\t\tlookup_fail(section,ENV_PRIVATE_KEY);\n\t\tgoto err;\n\t\t}\n\tif (BIO_read_filename(in,keyfile) <= 0)\n\t\t{\n\t\tperror(keyfile);\n\t\tBIO_printf(bio_err,"trying to load CA private key\\n");\n\t\tgoto err;\n\t\t}\n\tif (key == NULL)\n\t\tpkey=PEM_read_bio_PrivateKey(in,NULL,NULL,NULL);\n\telse\n\t\t{\n\t\tpkey=PEM_read_bio_PrivateKey(in,NULL,key_cb,key);\n\t\tmemset(key,0,strlen(key));\n\t\t}\n\tif (pkey == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"unable to load CA private key\\n");\n\t\tgoto err;\n\t\t}\n\tif ((certfile == NULL) && ((certfile=CONF_get_string(conf,\n\t\tsection,ENV_CERTIFICATE)) == NULL))\n\t\t{\n\t\tlookup_fail(section,ENV_CERTIFICATE);\n\t\tgoto err;\n\t\t}\n        if (BIO_read_filename(in,certfile) <= 0)\n\t\t{\n\t\tperror(certfile);\n\t\tBIO_printf(bio_err,"trying to load CA certificate\\n");\n\t\tgoto err;\n\t\t}\n\tx509=PEM_read_bio_X509(in,NULL,NULL,NULL);\n\tif (x509 == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"unable to load CA certificate\\n");\n\t\tgoto err;\n\t\t}\n\tif (!X509_check_private_key(x509,pkey))\n\t\t{\n\t\tBIO_printf(bio_err,"CA certificate and CA private key do not match\\n");\n\t\tgoto err;\n\t\t}\n\tf=CONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);\n\tif ((f != NULL) && ((*f == \'y\') || (*f == \'Y\')))\n\t\tpreserve=1;\n\tf=CONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);\n\tif ((f != NULL) && ((*f == \'y\') || (*f == \'Y\')))\n\t\tmsie_hack=1;\n\tif ((outdir == NULL) && (req))\n\t\t{\n\t\tstruct stat sb;\n\t\tif ((outdir=CONF_get_string(conf,section,ENV_NEW_CERTS_DIR))\n\t\t\t== NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\\n");\n\t\t\tgoto err;\n\t\t\t}\n#ifdef VMS\n\t\tif (access(outdir,R_OK|W_OK) != 0)\n#else\n\t\tif (access(outdir,R_OK|W_OK|X_OK) != 0)\n#endif\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"I am unable to acces the %s directory\\n",outdir);\n\t\t\tperror(outdir);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (stat(outdir,&sb) != 0)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"unable to stat(%s)\\n",outdir);\n\t\t\tperror(outdir);\n\t\t\tgoto err;\n\t\t\t}\n#ifdef S_IFDIR\n\t\tif (!(sb.st_mode & S_IFDIR))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"%s need to be a directory\\n",outdir);\n\t\t\tperror(outdir);\n\t\t\tgoto err;\n\t\t\t}\n#endif\n\t\t}\n\tif ((dbfile=CONF_get_string(conf,section,ENV_DATABASE)) == NULL)\n\t\t{\n\t\tlookup_fail(section,ENV_DATABASE);\n\t\tgoto err;\n\t\t}\n\tif (BIO_read_filename(in,dbfile) <= 0)\n\t\t{\n\t\tperror(dbfile);\n\t\tBIO_printf(bio_err,"unable to open \'%s\'\\n",dbfile);\n\t\tgoto err;\n\t\t}\n\tdb=TXT_DB_read(in,DB_NUMBER);\n\tif (db == NULL) goto err;\n\tfor (i=0; i<sk_num(db->data); i++)\n\t\t{\n\t\tpp=(char **)sk_value(db->data,i);\n\t\tif ((pp[DB_type][0] != DB_TYPE_REV) &&\n\t\t\t(pp[DB_rev_date][0] != \'\\0\'))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\\n",i+1);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif ((pp[DB_type][0] == DB_TYPE_REV) &&\n\t\t\t!check_time_format(pp[DB_rev_date]))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"entry %d: invalid revocation date\\n",\n\t\t\t\ti+1);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (!check_time_format(pp[DB_exp_date]))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"entry %d: invalid expiry date\\n",i+1);\n\t\t\tgoto err;\n\t\t\t}\n\t\tp=pp[DB_serial];\n\t\tj=strlen(p);\n\t\tif ((j&1) || (j < 2))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"entry %d: bad serial number length (%d)\\n",i+1,j);\n\t\t\tgoto err;\n\t\t\t}\n\t\twhile (*p)\n\t\t\t{\n\t\t\tif (!(\t((*p >= \'0\') && (*p <= \'9\')) ||\n\t\t\t\t((*p >= \'A\') && (*p <= \'F\')) ||\n\t\t\t\t((*p >= \'a\') && (*p <= \'f\')))  )\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is \'%c\'\\n",i+1,(long)(p-pp[DB_serial]),*p);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tp++;\n\t\t\t}\n\t\t}\n\tif (verbose)\n\t\t{\n\t\tBIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT);\n\t\tTXT_DB_write(out,db);\n\t\tBIO_printf(bio_err,"%d entries loaded from the database\\n",\n\t\t\tdb->data->num);\n\t\tBIO_printf(bio_err,"generating indexs\\n");\n\t\t}\n\tif (!TXT_DB_create_index(db,DB_serial,NULL,index_serial_hash,\n\t\tindex_serial_cmp))\n\t\t{\n\t\tBIO_printf(bio_err,"error creating serial number index:(%ld,%ld,%ld)\\n",db->error,db->arg1,db->arg2);\n\t\tgoto err;\n\t\t}\n\tif (!TXT_DB_create_index(db,DB_name,index_name_qual,index_name_hash,\n\t\tindex_name_cmp))\n\t\t{\n\t\tBIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\\n",\n\t\t\tdb->error,db->arg1,db->arg2);\n\t\tgoto err;\n\t\t}\n\tif (req || gencrl)\n\t\t{\n\t\tif (outfile != NULL)\n\t\t\t{\n\t\t\tif (BIO_write_filename(Sout,outfile) <= 0)\n\t\t\t\t{\n\t\t\t\tperror(outfile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n\t\t\tBIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);\n\t\t}\n\tif (req)\n\t\t{\n\t\tif ((md == NULL) && ((md=CONF_get_string(conf,\n\t\t\tsection,ENV_DEFAULT_MD)) == NULL))\n\t\t\t{\n\t\t\tlookup_fail(section,ENV_DEFAULT_MD);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif ((dgst=EVP_get_digestbyname(md)) == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"%s is an unsupported message digest type\\n",md);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (verbose)\n\t\t\tBIO_printf(bio_err,"message digest is %s\\n",\n\t\t\t\tOBJ_nid2ln(dgst->type));\n\t\tif ((policy == NULL) && ((policy=CONF_get_string(conf,\n\t\t\tsection,ENV_POLICY)) == NULL))\n\t\t\t{\n\t\t\tlookup_fail(section,ENV_POLICY);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (verbose)\n\t\t\tBIO_printf(bio_err,"policy is %s\\n",policy);\n\t\tif ((serialfile=CONF_get_string(conf,section,ENV_SERIAL))\n\t\t\t== NULL)\n\t\t\t{\n\t\t\tlookup_fail(section,ENV_SERIAL);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif(!extensions)\n\t\t\textensions=CONF_get_string(conf,section,ENV_EXTENSIONS);\n\t\tif(extensions) {\n\t\t\tX509V3_CTX ctx;\n\t\t\tX509V3_set_ctx_test(&ctx);\n\t\t\tX509V3_set_conf_lhash(&ctx, conf);\n\t\t\tif(!X509V3_EXT_add_conf(conf, &ctx, extensions, NULL)) {\n\t\t\t\tBIO_printf(bio_err,\n\t\t\t\t "Error Loading extension section %s\\n",\n\t\t\t\t\t\t\t\t extensions);\n\t\t\t\tret = 1;\n\t\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\t\tif (startdate == NULL)\n\t\t\t{\n\t\t\tstartdate=CONF_get_string(conf,section,\n\t\t\t\tENV_DEFAULT_STARTDATE);\n\t\t\t}\n\t\tif (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (startdate == NULL) startdate="today";\n\t\tif (enddate == NULL)\n\t\t\t{\n\t\t\tenddate=CONF_get_string(conf,section,\n\t\t\t\tENV_DEFAULT_ENDDATE);\n\t\t\t}\n\t\tif (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (days == 0)\n\t\t\t{\n\t\t\tdays=(int)CONF_get_number(conf,section,\n\t\t\t\tENV_DEFAULT_DAYS);\n\t\t\t}\n\t\tif (!enddate && (days == 0))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"cannot lookup how many days to certify for\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tif ((serial=load_serial(serialfile)) == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"error while loading serial number\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (verbose)\n\t\t\t{\n\t\t\tif ((f=BN_bn2hex(serial)) == NULL) goto err;\n\t\t\tBIO_printf(bio_err,"next serial number is %s\\n",f);\n\t\t\tFree(f);\n\t\t\t}\n\t\tif ((attribs=CONF_get_section(conf,policy)) == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"unable to find \'section\' for %s\\n",policy);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif ((cert_sk=sk_new_null()) == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"Malloc failure\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (spkac_file != NULL)\n\t\t\t{\n\t\t\ttotal++;\n\t\t\tj=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,\n\t\t\t\tserial,startdate,enddate, days,extensions,conf,\n\t\t\t\tverbose);\n\t\t\tif (j < 0) goto err;\n\t\t\tif (j > 0)\n\t\t\t\t{\n\t\t\t\ttotal_done++;\n\t\t\t\tBIO_printf(bio_err,"\\n");\n\t\t\t\tif (!BN_add_word(serial,1)) goto err;\n\t\t\t\tif (!sk_push(cert_sk,(char *)x))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"Malloc failure\\n");\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\tif (outfile)\n\t\t\t\t\t{\n\t\t\t\t\toutput_der = 1;\n\t\t\t\t\tbatch = 1;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\tif (ss_cert_file != NULL)\n\t\t\t{\n\t\t\ttotal++;\n\t\t\tj=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,\n\t\t\t\tdb,serial,startdate,enddate,days,batch,\n\t\t\t\textensions,conf,verbose);\n\t\t\tif (j < 0) goto err;\n\t\t\tif (j > 0)\n\t\t\t\t{\n\t\t\t\ttotal_done++;\n\t\t\t\tBIO_printf(bio_err,"\\n");\n\t\t\t\tif (!BN_add_word(serial,1)) goto err;\n\t\t\t\tif (!sk_push(cert_sk,(char *)x))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"Malloc failure\\n");\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\tif (infile != NULL)\n\t\t\t{\n\t\t\ttotal++;\n\t\t\tj=certify(&x,infile,pkey,x509,dgst,attribs,db,\n\t\t\t\tserial,startdate,enddate,days,batch,\n\t\t\t\textensions,conf,verbose);\n\t\t\tif (j < 0) goto err;\n\t\t\tif (j > 0)\n\t\t\t\t{\n\t\t\t\ttotal_done++;\n\t\t\t\tBIO_printf(bio_err,"\\n");\n\t\t\t\tif (!BN_add_word(serial,1)) goto err;\n\t\t\t\tif (!sk_push(cert_sk,(char *)x))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"Malloc failure\\n");\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\tfor (i=0; i<argc; i++)\n\t\t\t{\n\t\t\ttotal++;\n\t\t\tj=certify(&x,argv[i],pkey,x509,dgst,attribs,db,\n\t\t\t\tserial,startdate,enddate,days,batch,\n\t\t\t\textensions,conf,verbose);\n\t\t\tif (j < 0) goto err;\n\t\t\tif (j > 0)\n\t\t\t\t{\n\t\t\t\ttotal_done++;\n\t\t\t\tBIO_printf(bio_err,"\\n");\n\t\t\t\tif (!BN_add_word(serial,1)) goto err;\n\t\t\t\tif (!sk_push(cert_sk,(char *)x))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"Malloc failure\\n");\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\tif (sk_num(cert_sk) > 0)\n\t\t\t{\n\t\t\tif (!batch)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"\\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);\n\t\t\t\t(void)BIO_flush(bio_err);\n\t\t\t\tbuf[0][0]=\'\\0\';\n\t\t\t\tfgets(buf[0],10,stdin);\n\t\t\t\tif ((buf[0][0] != \'y\') && (buf[0][0] != \'Y\'))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"CERTIFICATION CANCELED\\n");\n\t\t\t\t\tret=0;\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\tBIO_printf(bio_err,"Write out database with %d new entries\\n",sk_num(cert_sk));\n\t\t\tstrncpy(buf[0],serialfile,BSIZE-4);\n#ifdef VMS\n\t\t\tstrcat(buf[0],"-new");\n#else\n\t\t\tstrcat(buf[0],".new");\n#endif\n\t\t\tif (!save_serial(buf[0],serial)) goto err;\n\t\t\tstrncpy(buf[1],dbfile,BSIZE-4);\n#ifdef VMS\n\t\t\tstrcat(buf[1],"-new");\n#else\n\t\t\tstrcat(buf[1],".new");\n#endif\n\t\t\tif (BIO_write_filename(out,buf[1]) <= 0)\n\t\t\t\t{\n\t\t\t\tperror(dbfile);\n\t\t\t\tBIO_printf(bio_err,"unable to open \'%s\'\\n",dbfile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tl=TXT_DB_write(out,db);\n\t\t\tif (l <= 0) goto err;\n\t\t\t}\n\t\tif (verbose)\n\t\t\tBIO_printf(bio_err,"writing new certificates\\n");\n\t\tfor (i=0; i<sk_num(cert_sk); i++)\n\t\t\t{\n\t\t\tint k;\n\t\t\tunsigned char *n;\n\t\t\tx=(X509 *)sk_value(cert_sk,i);\n\t\t\tj=x->cert_info->serialNumber->length;\n\t\t\tp=(char *)x->cert_info->serialNumber->data;\n\t\t\tstrncpy(buf[2],outdir,BSIZE-(j*2)-6);\n#ifndef VMS\n\t\t\tstrcat(buf[2],"/");\n#endif\n\t\t\tn=(unsigned char *)&(buf[2][strlen(buf[2])]);\n\t\t\tif (j > 0)\n\t\t\t\t{\n\t\t\t\tfor (k=0; k<j; k++)\n\t\t\t\t\t{\n\t\t\t\t\tsprintf((char *)n,"%02X",(unsigned char)*(p++));\n\t\t\t\t\tn+=2;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\t*(n++)=\'0\';\n\t\t\t\t*(n++)=\'0\';\n\t\t\t\t}\n\t\t\t*(n++)=\'.\'; *(n++)=\'p\'; *(n++)=\'e\'; *(n++)=\'m\';\n\t\t\t*n=\'\\0\';\n\t\t\tif (verbose)\n\t\t\t\tBIO_printf(bio_err,"writing %s\\n",buf[2]);\n\t\t\tif (BIO_write_filename(Cout,buf[2]) <= 0)\n\t\t\t\t{\n\t\t\t\tperror(buf[2]);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\twrite_new_certificate(Cout,x, 0);\n\t\t\twrite_new_certificate(Sout,x, output_der);\n\t\t\t}\n\t\tif (sk_num(cert_sk))\n\t\t\t{\n\t\t\tstrncpy(buf[2],serialfile,BSIZE-4);\n#ifdef VMS\n\t\t\tstrcat(buf[2],"-old");\n#else\n\t\t\tstrcat(buf[2],".old");\n#endif\n\t\t\tBIO_free(in);\n\t\t\tBIO_free(out);\n\t\t\tin=NULL;\n\t\t\tout=NULL;\n\t\t\tif (rename(serialfile,buf[2]) < 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unabel to rename %s to %s\\n",\n\t\t\t\t\tserialfile,buf[2]);\n\t\t\t\tperror("reason");\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (rename(buf[0],serialfile) < 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unabel to rename %s to %s\\n",\n\t\t\t\t\tbuf[0],serialfile);\n\t\t\t\tperror("reason");\n\t\t\t\trename(buf[2],serialfile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tstrncpy(buf[2],dbfile,BSIZE-4);\n#ifdef VMS\n\t\t\tstrcat(buf[2],"-old");\n#else\n\t\t\tstrcat(buf[2],".old");\n#endif\n\t\t\tif (rename(dbfile,buf[2]) < 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unabel to rename %s to %s\\n",\n\t\t\t\t\tdbfile,buf[2]);\n\t\t\t\tperror("reason");\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (rename(buf[1],dbfile) < 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unabel to rename %s to %s\\n",\n\t\t\t\t\tbuf[1],dbfile);\n\t\t\t\tperror("reason");\n\t\t\t\trename(buf[2],dbfile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tBIO_printf(bio_err,"Data Base Updated\\n");\n\t\t\t}\n\t\t}\n\tif (gencrl)\n\t\t{\n\t\tif(!crl_ext) crl_ext=CONF_get_string(conf,section,ENV_CRLEXT);\n\t\tif(crl_ext) {\n\t\t\tX509V3_CTX ctx;\n\t\t\tX509V3_set_ctx_test(&ctx);\n\t\t\tX509V3_set_conf_lhash(&ctx, conf);\n\t\t\tif(!X509V3_EXT_add_conf(conf, &ctx, crl_ext, NULL)) {\n\t\t\t\tBIO_printf(bio_err,\n\t\t\t\t "Error Loading CRL extension section %s\\n",\n\t\t\t\t\t\t\t\t crl_ext);\n\t\t\t\tret = 1;\n\t\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\t\tif ((hex=BIO_new(BIO_s_mem())) == NULL) goto err;\n\t\tif (!crldays && !crlhours)\n\t\t\t{\n\t\t\tcrldays=CONF_get_number(conf,section,\n\t\t\t\tENV_DEFAULT_CRL_DAYS);\n\t\t\tcrlhours=CONF_get_number(conf,section,\n\t\t\t\tENV_DEFAULT_CRL_HOURS);\n\t\t\t}\n\t\tif ((crldays == 0) && (crlhours == 0))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"cannot lookup how long until the next CRL is issuer\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (verbose) BIO_printf(bio_err,"making CRL\\n");\n\t\tif ((crl=X509_CRL_new()) == NULL) goto err;\n\t\tci=crl->crl;\n\t\tX509_NAME_free(ci->issuer);\n\t\tci->issuer=X509_NAME_dup(x509->cert_info->subject);\n\t\tif (ci->issuer == NULL) goto err;\n\t\tX509_gmtime_adj(ci->lastUpdate,0);\n\t\tif (ci->nextUpdate == NULL)\n\t\t\tci->nextUpdate=ASN1_UTCTIME_new();\n\t\tX509_gmtime_adj(ci->nextUpdate,(crldays*24+crlhours)*60*60);\n\t\tfor (i=0; i<sk_num(db->data); i++)\n\t\t\t{\n\t\t\tpp=(char **)sk_value(db->data,i);\n\t\t\tif (pp[DB_type][0] == DB_TYPE_REV)\n\t\t\t\t{\n\t\t\t\tif ((r=X509_REVOKED_new()) == NULL) goto err;\n\t\t\t\tASN1_STRING_set((ASN1_STRING *)\n\t\t\t\t\tr->revocationDate,\n\t\t\t\t\t(unsigned char *)pp[DB_rev_date],\n\t\t\t\t\tstrlen(pp[DB_rev_date]));\n\t\t\t\t(void)BIO_reset(hex);\n\t\t\t\tif (!BIO_puts(hex,pp[DB_serial]))\n\t\t\t\t\tgoto err;\n\t\t\t\tif (!a2i_ASN1_INTEGER(hex,r->serialNumber,\n\t\t\t\t\tbuf[0],BSIZE)) goto err;\n\t\t\t\tsk_X509_REVOKED_push(ci->revoked,r);\n\t\t\t\t}\n\t\t\t}\n\t\tsk_X509_REVOKED_sort(ci->revoked);\n\t\tfor (i=0; i<sk_X509_REVOKED_num(ci->revoked); i++)\n\t\t\t{\n\t\t\tr=sk_X509_REVOKED_value(ci->revoked,i);\n\t\t\tr->sequence=i;\n\t\t\t}\n\t\tif (verbose) BIO_printf(bio_err,"signing CRL\\n");\n\t\tif (md != NULL)\n\t\t\t{\n\t\t\tif ((dgst=EVP_get_digestbyname(md)) == NULL)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"%s is an unsupported message digest type\\n",md);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n\t\t    {\n#ifndef NO_DSA\n\t\t    if (pkey->type == EVP_PKEY_DSA)\n\t\t\tdgst=EVP_dss1();\n\t\t    else\n#endif\n\t\t\tdgst=EVP_md5();\n\t\t    }\n\t\tif(crl_ext) {\n\t\t    X509V3_CTX crlctx;\n\t\t    if (ci->version == NULL)\n\t\t    if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;\n\t\t    ASN1_INTEGER_set(ci->version,1);\n\t\t    X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);\n\t\t    X509V3_set_conf_lhash(&crlctx, conf);\n\t\t    if(!X509V3_EXT_CRL_add_conf(conf, &crlctx,\n\t\t\t\t\t\t crl_ext, crl)) goto err;\n\t\t}\n\t\tif (!X509_CRL_sign(crl,pkey,dgst)) goto err;\n\t\tPEM_write_bio_X509_CRL(Sout,crl);\n\t\t}\n\tif (dorevoke)\n\t\t{\n\t\tif (infile == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"no input files\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tX509 *revcert;\n\t\t\tif (BIO_read_filename(in,infile) <= 0)\n\t\t\t\t{\n\t\t\t\tperror(infile);\n\t\t\t\tBIO_printf(bio_err,"error trying to load \'%s\' certificate\\n",infile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\trevcert=PEM_read_bio_X509(in,NULL,NULL,NULL);\n\t\t\tif (revcert == NULL)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unable to load \'%s\' certificate\\n",infile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tj=do_revoke(revcert,db);\n\t\t\tif (j <= 0) goto err;\n\t\t\tX509_free(revcert);\n\t\t\tstrncpy(buf[0],dbfile,BSIZE-4);\n\t\t\tstrcat(buf[0],".new");\n\t\t\tif (BIO_write_filename(out,buf[0]) <= 0)\n\t\t\t\t{\n\t\t\t\tperror(dbfile);\n\t\t\t\tBIO_printf(bio_err,"unable to open \'%s\'\\n",dbfile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tj=TXT_DB_write(out,db);\n\t\t\tif (j <= 0) goto err;\n\t\t\tstrncpy(buf[1],dbfile,BSIZE-4);\n\t\t\tstrcat(buf[1],".old");\n\t\t\tif (rename(dbfile,buf[1]) < 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unable to rename %s to %s\\n", dbfile, buf[1]);\n\t\t\t\tperror("reason");\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (rename(buf[0],dbfile) < 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unable to rename %s to %s\\n", buf[0],dbfile);\n\t\t\t\tperror("reason");\n\t\t\t\trename(buf[1],dbfile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tBIO_printf(bio_err,"Data Base Updated\\n");\n\t\t\t}\n\t\t}\n\tret=0;\nerr:\n\tBIO_free(hex);\n\tBIO_free(Cout);\n\tBIO_free(Sout);\n\tBIO_free(out);\n\tBIO_free(in);\n\tsk_pop_free(cert_sk,X509_free);\n\tif (ret) ERR_print_errors(bio_err);\n\tapp_RAND_write_file(randfile, bio_err);\n\tBN_free(serial);\n\tTXT_DB_free(db);\n\tEVP_PKEY_free(pkey);\n\tX509_free(x509);\n\tX509_CRL_free(crl);\n\tCONF_free(conf);\n\tX509V3_EXT_cleanup();\n\tOBJ_cleanup();\n\tEXIT(ret);\n\t}', 'const char *X509_get_default_cert_area(void)\n\t{ return(X509_CERT_AREA); }']