fix certificate request verification

- invalid requests are now shown as FAILED
 - show SPKI challange and signatur algo correctly
 - fix formatting

lib/pki_x509req.cpp

@@ -209,38 +209,36 @@ void pki_x509req::writeReq(const QString fname, bool pem)
 
 bool pki_x509req::compare(pki_base *refreq)
 {
-	if (!refreq) return false;
 	const EVP_MD *digest=EVP_md5();
 	unsigned char d1[EVP_MAX_MD_SIZE], d2[EVP_MAX_MD_SIZE];
 	unsigned int d1_len,d2_len;
+
+	if (!refreq)
+		 return false;
 	X509_REQ_digest(request, digest, d1, &d1_len);
 	X509_REQ_digest(((pki_x509req *)refreq)->request, digest, d2, &d2_len);
 	ign_openssl_error();
 	if ((d1_len == d2_len) &&
 	    (d1_len >0) &&
-	    (memcmp(d1,d2,d1_len) == 0) )return true;
+	    (memcmp(d1,d2,d1_len) == 0) )
+	{
+		return true;
+	}
 	return false;
 }
 
 int pki_x509req::verify()
 {
 	EVP_PKEY *pkey = X509_REQ_get_pubkey(request);
-	bool x = (X509_REQ_verify(request,pkey) >= 0);
-	if ( !x  && spki != NULL) {
-		ign_openssl_error();
-		x = NETSCAPE_SPKI_verify(spki, pkey) >= 0;
-	}
-	if (x) {
-		ign_openssl_error();
+	bool x;
+
+	if (spki) {
+		x = NETSCAPE_SPKI_verify(spki, pkey) > 0;
+	} else {
+		x = X509_REQ_verify(request,pkey) > 0;
 	}
+	ign_openssl_error();
 	EVP_PKEY_free(pkey);
-	try {
-		openssl_error();
-	}
-	catch (errorEx &err) {
-		if (!err.isEmpty())
-			printf("Error: %s\n", CCHAR(err.getString()));
-	}
 	return x;
 }
 
@@ -248,7 +246,8 @@ pki_key *pki_x509req::getPubKey() const
 {
 	 EVP_PKEY *pkey = X509_REQ_get_pubkey(request);
 	 ign_openssl_error();
-	 if (pkey == NULL) return NULL;
+	 if (pkey == NULL)
+		 return NULL;
 	 pki_key *key = new pki_key(pkey);
 	 openssl_error();
 	 return key;
@@ -256,8 +255,13 @@ pki_key *pki_x509req::getPubKey() const
 
 QString pki_x509req::getSigAlg()
 {
-	QString alg = OBJ_nid2ln(OBJ_obj2nid(request->sig_alg->algorithm));
-	return alg;
+	ASN1_OBJECT *o;
+	if (spki) {
+		o = spki->spkac->pubkey->algor->algorithm;
+	} else {
+		o = request->sig_alg->algorithm;
+	}
+	return QString(OBJ_nid2ln(OBJ_obj2nid(o)));
 }
 
 extList pki_x509req::getV3ext()
@@ -424,6 +428,15 @@ void pki_x509req::load_spkac(const QString filename)
 		}
 }
 
+ASN1_IA5STRING *pki_x509req::spki_challange()
+{
+	if (spki) {
+		if (spki->spkac->challenge->length >0)
+			return spki->spkac->challenge;
+	}
+	return NULL;
+}
+
 QVariant pki_x509req::column_data(int col)
 {
 	switch (col) {

lib/pki_x509req.h

@@ -58,6 +58,7 @@ class pki_x509req : public pki_x509super
 		void setSPKIFromData(const unsigned char *p, int size);
 		void setSPKIBase64(const char *p);
 		void set_spki(NETSCAPE_SPKI *_spki);
+		ASN1_IA5STRING *spki_challange();
 		QVariant column_data(int col);
 		QVariant getIcon();
 };

widgets/ReqDetail.cpp

@@ -92,16 +92,26 @@ void ReqDetail::setReq(pki_x509req *req)
 			added++;
 
 			if (att->single) {
-				label = labelFromAsn1Type(att->value.single);
+				label = labelFromAsn1String(att->value.single->value.asn1_string);
 				attrLayout->addWidget(label, i, 1);
 				continue;
 			}
 			int count = sk_ASN1_TYPE_num(att->value.set);
 			for (int j=0; j<count; j++) {
-				label = labelFromAsn1Type(sk_ASN1_TYPE_value(att->value.set, j));
+				label = labelFromAsn1String(sk_ASN1_TYPE_value(att->value.set, j)->value.asn1_string);
 				attrLayout->addWidget(label, i, j +1);
 			}
 		}
+		ASN1_IA5STRING *chal = req->spki_challange();
+		if (chal) {
+			QLabel *label;
+			label = new QLabel(this);
+			label->setText(QString("SPKI Challenge String"));
+			attrLayout->addWidget(label, 0, 0);
+			label = labelFromAsn1String(chal);
+			attrLayout->addWidget(label, 0, 1);
+			added++;
+		}
 		if (!added) {
 			tabwidget->removeTab(2);
 		}
@@ -111,15 +121,14 @@ void ReqDetail::setReq(pki_x509req *req)
 	}
 }
 
-QLabel *ReqDetail::labelFromAsn1Type(ASN1_TYPE *at)
+QLabel *ReqDetail::labelFromAsn1String(ASN1_STRING *s)
 {
 	QLabel *label;
-	ASN1_STRING *st = at->value.asn1_string;
-
 	label = new CopyLabel(this);
-	label->setText(asn1ToQString(st));
-	label->setToolTip(QString(ASN1_tag2str(st->type)));
+	label->setText(asn1ToQString(s));
+	label->setToolTip(QString(ASN1_tag2str(s->type)));
 	label->setFrameShape(QFrame::Panel);
 	label->setFrameShadow(QFrame::Sunken);
 	return label;
 }
+

widgets/ReqDetail.h

@@ -21,7 +21,7 @@ class ReqDetail: public QDialog, public Ui::ReqDetail
    public:
 	ReqDetail( QWidget *parent);
 	void setReq(pki_x509req *req);
-	QLabel *labelFromAsn1Type(ASN1_TYPE *at);
+	QLabel *labelFromAsn1String(ASN1_STRING *s);
 };
 
 #endif