diff --git a/Rules.mak b/Rules.mak index 6385f4da..be177b9e 100644 --- a/Rules.mak +++ b/Rules.mak @@ -5,10 +5,17 @@ all: target.obj ifneq ($(prefix),) CFLAGS+= -DPREFIX=\"$(prefix)\" endif + ifneq ($(basedir),) CFLAGS+= -DBASEDIR=\"$(basedir)\" endif +ifneq ($(etc),) + CFLAGS+= -DETC=\"$(etc)\" +else + CFLAGS+= -DETC=\"/etc/xca\" +endif + SRCS=$(patsubst %.o, %.cpp, $(OBJS)) # recompile all diff --git a/lib/db_key.cpp b/lib/db_key.cpp index 193195a8..5fec32c5 100644 --- a/lib/db_key.cpp +++ b/lib/db_key.cpp @@ -123,7 +123,6 @@ pki_base* db_key::insert(pki_base *item) "'\n" + tr("and will be completed by the new, private part of the key"), "OK"); deletePKI(oldkey); lkey->setIntName(oldkey->getIntName()); - delete(oldkey); } } insertPKI(lkey); diff --git a/lib/oid.cpp b/lib/oid.cpp index bd6c7670..ce6ac116 100644 --- a/lib/oid.cpp +++ b/lib/oid.cpp @@ -67,6 +67,7 @@ static void readOIDs(QString fname) FILE *fp; int line = 0; QStringList sl; + //fprintf(stderr, "FILE: %s\n", fname.latin1()); fp = fopen(fname.latin1(), "r"); if (fp == NULL) return; while (fgets(buff, 127, fp)) { @@ -92,12 +93,16 @@ static void readOIDs(QString fname) void initOIDs(QString baseDir) { - QString dir=getPrefix(); - readOIDs(dir + QDir::separator() + "oids.txt"); + QString oids = (QChar)QDir::separator(); + oids += "oids.txt"; + QString dir = getPrefix(); + + readOIDs(dir + oids); #ifndef _WIN32_ - readOIDs("/etc/xca/oids.txt"); + QString etc = ETC; + readOIDs(etc + oids); #endif - readOIDs(baseDir + QDir::separator() + "oids.txt"); + readOIDs(baseDir + oids); } /* reads a list of OIDs/SNs from a file and turns them into a QValueList @@ -114,6 +119,7 @@ NIDlist readNIDlist(QString fname) int line = 0, nid; NIDlist nl; nl.clear(); + //fprintf(stderr, "OID FILE: %s\n", fname.latin1()); fp = fopen(fname.latin1(), "r"); if (fp == NULL) return nl; while (fgets(buff, 127, fp)) { diff --git a/misc/aia.txt b/misc/aia.txt new file mode 100644 index 00000000..39c5f197 --- /dev/null +++ b/misc/aia.txt @@ -0,0 +1,3 @@ +OCSP +caIssuers +ad_timestamping diff --git a/misc/xca.nsi b/misc/xca.nsi index 1f7e8044..f93c0647 100755 --- a/misc/xca.nsi +++ b/misc/xca.nsi @@ -72,6 +72,7 @@ Section "xca (required)" File "Release\msvcrt.dll" File "Release\msvcp60.dll" File "Release\qt-mt230nc.dll" + File "doc\*.html" ; Write the installation path into the registry WriteRegStr HKLM SOFTWARE\xca "Install_Dir" "$INSTDIR" diff --git a/ui/CertDetail.ui b/ui/CertDetail.ui index e87903d0..c2356c8f 100644 --- a/ui/CertDetail.ui +++ b/ui/CertDetail.ui @@ -11,8 +11,8 @@ 0 0 - 568 - 477 + 583 + 494 @@ -1274,7 +1274,7 @@ image0 - 789c6dd2c10ac2300c00d07bbf2234b7229d1ddec44f503c0ae2a154410f53d0ed20e2bf6bdb656dd6861dd23d9a66591b0587fd1654235ebded6f0edcd53e419d87ae7b1f4f9b8f906d0bfe012317426a70b07bdc2f3ec77f8ed6b89559061a0343d06a124cc105596482585094bc0ae599b04646c9018926491b2205e140c485cace25755c175d0a967b622ff900b8cc9c7d29af594ea722d589167f813aa852ba07d94b9dce296e883fe7bb163f23896753 + 789c6dd2c10ac2300c00d07bbf2234b7229d1be245fc04c5a3201e4615f430059d0711ff5ddb2e6bb236ec90eed134cb5a19d8ef36602af5ecdbfeeac05dda0798d3abebde87e3faa374d3807fa0d633a52d38d8de6f679fe33fc776e196f53cd010188256a3600a292882096246517815ca99884606e18044a3a40d91824820924265a7923a2e8bcd05f33db1173e002913175f2a6be6d3294871a2d95fa00e8a94ee017b69d339d90df1e77c57ea072ede6758 diff --git a/ui/CertExtend.ui b/ui/CertExtend.ui index 6b68b37e..8c8ae5d3 100644 --- a/ui/CertExtend.ui +++ b/ui/CertExtend.ui @@ -11,13 +11,13 @@ 0 0 - 670 - 329 + 671 + 353 caption - CertExtend_UI + diff --git a/ui/NewX509.ui b/ui/NewX509.ui index 66ce4ff1..22ec3591 100644 --- a/ui/NewX509.ui +++ b/ui/NewX509.ui @@ -11,13 +11,13 @@ 0 0 - 620 + 595 614 caption - + NewX509_UI QWidget @@ -2084,6 +2084,10 @@ email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld selectionMode Multi + + toolTip + can be altered by the file "eku.txt" + @@ -2114,9 +2118,9 @@ email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld QLayoutWidget name - Layout19 + Layout23 - + margin 0 @@ -2125,97 +2129,150 @@ email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld spacing 6 - - QLineEdit + + QLayoutWidget name - crlDist + Layout22 - - whatsThis - This is a multi-valued extension that supports all the literal options of subject alternative name. Of the few software packages that currentlyi nterpret this extension most only interpret the URI option. + + + margin + 0 + + + spacing + 6 + + + QLabel + + name + TextLabel1_2_3_2 + + + text + CRL distribution point + + + + QLabel + + name + TextLabel1_2_3_2_2 + + + text + Authority Info Access + + + + QLabel + + name + TextLabel1_2_3_2_2_2 + + + enabled + false + + + text + Certificate Policies + + + + + + QLayoutWidget + + name + Layout21 + + + + margin + 0 + + + spacing + 6 + + + QLineEdit + + name + authInfAcc + + + toolTip + DNS: IP: URI: email: RIP: + + + whatsThis + The authority information access extension gives details about how to access certain information relating to the CA. Its syntax is accessOID;location where 'location' has the same syntax as subject alternative name (except that email:copy is not supported). accessOID can be any valid OID but only certain values are meaningful for example OCSP and caIssuers. OCSP gives the location of an OCSP responder: this is used by Netscape PSM and other software. + +Example: + +OCSP;URI:http://ocsp.my.host/ +caIssuers;URI:http://my.ca/ca.html + + + + QLineEdit + + name + crlDist + + + whatsThis + This is a multi-valued extension that supports all the literal options of subject alternative name. Of the few software packages that currentlyi nterpret this extension most only interpret the URI option. Currently each option will set a new DistributionPoint with the fullName field set to the given value. Other fields like cRLissuer and reasons cannot currently be set or displayed: at this time no examples were available that used these fields. If you see this extension with <UNSUPPORTED> when you attempt to print it out or it doesn't appear to display correctly then let steve know, including the certificate (mail steve at openssl dot org) . Examples: URI:http://www.myhost.com/myca.crl URI:http://www.my.com/my.crl, URI:http://www.oth.com/my.crl - - - - QLabel - - name - TextLabel1_2_3_2_2_2 - - - enabled - false - - - text - Certificate Policies - - - - QLabel - - name - TextLabel1_2_3_2 - - - text - CRL distribution point - - - - QLineEdit - - name - certPol - - - enabled - false - - - whatsThis - If you follow the PKIX recommendations of not including any qualifiers and just + + + + QLineEdit + + name + certPol + + + enabled + false + + + text + This will be enabled in a later version :-( + + + whatsThis + If you follow the PKIX recommendations of not including any qualifiers and just using only one OID then you just include the value of that OID. Multiple OIDs can be set separated by commas, for example: Example: 1.2.4.5, 1.1.3.4 - + + + + QComboBox + + name + aiaOid + + + toolTip + can be altered by the file "aia.txt" + + + - - QLineEdit - - name - authInfAcc - - - whatsThis - The authority information access extension gives details about how to access certain information relating to the CA. Its syntax is accessOID;location where 'location' has the same syntax as subject alternative name (except that email:copy is not supported). accessOID can be any valid OID but only certain values are meaningful for example OCSP and caIssuers. OCSP gives the location of an OCSP responder: this is used by Netscape PSM and other software. - -Example: - -OCSP;URI:http://ocsp.my.host/ -caIssuers;URI:http://my.ca/ca.html - - - - QLabel - - name - TextLabel1_2_3_2_2 - - - text - Authority Info Access - - - + diff --git a/widgets/MainWindow.cpp b/widgets/MainWindow.cpp index 6024d0f0..9c77bac4 100644 --- a/widgets/MainWindow.cpp +++ b/widgets/MainWindow.cpp @@ -88,6 +88,7 @@ DbEnv *MainWindow::dbenv = NULL; NIDlist *MainWindow::eku_nid = NULL; NIDlist *MainWindow::dn_nid = NULL; +NIDlist *MainWindow::aia_nid = NULL; MainWindow::MainWindow(QWidget *parent, const char *name ) @@ -124,6 +125,29 @@ MainWindow::MainWindow(QWidget *parent, const char *name ) emit init_database(); } +/* creates a new nid list from the given filename */ +NIDlist *MainWindow::read_nidlist(QString name) +{ + NIDlist nl; + QString prefix = getPrefix(); + name = QDir::separator() + name; + + /* first try $HOME/xca/ */ + nl = readNIDlist(baseDir + name); + +#ifndef _WIN32_ + if (nl.count() == 0){ /* next is /etx/xca/... */ + QString unix_etc = ETC; + nl = readNIDlist(unix_etc + name); + } +#endif + + if (nl.count() == 0) /* look at /usr/(local/)share/xca/ */ + nl = readNIDlist(prefix + name); + + return new NIDlist(nl); +} + void MainWindow::init_baseDir() { static bool done = false; @@ -136,34 +160,15 @@ void MainWindow::init_baseDir() qFatal( QString::fromLatin1("Could not create: ") + baseDir ); } done = true; - NIDlist nl; - nl.clear(); - QString prefix = getPrefix(); /* read in all our own OIDs */ initOIDs(baseDir); - nl = readNIDlist(baseDir + QDir::separator() + "eku.txt"); -#ifndef _WIN32_ - if (nl.count() == 0) - nl = readNIDlist("/etc/xca/eku.txt"); -#endif - if (nl.count() == 0) - nl = readNIDlist(prefix + QDir::separator() + "eku.txt"); - eku_nid = new NIDlist(nl); - nl.clear(); - - nl = readNIDlist(baseDir + QDir::separator() + "dn.txt"); -#ifndef _WIN32_ - if (nl.count() == 0) - nl = readNIDlist("/etc/xca/dn.txt"); -#endif - if (nl.count() == 0) - nl = readNIDlist(prefix + QDir::separator() + "dn.txt"); - dn_nid = new NIDlist(nl); + eku_nid = read_nidlist("eku.txt"); + dn_nid = read_nidlist("dn.txt"); + aia_nid = read_nidlist("aia.txt"); } - void MainWindow::do_connections() { @@ -331,6 +336,8 @@ MainWindow::~MainWindow() delete eku_nid; if (dn_nid) delete dn_nid; + if (aia_nid) + delete aia_nid; #ifdef MDEBUG fprintf(stderr, "Memdebug:\n"); CRYPTO_mem_leaks_fp(stderr); diff --git a/widgets/MainWindow.h b/widgets/MainWindow.h index 31c38141..86edc9a8 100644 --- a/widgets/MainWindow.h +++ b/widgets/MainWindow.h @@ -81,7 +81,7 @@ class MainWindow: public MainWindow_UI DbTxn *global_tid; QMenuBar *mb; int force_load; - + NIDlist *read_nidlist(QString name); friend class pki_key; public: @@ -93,7 +93,7 @@ class MainWindow: public MainWindow_UI static db_crl *crls; static db_base *settings; static QPixmap *keyImg, *csrImg, *certImg, *tempImg, *nsImg, *revImg, *appIco; - static NIDlist *eku_nid, *dn_nid; + static NIDlist *eku_nid, *dn_nid, *aia_nid; int exitApp; QString baseDir, dbfile, dbdir; diff --git a/widgets/NewX509.cpp b/widgets/NewX509.cpp index 3f3c3c9e..45f9d024 100644 --- a/widgets/NewX509.cpp +++ b/widgets/NewX509.cpp @@ -96,6 +96,8 @@ NewX509::NewX509(QWidget *parent , const char *name, bool modal, WFlags f) eku_nid = *MainWindow::eku_nid; dn_nid = *MainWindow::dn_nid; + aia_nid = *MainWindow::aia_nid; + setCaption(tr(XCA_TITLE)); fixtemp = NULL; nsImg->setPixmap(*MainWindow::nsImg); @@ -158,6 +160,10 @@ NewX509::NewX509(QWidget *parent , const char *name, bool modal, WFlags f) for (i=0; i < dn_nid.count(); i++) extDNobj->insertItem(OBJ_nid2ln(dn_nid[i])); + // setup Authority Info Access + for (i=0; i < aia_nid.count(); i++) + aiaOid->insertItem(OBJ_nid2ln(aia_nid[i])); + // init the X509 v3 context X509V3_set_ctx(&ext_ctx, NULL , NULL, NULL, NULL, 0); X509V3_set_ctx_nodb((&ext_ctx)); @@ -189,14 +195,14 @@ void NewX509::setRequest() signerBox->setEnabled(false); requestBox->setEnabled(false); startText_h=tr("Welcome to the settings for certificate signing requests."); - startText_b=tr("A signing request needs a private key, so it will be" - "created if there isn't any unused key available in the key" - "database. This signing request can then be given to a" - "Certification authority while the private key of the request" - "and of the resulting certificate returned from the CA does never" + startText_b=tr("A signing request needs a private key, so it will be " + "created if there isn't any unused key available in the key " + "database. This signing request can then be given to a " + "Certification authority while the private key of the request " + "and of the resulting certificate returned from the CA does never " "leave your computer."); - endText=tr("You are done with entering all parameters for generating" - "a Certificate signing request. The resulting request should" + endText=tr("You are done with entering all parameters for generating " + "a Certificate signing request. The resulting request should " "be exported and send to an appropriate CA for signing it."); tText=tr("Certificate signing request"); setup(); @@ -213,12 +219,12 @@ void NewX509::setTemp(pki_temp *temp) setAppropriate(page1, false); finishButton()->setEnabled(true); startText_h=tr("Welcome to the settings for Templates."); - startText_b=tr("This templates do not refer to any ASN.1 structure" - "but are used to keep default settings for signing requests and" - "certificates. When creating a Request or Certificate the template" + startText_b=tr("This templates do not refer to any ASN.1 structure " + "but are used to keep default settings for signing requests and " + "certificates. When creating a Request or Certificate the template " "can preset the needed fields with default settings."); endText=tr("You are done with entering all parameters for the Template.\n" - "After this step the template can be assigned to one of your CAs to" + "After this step the template can be assigned to one of your CAs to " "be autoatically applied when signing with this CA."); tText=tr("Template"); if (temp->getIntName() != "--") { @@ -236,13 +242,13 @@ void NewX509::setCert() { finishButton()->setEnabled(true); startText_h=tr("Welcome to the settings for Certificates."); - startText_b=tr("The information for the new Certificate can either be" - "grabbed from a given Certificate-request or be filled in by hand." - "In the case of not signing a request there needs to be at least one" - "unused key. If this is not the case it will be created. If you want" - "to self-sign a request (unusual but nevertheless possible) you need" + startText_b=tr("The information for the new Certificate can either be " + "grabbed from a given Certificate-request or be filled in by hand. " + "In the case of not signing a request there needs to be at least one " + "unused key. If this is not the case it will be created. If you want " + "to self-sign a request (unusual but nevertheless possible) you need " "the private key used to create the request."); - endText=tr("You are done with entering all parameters for creating" + endText=tr("You are done with entering all parameters for creating " "a Certificate."); tText=tr("Certificate"); setup(); @@ -346,7 +352,7 @@ void NewX509::fromTemplate(pki_temp *temp) subAltName->setText(temp->subAltName); issAltName->setText(temp->issAltName); crlDist->setText(temp->crlDist); - authInfAcc->setText(temp->authInfAcc); + setAuthInfAcc_string(temp->authInfAcc); certPol->setText(temp->certPol); nsComment->setText(temp->nsComment); nsBaseUrl->setText(temp->nsBaseUrl); @@ -382,7 +388,7 @@ void NewX509::toTemplate(pki_temp *temp) temp->subAltName = subAltName->text(); temp->issAltName = issAltName->text(); temp->crlDist = crlDist->text(); - temp->authInfAcc = authInfAcc->text(); + temp->authInfAcc = getAuthInfAcc_string(); temp->certPol = certPol->text(); temp->nsComment = nsComment->text(); temp->nsBaseUrl = nsBaseUrl->text(); diff --git a/widgets/NewX509.h b/widgets/NewX509.h index 3d516459..8ccd62f9 100644 --- a/widgets/NewX509.h +++ b/widgets/NewX509.h @@ -76,6 +76,7 @@ class NewX509: public NewX509_UI QString startText_h, startText_b, endText, tText; NIDlist eku_nid; NIDlist dn_nid; + NIDlist aia_nid; #define EXPLICIT_NAME_CNT 7 static int name_nid[EXPLICIT_NAME_CNT]; QLineEdit *name_ptr[EXPLICIT_NAME_CNT]; @@ -104,6 +105,8 @@ class NewX509: public NewX509_UI x509name getX509name(); void setX509name(const x509name &n); void setImage(QPixmap *image); + void setAuthInfAcc_string(QString aia_txt); + QString getAuthInfAcc_string(); x509v3ext getBasicConstraints(); x509v3ext getSubKeyIdent(); x509v3ext getAuthKeyIdent(); diff --git a/widgets/NewX509_ext.cpp b/widgets/NewX509_ext.cpp index 77f78f31..840064c9 100644 --- a/widgets/NewX509_ext.cpp +++ b/widgets/NewX509_ext.cpp @@ -183,11 +183,46 @@ x509v3ext NewX509::getCrlDist() return ext; } +QString NewX509::getAuthInfAcc_string() +{ + QString rval=""; + QString aia_txt = authInfAcc->text(); + aia_txt.stripWhiteSpace(); + + if (!aia_txt.isEmpty()) { + rval = OBJ_nid2sn(aia_nid[aiaOid->currentItem()]); + rval += ";" + aia_txt; + } + return rval; +} + +void NewX509::setAuthInfAcc_string(QString aia_txt) +{ + QStringList aia; + int nid; + + aia = aia.split(';', aia_txt); + + if (aia.count() != 2) return; + + nid = OBJ_sn2nid(aia[0].latin1()); + + for (int i=0; i < aia_nid.count(); i++) { + if (aia_nid[i] == nid) { + aiaOid->setCurrentItem(i); + } + } + authInfAcc->setText(aia[1]); +} + + x509v3ext NewX509::getAuthInfAcc() { x509v3ext ext; - if (!authInfAcc->text().isEmpty()) { - ext.create(NID_info_access, authInfAcc->text()); + QString aia_txt = getAuthInfAcc_string(); + + if (!aia_txt.isEmpty()) { + ext.create(NID_info_access, aia_txt); } return ext; }