diff --git a/lib/pki_temp.cpp b/lib/pki_temp.cpp index e5b0bf41..5b60e621 100644 --- a/lib/pki_temp.cpp +++ b/lib/pki_temp.cpp @@ -65,6 +65,8 @@ pki_temp::pki_temp(const pki_temp *pk) subAltName=pk->subAltName; issAltName=pk->issAltName; crlDist=pk->crlDist; + authInfAcc=pk->authInfAcc; + certPol=pk->certPol; nsCertType=pk->nsCertType; nsComment=pk->nsComment; nsBaseUrl=pk->nsBaseUrl; @@ -92,11 +94,13 @@ pki_temp::pki_temp(const QString d, int atype) :pki_base(d) { class_name = "pki_temp"; - version=2; + version=3; type=atype; subAltName=""; issAltName=""; crlDist=""; + authInfAcc=""; + certPol=""; nsCertType=0; nsComment="xca certificate"; nsBaseUrl=""; @@ -168,7 +172,7 @@ void pki_temp::fromData(unsigned char *p, int size ) authKey=boolFromData(&p1); subAltCp=boolFromData(&p1); issAltCp=boolFromData(&p1); - if (version == 2) { + if (version >= 2) { ca = intFromData(&p1); } pathLen=intFromData(&p1); @@ -196,15 +200,21 @@ void pki_temp::fromData(unsigned char *p, int size ) nsRenewalUrl=stringFromData(&p1); nsCaPolicyUrl=stringFromData(&p1); nsSslServerName=stringFromData(&p1); - //next version: - if (version == 2) { + // next version: + if (version >= 2) { p1 = xname.d2i(p1, size - (p1-p)); } + if (version >= 3) { + authInfAcc=stringFromData(&p1); + certPol=stringFromData(&p1); + } + if (p1-p != size) { openssl_error("Wrong Size"); } - //set version to 2 - version = 2; + + //set version to 3 + version = 3; } @@ -214,7 +224,7 @@ unsigned char *pki_temp::toData(int *size) *size = dataSize(); p = (unsigned char*)OPENSSL_malloc(*size); p1 = p; - version = 2; + version = 3; intToData(&p1, version); intToData(&p1, type); boolToData(&p1, bcCrit); @@ -242,6 +252,8 @@ unsigned char *pki_temp::toData(int *size) stringToData(&p1, nsCaPolicyUrl); stringToData(&p1, nsSslServerName); p1 = xname.i2d(p1); + stringToData(&p1, authInfAcc); + stringToData(&p1, certPol); return p; } @@ -300,6 +312,8 @@ int pki_temp::dataSize() subAltName.length() + issAltName.length() + crlDist.length() + + authInfAcc.length() + + certPol.length() + nsComment.length() + nsBaseUrl.length() + nsRevocationUrl.length() + @@ -307,7 +321,7 @@ int pki_temp::dataSize() nsRenewalUrl.length() + nsCaPolicyUrl.length() + nsSslServerName.length() + - 10 ) * sizeof(char); + 12 ) * sizeof(char); } diff --git a/lib/pki_temp.h b/lib/pki_temp.h index 55244e1d..5c00403c 100644 --- a/lib/pki_temp.h +++ b/lib/pki_temp.h @@ -64,7 +64,7 @@ class pki_temp: public pki_base enum { EMPTY, CA, CLIENT, SERVER }; static QPixmap *icon; x509name xname; - QString subAltName, issAltName, crlDist; + QString subAltName, issAltName, crlDist, authInfAcc, certPol; QString nsComment, nsBaseUrl, nsRevocationUrl, nsCARevocationUrl, nsRenewalUrl, nsCaPolicyUrl, nsSslServerName; bool bcCrit, keyUseCrit, eKeyUseCrit, subKey, authKey, subAltCp, issAltCp ; diff --git a/ui/NewX509.ui b/ui/NewX509.ui index eabd8c55..59db6ac7 100644 --- a/ui/NewX509.ui +++ b/ui/NewX509.ui @@ -11,7 +11,7 @@ 0 0 - 547 + 531 590 @@ -1222,7 +1222,7 @@ Empy, CA, client, server name - Spacer39 + Spacer33_3 orientation @@ -1604,7 +1604,7 @@ It also copies the issuer and serial number from the issuer certificate. Normall name - Spacer8 + Spacer35_2 orientation @@ -1626,7 +1626,7 @@ It also copies the issuer and serial number from the issuer certificate. Normall QLayoutWidget name - Layout17 + Layout18 @@ -1637,32 +1637,6 @@ It also copies the issuer and serial number from the issuer certificate. Normall spacing 6 - - QCheckBox - - name - issAltCp - - - text - Copy &issuer name - - - toolTip - Wether to copy the subj. alt. name from the issuer - - - - QLabel - - name - TextLabel1_2_2_2 - - - text - issuer alternative name - - QLabel @@ -1674,17 +1648,6 @@ It also copies the issuer and serial number from the issuer certificate. Normall subject alternative name - - QLabel - - name - TextLabel1_2_3_2 - - - text - CRL distribution point - - QCheckBox @@ -1700,24 +1663,6 @@ It also copies the issuer and serial number from the issuer certificate. Normall This will automatically include any email addresses contained in the certificate subject name in the extension. - - QLineEdit - - name - issAltName - - - toolTip - DNS: IP: URI: email: RIP: - - - whatsThis - The issuer alternative name extension allows various literal values to be used. These include "email" (an email address) , "URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a registered ID: OBJECT IDENTIFIER) and IP (an IP address). -Examples: -email:my@other.address, IP: 1.1.1.1 , URI:http://my.url.here/ -email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld - - QLineEdit @@ -1736,21 +1681,48 @@ email:my@other.address, IP: 1.1.1.1 , URI:http://my.url.here/ email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld - + + QLabel + + name + TextLabel1_2_2_2 + + + text + issuer alternative name + + + + QCheckBox + + name + issAltCp + + + text + Copy &issuer name + + + toolTip + Wether to copy the subj. alt. name from the issuer + + + QLineEdit name - crlDist + issAltName + + + toolTip + DNS: IP: URI: email: RIP: whatsThis - This is a multi-valued extension that supports all the literal options of subject alternative name. Of the few software packages that currentlyi nterpret this extension most only interpret the URI option. -Currently each option will set a new DistributionPoint with the fullName field set to the given value. -Other fields like cRLissuer and reasons cannot currently be set or displayed: at this time no examples were available that used these fields. -If you see this extension with <UNSUPPORTED> when you attempt to print it out or it doesn't appear to display correctly then let steve know, including the certificate (mail steve at openssl dot org) . + The issuer alternative name extension allows various literal values to be used. These include "email" (an email address) , "URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a registered ID: OBJECT IDENTIFIER) and IP (an IP address). Examples: -URI:http://www.myhost.com/myca.crl -URI:http://www.my.com/my.crl, URI:http://www.oth.com/my.crl +email:my@other.address, IP: 1.1.1.1 , URI:http://my.url.here/ +email:my@other.address, RID:1.2.3.4, DNS: ns.server.tld @@ -1758,7 +1730,7 @@ URI:http://www.my.com/my.crl, URI:http://www.oth.com/my.crl name - Spacer74 + Spacer34_2 orientation @@ -1877,7 +1849,7 @@ URI:http://www.my.com/my.crl, URI:http://www.oth.com/my.crl name - Spacer79 + Spacer65 orientation @@ -2055,7 +2027,135 @@ URI:http://www.my.com/my.crl, URI:http://www.oth.com/my.crl name - Spacer80 + Spacer66 + + + orientation + Vertical + + + sizeType + Expanding + + + sizeHint + + 20 + 20 + + + + + QLayoutWidget + + name + Layout19 + + + + margin + 0 + + + spacing + 6 + + + QLineEdit + + name + crlDist + + + whatsThis + This is a multi-valued extension that supports all the literal options of subject alternative name. Of the few software packages that currentlyi nterpret this extension most only interpret the URI option. +Currently each option will set a new DistributionPoint with the fullName field set to the given value. +Other fields like cRLissuer and reasons cannot currently be set or displayed: at this time no examples were available that used these fields. +If you see this extension with <UNSUPPORTED> when you attempt to print it out or it doesn't appear to display correctly then let steve know, including the certificate (mail steve at openssl dot org) . +Examples: +URI:http://www.myhost.com/myca.crl +URI:http://www.my.com/my.crl, URI:http://www.oth.com/my.crl + + + + QLabel + + name + TextLabel1_2_3_2_2_2 + + + enabled + false + + + text + Certificate Policies + + + + QLabel + + name + TextLabel1_2_3_2 + + + text + CRL distribution point + + + + QLineEdit + + name + certPol + + + enabled + false + + + whatsThis + If you follow the PKIX recommendations of not including any qualifiers and just +using only one OID then you just include the value of that OID. Multiple OIDs +can be set separated by commas, for example: + +Example: +1.2.4.5, 1.1.3.4 + + + + QLineEdit + + name + authInfAcc + + + whatsThis + The authority information access extension gives details about how to access certain information relating to the CA. Its syntax is accessOID;location where 'location' has the same syntax as subject alternative name (except that email:copy is not supported). accessOID can be any valid OID but only certain values are meaningful for example OCSP and caIssuers. OCSP gives the location of an OCSP responder: this is used by Netscape PSM and other software. + +Example: + +OCSP;URI:http://ocsp.my.host/ +caIssuers;URI:http://my.ca/ca.html + + + + QLabel + + name + TextLabel1_2_3_2_2 + + + text + Authority Info Access + + + + + + + name + Spacer67 orientation @@ -2972,7 +3072,6 @@ URI:http://www.my.com/my.crl, URI:http://www.oth.com/my.crl subAltCp issAltName issAltCp - crlDist kuCritical keyUsage ekuCritical diff --git a/view/CertView.cpp b/view/CertView.cpp index 22633dff..c89db79c 100644 --- a/view/CertView.cpp +++ b/view/CertView.cpp @@ -223,6 +223,8 @@ void CertView::newCert(NewX509 *dlg) cert->addV3ext(dlg->getSubAltName()); cert->addV3ext(dlg->getIssAltName()); cert->addV3ext(dlg->getCrlDist()); + cert->addV3ext(dlg->getAuthInfAcc()); + cert->addV3ext(dlg->getCertPol()); extList ne = dlg->getNetscapeExt(); int m = ne.count(); for (int i=0; isetText(temp->subAltName); issAltName->setText(temp->issAltName); crlDist->setText(temp->crlDist); + authInfAcc->setText(temp->authInfAcc); + certPol->setText(temp->certPol); nsComment->setText(temp->nsComment); nsBaseUrl->setText(temp->nsBaseUrl); nsRevocationUrl->setText(temp->nsRevocationUrl); @@ -381,6 +383,8 @@ void NewX509::toTemplate(pki_temp *temp) temp->subAltName = subAltName->text(); temp->issAltName = issAltName->text(); temp->crlDist = crlDist->text(); + temp->authInfAcc = authInfAcc->text(); + temp->certPol = certPol->text(); temp->nsComment = nsComment->text(); temp->nsBaseUrl = nsBaseUrl->text(); temp->nsRevocationUrl = nsRevocationUrl->text(); diff --git a/widgets/NewX509.h b/widgets/NewX509.h index c43cb5de..254147e6 100644 --- a/widgets/NewX509.h +++ b/widgets/NewX509.h @@ -112,6 +112,8 @@ class NewX509: public NewX509_UI x509v3ext getSubAltName(); x509v3ext getIssAltName(); x509v3ext getCrlDist(); + x509v3ext getAuthInfAcc(); + x509v3ext getCertPol(); extList getNetscapeExt(); const EVP_MD *getHashAlgo(); void initCtx(pki_x509 *subj, pki_x509 *iss); diff --git a/widgets/NewX509_ext.cpp b/widgets/NewX509_ext.cpp index 5d022558..77f78f31 100644 --- a/widgets/NewX509_ext.cpp +++ b/widgets/NewX509_ext.cpp @@ -176,14 +176,33 @@ x509v3ext NewX509::getIssAltName() x509v3ext NewX509::getCrlDist() { - QStringList cont; x509v3ext ext; - if (!crlDist->text().isEmpty()) { + if (!crlDist->text().isEmpty()) { ext.create(NID_crl_distribution_points, crlDist->text()); } return ext; } +x509v3ext NewX509::getAuthInfAcc() +{ + x509v3ext ext; + if (!authInfAcc->text().isEmpty()) { + ext.create(NID_info_access, authInfAcc->text()); + } + return ext; +} + +x509v3ext NewX509::getCertPol() +{ + x509v3ext ext; +#if 0 + if (!certPol->text().isEmpty()) { + ext.create(NID_certificate_policies, certPol->text(), &ext_ctx); + } +#endif + return ext; +} + extList NewX509::getNetscapeExt() { QString certTypeList[] = { @@ -218,6 +237,7 @@ void NewX509::initCtx(pki_x509 *subj, pki_x509 *iss) if (iss) s = iss->getCert(); + memset(&ext_ctx, 0, sizeof(X509V3_CTX)); X509V3_set_ctx(&ext_ctx, s, s1, NULL, NULL, 0); } diff --git a/widgets/validity.cpp b/widgets/validity.cpp index 0fcfba1f..dc0bf58d 100644 --- a/widgets/validity.cpp +++ b/widgets/validity.cpp @@ -79,7 +79,8 @@ Validity::Validity( QWidget* parent, const char* name ) Mon->insertStringList(months); Year = new QLineEdit( this, "Year" ); - Year->setMaximumWidth(CHAR_W * 4); + Year->setMaximumWidth(CHAR_W * 5); + Year->setMinimumWidth(CHAR_W * 4); Year->setValidator( new QIntValidator(1000, 9999, this)); Day = new QLineEdit( this, "Day" );