v3_ocsp.c 7.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275
  1. /* v3_ocsp.c */
  2. /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
  3. * project 1999.
  4. */
  5. /* ====================================================================
  6. * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
  7. *
  8. * Redistribution and use in source and binary forms, with or without
  9. * modification, are permitted provided that the following conditions
  10. * are met:
  11. *
  12. * 1. Redistributions of source code must retain the above copyright
  13. * notice, this list of conditions and the following disclaimer.
  14. *
  15. * 2. Redistributions in binary form must reproduce the above copyright
  16. * notice, this list of conditions and the following disclaimer in
  17. * the documentation and/or other materials provided with the
  18. * distribution.
  19. *
  20. * 3. All advertising materials mentioning features or use of this
  21. * software must display the following acknowledgment:
  22. * "This product includes software developed by the OpenSSL Project
  23. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24. *
  25. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26. * endorse or promote products derived from this software without
  27. * prior written permission. For written permission, please contact
  28. * licensing@OpenSSL.org.
  29. *
  30. * 5. Products derived from this software may not be called "OpenSSL"
  31. * nor may "OpenSSL" appear in their names without prior written
  32. * permission of the OpenSSL Project.
  33. *
  34. * 6. Redistributions of any form whatsoever must retain the following
  35. * acknowledgment:
  36. * "This product includes software developed by the OpenSSL Project
  37. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38. *
  39. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50. * OF THE POSSIBILITY OF SUCH DAMAGE.
  51. * ====================================================================
  52. *
  53. * This product includes cryptographic software written by Eric Young
  54. * (eay@cryptsoft.com). This product includes software written by Tim
  55. * Hudson (tjh@cryptsoft.com).
  56. *
  57. */
  58. #ifndef OPENSSL_NO_OCSP
  59. #include <stdio.h>
  60. #include "cryptlib.h"
  61. #include <openssl/conf.h>
  62. #include <openssl/asn1.h>
  63. #include <openssl/ocsp.h>
  64. #include <openssl/x509v3.h>
  65. /* OCSP extensions and a couple of CRL entry extensions
  66. */
  67. static int i2r_ocsp_crlid(X509V3_EXT_METHOD *method, void *nonce, BIO *out, int indent);
  68. static int i2r_ocsp_acutoff(X509V3_EXT_METHOD *method, void *nonce, BIO *out, int indent);
  69. static int i2r_object(X509V3_EXT_METHOD *method, void *obj, BIO *out, int indent);
  70. static void *ocsp_nonce_new(void);
  71. static int i2d_ocsp_nonce(void *a, unsigned char **pp);
  72. static void *d2i_ocsp_nonce(void *a, const unsigned char **pp, long length);
  73. static void ocsp_nonce_free(void *a);
  74. static int i2r_ocsp_nonce(X509V3_EXT_METHOD *method, void *nonce, BIO *out, int indent);
  75. static int i2r_ocsp_nocheck(X509V3_EXT_METHOD *method, void *nocheck, BIO *out, int indent);
  76. static void *s2i_ocsp_nocheck(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, const char *str);
  77. static int i2r_ocsp_serviceloc(X509V3_EXT_METHOD *method, void *in, BIO *bp, int ind);
  78. X509V3_EXT_METHOD v3_ocsp_crlid = {
  79. NID_id_pkix_OCSP_CrlID, 0, ASN1_ITEM_ref(OCSP_CRLID),
  80. 0,0,0,0,
  81. 0,0,
  82. 0,0,
  83. i2r_ocsp_crlid,0,
  84. NULL
  85. };
  86. X509V3_EXT_METHOD v3_ocsp_acutoff = {
  87. NID_id_pkix_OCSP_archiveCutoff, 0, ASN1_ITEM_ref(ASN1_GENERALIZEDTIME),
  88. 0,0,0,0,
  89. 0,0,
  90. 0,0,
  91. i2r_ocsp_acutoff,0,
  92. NULL
  93. };
  94. X509V3_EXT_METHOD v3_crl_invdate = {
  95. NID_invalidity_date, 0, ASN1_ITEM_ref(ASN1_GENERALIZEDTIME),
  96. 0,0,0,0,
  97. 0,0,
  98. 0,0,
  99. i2r_ocsp_acutoff,0,
  100. NULL
  101. };
  102. X509V3_EXT_METHOD v3_crl_hold = {
  103. NID_hold_instruction_code, 0, ASN1_ITEM_ref(ASN1_OBJECT),
  104. 0,0,0,0,
  105. 0,0,
  106. 0,0,
  107. i2r_object,0,
  108. NULL
  109. };
  110. X509V3_EXT_METHOD v3_ocsp_nonce = {
  111. NID_id_pkix_OCSP_Nonce, 0, NULL,
  112. ocsp_nonce_new,
  113. ocsp_nonce_free,
  114. d2i_ocsp_nonce,
  115. i2d_ocsp_nonce,
  116. 0,0,
  117. 0,0,
  118. i2r_ocsp_nonce,0,
  119. NULL
  120. };
  121. X509V3_EXT_METHOD v3_ocsp_nocheck = {
  122. NID_id_pkix_OCSP_noCheck, 0, ASN1_ITEM_ref(ASN1_NULL),
  123. 0,0,0,0,
  124. 0,s2i_ocsp_nocheck,
  125. 0,0,
  126. i2r_ocsp_nocheck,0,
  127. NULL
  128. };
  129. X509V3_EXT_METHOD v3_ocsp_serviceloc = {
  130. NID_id_pkix_OCSP_serviceLocator, 0, ASN1_ITEM_ref(OCSP_SERVICELOC),
  131. 0,0,0,0,
  132. 0,0,
  133. 0,0,
  134. i2r_ocsp_serviceloc,0,
  135. NULL
  136. };
  137. static int i2r_ocsp_crlid(X509V3_EXT_METHOD *method, void *in, BIO *bp, int ind)
  138. {
  139. OCSP_CRLID *a = in;
  140. if (a->crlUrl)
  141. {
  142. if (!BIO_printf(bp, "%*scrlUrl: ", ind, "")) goto err;
  143. if (!ASN1_STRING_print(bp, (ASN1_STRING*)a->crlUrl)) goto err;
  144. if (!BIO_write(bp, "\n", 1)) goto err;
  145. }
  146. if (a->crlNum)
  147. {
  148. if (!BIO_printf(bp, "%*scrlNum: ", ind, "")) goto err;
  149. if (!i2a_ASN1_INTEGER(bp, a->crlNum)) goto err;
  150. if (!BIO_write(bp, "\n", 1)) goto err;
  151. }
  152. if (a->crlTime)
  153. {
  154. if (!BIO_printf(bp, "%*scrlTime: ", ind, "")) goto err;
  155. if (!ASN1_GENERALIZEDTIME_print(bp, a->crlTime)) goto err;
  156. if (!BIO_write(bp, "\n", 1)) goto err;
  157. }
  158. return 1;
  159. err:
  160. return 0;
  161. }
  162. static int i2r_ocsp_acutoff(X509V3_EXT_METHOD *method, void *cutoff, BIO *bp, int ind)
  163. {
  164. if (!BIO_printf(bp, "%*s", ind, "")) return 0;
  165. if(!ASN1_GENERALIZEDTIME_print(bp, cutoff)) return 0;
  166. return 1;
  167. }
  168. static int i2r_object(X509V3_EXT_METHOD *method, void *oid, BIO *bp, int ind)
  169. {
  170. if (!BIO_printf(bp, "%*s", ind, "")) return 0;
  171. if(!i2a_ASN1_OBJECT(bp, oid)) return 0;
  172. return 1;
  173. }
  174. /* OCSP nonce. This is needs special treatment because it doesn't have
  175. * an ASN1 encoding at all: it just contains arbitrary data.
  176. */
  177. static void *ocsp_nonce_new(void)
  178. {
  179. return ASN1_OCTET_STRING_new();
  180. }
  181. static int i2d_ocsp_nonce(void *a, unsigned char **pp)
  182. {
  183. ASN1_OCTET_STRING *os = a;
  184. if(pp) {
  185. memcpy(*pp, os->data, os->length);
  186. *pp += os->length;
  187. }
  188. return os->length;
  189. }
  190. static void *d2i_ocsp_nonce(void *a, const unsigned char **pp, long length)
  191. {
  192. ASN1_OCTET_STRING *os, **pos;
  193. pos = a;
  194. if(!pos || !*pos) os = ASN1_OCTET_STRING_new();
  195. else os = *pos;
  196. if(!ASN1_OCTET_STRING_set(os, *pp, length)) goto err;
  197. *pp += length;
  198. if(pos) *pos = os;
  199. return os;
  200. err:
  201. if(os && (!pos || (*pos != os))) M_ASN1_OCTET_STRING_free(os);
  202. OCSPerr(OCSP_F_D2I_OCSP_NONCE, ERR_R_MALLOC_FAILURE);
  203. return NULL;
  204. }
  205. static void ocsp_nonce_free(void *a)
  206. {
  207. M_ASN1_OCTET_STRING_free(a);
  208. }
  209. static int i2r_ocsp_nonce(X509V3_EXT_METHOD *method, void *nonce, BIO *out, int indent)
  210. {
  211. if(BIO_printf(out, "%*s", indent, "") <= 0) return 0;
  212. if(i2a_ASN1_STRING(out, nonce, V_ASN1_OCTET_STRING) <= 0) return 0;
  213. return 1;
  214. }
  215. /* Nocheck is just a single NULL. Don't print anything and always set it */
  216. static int i2r_ocsp_nocheck(X509V3_EXT_METHOD *method, void *nocheck, BIO *out, int indent)
  217. {
  218. return 1;
  219. }
  220. static void *s2i_ocsp_nocheck(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, const char *str)
  221. {
  222. return ASN1_NULL_new();
  223. }
  224. static int i2r_ocsp_serviceloc(X509V3_EXT_METHOD *method, void *in, BIO *bp, int ind)
  225. {
  226. int i;
  227. OCSP_SERVICELOC *a = in;
  228. ACCESS_DESCRIPTION *ad;
  229. if (BIO_printf(bp, "%*sIssuer: ", ind, "") <= 0) goto err;
  230. if (X509_NAME_print_ex(bp, a->issuer, 0, XN_FLAG_ONELINE) <= 0) goto err;
  231. for (i = 0; i < sk_ACCESS_DESCRIPTION_num(a->locator); i++)
  232. {
  233. ad = sk_ACCESS_DESCRIPTION_value(a->locator,i);
  234. if (BIO_printf(bp, "\n%*s", (2*ind), "") <= 0)
  235. goto err;
  236. if(i2a_ASN1_OBJECT(bp, ad->method) <= 0) goto err;
  237. if(BIO_puts(bp, " - ") <= 0) goto err;
  238. if(GENERAL_NAME_print(bp, ad->location) <= 0) goto err;
  239. }
  240. return 1;
  241. err:
  242. return 0;
  243. }
  244. #endif