2
0

ocsp.c 41 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262
  1. /*
  2. * Copyright 2001-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <openssl/opensslconf.h>
  10. #ifdef OPENSSL_SYS_VMS
  11. /* So fd_set and friends get properly defined on OpenVMS */
  12. # define _XOPEN_SOURCE_EXTENDED
  13. #endif
  14. #include <stdio.h>
  15. #include <stdlib.h>
  16. #include <string.h>
  17. #include <time.h>
  18. #include <ctype.h>
  19. /* Needs to be included before the openssl headers */
  20. #include "apps.h"
  21. #include "http_server.h"
  22. #include "progs.h"
  23. #include "internal/sockets.h"
  24. #include <openssl/e_os2.h>
  25. #include <openssl/crypto.h>
  26. #include <openssl/err.h>
  27. #include <openssl/ssl.h>
  28. #include <openssl/evp.h>
  29. #include <openssl/bn.h>
  30. #include <openssl/x509v3.h>
  31. #if defined(OPENSSL_SYS_VXWORKS)
  32. /* not supported */
  33. int setpgid(pid_t pid, pid_t pgid)
  34. {
  35. errno = ENOSYS;
  36. return 0;
  37. }
  38. /* not supported */
  39. pid_t fork(void)
  40. {
  41. errno = ENOSYS;
  42. return (pid_t) -1;
  43. }
  44. #endif
  45. /* Maximum leeway in validity period: default 5 minutes */
  46. #define MAX_VALIDITY_PERIOD (5 * 60)
  47. static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert,
  48. const EVP_MD *cert_id_md, X509 *issuer,
  49. STACK_OF(OCSP_CERTID) *ids);
  50. static int add_ocsp_serial(OCSP_REQUEST **req, char *serial,
  51. const EVP_MD *cert_id_md, X509 *issuer,
  52. STACK_OF(OCSP_CERTID) *ids);
  53. static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
  54. STACK_OF(OPENSSL_STRING) *names,
  55. STACK_OF(OCSP_CERTID) *ids, long nsec,
  56. long maxage);
  57. static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req,
  58. CA_DB *db, STACK_OF(X509) *ca, X509 *rcert,
  59. EVP_PKEY *rkey, const EVP_MD *md,
  60. STACK_OF(OPENSSL_STRING) *sigopts,
  61. STACK_OF(X509) *rother, unsigned long flags,
  62. int nmin, int ndays, int badsig,
  63. const EVP_MD *resp_md);
  64. static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser);
  65. static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio,
  66. int timeout);
  67. static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp);
  68. static char *prog;
  69. #ifdef HTTP_DAEMON
  70. static int index_changed(CA_DB *);
  71. #endif
  72. typedef enum OPTION_choice {
  73. OPT_COMMON,
  74. OPT_OUTFILE, OPT_TIMEOUT, OPT_URL, OPT_HOST, OPT_PORT,
  75. #ifndef OPENSSL_NO_SOCK
  76. OPT_PROXY, OPT_NO_PROXY,
  77. #endif
  78. OPT_IGNORE_ERR, OPT_NOVERIFY, OPT_NONCE, OPT_NO_NONCE,
  79. OPT_RESP_NO_CERTS, OPT_RESP_KEY_ID, OPT_NO_CERTS,
  80. OPT_NO_SIGNATURE_VERIFY, OPT_NO_CERT_VERIFY, OPT_NO_CHAIN,
  81. OPT_NO_CERT_CHECKS, OPT_NO_EXPLICIT, OPT_TRUST_OTHER,
  82. OPT_NO_INTERN, OPT_BADSIG, OPT_TEXT, OPT_REQ_TEXT, OPT_RESP_TEXT,
  83. OPT_REQIN, OPT_RESPIN, OPT_SIGNER, OPT_VAFILE, OPT_SIGN_OTHER,
  84. OPT_VERIFY_OTHER, OPT_CAFILE, OPT_CAPATH, OPT_CASTORE, OPT_NOCAFILE,
  85. OPT_NOCAPATH, OPT_NOCASTORE,
  86. OPT_VALIDITY_PERIOD, OPT_STATUS_AGE, OPT_SIGNKEY, OPT_REQOUT,
  87. OPT_RESPOUT, OPT_PATH, OPT_ISSUER, OPT_CERT, OPT_SERIAL,
  88. OPT_INDEX, OPT_CA, OPT_NMIN, OPT_REQUEST, OPT_NDAYS, OPT_RSIGNER,
  89. OPT_RKEY, OPT_ROTHER, OPT_RMD, OPT_RSIGOPT, OPT_HEADER,
  90. OPT_PASSIN,
  91. OPT_RCID,
  92. OPT_V_ENUM,
  93. OPT_MD,
  94. OPT_MULTI, OPT_PROV_ENUM
  95. } OPTION_CHOICE;
  96. const OPTIONS ocsp_options[] = {
  97. OPT_SECTION("General"),
  98. {"help", OPT_HELP, '-', "Display this summary"},
  99. {"ignore_err", OPT_IGNORE_ERR, '-',
  100. "Ignore error on OCSP request or response and continue running"},
  101. {"CAfile", OPT_CAFILE, '<', "Trusted certificates file"},
  102. {"CApath", OPT_CAPATH, '<', "Trusted certificates directory"},
  103. {"CAstore", OPT_CASTORE, ':', "Trusted certificates store URI"},
  104. {"no-CAfile", OPT_NOCAFILE, '-',
  105. "Do not load the default certificates file"},
  106. {"no-CApath", OPT_NOCAPATH, '-',
  107. "Do not load certificates from the default certificates directory"},
  108. {"no-CAstore", OPT_NOCASTORE, '-',
  109. "Do not load certificates from the default certificates store"},
  110. OPT_SECTION("Responder"),
  111. {"timeout", OPT_TIMEOUT, 'p',
  112. "Connection timeout (in seconds) to the OCSP responder"},
  113. {"resp_no_certs", OPT_RESP_NO_CERTS, '-',
  114. "Don't include any certificates in response"},
  115. #ifdef HTTP_DAEMON
  116. {"multi", OPT_MULTI, 'p', "run multiple responder processes"},
  117. #endif
  118. {"no_certs", OPT_NO_CERTS, '-',
  119. "Don't include any certificates in signed request"},
  120. {"badsig", OPT_BADSIG, '-',
  121. "Corrupt last byte of loaded OCSP response signature (for test)"},
  122. {"CA", OPT_CA, '<', "CA certificates"},
  123. {"nmin", OPT_NMIN, 'p', "Number of minutes before next update"},
  124. {"nrequest", OPT_REQUEST, 'p',
  125. "Number of requests to accept (default unlimited)"},
  126. {"reqin", OPT_REQIN, 's', "File with the DER-encoded request"},
  127. {"signer", OPT_SIGNER, '<', "Certificate to sign OCSP request with"},
  128. {"sign_other", OPT_SIGN_OTHER, '<',
  129. "Additional certificates to include in signed request"},
  130. {"index", OPT_INDEX, '<', "Certificate status index file"},
  131. {"ndays", OPT_NDAYS, 'p', "Number of days before next update"},
  132. {"rsigner", OPT_RSIGNER, '<',
  133. "Responder certificate to sign responses with"},
  134. {"rkey", OPT_RKEY, '<', "Responder key to sign responses with"},
  135. {"passin", OPT_PASSIN, 's', "Responder key pass phrase source"},
  136. {"rother", OPT_ROTHER, '<', "Other certificates to include in response"},
  137. {"rmd", OPT_RMD, 's', "Digest Algorithm to use in signature of OCSP response"},
  138. {"rsigopt", OPT_RSIGOPT, 's', "OCSP response signature parameter in n:v form"},
  139. {"header", OPT_HEADER, 's', "key=value header to add"},
  140. {"rcid", OPT_RCID, 's', "Use specified algorithm for cert id in response"},
  141. {"", OPT_MD, '-', "Any supported digest algorithm (sha1,sha256, ... )"},
  142. OPT_SECTION("Client"),
  143. {"url", OPT_URL, 's', "Responder URL"},
  144. {"host", OPT_HOST, 's', "TCP/IP hostname:port to connect to"},
  145. {"port", OPT_PORT, 'N', "Port to run responder on"},
  146. {"path", OPT_PATH, 's', "Path to use in OCSP request"},
  147. #ifndef OPENSSL_NO_SOCK
  148. {"proxy", OPT_PROXY, 's',
  149. "[http[s]://]host[:port][/path] of HTTP(S) proxy to use; path is ignored"},
  150. {"no_proxy", OPT_NO_PROXY, 's',
  151. "List of addresses of servers not to use HTTP(S) proxy for"},
  152. {OPT_MORE_STR, 0, 0,
  153. "Default from environment variable 'no_proxy', else 'NO_PROXY', else none"},
  154. #endif
  155. {"out", OPT_OUTFILE, '>', "Output filename"},
  156. {"noverify", OPT_NOVERIFY, '-', "Don't verify response at all"},
  157. {"nonce", OPT_NONCE, '-', "Add OCSP nonce to request"},
  158. {"no_nonce", OPT_NO_NONCE, '-', "Don't add OCSP nonce to request"},
  159. {"no_signature_verify", OPT_NO_SIGNATURE_VERIFY, '-',
  160. "Don't check signature on response"},
  161. {"resp_key_id", OPT_RESP_KEY_ID, '-',
  162. "Identify response by signing certificate key ID"},
  163. {"no_cert_verify", OPT_NO_CERT_VERIFY, '-',
  164. "Don't check signing certificate"},
  165. {"text", OPT_TEXT, '-', "Print text form of request and response"},
  166. {"req_text", OPT_REQ_TEXT, '-', "Print text form of request"},
  167. {"resp_text", OPT_RESP_TEXT, '-', "Print text form of response"},
  168. {"no_chain", OPT_NO_CHAIN, '-', "Don't chain verify response"},
  169. {"no_cert_checks", OPT_NO_CERT_CHECKS, '-',
  170. "Don't do additional checks on signing certificate"},
  171. {"no_explicit", OPT_NO_EXPLICIT, '-',
  172. "Do not explicitly check the chain, just verify the root"},
  173. {"trust_other", OPT_TRUST_OTHER, '-',
  174. "Don't verify additional certificates"},
  175. {"no_intern", OPT_NO_INTERN, '-',
  176. "Don't search certificates contained in response for signer"},
  177. {"respin", OPT_RESPIN, 's', "File with the DER-encoded response"},
  178. {"VAfile", OPT_VAFILE, '<', "Validator certificates file"},
  179. {"verify_other", OPT_VERIFY_OTHER, '<',
  180. "Additional certificates to search for signer"},
  181. {"cert", OPT_CERT, '<',
  182. "Certificate to check; may be given multiple times"},
  183. {"serial", OPT_SERIAL, 's',
  184. "Serial number to check; may be given multiple times"},
  185. {"validity_period", OPT_VALIDITY_PERIOD, 'u',
  186. "Maximum validity discrepancy in seconds"},
  187. {"signkey", OPT_SIGNKEY, 's', "Private key to sign OCSP request with"},
  188. {"reqout", OPT_REQOUT, 's', "Output file for the DER-encoded request"},
  189. {"respout", OPT_RESPOUT, 's', "Output file for the DER-encoded response"},
  190. {"issuer", OPT_ISSUER, '<', "Issuer certificate"},
  191. {"status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds"},
  192. OPT_V_OPTIONS,
  193. OPT_PROV_OPTIONS,
  194. {NULL}
  195. };
  196. int ocsp_main(int argc, char **argv)
  197. {
  198. BIO *acbio = NULL, *cbio = NULL, *derbio = NULL, *out = NULL;
  199. EVP_MD *cert_id_md = NULL, *rsign_md = NULL;
  200. STACK_OF(OPENSSL_STRING) *rsign_sigopts = NULL;
  201. int trailing_md = 0;
  202. CA_DB *rdb = NULL;
  203. EVP_PKEY *key = NULL, *rkey = NULL;
  204. OCSP_BASICRESP *bs = NULL;
  205. OCSP_REQUEST *req = NULL;
  206. OCSP_RESPONSE *resp = NULL;
  207. STACK_OF(CONF_VALUE) *headers = NULL;
  208. STACK_OF(OCSP_CERTID) *ids = NULL;
  209. STACK_OF(OPENSSL_STRING) *reqnames = NULL;
  210. STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL;
  211. STACK_OF(X509) *issuers = NULL;
  212. X509 *issuer = NULL, *cert = NULL;
  213. STACK_OF(X509) *rca_certs = NULL;
  214. EVP_MD *resp_certid_md = NULL;
  215. X509 *signer = NULL, *rsigner = NULL;
  216. X509_STORE *store = NULL;
  217. X509_VERIFY_PARAM *vpm = NULL;
  218. const char *CAfile = NULL, *CApath = NULL, *CAstore = NULL;
  219. char *header, *value, *respdigname = NULL;
  220. char *host = NULL, *port = NULL, *path = "/", *outfile = NULL;
  221. #ifndef OPENSSL_NO_SOCK
  222. char *opt_proxy = NULL;
  223. char *opt_no_proxy = NULL;
  224. #endif
  225. char *rca_filename = NULL, *reqin = NULL, *respin = NULL;
  226. char *reqout = NULL, *respout = NULL, *ridx_filename = NULL;
  227. char *rsignfile = NULL, *rkeyfile = NULL;
  228. char *passinarg = NULL, *passin = NULL;
  229. char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
  230. char *signfile = NULL, *keyfile = NULL;
  231. char *thost = NULL, *tport = NULL, *tpath = NULL;
  232. int noCAfile = 0, noCApath = 0, noCAstore = 0;
  233. int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1;
  234. int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1;
  235. int req_text = 0, resp_text = 0, res, ret = 1;
  236. int req_timeout = -1;
  237. long nsec = MAX_VALIDITY_PERIOD, maxage = -1;
  238. unsigned long sign_flags = 0, verify_flags = 0, rflags = 0;
  239. OPTION_CHOICE o;
  240. if ((reqnames = sk_OPENSSL_STRING_new_null()) == NULL
  241. || (ids = sk_OCSP_CERTID_new_null()) == NULL
  242. || (vpm = X509_VERIFY_PARAM_new()) == NULL)
  243. goto end;
  244. opt_set_unknown_name("digest");
  245. prog = opt_init(argc, argv, ocsp_options);
  246. while ((o = opt_next()) != OPT_EOF) {
  247. switch (o) {
  248. case OPT_EOF:
  249. case OPT_ERR:
  250. opthelp:
  251. BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
  252. goto end;
  253. case OPT_HELP:
  254. ret = 0;
  255. opt_help(ocsp_options);
  256. goto end;
  257. case OPT_OUTFILE:
  258. outfile = opt_arg();
  259. break;
  260. case OPT_TIMEOUT:
  261. #ifndef OPENSSL_NO_SOCK
  262. req_timeout = atoi(opt_arg());
  263. #endif
  264. break;
  265. case OPT_URL:
  266. OPENSSL_free(thost);
  267. OPENSSL_free(tport);
  268. OPENSSL_free(tpath);
  269. thost = tport = tpath = NULL;
  270. if (!OSSL_HTTP_parse_url(opt_arg(), &use_ssl, NULL /* userinfo */,
  271. &host, &port, NULL /* port_num */,
  272. &path, NULL /* qry */, NULL /* frag */)) {
  273. BIO_printf(bio_err, "%s Error parsing -url argument\n", prog);
  274. goto end;
  275. }
  276. thost = host;
  277. tport = port;
  278. tpath = path;
  279. break;
  280. case OPT_HOST:
  281. host = opt_arg();
  282. break;
  283. case OPT_PORT:
  284. port = opt_arg();
  285. break;
  286. case OPT_PATH:
  287. path = opt_arg();
  288. break;
  289. #ifndef OPENSSL_NO_SOCK
  290. case OPT_PROXY:
  291. opt_proxy = opt_arg();
  292. break;
  293. case OPT_NO_PROXY:
  294. opt_no_proxy = opt_arg();
  295. break;
  296. #endif
  297. case OPT_IGNORE_ERR:
  298. ignore_err = 1;
  299. break;
  300. case OPT_NOVERIFY:
  301. noverify = 1;
  302. break;
  303. case OPT_NONCE:
  304. add_nonce = 2;
  305. break;
  306. case OPT_NO_NONCE:
  307. add_nonce = 0;
  308. break;
  309. case OPT_RESP_NO_CERTS:
  310. rflags |= OCSP_NOCERTS;
  311. break;
  312. case OPT_RESP_KEY_ID:
  313. rflags |= OCSP_RESPID_KEY;
  314. break;
  315. case OPT_NO_CERTS:
  316. sign_flags |= OCSP_NOCERTS;
  317. break;
  318. case OPT_NO_SIGNATURE_VERIFY:
  319. verify_flags |= OCSP_NOSIGS;
  320. break;
  321. case OPT_NO_CERT_VERIFY:
  322. verify_flags |= OCSP_NOVERIFY;
  323. break;
  324. case OPT_NO_CHAIN:
  325. verify_flags |= OCSP_NOCHAIN;
  326. break;
  327. case OPT_NO_CERT_CHECKS:
  328. verify_flags |= OCSP_NOCHECKS;
  329. break;
  330. case OPT_NO_EXPLICIT:
  331. verify_flags |= OCSP_NOEXPLICIT;
  332. break;
  333. case OPT_TRUST_OTHER:
  334. verify_flags |= OCSP_TRUSTOTHER;
  335. break;
  336. case OPT_NO_INTERN:
  337. verify_flags |= OCSP_NOINTERN;
  338. break;
  339. case OPT_BADSIG:
  340. badsig = 1;
  341. break;
  342. case OPT_TEXT:
  343. req_text = resp_text = 1;
  344. break;
  345. case OPT_REQ_TEXT:
  346. req_text = 1;
  347. break;
  348. case OPT_RESP_TEXT:
  349. resp_text = 1;
  350. break;
  351. case OPT_REQIN:
  352. reqin = opt_arg();
  353. break;
  354. case OPT_RESPIN:
  355. respin = opt_arg();
  356. break;
  357. case OPT_SIGNER:
  358. signfile = opt_arg();
  359. break;
  360. case OPT_VAFILE:
  361. verify_certfile = opt_arg();
  362. verify_flags |= OCSP_TRUSTOTHER;
  363. break;
  364. case OPT_SIGN_OTHER:
  365. sign_certfile = opt_arg();
  366. break;
  367. case OPT_VERIFY_OTHER:
  368. verify_certfile = opt_arg();
  369. break;
  370. case OPT_CAFILE:
  371. CAfile = opt_arg();
  372. break;
  373. case OPT_CAPATH:
  374. CApath = opt_arg();
  375. break;
  376. case OPT_CASTORE:
  377. CAstore = opt_arg();
  378. break;
  379. case OPT_NOCAFILE:
  380. noCAfile = 1;
  381. break;
  382. case OPT_NOCAPATH:
  383. noCApath = 1;
  384. break;
  385. case OPT_NOCASTORE:
  386. noCAstore = 1;
  387. break;
  388. case OPT_V_CASES:
  389. if (!opt_verify(o, vpm))
  390. goto end;
  391. vpmtouched++;
  392. break;
  393. case OPT_VALIDITY_PERIOD:
  394. opt_long(opt_arg(), &nsec);
  395. break;
  396. case OPT_STATUS_AGE:
  397. opt_long(opt_arg(), &maxage);
  398. break;
  399. case OPT_SIGNKEY:
  400. keyfile = opt_arg();
  401. break;
  402. case OPT_REQOUT:
  403. reqout = opt_arg();
  404. break;
  405. case OPT_RESPOUT:
  406. respout = opt_arg();
  407. break;
  408. case OPT_ISSUER:
  409. issuer = load_cert(opt_arg(), FORMAT_UNDEF, "issuer certificate");
  410. if (issuer == NULL)
  411. goto end;
  412. if (issuers == NULL) {
  413. if ((issuers = sk_X509_new_null()) == NULL)
  414. goto end;
  415. }
  416. if (!sk_X509_push(issuers, issuer))
  417. goto end;
  418. break;
  419. case OPT_CERT:
  420. reset_unknown();
  421. X509_free(cert);
  422. cert = load_cert(opt_arg(), FORMAT_UNDEF, "certificate");
  423. if (cert == NULL)
  424. goto end;
  425. if (cert_id_md == NULL)
  426. cert_id_md = (EVP_MD *)EVP_sha1();
  427. if (!add_ocsp_cert(&req, cert, cert_id_md, issuer, ids))
  428. goto end;
  429. if (!sk_OPENSSL_STRING_push(reqnames, opt_arg()))
  430. goto end;
  431. trailing_md = 0;
  432. break;
  433. case OPT_SERIAL:
  434. reset_unknown();
  435. if (cert_id_md == NULL)
  436. cert_id_md = (EVP_MD *)EVP_sha1();
  437. if (!add_ocsp_serial(&req, opt_arg(), cert_id_md, issuer, ids))
  438. goto end;
  439. if (!sk_OPENSSL_STRING_push(reqnames, opt_arg()))
  440. goto end;
  441. trailing_md = 0;
  442. break;
  443. case OPT_INDEX:
  444. ridx_filename = opt_arg();
  445. break;
  446. case OPT_CA:
  447. rca_filename = opt_arg();
  448. break;
  449. case OPT_NMIN:
  450. nmin = opt_int_arg();
  451. if (ndays == -1)
  452. ndays = 0;
  453. break;
  454. case OPT_REQUEST:
  455. accept_count = opt_int_arg();
  456. break;
  457. case OPT_NDAYS:
  458. ndays = atoi(opt_arg());
  459. break;
  460. case OPT_RSIGNER:
  461. rsignfile = opt_arg();
  462. break;
  463. case OPT_RKEY:
  464. rkeyfile = opt_arg();
  465. break;
  466. case OPT_PASSIN:
  467. passinarg = opt_arg();
  468. break;
  469. case OPT_ROTHER:
  470. rcertfile = opt_arg();
  471. break;
  472. case OPT_RMD: /* Response MessageDigest */
  473. respdigname = opt_arg();
  474. break;
  475. case OPT_RSIGOPT:
  476. if (rsign_sigopts == NULL)
  477. rsign_sigopts = sk_OPENSSL_STRING_new_null();
  478. if (rsign_sigopts == NULL
  479. || !sk_OPENSSL_STRING_push(rsign_sigopts, opt_arg()))
  480. goto end;
  481. break;
  482. case OPT_HEADER:
  483. header = opt_arg();
  484. value = strchr(header, '=');
  485. if (value == NULL) {
  486. BIO_printf(bio_err, "Missing = in header key=value\n");
  487. goto opthelp;
  488. }
  489. *value++ = '\0';
  490. if (!X509V3_add_value(header, value, &headers))
  491. goto end;
  492. break;
  493. case OPT_RCID:
  494. if (!opt_md(opt_arg(), &resp_certid_md))
  495. goto opthelp;
  496. break;
  497. case OPT_MD:
  498. if (trailing_md) {
  499. BIO_printf(bio_err,
  500. "%s: Digest must be before -cert or -serial\n",
  501. prog);
  502. goto opthelp;
  503. }
  504. if (!opt_md(opt_unknown(), &cert_id_md))
  505. goto opthelp;
  506. trailing_md = 1;
  507. break;
  508. case OPT_MULTI:
  509. #ifdef HTTP_DAEMON
  510. n_responders = atoi(opt_arg());
  511. #endif
  512. break;
  513. case OPT_PROV_CASES:
  514. if (!opt_provider(o))
  515. goto end;
  516. break;
  517. }
  518. }
  519. /* No extra arguments. */
  520. if (!opt_check_rest_arg(NULL))
  521. goto opthelp;
  522. if (trailing_md) {
  523. BIO_printf(bio_err, "%s: Digest must be before -cert or -serial\n",
  524. prog);
  525. goto opthelp;
  526. }
  527. if (respdigname != NULL) {
  528. if (!opt_md(respdigname, &rsign_md))
  529. goto end;
  530. }
  531. /* Have we anything to do? */
  532. if (req == NULL && reqin == NULL
  533. && respin == NULL && !(port != NULL && ridx_filename != NULL))
  534. goto opthelp;
  535. out = bio_open_default(outfile, 'w', FORMAT_TEXT);
  536. if (out == NULL)
  537. goto end;
  538. if (req == NULL && (add_nonce != 2))
  539. add_nonce = 0;
  540. if (req == NULL && reqin != NULL) {
  541. derbio = bio_open_default(reqin, 'r', FORMAT_ASN1);
  542. if (derbio == NULL)
  543. goto end;
  544. req = d2i_OCSP_REQUEST_bio(derbio, NULL);
  545. BIO_free(derbio);
  546. if (req == NULL) {
  547. BIO_printf(bio_err, "Error reading OCSP request\n");
  548. goto end;
  549. }
  550. }
  551. if (req == NULL && port != NULL) {
  552. #ifndef OPENSSL_NO_SOCK
  553. acbio = http_server_init(prog, port, -1);
  554. if (acbio == NULL)
  555. goto end;
  556. #else
  557. BIO_printf(bio_err, "Cannot act as server - sockets not supported\n");
  558. goto end;
  559. #endif
  560. }
  561. if (rsignfile != NULL) {
  562. if (rkeyfile == NULL)
  563. rkeyfile = rsignfile;
  564. rsigner = load_cert(rsignfile, FORMAT_UNDEF, "responder certificate");
  565. if (rsigner == NULL) {
  566. BIO_printf(bio_err, "Error loading responder certificate\n");
  567. goto end;
  568. }
  569. if (!load_certs(rca_filename, 0, &rca_certs, NULL, "CA certificates"))
  570. goto end;
  571. if (rcertfile != NULL) {
  572. if (!load_certs(rcertfile, 0, &rother, NULL,
  573. "responder other certificates"))
  574. goto end;
  575. }
  576. if (!app_passwd(passinarg, NULL, &passin, NULL)) {
  577. BIO_printf(bio_err, "Error getting password\n");
  578. goto end;
  579. }
  580. rkey = load_key(rkeyfile, FORMAT_UNDEF, 0, passin, NULL,
  581. "responder private key");
  582. if (rkey == NULL)
  583. goto end;
  584. }
  585. if (ridx_filename != NULL
  586. && (rkey == NULL || rsigner == NULL || rca_certs == NULL)) {
  587. BIO_printf(bio_err,
  588. "Responder mode requires certificate, key, and CA.\n");
  589. goto end;
  590. }
  591. if (ridx_filename != NULL) {
  592. rdb = load_index(ridx_filename, NULL);
  593. if (rdb == NULL || index_index(rdb) <= 0) {
  594. BIO_printf(bio_err,
  595. "Problem with index file: %s (could not load/parse file)\n",
  596. ridx_filename);
  597. ret = 1;
  598. goto end;
  599. }
  600. }
  601. #ifdef HTTP_DAEMON
  602. if (n_responders != 0 && acbio != NULL)
  603. spawn_loop(prog);
  604. if (acbio != NULL && req_timeout > 0)
  605. signal(SIGALRM, socket_timeout);
  606. #endif
  607. if (acbio != NULL)
  608. trace_log_message(-1, prog,
  609. LOG_INFO, "waiting for OCSP client connections...");
  610. redo_accept:
  611. if (acbio != NULL) {
  612. #ifdef HTTP_DAEMON
  613. if (index_changed(rdb)) {
  614. CA_DB *newrdb = load_index(ridx_filename, NULL);
  615. if (newrdb != NULL && index_index(newrdb) > 0) {
  616. free_index(rdb);
  617. rdb = newrdb;
  618. } else {
  619. free_index(newrdb);
  620. trace_log_message(-1, prog,
  621. LOG_ERR, "error reloading updated index: %s",
  622. ridx_filename);
  623. }
  624. }
  625. #endif
  626. req = NULL;
  627. res = do_responder(&req, &cbio, acbio, req_timeout);
  628. if (res == 0)
  629. goto redo_accept;
  630. if (req == NULL) {
  631. if (res == 1) {
  632. resp =
  633. OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST,
  634. NULL);
  635. send_ocsp_response(cbio, resp);
  636. }
  637. goto done_resp;
  638. }
  639. }
  640. if (req == NULL
  641. && (signfile != NULL || reqout != NULL
  642. || host != NULL || add_nonce || ridx_filename != NULL)) {
  643. BIO_printf(bio_err, "Need an OCSP request for this operation!\n");
  644. goto end;
  645. }
  646. if (req != NULL && add_nonce) {
  647. if (!OCSP_request_add1_nonce(req, NULL, -1))
  648. goto end;
  649. }
  650. if (signfile != NULL) {
  651. if (keyfile == NULL)
  652. keyfile = signfile;
  653. signer = load_cert(signfile, FORMAT_UNDEF, "signer certificate");
  654. if (signer == NULL) {
  655. BIO_printf(bio_err, "Error loading signer certificate\n");
  656. goto end;
  657. }
  658. if (sign_certfile != NULL) {
  659. if (!load_certs(sign_certfile, 0, &sign_other, NULL,
  660. "signer certificates"))
  661. goto end;
  662. }
  663. key = load_key(keyfile, FORMAT_UNDEF, 0, NULL, NULL,
  664. "signer private key");
  665. if (key == NULL)
  666. goto end;
  667. if (!OCSP_request_sign(req, signer, key, NULL,
  668. sign_other, sign_flags)) {
  669. BIO_printf(bio_err, "Error signing OCSP request\n");
  670. goto end;
  671. }
  672. }
  673. if (req_text && req != NULL)
  674. OCSP_REQUEST_print(out, req, 0);
  675. if (reqout != NULL) {
  676. derbio = bio_open_default(reqout, 'w', FORMAT_ASN1);
  677. if (derbio == NULL)
  678. goto end;
  679. i2d_OCSP_REQUEST_bio(derbio, req);
  680. BIO_free(derbio);
  681. }
  682. if (rdb != NULL) {
  683. make_ocsp_response(bio_err, &resp, req, rdb, rca_certs, rsigner, rkey,
  684. rsign_md, rsign_sigopts, rother, rflags, nmin, ndays,
  685. badsig, resp_certid_md);
  686. if (resp == NULL)
  687. goto end;
  688. if (cbio != NULL)
  689. send_ocsp_response(cbio, resp);
  690. } else if (host != NULL) {
  691. #ifndef OPENSSL_NO_SOCK
  692. resp = process_responder(req, host, port, path, opt_proxy, opt_no_proxy,
  693. use_ssl, headers, req_timeout);
  694. if (resp == NULL)
  695. goto end;
  696. #else
  697. BIO_printf(bio_err,
  698. "Error creating connect BIO - sockets not supported\n");
  699. goto end;
  700. #endif
  701. } else if (respin != NULL) {
  702. derbio = bio_open_default(respin, 'r', FORMAT_ASN1);
  703. if (derbio == NULL)
  704. goto end;
  705. resp = d2i_OCSP_RESPONSE_bio(derbio, NULL);
  706. BIO_free(derbio);
  707. if (resp == NULL) {
  708. BIO_printf(bio_err, "Error reading OCSP response\n");
  709. goto end;
  710. }
  711. } else {
  712. ret = 0;
  713. goto end;
  714. }
  715. done_resp:
  716. if (respout != NULL) {
  717. derbio = bio_open_default(respout, 'w', FORMAT_ASN1);
  718. if (derbio == NULL)
  719. goto end;
  720. i2d_OCSP_RESPONSE_bio(derbio, resp);
  721. BIO_free(derbio);
  722. }
  723. i = OCSP_response_status(resp);
  724. if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
  725. BIO_printf(out, "Responder Error: %s (%d)\n",
  726. OCSP_response_status_str(i), i);
  727. if (!ignore_err)
  728. goto end;
  729. }
  730. if (resp_text)
  731. OCSP_RESPONSE_print(out, resp, 0);
  732. /* If running as responder don't verify our own response */
  733. if (cbio != NULL) {
  734. /* If not unlimited, see if we took all we should. */
  735. if (accept_count != -1 && --accept_count <= 0) {
  736. ret = 0;
  737. goto end;
  738. }
  739. BIO_free_all(cbio);
  740. cbio = NULL;
  741. OCSP_REQUEST_free(req);
  742. req = NULL;
  743. OCSP_RESPONSE_free(resp);
  744. resp = NULL;
  745. goto redo_accept;
  746. }
  747. if (ridx_filename != NULL) {
  748. ret = 0;
  749. goto end;
  750. }
  751. if (store == NULL) {
  752. store = setup_verify(CAfile, noCAfile, CApath, noCApath,
  753. CAstore, noCAstore);
  754. if (!store)
  755. goto end;
  756. }
  757. if (vpmtouched)
  758. X509_STORE_set1_param(store, vpm);
  759. if (verify_certfile != NULL) {
  760. if (!load_certs(verify_certfile, 0, &verify_other, NULL,
  761. "validator certificates"))
  762. goto end;
  763. }
  764. bs = OCSP_response_get1_basic(resp);
  765. if (bs == NULL) {
  766. BIO_printf(bio_err, "Error parsing response\n");
  767. goto end;
  768. }
  769. ret = 0;
  770. if (!noverify) {
  771. if (req != NULL && ((i = OCSP_check_nonce(req, bs)) <= 0)) {
  772. if (i == -1)
  773. BIO_printf(bio_err, "WARNING: no nonce in response\n");
  774. else {
  775. BIO_printf(bio_err, "Nonce Verify error\n");
  776. ret = 1;
  777. goto end;
  778. }
  779. }
  780. i = OCSP_basic_verify(bs, verify_other, store, verify_flags);
  781. if (i <= 0 && issuers) {
  782. i = OCSP_basic_verify(bs, issuers, store, OCSP_TRUSTOTHER);
  783. if (i > 0)
  784. ERR_clear_error();
  785. }
  786. if (i <= 0) {
  787. BIO_printf(bio_err, "Response Verify Failure\n");
  788. ERR_print_errors(bio_err);
  789. ret = 1;
  790. } else {
  791. BIO_printf(bio_err, "Response verify OK\n");
  792. }
  793. }
  794. if (!print_ocsp_summary(out, bs, req, reqnames, ids, nsec, maxage))
  795. ret = 1;
  796. end:
  797. ERR_print_errors(bio_err);
  798. X509_free(signer);
  799. X509_STORE_free(store);
  800. X509_VERIFY_PARAM_free(vpm);
  801. sk_OPENSSL_STRING_free(rsign_sigopts);
  802. EVP_PKEY_free(key);
  803. EVP_PKEY_free(rkey);
  804. EVP_MD_free(cert_id_md);
  805. EVP_MD_free(rsign_md);
  806. EVP_MD_free(resp_certid_md);
  807. X509_free(cert);
  808. OSSL_STACK_OF_X509_free(issuers);
  809. X509_free(rsigner);
  810. OSSL_STACK_OF_X509_free(rca_certs);
  811. free_index(rdb);
  812. BIO_free_all(cbio);
  813. BIO_free_all(acbio);
  814. BIO_free_all(out);
  815. OCSP_REQUEST_free(req);
  816. OCSP_RESPONSE_free(resp);
  817. OCSP_BASICRESP_free(bs);
  818. sk_OPENSSL_STRING_free(reqnames);
  819. sk_OCSP_CERTID_free(ids);
  820. OSSL_STACK_OF_X509_free(sign_other);
  821. OSSL_STACK_OF_X509_free(verify_other);
  822. sk_CONF_VALUE_pop_free(headers, X509V3_conf_free);
  823. OPENSSL_free(thost);
  824. OPENSSL_free(tport);
  825. OPENSSL_free(tpath);
  826. return ret;
  827. }
  828. #ifdef HTTP_DAEMON
  829. static int index_changed(CA_DB *rdb)
  830. {
  831. struct stat sb;
  832. if (rdb != NULL && stat(rdb->dbfname, &sb) != -1) {
  833. if (rdb->dbst.st_mtime != sb.st_mtime
  834. || rdb->dbst.st_ctime != sb.st_ctime
  835. || rdb->dbst.st_ino != sb.st_ino
  836. || rdb->dbst.st_dev != sb.st_dev) {
  837. syslog(LOG_INFO, "index file changed, reloading");
  838. return 1;
  839. }
  840. }
  841. return 0;
  842. }
  843. #endif
  844. static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert,
  845. const EVP_MD *cert_id_md, X509 *issuer,
  846. STACK_OF(OCSP_CERTID) *ids)
  847. {
  848. OCSP_CERTID *id;
  849. if (issuer == NULL) {
  850. BIO_printf(bio_err, "No issuer certificate specified\n");
  851. return 0;
  852. }
  853. if (*req == NULL)
  854. *req = OCSP_REQUEST_new();
  855. if (*req == NULL)
  856. goto err;
  857. id = OCSP_cert_to_id(cert_id_md, cert, issuer);
  858. if (id == NULL || !sk_OCSP_CERTID_push(ids, id))
  859. goto err;
  860. if (!OCSP_request_add0_id(*req, id))
  861. goto err;
  862. return 1;
  863. err:
  864. BIO_printf(bio_err, "Error Creating OCSP request\n");
  865. return 0;
  866. }
  867. static int add_ocsp_serial(OCSP_REQUEST **req, char *serial,
  868. const EVP_MD *cert_id_md, X509 *issuer,
  869. STACK_OF(OCSP_CERTID) *ids)
  870. {
  871. OCSP_CERTID *id;
  872. const X509_NAME *iname;
  873. ASN1_BIT_STRING *ikey;
  874. ASN1_INTEGER *sno;
  875. if (issuer == NULL) {
  876. BIO_printf(bio_err, "No issuer certificate specified\n");
  877. return 0;
  878. }
  879. if (*req == NULL)
  880. *req = OCSP_REQUEST_new();
  881. if (*req == NULL)
  882. goto err;
  883. iname = X509_get_subject_name(issuer);
  884. ikey = X509_get0_pubkey_bitstr(issuer);
  885. sno = s2i_ASN1_INTEGER(NULL, serial);
  886. if (sno == NULL) {
  887. BIO_printf(bio_err, "Error converting serial number %s\n", serial);
  888. return 0;
  889. }
  890. id = OCSP_cert_id_new(cert_id_md, iname, ikey, sno);
  891. ASN1_INTEGER_free(sno);
  892. if (id == NULL || !sk_OCSP_CERTID_push(ids, id))
  893. goto err;
  894. if (!OCSP_request_add0_id(*req, id))
  895. goto err;
  896. return 1;
  897. err:
  898. BIO_printf(bio_err, "Error Creating OCSP request\n");
  899. return 0;
  900. }
  901. static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
  902. STACK_OF(OPENSSL_STRING) *names,
  903. STACK_OF(OCSP_CERTID) *ids, long nsec,
  904. long maxage)
  905. {
  906. OCSP_CERTID *id;
  907. const char *name;
  908. int i, status, reason;
  909. ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
  910. int ret = 1;
  911. if (req == NULL || !sk_OPENSSL_STRING_num(names))
  912. return 1;
  913. if (bs == NULL || !sk_OCSP_CERTID_num(ids))
  914. return 0;
  915. for (i = 0; i < sk_OCSP_CERTID_num(ids); i++) {
  916. id = sk_OCSP_CERTID_value(ids, i);
  917. name = sk_OPENSSL_STRING_value(names, i);
  918. BIO_printf(out, "%s: ", name);
  919. if (!OCSP_resp_find_status(bs, id, &status, &reason,
  920. &rev, &thisupd, &nextupd)) {
  921. BIO_puts(out, "ERROR: No Status found.\n");
  922. ret = 0;
  923. continue;
  924. }
  925. /*
  926. * Check validity: if invalid write to output BIO so we know which
  927. * response this refers to.
  928. */
  929. if (!OCSP_check_validity(thisupd, nextupd, nsec, maxage)) {
  930. BIO_puts(out, "WARNING: Status times invalid.\n");
  931. ERR_print_errors(out);
  932. }
  933. BIO_printf(out, "%s\n", OCSP_cert_status_str(status));
  934. BIO_puts(out, "\tThis Update: ");
  935. ASN1_GENERALIZEDTIME_print(out, thisupd);
  936. BIO_puts(out, "\n");
  937. if (nextupd) {
  938. BIO_puts(out, "\tNext Update: ");
  939. ASN1_GENERALIZEDTIME_print(out, nextupd);
  940. BIO_puts(out, "\n");
  941. }
  942. if (status != V_OCSP_CERTSTATUS_REVOKED)
  943. continue;
  944. if (reason != -1)
  945. BIO_printf(out, "\tReason: %s\n", OCSP_crl_reason_str(reason));
  946. BIO_puts(out, "\tRevocation Time: ");
  947. ASN1_GENERALIZEDTIME_print(out, rev);
  948. BIO_puts(out, "\n");
  949. }
  950. return ret;
  951. }
  952. static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req,
  953. CA_DB *db, STACK_OF(X509) *ca, X509 *rcert,
  954. EVP_PKEY *rkey, const EVP_MD *rmd,
  955. STACK_OF(OPENSSL_STRING) *sigopts,
  956. STACK_OF(X509) *rother, unsigned long flags,
  957. int nmin, int ndays, int badsig,
  958. const EVP_MD *resp_md)
  959. {
  960. ASN1_TIME *thisupd = NULL, *nextupd = NULL;
  961. OCSP_CERTID *cid;
  962. OCSP_BASICRESP *bs = NULL;
  963. int i, id_count;
  964. EVP_MD_CTX *mctx = NULL;
  965. EVP_PKEY_CTX *pkctx = NULL;
  966. id_count = OCSP_request_onereq_count(req);
  967. if (id_count <= 0) {
  968. *resp =
  969. OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL);
  970. goto end;
  971. }
  972. bs = OCSP_BASICRESP_new();
  973. thisupd = X509_gmtime_adj(NULL, 0);
  974. if (ndays != -1)
  975. nextupd = X509_time_adj_ex(NULL, ndays, nmin * 60, NULL);
  976. /* Examine each certificate id in the request */
  977. for (i = 0; i < id_count; i++) {
  978. OCSP_ONEREQ *one;
  979. ASN1_INTEGER *serial;
  980. char **inf;
  981. int jj;
  982. int found = 0;
  983. ASN1_OBJECT *cert_id_md_oid;
  984. const EVP_MD *cert_id_md;
  985. OCSP_CERTID *cid_resp_md = NULL;
  986. one = OCSP_request_onereq_get0(req, i);
  987. cid = OCSP_onereq_get0_id(one);
  988. OCSP_id_get0_info(NULL, &cert_id_md_oid, NULL, NULL, cid);
  989. cert_id_md = EVP_get_digestbyobj(cert_id_md_oid);
  990. if (cert_id_md == NULL) {
  991. *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR,
  992. NULL);
  993. goto end;
  994. }
  995. for (jj = 0; jj < sk_X509_num(ca) && !found; jj++) {
  996. X509 *ca_cert = sk_X509_value(ca, jj);
  997. OCSP_CERTID *ca_id = OCSP_cert_to_id(cert_id_md, NULL, ca_cert);
  998. if (OCSP_id_issuer_cmp(ca_id, cid) == 0) {
  999. found = 1;
  1000. if (resp_md != NULL)
  1001. cid_resp_md = OCSP_cert_to_id(resp_md, NULL, ca_cert);
  1002. }
  1003. OCSP_CERTID_free(ca_id);
  1004. }
  1005. OCSP_id_get0_info(NULL, NULL, NULL, &serial, cid);
  1006. inf = lookup_serial(db, serial);
  1007. /* at this point, we can have cid be an alias of cid_resp_md */
  1008. cid = (cid_resp_md != NULL) ? cid_resp_md : cid;
  1009. if (!found) {
  1010. OCSP_basic_add1_status(bs, cid,
  1011. V_OCSP_CERTSTATUS_UNKNOWN,
  1012. 0, NULL, thisupd, nextupd);
  1013. continue;
  1014. }
  1015. if (inf == NULL) {
  1016. OCSP_basic_add1_status(bs, cid,
  1017. V_OCSP_CERTSTATUS_UNKNOWN,
  1018. 0, NULL, thisupd, nextupd);
  1019. } else if (inf[DB_type][0] == DB_TYPE_VAL) {
  1020. OCSP_basic_add1_status(bs, cid,
  1021. V_OCSP_CERTSTATUS_GOOD,
  1022. 0, NULL, thisupd, nextupd);
  1023. } else if (inf[DB_type][0] == DB_TYPE_REV) {
  1024. ASN1_OBJECT *inst = NULL;
  1025. ASN1_TIME *revtm = NULL;
  1026. ASN1_GENERALIZEDTIME *invtm = NULL;
  1027. OCSP_SINGLERESP *single;
  1028. int reason = -1;
  1029. unpack_revinfo(&revtm, &reason, &inst, &invtm, inf[DB_rev_date]);
  1030. single = OCSP_basic_add1_status(bs, cid,
  1031. V_OCSP_CERTSTATUS_REVOKED,
  1032. reason, revtm, thisupd, nextupd);
  1033. if (single == NULL) {
  1034. *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR,
  1035. NULL);
  1036. goto end;
  1037. }
  1038. if (invtm != NULL)
  1039. OCSP_SINGLERESP_add1_ext_i2d(single, NID_invalidity_date,
  1040. invtm, 0, 0);
  1041. else if (inst != NULL)
  1042. OCSP_SINGLERESP_add1_ext_i2d(single,
  1043. NID_hold_instruction_code, inst,
  1044. 0, 0);
  1045. ASN1_OBJECT_free(inst);
  1046. ASN1_TIME_free(revtm);
  1047. ASN1_GENERALIZEDTIME_free(invtm);
  1048. }
  1049. OCSP_CERTID_free(cid_resp_md);
  1050. }
  1051. OCSP_copy_nonce(bs, req);
  1052. mctx = EVP_MD_CTX_new();
  1053. if (mctx == NULL || !EVP_DigestSignInit(mctx, &pkctx, rmd, NULL, rkey)) {
  1054. *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, NULL);
  1055. goto end;
  1056. }
  1057. for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) {
  1058. char *sigopt = sk_OPENSSL_STRING_value(sigopts, i);
  1059. if (pkey_ctrl_string(pkctx, sigopt) <= 0) {
  1060. BIO_printf(err, "parameter error \"%s\"\n", sigopt);
  1061. ERR_print_errors(bio_err);
  1062. *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR,
  1063. NULL);
  1064. goto end;
  1065. }
  1066. }
  1067. if (!OCSP_basic_sign_ctx(bs, rcert, mctx, rother, flags)) {
  1068. *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, bs);
  1069. goto end;
  1070. }
  1071. if (badsig) {
  1072. const ASN1_OCTET_STRING *sig = OCSP_resp_get0_signature(bs);
  1073. corrupt_signature(sig);
  1074. }
  1075. *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_SUCCESSFUL, bs);
  1076. end:
  1077. EVP_MD_CTX_free(mctx);
  1078. ASN1_TIME_free(thisupd);
  1079. ASN1_TIME_free(nextupd);
  1080. OCSP_BASICRESP_free(bs);
  1081. }
  1082. static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser)
  1083. {
  1084. int i;
  1085. BIGNUM *bn = NULL;
  1086. char *itmp, *row[DB_NUMBER], **rrow;
  1087. for (i = 0; i < DB_NUMBER; i++)
  1088. row[i] = NULL;
  1089. bn = ASN1_INTEGER_to_BN(ser, NULL);
  1090. OPENSSL_assert(bn); /* FIXME: should report an error at this
  1091. * point and abort */
  1092. if (BN_is_zero(bn)) {
  1093. itmp = OPENSSL_strdup("00");
  1094. OPENSSL_assert(itmp);
  1095. } else {
  1096. itmp = BN_bn2hex(bn);
  1097. }
  1098. row[DB_serial] = itmp;
  1099. BN_free(bn);
  1100. rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
  1101. OPENSSL_free(itmp);
  1102. return rrow;
  1103. }
  1104. static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio,
  1105. int timeout)
  1106. {
  1107. #ifndef OPENSSL_NO_SOCK
  1108. return http_server_get_asn1_req(ASN1_ITEM_rptr(OCSP_REQUEST),
  1109. (ASN1_VALUE **)preq, NULL, pcbio, acbio,
  1110. NULL /* found_keep_alive */,
  1111. prog, 1 /* accept_get */, timeout);
  1112. #else
  1113. BIO_printf(bio_err,
  1114. "Error getting OCSP request - sockets not supported\n");
  1115. *preq = NULL;
  1116. return 0;
  1117. #endif
  1118. }
  1119. static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp)
  1120. {
  1121. #ifndef OPENSSL_NO_SOCK
  1122. return http_server_send_asn1_resp(prog, cbio,
  1123. 0 /* no keep-alive */,
  1124. "application/ocsp-response",
  1125. ASN1_ITEM_rptr(OCSP_RESPONSE),
  1126. (const ASN1_VALUE *)resp);
  1127. #else
  1128. BIO_printf(bio_err,
  1129. "Error sending OCSP response - sockets not supported\n");
  1130. return 0;
  1131. #endif
  1132. }
  1133. #ifndef OPENSSL_NO_SOCK
  1134. OCSP_RESPONSE *process_responder(OCSP_REQUEST *req, const char *host,
  1135. const char *port, const char *path,
  1136. const char *proxy, const char *no_proxy,
  1137. int use_ssl, STACK_OF(CONF_VALUE) *headers,
  1138. int req_timeout)
  1139. {
  1140. SSL_CTX *ctx = NULL;
  1141. OCSP_RESPONSE *resp = NULL;
  1142. if (use_ssl == 1) {
  1143. ctx = SSL_CTX_new(TLS_client_method());
  1144. if (ctx == NULL) {
  1145. BIO_printf(bio_err, "Error creating SSL context.\n");
  1146. goto end;
  1147. }
  1148. }
  1149. resp = (OCSP_RESPONSE *)
  1150. app_http_post_asn1(host, port, path, proxy, no_proxy,
  1151. ctx, headers, "application/ocsp-request",
  1152. (ASN1_VALUE *)req, ASN1_ITEM_rptr(OCSP_REQUEST),
  1153. "application/ocsp-response",
  1154. req_timeout, ASN1_ITEM_rptr(OCSP_RESPONSE));
  1155. if (resp == NULL)
  1156. BIO_printf(bio_err, "Error querying OCSP responder\n");
  1157. end:
  1158. SSL_CTX_free(ctx);
  1159. return resp;
  1160. }
  1161. #endif