]> git.ipfire.org Git - thirdparty/openssl.git/blame - apps/ocsp.c
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Initial OCSP server support, using index.txt format.
[thirdparty/openssl.git] / apps / ocsp.c
CommitLineData
5782ceb2
DSH		 1/* ocsp.c */
2/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
3 * project 2000.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61#include <openssl/pem.h>
62#include <openssl/ocsp.h>
63#include <openssl/err.h>
cdc7b8cc 64#include <openssl/ssl.h>
5782ceb2
DSH		 65#include "apps.h"
66
f1965221
DSH		 67/* Maximum leeway in validity period: default 5 minutes */
68#define MAX_VALIDITY_PERIOD (5 * 60)
69
ee306a13
DSH		 70/* CA index.txt definitions */
71#define DB_type 0
72#define DB_exp_date 1
73#define DB_rev_date 2
74#define DB_serial 3 /* index - unique */
75#define DB_file 4
76#define DB_name 5 /* index - unique for active */
77#define DB_NUMBER 6
78
79#define DB_TYPE_REV 'R'
80#define DB_TYPE_EXP 'E'
81#define DB_TYPE_VAL 'V'
82
73758d43
DSH		 83static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert, X509 *issuer,
84 STACK_OF(OCSP_CERTID) *ids);
85static int add_ocsp_serial(OCSP_REQUEST **req, char *serial, X509 *issuer,
86 STACK_OF(OCSP_CERTID) *ids);
87static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
f1965221
DSH		 88 STACK *names, STACK_OF(OCSP_CERTID) *ids,
89 long nsec, long maxage);
5782ceb2 90
ee306a13
DSH		 91static int make_ocsp_response(OCSP_RESPONSE **resp, OCSP_REQUEST *req, TXT_DB *db,
92 X509 *ca, X509 *rcert, EVP_PKEY *rkey,
93 STACK_OF(X509) *rother, unsigned long flags,
94 int nmin, int ndays);
95
96static char **lookup_serial(TXT_DB *db, ASN1_INTEGER *ser);
97static OCSP_REQUEST *do_responder(BIO **cbio, char *port);
98static int send_ocsp_response(BIO *cbio, OCSP_RESPONSE *resp);
99
5782ceb2
DSH		 100#undef PROG
101#define PROG ocsp_main
102
103int MAIN(int, char **);
104
105int MAIN(int argc, char **argv)
106 {
30b4c272 107 ENGINE *e = NULL;
5782ceb2 108 char **args;
67c18019 109 char *host = NULL, *port = NULL, *path = "/";
5782ceb2
DSH		 110 char *reqin = NULL, *respin = NULL;
111 char *reqout = NULL, *respout = NULL;
112 char *signfile = NULL, *keyfile = NULL;
ee306a13 113 char *rsignfile = NULL, *rkeyfile = NULL;
5782ceb2 114 char *outfile = NULL;
67c18019 115 int add_nonce = 1, noverify = 0, use_ssl = -1;
5782ceb2
DSH		 116 OCSP_REQUEST *req = NULL;
117 OCSP_RESPONSE *resp = NULL;
81f169e9 118 OCSP_BASICRESP *bs = NULL;
5782ceb2 119 X509 *issuer = NULL, *cert = NULL;
ee306a13
DSH		 120 X509 *signer = NULL, *rsigner = NULL;
121 EVP_PKEY *key = NULL, *rkey = NULL;
5782ceb2
DSH		 122 BIO *cbio = NULL, *derbio = NULL;
123 BIO *out = NULL;
124 int req_text = 0, resp_text = 0;
f1965221 125 long nsec = MAX_VALIDITY_PERIOD, maxage = -1;
81f169e9
DSH		 126 char *CAfile = NULL, *CApath = NULL;
127 X509_STORE *store = NULL;
cdc7b8cc 128 SSL_CTX *ctx = NULL;
ee306a13
DSH		 129 STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL;
130 char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
131 unsigned long sign_flags = 0, verify_flags = 0, rflags = 0;
5782ceb2
DSH		 132 int ret = 1;
133 int badarg = 0;
81f169e9 134 int i;
73758d43
DSH		 135 STACK *reqnames = NULL;
136 STACK_OF(OCSP_CERTID) *ids = NULL;
ee306a13
DSH		 137
138 X509 *rca_cert = NULL;
139 char *ridx_filename = NULL;
140 char *rca_filename = NULL;
141 TXT_DB *rdb = NULL;
142 int nmin = 0, ndays = -1;
143
5782ceb2 144 if (bio_err == NULL) bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
cdc7b8cc 145 SSL_load_error_strings();
5782ceb2 146 args = argv + 1;
73758d43
DSH		 147 reqnames = sk_new_null();
148 ids = sk_OCSP_CERTID_new_null();
5782ceb2
DSH		 149 while (!badarg && *args && *args[0] == '-')
150 {
151 if (!strcmp(*args, "-out"))
152 {
153 if (args[1])
154 {
155 args++;
156 outfile = *args;
157 }
158 else badarg = 1;
159 }
67c18019
DSH		 160 else if (!strcmp(*args, "-url"))
161 {
162 if (args[1])
163 {
164 args++;
165 if (!OCSP_parse_url(*args, &host, &port, &path, &use_ssl))
166 {
167 BIO_printf(bio_err, "Error parsing URL\n");
168 badarg = 1;
169 }
170 }
171 else badarg = 1;
172 }
5782ceb2
DSH		 173 else if (!strcmp(*args, "-host"))
174 {
175 if (args[1])
176 {
177 args++;
178 host = *args;
179 }
180 else badarg = 1;
181 }
ee306a13
DSH		 182 else if (!strcmp(*args, "-port"))
183 {
184 if (args[1])
185 {
186 args++;
187 port = *args;
188 }
189 else badarg = 1;
190 }
73758d43
DSH		 191 else if (!strcmp(*args, "-noverify"))
192 noverify = 1;
5782ceb2
DSH		 193 else if (!strcmp(*args, "-nonce"))
194 add_nonce = 2;
195 else if (!strcmp(*args, "-no_nonce"))
196 add_nonce = 0;
ee306a13
DSH		 197 else if (!strcmp(*args, "-responder_no_certs"))
198 rflags |= OCSP_NOCERTS;
199 else if (!strcmp(*args, "-responder_no_time"))
200 rflags |= OCSP_NOTIME;
201 else if (!strcmp(*args, "-responder_key_id"))
202 rflags |= OCSP_RESPID_KEY;
8c950429
DSH		 203 else if (!strcmp(*args, "-no_certs"))
204 sign_flags |= OCSP_NOCERTS;
205 else if (!strcmp(*args, "-no_signature_verify"))
206 verify_flags |= OCSP_NOSIGS;
207 else if (!strcmp(*args, "-no_cert_verify"))
208 verify_flags |= OCSP_NOVERIFY;
209 else if (!strcmp(*args, "-no_chain"))
210 verify_flags |= OCSP_NOCHAIN;
211 else if (!strcmp(*args, "-no_cert_checks"))
212 verify_flags |= OCSP_NOCHECKS;
213 else if (!strcmp(*args, "-no_explicit"))
214 verify_flags |= OCSP_NOEXPLICIT;
215 else if (!strcmp(*args, "-trust_other"))
216 verify_flags |= OCSP_TRUSTOTHER;
217 else if (!strcmp(*args, "-no_intern"))
218 verify_flags |= OCSP_NOINTERN;
5782ceb2
DSH		 219 else if (!strcmp(*args, "-text"))
220 {
221 req_text = 1;
222 resp_text = 1;
223 }
224 else if (!strcmp(*args, "-req_text"))
225 req_text = 1;
226 else if (!strcmp(*args, "-resp_text"))
227 resp_text = 1;
228 else if (!strcmp(*args, "-reqin"))
229 {
230 if (args[1])
231 {
232 args++;
233 reqin = *args;
234 }
235 else badarg = 1;
236 }
237 else if (!strcmp(*args, "-respin"))
238 {
239 if (args[1])
240 {
241 args++;
242 respin = *args;
243 }
244 else badarg = 1;
245 }
246 else if (!strcmp(*args, "-signer"))
247 {
248 if (args[1])
249 {
250 args++;
251 signfile = *args;
252 }
253 else badarg = 1;
254 }
9235adbf
RL		 255 else if (!strcmp (*args, "-VAfile"))
256 {
257 if (args[1])
258 {
259 args++;
8c950429
DSH		 260 verify_certfile = *args;
261 verify_flags |= OCSP_TRUSTOTHER;
262 }
263 else badarg = 1;
264 }
265 else if (!strcmp(*args, "-sign_other"))
266 {
267 if (args[1])
268 {
269 args++;
270 sign_certfile = *args;
271 }
272 else badarg = 1;
273 }
274 else if (!strcmp(*args, "-verify_other"))
275 {
276 if (args[1])
277 {
278 args++;
279 verify_certfile = *args;
9235adbf
RL		 280 }
281 else badarg = 1;
282 }
81f169e9
DSH		 283 else if (!strcmp (*args, "-CAfile"))
284 {
285 if (args[1])
286 {
287 args++;
288 CAfile = *args;
289 }
290 else badarg = 1;
291 }
292 else if (!strcmp (*args, "-CApath"))
293 {
294 if (args[1])
295 {
296 args++;
297 CApath = *args;
298 }
299 else badarg = 1;
300 }
f1965221
DSH		 301 else if (!strcmp (*args, "-validity_period"))
302 {
303 if (args[1])
304 {
305 args++;
306 nsec = atol(*args);
307 if (nsec < 0)
308 {
309 BIO_printf(bio_err,
310 "Illegal validity period %s\n",
311 *args);
312 badarg = 1;
313 }
314 }
315 else badarg = 1;
316 }
317 else if (!strcmp (*args, "-status_age"))
318 {
319 if (args[1])
320 {
321 args++;
322 maxage = atol(*args);
323 if (maxage < 0)
324 {
325 BIO_printf(bio_err,
326 "Illegal validity age %s\n",
327 *args);
328 badarg = 1;
329 }
330 }
331 else badarg = 1;
332 }
5782ceb2
DSH		 333 else if (!strcmp(*args, "-signkey"))
334 {
335 if (args[1])
336 {
337 args++;
338 keyfile = *args;
339 }
340 else badarg = 1;
341 }
342 else if (!strcmp(*args, "-reqout"))
343 {
344 if (args[1])
345 {
346 args++;
347 reqout = *args;
348 }
349 else badarg = 1;
350 }
351 else if (!strcmp(*args, "-respout"))
352 {
353 if (args[1])
354 {
355 args++;
356 respout = *args;
357 }
358 else badarg = 1;
359 }
360 else if (!strcmp(*args, "-path"))
361 {
362 if (args[1])
363 {
364 args++;
365 path = *args;
366 }
367 else badarg = 1;
368 }
369 else if (!strcmp(*args, "-issuer"))
370 {
371 if (args[1])
372 {
373 args++;
374 X509_free(issuer);
30b4c272
RL		 375 issuer = load_cert(bio_err, *args, FORMAT_PEM,
376 NULL, e, "issuer certificate");
5782ceb2
DSH		 377 if(!issuer) goto end;
378 }
379 else badarg = 1;
380 }
381 else if (!strcmp (*args, "-cert"))
382 {
383 if (args[1])
384 {
385 args++;
386 X509_free(cert);
30b4c272
RL		 387 cert = load_cert(bio_err, *args, FORMAT_PEM,
388 NULL, e, "certificate");
5782ceb2 389 if(!cert) goto end;
73758d43
DSH		 390 if(!add_ocsp_cert(&req, cert, issuer, ids))
391 goto end;
392 if(!sk_push(reqnames, *args))
5782ceb2
DSH		 393 goto end;
394 }
395 else badarg = 1;
396 }
397 else if (!strcmp(*args, "-serial"))
398 {
399 if (args[1])
400 {
401 args++;
73758d43
DSH		 402 if(!add_ocsp_serial(&req, *args, issuer, ids))
403 goto end;
404 if(!sk_push(reqnames, *args))
5782ceb2
DSH		 405 goto end;
406 }
407 else badarg = 1;
408 }
ee306a13
DSH		 409 else if (!strcmp(*args, "-index"))
410 {
411 if (args[1])
412 {
413 args++;
414 ridx_filename = *args;
415 }
416 else badarg = 1;
417 }
418 else if (!strcmp(*args, "-CA"))
419 {
420 if (args[1])
421 {
422 args++;
423 rca_filename = *args;
424 }
425 else badarg = 1;
426 }
427 else if (!strcmp (*args, "-nmin"))
428 {
429 if (args[1])
430 {
431 args++;
432 nmin = atol(*args);
433 if (nmin < 0)
434 {
435 BIO_printf(bio_err,
436 "Illegal update period %s\n",
437 *args);
438 badarg = 1;
439 }
440 }
441 if (ndays == -1)
442 ndays = 0;
443 else badarg = 1;
444 }
445 else if (!strcmp (*args, "-ndays"))
446 {
447 if (args[1])
448 {
449 args++;
450 ndays = atol(*args);
451 if (ndays < 0)
452 {
453 BIO_printf(bio_err,
454 "Illegal update period %s\n",
455 *args);
456 badarg = 1;
457 }
458 }
459 else badarg = 1;
460 }
461 else if (!strcmp(*args, "-rsigner"))
462 {
463 if (args[1])
464 {
465 args++;
466 rsignfile = *args;
467 }
468 else badarg = 1;
469 }
470 else if (!strcmp(*args, "-rkey"))
471 {
472 if (args[1])
473 {
474 args++;
475 rkeyfile = *args;
476 }
477 else badarg = 1;
478 }
479 else if (!strcmp(*args, "-rother"))
480 {
481 if (args[1])
482 {
483 args++;
484 rcertfile = *args;
485 }
486 else badarg = 1;
487 }
5782ceb2
DSH		 488 else badarg = 1;
489 args++;
490 }
491
492 /* Have we anything to do? */
ee306a13 493 if (!req && !reqin && !respin && !(port && ridx_filename)) badarg = 1;
5782ceb2
DSH		 494
495 if (badarg)
496 {
497 BIO_printf (bio_err, "OCSP utility\n");
498 BIO_printf (bio_err, "Usage ocsp [options]\n");
499 BIO_printf (bio_err, "where options are\n");
8c950429
DSH		 500 BIO_printf (bio_err, "-out file output filename\n");
501 BIO_printf (bio_err, "-issuer file issuer certificate\n");
502 BIO_printf (bio_err, "-cert file certificate to check\n");
503 BIO_printf (bio_err, "-serial n serial number to check\n");
504 BIO_printf (bio_err, "-signer file certificate to sign OCSP request with\n");
505 BIO_printf (bio_err, "-signkey file private key to sign OCSP request with\n");
b3f2e399
DSH		 506 BIO_printf (bio_err, "-sign_certs file additional certificates to include in signed request\n");
507 BIO_printf (bio_err, "-no_certs don't include any certificates in signed request\n");
8c950429
DSH		 508 BIO_printf (bio_err, "-req_text print text form of request\n");
509 BIO_printf (bio_err, "-resp_text print text form of response\n");
510 BIO_printf (bio_err, "-text print text form of request and response\n");
511 BIO_printf (bio_err, "-reqout file write DER encoded OCSP request to \"file\"\n");
512 BIO_printf (bio_err, "-respout file write DER encoded OCSP reponse to \"file\"\n");
513 BIO_printf (bio_err, "-reqin file read DER encoded OCSP request from \"file\"\n");
514 BIO_printf (bio_err, "-respin file read DER encoded OCSP reponse from \"file\"\n");
515 BIO_printf (bio_err, "-nonce add OCSP nonce to request\n");
516 BIO_printf (bio_err, "-no_nonce don't add OCSP nonce to request\n");
67c18019 517 BIO_printf (bio_err, "-url URL OCSP responder URL\n");
8c950429
DSH		 518 BIO_printf (bio_err, "-host host:n send OCSP request to host on port n\n");
519 BIO_printf (bio_err, "-path path to use in OCSP request\n");
520 BIO_printf (bio_err, "-CApath dir trusted certificates directory\n");
521 BIO_printf (bio_err, "-CAfile file trusted certificates file\n");
522 BIO_printf (bio_err, "-VAfile file validator certificates file\n");
f1965221
DSH		 523 BIO_printf (bio_err, "-validity_period n maximum validity discrepancy in seconds\n");
524 BIO_printf (bio_err, "-status_age n maximum status age in seconds\n");
8c950429 525 BIO_printf (bio_err, "-noverify don't verify response at all\n");
b3f2e399
DSH		 526 BIO_printf (bio_err, "-verify_certs file additional certificates to search for signer\n");
527 BIO_printf (bio_err, "-trust_other don't verify additional certificates\n");
528 BIO_printf (bio_err, "-no_intern don't search certificates contained in response for signer\n");
529 BIO_printf (bio_err, "-no_sig_verify don't check signature on response\n");
530 BIO_printf (bio_err, "-no_cert_verify don't check signing certificate\n");
531 BIO_printf (bio_err, "-no_chain don't chain verify response\n");
532 BIO_printf (bio_err, "-no_cert_checks don't do additional checks on signing certificate\n");
5782ceb2
DSH		 533 goto end;
534 }
535
536 if(outfile) out = BIO_new_file(outfile, "w");
537 else out = BIO_new_fp(stdout, BIO_NOCLOSE);
538
539 if(!out)
540 {
541 BIO_printf(bio_err, "Error opening output file\n");
542 goto end;
543 }
544
545 if (!req && (add_nonce != 2)) add_nonce = 0;
546
547 if (!req && reqin)
548 {
549 derbio = BIO_new_file(reqin, "rb");
550 if (!derbio)
551 {
552 BIO_printf(bio_err, "Error Opening OCSP request file\n");
553 goto end;
554 }
555 req = d2i_OCSP_REQUEST_bio(derbio, NULL);
556 BIO_free(derbio);
557 if(!req)
558 {
559 BIO_printf(bio_err, "Error reading OCSP request\n");
560 goto end;
561 }
562 }
563
ee306a13
DSH		 564 if (!req && port)
565 {
566 req = do_responder(&cbio, port);
567 if (!req && !cbio)
568 goto end;
569 if (!req && cbio)
570 {
571 resp = OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL);
572 send_ocsp_response(cbio, resp);
573 goto done_resp;
574 }
575 }
576
577 if (!req && (signfile || reqout || host || add_nonce || ridx_filename))
5782ceb2
DSH		 578 {
579 BIO_printf(bio_err, "Need an OCSP request for this operation!\n");
580 goto end;
581 }
582
73758d43 583 if (req && add_nonce) OCSP_request_add1_nonce(req, NULL, -1);
5782ceb2
DSH		 584
585 if (signfile)
586 {
587 if (!keyfile) keyfile = signfile;
30b4c272
RL		 588 signer = load_cert(bio_err, signfile, FORMAT_PEM,
589 NULL, e, "signer certificate");
5782ceb2
DSH		 590 if (!signer)
591 {
592 BIO_printf(bio_err, "Error loading signer certificate\n");
593 goto end;
594 }
8c950429
DSH		 595 if (sign_certfile)
596 {
30b4c272
RL		 597 sign_other = load_certs(bio_err, sign_certfile, FORMAT_PEM,
598 NULL, e, "signer certificates");
8c950429
DSH		 599 if (!sign_other) goto end;
600 }
30b4c272
RL		 601 key = load_key(bio_err, keyfile, FORMAT_PEM, NULL, NULL,
602 "signer private key");
5782ceb2 603 if (!key)
5782ceb2 604 goto end;
8c950429 605 if (!OCSP_request_sign(req, signer, key, EVP_sha1(), sign_other, sign_flags))
5782ceb2
DSH		 606 {
607 BIO_printf(bio_err, "Error signing OCSP request\n");
608 goto end;
609 }
610 }
611
ee306a13
DSH		 612 if (req_text && req) OCSP_REQUEST_print(out, req, 0);
613
614 if (rsignfile)
5782ceb2 615 {
ee306a13
DSH		 616 if (!rkeyfile) rkeyfile = rsignfile;
617 rsigner = load_cert(bio_err, rsignfile, FORMAT_PEM,
618 NULL, e, "responder certificate");
619 if (!rsigner)
5782ceb2 620 {
ee306a13 621 BIO_printf(bio_err, "Error loading responder certificate\n");
5782ceb2
DSH		 622 goto end;
623 }
ee306a13
DSH		 624 rca_cert = load_cert(bio_err, rca_filename, FORMAT_PEM,
625 NULL, e, "CA certificate");
626 if (rcertfile)
627 {
628 rother = load_certs(bio_err, sign_certfile, FORMAT_PEM,
629 NULL, e, "responder other certificates");
630 if (!sign_other) goto end;
631 }
632 rkey = load_key(bio_err, rkeyfile, FORMAT_PEM, NULL, NULL,
633 "responder private key");
634 if (!rkey)
635 goto end;
5782ceb2
DSH		 636 }
637
ee306a13
DSH		 638 if (ridx_filename && (!rkey || !rsigner || !rca_cert))
639 {
640 BIO_printf(bio_err, "Need a responder certificate, key and CA for this operation!\n");
641 goto end;
642 }
5782ceb2 643
ee306a13
DSH		 644 if (ridx_filename)
645 {
646 BIO *db_bio = NULL;
647 db_bio = BIO_new_file(ridx_filename, "r");
648 if (!db_bio)
649 {
650 BIO_printf(bio_err, "Error opening index file %s\n", ridx_filename);
651 goto end;
652 }
653 rdb = TXT_DB_read(db_bio, DB_NUMBER);
654 BIO_free(db_bio);
655 if (!rdb)
656 {
657 BIO_printf(bio_err, "Error reading index file %s\n", ridx_filename);
658 goto end;
659 }
660 if (!make_serial_index(rdb))
661 goto end;
662 i = make_ocsp_response(&resp, req, rdb, rca_cert, rsigner, rkey, rother, rflags, nmin, ndays);
663 if (cbio)
664 send_ocsp_response(cbio, resp);
665 }
666 else if (host)
5782ceb2
DSH		 667 {
668 cbio = BIO_new_connect(host);
669 if (!cbio)
670 {
671 BIO_printf(bio_err, "Error creating connect BIO\n");
672 goto end;
673 }
67c18019 674 if (port) BIO_set_conn_port(cbio, port);
cdc7b8cc
DSH		 675 if (use_ssl == 1)
676 {
677 BIO *sbio;
678 ctx = SSL_CTX_new(SSLv23_client_method());
679 SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
680 sbio = BIO_new_ssl(ctx, 1);
681 cbio = BIO_push(sbio, cbio);
682 }
5782ceb2
DSH		 683 if (BIO_do_connect(cbio) <= 0)
684 {
685 BIO_printf(bio_err, "Error connecting BIO\n");
686 goto end;
687 }
688 resp = OCSP_sendreq_bio(cbio, path, req);
cdc7b8cc 689 BIO_free_all(cbio);
5782ceb2
DSH		 690 cbio = NULL;
691 if (!resp)
692 {
693 BIO_printf(bio_err, "Error querying OCSP responsder\n");
694 goto end;
695 }
696 }
697 else if (respin)
698 {
699 derbio = BIO_new_file(respin, "rb");
700 if (!derbio)
701 {
702 BIO_printf(bio_err, "Error Opening OCSP response file\n");
703 goto end;
704 }
705 resp = d2i_OCSP_RESPONSE_bio(derbio, NULL);
706 BIO_free(derbio);
707 if(!resp)
708 {
709 BIO_printf(bio_err, "Error reading OCSP response\n");
710 goto end;
711 }
712
713 }
714 else
715 {
716 ret = 0;
717 goto end;
718 }
719
ee306a13
DSH		 720 done_resp:
721
5782ceb2
DSH		 722 if (respout)
723 {
724 derbio = BIO_new_file(respout, "wb");
725 if(!derbio)
726 {
727 BIO_printf(bio_err, "Error opening file %s\n", respout);
728 goto end;
729 }
730 i2d_OCSP_RESPONSE_bio(derbio, resp);
731 BIO_free(derbio);
732 }
733
73758d43
DSH		 734 i = OCSP_response_status(resp);
735
736 if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL)
737 {
738 BIO_printf(out, "Responder Error: %s (%ld)\n",
739 OCSP_response_status_str(i), i);
740 ret = 0;
741 goto end;
742 }
743
5782ceb2
DSH		 744 if (resp_text) OCSP_RESPONSE_print(out, resp, 0);
745
ee306a13
DSH		 746 /* If running as responder don't verify our own response */
747 if (cbio)
748 goto end;
749
81f169e9
DSH		 750 store = setup_verify(bio_err, CAfile, CApath);
751 if(!store) goto end;
8c950429
DSH		 752 if (verify_certfile)
753 {
30b4c272
RL		 754 verify_other = load_certs(bio_err, verify_certfile, FORMAT_PEM,
755 NULL, e, "validator certificate");
8c950429
DSH		 756 if (!verify_other) goto end;
757 }
9235adbf 758
81f169e9
DSH		 759 bs = OCSP_response_get1_basic(resp);
760
73758d43
DSH		 761 if (!bs)
762 {
763 BIO_printf(bio_err, "Error parsing response\n");
764 goto end;
765 }
81f169e9 766
73758d43 767 if (!noverify)
81f169e9 768 {
46a58ab9 769 if (req && ((i = OCSP_check_nonce(req, bs)) <= 0))
73758d43 770 {
46a58ab9
DSH		 771 if (i == -1)
772 BIO_printf(bio_err, "WARNING: no nonce in response\n");
773 else
774 {
775 BIO_printf(bio_err, "Nonce Verify error\n");
776 goto end;
777 }
73758d43
DSH		 778 }
779
8c950429 780 i = OCSP_basic_verify(bs, verify_other, store, verify_flags);
9235adbf 781 if (i < 0) i = OCSP_basic_verify(bs, NULL, store, 0);
73758d43
DSH		 782
783 if(i <= 0)
784 {
785 BIO_printf(bio_err, "Response Verify Failure\n", i);
786 ERR_print_errors(bio_err);
787 }
788 else
789 BIO_printf(bio_err, "Response verify OK\n");
790
81f169e9 791 }
73758d43 792
f1965221 793 if (!print_ocsp_summary(out, bs, req, reqnames, ids, nsec, maxage))
73758d43 794 goto end;
81f169e9 795
5782ceb2
DSH		 796 ret = 0;
797
798end:
799 ERR_print_errors(bio_err);
800 X509_free(signer);
81f169e9 801 X509_STORE_free(store);
5782ceb2 802 EVP_PKEY_free(key);
ee306a13 803 EVP_PKEY_free(rkey);
5782ceb2
DSH		 804 X509_free(issuer);
805 X509_free(cert);
ee306a13
DSH		 806 X509_free(rsigner);
807 X509_free(rca_cert);
808 TXT_DB_free(rdb);
cdc7b8cc 809 BIO_free_all(cbio);
5782ceb2
DSH		 810 BIO_free(out);
811 OCSP_REQUEST_free(req);
812 OCSP_RESPONSE_free(resp);
81f169e9 813 OCSP_BASICRESP_free(bs);
73758d43
DSH		 814 sk_free(reqnames);
815 sk_OCSP_CERTID_free(ids);
8c950429
DSH		 816 sk_X509_pop_free(sign_other, X509_free);
817 sk_X509_pop_free(verify_other, X509_free);
5782ceb2 818
67c18019
DSH		 819 if (use_ssl != -1)
820 {
821 OPENSSL_free(host);
822 OPENSSL_free(port);
823 OPENSSL_free(path);
cdc7b8cc 824 SSL_CTX_free(ctx);
67c18019
DSH		 825 }
826
5782ceb2
DSH		 827 EXIT(ret);
828}
829
73758d43
DSH		 830static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert, X509 *issuer,
831 STACK_OF(OCSP_CERTID) *ids)
5782ceb2
DSH		 832 {
833 OCSP_CERTID *id;
834 if(!issuer)
835 {
836 BIO_printf(bio_err, "No issuer certificate specified\n");
837 return 0;
838 }
839 if(!*req) *req = OCSP_REQUEST_new();
840 if(!*req) goto err;
841 id = OCSP_cert_to_id(NULL, cert, issuer);
73758d43 842 if(!id || !sk_OCSP_CERTID_push(ids, id)) goto err;
5782ceb2
DSH		 843 if(!OCSP_request_add0_id(*req, id)) goto err;
844 return 1;
845
846 err:
847 BIO_printf(bio_err, "Error Creating OCSP request\n");
848 return 0;
849 }
850
73758d43
DSH		 851static int add_ocsp_serial(OCSP_REQUEST **req, char *serial, X509 *issuer,
852 STACK_OF(OCSP_CERTID) *ids)
5782ceb2
DSH		 853 {
854 OCSP_CERTID *id;
855 X509_NAME *iname;
856 ASN1_BIT_STRING *ikey;
857 ASN1_INTEGER *sno;
858 if(!issuer)
859 {
860 BIO_printf(bio_err, "No issuer certificate specified\n");
861 return 0;
862 }
863 if(!*req) *req = OCSP_REQUEST_new();
864 if(!*req) goto err;
865 iname = X509_get_subject_name(issuer);
88ce56f8 866 ikey = X509_get0_pubkey_bitstr(issuer);
5782ceb2
DSH		 867 sno = s2i_ASN1_INTEGER(NULL, serial);
868 if(!sno)
869 {
870 BIO_printf(bio_err, "Error converting serial number %s\n", serial);
871 return 0;
872 }
873 id = OCSP_cert_id_new(EVP_sha1(), iname, ikey, sno);
874 ASN1_INTEGER_free(sno);
73758d43 875 if(!id || !sk_OCSP_CERTID_push(ids, id)) goto err;
5782ceb2
DSH		 876 if(!OCSP_request_add0_id(*req, id)) goto err;
877 return 1;
878
879 err:
880 BIO_printf(bio_err, "Error Creating OCSP request\n");
881 return 0;
882 }
73758d43
DSH		 883
884static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
f1965221
DSH		 885 STACK *names, STACK_OF(OCSP_CERTID) *ids,
886 long nsec, long maxage)
73758d43
DSH		 887 {
888 OCSP_CERTID *id;
889 char *name;
890 int i;
891
892 int status, reason;
893
894 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
895
896 if (!bs || !req || !sk_num(names) || !sk_OCSP_CERTID_num(ids))
897 return 1;
898
899 for (i = 0; i < sk_OCSP_CERTID_num(ids); i++)
900 {
901 id = sk_OCSP_CERTID_value(ids, i);
902 name = sk_value(names, i);
903 BIO_printf(out, "%s: ", name);
904
905 if(!OCSP_resp_find_status(bs, id, &status, &reason,
906 &rev, &thisupd, &nextupd))
907 {
908 BIO_puts(out, "ERROR: No Status found.\n");
909 continue;
910 }
f1965221
DSH		 911
912 /* Check validity: if invalid write to output BIO so we
913 * know which response this refers to.
914 */
915 if (!OCSP_check_validity(thisupd, nextupd, nsec, maxage))
916 {
917 BIO_puts(out, "WARNING: Status times invalid.\n");
918 ERR_print_errors(out);
919 }
73758d43
DSH		 920 BIO_printf(out, "%s\n", OCSP_cert_status_str(status));
921
922 BIO_puts(out, "\tThis Update: ");
923 ASN1_GENERALIZEDTIME_print(out, thisupd);
924 BIO_puts(out, "\n");
925
926 if(nextupd)
927 {
928 BIO_puts(out, "\tNext Update: ");
569afce4 929 ASN1_GENERALIZEDTIME_print(out, nextupd);
73758d43
DSH		 930 BIO_puts(out, "\n");
931 }
932
933 if (status != V_OCSP_CERTSTATUS_REVOKED)
934 continue;
935
8e8972bb 936 if (reason != -1)
73758d43
DSH		 937 BIO_printf(out, "\tReason: %s\n",
938 OCSP_crl_reason_str(reason));
939
940 BIO_puts(out, "\tRevocation Time: ");
941 ASN1_GENERALIZEDTIME_print(out, rev);
942 BIO_puts(out, "\n");
943 }
944
945 return 1;
946 }
947
ee306a13
DSH		 948
949static int make_ocsp_response(OCSP_RESPONSE **resp, OCSP_REQUEST *req, TXT_DB *db,
950 X509 *ca, X509 *rcert, EVP_PKEY *rkey,
951 STACK_OF(X509) *rother, unsigned long flags,
952 int nmin, int ndays)
953 {
954 ASN1_TIME *thisupd = NULL, *nextupd = NULL;
955 OCSP_CERTID *cid, *ca_id = NULL;
956 OCSP_BASICRESP *bs = NULL;
957 int i, id_count, ret = 1;
958
959
960 id_count = OCSP_request_onereq_count(req);
961
962 if (id_count <= 0)
963 {
964 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL);
965 goto end;
966 }
967
968 ca_id = OCSP_cert_to_id(EVP_sha1(), NULL, ca);
969
970 bs = OCSP_BASICRESP_new();
971 thisupd = X509_gmtime_adj(NULL, 0);
972 if (ndays != -1)
973 nextupd = X509_gmtime_adj(NULL, nmin * 60 + ndays * 3600 * 24 );
974
975 /* Examine each certificate id in the request */
976 for (i = 0; i < id_count; i++)
977 {
978 OCSP_ONEREQ *one;
979 ASN1_INTEGER *serial;
980 char **inf;
981 one = OCSP_request_onereq_get0(req, i);
982 cid = OCSP_onereq_get0_id(one);
983 /* Is this request about our CA? */
984 if (OCSP_id_issuer_cmp(ca_id, cid))
985 {
986 OCSP_basic_add1_status(bs, cid,
987 V_OCSP_CERTSTATUS_UNKNOWN,
988 0, NULL,
989 thisupd, nextupd);
990 continue;
991 }
992 OCSP_id_get0_info(NULL, NULL, NULL, &serial, cid);
993 inf = lookup_serial(db, serial);
994 if (!inf)
995 OCSP_basic_add1_status(bs, cid,
996 V_OCSP_CERTSTATUS_UNKNOWN,
997 0, NULL,
998 thisupd, nextupd);
999 else if (inf[DB_type][0] == DB_TYPE_VAL)
1000 OCSP_basic_add1_status(bs, cid,
1001 V_OCSP_CERTSTATUS_GOOD,
1002 0, NULL,
1003 thisupd, nextupd);
1004 else if (inf[DB_type][0] == DB_TYPE_REV)
1005 {
1006 ASN1_OBJECT *inst = NULL;
1007 ASN1_TIME *revtm = NULL;
1008 ASN1_GENERALIZEDTIME *invtm = NULL;
1009 OCSP_SINGLERESP *single;
1010 int reason = -1;
1011 unpack_revinfo(&revtm, &reason, &inst, &invtm, inf[DB_rev_date]);
1012 single = OCSP_basic_add1_status(bs, cid,
1013 V_OCSP_CERTSTATUS_REVOKED,
1014 reason, revtm,
1015 thisupd, nextupd);
1016 if (invtm)
1017 OCSP_SINGLERESP_add1_ext_i2d(single, NID_invalidity_date, invtm, 0, 0);
1018 else if (inst)
1019 OCSP_SINGLERESP_add1_ext_i2d(single, NID_hold_instruction_code, inst, 0, 0);
1020 ASN1_OBJECT_free(inst);
1021 ASN1_TIME_free(revtm);
1022 ASN1_GENERALIZEDTIME_free(invtm);
1023 }
1024 }
1025
1026 OCSP_copy_nonce(bs, req);
1027
1028 OCSP_basic_sign(bs, rcert, rkey, EVP_sha1(), rother, flags);
1029
1030 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_SUCCESSFUL, bs);
1031
1032 end:
1033 ASN1_TIME_free(thisupd);
1034 ASN1_TIME_free(nextupd);
1035 OCSP_CERTID_free(ca_id);
1036 OCSP_BASICRESP_free(bs);
1037 return ret;
1038
1039 }
1040
1041static char **lookup_serial(TXT_DB *db, ASN1_INTEGER *ser)
1042 {
1043 int i;
1044 BIGNUM *bn = NULL;
1045 char *itmp, *row[DB_NUMBER],**rrow;
1046 for (i = 0; i < DB_NUMBER; i++) row[i] = NULL;
1047 bn = ASN1_INTEGER_to_BN(ser,NULL);
1048 itmp = BN_bn2hex(bn);
1049 row[DB_serial] = itmp;
1050 BN_free(bn);
1051 rrow=TXT_DB_get_by_index(db,DB_serial,row);
1052 OPENSSL_free(itmp);
1053 return rrow;
1054 }
1055
1056/* Quick and dirty OCSP server: read in and parse input request */
1057
1058static OCSP_REQUEST *do_responder(BIO **pcbio, char *port)
1059 {
1060 int have_post = 0, len;
1061 OCSP_REQUEST *req = NULL;
1062 char inbuf[1024];
1063 BIO *acbio = NULL, *bufbio = NULL, *cbio = NULL;
1064 bufbio = BIO_new(BIO_f_buffer());
1065 if (!bufbio)
1066 goto err;
1067 acbio = BIO_new_accept(port);
1068 if (!acbio)
1069 goto err;
1070 BIO_set_accept_bios(acbio, bufbio);
1071 bufbio = NULL;
1072
1073 if (BIO_do_accept(acbio) <= 0)
1074 {
1075 BIO_printf(bio_err, "Error setting up accept BIO\n");
1076 ERR_print_errors(bio_err);
1077 goto err;
1078 }
1079
1080 BIO_printf(bio_err, "Waiting for OCSP client connection...\n");
1081
1082 if (BIO_do_accept(acbio) <= 0)
1083 {
1084 BIO_printf(bio_err, "Error accepting connection\n");
1085 ERR_print_errors(bio_err);
1086 goto err;
1087 }
1088
1089 BIO_printf(bio_err, "Connection Established\n");
1090
1091
1092 cbio = BIO_pop(acbio);
1093 BIO_free_all(acbio);
1094 acbio = NULL;
1095
1096 for(;;)
1097 {
1098 len = BIO_gets(cbio, inbuf, 1024);
1099 if (len <= 0) goto err;
1100 /* Look for "POST" signalling start of query */
1101 if (!have_post)
1102 {
1103 if(strncmp(inbuf, "POST", 4))
1104 {
1105 BIO_printf(bio_err, "Invalid request\n");
1106 goto err;
1107 }
1108 have_post = 1;
1109 }
1110 /* Look for end of headers */
1111 if ((inbuf[0] == '\r') || (inbuf[0] == '\n'))
1112 break;
1113 }
1114
1115 /* Try to read OCSP request */
1116
1117 req = d2i_OCSP_REQUEST_bio(cbio, NULL);
1118
1119 *pcbio = cbio;
1120
1121 if (!req)
1122 {
1123 BIO_printf(bio_err, "Error parsing OCSP request\n");
1124 ERR_print_errors(bio_err);
1125 }
1126
1127 return req;
1128
1129 err:
1130 BIO_free_all(acbio);
1131 BIO_free_all(cbio);
1132 BIO_free(bufbio);
1133 OCSP_REQUEST_free(req);
1134 return NULL;
1135 }
1136
1137static int send_ocsp_response(BIO *cbio, OCSP_RESPONSE *resp)
1138 {
1139 char http_resp[] =
1140 "HTTP/1.0 200 OK\r\nContent-type: application/ocsp-response\r\n"
1141 "Content-Length: %d\r\n\r\n";
1142 if (!cbio)
1143 return 0;
1144 BIO_printf(cbio, http_resp, i2d_OCSP_RESPONSE(resp, NULL));
1145 i2d_OCSP_RESPONSE_bio(cbio, resp);
1146 BIO_flush(cbio);
1147 return 1;
1148 }
1149
A mirror of the official openssl repository