crypto/ocsp/ocsp_ext.c

   1 /*
   2  * Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the OpenSSL license (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include <openssl/objects.h>
  13 #include <openssl/x509.h>
  14 #include <openssl/ocsp.h>
  15 #include "ocsp_lcl.h"
  16 #include <openssl/rand.h>
  17 #include <openssl/x509v3.h>
  18
  19 /* Standard wrapper functions for extensions */
  20
  21 /* OCSP request extensions */
  22
  23 int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x)
  24 {
  25     return (X509v3_get_ext_count(x->tbsRequest.requestExtensions));
  26 }
  27
  28 int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos)
  29 {
  30     return (X509v3_get_ext_by_NID
  31             (x->tbsRequest.requestExtensions, nid, lastpos));
  32 }
  33
  34 int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj,
  35                                 int lastpos)
  36 {
  37     return (X509v3_get_ext_by_OBJ
  38             (x->tbsRequest.requestExtensions, obj, lastpos));
  39 }
  40
  41 int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos)
  42 {
  43     return (X509v3_get_ext_by_critical
  44             (x->tbsRequest.requestExtensions, crit, lastpos));
  45 }
  46
  47 X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc)
  48 {
  49     return (X509v3_get_ext(x->tbsRequest.requestExtensions, loc));
  50 }
  51
  52 X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc)
  53 {
  54     return (X509v3_delete_ext(x->tbsRequest.requestExtensions, loc));
  55 }
  56
  57 void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx)
  58 {
  59     return X509V3_get_d2i(x->tbsRequest.requestExtensions, nid, crit, idx);
  60 }
  61
  62 int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, int crit,
  63                               unsigned long flags)
  64 {
  65     return X509V3_add1_i2d(&x->tbsRequest.requestExtensions, nid, value,
  66                            crit, flags);
  67 }
  68
  69 int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc)
  70 {
  71     return (X509v3_add_ext(&(x->tbsRequest.requestExtensions), ex, loc) !=
  72             NULL);
  73 }
  74
  75 /* Single extensions */
  76
  77 int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x)
  78 {
  79     return (X509v3_get_ext_count(x->singleRequestExtensions));
  80 }
  81
  82 int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos)
  83 {
  84     return (X509v3_get_ext_by_NID(x->singleRequestExtensions, nid, lastpos));
  85 }
  86
  87 int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj, int lastpos)
  88 {
  89     return (X509v3_get_ext_by_OBJ(x->singleRequestExtensions, obj, lastpos));
  90 }
  91
  92 int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos)
  93 {
  94     return (X509v3_get_ext_by_critical
  95             (x->singleRequestExtensions, crit, lastpos));
  96 }
  97
  98 X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc)
  99 {
 100     return (X509v3_get_ext(x->singleRequestExtensions, loc));
 101 }
 102
 103 X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc)
 104 {
 105     return (X509v3_delete_ext(x->singleRequestExtensions, loc));
 106 }
 107
 108 void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx)
 109 {
 110     return X509V3_get_d2i(x->singleRequestExtensions, nid, crit, idx);
 111 }
 112
 113 int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit,
 114                              unsigned long flags)
 115 {
 116     return X509V3_add1_i2d(&x->singleRequestExtensions, nid, value, crit,
 117                            flags);
 118 }
 119
 120 int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc)
 121 {
 122     return (X509v3_add_ext(&(x->singleRequestExtensions), ex, loc) != NULL);
 123 }
 124
 125 /* OCSP Basic response */
 126
 127 int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x)
 128 {
 129     return (X509v3_get_ext_count(x->tbsResponseData.responseExtensions));
 130 }
 131
 132 int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos)
 133 {
 134     return (X509v3_get_ext_by_NID
 135             (x->tbsResponseData.responseExtensions, nid, lastpos));
 136 }
 137
 138 int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj,
 139                                   int lastpos)
 140 {
 141     return (X509v3_get_ext_by_OBJ
 142             (x->tbsResponseData.responseExtensions, obj, lastpos));
 143 }
 144
 145 int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit,
 146                                        int lastpos)
 147 {
 148     return (X509v3_get_ext_by_critical
 149             (x->tbsResponseData.responseExtensions, crit, lastpos));
 150 }
 151
 152 X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc)
 153 {
 154     return (X509v3_get_ext(x->tbsResponseData.responseExtensions, loc));
 155 }
 156
 157 X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc)
 158 {
 159     return (X509v3_delete_ext(x->tbsResponseData.responseExtensions, loc));
 160 }
 161
 162 void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit,
 163                                   int *idx)
 164 {
 165     return X509V3_get_d2i(x->tbsResponseData.responseExtensions, nid, crit,
 166                           idx);
 167 }
 168
 169 int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value,
 170                                 int crit, unsigned long flags)
 171 {
 172     return X509V3_add1_i2d(&x->tbsResponseData.responseExtensions, nid,
 173                            value, crit, flags);
 174 }
 175
 176 int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc)
 177 {
 178     return (X509v3_add_ext(&(x->tbsResponseData.responseExtensions), ex, loc)
 179             != NULL);
 180 }
 181
 182 /* OCSP single response extensions */
 183
 184 int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x)
 185 {
 186     return (X509v3_get_ext_count(x->singleExtensions));
 187 }
 188
 189 int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos)
 190 {
 191     return (X509v3_get_ext_by_NID(x->singleExtensions, nid, lastpos));
 192 }
 193
 194 int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj,
 195                                    int lastpos)
 196 {
 197     return (X509v3_get_ext_by_OBJ(x->singleExtensions, obj, lastpos));
 198 }
 199
 200 int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit,
 201                                         int lastpos)
 202 {
 203     return (X509v3_get_ext_by_critical(x->singleExtensions, crit, lastpos));
 204 }
 205
 206 X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc)
 207 {
 208     return (X509v3_get_ext(x->singleExtensions, loc));
 209 }
 210
 211 X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc)
 212 {
 213     return (X509v3_delete_ext(x->singleExtensions, loc));
 214 }
 215
 216 void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit,
 217                                    int *idx)
 218 {
 219     return X509V3_get_d2i(x->singleExtensions, nid, crit, idx);
 220 }
 221
 222 int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value,
 223                                  int crit, unsigned long flags)
 224 {
 225     return X509V3_add1_i2d(&x->singleExtensions, nid, value, crit, flags);
 226 }
 227
 228 int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc)
 229 {
 230     return (X509v3_add_ext(&(x->singleExtensions), ex, loc) != NULL);
 231 }
 232
 233 /* also CRL Entry Extensions */
 234
 235 /* Nonce handling functions */
 236
 237 /*
 238  * Add a nonce to an extension stack. A nonce can be specified or if NULL a
 239  * random nonce will be generated. Note: OpenSSL 0.9.7d and later create an
 240  * OCTET STRING containing the nonce, previous versions used the raw nonce.
 241  */
 242
 243 static int ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts,
 244                            unsigned char *val, int len)
 245 {
 246     unsigned char *tmpval;
 247     ASN1_OCTET_STRING os;
 248     int ret = 0;
 249     if (len <= 0)
 250         len = OCSP_DEFAULT_NONCE_LENGTH;
 251     /*
 252      * Create the OCTET STRING manually by writing out the header and
 253      * appending the content octets. This avoids an extra memory allocation
 254      * operation in some cases. Applications should *NOT* do this because it
 255      * relies on library internals.
 256      */
 257     os.length = ASN1_object_size(0, len, V_ASN1_OCTET_STRING);
 258     os.data = OPENSSL_malloc(os.length);
 259     if (os.data == NULL)
 260         goto err;
 261     tmpval = os.data;
 262     ASN1_put_object(&tmpval, 0, len, V_ASN1_OCTET_STRING, V_ASN1_UNIVERSAL);
 263     if (val)
 264         memcpy(tmpval, val, len);
 265     else if (RAND_bytes(tmpval, len) <= 0)
 266         goto err;
 267     if (!X509V3_add1_i2d(exts, NID_id_pkix_OCSP_Nonce,
 268                          &os, 0, X509V3_ADD_REPLACE))
 269         goto err;
 270     ret = 1;
 271  err:
 272     OPENSSL_free(os.data);
 273     return ret;
 274 }
 275
 276 /* Add nonce to an OCSP request */
 277
 278 int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len)
 279 {
 280     return ocsp_add1_nonce(&req->tbsRequest.requestExtensions, val, len);
 281 }
 282
 283 /* Same as above but for a response */
 284
 285 int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len)
 286 {
 287     return ocsp_add1_nonce(&resp->tbsResponseData.responseExtensions, val,
 288                            len);
 289 }
 290
 291 /*-
 292  * Check nonce validity in a request and response.
 293  * Return value reflects result:
 294  *  1: nonces present and equal.
 295  *  2: nonces both absent.
 296  *  3: nonce present in response only.
 297  *  0: nonces both present and not equal.
 298  * -1: nonce in request only.
 299  *
 300  *  For most responders clients can check return > 0.
 301  *  If responder doesn't handle nonces return != 0 may be
 302  *  necessary. return == 0 is always an error.
 303  */
 304
 305 int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs)
 306 {
 307     /*
 308      * Since we are only interested in the presence or absence of
 309      * the nonce and comparing its value there is no need to use
 310      * the X509V3 routines: this way we can avoid them allocating an
 311      * ASN1_OCTET_STRING structure for the value which would be
 312      * freed immediately anyway.
 313      */
 314
 315     int req_idx, resp_idx;
 316     X509_EXTENSION *req_ext, *resp_ext;
 317     req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1);
 318     resp_idx = OCSP_BASICRESP_get_ext_by_NID(bs, NID_id_pkix_OCSP_Nonce, -1);
 319     /* Check both absent */
 320     if ((req_idx < 0) && (resp_idx < 0))
 321         return 2;
 322     /* Check in request only */
 323     if ((req_idx >= 0) && (resp_idx < 0))
 324         return -1;
 325     /* Check in response but not request */
 326     if ((req_idx < 0) && (resp_idx >= 0))
 327         return 3;
 328     /*
 329      * Otherwise nonce in request and response so retrieve the extensions
 330      */
 331     req_ext = OCSP_REQUEST_get_ext(req, req_idx);
 332     resp_ext = OCSP_BASICRESP_get_ext(bs, resp_idx);
 333     if (ASN1_OCTET_STRING_cmp(X509_EXTENSION_get_data(req_ext),
 334                               X509_EXTENSION_get_data(resp_ext)))
 335         return 0;
 336     return 1;
 337 }
 338
 339 /*
 340  * Copy the nonce value (if any) from an OCSP request to a response.
 341  */
 342
 343 int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req)
 344 {
 345     X509_EXTENSION *req_ext;
 346     int req_idx;
 347     /* Check for nonce in request */
 348     req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1);
 349     /* If no nonce that's OK */
 350     if (req_idx < 0)
 351         return 2;
 352     req_ext = OCSP_REQUEST_get_ext(req, req_idx);
 353     return OCSP_BASICRESP_add_ext(resp, req_ext, -1);
 354 }
 355
 356 X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim)
 357 {
 358     X509_EXTENSION *x = NULL;
 359     OCSP_CRLID *cid = NULL;
 360
 361     if ((cid = OCSP_CRLID_new()) == NULL)
 362         goto err;
 363     if (url) {
 364         if ((cid->crlUrl = ASN1_IA5STRING_new()) == NULL)
 365             goto err;
 366         if (!(ASN1_STRING_set(cid->crlUrl, url, -1)))
 367             goto err;
 368     }
 369     if (n) {
 370         if ((cid->crlNum = ASN1_INTEGER_new()) == NULL)
 371             goto err;
 372         if (!(ASN1_INTEGER_set(cid->crlNum, *n)))
 373             goto err;
 374     }
 375     if (tim) {
 376         if ((cid->crlTime = ASN1_GENERALIZEDTIME_new()) == NULL)
 377             goto err;
 378         if (!(ASN1_GENERALIZEDTIME_set_string(cid->crlTime, tim)))
 379             goto err;
 380     }
 381     x = X509V3_EXT_i2d(NID_id_pkix_OCSP_CrlID, 0, cid);
 382  err:
 383     OCSP_CRLID_free(cid);
 384     return x;
 385 }
 386
 387 /*   AcceptableResponses ::= SEQUENCE OF OBJECT IDENTIFIER */
 388 X509_EXTENSION *OCSP_accept_responses_new(char **oids)
 389 {
 390     int nid;
 391     STACK_OF(ASN1_OBJECT) *sk = NULL;
 392     ASN1_OBJECT *o = NULL;
 393     X509_EXTENSION *x = NULL;
 394
 395     if ((sk = sk_ASN1_OBJECT_new_null()) == NULL)
 396         goto err;
 397     while (oids && *oids) {
 398         if ((nid = OBJ_txt2nid(*oids)) != NID_undef && (o = OBJ_nid2obj(nid)))
 399             sk_ASN1_OBJECT_push(sk, o);
 400         oids++;
 401     }
 402     x = X509V3_EXT_i2d(NID_id_pkix_OCSP_acceptableResponses, 0, sk);
 403  err:
 404     sk_ASN1_OBJECT_pop_free(sk, ASN1_OBJECT_free);
 405     return x;
 406 }
 407
 408 /*  ArchiveCutoff ::= GeneralizedTime */
 409 X509_EXTENSION *OCSP_archive_cutoff_new(char *tim)
 410 {
 411     X509_EXTENSION *x = NULL;
 412     ASN1_GENERALIZEDTIME *gt = NULL;
 413
 414     if ((gt = ASN1_GENERALIZEDTIME_new()) == NULL)
 415         goto err;
 416     if (!(ASN1_GENERALIZEDTIME_set_string(gt, tim)))
 417         goto err;
 418     x = X509V3_EXT_i2d(NID_id_pkix_OCSP_archiveCutoff, 0, gt);
 419  err:
 420     ASN1_GENERALIZEDTIME_free(gt);
 421     return x;
 422 }
 423
 424 /*
 425  * per ACCESS_DESCRIPTION parameter are oids, of which there are currently
 426  * two--NID_ad_ocsp, NID_id_ad_caIssuers--and GeneralName value.  This method
 427  * forces NID_ad_ocsp and uniformResourceLocator [6] IA5String.
 428  */
 429 X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME *issuer, char **urls)
 430 {
 431     X509_EXTENSION *x = NULL;
 432     ASN1_IA5STRING *ia5 = NULL;
 433     OCSP_SERVICELOC *sloc = NULL;
 434     ACCESS_DESCRIPTION *ad = NULL;
 435
 436     if ((sloc = OCSP_SERVICELOC_new()) == NULL)
 437         goto err;
 438     if ((sloc->issuer = X509_NAME_dup(issuer)) == NULL)
 439         goto err;
 440     if (urls && *urls
 441         && (sloc->locator = sk_ACCESS_DESCRIPTION_new_null()) == NULL)
 442         goto err;
 443     while (urls && *urls) {
 444         if ((ad = ACCESS_DESCRIPTION_new()) == NULL)
 445             goto err;
 446         if ((ad->method = OBJ_nid2obj(NID_ad_OCSP)) == NULL)
 447             goto err;
 448         if ((ad->location = GENERAL_NAME_new()) == NULL)
 449             goto err;
 450         if ((ia5 = ASN1_IA5STRING_new()) == NULL)
 451             goto err;
 452         if (!ASN1_STRING_set((ASN1_STRING *)ia5, *urls, -1))
 453             goto err;
 454         ad->location->type = GEN_URI;
 455         ad->location->d.ia5 = ia5;
 456         ia5 = NULL;
 457         if (!sk_ACCESS_DESCRIPTION_push(sloc->locator, ad))
 458             goto err;
 459         ad = NULL;
 460         urls++;
 461     }
 462     x = X509V3_EXT_i2d(NID_id_pkix_OCSP_serviceLocator, 0, sloc);
 463  err:
 464     ASN1_IA5STRING_free(ia5);
 465     ACCESS_DESCRIPTION_free(ad);
 466     OCSP_SERVICELOC_free(sloc);
 467     return x;
 468 }