2 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
5 /* ====================================================================
6 * Copyright (c) 2000 The OpenSSL Project. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
34 * 6. Redistributions of any form whatsoever must retain the following
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
59 #include <openssl/ocsp.h>
60 #include <openssl/err.h>
62 static X509
*ocsp_find_signer(OCSP_BASICRESP
*bs
, STACK_OF(X509
) *certs
,
63 X509_STORE
*st
, unsigned long flags
);
64 static X509
*ocsp_find_signer_sk(STACK_OF(X509
) *certs
, OCSP_RESPID
*id
);
66 /* Verify a basic response message */
68 int OCSP_basic_verify(OCSP_BASICRESP
*bs
, STACK_OF(X509
) *certs
,
69 X509_STORE
*st
, unsigned long flags
)
72 STACK_OF(X509
) *chain
= NULL
;
75 signer
= ocsp_find_signer(bs
, certs
, st
, flags
);
78 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY
, OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND
);
81 if(!(flags
& OCSP_NOSIGS
))
84 skey
= X509_get_pubkey(signer
);
85 ret
= OCSP_BASICRESP_verify(bs
, skey
, 0);
89 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY
, OCSP_R_SIGNATURE_FAILURE
);
93 if(!(flags
& OCSP_NOVERIFY
))
95 if(flags
& OCSP_NOCHAIN
)
96 X509_STORE_CTX_init(&ctx
, st
, signer
, NULL
);
98 X509_STORE_CTX_init(&ctx
, st
, signer
, bs
->certs
);
100 X509_STORE_CTX_set_purpose(&ctx
, X509_PURPOSE_OCSP_HELPER
);
101 ret
= X509_verify_cert(&ctx
);
102 chain
= X509_STORE_CTX_get1_chain(&ctx
);
103 X509_STORE_CTX_cleanup(&ctx
);
106 i
= X509_STORE_CTX_get_error(&ctx
);
107 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY
,OCSP_R_CERTIFICATE_VERIFY_ERROR
);
108 ERR_add_error_data(2, "Verify error:",
109 X509_verify_cert_error_string(i
));
112 if(flags
& OCSP_NOCHECKS
)
117 /* At this point we have a valid certificate chain
118 * need to verify it against the OCSP criteria.
121 if(ocsp_check_issuer(bs
, chain
, flags
))
128 /* Easy case: explicitly trusted. Get root CA and
129 * check for explicit trust
131 if(flags
& OCSP_NOEXPLICIT
) goto end
;
133 x
= sk_X509_value(chain
, sk_X509_num(chain
) - 1);
134 if(X509_check_trust(x
, NID_OCSP_sign
, 0) != X509_TRUST_TRUSTED
)
136 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY
,OCSP_R_ROOT_CA_NOT_TRUSTED
);
145 if(chain
) sk_X509_pop_free(chain
, X509_free
);
150 static X509
*ocsp_find_signer(OCSP_BASICRESP
*bs
, STACK_OF(X509
) *certs
,
151 X509_STORE
*st
, unsigned long flags
)
154 OCSP_RESPID
*rid
= bs
->tbsResponseData
->responderId
;
155 if ((signer
= ocsp_find_signer_sk(certs
, rid
)))
157 if(!(flags
& OCSP_NOINTERN
) &&
158 (signer
= ocsp_find_signer_sk(bs
->certs
, rid
)))
160 /* Maybe lookup from store if by subject name */
166 static X509
*ocsp_find_signer_sk(STACK_OF(X509
) *certs
, OCSP_RESPID
*id
)
169 unsigned char tmphash
[SHA_DIGEST_LENGTH
], *keyhash
;
170 ASN1_BIT_STRING
*key
;
174 /* Easy if lookup by name */
175 if(id
->type
== V_OCSP_RESPID_NAME
)
176 return X509_find_by_subject(certs
, id
->value
.byName
);
178 /* Lookup by key hash */
180 /* If key hash isn't SHA1 length then forget it */
181 if(id
->value
.byKey
->length
!= SHA_DIGEST_LENGTH
) return NULL
;
182 keyhash
= id
->value
.byKey
->data
;
183 /* Calculate hash of each key and compare */
184 for(i
= 0; i
< sk_X509_num(certs
); i
++)
186 x
= sk_X509_value(certs
, i
);
187 key
= x
->cert_info
->key
->public_key
;
188 EVP_DigestInit(&ctx
,EVP_sha1());
189 EVP_DigestUpdate(&ctx
,key
->data
, key
->length
);
190 EVP_DigestFinal(&ctx
,tmphash
,NULL
);
191 if(!memcmp(keyhash
, tmphash
, SHA_DIGEST_LENGTH
))