summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/lib/libcrypto/ocsp/ocsp.h357
-rw-r--r--src/lib/libcrypto/ocsp/ocsp_cl.c315
-rw-r--r--src/lib/libcrypto/ocsp/ocsp_ext.c655
-rw-r--r--src/lib/libcrypto/ocsp/ocsp_ht.c275
-rw-r--r--src/lib/libcrypto/ocsp/ocsp_lib.c170
-rw-r--r--src/lib/libcrypto/ocsp/ocsp_prn.c278
-rw-r--r--src/lib/libcrypto/ocsp/ocsp_srv.c199
-rw-r--r--src/lib/libcrypto/ocsp/ocsp_vfy.c357
-rw-r--r--src/lib/libssl/src/crypto/ocsp/ocsp.h357
-rw-r--r--src/lib/libssl/src/crypto/ocsp/ocsp_cl.c315
-rw-r--r--src/lib/libssl/src/crypto/ocsp/ocsp_ext.c655
-rw-r--r--src/lib/libssl/src/crypto/ocsp/ocsp_ht.c275
-rw-r--r--src/lib/libssl/src/crypto/ocsp/ocsp_lib.c170
-rw-r--r--src/lib/libssl/src/crypto/ocsp/ocsp_prn.c278
-rw-r--r--src/lib/libssl/src/crypto/ocsp/ocsp_srv.c199
-rw-r--r--src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c357
16 files changed, 2664 insertions, 2548 deletions
diff --git a/src/lib/libcrypto/ocsp/ocsp.h b/src/lib/libcrypto/ocsp/ocsp.h
index 31e45744ba..9401f7db2f 100644
--- a/src/lib/libcrypto/ocsp/ocsp.h
+++ b/src/lib/libcrypto/ocsp/ocsp.h
@@ -96,13 +96,12 @@ extern "C" {
96 * issuerKeyHash OCTET STRING, -- Hash of Issuers public key (excluding the tag & length fields) 96 * issuerKeyHash OCTET STRING, -- Hash of Issuers public key (excluding the tag & length fields)
97 * serialNumber CertificateSerialNumber } 97 * serialNumber CertificateSerialNumber }
98 */ 98 */
99typedef struct ocsp_cert_id_st 99typedef struct ocsp_cert_id_st {
100 {
101 X509_ALGOR *hashAlgorithm; 100 X509_ALGOR *hashAlgorithm;
102 ASN1_OCTET_STRING *issuerNameHash; 101 ASN1_OCTET_STRING *issuerNameHash;
103 ASN1_OCTET_STRING *issuerKeyHash; 102 ASN1_OCTET_STRING *issuerKeyHash;
104 ASN1_INTEGER *serialNumber; 103 ASN1_INTEGER *serialNumber;
105 } OCSP_CERTID; 104} OCSP_CERTID;
106 105
107DECLARE_STACK_OF(OCSP_CERTID) 106DECLARE_STACK_OF(OCSP_CERTID)
108 107
@@ -110,11 +109,10 @@ DECLARE_STACK_OF(OCSP_CERTID)
110 * reqCert CertID, 109 * reqCert CertID,
111 * singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL } 110 * singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL }
112 */ 111 */
113typedef struct ocsp_one_request_st 112typedef struct ocsp_one_request_st {
114 {
115 OCSP_CERTID *reqCert; 113 OCSP_CERTID *reqCert;
116 STACK_OF(X509_EXTENSION) *singleRequestExtensions; 114 STACK_OF(X509_EXTENSION) *singleRequestExtensions;
117 } OCSP_ONEREQ; 115} OCSP_ONEREQ;
118 116
119DECLARE_STACK_OF(OCSP_ONEREQ) 117DECLARE_STACK_OF(OCSP_ONEREQ)
120DECLARE_ASN1_SET_OF(OCSP_ONEREQ) 118DECLARE_ASN1_SET_OF(OCSP_ONEREQ)
@@ -126,35 +124,32 @@ DECLARE_ASN1_SET_OF(OCSP_ONEREQ)
126 * requestList SEQUENCE OF Request, 124 * requestList SEQUENCE OF Request,
127 * requestExtensions [2] EXPLICIT Extensions OPTIONAL } 125 * requestExtensions [2] EXPLICIT Extensions OPTIONAL }
128 */ 126 */
129typedef struct ocsp_req_info_st 127typedef struct ocsp_req_info_st {
130 {
131 ASN1_INTEGER *version; 128 ASN1_INTEGER *version;
132 GENERAL_NAME *requestorName; 129 GENERAL_NAME *requestorName;
133 STACK_OF(OCSP_ONEREQ) *requestList; 130 STACK_OF(OCSP_ONEREQ) *requestList;
134 STACK_OF(X509_EXTENSION) *requestExtensions; 131 STACK_OF(X509_EXTENSION) *requestExtensions;
135 } OCSP_REQINFO; 132} OCSP_REQINFO;
136 133
137/* Signature ::= SEQUENCE { 134/* Signature ::= SEQUENCE {
138 * signatureAlgorithm AlgorithmIdentifier, 135 * signatureAlgorithm AlgorithmIdentifier,
139 * signature BIT STRING, 136 * signature BIT STRING,
140 * certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL } 137 * certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }
141 */ 138 */
142typedef struct ocsp_signature_st 139typedef struct ocsp_signature_st {
143 {
144 X509_ALGOR *signatureAlgorithm; 140 X509_ALGOR *signatureAlgorithm;
145 ASN1_BIT_STRING *signature; 141 ASN1_BIT_STRING *signature;
146 STACK_OF(X509) *certs; 142 STACK_OF(X509) *certs;
147 } OCSP_SIGNATURE; 143} OCSP_SIGNATURE;
148 144
149/* OCSPRequest ::= SEQUENCE { 145/* OCSPRequest ::= SEQUENCE {
150 * tbsRequest TBSRequest, 146 * tbsRequest TBSRequest,
151 * optionalSignature [0] EXPLICIT Signature OPTIONAL } 147 * optionalSignature [0] EXPLICIT Signature OPTIONAL }
152 */ 148 */
153typedef struct ocsp_request_st 149typedef struct ocsp_request_st {
154 {
155 OCSP_REQINFO *tbsRequest; 150 OCSP_REQINFO *tbsRequest;
156 OCSP_SIGNATURE *optionalSignature; /* OPTIONAL */ 151 OCSP_SIGNATURE *optionalSignature; /* OPTIONAL */
157 } OCSP_REQUEST; 152} OCSP_REQUEST;
158 153
159/* OCSPResponseStatus ::= ENUMERATED { 154/* OCSPResponseStatus ::= ENUMERATED {
160 * successful (0), --Response has valid confirmations 155 * successful (0), --Response has valid confirmations
@@ -166,32 +161,30 @@ typedef struct ocsp_request_st
166 * unauthorized (6) --Request unauthorized 161 * unauthorized (6) --Request unauthorized
167 * } 162 * }
168 */ 163 */
169#define OCSP_RESPONSE_STATUS_SUCCESSFUL 0 164#define OCSP_RESPONSE_STATUS_SUCCESSFUL 0
170#define OCSP_RESPONSE_STATUS_MALFORMEDREQUEST 1 165#define OCSP_RESPONSE_STATUS_MALFORMEDREQUEST 1
171#define OCSP_RESPONSE_STATUS_INTERNALERROR 2 166#define OCSP_RESPONSE_STATUS_INTERNALERROR 2
172#define OCSP_RESPONSE_STATUS_TRYLATER 3 167#define OCSP_RESPONSE_STATUS_TRYLATER 3
173#define OCSP_RESPONSE_STATUS_SIGREQUIRED 5 168#define OCSP_RESPONSE_STATUS_SIGREQUIRED 5
174#define OCSP_RESPONSE_STATUS_UNAUTHORIZED 6 169#define OCSP_RESPONSE_STATUS_UNAUTHORIZED 6
175 170
176/* ResponseBytes ::= SEQUENCE { 171/* ResponseBytes ::= SEQUENCE {
177 * responseType OBJECT IDENTIFIER, 172 * responseType OBJECT IDENTIFIER,
178 * response OCTET STRING } 173 * response OCTET STRING }
179 */ 174 */
180typedef struct ocsp_resp_bytes_st 175typedef struct ocsp_resp_bytes_st {
181 {
182 ASN1_OBJECT *responseType; 176 ASN1_OBJECT *responseType;
183 ASN1_OCTET_STRING *response; 177 ASN1_OCTET_STRING *response;
184 } OCSP_RESPBYTES; 178} OCSP_RESPBYTES;
185 179
186/* OCSPResponse ::= SEQUENCE { 180/* OCSPResponse ::= SEQUENCE {
187 * responseStatus OCSPResponseStatus, 181 * responseStatus OCSPResponseStatus,
188 * responseBytes [0] EXPLICIT ResponseBytes OPTIONAL } 182 * responseBytes [0] EXPLICIT ResponseBytes OPTIONAL }
189 */ 183 */
190struct ocsp_response_st 184struct ocsp_response_st {
191 {
192 ASN1_ENUMERATED *responseStatus; 185 ASN1_ENUMERATED *responseStatus;
193 OCSP_RESPBYTES *responseBytes; 186 OCSP_RESPBYTES *responseBytes;
194 }; 187};
195 188
196/* ResponderID ::= CHOICE { 189/* ResponderID ::= CHOICE {
197 * byName [1] Name, 190 * byName [1] Name,
@@ -199,14 +192,13 @@ struct ocsp_response_st
199 */ 192 */
200#define V_OCSP_RESPID_NAME 0 193#define V_OCSP_RESPID_NAME 0
201#define V_OCSP_RESPID_KEY 1 194#define V_OCSP_RESPID_KEY 1
202struct ocsp_responder_id_st 195struct ocsp_responder_id_st {
203 {
204 int type; 196 int type;
205 union { 197 union {
206 X509_NAME* byName; 198 X509_NAME* byName;
207 ASN1_OCTET_STRING *byKey; 199 ASN1_OCTET_STRING *byKey;
208 } value; 200 } value;
209 }; 201};
210 202
211DECLARE_STACK_OF(OCSP_RESPID) 203DECLARE_STACK_OF(OCSP_RESPID)
212DECLARE_ASN1_FUNCTIONS(OCSP_RESPID) 204DECLARE_ASN1_FUNCTIONS(OCSP_RESPID)
@@ -219,11 +211,10 @@ DECLARE_ASN1_FUNCTIONS(OCSP_RESPID)
219 * revocationTime GeneralizedTime, 211 * revocationTime GeneralizedTime,
220 * revocationReason [0] EXPLICIT CRLReason OPTIONAL } 212 * revocationReason [0] EXPLICIT CRLReason OPTIONAL }
221 */ 213 */
222typedef struct ocsp_revoked_info_st 214typedef struct ocsp_revoked_info_st {
223 {
224 ASN1_GENERALIZEDTIME *revocationTime; 215 ASN1_GENERALIZEDTIME *revocationTime;
225 ASN1_ENUMERATED *revocationReason; 216 ASN1_ENUMERATED *revocationReason;
226 } OCSP_REVOKEDINFO; 217} OCSP_REVOKEDINFO;
227 218
228/* CertStatus ::= CHOICE { 219/* CertStatus ::= CHOICE {
229 * good [0] IMPLICIT NULL, 220 * good [0] IMPLICIT NULL,
@@ -233,15 +224,14 @@ typedef struct ocsp_revoked_info_st
233#define V_OCSP_CERTSTATUS_GOOD 0 224#define V_OCSP_CERTSTATUS_GOOD 0
234#define V_OCSP_CERTSTATUS_REVOKED 1 225#define V_OCSP_CERTSTATUS_REVOKED 1
235#define V_OCSP_CERTSTATUS_UNKNOWN 2 226#define V_OCSP_CERTSTATUS_UNKNOWN 2
236typedef struct ocsp_cert_status_st 227typedef struct ocsp_cert_status_st {
237 {
238 int type; 228 int type;
239 union { 229 union {
240 ASN1_NULL *good; 230 ASN1_NULL *good;
241 OCSP_REVOKEDINFO *revoked; 231 OCSP_REVOKEDINFO *revoked;
242 ASN1_NULL *unknown; 232 ASN1_NULL *unknown;
243 } value; 233 } value;
244 } OCSP_CERTSTATUS; 234} OCSP_CERTSTATUS;
245 235
246/* SingleResponse ::= SEQUENCE { 236/* SingleResponse ::= SEQUENCE {
247 * certID CertID, 237 * certID CertID,
@@ -250,14 +240,13 @@ typedef struct ocsp_cert_status_st
250 * nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL, 240 * nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL,
251 * singleExtensions [1] EXPLICIT Extensions OPTIONAL } 241 * singleExtensions [1] EXPLICIT Extensions OPTIONAL }
252 */ 242 */
253typedef struct ocsp_single_response_st 243typedef struct ocsp_single_response_st {
254 {
255 OCSP_CERTID *certId; 244 OCSP_CERTID *certId;
256 OCSP_CERTSTATUS *certStatus; 245 OCSP_CERTSTATUS *certStatus;
257 ASN1_GENERALIZEDTIME *thisUpdate; 246 ASN1_GENERALIZEDTIME *thisUpdate;
258 ASN1_GENERALIZEDTIME *nextUpdate; 247 ASN1_GENERALIZEDTIME *nextUpdate;
259 STACK_OF(X509_EXTENSION) *singleExtensions; 248 STACK_OF(X509_EXTENSION) *singleExtensions;
260 } OCSP_SINGLERESP; 249} OCSP_SINGLERESP;
261 250
262DECLARE_STACK_OF(OCSP_SINGLERESP) 251DECLARE_STACK_OF(OCSP_SINGLERESP)
263DECLARE_ASN1_SET_OF(OCSP_SINGLERESP) 252DECLARE_ASN1_SET_OF(OCSP_SINGLERESP)
@@ -269,14 +258,13 @@ DECLARE_ASN1_SET_OF(OCSP_SINGLERESP)
269 * responses SEQUENCE OF SingleResponse, 258 * responses SEQUENCE OF SingleResponse,
270 * responseExtensions [1] EXPLICIT Extensions OPTIONAL } 259 * responseExtensions [1] EXPLICIT Extensions OPTIONAL }
271 */ 260 */
272typedef struct ocsp_response_data_st 261typedef struct ocsp_response_data_st {
273 {
274 ASN1_INTEGER *version; 262 ASN1_INTEGER *version;
275 OCSP_RESPID *responderId; 263 OCSP_RESPID *responderId;
276 ASN1_GENERALIZEDTIME *producedAt; 264 ASN1_GENERALIZEDTIME *producedAt;
277 STACK_OF(OCSP_SINGLERESP) *responses; 265 STACK_OF(OCSP_SINGLERESP) *responses;
278 STACK_OF(X509_EXTENSION) *responseExtensions; 266 STACK_OF(X509_EXTENSION) *responseExtensions;
279 } OCSP_RESPDATA; 267} OCSP_RESPDATA;
280 268
281/* BasicOCSPResponse ::= SEQUENCE { 269/* BasicOCSPResponse ::= SEQUENCE {
282 * tbsResponseData ResponseData, 270 * tbsResponseData ResponseData,
@@ -300,13 +288,12 @@ typedef struct ocsp_response_data_st
300 that it doesn't do the double hashing that the RFC seems to say one 288 that it doesn't do the double hashing that the RFC seems to say one
301 should. Therefore, all relevant functions take a flag saying which 289 should. Therefore, all relevant functions take a flag saying which
302 variant should be used. -- Richard Levitte, OpenSSL team and CeloCom */ 290 variant should be used. -- Richard Levitte, OpenSSL team and CeloCom */
303typedef struct ocsp_basic_response_st 291typedef struct ocsp_basic_response_st {
304 {
305 OCSP_RESPDATA *tbsResponseData; 292 OCSP_RESPDATA *tbsResponseData;
306 X509_ALGOR *signatureAlgorithm; 293 X509_ALGOR *signatureAlgorithm;
307 ASN1_BIT_STRING *signature; 294 ASN1_BIT_STRING *signature;
308 STACK_OF(X509) *certs; 295 STACK_OF(X509) *certs;
309 } OCSP_BASICRESP; 296} OCSP_BASICRESP;
310 297
311/* 298/*
312 * CRLReason ::= ENUMERATED { 299 * CRLReason ::= ENUMERATED {
@@ -319,164 +306,159 @@ typedef struct ocsp_basic_response_st
319 * certificateHold (6), 306 * certificateHold (6),
320 * removeFromCRL (8) } 307 * removeFromCRL (8) }
321 */ 308 */
322#define OCSP_REVOKED_STATUS_NOSTATUS -1 309#define OCSP_REVOKED_STATUS_NOSTATUS -1
323#define OCSP_REVOKED_STATUS_UNSPECIFIED 0 310#define OCSP_REVOKED_STATUS_UNSPECIFIED 0
324#define OCSP_REVOKED_STATUS_KEYCOMPROMISE 1 311#define OCSP_REVOKED_STATUS_KEYCOMPROMISE 1
325#define OCSP_REVOKED_STATUS_CACOMPROMISE 2 312#define OCSP_REVOKED_STATUS_CACOMPROMISE 2
326#define OCSP_REVOKED_STATUS_AFFILIATIONCHANGED 3 313#define OCSP_REVOKED_STATUS_AFFILIATIONCHANGED 3
327#define OCSP_REVOKED_STATUS_SUPERSEDED 4 314#define OCSP_REVOKED_STATUS_SUPERSEDED 4
328#define OCSP_REVOKED_STATUS_CESSATIONOFOPERATION 5 315#define OCSP_REVOKED_STATUS_CESSATIONOFOPERATION 5
329#define OCSP_REVOKED_STATUS_CERTIFICATEHOLD 6 316#define OCSP_REVOKED_STATUS_CERTIFICATEHOLD 6
330#define OCSP_REVOKED_STATUS_REMOVEFROMCRL 8 317#define OCSP_REVOKED_STATUS_REMOVEFROMCRL 8
331 318
332/* CrlID ::= SEQUENCE { 319/* CrlID ::= SEQUENCE {
333 * crlUrl [0] EXPLICIT IA5String OPTIONAL, 320 * crlUrl [0] EXPLICIT IA5String OPTIONAL,
334 * crlNum [1] EXPLICIT INTEGER OPTIONAL, 321 * crlNum [1] EXPLICIT INTEGER OPTIONAL,
335 * crlTime [2] EXPLICIT GeneralizedTime OPTIONAL } 322 * crlTime [2] EXPLICIT GeneralizedTime OPTIONAL }
336 */ 323 */
337typedef struct ocsp_crl_id_st 324typedef struct ocsp_crl_id_st {
338 {
339 ASN1_IA5STRING *crlUrl; 325 ASN1_IA5STRING *crlUrl;
340 ASN1_INTEGER *crlNum; 326 ASN1_INTEGER *crlNum;
341 ASN1_GENERALIZEDTIME *crlTime; 327 ASN1_GENERALIZEDTIME *crlTime;
342 } OCSP_CRLID; 328} OCSP_CRLID;
343 329
344/* ServiceLocator ::= SEQUENCE { 330/* ServiceLocator ::= SEQUENCE {
345 * issuer Name, 331 * issuer Name,
346 * locator AuthorityInfoAccessSyntax OPTIONAL } 332 * locator AuthorityInfoAccessSyntax OPTIONAL }
347 */ 333 */
348typedef struct ocsp_service_locator_st 334typedef struct ocsp_service_locator_st {
349 {
350 X509_NAME* issuer; 335 X509_NAME* issuer;
351 STACK_OF(ACCESS_DESCRIPTION) *locator; 336 STACK_OF(ACCESS_DESCRIPTION) *locator;
352 } OCSP_SERVICELOC; 337} OCSP_SERVICELOC;
353 338
354#define PEM_STRING_OCSP_REQUEST "OCSP REQUEST" 339#define PEM_STRING_OCSP_REQUEST "OCSP REQUEST"
355#define PEM_STRING_OCSP_RESPONSE "OCSP RESPONSE" 340#define PEM_STRING_OCSP_RESPONSE "OCSP RESPONSE"
356 341
357#define d2i_OCSP_REQUEST_bio(bp,p) ASN1_d2i_bio_of(OCSP_REQUEST,OCSP_REQUEST_new,d2i_OCSP_REQUEST,bp,p) 342#define d2i_OCSP_REQUEST_bio(bp,p) \
343 ASN1_d2i_bio_of(OCSP_REQUEST,OCSP_REQUEST_new,d2i_OCSP_REQUEST,bp,p)
358 344
359#define d2i_OCSP_RESPONSE_bio(bp,p) ASN1_d2i_bio_of(OCSP_RESPONSE,OCSP_RESPONSE_new,d2i_OCSP_RESPONSE,bp,p) 345#define d2i_OCSP_RESPONSE_bio(bp,p) \
346 ASN1_d2i_bio_of(OCSP_RESPONSE,OCSP_RESPONSE_new,d2i_OCSP_RESPONSE,bp,p)
360 347
361#define PEM_read_bio_OCSP_REQUEST(bp,x,cb) (OCSP_REQUEST *)PEM_ASN1_read_bio( \ 348#define PEM_read_bio_OCSP_REQUEST(bp,x,cb) \
362 (char *(*)())d2i_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,bp,(char **)x,cb,NULL) 349 (OCSP_REQUEST *)PEM_ASN1_read_bio((char *(*)())d2i_OCSP_REQUEST, \
350 PEM_STRING_OCSP_REQUEST,bp,(char **)x,cb,NULL)
363 351
364#define PEM_read_bio_OCSP_RESPONSE(bp,x,cb)(OCSP_RESPONSE *)PEM_ASN1_read_bio(\ 352#define PEM_read_bio_OCSP_RESPONSE(bp,x,cb) \
365 (char *(*)())d2i_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,bp,(char **)x,cb,NULL) 353 (OCSP_RESPONSE *)PEM_ASN1_read_bio((char *(*)())d2i_OCSP_RESPONSE, \
354 PEM_STRING_OCSP_RESPONSE,bp,(char **)x,cb,NULL)
366 355
367#define PEM_write_bio_OCSP_REQUEST(bp,o) \ 356#define PEM_write_bio_OCSP_REQUEST(bp,o) \
368 PEM_ASN1_write_bio((int (*)())i2d_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,\ 357 PEM_ASN1_write_bio((int (*)())i2d_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,\
369 bp,(char *)o, NULL,NULL,0,NULL,NULL) 358 bp,(char *)o, NULL,NULL,0,NULL,NULL)
370 359
371#define PEM_write_bio_OCSP_RESPONSE(bp,o) \ 360#define PEM_write_bio_OCSP_RESPONSE(bp,o) \
372 PEM_ASN1_write_bio((int (*)())i2d_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,\ 361 PEM_ASN1_write_bio((int (*)())i2d_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,\
373 bp,(char *)o, NULL,NULL,0,NULL,NULL) 362 bp,(char *)o, NULL,NULL,0,NULL,NULL)
374 363
375#define i2d_OCSP_RESPONSE_bio(bp,o) ASN1_i2d_bio_of(OCSP_RESPONSE,i2d_OCSP_RESPONSE,bp,o) 364#define i2d_OCSP_RESPONSE_bio(bp,o) \
365 ASN1_i2d_bio_of(OCSP_RESPONSE,i2d_OCSP_RESPONSE,bp,o)
376 366
377#define i2d_OCSP_REQUEST_bio(bp,o) ASN1_i2d_bio_of(OCSP_REQUEST,i2d_OCSP_REQUEST,bp,o) 367#define i2d_OCSP_REQUEST_bio(bp,o) \
368 ASN1_i2d_bio_of(OCSP_REQUEST,i2d_OCSP_REQUEST,bp,o)
378 369
379#define OCSP_REQUEST_sign(o,pkey,md) \ 370#define OCSP_REQUEST_sign(o,pkey,md) \
380 ASN1_item_sign(ASN1_ITEM_rptr(OCSP_REQINFO),\ 371 ASN1_item_sign(ASN1_ITEM_rptr(OCSP_REQINFO), \
381 o->optionalSignature->signatureAlgorithm,NULL,\ 372 o->optionalSignature->signatureAlgorithm,NULL, \
382 o->optionalSignature->signature,o->tbsRequest,pkey,md) 373 o->optionalSignature->signature,o->tbsRequest,pkey,md)
383 374
384#define OCSP_BASICRESP_sign(o,pkey,md,d) \ 375#define OCSP_BASICRESP_sign(o,pkey,md,d) \
385 ASN1_item_sign(ASN1_ITEM_rptr(OCSP_RESPDATA),o->signatureAlgorithm,NULL,\ 376 ASN1_item_sign(ASN1_ITEM_rptr(OCSP_RESPDATA),o->signatureAlgorithm,NULL, \
386 o->signature,o->tbsResponseData,pkey,md) 377 o->signature,o->tbsResponseData,pkey,md)
387 378
388#define OCSP_REQUEST_verify(a,r) ASN1_item_verify(ASN1_ITEM_rptr(OCSP_REQINFO),\ 379#define OCSP_REQUEST_verify(a,r) \
389 a->optionalSignature->signatureAlgorithm,\ 380 ASN1_item_verify(ASN1_ITEM_rptr(OCSP_REQINFO), \
381 a->optionalSignature->signatureAlgorithm, \
390 a->optionalSignature->signature,a->tbsRequest,r) 382 a->optionalSignature->signature,a->tbsRequest,r)
391 383
392#define OCSP_BASICRESP_verify(a,r,d) ASN1_item_verify(ASN1_ITEM_rptr(OCSP_RESPDATA),\ 384#define OCSP_BASICRESP_verify(a,r,d) \
385 ASN1_item_verify(ASN1_ITEM_rptr(OCSP_RESPDATA), \
393 a->signatureAlgorithm,a->signature,a->tbsResponseData,r) 386 a->signatureAlgorithm,a->signature,a->tbsResponseData,r)
394 387
395#define ASN1_BIT_STRING_digest(data,type,md,len) \ 388#define ASN1_BIT_STRING_digest(data,type,md,len) \
396 ASN1_item_digest(ASN1_ITEM_rptr(ASN1_BIT_STRING),type,data,md,len) 389 ASN1_item_digest(ASN1_ITEM_rptr(ASN1_BIT_STRING),type,data,md,len)
397 390
398#define OCSP_CERTSTATUS_dup(cs)\ 391#define OCSP_CERTSTATUS_dup(cs)\
399 (OCSP_CERTSTATUS*)ASN1_dup((int(*)())i2d_OCSP_CERTSTATUS,\ 392 (OCSP_CERTSTATUS*)ASN1_dup((int(*)())i2d_OCSP_CERTSTATUS,\
400 (char *(*)())d2i_OCSP_CERTSTATUS,(char *)(cs)) 393 (char *(*)())d2i_OCSP_CERTSTATUS,(char *)(cs))
401 394
402OCSP_CERTID *OCSP_CERTID_dup(OCSP_CERTID *id); 395OCSP_CERTID *OCSP_CERTID_dup(OCSP_CERTID *id);
403 396
404OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req); 397OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req);
405OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req, 398OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req,
406 int maxline); 399 int maxline);
407int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx); 400int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx);
408void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx); 401void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx);
409int OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, OCSP_REQUEST *req); 402int OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, OCSP_REQUEST *req);
410int OCSP_REQ_CTX_add1_header(OCSP_REQ_CTX *rctx, 403int OCSP_REQ_CTX_add1_header(OCSP_REQ_CTX *rctx, const char *name,
411 const char *name, const char *value); 404 const char *value);
412 405
413OCSP_CERTID *OCSP_cert_to_id(const EVP_MD *dgst, X509 *subject, X509 *issuer); 406OCSP_CERTID *OCSP_cert_to_id(const EVP_MD *dgst, X509 *subject, X509 *issuer);
414 407
415OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst, 408OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst, X509_NAME *issuerName,
416 X509_NAME *issuerName, 409 ASN1_BIT_STRING* issuerKey, ASN1_INTEGER *serialNumber);
417 ASN1_BIT_STRING* issuerKey,
418 ASN1_INTEGER *serialNumber);
419 410
420OCSP_ONEREQ *OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid); 411OCSP_ONEREQ *OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid);
421 412
422int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len); 413int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len);
423int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len); 414int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len);
424int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs); 415int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs);
425int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req); 416int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req);
426 417
427int OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm); 418int OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm);
428int OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert); 419int OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert);
429 420
430int OCSP_request_sign(OCSP_REQUEST *req, 421int OCSP_request_sign(OCSP_REQUEST *req, X509 *signer, EVP_PKEY *key,
431 X509 *signer, 422 const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags);
432 EVP_PKEY *key,
433 const EVP_MD *dgst,
434 STACK_OF(X509) *certs,
435 unsigned long flags);
436 423
437int OCSP_response_status(OCSP_RESPONSE *resp); 424int OCSP_response_status(OCSP_RESPONSE *resp);
438OCSP_BASICRESP *OCSP_response_get1_basic(OCSP_RESPONSE *resp); 425OCSP_BASICRESP *OCSP_response_get1_basic(OCSP_RESPONSE *resp);
439 426
440int OCSP_resp_count(OCSP_BASICRESP *bs); 427int OCSP_resp_count(OCSP_BASICRESP *bs);
441OCSP_SINGLERESP *OCSP_resp_get0(OCSP_BASICRESP *bs, int idx); 428OCSP_SINGLERESP *OCSP_resp_get0(OCSP_BASICRESP *bs, int idx);
442int OCSP_resp_find(OCSP_BASICRESP *bs, OCSP_CERTID *id, int last); 429int OCSP_resp_find(OCSP_BASICRESP *bs, OCSP_CERTID *id, int last);
443int OCSP_single_get0_status(OCSP_SINGLERESP *single, int *reason, 430int OCSP_single_get0_status(OCSP_SINGLERESP *single, int *reason,
444 ASN1_GENERALIZEDTIME **revtime, 431 ASN1_GENERALIZEDTIME **revtime, ASN1_GENERALIZEDTIME **thisupd,
445 ASN1_GENERALIZEDTIME **thisupd, 432 ASN1_GENERALIZEDTIME **nextupd);
446 ASN1_GENERALIZEDTIME **nextupd); 433int OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status,
447int OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status, 434 int *reason, ASN1_GENERALIZEDTIME **revtime,
448 int *reason, 435 ASN1_GENERALIZEDTIME **thisupd, ASN1_GENERALIZEDTIME **nextupd);
449 ASN1_GENERALIZEDTIME **revtime, 436int OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
450 ASN1_GENERALIZEDTIME **thisupd, 437 ASN1_GENERALIZEDTIME *nextupd, long sec, long maxsec);
451 ASN1_GENERALIZEDTIME **nextupd); 438
452int OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd, 439int OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs,
453 ASN1_GENERALIZEDTIME *nextupd, 440 X509_STORE *store, unsigned long flags);
454 long sec, long maxsec); 441
455 442int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath,
456int OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *store, unsigned long flags); 443 int *pssl);
457 444
458int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pssl); 445int OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b);
459 446int OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b);
460int OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b); 447
461int OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b); 448int OCSP_request_onereq_count(OCSP_REQUEST *req);
462
463int OCSP_request_onereq_count(OCSP_REQUEST *req);
464OCSP_ONEREQ *OCSP_request_onereq_get0(OCSP_REQUEST *req, int i); 449OCSP_ONEREQ *OCSP_request_onereq_get0(OCSP_REQUEST *req, int i);
465OCSP_CERTID *OCSP_onereq_get0_id(OCSP_ONEREQ *one); 450OCSP_CERTID *OCSP_onereq_get0_id(OCSP_ONEREQ *one);
466int OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd, 451int OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd,
467 ASN1_OCTET_STRING **pikeyHash, 452 ASN1_OCTET_STRING **pikeyHash, ASN1_INTEGER **pserial,
468 ASN1_INTEGER **pserial, OCSP_CERTID *cid); 453 OCSP_CERTID *cid);
469int OCSP_request_is_signed(OCSP_REQUEST *req); 454int OCSP_request_is_signed(OCSP_REQUEST *req);
470OCSP_RESPONSE *OCSP_response_create(int status, OCSP_BASICRESP *bs); 455OCSP_RESPONSE *OCSP_response_create(int status, OCSP_BASICRESP *bs);
471OCSP_SINGLERESP *OCSP_basic_add1_status(OCSP_BASICRESP *rsp, 456OCSP_SINGLERESP *OCSP_basic_add1_status(OCSP_BASICRESP *rsp, OCSP_CERTID *cid,
472 OCSP_CERTID *cid, 457 int status, int reason, ASN1_TIME *revtime, ASN1_TIME *thisupd,
473 int status, int reason, 458 ASN1_TIME *nextupd);
474 ASN1_TIME *revtime, 459int OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert);
475 ASN1_TIME *thisupd, ASN1_TIME *nextupd); 460int OCSP_basic_sign(OCSP_BASICRESP *brsp, X509 *signer, EVP_PKEY *key,
476int OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert); 461 const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags);
477int OCSP_basic_sign(OCSP_BASICRESP *brsp,
478 X509 *signer, EVP_PKEY *key, const EVP_MD *dgst,
479 STACK_OF(X509) *certs, unsigned long flags);
480 462
481X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim); 463X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim);
482 464
@@ -486,49 +468,60 @@ X509_EXTENSION *OCSP_archive_cutoff_new(char* tim);
486 468
487X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, char **urls); 469X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, char **urls);
488 470
489int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x); 471int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x);
490int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos); 472int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos);
491int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj, int lastpos); 473int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj,
492int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos); 474 int lastpos);
475int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit,
476 int lastpos);
493X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc); 477X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc);
494X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc); 478X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc);
495void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx); 479void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx);
496int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, int crit, 480int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value,
497 unsigned long flags); 481 int crit, unsigned long flags);
498int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc); 482int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc);
499 483
500int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x); 484int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x);
501int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos); 485int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos);
502int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj, int lastpos); 486int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj,
503int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos); 487 int lastpos);
488int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos);
504X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc); 489X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc);
505X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc); 490X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc);
506void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx); 491void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx);
507int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit, 492int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit,
508 unsigned long flags); 493 unsigned long flags);
509int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc); 494int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc);
510 495
511int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x); 496int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x);
512int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos); 497int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos);
513int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj, int lastpos); 498int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj,
514int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit, int lastpos); 499 int lastpos);
500int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit,
501 int lastpos);
515X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc); 502X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc);
516X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc); 503X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc);
517void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit, int *idx); 504void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit,
518int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value, int crit, 505 int *idx);
519 unsigned long flags); 506int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value,
520int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc); 507 int crit, unsigned long flags);
521 508int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc);
522int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x); 509
523int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos); 510int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x);
524int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj, int lastpos); 511int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid,
525int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit, int lastpos); 512 int lastpos);
513int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj,
514 int lastpos);
515int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit,
516 int lastpos);
526X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc); 517X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc);
527X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc); 518X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc);
528void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit, int *idx); 519void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit,
529int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value, int crit, 520 int *idx);
530 unsigned long flags); 521int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value,
531int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc); 522 int crit, unsigned long flags);
523int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex,
524 int loc);
532 525
533DECLARE_ASN1_FUNCTIONS(OCSP_SINGLERESP) 526DECLARE_ASN1_FUNCTIONS(OCSP_SINGLERESP)
534DECLARE_ASN1_FUNCTIONS(OCSP_CERTSTATUS) 527DECLARE_ASN1_FUNCTIONS(OCSP_CERTSTATUS)
@@ -550,11 +543,11 @@ const char *OCSP_response_status_str(long s);
550const char *OCSP_cert_status_str(long s); 543const char *OCSP_cert_status_str(long s);
551const char *OCSP_crl_reason_str(long s); 544const char *OCSP_crl_reason_str(long s);
552 545
553int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* a, unsigned long flags); 546int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* a, unsigned long flags);
554int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags); 547int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags);
555 548
556int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, 549int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
557 X509_STORE *st, unsigned long flags); 550 X509_STORE *st, unsigned long flags);
558 551
559/* BEGIN ERROR CODES */ 552/* BEGIN ERROR CODES */
560/* The following lines are auto generated by the script mkerr.pl. Any changes 553/* The following lines are auto generated by the script mkerr.pl. Any changes
diff --git a/src/lib/libcrypto/ocsp/ocsp_cl.c b/src/lib/libcrypto/ocsp/ocsp_cl.c
index 9c14d9da27..716513d2f9 100644
--- a/src/lib/libcrypto/ocsp/ocsp_cl.c
+++ b/src/lib/libcrypto/ocsp/ocsp_cl.c
@@ -78,229 +78,241 @@
78/* Add an OCSP_CERTID to an OCSP request. Return new OCSP_ONEREQ 78/* Add an OCSP_CERTID to an OCSP request. Return new OCSP_ONEREQ
79 * pointer: useful if we want to add extensions. 79 * pointer: useful if we want to add extensions.
80 */ 80 */
81 81OCSP_ONEREQ *
82OCSP_ONEREQ *OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid) 82OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid)
83 { 83{
84 OCSP_ONEREQ *one = NULL; 84 OCSP_ONEREQ *one = NULL;
85 85
86 if (!(one = OCSP_ONEREQ_new())) goto err; 86 if (!(one = OCSP_ONEREQ_new()))
87 if (one->reqCert) OCSP_CERTID_free(one->reqCert); 87 goto err;
88 if (one->reqCert)
89 OCSP_CERTID_free(one->reqCert);
88 one->reqCert = cid; 90 one->reqCert = cid;
89 if (req && 91 if (req && !sk_OCSP_ONEREQ_push(req->tbsRequest->requestList, one))
90 !sk_OCSP_ONEREQ_push(req->tbsRequest->requestList, one)) 92 goto err;
91 goto err;
92 return one; 93 return one;
93err: 94err:
94 OCSP_ONEREQ_free(one); 95 OCSP_ONEREQ_free(one);
95 return NULL; 96 return NULL;
96 } 97}
97 98
98/* Set requestorName from an X509_NAME structure */ 99/* Set requestorName from an X509_NAME structure */
99 100int
100int OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm) 101OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm)
101 { 102{
102 GENERAL_NAME *gen; 103 GENERAL_NAME *gen;
104
103 gen = GENERAL_NAME_new(); 105 gen = GENERAL_NAME_new();
104 if (gen == NULL) 106 if (gen == NULL)
105 return 0; 107 return 0;
106 if (!X509_NAME_set(&gen->d.directoryName, nm)) 108 if (!X509_NAME_set(&gen->d.directoryName, nm)) {
107 {
108 GENERAL_NAME_free(gen); 109 GENERAL_NAME_free(gen);
109 return 0; 110 return 0;
110 } 111 }
111 gen->type = GEN_DIRNAME; 112 gen->type = GEN_DIRNAME;
112 if (req->tbsRequest->requestorName) 113 if (req->tbsRequest->requestorName)
113 GENERAL_NAME_free(req->tbsRequest->requestorName); 114 GENERAL_NAME_free(req->tbsRequest->requestorName);
114 req->tbsRequest->requestorName = gen; 115 req->tbsRequest->requestorName = gen;
115 return 1; 116 return 1;
116 } 117}
117 118
118
119/* Add a certificate to an OCSP request */ 119/* Add a certificate to an OCSP request */
120 120int
121int OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert) 121OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert)
122 { 122{
123 OCSP_SIGNATURE *sig; 123 OCSP_SIGNATURE *sig;
124
124 if (!req->optionalSignature) 125 if (!req->optionalSignature)
125 req->optionalSignature = OCSP_SIGNATURE_new(); 126 req->optionalSignature = OCSP_SIGNATURE_new();
126 sig = req->optionalSignature; 127 sig = req->optionalSignature;
127 if (!sig) return 0; 128 if (!sig)
128 if (!cert) return 1; 129 return 0;
130 if (!cert)
131 return 1;
129 if (!sig->certs && !(sig->certs = sk_X509_new_null())) 132 if (!sig->certs && !(sig->certs = sk_X509_new_null()))
130 return 0; 133 return 0;
131 134
132 if(!sk_X509_push(sig->certs, cert)) return 0; 135 if(!sk_X509_push(sig->certs, cert))
136 return 0;
133 CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509); 137 CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509);
134 return 1; 138 return 1;
135 } 139}
136 140
137/* Sign an OCSP request set the requestorName to the subjec 141/* Sign an OCSP request set the requestorName to the subjec
138 * name of an optional signers certificate and include one 142 * name of an optional signers certificate and include one
139 * or more optional certificates in the request. Behaves 143 * or more optional certificates in the request. Behaves
140 * like PKCS7_sign(). 144 * like PKCS7_sign().
141 */ 145 */
142 146int
143int OCSP_request_sign(OCSP_REQUEST *req, 147OCSP_request_sign(OCSP_REQUEST *req, X509 *signer, EVP_PKEY *key,
144 X509 *signer, 148 const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags)
145 EVP_PKEY *key, 149{
146 const EVP_MD *dgst,
147 STACK_OF(X509) *certs,
148 unsigned long flags)
149 {
150 int i; 150 int i;
151 OCSP_SIGNATURE *sig; 151 OCSP_SIGNATURE *sig;
152 X509 *x; 152 X509 *x;
153 153
154 if (!OCSP_request_set1_name(req, X509_get_subject_name(signer))) 154 if (!OCSP_request_set1_name(req, X509_get_subject_name(signer)))
155 goto err;
156
157 if (!(req->optionalSignature = sig = OCSP_SIGNATURE_new()))
158 goto err;
159 if (key) {
160 if (!X509_check_private_key(signer, key)) {
161 OCSPerr(OCSP_F_OCSP_REQUEST_SIGN,
162 OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
155 goto err; 163 goto err;
156
157 if (!(req->optionalSignature = sig = OCSP_SIGNATURE_new())) goto err;
158 if (key)
159 {
160 if (!X509_check_private_key(signer, key))
161 {
162 OCSPerr(OCSP_F_OCSP_REQUEST_SIGN, OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
163 goto err;
164 }
165 if (!OCSP_REQUEST_sign(req, key, dgst)) goto err;
166 } 164 }
165 if (!OCSP_REQUEST_sign(req, key, dgst))
166 goto err;
167 }
167 168
168 if (!(flags & OCSP_NOCERTS)) 169 if (!(flags & OCSP_NOCERTS)) {
169 { 170 if(!OCSP_request_add1_cert(req, signer))
170 if(!OCSP_request_add1_cert(req, signer)) goto err; 171 goto err;
171 for (i = 0; i < sk_X509_num(certs); i++) 172 for (i = 0; i < sk_X509_num(certs); i++) {
172 {
173 x = sk_X509_value(certs, i); 173 x = sk_X509_value(certs, i);
174 if (!OCSP_request_add1_cert(req, x)) goto err; 174 if (!OCSP_request_add1_cert(req, x))
175 } 175 goto err;
176 } 176 }
177 }
177 178
178 return 1; 179 return 1;
179err: 180err:
180 OCSP_SIGNATURE_free(req->optionalSignature); 181 OCSP_SIGNATURE_free(req->optionalSignature);
181 req->optionalSignature = NULL; 182 req->optionalSignature = NULL;
182 return 0; 183 return 0;
183 } 184}
184 185
185/* Get response status */ 186/* Get response status */
186 187int
187int OCSP_response_status(OCSP_RESPONSE *resp) 188OCSP_response_status(OCSP_RESPONSE *resp)
188 { 189{
189 return ASN1_ENUMERATED_get(resp->responseStatus); 190 return ASN1_ENUMERATED_get(resp->responseStatus);
190 } 191}
191 192
192/* Extract basic response from OCSP_RESPONSE or NULL if 193/* Extract basic response from OCSP_RESPONSE or NULL if
193 * no basic response present. 194 * no basic response present.
194 */ 195 */
195 196OCSP_BASICRESP *
196 197OCSP_response_get1_basic(OCSP_RESPONSE *resp)
197OCSP_BASICRESP *OCSP_response_get1_basic(OCSP_RESPONSE *resp) 198{
198 {
199 OCSP_RESPBYTES *rb; 199 OCSP_RESPBYTES *rb;
200
200 rb = resp->responseBytes; 201 rb = resp->responseBytes;
201 if (!rb) 202 if (!rb) {
202 { 203 OCSPerr(OCSP_F_OCSP_RESPONSE_GET1_BASIC,
203 OCSPerr(OCSP_F_OCSP_RESPONSE_GET1_BASIC, OCSP_R_NO_RESPONSE_DATA); 204 OCSP_R_NO_RESPONSE_DATA);
204 return NULL; 205 return NULL;
205 } 206 }
206 if (OBJ_obj2nid(rb->responseType) != NID_id_pkix_OCSP_basic) 207 if (OBJ_obj2nid(rb->responseType) != NID_id_pkix_OCSP_basic) {
207 { 208 OCSPerr(OCSP_F_OCSP_RESPONSE_GET1_BASIC,
208 OCSPerr(OCSP_F_OCSP_RESPONSE_GET1_BASIC, OCSP_R_NOT_BASIC_RESPONSE); 209 OCSP_R_NOT_BASIC_RESPONSE);
209 return NULL; 210 return NULL;
210 } 211 }
211 212
212 return ASN1_item_unpack(rb->response, ASN1_ITEM_rptr(OCSP_BASICRESP)); 213 return ASN1_item_unpack(rb->response, ASN1_ITEM_rptr(OCSP_BASICRESP));
213 } 214}
214 215
215/* Return number of OCSP_SINGLERESP reponses present in 216/* Return number of OCSP_SINGLERESP reponses present in
216 * a basic response. 217 * a basic response.
217 */ 218 */
218 219int
219int OCSP_resp_count(OCSP_BASICRESP *bs) 220OCSP_resp_count(OCSP_BASICRESP *bs)
220 { 221{
221 if (!bs) return -1; 222 if (!bs)
223 return -1;
222 return sk_OCSP_SINGLERESP_num(bs->tbsResponseData->responses); 224 return sk_OCSP_SINGLERESP_num(bs->tbsResponseData->responses);
223 } 225}
224 226
225/* Extract an OCSP_SINGLERESP response with a given index */ 227/* Extract an OCSP_SINGLERESP response with a given index */
226 228OCSP_SINGLERESP *
227OCSP_SINGLERESP *OCSP_resp_get0(OCSP_BASICRESP *bs, int idx) 229OCSP_resp_get0(OCSP_BASICRESP *bs, int idx)
228 { 230{
229 if (!bs) return NULL; 231 if (!bs)
232 return NULL;
230 return sk_OCSP_SINGLERESP_value(bs->tbsResponseData->responses, idx); 233 return sk_OCSP_SINGLERESP_value(bs->tbsResponseData->responses, idx);
231 } 234}
232 235
233/* Look single response matching a given certificate ID */ 236/* Look single response matching a given certificate ID */
234 237int
235int OCSP_resp_find(OCSP_BASICRESP *bs, OCSP_CERTID *id, int last) 238OCSP_resp_find(OCSP_BASICRESP *bs, OCSP_CERTID *id, int last)
236 { 239{
237 int i; 240 int i;
238 STACK_OF(OCSP_SINGLERESP) *sresp; 241 STACK_OF(OCSP_SINGLERESP) *sresp;
239 OCSP_SINGLERESP *single; 242 OCSP_SINGLERESP *single;
240 if (!bs) return -1; 243
241 if (last < 0) last = 0; 244 if (!bs)
242 else last++; 245 return -1;
246 if (last < 0)
247 last = 0;
248 else
249 last++;
243 sresp = bs->tbsResponseData->responses; 250 sresp = bs->tbsResponseData->responses;
244 for (i = last; i < sk_OCSP_SINGLERESP_num(sresp); i++) 251 for (i = last; i < sk_OCSP_SINGLERESP_num(sresp); i++) {
245 {
246 single = sk_OCSP_SINGLERESP_value(sresp, i); 252 single = sk_OCSP_SINGLERESP_value(sresp, i);
247 if (!OCSP_id_cmp(id, single->certId)) return i; 253 if (!OCSP_id_cmp(id, single->certId))
248 } 254 return i;
249 return -1;
250 } 255 }
256 return -1;
257}
251 258
252/* Extract status information from an OCSP_SINGLERESP structure. 259/* Extract status information from an OCSP_SINGLERESP structure.
253 * Note: the revtime and reason values are only set if the 260 * Note: the revtime and reason values are only set if the
254 * certificate status is revoked. Returns numerical value of 261 * certificate status is revoked. Returns numerical value of
255 * status. 262 * status.
256 */ 263 */
257 264int
258int OCSP_single_get0_status(OCSP_SINGLERESP *single, int *reason, 265OCSP_single_get0_status(OCSP_SINGLERESP *single, int *reason,
259 ASN1_GENERALIZEDTIME **revtime, 266 ASN1_GENERALIZEDTIME **revtime, ASN1_GENERALIZEDTIME **thisupd,
260 ASN1_GENERALIZEDTIME **thisupd, 267 ASN1_GENERALIZEDTIME **nextupd)
261 ASN1_GENERALIZEDTIME **nextupd) 268{
262 {
263 int ret; 269 int ret;
264 OCSP_CERTSTATUS *cst; 270 OCSP_CERTSTATUS *cst;
265 if(!single) return -1; 271
272 if (!single)
273 return -1;
266 cst = single->certStatus; 274 cst = single->certStatus;
267 ret = cst->type; 275 ret = cst->type;
268 if (ret == V_OCSP_CERTSTATUS_REVOKED) 276 if (ret == V_OCSP_CERTSTATUS_REVOKED) {
269 {
270 OCSP_REVOKEDINFO *rev = cst->value.revoked; 277 OCSP_REVOKEDINFO *rev = cst->value.revoked;
271 if (revtime) *revtime = rev->revocationTime; 278
272 if (reason) 279 if (revtime)
273 { 280 *revtime = rev->revocationTime;
274 if(rev->revocationReason) 281 if (reason) {
282 if (rev->revocationReason)
275 *reason = ASN1_ENUMERATED_get(rev->revocationReason); 283 *reason = ASN1_ENUMERATED_get(rev->revocationReason);
276 else *reason = -1; 284 else
277 } 285 *reason = -1;
278 } 286 }
279 if(thisupd) *thisupd = single->thisUpdate;
280 if(nextupd) *nextupd = single->nextUpdate;
281 return ret;
282 } 287 }
288 if (thisupd)
289 *thisupd = single->thisUpdate;
290 if (nextupd)
291 *nextupd = single->nextUpdate;
292 return ret;
293}
283 294
284/* This function combines the previous ones: look up a certificate ID and 295/* This function combines the previous ones: look up a certificate ID and
285 * if found extract status information. Return 0 is successful. 296 * if found extract status information. Return 0 is successful.
286 */ 297 */
287 298int
288int OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status, 299OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status,
289 int *reason, 300 int *reason, ASN1_GENERALIZEDTIME **revtime, ASN1_GENERALIZEDTIME **thisupd,
290 ASN1_GENERALIZEDTIME **revtime, 301 ASN1_GENERALIZEDTIME **nextupd)
291 ASN1_GENERALIZEDTIME **thisupd, 302{
292 ASN1_GENERALIZEDTIME **nextupd)
293 {
294 int i; 303 int i;
295 OCSP_SINGLERESP *single; 304 OCSP_SINGLERESP *single;
305
296 i = OCSP_resp_find(bs, id, -1); 306 i = OCSP_resp_find(bs, id, -1);
297 /* Maybe check for multiple responses and give an error? */ 307 /* Maybe check for multiple responses and give an error? */
298 if(i < 0) return 0; 308 if (i < 0)
309 return 0;
299 single = OCSP_resp_get0(bs, i); 310 single = OCSP_resp_get0(bs, i);
300 i = OCSP_single_get0_status(single, reason, revtime, thisupd, nextupd); 311 i = OCSP_single_get0_status(single, reason, revtime, thisupd, nextupd);
301 if(status) *status = i; 312 if (status)
313 *status = i;
302 return 1; 314 return 1;
303 } 315}
304 316
305/* Check validity of thisUpdate and nextUpdate fields. It is possible that the request will 317/* Check validity of thisUpdate and nextUpdate fields. It is possible that the request will
306 * take a few seconds to process and/or the time wont be totally accurate. Therefore to avoid 318 * take a few seconds to process and/or the time wont be totally accurate. Therefore to avoid
@@ -308,64 +320,61 @@ int OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status,
308 * Also to avoid accepting very old responses without a nextUpdate field an optional maxage 320 * Also to avoid accepting very old responses without a nextUpdate field an optional maxage
309 * parameter specifies the maximum age the thisUpdate field can be. 321 * parameter specifies the maximum age the thisUpdate field can be.
310 */ 322 */
311 323int
312int OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd, ASN1_GENERALIZEDTIME *nextupd, long nsec, long maxsec) 324OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
313 { 325 ASN1_GENERALIZEDTIME *nextupd, long nsec, long maxsec)
326{
314 int ret = 1; 327 int ret = 1;
315 time_t t_now, t_tmp; 328 time_t t_now, t_tmp;
329
316 time(&t_now); 330 time(&t_now);
317 /* Check thisUpdate is valid and not more than nsec in the future */ 331 /* Check thisUpdate is valid and not more than nsec in the future */
318 if (!ASN1_GENERALIZEDTIME_check(thisupd)) 332 if (!ASN1_GENERALIZEDTIME_check(thisupd)) {
319 { 333 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY,
320 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, OCSP_R_ERROR_IN_THISUPDATE_FIELD); 334 OCSP_R_ERROR_IN_THISUPDATE_FIELD);
321 ret = 0; 335 ret = 0;
322 } 336 } else {
323 else 337 t_tmp = t_now + nsec;
324 { 338 if (X509_cmp_time(thisupd, &t_tmp) > 0) {
325 t_tmp = t_now + nsec; 339 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY,
326 if (X509_cmp_time(thisupd, &t_tmp) > 0) 340 OCSP_R_STATUS_NOT_YET_VALID);
327 {
328 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, OCSP_R_STATUS_NOT_YET_VALID);
329 ret = 0; 341 ret = 0;
330 } 342 }
331 343
332 /* If maxsec specified check thisUpdate is not more than maxsec in the past */ 344 /* If maxsec specified check thisUpdate is not more than maxsec in the past */
333 if (maxsec >= 0) 345 if (maxsec >= 0) {
334 {
335 t_tmp = t_now - maxsec; 346 t_tmp = t_now - maxsec;
336 if (X509_cmp_time(thisupd, &t_tmp) < 0) 347 if (X509_cmp_time(thisupd, &t_tmp) < 0) {
337 { 348 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY,
338 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, OCSP_R_STATUS_TOO_OLD); 349 OCSP_R_STATUS_TOO_OLD);
339 ret = 0; 350 ret = 0;
340 }
341 } 351 }
342 } 352 }
343 353 }
344 354
345 if (!nextupd) return ret; 355 if (!nextupd)
356 return ret;
346 357
347 /* Check nextUpdate is valid and not more than nsec in the past */ 358 /* Check nextUpdate is valid and not more than nsec in the past */
348 if (!ASN1_GENERALIZEDTIME_check(nextupd)) 359 if (!ASN1_GENERALIZEDTIME_check(nextupd)) {
349 { 360 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY,
350 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, OCSP_R_ERROR_IN_NEXTUPDATE_FIELD); 361 OCSP_R_ERROR_IN_NEXTUPDATE_FIELD);
351 ret = 0; 362 ret = 0;
352 } 363 } else {
353 else
354 {
355 t_tmp = t_now - nsec; 364 t_tmp = t_now - nsec;
356 if (X509_cmp_time(nextupd, &t_tmp) < 0) 365 if (X509_cmp_time(nextupd, &t_tmp) < 0) {
357 { 366 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY,
358 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, OCSP_R_STATUS_EXPIRED); 367 OCSP_R_STATUS_EXPIRED);
359 ret = 0; 368 ret = 0;
360 }
361 } 369 }
370 }
362 371
363 /* Also don't allow nextUpdate to precede thisUpdate */ 372 /* Also don't allow nextUpdate to precede thisUpdate */
364 if (ASN1_STRING_cmp(nextupd, thisupd) < 0) 373 if (ASN1_STRING_cmp(nextupd, thisupd) < 0) {
365 { 374 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY,
366 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE); 375 OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE);
367 ret = 0; 376 ret = 0;
368 } 377 }
369 378
370 return ret; 379 return ret;
371 } 380}
diff --git a/src/lib/libcrypto/ocsp/ocsp_ext.c b/src/lib/libcrypto/ocsp/ocsp_ext.c
index 9c7832b301..6ec8ca4adf 100644
--- a/src/lib/libcrypto/ocsp/ocsp_ext.c
+++ b/src/lib/libcrypto/ocsp/ocsp_ext.c
@@ -73,238 +73,285 @@
73 73
74/* OCSP request extensions */ 74/* OCSP request extensions */
75 75
76int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x) 76int
77 { 77OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x)
78 return(X509v3_get_ext_count(x->tbsRequest->requestExtensions)); 78{
79 } 79 return X509v3_get_ext_count(x->tbsRequest->requestExtensions);
80 80}
81int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos) 81
82 { 82int
83 return(X509v3_get_ext_by_NID(x->tbsRequest->requestExtensions,nid,lastpos)); 83OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos)
84 } 84{
85 85 return X509v3_get_ext_by_NID(x->tbsRequest->requestExtensions, nid,
86int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj, int lastpos) 86 lastpos);
87 { 87}
88 return(X509v3_get_ext_by_OBJ(x->tbsRequest->requestExtensions,obj,lastpos)); 88
89 } 89int
90 90OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj, int lastpos)
91int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos) 91{
92 { 92 return X509v3_get_ext_by_OBJ(x->tbsRequest->requestExtensions, obj,
93 return(X509v3_get_ext_by_critical(x->tbsRequest->requestExtensions,crit,lastpos)); 93 lastpos);
94 } 94}
95 95
96X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc) 96int
97 { 97OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos)
98 return(X509v3_get_ext(x->tbsRequest->requestExtensions,loc)); 98{
99 } 99 return X509v3_get_ext_by_critical(x->tbsRequest->requestExtensions,
100 100 crit, lastpos);
101X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc) 101}
102 { 102
103 return(X509v3_delete_ext(x->tbsRequest->requestExtensions,loc)); 103X509_EXTENSION *
104 } 104OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc)
105 105{
106void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx) 106 return X509v3_get_ext(x->tbsRequest->requestExtensions, loc);
107 { 107}
108
109X509_EXTENSION *
110OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc)
111{
112 return X509v3_delete_ext(x->tbsRequest->requestExtensions, loc);
113}
114
115void *
116OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx)
117{
108 return X509V3_get_d2i(x->tbsRequest->requestExtensions, nid, crit, idx); 118 return X509V3_get_d2i(x->tbsRequest->requestExtensions, nid, crit, idx);
109 } 119}
110 120
111int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, int crit, 121int
112 unsigned long flags) 122OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, int crit,
113 { 123 unsigned long flags)
114 return X509V3_add1_i2d(&x->tbsRequest->requestExtensions, nid, value, crit, flags); 124{
115 } 125 return X509V3_add1_i2d(&x->tbsRequest->requestExtensions, nid, value,
116 126 crit, flags);
117int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc) 127}
118 { 128
119 return(X509v3_add_ext(&(x->tbsRequest->requestExtensions),ex,loc) != NULL); 129int
120 } 130OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc)
131{
132 return X509v3_add_ext(&(x->tbsRequest->requestExtensions), ex, loc) !=
133 NULL;
134}
121 135
122/* Single extensions */ 136/* Single extensions */
123 137
124int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x) 138int
125 { 139OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x)
126 return(X509v3_get_ext_count(x->singleRequestExtensions)); 140{
127 } 141 return X509v3_get_ext_count(x->singleRequestExtensions);
128 142}
129int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos) 143
130 { 144int
131 return(X509v3_get_ext_by_NID(x->singleRequestExtensions,nid,lastpos)); 145OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos)
132 } 146{
133 147 return X509v3_get_ext_by_NID(x->singleRequestExtensions, nid, lastpos);
134int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj, int lastpos) 148}
135 { 149
136 return(X509v3_get_ext_by_OBJ(x->singleRequestExtensions,obj,lastpos)); 150int
137 } 151OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj, int lastpos)
138 152{
139int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos) 153 return X509v3_get_ext_by_OBJ(x->singleRequestExtensions, obj, lastpos);
140 { 154}
141 return(X509v3_get_ext_by_critical(x->singleRequestExtensions,crit,lastpos)); 155
142 } 156int
143 157OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos)
144X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc) 158{
145 { 159 return X509v3_get_ext_by_critical(x->singleRequestExtensions, crit,
146 return(X509v3_get_ext(x->singleRequestExtensions,loc)); 160 lastpos);
147 } 161}
148 162
149X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc) 163X509_EXTENSION *
150 { 164OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc)
151 return(X509v3_delete_ext(x->singleRequestExtensions,loc)); 165{
152 } 166 return X509v3_get_ext(x->singleRequestExtensions, loc);
167}
168
169X509_EXTENSION *
170OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc)
171{
172 return X509v3_delete_ext(x->singleRequestExtensions, loc);
173}
153 174
154void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx) 175void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx)
155 { 176{
156 return X509V3_get_d2i(x->singleRequestExtensions, nid, crit, idx); 177 return X509V3_get_d2i(x->singleRequestExtensions, nid, crit, idx);
157 } 178}
158 179
159int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit, 180int
160 unsigned long flags) 181OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit,
161 { 182 unsigned long flags)
162 return X509V3_add1_i2d(&x->singleRequestExtensions, nid, value, crit, flags); 183{
163 } 184 return X509V3_add1_i2d(&x->singleRequestExtensions, nid, value, crit,
164 185 flags);
165int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc) 186}
166 { 187
167 return(X509v3_add_ext(&(x->singleRequestExtensions),ex,loc) != NULL); 188int
168 } 189OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc)
190{
191 return X509v3_add_ext(&(x->singleRequestExtensions), ex, loc) != NULL;
192}
169 193
170/* OCSP Basic response */ 194/* OCSP Basic response */
171 195
172int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x) 196int
173 { 197OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x)
174 return(X509v3_get_ext_count(x->tbsResponseData->responseExtensions)); 198{
175 } 199 return X509v3_get_ext_count(x->tbsResponseData->responseExtensions);
176 200}
177int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos) 201
178 { 202int
179 return(X509v3_get_ext_by_NID(x->tbsResponseData->responseExtensions,nid,lastpos)); 203OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos)
180 } 204{
181 205 return X509v3_get_ext_by_NID(x->tbsResponseData->responseExtensions,
182int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj, int lastpos) 206 nid ,lastpos);
183 { 207}
184 return(X509v3_get_ext_by_OBJ(x->tbsResponseData->responseExtensions,obj,lastpos)); 208
185 } 209int
186 210OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj, int lastpos)
187int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit, int lastpos) 211{
188 { 212 return X509v3_get_ext_by_OBJ(x->tbsResponseData->responseExtensions,
189 return(X509v3_get_ext_by_critical(x->tbsResponseData->responseExtensions,crit,lastpos)); 213 obj, lastpos);
190 } 214}
191 215
192X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc) 216int
193 { 217OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit, int lastpos)
194 return(X509v3_get_ext(x->tbsResponseData->responseExtensions,loc)); 218{
195 } 219 return X509v3_get_ext_by_critical(x->tbsResponseData->responseExtensions,
196 220 crit, lastpos);
197X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc) 221}
198 { 222
199 return(X509v3_delete_ext(x->tbsResponseData->responseExtensions,loc)); 223X509_EXTENSION *
200 } 224OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc)
201 225{
202void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit, int *idx) 226 return X509v3_get_ext(x->tbsResponseData->responseExtensions, loc);
203 { 227}
204 return X509V3_get_d2i(x->tbsResponseData->responseExtensions, nid, crit, idx); 228
205 } 229X509_EXTENSION *
206 230OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc)
207int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value, int crit, 231{
208 unsigned long flags) 232 return X509v3_delete_ext(x->tbsResponseData->responseExtensions, loc);
209 { 233}
210 return X509V3_add1_i2d(&x->tbsResponseData->responseExtensions, nid, value, crit, flags); 234
211 } 235void *
212 236OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit, int *idx)
213int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc) 237{
214 { 238 return X509V3_get_d2i(x->tbsResponseData->responseExtensions, nid,
215 return(X509v3_add_ext(&(x->tbsResponseData->responseExtensions),ex,loc) != NULL); 239 crit, idx);
216 } 240}
241
242int
243OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value, int crit,
244 unsigned long flags)
245{
246 return X509V3_add1_i2d(&x->tbsResponseData->responseExtensions, nid,
247 value, crit, flags);
248}
249
250int
251OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc)
252{
253 return X509v3_add_ext(&(x->tbsResponseData->responseExtensions), ex,
254 loc) != NULL;
255}
217 256
218/* OCSP single response extensions */ 257/* OCSP single response extensions */
219 258
220int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x) 259int
221 { 260OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x)
222 return(X509v3_get_ext_count(x->singleExtensions)); 261{
223 } 262 return X509v3_get_ext_count(x->singleExtensions);
224 263}
225int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos) 264
226 { 265int
227 return(X509v3_get_ext_by_NID(x->singleExtensions,nid,lastpos)); 266OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos)
228 } 267{
229 268 return X509v3_get_ext_by_NID(x->singleExtensions, nid, lastpos);
230int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj, int lastpos) 269}
231 { 270
232 return(X509v3_get_ext_by_OBJ(x->singleExtensions,obj,lastpos)); 271int
233 } 272OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj,
234 273 int lastpos)
235int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit, int lastpos) 274{
236 { 275 return X509v3_get_ext_by_OBJ(x->singleExtensions, obj, lastpos);
237 return(X509v3_get_ext_by_critical(x->singleExtensions,crit,lastpos)); 276}
238 } 277
239 278int
240X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc) 279OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit, int lastpos)
241 { 280{
242 return(X509v3_get_ext(x->singleExtensions,loc)); 281 return X509v3_get_ext_by_critical(x->singleExtensions, crit, lastpos);
243 } 282}
244 283
245X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc) 284X509_EXTENSION *
246 { 285OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc)
247 return(X509v3_delete_ext(x->singleExtensions,loc)); 286{
248 } 287 return X509v3_get_ext(x->singleExtensions, loc);
249 288}
250void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit, int *idx) 289
251 { 290X509_EXTENSION *
291OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc)
292{
293 return X509v3_delete_ext(x->singleExtensions, loc);
294}
295
296void *
297OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit, int *idx)
298{
252 return X509V3_get_d2i(x->singleExtensions, nid, crit, idx); 299 return X509V3_get_d2i(x->singleExtensions, nid, crit, idx);
253 } 300}
254 301
255int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value, int crit, 302int
256 unsigned long flags) 303OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value, int crit,
257 { 304 unsigned long flags)
305{
258 return X509V3_add1_i2d(&x->singleExtensions, nid, value, crit, flags); 306 return X509V3_add1_i2d(&x->singleExtensions, nid, value, crit, flags);
259 } 307}
260 308
261int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc) 309int
262 { 310OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc)
263 return(X509v3_add_ext(&(x->singleExtensions),ex,loc) != NULL); 311{
264 } 312 return X509v3_add_ext(&(x->singleExtensions), ex, loc) != NULL;
313}
265 314
266/* also CRL Entry Extensions */ 315/* also CRL Entry Extensions */
267#if 0 316#if 0
268ASN1_STRING *ASN1_STRING_encode(ASN1_STRING *s, i2d_of_void *i2d, 317ASN1_STRING *
269 void *data, STACK_OF(ASN1_OBJECT) *sk) 318ASN1_STRING_encode(ASN1_STRING *s, i2d_of_void *i2d, void *data,
270 { 319 STACK_OF(ASN1_OBJECT) *sk)
320{
271 int i; 321 int i;
272 unsigned char *p, *b = NULL; 322 unsigned char *p, *b = NULL;
273 323
274 if (data) 324 if (data) {
275 { 325 if ((i = i2d(data, NULL)) <= 0)
276 if ((i=i2d(data,NULL)) <= 0) goto err;
277 if (!(b=p=malloc((unsigned int)i)))
278 goto err; 326 goto err;
279 if (i2d(data, &p) <= 0) goto err; 327 if (!(b = p = malloc((unsigned int)i)))
280 } 328 goto err;
281 else if (sk) 329 if (i2d(data, &p) <= 0)
282 { 330 goto err;
283 if ((i=i2d_ASN1_SET_OF_ASN1_OBJECT(sk,NULL, 331 } else if (sk) {
284 (I2D_OF(ASN1_OBJECT))i2d, 332 if ((i = i2d_ASN1_SET_OF_ASN1_OBJECT(sk,NULL,
285 V_ASN1_SEQUENCE, 333 (I2D_OF(ASN1_OBJECT))i2d, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL,
286 V_ASN1_UNIVERSAL, 334 IS_SEQUENCE)) <= 0)
287 IS_SEQUENCE))<=0) goto err; 335 goto err;
288 if (!(b=p=malloc((unsigned int)i))) 336 if (!(b = p = malloc((unsigned int)i)))
289 goto err; 337 goto err;
290 if (i2d_ASN1_SET_OF_ASN1_OBJECT(sk,&p,(I2D_OF(ASN1_OBJECT))i2d, 338 if (i2d_ASN1_SET_OF_ASN1_OBJECT(sk,&p,(I2D_OF(ASN1_OBJECT))i2d,
291 V_ASN1_SEQUENCE, 339 V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, IS_SEQUENCE) <= 0)
292 V_ASN1_UNIVERSAL, 340 goto err;
293 IS_SEQUENCE)<=0) goto err; 341 } else {
294 } 342 OCSPerr(OCSP_F_ASN1_STRING_ENCODE, OCSP_R_BAD_DATA);
295 else 343 goto err;
296 { 344 }
297 OCSPerr(OCSP_F_ASN1_STRING_ENCODE,OCSP_R_BAD_DATA); 345 if (!s && !(s = ASN1_STRING_new()))
346 goto err;
347 if (!(ASN1_STRING_set(s, b, i)))
298 goto err; 348 goto err;
299 }
300 if (!s && !(s = ASN1_STRING_new())) goto err;
301 if (!(ASN1_STRING_set(s, b, i))) goto err;
302 free(b); 349 free(b);
303 return s; 350 return s;
304err: 351err:
305 if (b) free(b); 352 free(b);
306 return NULL; 353 return NULL;
307 } 354}
308#endif 355#endif
309 356
310/* Nonce handling functions */ 357/* Nonce handling functions */
@@ -315,16 +362,19 @@ err:
315 * nonce, previous versions used the raw nonce. 362 * nonce, previous versions used the raw nonce.
316 */ 363 */
317 364
318static int ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts, unsigned char *val, int len) 365static int
319 { 366ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts, unsigned char *val, int len)
367{
320 unsigned char *tmpval; 368 unsigned char *tmpval;
321 ASN1_OCTET_STRING os; 369 ASN1_OCTET_STRING os;
322 int ret = 0; 370 int ret = 0;
323 if (len <= 0) len = OCSP_DEFAULT_NONCE_LENGTH; 371
372 if (len <= 0)
373 len = OCSP_DEFAULT_NONCE_LENGTH;
324 /* Create the OCTET STRING manually by writing out the header and 374 /* Create the OCTET STRING manually by writing out the header and
325 * appending the content octets. This avoids an extra memory allocation 375 * appending the content octets. This avoids an extra memory allocation
326 * operation in some cases. Applications should *NOT* do this because 376 * operation in some cases. Applications should *NOT* do this because
327 * it relies on library internals. 377 * it relies on library internals.
328 */ 378 */
329 os.length = ASN1_object_size(0, len, V_ASN1_OCTET_STRING); 379 os.length = ASN1_object_size(0, len, V_ASN1_OCTET_STRING);
330 os.data = malloc(os.length); 380 os.data = malloc(os.length);
@@ -336,30 +386,29 @@ static int ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts, unsigned char *val,
336 memcpy(tmpval, val, len); 386 memcpy(tmpval, val, len);
337 else 387 else
338 RAND_pseudo_bytes(tmpval, len); 388 RAND_pseudo_bytes(tmpval, len);
339 if(!X509V3_add1_i2d(exts, NID_id_pkix_OCSP_Nonce, 389 if (!X509V3_add1_i2d(exts, NID_id_pkix_OCSP_Nonce, &os, 0,
340 &os, 0, X509V3_ADD_REPLACE)) 390 X509V3_ADD_REPLACE))
341 goto err; 391 goto err;
342 ret = 1; 392 ret = 1;
343 err: 393err:
344 if (os.data) 394 free(os.data);
345 free(os.data);
346 return ret; 395 return ret;
347 } 396}
348
349 397
350/* Add nonce to an OCSP request */ 398/* Add nonce to an OCSP request */
351 399int
352int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len) 400OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len)
353 { 401{
354 return ocsp_add1_nonce(&req->tbsRequest->requestExtensions, val, len); 402 return ocsp_add1_nonce(&req->tbsRequest->requestExtensions, val, len);
355 } 403}
356 404
357/* Same as above but for a response */ 405/* Same as above but for a response */
358 406int
359int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len) 407OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len)
360 { 408{
361 return ocsp_add1_nonce(&resp->tbsResponseData->responseExtensions, val, len); 409 return ocsp_add1_nonce(&resp->tbsResponseData->responseExtensions, val,
362 } 410 len);
411}
363 412
364/* Check nonce validity in a request and response. 413/* Check nonce validity in a request and response.
365 * Return value reflects result: 414 * Return value reflects result:
@@ -373,9 +422,9 @@ int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len)
373 * If responder doesn't handle nonces return != 0 may be 422 * If responder doesn't handle nonces return != 0 may be
374 * necessary. return == 0 is always an error. 423 * necessary. return == 0 is always an error.
375 */ 424 */
376 425int
377int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs) 426OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs)
378 { 427{
379 /* 428 /*
380 * Since we are only interested in the presence or absence of 429 * Since we are only interested in the presence or absence of
381 * the nonce and comparing its value there is no need to use 430 * the nonce and comparing its value there is no need to use
@@ -383,136 +432,160 @@ int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs)
383 * ASN1_OCTET_STRING structure for the value which would be 432 * ASN1_OCTET_STRING structure for the value which would be
384 * freed immediately anyway. 433 * freed immediately anyway.
385 */ 434 */
386
387 int req_idx, resp_idx; 435 int req_idx, resp_idx;
388 X509_EXTENSION *req_ext, *resp_ext; 436 X509_EXTENSION *req_ext, *resp_ext;
437
389 req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1); 438 req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1);
390 resp_idx = OCSP_BASICRESP_get_ext_by_NID(bs, NID_id_pkix_OCSP_Nonce, -1); 439 resp_idx = OCSP_BASICRESP_get_ext_by_NID(bs, NID_id_pkix_OCSP_Nonce, -1);
391 /* Check both absent */ 440 /* Check both absent */
392 if((req_idx < 0) && (resp_idx < 0)) 441 if (req_idx < 0 && resp_idx < 0)
393 return 2; 442 return 2;
394 /* Check in request only */ 443 /* Check in request only */
395 if((req_idx >= 0) && (resp_idx < 0)) 444 if (req_idx >= 0 && resp_idx < 0)
396 return -1; 445 return -1;
397 /* Check in response but not request */ 446 /* Check in response but not request */
398 if((req_idx < 0) && (resp_idx >= 0)) 447 if (req_idx < 0 && resp_idx >= 0)
399 return 3; 448 return 3;
400 /* Otherwise nonce in request and response so retrieve the extensions */ 449 /* Otherwise nonce in request and response so retrieve the extensions */
401 req_ext = OCSP_REQUEST_get_ext(req, req_idx); 450 req_ext = OCSP_REQUEST_get_ext(req, req_idx);
402 resp_ext = OCSP_BASICRESP_get_ext(bs, resp_idx); 451 resp_ext = OCSP_BASICRESP_get_ext(bs, resp_idx);
403 if(ASN1_OCTET_STRING_cmp(req_ext->value, resp_ext->value)) 452 if (ASN1_OCTET_STRING_cmp(req_ext->value, resp_ext->value))
404 return 0; 453 return 0;
405 return 1; 454 return 1;
406 } 455}
407 456
408/* Copy the nonce value (if any) from an OCSP request to 457/* Copy the nonce value (if any) from an OCSP request to
409 * a response. 458 * a response.
410 */ 459 */
411 460int
412int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req) 461OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req)
413 { 462{
414 X509_EXTENSION *req_ext; 463 X509_EXTENSION *req_ext;
415 int req_idx; 464 int req_idx;
465
416 /* Check for nonce in request */ 466 /* Check for nonce in request */
417 req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1); 467 req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1);
418 /* If no nonce that's OK */ 468 /* If no nonce that's OK */
419 if (req_idx < 0) return 2; 469 if (req_idx < 0)
470 return 2;
420 req_ext = OCSP_REQUEST_get_ext(req, req_idx); 471 req_ext = OCSP_REQUEST_get_ext(req, req_idx);
421 return OCSP_BASICRESP_add_ext(resp, req_ext, -1); 472 return OCSP_BASICRESP_add_ext(resp, req_ext, -1);
422 } 473}
423 474
424X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim) 475X509_EXTENSION *
425 { 476OCSP_crlID_new(char *url, long *n, char *tim)
477{
426 X509_EXTENSION *x = NULL; 478 X509_EXTENSION *x = NULL;
427 OCSP_CRLID *cid = NULL; 479 OCSP_CRLID *cid = NULL;
428 480
429 if (!(cid = OCSP_CRLID_new())) goto err; 481 if (!(cid = OCSP_CRLID_new()))
430 if (url) 482 goto err;
431 { 483 if (url) {
432 if (!(cid->crlUrl = ASN1_IA5STRING_new())) goto err; 484 if (!(cid->crlUrl = ASN1_IA5STRING_new()))
433 if (!(ASN1_STRING_set(cid->crlUrl, url, -1))) goto err; 485 goto err;
434 } 486 if (!(ASN1_STRING_set(cid->crlUrl, url, -1)))
435 if (n) 487 goto err;
436 { 488 }
437 if (!(cid->crlNum = ASN1_INTEGER_new())) goto err; 489 if (n) {
438 if (!(ASN1_INTEGER_set(cid->crlNum, *n))) goto err; 490 if (!(cid->crlNum = ASN1_INTEGER_new()))
439 } 491 goto err;
440 if (tim) 492 if (!(ASN1_INTEGER_set(cid->crlNum, *n)))
441 { 493 goto err;
442 if (!(cid->crlTime = ASN1_GENERALIZEDTIME_new())) goto err; 494 }
495 if (tim) {
496 if (!(cid->crlTime = ASN1_GENERALIZEDTIME_new()))
497 goto err;
443 if (!(ASN1_GENERALIZEDTIME_set_string(cid->crlTime, tim))) 498 if (!(ASN1_GENERALIZEDTIME_set_string(cid->crlTime, tim)))
444 goto err; 499 goto err;
445 } 500 }
446 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_CrlID, 0, cid); 501 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_CrlID, 0, cid);
447err: 502err:
448 if (cid) OCSP_CRLID_free(cid); 503 if (cid)
504 OCSP_CRLID_free(cid);
449 return x; 505 return x;
450 } 506}
451 507
452/* AcceptableResponses ::= SEQUENCE OF OBJECT IDENTIFIER */ 508/* AcceptableResponses ::= SEQUENCE OF OBJECT IDENTIFIER */
453X509_EXTENSION *OCSP_accept_responses_new(char **oids) 509X509_EXTENSION *
454 { 510OCSP_accept_responses_new(char **oids)
511{
455 int nid; 512 int nid;
456 STACK_OF(ASN1_OBJECT) *sk = NULL; 513 STACK_OF(ASN1_OBJECT) *sk = NULL;
457 ASN1_OBJECT *o = NULL; 514 ASN1_OBJECT *o = NULL;
458 X509_EXTENSION *x = NULL; 515 X509_EXTENSION *x = NULL;
459 516
460 if (!(sk = sk_ASN1_OBJECT_new_null())) goto err; 517 if (!(sk = sk_ASN1_OBJECT_new_null()))
461 while (oids && *oids) 518 goto err;
462 { 519 while (oids && *oids) {
463 if ((nid=OBJ_txt2nid(*oids))!=NID_undef&&(o=OBJ_nid2obj(nid))) 520 if ((nid = OBJ_txt2nid(*oids)) != NID_undef &&
464 sk_ASN1_OBJECT_push(sk, o); 521 (o = OBJ_nid2obj(nid)))
522 sk_ASN1_OBJECT_push(sk, o);
465 oids++; 523 oids++;
466 } 524 }
467 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_acceptableResponses, 0, sk); 525 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_acceptableResponses, 0, sk);
468err: 526err:
469 if (sk) sk_ASN1_OBJECT_pop_free(sk, ASN1_OBJECT_free); 527 if (sk)
528 sk_ASN1_OBJECT_pop_free(sk, ASN1_OBJECT_free);
470 return x; 529 return x;
471 } 530}
472 531
473/* ArchiveCutoff ::= GeneralizedTime */ 532/* ArchiveCutoff ::= GeneralizedTime */
474X509_EXTENSION *OCSP_archive_cutoff_new(char* tim) 533X509_EXTENSION *
475 { 534OCSP_archive_cutoff_new(char* tim)
476 X509_EXTENSION *x=NULL; 535{
536 X509_EXTENSION *x = NULL;
477 ASN1_GENERALIZEDTIME *gt = NULL; 537 ASN1_GENERALIZEDTIME *gt = NULL;
478 538
479 if (!(gt = ASN1_GENERALIZEDTIME_new())) goto err; 539 if (!(gt = ASN1_GENERALIZEDTIME_new()))
480 if (!(ASN1_GENERALIZEDTIME_set_string(gt, tim))) goto err; 540 goto err;
541 if (!(ASN1_GENERALIZEDTIME_set_string(gt, tim)))
542 goto err;
481 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_archiveCutoff, 0, gt); 543 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_archiveCutoff, 0, gt);
482err: 544err:
483 if (gt) ASN1_GENERALIZEDTIME_free(gt); 545 if (gt)
546 ASN1_GENERALIZEDTIME_free(gt);
484 return x; 547 return x;
485 } 548}
486 549
487/* per ACCESS_DESCRIPTION parameter are oids, of which there are currently 550/* per ACCESS_DESCRIPTION parameter are oids, of which there are currently
488 * two--NID_ad_ocsp, NID_id_ad_caIssuers--and GeneralName value. This 551 * two--NID_ad_ocsp, NID_id_ad_caIssuers--and GeneralName value. This
489 * method forces NID_ad_ocsp and uniformResourceLocator [6] IA5String. 552 * method forces NID_ad_ocsp and uniformResourceLocator [6] IA5String.
490 */ 553 */
491X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, char **urls) 554X509_EXTENSION *
492 { 555OCSP_url_svcloc_new(X509_NAME* issuer, char **urls)
556{
493 X509_EXTENSION *x = NULL; 557 X509_EXTENSION *x = NULL;
494 ASN1_IA5STRING *ia5 = NULL; 558 ASN1_IA5STRING *ia5 = NULL;
495 OCSP_SERVICELOC *sloc = NULL; 559 OCSP_SERVICELOC *sloc = NULL;
496 ACCESS_DESCRIPTION *ad = NULL; 560 ACCESS_DESCRIPTION *ad = NULL;
497 561
498 if (!(sloc = OCSP_SERVICELOC_new())) goto err; 562 if (!(sloc = OCSP_SERVICELOC_new()))
499 if (!(sloc->issuer = X509_NAME_dup(issuer))) goto err; 563 goto err;
500 if (urls && *urls && !(sloc->locator = sk_ACCESS_DESCRIPTION_new_null())) goto err; 564 if (!(sloc->issuer = X509_NAME_dup(issuer)))
501 while (urls && *urls) 565 goto err;
502 { 566 if (urls && *urls &&
503 if (!(ad = ACCESS_DESCRIPTION_new())) goto err; 567 !(sloc->locator = sk_ACCESS_DESCRIPTION_new_null()))
504 if (!(ad->method=OBJ_nid2obj(NID_ad_OCSP))) goto err; 568 goto err;
505 if (!(ad->location = GENERAL_NAME_new())) goto err; 569 while (urls && *urls) {
506 if (!(ia5 = ASN1_IA5STRING_new())) goto err; 570 if (!(ad = ACCESS_DESCRIPTION_new()))
507 if (!ASN1_STRING_set((ASN1_STRING*)ia5, *urls, -1)) goto err; 571 goto err;
572 if (!(ad->method = OBJ_nid2obj(NID_ad_OCSP)))
573 goto err;
574 if (!(ad->location = GENERAL_NAME_new()))
575 goto err;
576 if (!(ia5 = ASN1_IA5STRING_new()))
577 goto err;
578 if (!ASN1_STRING_set((ASN1_STRING*)ia5, *urls, -1))
579 goto err;
508 ad->location->type = GEN_URI; 580 ad->location->type = GEN_URI;
509 ad->location->d.ia5 = ia5; 581 ad->location->d.ia5 = ia5;
510 if (!sk_ACCESS_DESCRIPTION_push(sloc->locator, ad)) goto err; 582 if (!sk_ACCESS_DESCRIPTION_push(sloc->locator, ad))
583 goto err;
511 urls++; 584 urls++;
512 } 585 }
513 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_serviceLocator, 0, sloc); 586 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_serviceLocator, 0, sloc);
514err: 587err:
515 if (sloc) OCSP_SERVICELOC_free(sloc); 588 if (sloc)
589 OCSP_SERVICELOC_free(sloc);
516 return x; 590 return x;
517 } 591}
518
diff --git a/src/lib/libcrypto/ocsp/ocsp_ht.c b/src/lib/libcrypto/ocsp/ocsp_ht.c
index b45eaf6767..fe4a7a1a72 100644
--- a/src/lib/libcrypto/ocsp/ocsp_ht.c
+++ b/src/lib/libcrypto/ocsp/ocsp_ht.c
@@ -79,7 +79,7 @@ struct ocsp_req_ctx_st {
79 BIO *io; /* BIO to perform I/O with */ 79 BIO *io; /* BIO to perform I/O with */
80 BIO *mem; /* Memory BIO response is built into */ 80 BIO *mem; /* Memory BIO response is built into */
81 unsigned long asn1_len; /* ASN1 length of response */ 81 unsigned long asn1_len; /* ASN1 length of response */
82 }; 82};
83 83
84#define OCSP_MAX_REQUEST_LENGTH (100 * 1024) 84#define OCSP_MAX_REQUEST_LENGTH (100 * 1024)
85#define OCSP_MAX_LINE_LEN 4096; 85#define OCSP_MAX_LINE_LEN 4096;
@@ -108,54 +108,57 @@ struct ocsp_req_ctx_st {
108 108
109static int parse_http_line1(char *line); 109static int parse_http_line1(char *line);
110 110
111void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx) 111void
112 { 112OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx)
113{
113 if (rctx->mem) 114 if (rctx->mem)
114 BIO_free(rctx->mem); 115 BIO_free(rctx->mem);
115 if (rctx->iobuf) 116 if (rctx->iobuf)
116 free(rctx->iobuf); 117 free(rctx->iobuf);
117 free(rctx); 118 free(rctx);
118 } 119}
119 120
120int OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, OCSP_REQUEST *req) 121int
121 { 122OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, OCSP_REQUEST *req)
123{
122 static const char req_hdr[] = 124 static const char req_hdr[] =
123 "Content-Type: application/ocsp-request\r\n" 125 "Content-Type: application/ocsp-request\r\n"
124 "Content-Length: %d\r\n\r\n"; 126 "Content-Length: %d\r\n\r\n";
125 if (BIO_printf(rctx->mem, req_hdr, i2d_OCSP_REQUEST(req, NULL)) <= 0) 127
128 if (BIO_printf(rctx->mem, req_hdr, i2d_OCSP_REQUEST(req, NULL)) <= 0)
126 return 0; 129 return 0;
127 if (i2d_OCSP_REQUEST_bio(rctx->mem, req) <= 0) 130 if (i2d_OCSP_REQUEST_bio(rctx->mem, req) <= 0)
128 return 0; 131 return 0;
129 rctx->state = OHS_ASN1_WRITE; 132 rctx->state = OHS_ASN1_WRITE;
130 rctx->asn1_len = BIO_get_mem_data(rctx->mem, NULL); 133 rctx->asn1_len = BIO_get_mem_data(rctx->mem, NULL);
131 return 1; 134 return 1;
132 } 135}
133 136
134int OCSP_REQ_CTX_add1_header(OCSP_REQ_CTX *rctx, 137int
135 const char *name, const char *value) 138OCSP_REQ_CTX_add1_header(OCSP_REQ_CTX *rctx, const char *name,
136 { 139 const char *value)
140{
137 if (!name) 141 if (!name)
138 return 0; 142 return 0;
139 if (BIO_puts(rctx->mem, name) <= 0) 143 if (BIO_puts(rctx->mem, name) <= 0)
140 return 0; 144 return 0;
141 if (value) 145 if (value) {
142 {
143 if (BIO_write(rctx->mem, ": ", 2) != 2) 146 if (BIO_write(rctx->mem, ": ", 2) != 2)
144 return 0; 147 return 0;
145 if (BIO_puts(rctx->mem, value) <= 0) 148 if (BIO_puts(rctx->mem, value) <= 0)
146 return 0; 149 return 0;
147 } 150 }
148 if (BIO_write(rctx->mem, "\r\n", 2) != 2) 151 if (BIO_write(rctx->mem, "\r\n", 2) != 2)
149 return 0; 152 return 0;
150 return 1; 153 return 1;
151 } 154}
152 155
153OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req, 156OCSP_REQ_CTX *
154 int maxline) 157OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req, int maxline)
155 { 158{
156 static const char post_hdr[] = "POST %s HTTP/1.0\r\n"; 159 static const char post_hdr[] = "POST %s HTTP/1.0\r\n";
157
158 OCSP_REQ_CTX *rctx; 160 OCSP_REQ_CTX *rctx;
161
159 rctx = malloc(sizeof(OCSP_REQ_CTX)); 162 rctx = malloc(sizeof(OCSP_REQ_CTX));
160 rctx->state = OHS_ERROR; 163 rctx->state = OHS_ERROR;
161 rctx->mem = BIO_new(BIO_s_mem()); 164 rctx->mem = BIO_new(BIO_s_mem());
@@ -174,7 +177,7 @@ OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req,
174 if (!path) 177 if (!path)
175 path = "/"; 178 path = "/";
176 179
177 if (BIO_printf(rctx->mem, post_hdr, path) <= 0) { 180 if (BIO_printf(rctx->mem, post_hdr, path) <= 0) {
178 free(rctx->iobuf); 181 free(rctx->iobuf);
179 BIO_free(rctx->mem); 182 BIO_free(rctx->mem);
180 free(rctx); 183 free(rctx);
@@ -189,49 +192,44 @@ OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req,
189 } 192 }
190 193
191 return rctx; 194 return rctx;
192 } 195}
193 196
194/* Parse the HTTP response. This will look like this: 197/* Parse the HTTP response. This will look like this:
195 * "HTTP/1.0 200 OK". We need to obtain the numeric code and 198 * "HTTP/1.0 200 OK". We need to obtain the numeric code and
196 * (optional) informational message. 199 * (optional) informational message.
197 */ 200 */
198 201static int
199static int parse_http_line1(char *line) 202parse_http_line1(char *line)
200 { 203{
201 int retcode; 204 int retcode;
202 char *p, *q, *r; 205 char *p, *q, *r;
203 /* Skip to first white space (passed protocol info) */
204 206
205 for(p = line; *p && !isspace((unsigned char)*p); p++) 207 /* Skip to first white space (passed protocol info) */
208 for (p = line; *p && !isspace((unsigned char)*p); p++)
206 continue; 209 continue;
207 if(!*p) 210 if (!*p) {
208 {
209 OCSPerr(OCSP_F_PARSE_HTTP_LINE1, 211 OCSPerr(OCSP_F_PARSE_HTTP_LINE1,
210 OCSP_R_SERVER_RESPONSE_PARSE_ERROR); 212 OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
211 return 0; 213 return 0;
212 } 214 }
213 215
214 /* Skip past white space to start of response code */ 216 /* Skip past white space to start of response code */
215 while(*p && isspace((unsigned char)*p)) 217 while (*p && isspace((unsigned char)*p))
216 p++; 218 p++;
217 219 if (!*p) {
218 if(!*p)
219 {
220 OCSPerr(OCSP_F_PARSE_HTTP_LINE1, 220 OCSPerr(OCSP_F_PARSE_HTTP_LINE1,
221 OCSP_R_SERVER_RESPONSE_PARSE_ERROR); 221 OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
222 return 0; 222 return 0;
223 } 223 }
224 224
225 /* Find end of response code: first whitespace after start of code */ 225 /* Find end of response code: first whitespace after start of code */
226 for(q = p; *q && !isspace((unsigned char)*q); q++) 226 for (q = p; *q && !isspace((unsigned char)*q); q++)
227 continue; 227 continue;
228 228 if (!*q) {
229 if(!*q)
230 {
231 OCSPerr(OCSP_F_PARSE_HTTP_LINE1, 229 OCSPerr(OCSP_F_PARSE_HTTP_LINE1,
232 OCSP_R_SERVER_RESPONSE_PARSE_ERROR); 230 OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
233 return 0; 231 return 0;
234 } 232 }
235 233
236 /* Set end of response code and start of message */ 234 /* Set end of response code and start of message */
237 *q++ = 0; 235 *q++ = 0;
@@ -239,94 +237,80 @@ static int parse_http_line1(char *line)
239 /* Attempt to parse numeric code */ 237 /* Attempt to parse numeric code */
240 retcode = strtoul(p, &r, 10); 238 retcode = strtoul(p, &r, 10);
241 239
242 if(*r) 240 if (*r)
243 return 0; 241 return 0;
244 242
245 /* Skip over any leading white space in message */ 243 /* Skip over any leading white space in message */
246 while(*q && isspace((unsigned char)*q)) 244 while (*q && isspace((unsigned char)*q))
247 q++; 245 q++;
248 246 if (*q) {
249 if(*q)
250 {
251 /* Finally zap any trailing white space in message (include 247 /* Finally zap any trailing white space in message (include
252 * CRLF) */ 248 * CRLF) */
253 249
254 /* We know q has a non white space character so this is OK */ 250 /* We know q has a non white space character so this is OK */
255 for(r = q + strlen(q) - 1; isspace((unsigned char)*r); r--) 251 for (r = q + strlen(q) - 1; isspace((unsigned char)*r); r--)
256 *r = 0; 252 *r = 0;
257 } 253 }
258 if(retcode != 200) 254 if (retcode != 200) {
259 {
260 OCSPerr(OCSP_F_PARSE_HTTP_LINE1, OCSP_R_SERVER_RESPONSE_ERROR); 255 OCSPerr(OCSP_F_PARSE_HTTP_LINE1, OCSP_R_SERVER_RESPONSE_ERROR);
261 if(!*q) 256 if (!*q)
262 ERR_asprintf_error_data("Code=%s", p); 257 ERR_asprintf_error_data("Code=%s", p);
263 else 258 else
264 ERR_asprintf_error_data("Code=%s,Reason=%s", p, q); 259 ERR_asprintf_error_data("Code=%s,Reason=%s", p, q);
265 return 0; 260 return 0;
266 } 261 }
267
268 262
269 return 1; 263 return 1;
264}
270 265
271 } 266int
272 267OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx)
273int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx) 268{
274 {
275 int i, n; 269 int i, n;
276 const unsigned char *p; 270 const unsigned char *p;
277 next_io: 271
278 if (!(rctx->state & OHS_NOREAD)) 272next_io:
279 { 273 if (!(rctx->state & OHS_NOREAD)) {
280 n = BIO_read(rctx->io, rctx->iobuf, rctx->iobuflen); 274 n = BIO_read(rctx->io, rctx->iobuf, rctx->iobuflen);
281 275
282 if (n <= 0) 276 if (n <= 0) {
283 {
284 if (BIO_should_retry(rctx->io)) 277 if (BIO_should_retry(rctx->io))
285 return -1; 278 return -1;
286 return 0; 279 return 0;
287 } 280 }
288 281
289 /* Write data to memory BIO */ 282 /* Write data to memory BIO */
290
291 if (BIO_write(rctx->mem, rctx->iobuf, n) != n) 283 if (BIO_write(rctx->mem, rctx->iobuf, n) != n)
292 return 0; 284 return 0;
293 } 285 }
294
295 switch(rctx->state)
296 {
297 286
298 case OHS_ASN1_WRITE: 287 switch (rctx->state) {
288 case OHS_ASN1_WRITE:
299 n = BIO_get_mem_data(rctx->mem, &p); 289 n = BIO_get_mem_data(rctx->mem, &p);
300
301 i = BIO_write(rctx->io, 290 i = BIO_write(rctx->io,
302 p + (n - rctx->asn1_len), rctx->asn1_len); 291 p + (n - rctx->asn1_len), rctx->asn1_len);
303 292 if (i <= 0) {
304 if (i <= 0)
305 {
306 if (BIO_should_retry(rctx->io)) 293 if (BIO_should_retry(rctx->io))
307 return -1; 294 return -1;
308 rctx->state = OHS_ERROR; 295 rctx->state = OHS_ERROR;
309 return 0; 296 return 0;
310 } 297 }
311 298
312 rctx->asn1_len -= i; 299 rctx->asn1_len -= i;
313
314 if (rctx->asn1_len > 0) 300 if (rctx->asn1_len > 0)
315 goto next_io; 301 goto next_io;
316 302
317 rctx->state = OHS_ASN1_FLUSH; 303 rctx->state = OHS_ASN1_FLUSH;
318 304
319 (void)BIO_reset(rctx->mem); 305 (void)BIO_reset(rctx->mem);
306 /* FALLTHROUGH */
320 307
321 case OHS_ASN1_FLUSH: 308 case OHS_ASN1_FLUSH:
322
323 i = BIO_flush(rctx->io); 309 i = BIO_flush(rctx->io);
324 310 if (i > 0) {
325 if (i > 0)
326 {
327 rctx->state = OHS_FIRSTLINE; 311 rctx->state = OHS_FIRSTLINE;
328 goto next_io; 312 goto next_io;
329 } 313 }
330 314
331 if (BIO_should_retry(rctx->io)) 315 if (BIO_should_retry(rctx->io))
332 return -1; 316 return -1;
@@ -334,79 +318,62 @@ int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx)
334 rctx->state = OHS_ERROR; 318 rctx->state = OHS_ERROR;
335 return 0; 319 return 0;
336 320
337 case OHS_ERROR: 321 case OHS_ERROR:
338 return 0; 322 return 0;
339 323
340 case OHS_FIRSTLINE: 324 case OHS_FIRSTLINE:
341 case OHS_HEADERS: 325 case OHS_HEADERS:
342
343 /* Attempt to read a line in */ 326 /* Attempt to read a line in */
344 327next_line:
345 next_line:
346 /* Due to &%^*$" memory BIO behaviour with BIO_gets we 328 /* Due to &%^*$" memory BIO behaviour with BIO_gets we
347 * have to check there's a complete line in there before 329 * have to check there's a complete line in there before
348 * calling BIO_gets or we'll just get a partial read. 330 * calling BIO_gets or we'll just get a partial read.
349 */ 331 */
350 n = BIO_get_mem_data(rctx->mem, &p); 332 n = BIO_get_mem_data(rctx->mem, &p);
351 if ((n <= 0) || !memchr(p, '\n', n)) 333 if ((n <= 0) || !memchr(p, '\n', n)) {
352 { 334 if (n >= rctx->iobuflen) {
353 if (n >= rctx->iobuflen)
354 {
355 rctx->state = OHS_ERROR; 335 rctx->state = OHS_ERROR;
356 return 0; 336 return 0;
357 }
358 goto next_io;
359 } 337 }
338 goto next_io;
339 }
360 n = BIO_gets(rctx->mem, (char *)rctx->iobuf, rctx->iobuflen); 340 n = BIO_gets(rctx->mem, (char *)rctx->iobuf, rctx->iobuflen);
361 341 if (n <= 0) {
362 if (n <= 0)
363 {
364 if (BIO_should_retry(rctx->mem)) 342 if (BIO_should_retry(rctx->mem))
365 goto next_io; 343 goto next_io;
366 rctx->state = OHS_ERROR; 344 rctx->state = OHS_ERROR;
367 return 0; 345 return 0;
368 } 346 }
369 347
370 /* Don't allow excessive lines */ 348 /* Don't allow excessive lines */
371 if (n == rctx->iobuflen) 349 if (n == rctx->iobuflen) {
372 {
373 rctx->state = OHS_ERROR; 350 rctx->state = OHS_ERROR;
374 return 0; 351 return 0;
375 } 352 }
376 353
377 /* First line */ 354 /* First line */
378 if (rctx->state == OHS_FIRSTLINE) 355 if (rctx->state == OHS_FIRSTLINE) {
379 { 356 if (parse_http_line1((char *)rctx->iobuf)) {
380 if (parse_http_line1((char *)rctx->iobuf))
381 {
382 rctx->state = OHS_HEADERS; 357 rctx->state = OHS_HEADERS;
383 goto next_line; 358 goto next_line;
384 } 359 } else {
385 else
386 {
387 rctx->state = OHS_ERROR; 360 rctx->state = OHS_ERROR;
388 return 0; 361 return 0;
389 }
390 } 362 }
391 else 363 } else {
392 {
393 /* Look for blank line: end of headers */ 364 /* Look for blank line: end of headers */
394 for (p = rctx->iobuf; *p; p++) 365 for (p = rctx->iobuf; *p; p++) {
395 {
396 if ((*p != '\r') && (*p != '\n')) 366 if ((*p != '\r') && (*p != '\n'))
397 break; 367 break;
398 } 368 }
399 if (*p) 369 if (*p)
400 goto next_line; 370 goto next_line;
401 371
402 rctx->state = OHS_ASN1_HEADER; 372 rctx->state = OHS_ASN1_HEADER;
373 }
374 /* FALLTRHOUGH */
403 375
404 } 376 case OHS_ASN1_HEADER:
405
406 /* Fall thru */
407
408
409 case OHS_ASN1_HEADER:
410 /* Now reading ASN1 header: can read at least 2 bytes which 377 /* Now reading ASN1 header: can read at least 2 bytes which
411 * is enough for ASN1 SEQUENCE header and either length field 378 * is enough for ASN1 SEQUENCE header and either length field
412 * or at least the length of the length field. 379 * or at least the length of the length field.
@@ -416,15 +383,13 @@ int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx)
416 goto next_io; 383 goto next_io;
417 384
418 /* Check it is an ASN1 SEQUENCE */ 385 /* Check it is an ASN1 SEQUENCE */
419 if (*p++ != (V_ASN1_SEQUENCE|V_ASN1_CONSTRUCTED)) 386 if (*p++ != (V_ASN1_SEQUENCE|V_ASN1_CONSTRUCTED)) {
420 {
421 rctx->state = OHS_ERROR; 387 rctx->state = OHS_ERROR;
422 return 0; 388 return 0;
423 } 389 }
424 390
425 /* Check out length field */ 391 /* Check out length field */
426 if (*p & 0x80) 392 if (*p & 0x80) {
427 {
428 /* If MSB set on initial length octet we can now 393 /* If MSB set on initial length octet we can now
429 * always read 6 octets: make sure we have them. 394 * always read 6 octets: make sure we have them.
430 */ 395 */
@@ -432,78 +397,64 @@ int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx)
432 goto next_io; 397 goto next_io;
433 n = *p & 0x7F; 398 n = *p & 0x7F;
434 /* Not NDEF or excessive length */ 399 /* Not NDEF or excessive length */
435 if (!n || (n > 4)) 400 if (!n || (n > 4)) {
436 {
437 rctx->state = OHS_ERROR; 401 rctx->state = OHS_ERROR;
438 return 0; 402 return 0;
439 } 403 }
440 p++; 404 p++;
441 rctx->asn1_len = 0; 405 rctx->asn1_len = 0;
442 for (i = 0; i < n; i++) 406 for (i = 0; i < n; i++) {
443 {
444 rctx->asn1_len <<= 8; 407 rctx->asn1_len <<= 8;
445 rctx->asn1_len |= *p++; 408 rctx->asn1_len |= *p++;
446 } 409 }
447 410
448 if (rctx->asn1_len > OCSP_MAX_REQUEST_LENGTH) 411 if (rctx->asn1_len > OCSP_MAX_REQUEST_LENGTH) {
449 {
450 rctx->state = OHS_ERROR; 412 rctx->state = OHS_ERROR;
451 return 0; 413 return 0;
452 } 414 }
453 415
454 rctx->asn1_len += n + 2; 416 rctx->asn1_len += n + 2;
455 } 417 } else
456 else
457 rctx->asn1_len = *p + 2; 418 rctx->asn1_len = *p + 2;
458 419
459 rctx->state = OHS_ASN1_CONTENT; 420 rctx->state = OHS_ASN1_CONTENT;
460 421
461 /* Fall thru */ 422 /* FALLTHROUGH */
462 423
463 case OHS_ASN1_CONTENT: 424 case OHS_ASN1_CONTENT:
464 n = BIO_get_mem_data(rctx->mem, &p); 425 n = BIO_get_mem_data(rctx->mem, &p);
465 if (n < (int)rctx->asn1_len) 426 if (n < (int)rctx->asn1_len)
466 goto next_io; 427 goto next_io;
467 428
468
469 *presp = d2i_OCSP_RESPONSE(NULL, &p, rctx->asn1_len); 429 *presp = d2i_OCSP_RESPONSE(NULL, &p, rctx->asn1_len);
470 if (*presp) 430 if (*presp) {
471 {
472 rctx->state = OHS_DONE; 431 rctx->state = OHS_DONE;
473 return 1; 432 return 1;
474 } 433 }
475 434
476 rctx->state = OHS_ERROR; 435 rctx->state = OHS_ERROR;
477 return 0; 436 return 0;
478 437
479 break; 438 case OHS_DONE:
480
481 case OHS_DONE:
482 return 1; 439 return 1;
483 440 }
484 }
485
486
487 441
488 return 0; 442 return 0;
489 443}
490
491 }
492 444
493/* Blocking OCSP request handler: now a special case of non-blocking I/O */ 445/* Blocking OCSP request handler: now a special case of non-blocking I/O */
494 446OCSP_RESPONSE *
495OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req) 447OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req)
496 { 448{
497 OCSP_RESPONSE *resp = NULL; 449 OCSP_RESPONSE *resp = NULL;
498 OCSP_REQ_CTX *ctx; 450 OCSP_REQ_CTX *ctx;
499 int rv; 451 int rv;
500 452
501 ctx = OCSP_sendreq_new(b, path, req, -1); 453 ctx = OCSP_sendreq_new(b, path, req, -1);
502 454
503 do 455 do {
504 {
505 rv = OCSP_sendreq_nbio(&resp, ctx); 456 rv = OCSP_sendreq_nbio(&resp, ctx);
506 } while ((rv == -1) && BIO_should_retry(b)); 457 } while ((rv == -1) && BIO_should_retry(b));
507 458
508 OCSP_REQ_CTX_free(ctx); 459 OCSP_REQ_CTX_free(ctx);
509 460
@@ -511,4 +462,4 @@ OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req)
511 return resp; 462 return resp;
512 463
513 return NULL; 464 return NULL;
514 } 465}
diff --git a/src/lib/libcrypto/ocsp/ocsp_lib.c b/src/lib/libcrypto/ocsp/ocsp_lib.c
index 514cdabf2d..056bd27665 100644
--- a/src/lib/libcrypto/ocsp/ocsp_lib.c
+++ b/src/lib/libcrypto/ocsp/ocsp_lib.c
@@ -73,102 +73,112 @@
73 73
74/* Convert a certificate and its issuer to an OCSP_CERTID */ 74/* Convert a certificate and its issuer to an OCSP_CERTID */
75 75
76OCSP_CERTID *OCSP_cert_to_id(const EVP_MD *dgst, X509 *subject, X509 *issuer) 76OCSP_CERTID *
77OCSP_cert_to_id(const EVP_MD *dgst, X509 *subject, X509 *issuer)
77{ 78{
78 X509_NAME *iname; 79 X509_NAME *iname;
79 ASN1_INTEGER *serial; 80 ASN1_INTEGER *serial;
80 ASN1_BIT_STRING *ikey; 81 ASN1_BIT_STRING *ikey;
82
81#ifndef OPENSSL_NO_SHA1 83#ifndef OPENSSL_NO_SHA1
82 if(!dgst) dgst = EVP_sha1(); 84 if (!dgst)
85 dgst = EVP_sha1();
83#endif 86#endif
84 if (subject) 87 if (subject) {
85 {
86 iname = X509_get_issuer_name(subject); 88 iname = X509_get_issuer_name(subject);
87 serial = X509_get_serialNumber(subject); 89 serial = X509_get_serialNumber(subject);
88 } 90 } else {
89 else
90 {
91 iname = X509_get_subject_name(issuer); 91 iname = X509_get_subject_name(issuer);
92 serial = NULL; 92 serial = NULL;
93 } 93 }
94 ikey = X509_get0_pubkey_bitstr(issuer); 94 ikey = X509_get0_pubkey_bitstr(issuer);
95 return OCSP_cert_id_new(dgst, iname, ikey, serial); 95 return OCSP_cert_id_new(dgst, iname, ikey, serial);
96} 96}
97 97
98 98OCSP_CERTID *
99OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst, 99OCSP_cert_id_new(const EVP_MD *dgst, X509_NAME *issuerName,
100 X509_NAME *issuerName, 100 ASN1_BIT_STRING* issuerKey, ASN1_INTEGER *serialNumber)
101 ASN1_BIT_STRING* issuerKey, 101{
102 ASN1_INTEGER *serialNumber)
103 {
104 int nid; 102 int nid;
105 unsigned int i; 103 unsigned int i;
106 X509_ALGOR *alg; 104 X509_ALGOR *alg;
107 OCSP_CERTID *cid = NULL; 105 OCSP_CERTID *cid = NULL;
108 unsigned char md[EVP_MAX_MD_SIZE]; 106 unsigned char md[EVP_MAX_MD_SIZE];
109 107
110 if (!(cid = OCSP_CERTID_new())) goto err; 108 if (!(cid = OCSP_CERTID_new()))
109 goto err;
111 110
112 alg = cid->hashAlgorithm; 111 alg = cid->hashAlgorithm;
113 if (alg->algorithm != NULL) ASN1_OBJECT_free(alg->algorithm); 112 if (alg->algorithm != NULL)
114 if ((nid = EVP_MD_type(dgst)) == NID_undef) 113 ASN1_OBJECT_free(alg->algorithm);
115 { 114 if ((nid = EVP_MD_type(dgst)) == NID_undef) {
116 OCSPerr(OCSP_F_OCSP_CERT_ID_NEW,OCSP_R_UNKNOWN_NID); 115 OCSPerr(OCSP_F_OCSP_CERT_ID_NEW, OCSP_R_UNKNOWN_NID);
116 goto err;
117 }
118 if (!(alg->algorithm=OBJ_nid2obj(nid)))
119 goto err;
120 if ((alg->parameter=ASN1_TYPE_new()) == NULL)
117 goto err; 121 goto err;
118 }
119 if (!(alg->algorithm=OBJ_nid2obj(nid))) goto err;
120 if ((alg->parameter=ASN1_TYPE_new()) == NULL) goto err;
121 alg->parameter->type=V_ASN1_NULL; 122 alg->parameter->type=V_ASN1_NULL;
122 123
123 if (!X509_NAME_digest(issuerName, dgst, md, &i)) goto digerr; 124 if (!X509_NAME_digest(issuerName, dgst, md, &i))
124 if (!(ASN1_OCTET_STRING_set(cid->issuerNameHash, md, i))) goto err; 125 goto digerr;
126 if (!(ASN1_OCTET_STRING_set(cid->issuerNameHash, md, i)))
127 goto err;
125 128
126 /* Calculate the issuerKey hash, excluding tag and length */ 129 /* Calculate the issuerKey hash, excluding tag and length */
127 if (!EVP_Digest(issuerKey->data, issuerKey->length, md, &i, dgst, NULL)) 130 if (!EVP_Digest(issuerKey->data, issuerKey->length, md, &i, dgst, NULL))
128 goto err; 131 goto err;
129 132
130 if (!(ASN1_OCTET_STRING_set(cid->issuerKeyHash, md, i))) goto err; 133 if (!(ASN1_OCTET_STRING_set(cid->issuerKeyHash, md, i)))
134 goto err;
131 135
132 if (serialNumber) 136 if (serialNumber) {
133 {
134 ASN1_INTEGER_free(cid->serialNumber); 137 ASN1_INTEGER_free(cid->serialNumber);
135 if (!(cid->serialNumber = ASN1_INTEGER_dup(serialNumber))) goto err; 138 if (!(cid->serialNumber = ASN1_INTEGER_dup(serialNumber)))
136 } 139 goto err;
140 }
137 return cid; 141 return cid;
138digerr: 142digerr:
139 OCSPerr(OCSP_F_OCSP_CERT_ID_NEW,OCSP_R_DIGEST_ERR); 143 OCSPerr(OCSP_F_OCSP_CERT_ID_NEW, OCSP_R_DIGEST_ERR);
140err: 144err:
141 if (cid) OCSP_CERTID_free(cid); 145 if (cid)
146 OCSP_CERTID_free(cid);
142 return NULL; 147 return NULL;
143 } 148}
144 149
145int OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b) 150int
146 { 151OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b)
152{
147 int ret; 153 int ret;
154
148 ret = OBJ_cmp(a->hashAlgorithm->algorithm, b->hashAlgorithm->algorithm); 155 ret = OBJ_cmp(a->hashAlgorithm->algorithm, b->hashAlgorithm->algorithm);
149 if (ret) return ret; 156 if (ret)
157 return ret;
150 ret = ASN1_OCTET_STRING_cmp(a->issuerNameHash, b->issuerNameHash); 158 ret = ASN1_OCTET_STRING_cmp(a->issuerNameHash, b->issuerNameHash);
151 if (ret) return ret; 159 if (ret)
160 return ret;
152 return ASN1_OCTET_STRING_cmp(a->issuerKeyHash, b->issuerKeyHash); 161 return ASN1_OCTET_STRING_cmp(a->issuerKeyHash, b->issuerKeyHash);
153 } 162}
154 163
155int OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b) 164int
156 { 165OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b)
166{
157 int ret; 167 int ret;
168
158 ret = OCSP_id_issuer_cmp(a, b); 169 ret = OCSP_id_issuer_cmp(a, b);
159 if (ret) return ret; 170 if (ret)
171 return ret;
160 return ASN1_INTEGER_cmp(a->serialNumber, b->serialNumber); 172 return ASN1_INTEGER_cmp(a->serialNumber, b->serialNumber);
161 } 173}
162
163 174
164/* Parse a URL and split it up into host, port and path components and whether 175/* Parse a URL and split it up into host, port and path components and whether
165 * it is SSL. 176 * it is SSL.
166 */ 177 */
167 178int
168int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pssl) 179OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pssl)
169 { 180{
170 char *p, *buf; 181 char *p, *buf;
171
172 char *host, *port; 182 char *host, *port;
173 183
174 *phost = NULL; 184 *phost = NULL;
@@ -177,26 +187,23 @@ int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pss
177 187
178 /* dup the buffer since we are going to mess with it */ 188 /* dup the buffer since we are going to mess with it */
179 buf = BUF_strdup(url); 189 buf = BUF_strdup(url);
180 if (!buf) goto mem_err; 190 if (!buf)
191 goto mem_err;
181 192
182 /* Check for initial colon */ 193 /* Check for initial colon */
183 p = strchr(buf, ':'); 194 p = strchr(buf, ':');
184 195 if (!p)
185 if (!p) goto parse_err; 196 goto parse_err;
186 197
187 *(p++) = '\0'; 198 *(p++) = '\0';
188 199
189 if (!strcmp(buf, "http")) 200 if (!strcmp(buf, "http")) {
190 {
191 *pssl = 0; 201 *pssl = 0;
192 port = "80"; 202 port = "80";
193 } 203 } else if (!strcmp(buf, "https")) {
194 else if (!strcmp(buf, "https"))
195 {
196 *pssl = 1; 204 *pssl = 1;
197 port = "443"; 205 port = "443";
198 } 206 } else
199 else
200 goto parse_err; 207 goto parse_err;
201 208
202 /* Check for double slash */ 209 /* Check for double slash */
@@ -208,59 +215,56 @@ int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pss
208 host = p; 215 host = p;
209 216
210 /* Check for trailing part of path */ 217 /* Check for trailing part of path */
211
212 p = strchr(p, '/'); 218 p = strchr(p, '/');
213
214 if (!p) 219 if (!p)
215 *ppath = BUF_strdup("/"); 220 *ppath = BUF_strdup("/");
216 else 221 else {
217 {
218 *ppath = BUF_strdup(p); 222 *ppath = BUF_strdup(p);
219 /* Set start of path to 0 so hostname is valid */ 223 /* Set start of path to 0 so hostname is valid */
220 *p = '\0'; 224 *p = '\0';
221 } 225 }
222 226
223 if (!*ppath) goto mem_err; 227 if (!*ppath)
228 goto mem_err;
224 229
225 /* Look for optional ':' for port number */ 230 /* Look for optional ':' for port number */
226 if ((p = strchr(host, ':'))) 231 if ((p = strchr(host, ':'))) {
227 {
228 *p = 0; 232 *p = 0;
229 port = p + 1; 233 port = p + 1;
230 } 234 } else {
231 else
232 {
233 /* Not found: set default port */ 235 /* Not found: set default port */
234 if (*pssl) port = "443"; 236 if (*pssl)
235 else port = "80"; 237 port = "443";
236 } 238 else
239 port = "80";
240 }
237 241
238 *pport = BUF_strdup(port); 242 *pport = BUF_strdup(port);
239 if (!*pport) goto mem_err; 243 if (!*pport)
244 goto mem_err;
240 245
241 *phost = BUF_strdup(host); 246 *phost = BUF_strdup(host);
242 247
243 if (!*phost) goto mem_err; 248 if (!*phost)
249 goto mem_err;
244 250
245 free(buf); 251 free(buf);
246 252
247 return 1; 253 return 1;
248 254
249 mem_err: 255mem_err:
250 OCSPerr(OCSP_F_OCSP_PARSE_URL, ERR_R_MALLOC_FAILURE); 256 OCSPerr(OCSP_F_OCSP_PARSE_URL, ERR_R_MALLOC_FAILURE);
251 goto err; 257 goto err;
252 258
253 parse_err: 259parse_err:
254 OCSPerr(OCSP_F_OCSP_PARSE_URL, OCSP_R_ERROR_PARSING_URL); 260 OCSPerr(OCSP_F_OCSP_PARSE_URL, OCSP_R_ERROR_PARSING_URL);
255 261
256 262err:
257 err: 263 free(buf);
258 if (buf) free(buf); 264 free(*ppath);
259 if (*ppath) free(*ppath); 265 free(*pport);
260 if (*pport) free(*pport); 266 free(*phost);
261 if (*phost) free(*phost);
262 return 0; 267 return 0;
263 268}
264 }
265 269
266IMPLEMENT_ASN1_DUP_FUNCTION(OCSP_CERTID) 270IMPLEMENT_ASN1_DUP_FUNCTION(OCSP_CERTID)
diff --git a/src/lib/libcrypto/ocsp/ocsp_prn.c b/src/lib/libcrypto/ocsp/ocsp_prn.c
index 87608ff399..9e4b81f061 100644
--- a/src/lib/libcrypto/ocsp/ocsp_prn.c
+++ b/src/lib/libcrypto/ocsp/ocsp_prn.c
@@ -66,8 +66,9 @@
66#include <openssl/ocsp.h> 66#include <openssl/ocsp.h>
67#include <openssl/pem.h> 67#include <openssl/pem.h>
68 68
69static int ocsp_certid_print(BIO *bp, OCSP_CERTID* a, int indent) 69static int
70 { 70ocsp_certid_print(BIO *bp, OCSP_CERTID* a, int indent)
71{
71 BIO_printf(bp, "%*sCertificate ID:\n", indent, ""); 72 BIO_printf(bp, "%*sCertificate ID:\n", indent, "");
72 indent += 2; 73 indent += 2;
73 BIO_printf(bp, "%*sHash Algorithm: ", indent, ""); 74 BIO_printf(bp, "%*sHash Algorithm: ", indent, "");
@@ -80,60 +81,68 @@ static int ocsp_certid_print(BIO *bp, OCSP_CERTID* a, int indent)
80 i2a_ASN1_INTEGER(bp, a->serialNumber); 81 i2a_ASN1_INTEGER(bp, a->serialNumber);
81 BIO_printf(bp, "\n"); 82 BIO_printf(bp, "\n");
82 return 1; 83 return 1;
83 } 84}
84 85
85typedef struct 86typedef struct {
86 {
87 long t; 87 long t;
88 const char *m; 88 const char *m;
89 } OCSP_TBLSTR; 89} OCSP_TBLSTR;
90 90
91static const char *table2string(long s, const OCSP_TBLSTR *ts, int len) 91static const char *
92table2string(long s, const OCSP_TBLSTR *ts, int len)
92{ 93{
93 const OCSP_TBLSTR *p; 94 const OCSP_TBLSTR *p;
95
94 for (p=ts; p < ts + len; p++) 96 for (p=ts; p < ts + len; p++)
95 if (p->t == s) 97 if (p->t == s)
96 return p->m; 98 return p->m;
97 return "(UNKNOWN)"; 99 return "(UNKNOWN)";
98} 100}
99 101
100const char *OCSP_response_status_str(long s) 102const char *
101 { 103OCSP_response_status_str(long s)
104{
102 static const OCSP_TBLSTR rstat_tbl[] = { 105 static const OCSP_TBLSTR rstat_tbl[] = {
103 { OCSP_RESPONSE_STATUS_SUCCESSFUL, "successful" }, 106 { OCSP_RESPONSE_STATUS_SUCCESSFUL, "successful" },
104 { OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, "malformedrequest" }, 107 { OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, "malformedrequest" },
105 { OCSP_RESPONSE_STATUS_INTERNALERROR, "internalerror" }, 108 { OCSP_RESPONSE_STATUS_INTERNALERROR, "internalerror" },
106 { OCSP_RESPONSE_STATUS_TRYLATER, "trylater" }, 109 { OCSP_RESPONSE_STATUS_TRYLATER, "trylater" },
107 { OCSP_RESPONSE_STATUS_SIGREQUIRED, "sigrequired" }, 110 { OCSP_RESPONSE_STATUS_SIGREQUIRED, "sigrequired" },
108 { OCSP_RESPONSE_STATUS_UNAUTHORIZED, "unauthorized" } }; 111 { OCSP_RESPONSE_STATUS_UNAUTHORIZED, "unauthorized" }
112 };
109 return table2string(s, rstat_tbl, 6); 113 return table2string(s, rstat_tbl, 6);
110 } 114}
111 115
112const char *OCSP_cert_status_str(long s) 116const char *
113 { 117OCSP_cert_status_str(long s)
118{
114 static const OCSP_TBLSTR cstat_tbl[] = { 119 static const OCSP_TBLSTR cstat_tbl[] = {
115 { V_OCSP_CERTSTATUS_GOOD, "good" }, 120 { V_OCSP_CERTSTATUS_GOOD, "good" },
116 { V_OCSP_CERTSTATUS_REVOKED, "revoked" }, 121 { V_OCSP_CERTSTATUS_REVOKED, "revoked" },
117 { V_OCSP_CERTSTATUS_UNKNOWN, "unknown" } }; 122 { V_OCSP_CERTSTATUS_UNKNOWN, "unknown" }
123 };
118 return table2string(s, cstat_tbl, 3); 124 return table2string(s, cstat_tbl, 3);
119 } 125}
120 126
121const char *OCSP_crl_reason_str(long s) 127const char *
122 { 128OCSP_crl_reason_str(long s)
129{
123 static const OCSP_TBLSTR reason_tbl[] = { 130 static const OCSP_TBLSTR reason_tbl[] = {
124 { OCSP_REVOKED_STATUS_UNSPECIFIED, "unspecified" }, 131 { OCSP_REVOKED_STATUS_UNSPECIFIED, "unspecified" },
125 { OCSP_REVOKED_STATUS_KEYCOMPROMISE, "keyCompromise" }, 132 { OCSP_REVOKED_STATUS_KEYCOMPROMISE, "keyCompromise" },
126 { OCSP_REVOKED_STATUS_CACOMPROMISE, "cACompromise" }, 133 { OCSP_REVOKED_STATUS_CACOMPROMISE, "cACompromise" },
127 { OCSP_REVOKED_STATUS_AFFILIATIONCHANGED, "affiliationChanged" }, 134 { OCSP_REVOKED_STATUS_AFFILIATIONCHANGED, "affiliationChanged" },
128 { OCSP_REVOKED_STATUS_SUPERSEDED, "superseded" }, 135 { OCSP_REVOKED_STATUS_SUPERSEDED, "superseded" },
129 { OCSP_REVOKED_STATUS_CESSATIONOFOPERATION, "cessationOfOperation" }, 136 { OCSP_REVOKED_STATUS_CESSATIONOFOPERATION, "cessationOfOperation" },
130 { OCSP_REVOKED_STATUS_CERTIFICATEHOLD, "certificateHold" }, 137 { OCSP_REVOKED_STATUS_CERTIFICATEHOLD, "certificateHold" },
131 { OCSP_REVOKED_STATUS_REMOVEFROMCRL, "removeFromCRL" } }; 138 { OCSP_REVOKED_STATUS_REMOVEFROMCRL, "removeFromCRL" }
139 };
132 return table2string(s, reason_tbl, 8); 140 return table2string(s, reason_tbl, 8);
133 } 141}
134 142
135int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* o, unsigned long flags) 143int
136 { 144OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* o, unsigned long flags)
145{
137 int i; 146 int i;
138 long l; 147 long l;
139 OCSP_CERTID* cid = NULL; 148 OCSP_CERTID* cid = NULL;
@@ -141,45 +150,45 @@ int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* o, unsigned long flags)
141 OCSP_REQINFO *inf = o->tbsRequest; 150 OCSP_REQINFO *inf = o->tbsRequest;
142 OCSP_SIGNATURE *sig = o->optionalSignature; 151 OCSP_SIGNATURE *sig = o->optionalSignature;
143 152
144 if (BIO_write(bp,"OCSP Request Data:\n",19) <= 0) goto err; 153 if (BIO_write(bp,"OCSP Request Data:\n",19) <= 0)
145 l=ASN1_INTEGER_get(inf->version); 154 goto err;
146 if (BIO_printf(bp," Version: %lu (0x%lx)",l+1,l) <= 0) goto err; 155 l = ASN1_INTEGER_get(inf->version);
147 if (inf->requestorName != NULL) 156 if (BIO_printf(bp," Version: %lu (0x%lx)",l+1,l) <= 0)
148 { 157 goto err;
158 if (inf->requestorName != NULL) {
149 if (BIO_write(bp,"\n Requestor Name: ",21) <= 0) 159 if (BIO_write(bp,"\n Requestor Name: ",21) <= 0)
150 goto err; 160 goto err;
151 GENERAL_NAME_print(bp, inf->requestorName); 161 GENERAL_NAME_print(bp, inf->requestorName);
152 } 162 }
153 if (BIO_write(bp,"\n Requestor List:\n",21) <= 0) goto err; 163 if (BIO_write(bp,"\n Requestor List:\n",21) <= 0)
154 for (i = 0; i < sk_OCSP_ONEREQ_num(inf->requestList); i++) 164 goto err;
155 { 165 for (i = 0; i < sk_OCSP_ONEREQ_num(inf->requestList); i++) {
156 one = sk_OCSP_ONEREQ_value(inf->requestList, i); 166 one = sk_OCSP_ONEREQ_value(inf->requestList, i);
157 cid = one->reqCert; 167 cid = one->reqCert;
158 ocsp_certid_print(bp, cid, 8); 168 ocsp_certid_print(bp, cid, 8);
159 if (!X509V3_extensions_print(bp, 169 if (!X509V3_extensions_print(bp, "Request Single Extensions",
160 "Request Single Extensions", 170 one->singleRequestExtensions, flags, 8))
161 one->singleRequestExtensions, flags, 8)) 171 goto err;
162 goto err; 172 }
163 }
164 if (!X509V3_extensions_print(bp, "Request Extensions", 173 if (!X509V3_extensions_print(bp, "Request Extensions",
165 inf->requestExtensions, flags, 4)) 174 inf->requestExtensions, flags, 4))
166 goto err; 175 goto err;
167 if (sig) 176 if (sig) {
168 { 177 X509_signature_print(bp, sig->signatureAlgorithm,
169 X509_signature_print(bp, sig->signatureAlgorithm, sig->signature); 178 sig->signature);
170 for (i=0; i<sk_X509_num(sig->certs); i++) 179 for (i=0; i<sk_X509_num(sig->certs); i++) {
171 {
172 X509_print(bp, sk_X509_value(sig->certs,i)); 180 X509_print(bp, sk_X509_value(sig->certs,i));
173 PEM_write_bio_X509(bp,sk_X509_value(sig->certs,i)); 181 PEM_write_bio_X509(bp,sk_X509_value(sig->certs,i));
174 }
175 } 182 }
183 }
176 return 1; 184 return 1;
177err: 185err:
178 return 0; 186 return 0;
179 } 187}
180 188
181int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags) 189int
182 { 190OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags)
191{
183 int i, ret = 0; 192 int i, ret = 0;
184 long l; 193 long l;
185 OCSP_CERTID *cid = NULL; 194 OCSP_CERTID *cid = NULL;
@@ -191,100 +200,107 @@ int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags)
191 OCSP_SINGLERESP *single = NULL; 200 OCSP_SINGLERESP *single = NULL;
192 OCSP_RESPBYTES *rb = o->responseBytes; 201 OCSP_RESPBYTES *rb = o->responseBytes;
193 202
194 if (BIO_puts(bp,"OCSP Response Data:\n") <= 0) goto err; 203 if (BIO_puts(bp,"OCSP Response Data:\n") <= 0)
195 l=ASN1_ENUMERATED_get(o->responseStatus); 204 goto err;
205 l = ASN1_ENUMERATED_get(o->responseStatus);
196 if (BIO_printf(bp," OCSP Response Status: %s (0x%lx)\n", 206 if (BIO_printf(bp," OCSP Response Status: %s (0x%lx)\n",
197 OCSP_response_status_str(l), l) <= 0) goto err; 207 OCSP_response_status_str(l), l) <= 0)
198 if (rb == NULL) return 1; 208 goto err;
199 if (BIO_puts(bp," Response Type: ") <= 0) 209 if (rb == NULL)
200 goto err; 210 return 1;
211 if (BIO_puts(bp," Response Type: ") <= 0)
212 goto err;
201 if(i2a_ASN1_OBJECT(bp, rb->responseType) <= 0) 213 if(i2a_ASN1_OBJECT(bp, rb->responseType) <= 0)
202 goto err; 214 goto err;
203 if (OBJ_obj2nid(rb->responseType) != NID_id_pkix_OCSP_basic) 215 if (OBJ_obj2nid(rb->responseType) != NID_id_pkix_OCSP_basic) {
204 {
205 BIO_puts(bp," (unknown response type)\n"); 216 BIO_puts(bp," (unknown response type)\n");
206 return 1; 217 return 1;
207 } 218 }
208 219
209 i = ASN1_STRING_length(rb->response); 220 i = ASN1_STRING_length(rb->response);
210 if (!(br = OCSP_response_get1_basic(o))) goto err; 221 if (!(br = OCSP_response_get1_basic(o)))
222 goto err;
211 rd = br->tbsResponseData; 223 rd = br->tbsResponseData;
212 l=ASN1_INTEGER_get(rd->version); 224 l = ASN1_INTEGER_get(rd->version);
213 if (BIO_printf(bp,"\n Version: %lu (0x%lx)\n", 225 if (BIO_printf(bp,"\n Version: %lu (0x%lx)\n", l+1,l) <= 0)
214 l+1,l) <= 0) goto err; 226 goto err;
215 if (BIO_puts(bp," Responder Id: ") <= 0) goto err; 227 if (BIO_puts(bp," Responder Id: ") <= 0)
228 goto err;
216 229
217 rid = rd->responderId; 230 rid = rd->responderId;
218 switch (rid->type) 231 switch (rid->type) {
219 { 232 case V_OCSP_RESPID_NAME:
220 case V_OCSP_RESPID_NAME: 233 X509_NAME_print_ex(bp, rid->value.byName, 0, XN_FLAG_ONELINE);
221 X509_NAME_print_ex(bp, rid->value.byName, 0, XN_FLAG_ONELINE); 234 break;
222 break; 235 case V_OCSP_RESPID_KEY:
223 case V_OCSP_RESPID_KEY: 236 i2a_ASN1_STRING(bp, rid->value.byKey, V_ASN1_OCTET_STRING);
224 i2a_ASN1_STRING(bp, rid->value.byKey, V_ASN1_OCTET_STRING); 237 break;
225 break; 238 }
226 }
227 239
228 if (BIO_printf(bp,"\n Produced At: ")<=0) goto err; 240 if (BIO_printf(bp,"\n Produced At: ")<=0)
229 if (!ASN1_GENERALIZEDTIME_print(bp, rd->producedAt)) goto err; 241 goto err;
230 if (BIO_printf(bp,"\n Responses:\n") <= 0) goto err; 242 if (!ASN1_GENERALIZEDTIME_print(bp, rd->producedAt))
231 for (i = 0; i < sk_OCSP_SINGLERESP_num(rd->responses); i++) 243 goto err;
232 { 244 if (BIO_printf(bp,"\n Responses:\n") <= 0)
233 if (! sk_OCSP_SINGLERESP_value(rd->responses, i)) continue; 245 goto err;
246 for (i = 0; i < sk_OCSP_SINGLERESP_num(rd->responses); i++) {
247 if (! sk_OCSP_SINGLERESP_value(rd->responses, i))
248 continue;
234 single = sk_OCSP_SINGLERESP_value(rd->responses, i); 249 single = sk_OCSP_SINGLERESP_value(rd->responses, i);
235 cid = single->certId; 250 cid = single->certId;
236 if(ocsp_certid_print(bp, cid, 4) <= 0) goto err; 251 if (ocsp_certid_print(bp, cid, 4) <= 0)
252 goto err;
237 cst = single->certStatus; 253 cst = single->certStatus;
238 if (BIO_printf(bp," Cert Status: %s", 254 if (BIO_printf(bp," Cert Status: %s",
239 OCSP_cert_status_str(cst->type)) <= 0) 255 OCSP_cert_status_str(cst->type)) <= 0)
240 goto err; 256 goto err;
241 if (cst->type == V_OCSP_CERTSTATUS_REVOKED) 257 if (cst->type == V_OCSP_CERTSTATUS_REVOKED) {
242 { 258 rev = cst->value.revoked;
243 rev = cst->value.revoked;
244 if (BIO_printf(bp, "\n Revocation Time: ") <= 0) 259 if (BIO_printf(bp, "\n Revocation Time: ") <= 0)
245 goto err;
246 if (!ASN1_GENERALIZEDTIME_print(bp,
247 rev->revocationTime))
248 goto err; 260 goto err;
249 if (rev->revocationReason) 261 if (!ASN1_GENERALIZEDTIME_print(bp,
250 { 262 rev->revocationTime))
251 l=ASN1_ENUMERATED_get(rev->revocationReason); 263 goto err;
252 if (BIO_printf(bp, 264 if (rev->revocationReason) {
253 "\n Revocation Reason: %s (0x%lx)", 265 l = ASN1_ENUMERATED_get(rev->revocationReason);
254 OCSP_crl_reason_str(l), l) <= 0) 266 if (BIO_printf(bp,
255 goto err; 267 "\n Revocation Reason: %s (0x%lx)",
256 } 268 OCSP_crl_reason_str(l), l) <= 0)
269 goto err;
257 } 270 }
258 if (BIO_printf(bp,"\n This Update: ") <= 0) goto err; 271 }
272 if (BIO_printf(bp,"\n This Update: ") <= 0)
273 goto err;
259 if (!ASN1_GENERALIZEDTIME_print(bp, single->thisUpdate)) 274 if (!ASN1_GENERALIZEDTIME_print(bp, single->thisUpdate))
260 goto err; 275 goto err;
261 if (single->nextUpdate) 276 if (single->nextUpdate) {
262 { 277 if (BIO_printf(bp,"\n Next Update: ") <= 0)
263 if (BIO_printf(bp,"\n Next Update: ") <= 0)goto err; 278 goto err;
264 if (!ASN1_GENERALIZEDTIME_print(bp,single->nextUpdate)) 279 if (!ASN1_GENERALIZEDTIME_print(bp,single->nextUpdate))
265 goto err; 280 goto err;
266 }
267 if (BIO_write(bp,"\n",1) <= 0) goto err;
268 if (!X509V3_extensions_print(bp,
269 "Response Single Extensions",
270 single->singleExtensions, flags, 8))
271 goto err;
272 if (BIO_write(bp,"\n",1) <= 0) goto err;
273 } 281 }
282 if (BIO_write(bp,"\n",1) <= 0)
283 goto err;
284 if (!X509V3_extensions_print(bp, "Response Single Extensions",
285 single->singleExtensions, flags, 8))
286 goto err;
287 if (BIO_write(bp,"\n",1) <= 0)
288 goto err;
289 }
274 if (!X509V3_extensions_print(bp, "Response Extensions", 290 if (!X509V3_extensions_print(bp, "Response Extensions",
275 rd->responseExtensions, flags, 4)) 291 rd->responseExtensions, flags, 4))
276 goto err; 292 goto err;
277 if(X509_signature_print(bp, br->signatureAlgorithm, br->signature) <= 0) 293 if (X509_signature_print(bp, br->signatureAlgorithm, br->signature) <=
278 goto err; 294 0)
295 goto err;
279 296
280 for (i=0; i<sk_X509_num(br->certs); i++) 297 for (i = 0; i < sk_X509_num(br->certs); i++) {
281 { 298 X509_print(bp, sk_X509_value(br->certs, i));
282 X509_print(bp, sk_X509_value(br->certs,i)); 299 PEM_write_bio_X509(bp,sk_X509_value(br->certs, i));
283 PEM_write_bio_X509(bp,sk_X509_value(br->certs,i)); 300 }
284 }
285 301
286 ret = 1; 302 ret = 1;
287err: 303err:
288 OCSP_BASICRESP_free(br); 304 OCSP_BASICRESP_free(br);
289 return ret; 305 return ret;
290 } 306}
diff --git a/src/lib/libcrypto/ocsp/ocsp_srv.c b/src/lib/libcrypto/ocsp/ocsp_srv.c
index 1c606dd0b6..c14e8e2bc3 100644
--- a/src/lib/libcrypto/ocsp/ocsp_srv.c
+++ b/src/lib/libcrypto/ocsp/ocsp_srv.c
@@ -69,107 +69,118 @@
69 * relevant information from the request. 69 * relevant information from the request.
70 */ 70 */
71 71
72int OCSP_request_onereq_count(OCSP_REQUEST *req) 72int
73 { 73OCSP_request_onereq_count(OCSP_REQUEST *req)
74{
74 return sk_OCSP_ONEREQ_num(req->tbsRequest->requestList); 75 return sk_OCSP_ONEREQ_num(req->tbsRequest->requestList);
75 } 76}
76 77
77OCSP_ONEREQ *OCSP_request_onereq_get0(OCSP_REQUEST *req, int i) 78OCSP_ONEREQ *
78 { 79OCSP_request_onereq_get0(OCSP_REQUEST *req, int i)
80{
79 return sk_OCSP_ONEREQ_value(req->tbsRequest->requestList, i); 81 return sk_OCSP_ONEREQ_value(req->tbsRequest->requestList, i);
80 } 82}
81 83
82OCSP_CERTID *OCSP_onereq_get0_id(OCSP_ONEREQ *one) 84OCSP_CERTID *
83 { 85OCSP_onereq_get0_id(OCSP_ONEREQ *one)
86{
84 return one->reqCert; 87 return one->reqCert;
85 } 88}
86 89
87int OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd, 90int
88 ASN1_OCTET_STRING **pikeyHash, 91OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd,
89 ASN1_INTEGER **pserial, OCSP_CERTID *cid) 92 ASN1_OCTET_STRING **pikeyHash, ASN1_INTEGER **pserial, OCSP_CERTID *cid)
90 { 93{
91 if (!cid) return 0; 94 if (!cid)
92 if (pmd) *pmd = cid->hashAlgorithm->algorithm; 95 return 0;
93 if(piNameHash) *piNameHash = cid->issuerNameHash; 96 if (pmd)
94 if (pikeyHash) *pikeyHash = cid->issuerKeyHash; 97 *pmd = cid->hashAlgorithm->algorithm;
95 if (pserial) *pserial = cid->serialNumber; 98 if (piNameHash)
99 *piNameHash = cid->issuerNameHash;
100 if (pikeyHash)
101 *pikeyHash = cid->issuerKeyHash;
102 if (pserial)
103 *pserial = cid->serialNumber;
96 return 1; 104 return 1;
97 } 105}
98 106
99int OCSP_request_is_signed(OCSP_REQUEST *req) 107int
100 { 108OCSP_request_is_signed(OCSP_REQUEST *req)
101 if(req->optionalSignature) return 1; 109{
110 if (req->optionalSignature)
111 return 1;
102 return 0; 112 return 0;
103 } 113}
104 114
105/* Create an OCSP response and encode an optional basic response */ 115/* Create an OCSP response and encode an optional basic response */
106OCSP_RESPONSE *OCSP_response_create(int status, OCSP_BASICRESP *bs) 116OCSP_RESPONSE *
107 { 117OCSP_response_create(int status, OCSP_BASICRESP *bs)
108 OCSP_RESPONSE *rsp = NULL; 118{
119 OCSP_RESPONSE *rsp = NULL;
109 120
110 if (!(rsp = OCSP_RESPONSE_new())) goto err; 121 if (!(rsp = OCSP_RESPONSE_new()))
111 if (!(ASN1_ENUMERATED_set(rsp->responseStatus, status))) goto err; 122 goto err;
112 if (!bs) return rsp; 123 if (!(ASN1_ENUMERATED_set(rsp->responseStatus, status)))
113 if (!(rsp->responseBytes = OCSP_RESPBYTES_new())) goto err; 124 goto err;
125 if (!bs)
126 return rsp;
127 if (!(rsp->responseBytes = OCSP_RESPBYTES_new()))
128 goto err;
114 rsp->responseBytes->responseType = OBJ_nid2obj(NID_id_pkix_OCSP_basic); 129 rsp->responseBytes->responseType = OBJ_nid2obj(NID_id_pkix_OCSP_basic);
115 if (!ASN1_item_pack(bs, ASN1_ITEM_rptr(OCSP_BASICRESP), &rsp->responseBytes->response)) 130 if (!ASN1_item_pack(bs, ASN1_ITEM_rptr(OCSP_BASICRESP),
116 goto err; 131 &rsp->responseBytes->response))
132 goto err;
117 return rsp; 133 return rsp;
118err: 134err:
119 if (rsp) OCSP_RESPONSE_free(rsp); 135 if (rsp)
136 OCSP_RESPONSE_free(rsp);
120 return NULL; 137 return NULL;
121 } 138}
122
123 139
124OCSP_SINGLERESP *OCSP_basic_add1_status(OCSP_BASICRESP *rsp, 140OCSP_SINGLERESP *
125 OCSP_CERTID *cid, 141OCSP_basic_add1_status(OCSP_BASICRESP *rsp, OCSP_CERTID *cid, int status,
126 int status, int reason, 142 int reason, ASN1_TIME *revtime, ASN1_TIME *thisupd, ASN1_TIME *nextupd)
127 ASN1_TIME *revtime, 143{
128 ASN1_TIME *thisupd, ASN1_TIME *nextupd)
129 {
130 OCSP_SINGLERESP *single = NULL; 144 OCSP_SINGLERESP *single = NULL;
131 OCSP_CERTSTATUS *cs; 145 OCSP_CERTSTATUS *cs;
132 OCSP_REVOKEDINFO *ri; 146 OCSP_REVOKEDINFO *ri;
133 147
134 if(!rsp->tbsResponseData->responses && 148 if (!rsp->tbsResponseData->responses &&
135 !(rsp->tbsResponseData->responses = sk_OCSP_SINGLERESP_new_null())) 149 !(rsp->tbsResponseData->responses = sk_OCSP_SINGLERESP_new_null()))
136 goto err; 150 goto err;
137 151
138 if (!(single = OCSP_SINGLERESP_new())) 152 if (!(single = OCSP_SINGLERESP_new()))
139 goto err; 153 goto err;
140 154
141
142
143 if (!ASN1_TIME_to_generalizedtime(thisupd, &single->thisUpdate)) 155 if (!ASN1_TIME_to_generalizedtime(thisupd, &single->thisUpdate))
144 goto err; 156 goto err;
145 if (nextupd && 157 if (nextupd &&
146 !ASN1_TIME_to_generalizedtime(nextupd, &single->nextUpdate)) 158 !ASN1_TIME_to_generalizedtime(nextupd, &single->nextUpdate))
147 goto err; 159 goto err;
148 160
149 OCSP_CERTID_free(single->certId); 161 OCSP_CERTID_free(single->certId);
150 162
151 if(!(single->certId = OCSP_CERTID_dup(cid))) 163 if (!(single->certId = OCSP_CERTID_dup(cid)))
152 goto err; 164 goto err;
153 165
154 cs = single->certStatus; 166 cs = single->certStatus;
155 switch(cs->type = status) 167 switch(cs->type = status) {
156 {
157 case V_OCSP_CERTSTATUS_REVOKED: 168 case V_OCSP_CERTSTATUS_REVOKED:
158 if (!revtime) 169 if (!revtime) {
159 { 170 OCSPerr(OCSP_F_OCSP_BASIC_ADD1_STATUS,
160 OCSPerr(OCSP_F_OCSP_BASIC_ADD1_STATUS,OCSP_R_NO_REVOKED_TIME); 171 OCSP_R_NO_REVOKED_TIME);
172 goto err;
173 }
174 if (!(cs->value.revoked = ri = OCSP_REVOKEDINFO_new()))
161 goto err; 175 goto err;
162 }
163 if (!(cs->value.revoked = ri = OCSP_REVOKEDINFO_new())) goto err;
164 if (!ASN1_TIME_to_generalizedtime(revtime, &ri->revocationTime)) 176 if (!ASN1_TIME_to_generalizedtime(revtime, &ri->revocationTime))
165 goto err; 177 goto err;
166 if (reason != OCSP_REVOKED_STATUS_NOSTATUS) 178 if (reason != OCSP_REVOKED_STATUS_NOSTATUS) {
167 {
168 if (!(ri->revocationReason = ASN1_ENUMERATED_new())) 179 if (!(ri->revocationReason = ASN1_ENUMERATED_new()))
169 goto err; 180 goto err;
170 if (!(ASN1_ENUMERATED_set(ri->revocationReason, 181 if (!(ASN1_ENUMERATED_set(ri->revocationReason,
171 reason))) 182 reason)))
172 goto err; 183 goto err;
173 } 184 }
174 break; 185 break;
175 186
@@ -183,82 +194,80 @@ OCSP_SINGLERESP *OCSP_basic_add1_status(OCSP_BASICRESP *rsp,
183 194
184 default: 195 default:
185 goto err; 196 goto err;
186 197 }
187 }
188 if (!(sk_OCSP_SINGLERESP_push(rsp->tbsResponseData->responses, single))) 198 if (!(sk_OCSP_SINGLERESP_push(rsp->tbsResponseData->responses, single)))
189 goto err; 199 goto err;
190 return single; 200 return single;
191err: 201err:
192 OCSP_SINGLERESP_free(single); 202 OCSP_SINGLERESP_free(single);
193 return NULL; 203 return NULL;
194 } 204}
195 205
196/* Add a certificate to an OCSP request */ 206/* Add a certificate to an OCSP request */
197 207int
198int OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert) 208OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert)
199 { 209{
200 if (!resp->certs && !(resp->certs = sk_X509_new_null())) 210 if (!resp->certs && !(resp->certs = sk_X509_new_null()))
201 return 0; 211 return 0;
202 212
203 if(!sk_X509_push(resp->certs, cert)) return 0; 213 if (!sk_X509_push(resp->certs, cert))
214 return 0;
204 CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509); 215 CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509);
205 return 1; 216 return 1;
206 } 217}
207 218
208int OCSP_basic_sign(OCSP_BASICRESP *brsp, 219int
209 X509 *signer, EVP_PKEY *key, const EVP_MD *dgst, 220OCSP_basic_sign(OCSP_BASICRESP *brsp, X509 *signer, EVP_PKEY *key,
210 STACK_OF(X509) *certs, unsigned long flags) 221 const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags)
211 { 222{
212 int i; 223 int i;
213 OCSP_RESPID *rid; 224 OCSP_RESPID *rid;
214 225
215 if (!X509_check_private_key(signer, key)) 226 if (!X509_check_private_key(signer, key)) {
216 { 227 OCSPerr(OCSP_F_OCSP_BASIC_SIGN,
217 OCSPerr(OCSP_F_OCSP_BASIC_SIGN, OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); 228 OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
218 goto err; 229 goto err;
219 } 230 }
220 231
221 if(!(flags & OCSP_NOCERTS)) 232 if (!(flags & OCSP_NOCERTS)) {
222 { 233 if (!OCSP_basic_add1_cert(brsp, signer))
223 if(!OCSP_basic_add1_cert(brsp, signer))
224 goto err; 234 goto err;
225 for (i = 0; i < sk_X509_num(certs); i++) 235 for (i = 0; i < sk_X509_num(certs); i++) {
226 {
227 X509 *tmpcert = sk_X509_value(certs, i); 236 X509 *tmpcert = sk_X509_value(certs, i);
228 if(!OCSP_basic_add1_cert(brsp, tmpcert)) 237 if (!OCSP_basic_add1_cert(brsp, tmpcert))
229 goto err; 238 goto err;
230 }
231 } 239 }
240 }
232 241
233 rid = brsp->tbsResponseData->responderId; 242 rid = brsp->tbsResponseData->responderId;
234 if (flags & OCSP_RESPID_KEY) 243 if (flags & OCSP_RESPID_KEY) {
235 {
236 unsigned char md[SHA_DIGEST_LENGTH]; 244 unsigned char md[SHA_DIGEST_LENGTH];
245
237 X509_pubkey_digest(signer, EVP_sha1(), md, NULL); 246 X509_pubkey_digest(signer, EVP_sha1(), md, NULL);
238 if (!(rid->value.byKey = ASN1_OCTET_STRING_new())) 247 if (!(rid->value.byKey = ASN1_OCTET_STRING_new()))
239 goto err; 248 goto err;
240 if (!(ASN1_OCTET_STRING_set(rid->value.byKey, md, SHA_DIGEST_LENGTH))) 249 if (!(ASN1_OCTET_STRING_set(rid->value.byKey, md,
241 goto err; 250 SHA_DIGEST_LENGTH)))
251 goto err;
242 rid->type = V_OCSP_RESPID_KEY; 252 rid->type = V_OCSP_RESPID_KEY;
243 } 253 } else {
244 else
245 {
246 if (!X509_NAME_set(&rid->value.byName, 254 if (!X509_NAME_set(&rid->value.byName,
247 X509_get_subject_name(signer))) 255 X509_get_subject_name(signer)))
248 goto err; 256 goto err;
249 rid->type = V_OCSP_RESPID_NAME; 257 rid->type = V_OCSP_RESPID_NAME;
250 } 258 }
251 259
252 if (!(flags & OCSP_NOTIME) && 260 if (!(flags & OCSP_NOTIME) &&
253 !X509_gmtime_adj(brsp->tbsResponseData->producedAt, 0)) 261 !X509_gmtime_adj(brsp->tbsResponseData->producedAt, 0))
254 goto err; 262 goto err;
255 263
256 /* Right now, I think that not doing double hashing is the right 264 /* Right now, I think that not doing double hashing is the right
257 thing. -- Richard Levitte */ 265 thing. -- Richard Levitte */
258 266
259 if (!OCSP_BASICRESP_sign(brsp, key, dgst, 0)) goto err; 267 if (!OCSP_BASICRESP_sign(brsp, key, dgst, 0))
268 goto err;
260 269
261 return 1; 270 return 1;
262err: 271err:
263 return 0; 272 return 0;
264 } 273}
diff --git a/src/lib/libcrypto/ocsp/ocsp_vfy.c b/src/lib/libcrypto/ocsp/ocsp_vfy.c
index 0b181d5abe..aede155871 100644
--- a/src/lib/libcrypto/ocsp/ocsp_vfy.c
+++ b/src/lib/libcrypto/ocsp/ocsp_vfy.c
@@ -60,134 +60,137 @@
60#include <openssl/err.h> 60#include <openssl/err.h>
61#include <string.h> 61#include <string.h>
62 62
63static int ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs, STACK_OF(X509) *certs, 63static int ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs,
64 X509_STORE *st, unsigned long flags); 64 STACK_OF(X509) *certs, X509_STORE *st, unsigned long flags);
65static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id); 65static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id);
66static int ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain, unsigned long flags); 66static int ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain,
67 unsigned long flags);
67static int ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret); 68static int ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret);
68static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid, STACK_OF(OCSP_SINGLERESP) *sresp); 69static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,
70 STACK_OF(OCSP_SINGLERESP) *sresp);
69static int ocsp_check_delegated(X509 *x, int flags); 71static int ocsp_check_delegated(X509 *x, int flags);
70static int ocsp_req_find_signer(X509 **psigner, OCSP_REQUEST *req, X509_NAME *nm, STACK_OF(X509) *certs, 72static int ocsp_req_find_signer(X509 **psigner, OCSP_REQUEST *req,
71 X509_STORE *st, unsigned long flags); 73 X509_NAME *nm, STACK_OF(X509) *certs, X509_STORE *st,
74 unsigned long flags);
72 75
73/* Verify a basic response message */ 76/* Verify a basic response message */
74 77int
75int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, 78OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, X509_STORE *st,
76 X509_STORE *st, unsigned long flags) 79 unsigned long flags)
77 { 80{
78 X509 *signer, *x; 81 X509 *signer, *x;
79 STACK_OF(X509) *chain = NULL; 82 STACK_OF(X509) *chain = NULL;
80 X509_STORE_CTX ctx; 83 X509_STORE_CTX ctx;
81 int i, ret = 0; 84 int i, ret = 0;
85
82 ret = ocsp_find_signer(&signer, bs, certs, st, flags); 86 ret = ocsp_find_signer(&signer, bs, certs, st, flags);
83 if (!ret) 87 if (!ret) {
84 { 88 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,
85 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY, OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND); 89 OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND);
86 goto end; 90 goto end;
87 } 91 }
88 if ((ret == 2) && (flags & OCSP_TRUSTOTHER)) 92 if ((ret == 2) && (flags & OCSP_TRUSTOTHER))
89 flags |= OCSP_NOVERIFY; 93 flags |= OCSP_NOVERIFY;
90 if (!(flags & OCSP_NOSIGS)) 94 if (!(flags & OCSP_NOSIGS)) {
91 {
92 EVP_PKEY *skey; 95 EVP_PKEY *skey;
96
93 skey = X509_get_pubkey(signer); 97 skey = X509_get_pubkey(signer);
94 if (skey) 98 if (skey) {
95 {
96 ret = OCSP_BASICRESP_verify(bs, skey, 0); 99 ret = OCSP_BASICRESP_verify(bs, skey, 0);
97 EVP_PKEY_free(skey); 100 EVP_PKEY_free(skey);
98 } 101 }
99 if(!skey || ret <= 0) 102 if (!skey || ret <= 0) {
100 { 103 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,
101 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY, OCSP_R_SIGNATURE_FAILURE); 104 OCSP_R_SIGNATURE_FAILURE);
102 goto end; 105 goto end;
103 }
104 } 106 }
105 if (!(flags & OCSP_NOVERIFY)) 107 }
106 { 108 if (!(flags & OCSP_NOVERIFY)) {
107 int init_res; 109 int init_res;
110
108 if(flags & OCSP_NOCHAIN) 111 if(flags & OCSP_NOCHAIN)
109 init_res = X509_STORE_CTX_init(&ctx, st, signer, NULL); 112 init_res = X509_STORE_CTX_init(&ctx, st, signer, NULL);
110 else 113 else
111 init_res = X509_STORE_CTX_init(&ctx, st, signer, bs->certs); 114 init_res = X509_STORE_CTX_init(&ctx, st, signer,
112 if(!init_res) 115 bs->certs);
113 { 116 if (!init_res) {
114 ret = -1; 117 ret = -1;
115 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,ERR_R_X509_LIB); 118 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,ERR_R_X509_LIB);
116 goto end; 119 goto end;
117 } 120 }
118 121
119 X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_OCSP_HELPER); 122 X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_OCSP_HELPER);
120 ret = X509_verify_cert(&ctx); 123 ret = X509_verify_cert(&ctx);
121 chain = X509_STORE_CTX_get1_chain(&ctx); 124 chain = X509_STORE_CTX_get1_chain(&ctx);
122 X509_STORE_CTX_cleanup(&ctx); 125 X509_STORE_CTX_cleanup(&ctx);
123 if (ret <= 0) 126 if (ret <= 0) {
124 {
125 i = X509_STORE_CTX_get_error(&ctx); 127 i = X509_STORE_CTX_get_error(&ctx);
126 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,OCSP_R_CERTIFICATE_VERIFY_ERROR); 128 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,
129 OCSP_R_CERTIFICATE_VERIFY_ERROR);
127 ERR_asprintf_error_data("Verify error:%s", 130 ERR_asprintf_error_data("Verify error:%s",
128 X509_verify_cert_error_string(i)); 131 X509_verify_cert_error_string(i));
129 goto end; 132 goto end;
130 } 133 }
131 if(flags & OCSP_NOCHECKS) 134 if(flags & OCSP_NOCHECKS) {
132 {
133 ret = 1; 135 ret = 1;
134 goto end; 136 goto end;
135 } 137 }
136 /* At this point we have a valid certificate chain 138 /* At this point we have a valid certificate chain
137 * need to verify it against the OCSP issuer criteria. 139 * need to verify it against the OCSP issuer criteria.
138 */ 140 */
139 ret = ocsp_check_issuer(bs, chain, flags); 141 ret = ocsp_check_issuer(bs, chain, flags);
140 142
141 /* If fatal error or valid match then finish */ 143 /* If fatal error or valid match then finish */
142 if (ret != 0) goto end; 144 if (ret != 0)
145 goto end;
143 146
144 /* Easy case: explicitly trusted. Get root CA and 147 /* Easy case: explicitly trusted. Get root CA and
145 * check for explicit trust 148 * check for explicit trust
146 */ 149 */
147 if(flags & OCSP_NOEXPLICIT) goto end; 150 if (flags & OCSP_NOEXPLICIT)
151 goto end;
148 152
149 x = sk_X509_value(chain, sk_X509_num(chain) - 1); 153 x = sk_X509_value(chain, sk_X509_num(chain) - 1);
150 if(X509_check_trust(x, NID_OCSP_sign, 0) != X509_TRUST_TRUSTED) 154 if (X509_check_trust(x, NID_OCSP_sign, 0) !=
151 { 155 X509_TRUST_TRUSTED) {
152 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,OCSP_R_ROOT_CA_NOT_TRUSTED); 156 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,
157 OCSP_R_ROOT_CA_NOT_TRUSTED);
153 goto end; 158 goto end;
154 }
155 ret = 1;
156 } 159 }
157 160 ret = 1;
158
159
160 end:
161 if(chain) sk_X509_pop_free(chain, X509_free);
162 return ret;
163 } 161 }
164 162
163end:
164 if (chain)
165 sk_X509_pop_free(chain, X509_free);
166 return ret;
167}
165 168
166static int ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs, STACK_OF(X509) *certs, 169static int
167 X509_STORE *st, unsigned long flags) 170ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
168 { 171 X509_STORE *st, unsigned long flags)
172{
169 X509 *signer; 173 X509 *signer;
170 OCSP_RESPID *rid = bs->tbsResponseData->responderId; 174 OCSP_RESPID *rid = bs->tbsResponseData->responderId;
171 if ((signer = ocsp_find_signer_sk(certs, rid))) 175
172 { 176 if ((signer = ocsp_find_signer_sk(certs, rid))) {
173 *psigner = signer; 177 *psigner = signer;
174 return 2; 178 return 2;
175 } 179 }
176 if(!(flags & OCSP_NOINTERN) && 180 if (!(flags & OCSP_NOINTERN) &&
177 (signer = ocsp_find_signer_sk(bs->certs, rid))) 181 (signer = ocsp_find_signer_sk(bs->certs, rid))) {
178 {
179 *psigner = signer; 182 *psigner = signer;
180 return 1; 183 return 1;
181 } 184 }
182 /* Maybe lookup from store if by subject name */ 185 /* Maybe lookup from store if by subject name */
183 186
184 *psigner = NULL; 187 *psigner = NULL;
185 return 0; 188 return 0;
186 } 189}
187
188 190
189static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id) 191static X509 *
190 { 192ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id)
193{
191 int i; 194 int i;
192 unsigned char tmphash[SHA_DIGEST_LENGTH], *keyhash; 195 unsigned char tmphash[SHA_DIGEST_LENGTH], *keyhash;
193 X509 *x; 196 X509 *x;
@@ -199,123 +202,124 @@ static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id)
199 /* Lookup by key hash */ 202 /* Lookup by key hash */
200 203
201 /* If key hash isn't SHA1 length then forget it */ 204 /* If key hash isn't SHA1 length then forget it */
202 if (id->value.byKey->length != SHA_DIGEST_LENGTH) return NULL; 205 if (id->value.byKey->length != SHA_DIGEST_LENGTH)
206 return NULL;
203 keyhash = id->value.byKey->data; 207 keyhash = id->value.byKey->data;
204 /* Calculate hash of each key and compare */ 208 /* Calculate hash of each key and compare */
205 for (i = 0; i < sk_X509_num(certs); i++) 209 for (i = 0; i < sk_X509_num(certs); i++) {
206 {
207 x = sk_X509_value(certs, i); 210 x = sk_X509_value(certs, i);
208 X509_pubkey_digest(x, EVP_sha1(), tmphash, NULL); 211 X509_pubkey_digest(x, EVP_sha1(), tmphash, NULL);
209 if(!memcmp(keyhash, tmphash, SHA_DIGEST_LENGTH)) 212 if (!memcmp(keyhash, tmphash, SHA_DIGEST_LENGTH))
210 return x; 213 return x;
211 }
212 return NULL;
213 } 214 }
215 return NULL;
216}
214 217
215 218static int
216static int ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain, unsigned long flags) 219ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain,
217 { 220 unsigned long flags)
221{
218 STACK_OF(OCSP_SINGLERESP) *sresp; 222 STACK_OF(OCSP_SINGLERESP) *sresp;
219 X509 *signer, *sca; 223 X509 *signer, *sca;
220 OCSP_CERTID *caid = NULL; 224 OCSP_CERTID *caid = NULL;
221 int i; 225 int i;
226
222 sresp = bs->tbsResponseData->responses; 227 sresp = bs->tbsResponseData->responses;
223 228
224 if (sk_X509_num(chain) <= 0) 229 if (sk_X509_num(chain) <= 0) {
225 { 230 OCSPerr(OCSP_F_OCSP_CHECK_ISSUER,
226 OCSPerr(OCSP_F_OCSP_CHECK_ISSUER, OCSP_R_NO_CERTIFICATES_IN_CHAIN); 231 OCSP_R_NO_CERTIFICATES_IN_CHAIN);
227 return -1; 232 return -1;
228 } 233 }
229 234
230 /* See if the issuer IDs match. */ 235 /* See if the issuer IDs match. */
231 i = ocsp_check_ids(sresp, &caid); 236 i = ocsp_check_ids(sresp, &caid);
232 237
233 /* If ID mismatch or other error then return */ 238 /* If ID mismatch or other error then return */
234 if (i <= 0) return i; 239 if (i <= 0)
240 return i;
235 241
236 signer = sk_X509_value(chain, 0); 242 signer = sk_X509_value(chain, 0);
237 /* Check to see if OCSP responder CA matches request CA */ 243 /* Check to see if OCSP responder CA matches request CA */
238 if (sk_X509_num(chain) > 1) 244 if (sk_X509_num(chain) > 1) {
239 {
240 sca = sk_X509_value(chain, 1); 245 sca = sk_X509_value(chain, 1);
241 i = ocsp_match_issuerid(sca, caid, sresp); 246 i = ocsp_match_issuerid(sca, caid, sresp);
242 if (i < 0) return i; 247 if (i < 0)
243 if (i) 248 return i;
244 { 249 if (i) {
245 /* We have a match, if extensions OK then success */ 250 /* We have a match, if extensions OK then success */
246 if (ocsp_check_delegated(signer, flags)) return 1; 251 if (ocsp_check_delegated(signer, flags))
252 return 1;
247 return 0; 253 return 0;
248 }
249 } 254 }
255 }
250 256
251 /* Otherwise check if OCSP request signed directly by request CA */ 257 /* Otherwise check if OCSP request signed directly by request CA */
252 return ocsp_match_issuerid(signer, caid, sresp); 258 return ocsp_match_issuerid(signer, caid, sresp);
253 } 259}
254
255 260
256/* Check the issuer certificate IDs for equality. If there is a mismatch with the same 261/* Check the issuer certificate IDs for equality. If there is a mismatch with the same
257 * algorithm then there's no point trying to match any certificates against the issuer. 262 * algorithm then there's no point trying to match any certificates against the issuer.
258 * If the issuer IDs all match then we just need to check equality against one of them. 263 * If the issuer IDs all match then we just need to check equality against one of them.
259 */ 264 */
260 265static int
261static int ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret) 266ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret)
262 { 267{
263 OCSP_CERTID *tmpid, *cid; 268 OCSP_CERTID *tmpid, *cid;
264 int i, idcount; 269 int i, idcount;
265 270
266 idcount = sk_OCSP_SINGLERESP_num(sresp); 271 idcount = sk_OCSP_SINGLERESP_num(sresp);
267 if (idcount <= 0) 272 if (idcount <= 0) {
268 { 273 OCSPerr(OCSP_F_OCSP_CHECK_IDS,
269 OCSPerr(OCSP_F_OCSP_CHECK_IDS, OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA); 274 OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA);
270 return -1; 275 return -1;
271 } 276 }
272 277
273 cid = sk_OCSP_SINGLERESP_value(sresp, 0)->certId; 278 cid = sk_OCSP_SINGLERESP_value(sresp, 0)->certId;
274 279
275 *ret = NULL; 280 *ret = NULL;
276 281
277 for (i = 1; i < idcount; i++) 282 for (i = 1; i < idcount; i++) {
278 {
279 tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId; 283 tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId;
280 /* Check to see if IDs match */ 284 /* Check to see if IDs match */
281 if (OCSP_id_issuer_cmp(cid, tmpid)) 285 if (OCSP_id_issuer_cmp(cid, tmpid)) {
282 {
283 /* If algoritm mismatch let caller deal with it */ 286 /* If algoritm mismatch let caller deal with it */
284 if (OBJ_cmp(tmpid->hashAlgorithm->algorithm, 287 if (OBJ_cmp(tmpid->hashAlgorithm->algorithm,
285 cid->hashAlgorithm->algorithm)) 288 cid->hashAlgorithm->algorithm))
286 return 2; 289 return 2;
287 /* Else mismatch */ 290 /* Else mismatch */
288 return 0; 291 return 0;
289 }
290 } 292 }
293 }
291 294
292 /* All IDs match: only need to check one ID */ 295 /* All IDs match: only need to check one ID */
293 *ret = cid; 296 *ret = cid;
294 return 1; 297 return 1;
295 } 298}
296 299
297 300static int
298static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid, 301ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,
299 STACK_OF(OCSP_SINGLERESP) *sresp) 302 STACK_OF(OCSP_SINGLERESP) *sresp)
300 { 303{
301 /* If only one ID to match then do it */ 304 /* If only one ID to match then do it */
302 if(cid) 305 if (cid) {
303 {
304 const EVP_MD *dgst; 306 const EVP_MD *dgst;
305 X509_NAME *iname; 307 X509_NAME *iname;
306 int mdlen; 308 int mdlen;
307 unsigned char md[EVP_MAX_MD_SIZE]; 309 unsigned char md[EVP_MAX_MD_SIZE];
308 if (!(dgst = EVP_get_digestbyobj(cid->hashAlgorithm->algorithm))) 310
309 { 311 if (!(dgst =
310 OCSPerr(OCSP_F_OCSP_MATCH_ISSUERID, OCSP_R_UNKNOWN_MESSAGE_DIGEST); 312 EVP_get_digestbyobj(cid->hashAlgorithm->algorithm))) {
313 OCSPerr(OCSP_F_OCSP_MATCH_ISSUERID,
314 OCSP_R_UNKNOWN_MESSAGE_DIGEST);
311 return -1; 315 return -1;
312 } 316 }
313 317
314 mdlen = EVP_MD_size(dgst); 318 mdlen = EVP_MD_size(dgst);
315 if (mdlen < 0) 319 if (mdlen < 0)
316 return -1; 320 return -1;
317 if ((cid->issuerNameHash->length != mdlen) || 321 if (cid->issuerNameHash->length != mdlen ||
318 (cid->issuerKeyHash->length != mdlen)) 322 cid->issuerKeyHash->length != mdlen)
319 return 0; 323 return 0;
320 iname = X509_get_subject_name(cert); 324 iname = X509_get_subject_name(cert);
321 if (!X509_NAME_digest(iname, dgst, md, NULL)) 325 if (!X509_NAME_digest(iname, dgst, md, NULL))
@@ -327,124 +331,123 @@ static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,
327 return 0; 331 return 0;
328 332
329 return 1; 333 return 1;
330 334 } else {
331 }
332 else
333 {
334 /* We have to match the whole lot */ 335 /* We have to match the whole lot */
335 int i, ret; 336 int i, ret;
336 OCSP_CERTID *tmpid; 337 OCSP_CERTID *tmpid;
337 for (i = 0; i < sk_OCSP_SINGLERESP_num(sresp); i++) 338
338 { 339 for (i = 0; i < sk_OCSP_SINGLERESP_num(sresp); i++) {
339 tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId; 340 tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId;
340 ret = ocsp_match_issuerid(cert, tmpid, NULL); 341 ret = ocsp_match_issuerid(cert, tmpid, NULL);
341 if (ret <= 0) return ret; 342 if (ret <= 0)
342 } 343 return ret;
343 return 1;
344 } 344 }
345 345 return 1;
346 } 346 }
347}
347 348
348static int ocsp_check_delegated(X509 *x, int flags) 349static int
349 { 350ocsp_check_delegated(X509 *x, int flags)
351{
350 X509_check_purpose(x, -1, 0); 352 X509_check_purpose(x, -1, 0);
351 if ((x->ex_flags & EXFLAG_XKUSAGE) && 353 if ((x->ex_flags & EXFLAG_XKUSAGE) && (x->ex_xkusage & XKU_OCSP_SIGN))
352 (x->ex_xkusage & XKU_OCSP_SIGN))
353 return 1; 354 return 1;
354 OCSPerr(OCSP_F_OCSP_CHECK_DELEGATED, OCSP_R_MISSING_OCSPSIGNING_USAGE); 355 OCSPerr(OCSP_F_OCSP_CHECK_DELEGATED, OCSP_R_MISSING_OCSPSIGNING_USAGE);
355 return 0; 356 return 0;
356 } 357}
357 358
358/* Verify an OCSP request. This is fortunately much easier than OCSP 359/* Verify an OCSP request. This is fortunately much easier than OCSP
359 * response verify. Just find the signers certificate and verify it 360 * response verify. Just find the signers certificate and verify it
360 * against a given trust value. 361 * against a given trust value.
361 */ 362 */
362 363int
363int OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *store, unsigned long flags) 364OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *store,
364 { 365 unsigned long flags)
366{
365 X509 *signer; 367 X509 *signer;
366 X509_NAME *nm; 368 X509_NAME *nm;
367 GENERAL_NAME *gen; 369 GENERAL_NAME *gen;
368 int ret; 370 int ret;
369 X509_STORE_CTX ctx; 371 X509_STORE_CTX ctx;
370 if (!req->optionalSignature) 372
371 { 373 if (!req->optionalSignature) {
372 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY, OCSP_R_REQUEST_NOT_SIGNED); 374 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY, OCSP_R_REQUEST_NOT_SIGNED);
373 return 0; 375 return 0;
374 } 376 }
375 gen = req->tbsRequest->requestorName; 377 gen = req->tbsRequest->requestorName;
376 if (!gen || gen->type != GEN_DIRNAME) 378 if (!gen || gen->type != GEN_DIRNAME) {
377 { 379 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,
378 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY, OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE); 380 OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE);
379 return 0; 381 return 0;
380 } 382 }
381 nm = gen->d.directoryName; 383 nm = gen->d.directoryName;
382 ret = ocsp_req_find_signer(&signer, req, nm, certs, store, flags); 384 ret = ocsp_req_find_signer(&signer, req, nm, certs, store, flags);
383 if (ret <= 0) 385 if (ret <= 0) {
384 { 386 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,
385 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY, OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND); 387 OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND);
386 return 0; 388 return 0;
387 } 389 }
388 if ((ret == 2) && (flags & OCSP_TRUSTOTHER)) 390 if ((ret == 2) && (flags & OCSP_TRUSTOTHER))
389 flags |= OCSP_NOVERIFY; 391 flags |= OCSP_NOVERIFY;
390 if (!(flags & OCSP_NOSIGS)) 392 if (!(flags & OCSP_NOSIGS)) {
391 {
392 EVP_PKEY *skey; 393 EVP_PKEY *skey;
394
393 skey = X509_get_pubkey(signer); 395 skey = X509_get_pubkey(signer);
394 ret = OCSP_REQUEST_verify(req, skey); 396 ret = OCSP_REQUEST_verify(req, skey);
395 EVP_PKEY_free(skey); 397 EVP_PKEY_free(skey);
396 if(ret <= 0) 398 if (ret <= 0) {
397 { 399 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,
398 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY, OCSP_R_SIGNATURE_FAILURE); 400 OCSP_R_SIGNATURE_FAILURE);
399 return 0; 401 return 0;
400 }
401 } 402 }
402 if (!(flags & OCSP_NOVERIFY)) 403 }
403 { 404 if (!(flags & OCSP_NOVERIFY)) {
404 int init_res; 405 int init_res;
405 if(flags & OCSP_NOCHAIN) 406
406 init_res = X509_STORE_CTX_init(&ctx, store, signer, NULL); 407 if (flags & OCSP_NOCHAIN)
408 init_res = X509_STORE_CTX_init(&ctx, store, signer,
409 NULL);
407 else 410 else
408 init_res = X509_STORE_CTX_init(&ctx, store, signer, 411 init_res = X509_STORE_CTX_init(&ctx, store, signer,
409 req->optionalSignature->certs); 412 req->optionalSignature->certs);
410 if(!init_res) 413 if (!init_res) {
411 {
412 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,ERR_R_X509_LIB); 414 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,ERR_R_X509_LIB);
413 return 0; 415 return 0;
414 } 416 }
415 417
416 X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_OCSP_HELPER); 418 X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_OCSP_HELPER);
417 X509_STORE_CTX_set_trust(&ctx, X509_TRUST_OCSP_REQUEST); 419 X509_STORE_CTX_set_trust(&ctx, X509_TRUST_OCSP_REQUEST);
418 ret = X509_verify_cert(&ctx); 420 ret = X509_verify_cert(&ctx);
419 X509_STORE_CTX_cleanup(&ctx); 421 X509_STORE_CTX_cleanup(&ctx);
420 if (ret <= 0) 422 if (ret <= 0) {
421 {
422 ret = X509_STORE_CTX_get_error(&ctx); 423 ret = X509_STORE_CTX_get_error(&ctx);
423 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,OCSP_R_CERTIFICATE_VERIFY_ERROR); 424 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,
425 OCSP_R_CERTIFICATE_VERIFY_ERROR);
424 ERR_asprintf_error_data("Verify error:%s", 426 ERR_asprintf_error_data("Verify error:%s",
425 X509_verify_cert_error_string(ret)); 427 X509_verify_cert_error_string(ret));
426 return 0; 428 return 0;
427 }
428 } 429 }
430 }
429 return 1; 431 return 1;
430 } 432}
431 433
432static int ocsp_req_find_signer(X509 **psigner, OCSP_REQUEST *req, X509_NAME *nm, STACK_OF(X509) *certs, 434static int
433 X509_STORE *st, unsigned long flags) 435ocsp_req_find_signer(X509 **psigner, OCSP_REQUEST *req, X509_NAME *nm,
434 { 436 STACK_OF(X509) *certs, X509_STORE *st, unsigned long flags)
437{
435 X509 *signer; 438 X509 *signer;
436 if(!(flags & OCSP_NOINTERN)) 439
437 { 440 if (!(flags & OCSP_NOINTERN)) {
438 signer = X509_find_by_subject(req->optionalSignature->certs, nm); 441 signer =
442 X509_find_by_subject(req->optionalSignature->certs, nm);
439 *psigner = signer; 443 *psigner = signer;
440 return 1; 444 return 1;
441 } 445 }
442 446
443 signer = X509_find_by_subject(certs, nm); 447 signer = X509_find_by_subject(certs, nm);
444 if (signer) 448 if (signer) {
445 {
446 *psigner = signer; 449 *psigner = signer;
447 return 2; 450 return 2;
448 }
449 return 0;
450 } 451 }
452 return 0;
453}
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp.h b/src/lib/libssl/src/crypto/ocsp/ocsp.h
index 31e45744ba..9401f7db2f 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp.h
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp.h
@@ -96,13 +96,12 @@ extern "C" {
96 * issuerKeyHash OCTET STRING, -- Hash of Issuers public key (excluding the tag & length fields) 96 * issuerKeyHash OCTET STRING, -- Hash of Issuers public key (excluding the tag & length fields)
97 * serialNumber CertificateSerialNumber } 97 * serialNumber CertificateSerialNumber }
98 */ 98 */
99typedef struct ocsp_cert_id_st 99typedef struct ocsp_cert_id_st {
100 {
101 X509_ALGOR *hashAlgorithm; 100 X509_ALGOR *hashAlgorithm;
102 ASN1_OCTET_STRING *issuerNameHash; 101 ASN1_OCTET_STRING *issuerNameHash;
103 ASN1_OCTET_STRING *issuerKeyHash; 102 ASN1_OCTET_STRING *issuerKeyHash;
104 ASN1_INTEGER *serialNumber; 103 ASN1_INTEGER *serialNumber;
105 } OCSP_CERTID; 104} OCSP_CERTID;
106 105
107DECLARE_STACK_OF(OCSP_CERTID) 106DECLARE_STACK_OF(OCSP_CERTID)
108 107
@@ -110,11 +109,10 @@ DECLARE_STACK_OF(OCSP_CERTID)
110 * reqCert CertID, 109 * reqCert CertID,
111 * singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL } 110 * singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL }
112 */ 111 */
113typedef struct ocsp_one_request_st 112typedef struct ocsp_one_request_st {
114 {
115 OCSP_CERTID *reqCert; 113 OCSP_CERTID *reqCert;
116 STACK_OF(X509_EXTENSION) *singleRequestExtensions; 114 STACK_OF(X509_EXTENSION) *singleRequestExtensions;
117 } OCSP_ONEREQ; 115} OCSP_ONEREQ;
118 116
119DECLARE_STACK_OF(OCSP_ONEREQ) 117DECLARE_STACK_OF(OCSP_ONEREQ)
120DECLARE_ASN1_SET_OF(OCSP_ONEREQ) 118DECLARE_ASN1_SET_OF(OCSP_ONEREQ)
@@ -126,35 +124,32 @@ DECLARE_ASN1_SET_OF(OCSP_ONEREQ)
126 * requestList SEQUENCE OF Request, 124 * requestList SEQUENCE OF Request,
127 * requestExtensions [2] EXPLICIT Extensions OPTIONAL } 125 * requestExtensions [2] EXPLICIT Extensions OPTIONAL }
128 */ 126 */
129typedef struct ocsp_req_info_st 127typedef struct ocsp_req_info_st {
130 {
131 ASN1_INTEGER *version; 128 ASN1_INTEGER *version;
132 GENERAL_NAME *requestorName; 129 GENERAL_NAME *requestorName;
133 STACK_OF(OCSP_ONEREQ) *requestList; 130 STACK_OF(OCSP_ONEREQ) *requestList;
134 STACK_OF(X509_EXTENSION) *requestExtensions; 131 STACK_OF(X509_EXTENSION) *requestExtensions;
135 } OCSP_REQINFO; 132} OCSP_REQINFO;
136 133
137/* Signature ::= SEQUENCE { 134/* Signature ::= SEQUENCE {
138 * signatureAlgorithm AlgorithmIdentifier, 135 * signatureAlgorithm AlgorithmIdentifier,
139 * signature BIT STRING, 136 * signature BIT STRING,
140 * certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL } 137 * certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }
141 */ 138 */
142typedef struct ocsp_signature_st 139typedef struct ocsp_signature_st {
143 {
144 X509_ALGOR *signatureAlgorithm; 140 X509_ALGOR *signatureAlgorithm;
145 ASN1_BIT_STRING *signature; 141 ASN1_BIT_STRING *signature;
146 STACK_OF(X509) *certs; 142 STACK_OF(X509) *certs;
147 } OCSP_SIGNATURE; 143} OCSP_SIGNATURE;
148 144
149/* OCSPRequest ::= SEQUENCE { 145/* OCSPRequest ::= SEQUENCE {
150 * tbsRequest TBSRequest, 146 * tbsRequest TBSRequest,
151 * optionalSignature [0] EXPLICIT Signature OPTIONAL } 147 * optionalSignature [0] EXPLICIT Signature OPTIONAL }
152 */ 148 */
153typedef struct ocsp_request_st 149typedef struct ocsp_request_st {
154 {
155 OCSP_REQINFO *tbsRequest; 150 OCSP_REQINFO *tbsRequest;
156 OCSP_SIGNATURE *optionalSignature; /* OPTIONAL */ 151 OCSP_SIGNATURE *optionalSignature; /* OPTIONAL */
157 } OCSP_REQUEST; 152} OCSP_REQUEST;
158 153
159/* OCSPResponseStatus ::= ENUMERATED { 154/* OCSPResponseStatus ::= ENUMERATED {
160 * successful (0), --Response has valid confirmations 155 * successful (0), --Response has valid confirmations
@@ -166,32 +161,30 @@ typedef struct ocsp_request_st
166 * unauthorized (6) --Request unauthorized 161 * unauthorized (6) --Request unauthorized
167 * } 162 * }
168 */ 163 */
169#define OCSP_RESPONSE_STATUS_SUCCESSFUL 0 164#define OCSP_RESPONSE_STATUS_SUCCESSFUL 0
170#define OCSP_RESPONSE_STATUS_MALFORMEDREQUEST 1 165#define OCSP_RESPONSE_STATUS_MALFORMEDREQUEST 1
171#define OCSP_RESPONSE_STATUS_INTERNALERROR 2 166#define OCSP_RESPONSE_STATUS_INTERNALERROR 2
172#define OCSP_RESPONSE_STATUS_TRYLATER 3 167#define OCSP_RESPONSE_STATUS_TRYLATER 3
173#define OCSP_RESPONSE_STATUS_SIGREQUIRED 5 168#define OCSP_RESPONSE_STATUS_SIGREQUIRED 5
174#define OCSP_RESPONSE_STATUS_UNAUTHORIZED 6 169#define OCSP_RESPONSE_STATUS_UNAUTHORIZED 6
175 170
176/* ResponseBytes ::= SEQUENCE { 171/* ResponseBytes ::= SEQUENCE {
177 * responseType OBJECT IDENTIFIER, 172 * responseType OBJECT IDENTIFIER,
178 * response OCTET STRING } 173 * response OCTET STRING }
179 */ 174 */
180typedef struct ocsp_resp_bytes_st 175typedef struct ocsp_resp_bytes_st {
181 {
182 ASN1_OBJECT *responseType; 176 ASN1_OBJECT *responseType;
183 ASN1_OCTET_STRING *response; 177 ASN1_OCTET_STRING *response;
184 } OCSP_RESPBYTES; 178} OCSP_RESPBYTES;
185 179
186/* OCSPResponse ::= SEQUENCE { 180/* OCSPResponse ::= SEQUENCE {
187 * responseStatus OCSPResponseStatus, 181 * responseStatus OCSPResponseStatus,
188 * responseBytes [0] EXPLICIT ResponseBytes OPTIONAL } 182 * responseBytes [0] EXPLICIT ResponseBytes OPTIONAL }
189 */ 183 */
190struct ocsp_response_st 184struct ocsp_response_st {
191 {
192 ASN1_ENUMERATED *responseStatus; 185 ASN1_ENUMERATED *responseStatus;
193 OCSP_RESPBYTES *responseBytes; 186 OCSP_RESPBYTES *responseBytes;
194 }; 187};
195 188
196/* ResponderID ::= CHOICE { 189/* ResponderID ::= CHOICE {
197 * byName [1] Name, 190 * byName [1] Name,
@@ -199,14 +192,13 @@ struct ocsp_response_st
199 */ 192 */
200#define V_OCSP_RESPID_NAME 0 193#define V_OCSP_RESPID_NAME 0
201#define V_OCSP_RESPID_KEY 1 194#define V_OCSP_RESPID_KEY 1
202struct ocsp_responder_id_st 195struct ocsp_responder_id_st {
203 {
204 int type; 196 int type;
205 union { 197 union {
206 X509_NAME* byName; 198 X509_NAME* byName;
207 ASN1_OCTET_STRING *byKey; 199 ASN1_OCTET_STRING *byKey;
208 } value; 200 } value;
209 }; 201};
210 202
211DECLARE_STACK_OF(OCSP_RESPID) 203DECLARE_STACK_OF(OCSP_RESPID)
212DECLARE_ASN1_FUNCTIONS(OCSP_RESPID) 204DECLARE_ASN1_FUNCTIONS(OCSP_RESPID)
@@ -219,11 +211,10 @@ DECLARE_ASN1_FUNCTIONS(OCSP_RESPID)
219 * revocationTime GeneralizedTime, 211 * revocationTime GeneralizedTime,
220 * revocationReason [0] EXPLICIT CRLReason OPTIONAL } 212 * revocationReason [0] EXPLICIT CRLReason OPTIONAL }
221 */ 213 */
222typedef struct ocsp_revoked_info_st 214typedef struct ocsp_revoked_info_st {
223 {
224 ASN1_GENERALIZEDTIME *revocationTime; 215 ASN1_GENERALIZEDTIME *revocationTime;
225 ASN1_ENUMERATED *revocationReason; 216 ASN1_ENUMERATED *revocationReason;
226 } OCSP_REVOKEDINFO; 217} OCSP_REVOKEDINFO;
227 218
228/* CertStatus ::= CHOICE { 219/* CertStatus ::= CHOICE {
229 * good [0] IMPLICIT NULL, 220 * good [0] IMPLICIT NULL,
@@ -233,15 +224,14 @@ typedef struct ocsp_revoked_info_st
233#define V_OCSP_CERTSTATUS_GOOD 0 224#define V_OCSP_CERTSTATUS_GOOD 0
234#define V_OCSP_CERTSTATUS_REVOKED 1 225#define V_OCSP_CERTSTATUS_REVOKED 1
235#define V_OCSP_CERTSTATUS_UNKNOWN 2 226#define V_OCSP_CERTSTATUS_UNKNOWN 2
236typedef struct ocsp_cert_status_st 227typedef struct ocsp_cert_status_st {
237 {
238 int type; 228 int type;
239 union { 229 union {
240 ASN1_NULL *good; 230 ASN1_NULL *good;
241 OCSP_REVOKEDINFO *revoked; 231 OCSP_REVOKEDINFO *revoked;
242 ASN1_NULL *unknown; 232 ASN1_NULL *unknown;
243 } value; 233 } value;
244 } OCSP_CERTSTATUS; 234} OCSP_CERTSTATUS;
245 235
246/* SingleResponse ::= SEQUENCE { 236/* SingleResponse ::= SEQUENCE {
247 * certID CertID, 237 * certID CertID,
@@ -250,14 +240,13 @@ typedef struct ocsp_cert_status_st
250 * nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL, 240 * nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL,
251 * singleExtensions [1] EXPLICIT Extensions OPTIONAL } 241 * singleExtensions [1] EXPLICIT Extensions OPTIONAL }
252 */ 242 */
253typedef struct ocsp_single_response_st 243typedef struct ocsp_single_response_st {
254 {
255 OCSP_CERTID *certId; 244 OCSP_CERTID *certId;
256 OCSP_CERTSTATUS *certStatus; 245 OCSP_CERTSTATUS *certStatus;
257 ASN1_GENERALIZEDTIME *thisUpdate; 246 ASN1_GENERALIZEDTIME *thisUpdate;
258 ASN1_GENERALIZEDTIME *nextUpdate; 247 ASN1_GENERALIZEDTIME *nextUpdate;
259 STACK_OF(X509_EXTENSION) *singleExtensions; 248 STACK_OF(X509_EXTENSION) *singleExtensions;
260 } OCSP_SINGLERESP; 249} OCSP_SINGLERESP;
261 250
262DECLARE_STACK_OF(OCSP_SINGLERESP) 251DECLARE_STACK_OF(OCSP_SINGLERESP)
263DECLARE_ASN1_SET_OF(OCSP_SINGLERESP) 252DECLARE_ASN1_SET_OF(OCSP_SINGLERESP)
@@ -269,14 +258,13 @@ DECLARE_ASN1_SET_OF(OCSP_SINGLERESP)
269 * responses SEQUENCE OF SingleResponse, 258 * responses SEQUENCE OF SingleResponse,
270 * responseExtensions [1] EXPLICIT Extensions OPTIONAL } 259 * responseExtensions [1] EXPLICIT Extensions OPTIONAL }
271 */ 260 */
272typedef struct ocsp_response_data_st 261typedef struct ocsp_response_data_st {
273 {
274 ASN1_INTEGER *version; 262 ASN1_INTEGER *version;
275 OCSP_RESPID *responderId; 263 OCSP_RESPID *responderId;
276 ASN1_GENERALIZEDTIME *producedAt; 264 ASN1_GENERALIZEDTIME *producedAt;
277 STACK_OF(OCSP_SINGLERESP) *responses; 265 STACK_OF(OCSP_SINGLERESP) *responses;
278 STACK_OF(X509_EXTENSION) *responseExtensions; 266 STACK_OF(X509_EXTENSION) *responseExtensions;
279 } OCSP_RESPDATA; 267} OCSP_RESPDATA;
280 268
281/* BasicOCSPResponse ::= SEQUENCE { 269/* BasicOCSPResponse ::= SEQUENCE {
282 * tbsResponseData ResponseData, 270 * tbsResponseData ResponseData,
@@ -300,13 +288,12 @@ typedef struct ocsp_response_data_st
300 that it doesn't do the double hashing that the RFC seems to say one 288 that it doesn't do the double hashing that the RFC seems to say one
301 should. Therefore, all relevant functions take a flag saying which 289 should. Therefore, all relevant functions take a flag saying which
302 variant should be used. -- Richard Levitte, OpenSSL team and CeloCom */ 290 variant should be used. -- Richard Levitte, OpenSSL team and CeloCom */
303typedef struct ocsp_basic_response_st 291typedef struct ocsp_basic_response_st {
304 {
305 OCSP_RESPDATA *tbsResponseData; 292 OCSP_RESPDATA *tbsResponseData;
306 X509_ALGOR *signatureAlgorithm; 293 X509_ALGOR *signatureAlgorithm;
307 ASN1_BIT_STRING *signature; 294 ASN1_BIT_STRING *signature;
308 STACK_OF(X509) *certs; 295 STACK_OF(X509) *certs;
309 } OCSP_BASICRESP; 296} OCSP_BASICRESP;
310 297
311/* 298/*
312 * CRLReason ::= ENUMERATED { 299 * CRLReason ::= ENUMERATED {
@@ -319,164 +306,159 @@ typedef struct ocsp_basic_response_st
319 * certificateHold (6), 306 * certificateHold (6),
320 * removeFromCRL (8) } 307 * removeFromCRL (8) }
321 */ 308 */
322#define OCSP_REVOKED_STATUS_NOSTATUS -1 309#define OCSP_REVOKED_STATUS_NOSTATUS -1
323#define OCSP_REVOKED_STATUS_UNSPECIFIED 0 310#define OCSP_REVOKED_STATUS_UNSPECIFIED 0
324#define OCSP_REVOKED_STATUS_KEYCOMPROMISE 1 311#define OCSP_REVOKED_STATUS_KEYCOMPROMISE 1
325#define OCSP_REVOKED_STATUS_CACOMPROMISE 2 312#define OCSP_REVOKED_STATUS_CACOMPROMISE 2
326#define OCSP_REVOKED_STATUS_AFFILIATIONCHANGED 3 313#define OCSP_REVOKED_STATUS_AFFILIATIONCHANGED 3
327#define OCSP_REVOKED_STATUS_SUPERSEDED 4 314#define OCSP_REVOKED_STATUS_SUPERSEDED 4
328#define OCSP_REVOKED_STATUS_CESSATIONOFOPERATION 5 315#define OCSP_REVOKED_STATUS_CESSATIONOFOPERATION 5
329#define OCSP_REVOKED_STATUS_CERTIFICATEHOLD 6 316#define OCSP_REVOKED_STATUS_CERTIFICATEHOLD 6
330#define OCSP_REVOKED_STATUS_REMOVEFROMCRL 8 317#define OCSP_REVOKED_STATUS_REMOVEFROMCRL 8
331 318
332/* CrlID ::= SEQUENCE { 319/* CrlID ::= SEQUENCE {
333 * crlUrl [0] EXPLICIT IA5String OPTIONAL, 320 * crlUrl [0] EXPLICIT IA5String OPTIONAL,
334 * crlNum [1] EXPLICIT INTEGER OPTIONAL, 321 * crlNum [1] EXPLICIT INTEGER OPTIONAL,
335 * crlTime [2] EXPLICIT GeneralizedTime OPTIONAL } 322 * crlTime [2] EXPLICIT GeneralizedTime OPTIONAL }
336 */ 323 */
337typedef struct ocsp_crl_id_st 324typedef struct ocsp_crl_id_st {
338 {
339 ASN1_IA5STRING *crlUrl; 325 ASN1_IA5STRING *crlUrl;
340 ASN1_INTEGER *crlNum; 326 ASN1_INTEGER *crlNum;
341 ASN1_GENERALIZEDTIME *crlTime; 327 ASN1_GENERALIZEDTIME *crlTime;
342 } OCSP_CRLID; 328} OCSP_CRLID;
343 329
344/* ServiceLocator ::= SEQUENCE { 330/* ServiceLocator ::= SEQUENCE {
345 * issuer Name, 331 * issuer Name,
346 * locator AuthorityInfoAccessSyntax OPTIONAL } 332 * locator AuthorityInfoAccessSyntax OPTIONAL }
347 */ 333 */
348typedef struct ocsp_service_locator_st 334typedef struct ocsp_service_locator_st {
349 {
350 X509_NAME* issuer; 335 X509_NAME* issuer;
351 STACK_OF(ACCESS_DESCRIPTION) *locator; 336 STACK_OF(ACCESS_DESCRIPTION) *locator;
352 } OCSP_SERVICELOC; 337} OCSP_SERVICELOC;
353 338
354#define PEM_STRING_OCSP_REQUEST "OCSP REQUEST" 339#define PEM_STRING_OCSP_REQUEST "OCSP REQUEST"
355#define PEM_STRING_OCSP_RESPONSE "OCSP RESPONSE" 340#define PEM_STRING_OCSP_RESPONSE "OCSP RESPONSE"
356 341
357#define d2i_OCSP_REQUEST_bio(bp,p) ASN1_d2i_bio_of(OCSP_REQUEST,OCSP_REQUEST_new,d2i_OCSP_REQUEST,bp,p) 342#define d2i_OCSP_REQUEST_bio(bp,p) \
343 ASN1_d2i_bio_of(OCSP_REQUEST,OCSP_REQUEST_new,d2i_OCSP_REQUEST,bp,p)
358 344
359#define d2i_OCSP_RESPONSE_bio(bp,p) ASN1_d2i_bio_of(OCSP_RESPONSE,OCSP_RESPONSE_new,d2i_OCSP_RESPONSE,bp,p) 345#define d2i_OCSP_RESPONSE_bio(bp,p) \
346 ASN1_d2i_bio_of(OCSP_RESPONSE,OCSP_RESPONSE_new,d2i_OCSP_RESPONSE,bp,p)
360 347
361#define PEM_read_bio_OCSP_REQUEST(bp,x,cb) (OCSP_REQUEST *)PEM_ASN1_read_bio( \ 348#define PEM_read_bio_OCSP_REQUEST(bp,x,cb) \
362 (char *(*)())d2i_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,bp,(char **)x,cb,NULL) 349 (OCSP_REQUEST *)PEM_ASN1_read_bio((char *(*)())d2i_OCSP_REQUEST, \
350 PEM_STRING_OCSP_REQUEST,bp,(char **)x,cb,NULL)
363 351
364#define PEM_read_bio_OCSP_RESPONSE(bp,x,cb)(OCSP_RESPONSE *)PEM_ASN1_read_bio(\ 352#define PEM_read_bio_OCSP_RESPONSE(bp,x,cb) \
365 (char *(*)())d2i_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,bp,(char **)x,cb,NULL) 353 (OCSP_RESPONSE *)PEM_ASN1_read_bio((char *(*)())d2i_OCSP_RESPONSE, \
354 PEM_STRING_OCSP_RESPONSE,bp,(char **)x,cb,NULL)
366 355
367#define PEM_write_bio_OCSP_REQUEST(bp,o) \ 356#define PEM_write_bio_OCSP_REQUEST(bp,o) \
368 PEM_ASN1_write_bio((int (*)())i2d_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,\ 357 PEM_ASN1_write_bio((int (*)())i2d_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,\
369 bp,(char *)o, NULL,NULL,0,NULL,NULL) 358 bp,(char *)o, NULL,NULL,0,NULL,NULL)
370 359
371#define PEM_write_bio_OCSP_RESPONSE(bp,o) \ 360#define PEM_write_bio_OCSP_RESPONSE(bp,o) \
372 PEM_ASN1_write_bio((int (*)())i2d_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,\ 361 PEM_ASN1_write_bio((int (*)())i2d_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,\
373 bp,(char *)o, NULL,NULL,0,NULL,NULL) 362 bp,(char *)o, NULL,NULL,0,NULL,NULL)
374 363
375#define i2d_OCSP_RESPONSE_bio(bp,o) ASN1_i2d_bio_of(OCSP_RESPONSE,i2d_OCSP_RESPONSE,bp,o) 364#define i2d_OCSP_RESPONSE_bio(bp,o) \
365 ASN1_i2d_bio_of(OCSP_RESPONSE,i2d_OCSP_RESPONSE,bp,o)
376 366
377#define i2d_OCSP_REQUEST_bio(bp,o) ASN1_i2d_bio_of(OCSP_REQUEST,i2d_OCSP_REQUEST,bp,o) 367#define i2d_OCSP_REQUEST_bio(bp,o) \
368 ASN1_i2d_bio_of(OCSP_REQUEST,i2d_OCSP_REQUEST,bp,o)
378 369
379#define OCSP_REQUEST_sign(o,pkey,md) \ 370#define OCSP_REQUEST_sign(o,pkey,md) \
380 ASN1_item_sign(ASN1_ITEM_rptr(OCSP_REQINFO),\ 371 ASN1_item_sign(ASN1_ITEM_rptr(OCSP_REQINFO), \
381 o->optionalSignature->signatureAlgorithm,NULL,\ 372 o->optionalSignature->signatureAlgorithm,NULL, \
382 o->optionalSignature->signature,o->tbsRequest,pkey,md) 373 o->optionalSignature->signature,o->tbsRequest,pkey,md)
383 374
384#define OCSP_BASICRESP_sign(o,pkey,md,d) \ 375#define OCSP_BASICRESP_sign(o,pkey,md,d) \
385 ASN1_item_sign(ASN1_ITEM_rptr(OCSP_RESPDATA),o->signatureAlgorithm,NULL,\ 376 ASN1_item_sign(ASN1_ITEM_rptr(OCSP_RESPDATA),o->signatureAlgorithm,NULL, \
386 o->signature,o->tbsResponseData,pkey,md) 377 o->signature,o->tbsResponseData,pkey,md)
387 378
388#define OCSP_REQUEST_verify(a,r) ASN1_item_verify(ASN1_ITEM_rptr(OCSP_REQINFO),\ 379#define OCSP_REQUEST_verify(a,r) \
389 a->optionalSignature->signatureAlgorithm,\ 380 ASN1_item_verify(ASN1_ITEM_rptr(OCSP_REQINFO), \
381 a->optionalSignature->signatureAlgorithm, \
390 a->optionalSignature->signature,a->tbsRequest,r) 382 a->optionalSignature->signature,a->tbsRequest,r)
391 383
392#define OCSP_BASICRESP_verify(a,r,d) ASN1_item_verify(ASN1_ITEM_rptr(OCSP_RESPDATA),\ 384#define OCSP_BASICRESP_verify(a,r,d) \
385 ASN1_item_verify(ASN1_ITEM_rptr(OCSP_RESPDATA), \
393 a->signatureAlgorithm,a->signature,a->tbsResponseData,r) 386 a->signatureAlgorithm,a->signature,a->tbsResponseData,r)
394 387
395#define ASN1_BIT_STRING_digest(data,type,md,len) \ 388#define ASN1_BIT_STRING_digest(data,type,md,len) \
396 ASN1_item_digest(ASN1_ITEM_rptr(ASN1_BIT_STRING),type,data,md,len) 389 ASN1_item_digest(ASN1_ITEM_rptr(ASN1_BIT_STRING),type,data,md,len)
397 390
398#define OCSP_CERTSTATUS_dup(cs)\ 391#define OCSP_CERTSTATUS_dup(cs)\
399 (OCSP_CERTSTATUS*)ASN1_dup((int(*)())i2d_OCSP_CERTSTATUS,\ 392 (OCSP_CERTSTATUS*)ASN1_dup((int(*)())i2d_OCSP_CERTSTATUS,\
400 (char *(*)())d2i_OCSP_CERTSTATUS,(char *)(cs)) 393 (char *(*)())d2i_OCSP_CERTSTATUS,(char *)(cs))
401 394
402OCSP_CERTID *OCSP_CERTID_dup(OCSP_CERTID *id); 395OCSP_CERTID *OCSP_CERTID_dup(OCSP_CERTID *id);
403 396
404OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req); 397OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req);
405OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req, 398OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req,
406 int maxline); 399 int maxline);
407int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx); 400int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx);
408void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx); 401void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx);
409int OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, OCSP_REQUEST *req); 402int OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, OCSP_REQUEST *req);
410int OCSP_REQ_CTX_add1_header(OCSP_REQ_CTX *rctx, 403int OCSP_REQ_CTX_add1_header(OCSP_REQ_CTX *rctx, const char *name,
411 const char *name, const char *value); 404 const char *value);
412 405
413OCSP_CERTID *OCSP_cert_to_id(const EVP_MD *dgst, X509 *subject, X509 *issuer); 406OCSP_CERTID *OCSP_cert_to_id(const EVP_MD *dgst, X509 *subject, X509 *issuer);
414 407
415OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst, 408OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst, X509_NAME *issuerName,
416 X509_NAME *issuerName, 409 ASN1_BIT_STRING* issuerKey, ASN1_INTEGER *serialNumber);
417 ASN1_BIT_STRING* issuerKey,
418 ASN1_INTEGER *serialNumber);
419 410
420OCSP_ONEREQ *OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid); 411OCSP_ONEREQ *OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid);
421 412
422int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len); 413int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len);
423int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len); 414int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len);
424int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs); 415int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs);
425int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req); 416int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req);
426 417
427int OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm); 418int OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm);
428int OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert); 419int OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert);
429 420
430int OCSP_request_sign(OCSP_REQUEST *req, 421int OCSP_request_sign(OCSP_REQUEST *req, X509 *signer, EVP_PKEY *key,
431 X509 *signer, 422 const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags);
432 EVP_PKEY *key,
433 const EVP_MD *dgst,
434 STACK_OF(X509) *certs,
435 unsigned long flags);
436 423
437int OCSP_response_status(OCSP_RESPONSE *resp); 424int OCSP_response_status(OCSP_RESPONSE *resp);
438OCSP_BASICRESP *OCSP_response_get1_basic(OCSP_RESPONSE *resp); 425OCSP_BASICRESP *OCSP_response_get1_basic(OCSP_RESPONSE *resp);
439 426
440int OCSP_resp_count(OCSP_BASICRESP *bs); 427int OCSP_resp_count(OCSP_BASICRESP *bs);
441OCSP_SINGLERESP *OCSP_resp_get0(OCSP_BASICRESP *bs, int idx); 428OCSP_SINGLERESP *OCSP_resp_get0(OCSP_BASICRESP *bs, int idx);
442int OCSP_resp_find(OCSP_BASICRESP *bs, OCSP_CERTID *id, int last); 429int OCSP_resp_find(OCSP_BASICRESP *bs, OCSP_CERTID *id, int last);
443int OCSP_single_get0_status(OCSP_SINGLERESP *single, int *reason, 430int OCSP_single_get0_status(OCSP_SINGLERESP *single, int *reason,
444 ASN1_GENERALIZEDTIME **revtime, 431 ASN1_GENERALIZEDTIME **revtime, ASN1_GENERALIZEDTIME **thisupd,
445 ASN1_GENERALIZEDTIME **thisupd, 432 ASN1_GENERALIZEDTIME **nextupd);
446 ASN1_GENERALIZEDTIME **nextupd); 433int OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status,
447int OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status, 434 int *reason, ASN1_GENERALIZEDTIME **revtime,
448 int *reason, 435 ASN1_GENERALIZEDTIME **thisupd, ASN1_GENERALIZEDTIME **nextupd);
449 ASN1_GENERALIZEDTIME **revtime, 436int OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
450 ASN1_GENERALIZEDTIME **thisupd, 437 ASN1_GENERALIZEDTIME *nextupd, long sec, long maxsec);
451 ASN1_GENERALIZEDTIME **nextupd); 438
452int OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd, 439int OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs,
453 ASN1_GENERALIZEDTIME *nextupd, 440 X509_STORE *store, unsigned long flags);
454 long sec, long maxsec); 441
455 442int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath,
456int OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *store, unsigned long flags); 443 int *pssl);
457 444
458int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pssl); 445int OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b);
459 446int OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b);
460int OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b); 447
461int OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b); 448int OCSP_request_onereq_count(OCSP_REQUEST *req);
462
463int OCSP_request_onereq_count(OCSP_REQUEST *req);
464OCSP_ONEREQ *OCSP_request_onereq_get0(OCSP_REQUEST *req, int i); 449OCSP_ONEREQ *OCSP_request_onereq_get0(OCSP_REQUEST *req, int i);
465OCSP_CERTID *OCSP_onereq_get0_id(OCSP_ONEREQ *one); 450OCSP_CERTID *OCSP_onereq_get0_id(OCSP_ONEREQ *one);
466int OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd, 451int OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd,
467 ASN1_OCTET_STRING **pikeyHash, 452 ASN1_OCTET_STRING **pikeyHash, ASN1_INTEGER **pserial,
468 ASN1_INTEGER **pserial, OCSP_CERTID *cid); 453 OCSP_CERTID *cid);
469int OCSP_request_is_signed(OCSP_REQUEST *req); 454int OCSP_request_is_signed(OCSP_REQUEST *req);
470OCSP_RESPONSE *OCSP_response_create(int status, OCSP_BASICRESP *bs); 455OCSP_RESPONSE *OCSP_response_create(int status, OCSP_BASICRESP *bs);
471OCSP_SINGLERESP *OCSP_basic_add1_status(OCSP_BASICRESP *rsp, 456OCSP_SINGLERESP *OCSP_basic_add1_status(OCSP_BASICRESP *rsp, OCSP_CERTID *cid,
472 OCSP_CERTID *cid, 457 int status, int reason, ASN1_TIME *revtime, ASN1_TIME *thisupd,
473 int status, int reason, 458 ASN1_TIME *nextupd);
474 ASN1_TIME *revtime, 459int OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert);
475 ASN1_TIME *thisupd, ASN1_TIME *nextupd); 460int OCSP_basic_sign(OCSP_BASICRESP *brsp, X509 *signer, EVP_PKEY *key,
476int OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert); 461 const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags);
477int OCSP_basic_sign(OCSP_BASICRESP *brsp,
478 X509 *signer, EVP_PKEY *key, const EVP_MD *dgst,
479 STACK_OF(X509) *certs, unsigned long flags);
480 462
481X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim); 463X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim);
482 464
@@ -486,49 +468,60 @@ X509_EXTENSION *OCSP_archive_cutoff_new(char* tim);
486 468
487X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, char **urls); 469X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, char **urls);
488 470
489int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x); 471int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x);
490int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos); 472int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos);
491int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj, int lastpos); 473int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj,
492int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos); 474 int lastpos);
475int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit,
476 int lastpos);
493X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc); 477X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc);
494X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc); 478X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc);
495void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx); 479void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx);
496int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, int crit, 480int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value,
497 unsigned long flags); 481 int crit, unsigned long flags);
498int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc); 482int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc);
499 483
500int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x); 484int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x);
501int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos); 485int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos);
502int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj, int lastpos); 486int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj,
503int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos); 487 int lastpos);
488int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos);
504X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc); 489X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc);
505X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc); 490X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc);
506void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx); 491void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx);
507int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit, 492int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit,
508 unsigned long flags); 493 unsigned long flags);
509int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc); 494int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc);
510 495
511int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x); 496int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x);
512int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos); 497int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos);
513int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj, int lastpos); 498int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj,
514int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit, int lastpos); 499 int lastpos);
500int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit,
501 int lastpos);
515X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc); 502X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc);
516X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc); 503X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc);
517void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit, int *idx); 504void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit,
518int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value, int crit, 505 int *idx);
519 unsigned long flags); 506int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value,
520int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc); 507 int crit, unsigned long flags);
521 508int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc);
522int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x); 509
523int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos); 510int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x);
524int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj, int lastpos); 511int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid,
525int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit, int lastpos); 512 int lastpos);
513int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj,
514 int lastpos);
515int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit,
516 int lastpos);
526X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc); 517X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc);
527X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc); 518X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc);
528void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit, int *idx); 519void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit,
529int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value, int crit, 520 int *idx);
530 unsigned long flags); 521int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value,
531int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc); 522 int crit, unsigned long flags);
523int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex,
524 int loc);
532 525
533DECLARE_ASN1_FUNCTIONS(OCSP_SINGLERESP) 526DECLARE_ASN1_FUNCTIONS(OCSP_SINGLERESP)
534DECLARE_ASN1_FUNCTIONS(OCSP_CERTSTATUS) 527DECLARE_ASN1_FUNCTIONS(OCSP_CERTSTATUS)
@@ -550,11 +543,11 @@ const char *OCSP_response_status_str(long s);
550const char *OCSP_cert_status_str(long s); 543const char *OCSP_cert_status_str(long s);
551const char *OCSP_crl_reason_str(long s); 544const char *OCSP_crl_reason_str(long s);
552 545
553int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* a, unsigned long flags); 546int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* a, unsigned long flags);
554int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags); 547int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags);
555 548
556int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, 549int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
557 X509_STORE *st, unsigned long flags); 550 X509_STORE *st, unsigned long flags);
558 551
559/* BEGIN ERROR CODES */ 552/* BEGIN ERROR CODES */
560/* The following lines are auto generated by the script mkerr.pl. Any changes 553/* The following lines are auto generated by the script mkerr.pl. Any changes
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_cl.c b/src/lib/libssl/src/crypto/ocsp/ocsp_cl.c
index 9c14d9da27..716513d2f9 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_cl.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_cl.c
@@ -78,229 +78,241 @@
78/* Add an OCSP_CERTID to an OCSP request. Return new OCSP_ONEREQ 78/* Add an OCSP_CERTID to an OCSP request. Return new OCSP_ONEREQ
79 * pointer: useful if we want to add extensions. 79 * pointer: useful if we want to add extensions.
80 */ 80 */
81 81OCSP_ONEREQ *
82OCSP_ONEREQ *OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid) 82OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid)
83 { 83{
84 OCSP_ONEREQ *one = NULL; 84 OCSP_ONEREQ *one = NULL;
85 85
86 if (!(one = OCSP_ONEREQ_new())) goto err; 86 if (!(one = OCSP_ONEREQ_new()))
87 if (one->reqCert) OCSP_CERTID_free(one->reqCert); 87 goto err;
88 if (one->reqCert)
89 OCSP_CERTID_free(one->reqCert);
88 one->reqCert = cid; 90 one->reqCert = cid;
89 if (req && 91 if (req && !sk_OCSP_ONEREQ_push(req->tbsRequest->requestList, one))
90 !sk_OCSP_ONEREQ_push(req->tbsRequest->requestList, one)) 92 goto err;
91 goto err;
92 return one; 93 return one;
93err: 94err:
94 OCSP_ONEREQ_free(one); 95 OCSP_ONEREQ_free(one);
95 return NULL; 96 return NULL;
96 } 97}
97 98
98/* Set requestorName from an X509_NAME structure */ 99/* Set requestorName from an X509_NAME structure */
99 100int
100int OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm) 101OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm)
101 { 102{
102 GENERAL_NAME *gen; 103 GENERAL_NAME *gen;
104
103 gen = GENERAL_NAME_new(); 105 gen = GENERAL_NAME_new();
104 if (gen == NULL) 106 if (gen == NULL)
105 return 0; 107 return 0;
106 if (!X509_NAME_set(&gen->d.directoryName, nm)) 108 if (!X509_NAME_set(&gen->d.directoryName, nm)) {
107 {
108 GENERAL_NAME_free(gen); 109 GENERAL_NAME_free(gen);
109 return 0; 110 return 0;
110 } 111 }
111 gen->type = GEN_DIRNAME; 112 gen->type = GEN_DIRNAME;
112 if (req->tbsRequest->requestorName) 113 if (req->tbsRequest->requestorName)
113 GENERAL_NAME_free(req->tbsRequest->requestorName); 114 GENERAL_NAME_free(req->tbsRequest->requestorName);
114 req->tbsRequest->requestorName = gen; 115 req->tbsRequest->requestorName = gen;
115 return 1; 116 return 1;
116 } 117}
117 118
118
119/* Add a certificate to an OCSP request */ 119/* Add a certificate to an OCSP request */
120 120int
121int OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert) 121OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert)
122 { 122{
123 OCSP_SIGNATURE *sig; 123 OCSP_SIGNATURE *sig;
124
124 if (!req->optionalSignature) 125 if (!req->optionalSignature)
125 req->optionalSignature = OCSP_SIGNATURE_new(); 126 req->optionalSignature = OCSP_SIGNATURE_new();
126 sig = req->optionalSignature; 127 sig = req->optionalSignature;
127 if (!sig) return 0; 128 if (!sig)
128 if (!cert) return 1; 129 return 0;
130 if (!cert)
131 return 1;
129 if (!sig->certs && !(sig->certs = sk_X509_new_null())) 132 if (!sig->certs && !(sig->certs = sk_X509_new_null()))
130 return 0; 133 return 0;
131 134
132 if(!sk_X509_push(sig->certs, cert)) return 0; 135 if(!sk_X509_push(sig->certs, cert))
136 return 0;
133 CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509); 137 CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509);
134 return 1; 138 return 1;
135 } 139}
136 140
137/* Sign an OCSP request set the requestorName to the subjec 141/* Sign an OCSP request set the requestorName to the subjec
138 * name of an optional signers certificate and include one 142 * name of an optional signers certificate and include one
139 * or more optional certificates in the request. Behaves 143 * or more optional certificates in the request. Behaves
140 * like PKCS7_sign(). 144 * like PKCS7_sign().
141 */ 145 */
142 146int
143int OCSP_request_sign(OCSP_REQUEST *req, 147OCSP_request_sign(OCSP_REQUEST *req, X509 *signer, EVP_PKEY *key,
144 X509 *signer, 148 const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags)
145 EVP_PKEY *key, 149{
146 const EVP_MD *dgst,
147 STACK_OF(X509) *certs,
148 unsigned long flags)
149 {
150 int i; 150 int i;
151 OCSP_SIGNATURE *sig; 151 OCSP_SIGNATURE *sig;
152 X509 *x; 152 X509 *x;
153 153
154 if (!OCSP_request_set1_name(req, X509_get_subject_name(signer))) 154 if (!OCSP_request_set1_name(req, X509_get_subject_name(signer)))
155 goto err;
156
157 if (!(req->optionalSignature = sig = OCSP_SIGNATURE_new()))
158 goto err;
159 if (key) {
160 if (!X509_check_private_key(signer, key)) {
161 OCSPerr(OCSP_F_OCSP_REQUEST_SIGN,
162 OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
155 goto err; 163 goto err;
156
157 if (!(req->optionalSignature = sig = OCSP_SIGNATURE_new())) goto err;
158 if (key)
159 {
160 if (!X509_check_private_key(signer, key))
161 {
162 OCSPerr(OCSP_F_OCSP_REQUEST_SIGN, OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
163 goto err;
164 }
165 if (!OCSP_REQUEST_sign(req, key, dgst)) goto err;
166 } 164 }
165 if (!OCSP_REQUEST_sign(req, key, dgst))
166 goto err;
167 }
167 168
168 if (!(flags & OCSP_NOCERTS)) 169 if (!(flags & OCSP_NOCERTS)) {
169 { 170 if(!OCSP_request_add1_cert(req, signer))
170 if(!OCSP_request_add1_cert(req, signer)) goto err; 171 goto err;
171 for (i = 0; i < sk_X509_num(certs); i++) 172 for (i = 0; i < sk_X509_num(certs); i++) {
172 {
173 x = sk_X509_value(certs, i); 173 x = sk_X509_value(certs, i);
174 if (!OCSP_request_add1_cert(req, x)) goto err; 174 if (!OCSP_request_add1_cert(req, x))
175 } 175 goto err;
176 } 176 }
177 }
177 178
178 return 1; 179 return 1;
179err: 180err:
180 OCSP_SIGNATURE_free(req->optionalSignature); 181 OCSP_SIGNATURE_free(req->optionalSignature);
181 req->optionalSignature = NULL; 182 req->optionalSignature = NULL;
182 return 0; 183 return 0;
183 } 184}
184 185
185/* Get response status */ 186/* Get response status */
186 187int
187int OCSP_response_status(OCSP_RESPONSE *resp) 188OCSP_response_status(OCSP_RESPONSE *resp)
188 { 189{
189 return ASN1_ENUMERATED_get(resp->responseStatus); 190 return ASN1_ENUMERATED_get(resp->responseStatus);
190 } 191}
191 192
192/* Extract basic response from OCSP_RESPONSE or NULL if 193/* Extract basic response from OCSP_RESPONSE or NULL if
193 * no basic response present. 194 * no basic response present.
194 */ 195 */
195 196OCSP_BASICRESP *
196 197OCSP_response_get1_basic(OCSP_RESPONSE *resp)
197OCSP_BASICRESP *OCSP_response_get1_basic(OCSP_RESPONSE *resp) 198{
198 {
199 OCSP_RESPBYTES *rb; 199 OCSP_RESPBYTES *rb;
200
200 rb = resp->responseBytes; 201 rb = resp->responseBytes;
201 if (!rb) 202 if (!rb) {
202 { 203 OCSPerr(OCSP_F_OCSP_RESPONSE_GET1_BASIC,
203 OCSPerr(OCSP_F_OCSP_RESPONSE_GET1_BASIC, OCSP_R_NO_RESPONSE_DATA); 204 OCSP_R_NO_RESPONSE_DATA);
204 return NULL; 205 return NULL;
205 } 206 }
206 if (OBJ_obj2nid(rb->responseType) != NID_id_pkix_OCSP_basic) 207 if (OBJ_obj2nid(rb->responseType) != NID_id_pkix_OCSP_basic) {
207 { 208 OCSPerr(OCSP_F_OCSP_RESPONSE_GET1_BASIC,
208 OCSPerr(OCSP_F_OCSP_RESPONSE_GET1_BASIC, OCSP_R_NOT_BASIC_RESPONSE); 209 OCSP_R_NOT_BASIC_RESPONSE);
209 return NULL; 210 return NULL;
210 } 211 }
211 212
212 return ASN1_item_unpack(rb->response, ASN1_ITEM_rptr(OCSP_BASICRESP)); 213 return ASN1_item_unpack(rb->response, ASN1_ITEM_rptr(OCSP_BASICRESP));
213 } 214}
214 215
215/* Return number of OCSP_SINGLERESP reponses present in 216/* Return number of OCSP_SINGLERESP reponses present in
216 * a basic response. 217 * a basic response.
217 */ 218 */
218 219int
219int OCSP_resp_count(OCSP_BASICRESP *bs) 220OCSP_resp_count(OCSP_BASICRESP *bs)
220 { 221{
221 if (!bs) return -1; 222 if (!bs)
223 return -1;
222 return sk_OCSP_SINGLERESP_num(bs->tbsResponseData->responses); 224 return sk_OCSP_SINGLERESP_num(bs->tbsResponseData->responses);
223 } 225}
224 226
225/* Extract an OCSP_SINGLERESP response with a given index */ 227/* Extract an OCSP_SINGLERESP response with a given index */
226 228OCSP_SINGLERESP *
227OCSP_SINGLERESP *OCSP_resp_get0(OCSP_BASICRESP *bs, int idx) 229OCSP_resp_get0(OCSP_BASICRESP *bs, int idx)
228 { 230{
229 if (!bs) return NULL; 231 if (!bs)
232 return NULL;
230 return sk_OCSP_SINGLERESP_value(bs->tbsResponseData->responses, idx); 233 return sk_OCSP_SINGLERESP_value(bs->tbsResponseData->responses, idx);
231 } 234}
232 235
233/* Look single response matching a given certificate ID */ 236/* Look single response matching a given certificate ID */
234 237int
235int OCSP_resp_find(OCSP_BASICRESP *bs, OCSP_CERTID *id, int last) 238OCSP_resp_find(OCSP_BASICRESP *bs, OCSP_CERTID *id, int last)
236 { 239{
237 int i; 240 int i;
238 STACK_OF(OCSP_SINGLERESP) *sresp; 241 STACK_OF(OCSP_SINGLERESP) *sresp;
239 OCSP_SINGLERESP *single; 242 OCSP_SINGLERESP *single;
240 if (!bs) return -1; 243
241 if (last < 0) last = 0; 244 if (!bs)
242 else last++; 245 return -1;
246 if (last < 0)
247 last = 0;
248 else
249 last++;
243 sresp = bs->tbsResponseData->responses; 250 sresp = bs->tbsResponseData->responses;
244 for (i = last; i < sk_OCSP_SINGLERESP_num(sresp); i++) 251 for (i = last; i < sk_OCSP_SINGLERESP_num(sresp); i++) {
245 {
246 single = sk_OCSP_SINGLERESP_value(sresp, i); 252 single = sk_OCSP_SINGLERESP_value(sresp, i);
247 if (!OCSP_id_cmp(id, single->certId)) return i; 253 if (!OCSP_id_cmp(id, single->certId))
248 } 254 return i;
249 return -1;
250 } 255 }
256 return -1;
257}
251 258
252/* Extract status information from an OCSP_SINGLERESP structure. 259/* Extract status information from an OCSP_SINGLERESP structure.
253 * Note: the revtime and reason values are only set if the 260 * Note: the revtime and reason values are only set if the
254 * certificate status is revoked. Returns numerical value of 261 * certificate status is revoked. Returns numerical value of
255 * status. 262 * status.
256 */ 263 */
257 264int
258int OCSP_single_get0_status(OCSP_SINGLERESP *single, int *reason, 265OCSP_single_get0_status(OCSP_SINGLERESP *single, int *reason,
259 ASN1_GENERALIZEDTIME **revtime, 266 ASN1_GENERALIZEDTIME **revtime, ASN1_GENERALIZEDTIME **thisupd,
260 ASN1_GENERALIZEDTIME **thisupd, 267 ASN1_GENERALIZEDTIME **nextupd)
261 ASN1_GENERALIZEDTIME **nextupd) 268{
262 {
263 int ret; 269 int ret;
264 OCSP_CERTSTATUS *cst; 270 OCSP_CERTSTATUS *cst;
265 if(!single) return -1; 271
272 if (!single)
273 return -1;
266 cst = single->certStatus; 274 cst = single->certStatus;
267 ret = cst->type; 275 ret = cst->type;
268 if (ret == V_OCSP_CERTSTATUS_REVOKED) 276 if (ret == V_OCSP_CERTSTATUS_REVOKED) {
269 {
270 OCSP_REVOKEDINFO *rev = cst->value.revoked; 277 OCSP_REVOKEDINFO *rev = cst->value.revoked;
271 if (revtime) *revtime = rev->revocationTime; 278
272 if (reason) 279 if (revtime)
273 { 280 *revtime = rev->revocationTime;
274 if(rev->revocationReason) 281 if (reason) {
282 if (rev->revocationReason)
275 *reason = ASN1_ENUMERATED_get(rev->revocationReason); 283 *reason = ASN1_ENUMERATED_get(rev->revocationReason);
276 else *reason = -1; 284 else
277 } 285 *reason = -1;
278 } 286 }
279 if(thisupd) *thisupd = single->thisUpdate;
280 if(nextupd) *nextupd = single->nextUpdate;
281 return ret;
282 } 287 }
288 if (thisupd)
289 *thisupd = single->thisUpdate;
290 if (nextupd)
291 *nextupd = single->nextUpdate;
292 return ret;
293}
283 294
284/* This function combines the previous ones: look up a certificate ID and 295/* This function combines the previous ones: look up a certificate ID and
285 * if found extract status information. Return 0 is successful. 296 * if found extract status information. Return 0 is successful.
286 */ 297 */
287 298int
288int OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status, 299OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status,
289 int *reason, 300 int *reason, ASN1_GENERALIZEDTIME **revtime, ASN1_GENERALIZEDTIME **thisupd,
290 ASN1_GENERALIZEDTIME **revtime, 301 ASN1_GENERALIZEDTIME **nextupd)
291 ASN1_GENERALIZEDTIME **thisupd, 302{
292 ASN1_GENERALIZEDTIME **nextupd)
293 {
294 int i; 303 int i;
295 OCSP_SINGLERESP *single; 304 OCSP_SINGLERESP *single;
305
296 i = OCSP_resp_find(bs, id, -1); 306 i = OCSP_resp_find(bs, id, -1);
297 /* Maybe check for multiple responses and give an error? */ 307 /* Maybe check for multiple responses and give an error? */
298 if(i < 0) return 0; 308 if (i < 0)
309 return 0;
299 single = OCSP_resp_get0(bs, i); 310 single = OCSP_resp_get0(bs, i);
300 i = OCSP_single_get0_status(single, reason, revtime, thisupd, nextupd); 311 i = OCSP_single_get0_status(single, reason, revtime, thisupd, nextupd);
301 if(status) *status = i; 312 if (status)
313 *status = i;
302 return 1; 314 return 1;
303 } 315}
304 316
305/* Check validity of thisUpdate and nextUpdate fields. It is possible that the request will 317/* Check validity of thisUpdate and nextUpdate fields. It is possible that the request will
306 * take a few seconds to process and/or the time wont be totally accurate. Therefore to avoid 318 * take a few seconds to process and/or the time wont be totally accurate. Therefore to avoid
@@ -308,64 +320,61 @@ int OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status,
308 * Also to avoid accepting very old responses without a nextUpdate field an optional maxage 320 * Also to avoid accepting very old responses without a nextUpdate field an optional maxage
309 * parameter specifies the maximum age the thisUpdate field can be. 321 * parameter specifies the maximum age the thisUpdate field can be.
310 */ 322 */
311 323int
312int OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd, ASN1_GENERALIZEDTIME *nextupd, long nsec, long maxsec) 324OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
313 { 325 ASN1_GENERALIZEDTIME *nextupd, long nsec, long maxsec)
326{
314 int ret = 1; 327 int ret = 1;
315 time_t t_now, t_tmp; 328 time_t t_now, t_tmp;
329
316 time(&t_now); 330 time(&t_now);
317 /* Check thisUpdate is valid and not more than nsec in the future */ 331 /* Check thisUpdate is valid and not more than nsec in the future */
318 if (!ASN1_GENERALIZEDTIME_check(thisupd)) 332 if (!ASN1_GENERALIZEDTIME_check(thisupd)) {
319 { 333 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY,
320 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, OCSP_R_ERROR_IN_THISUPDATE_FIELD); 334 OCSP_R_ERROR_IN_THISUPDATE_FIELD);
321 ret = 0; 335 ret = 0;
322 } 336 } else {
323 else 337 t_tmp = t_now + nsec;
324 { 338 if (X509_cmp_time(thisupd, &t_tmp) > 0) {
325 t_tmp = t_now + nsec; 339 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY,
326 if (X509_cmp_time(thisupd, &t_tmp) > 0) 340 OCSP_R_STATUS_NOT_YET_VALID);
327 {
328 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, OCSP_R_STATUS_NOT_YET_VALID);
329 ret = 0; 341 ret = 0;
330 } 342 }
331 343
332 /* If maxsec specified check thisUpdate is not more than maxsec in the past */ 344 /* If maxsec specified check thisUpdate is not more than maxsec in the past */
333 if (maxsec >= 0) 345 if (maxsec >= 0) {
334 {
335 t_tmp = t_now - maxsec; 346 t_tmp = t_now - maxsec;
336 if (X509_cmp_time(thisupd, &t_tmp) < 0) 347 if (X509_cmp_time(thisupd, &t_tmp) < 0) {
337 { 348 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY,
338 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, OCSP_R_STATUS_TOO_OLD); 349 OCSP_R_STATUS_TOO_OLD);
339 ret = 0; 350 ret = 0;
340 }
341 } 351 }
342 } 352 }
343 353 }
344 354
345 if (!nextupd) return ret; 355 if (!nextupd)
356 return ret;
346 357
347 /* Check nextUpdate is valid and not more than nsec in the past */ 358 /* Check nextUpdate is valid and not more than nsec in the past */
348 if (!ASN1_GENERALIZEDTIME_check(nextupd)) 359 if (!ASN1_GENERALIZEDTIME_check(nextupd)) {
349 { 360 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY,
350 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, OCSP_R_ERROR_IN_NEXTUPDATE_FIELD); 361 OCSP_R_ERROR_IN_NEXTUPDATE_FIELD);
351 ret = 0; 362 ret = 0;
352 } 363 } else {
353 else
354 {
355 t_tmp = t_now - nsec; 364 t_tmp = t_now - nsec;
356 if (X509_cmp_time(nextupd, &t_tmp) < 0) 365 if (X509_cmp_time(nextupd, &t_tmp) < 0) {
357 { 366 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY,
358 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, OCSP_R_STATUS_EXPIRED); 367 OCSP_R_STATUS_EXPIRED);
359 ret = 0; 368 ret = 0;
360 }
361 } 369 }
370 }
362 371
363 /* Also don't allow nextUpdate to precede thisUpdate */ 372 /* Also don't allow nextUpdate to precede thisUpdate */
364 if (ASN1_STRING_cmp(nextupd, thisupd) < 0) 373 if (ASN1_STRING_cmp(nextupd, thisupd) < 0) {
365 { 374 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY,
366 OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE); 375 OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE);
367 ret = 0; 376 ret = 0;
368 } 377 }
369 378
370 return ret; 379 return ret;
371 } 380}
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_ext.c b/src/lib/libssl/src/crypto/ocsp/ocsp_ext.c
index 9c7832b301..6ec8ca4adf 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_ext.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_ext.c
@@ -73,238 +73,285 @@
73 73
74/* OCSP request extensions */ 74/* OCSP request extensions */
75 75
76int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x) 76int
77 { 77OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x)
78 return(X509v3_get_ext_count(x->tbsRequest->requestExtensions)); 78{
79 } 79 return X509v3_get_ext_count(x->tbsRequest->requestExtensions);
80 80}
81int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos) 81
82 { 82int
83 return(X509v3_get_ext_by_NID(x->tbsRequest->requestExtensions,nid,lastpos)); 83OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos)
84 } 84{
85 85 return X509v3_get_ext_by_NID(x->tbsRequest->requestExtensions, nid,
86int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj, int lastpos) 86 lastpos);
87 { 87}
88 return(X509v3_get_ext_by_OBJ(x->tbsRequest->requestExtensions,obj,lastpos)); 88
89 } 89int
90 90OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj, int lastpos)
91int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos) 91{
92 { 92 return X509v3_get_ext_by_OBJ(x->tbsRequest->requestExtensions, obj,
93 return(X509v3_get_ext_by_critical(x->tbsRequest->requestExtensions,crit,lastpos)); 93 lastpos);
94 } 94}
95 95
96X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc) 96int
97 { 97OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos)
98 return(X509v3_get_ext(x->tbsRequest->requestExtensions,loc)); 98{
99 } 99 return X509v3_get_ext_by_critical(x->tbsRequest->requestExtensions,
100 100 crit, lastpos);
101X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc) 101}
102 { 102
103 return(X509v3_delete_ext(x->tbsRequest->requestExtensions,loc)); 103X509_EXTENSION *
104 } 104OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc)
105 105{
106void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx) 106 return X509v3_get_ext(x->tbsRequest->requestExtensions, loc);
107 { 107}
108
109X509_EXTENSION *
110OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc)
111{
112 return X509v3_delete_ext(x->tbsRequest->requestExtensions, loc);
113}
114
115void *
116OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx)
117{
108 return X509V3_get_d2i(x->tbsRequest->requestExtensions, nid, crit, idx); 118 return X509V3_get_d2i(x->tbsRequest->requestExtensions, nid, crit, idx);
109 } 119}
110 120
111int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, int crit, 121int
112 unsigned long flags) 122OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, int crit,
113 { 123 unsigned long flags)
114 return X509V3_add1_i2d(&x->tbsRequest->requestExtensions, nid, value, crit, flags); 124{
115 } 125 return X509V3_add1_i2d(&x->tbsRequest->requestExtensions, nid, value,
116 126 crit, flags);
117int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc) 127}
118 { 128
119 return(X509v3_add_ext(&(x->tbsRequest->requestExtensions),ex,loc) != NULL); 129int
120 } 130OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc)
131{
132 return X509v3_add_ext(&(x->tbsRequest->requestExtensions), ex, loc) !=
133 NULL;
134}
121 135
122/* Single extensions */ 136/* Single extensions */
123 137
124int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x) 138int
125 { 139OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x)
126 return(X509v3_get_ext_count(x->singleRequestExtensions)); 140{
127 } 141 return X509v3_get_ext_count(x->singleRequestExtensions);
128 142}
129int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos) 143
130 { 144int
131 return(X509v3_get_ext_by_NID(x->singleRequestExtensions,nid,lastpos)); 145OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos)
132 } 146{
133 147 return X509v3_get_ext_by_NID(x->singleRequestExtensions, nid, lastpos);
134int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj, int lastpos) 148}
135 { 149
136 return(X509v3_get_ext_by_OBJ(x->singleRequestExtensions,obj,lastpos)); 150int
137 } 151OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj, int lastpos)
138 152{
139int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos) 153 return X509v3_get_ext_by_OBJ(x->singleRequestExtensions, obj, lastpos);
140 { 154}
141 return(X509v3_get_ext_by_critical(x->singleRequestExtensions,crit,lastpos)); 155
142 } 156int
143 157OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos)
144X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc) 158{
145 { 159 return X509v3_get_ext_by_critical(x->singleRequestExtensions, crit,
146 return(X509v3_get_ext(x->singleRequestExtensions,loc)); 160 lastpos);
147 } 161}
148 162
149X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc) 163X509_EXTENSION *
150 { 164OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc)
151 return(X509v3_delete_ext(x->singleRequestExtensions,loc)); 165{
152 } 166 return X509v3_get_ext(x->singleRequestExtensions, loc);
167}
168
169X509_EXTENSION *
170OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc)
171{
172 return X509v3_delete_ext(x->singleRequestExtensions, loc);
173}
153 174
154void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx) 175void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx)
155 { 176{
156 return X509V3_get_d2i(x->singleRequestExtensions, nid, crit, idx); 177 return X509V3_get_d2i(x->singleRequestExtensions, nid, crit, idx);
157 } 178}
158 179
159int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit, 180int
160 unsigned long flags) 181OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit,
161 { 182 unsigned long flags)
162 return X509V3_add1_i2d(&x->singleRequestExtensions, nid, value, crit, flags); 183{
163 } 184 return X509V3_add1_i2d(&x->singleRequestExtensions, nid, value, crit,
164 185 flags);
165int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc) 186}
166 { 187
167 return(X509v3_add_ext(&(x->singleRequestExtensions),ex,loc) != NULL); 188int
168 } 189OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc)
190{
191 return X509v3_add_ext(&(x->singleRequestExtensions), ex, loc) != NULL;
192}
169 193
170/* OCSP Basic response */ 194/* OCSP Basic response */
171 195
172int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x) 196int
173 { 197OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x)
174 return(X509v3_get_ext_count(x->tbsResponseData->responseExtensions)); 198{
175 } 199 return X509v3_get_ext_count(x->tbsResponseData->responseExtensions);
176 200}
177int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos) 201
178 { 202int
179 return(X509v3_get_ext_by_NID(x->tbsResponseData->responseExtensions,nid,lastpos)); 203OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos)
180 } 204{
181 205 return X509v3_get_ext_by_NID(x->tbsResponseData->responseExtensions,
182int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj, int lastpos) 206 nid ,lastpos);
183 { 207}
184 return(X509v3_get_ext_by_OBJ(x->tbsResponseData->responseExtensions,obj,lastpos)); 208
185 } 209int
186 210OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj, int lastpos)
187int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit, int lastpos) 211{
188 { 212 return X509v3_get_ext_by_OBJ(x->tbsResponseData->responseExtensions,
189 return(X509v3_get_ext_by_critical(x->tbsResponseData->responseExtensions,crit,lastpos)); 213 obj, lastpos);
190 } 214}
191 215
192X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc) 216int
193 { 217OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit, int lastpos)
194 return(X509v3_get_ext(x->tbsResponseData->responseExtensions,loc)); 218{
195 } 219 return X509v3_get_ext_by_critical(x->tbsResponseData->responseExtensions,
196 220 crit, lastpos);
197X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc) 221}
198 { 222
199 return(X509v3_delete_ext(x->tbsResponseData->responseExtensions,loc)); 223X509_EXTENSION *
200 } 224OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc)
201 225{
202void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit, int *idx) 226 return X509v3_get_ext(x->tbsResponseData->responseExtensions, loc);
203 { 227}
204 return X509V3_get_d2i(x->tbsResponseData->responseExtensions, nid, crit, idx); 228
205 } 229X509_EXTENSION *
206 230OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc)
207int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value, int crit, 231{
208 unsigned long flags) 232 return X509v3_delete_ext(x->tbsResponseData->responseExtensions, loc);
209 { 233}
210 return X509V3_add1_i2d(&x->tbsResponseData->responseExtensions, nid, value, crit, flags); 234
211 } 235void *
212 236OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit, int *idx)
213int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc) 237{
214 { 238 return X509V3_get_d2i(x->tbsResponseData->responseExtensions, nid,
215 return(X509v3_add_ext(&(x->tbsResponseData->responseExtensions),ex,loc) != NULL); 239 crit, idx);
216 } 240}
241
242int
243OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value, int crit,
244 unsigned long flags)
245{
246 return X509V3_add1_i2d(&x->tbsResponseData->responseExtensions, nid,
247 value, crit, flags);
248}
249
250int
251OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc)
252{
253 return X509v3_add_ext(&(x->tbsResponseData->responseExtensions), ex,
254 loc) != NULL;
255}
217 256
218/* OCSP single response extensions */ 257/* OCSP single response extensions */
219 258
220int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x) 259int
221 { 260OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x)
222 return(X509v3_get_ext_count(x->singleExtensions)); 261{
223 } 262 return X509v3_get_ext_count(x->singleExtensions);
224 263}
225int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos) 264
226 { 265int
227 return(X509v3_get_ext_by_NID(x->singleExtensions,nid,lastpos)); 266OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos)
228 } 267{
229 268 return X509v3_get_ext_by_NID(x->singleExtensions, nid, lastpos);
230int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj, int lastpos) 269}
231 { 270
232 return(X509v3_get_ext_by_OBJ(x->singleExtensions,obj,lastpos)); 271int
233 } 272OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj,
234 273 int lastpos)
235int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit, int lastpos) 274{
236 { 275 return X509v3_get_ext_by_OBJ(x->singleExtensions, obj, lastpos);
237 return(X509v3_get_ext_by_critical(x->singleExtensions,crit,lastpos)); 276}
238 } 277
239 278int
240X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc) 279OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit, int lastpos)
241 { 280{
242 return(X509v3_get_ext(x->singleExtensions,loc)); 281 return X509v3_get_ext_by_critical(x->singleExtensions, crit, lastpos);
243 } 282}
244 283
245X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc) 284X509_EXTENSION *
246 { 285OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc)
247 return(X509v3_delete_ext(x->singleExtensions,loc)); 286{
248 } 287 return X509v3_get_ext(x->singleExtensions, loc);
249 288}
250void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit, int *idx) 289
251 { 290X509_EXTENSION *
291OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc)
292{
293 return X509v3_delete_ext(x->singleExtensions, loc);
294}
295
296void *
297OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit, int *idx)
298{
252 return X509V3_get_d2i(x->singleExtensions, nid, crit, idx); 299 return X509V3_get_d2i(x->singleExtensions, nid, crit, idx);
253 } 300}
254 301
255int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value, int crit, 302int
256 unsigned long flags) 303OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value, int crit,
257 { 304 unsigned long flags)
305{
258 return X509V3_add1_i2d(&x->singleExtensions, nid, value, crit, flags); 306 return X509V3_add1_i2d(&x->singleExtensions, nid, value, crit, flags);
259 } 307}
260 308
261int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc) 309int
262 { 310OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc)
263 return(X509v3_add_ext(&(x->singleExtensions),ex,loc) != NULL); 311{
264 } 312 return X509v3_add_ext(&(x->singleExtensions), ex, loc) != NULL;
313}
265 314
266/* also CRL Entry Extensions */ 315/* also CRL Entry Extensions */
267#if 0 316#if 0
268ASN1_STRING *ASN1_STRING_encode(ASN1_STRING *s, i2d_of_void *i2d, 317ASN1_STRING *
269 void *data, STACK_OF(ASN1_OBJECT) *sk) 318ASN1_STRING_encode(ASN1_STRING *s, i2d_of_void *i2d, void *data,
270 { 319 STACK_OF(ASN1_OBJECT) *sk)
320{
271 int i; 321 int i;
272 unsigned char *p, *b = NULL; 322 unsigned char *p, *b = NULL;
273 323
274 if (data) 324 if (data) {
275 { 325 if ((i = i2d(data, NULL)) <= 0)
276 if ((i=i2d(data,NULL)) <= 0) goto err;
277 if (!(b=p=malloc((unsigned int)i)))
278 goto err; 326 goto err;
279 if (i2d(data, &p) <= 0) goto err; 327 if (!(b = p = malloc((unsigned int)i)))
280 } 328 goto err;
281 else if (sk) 329 if (i2d(data, &p) <= 0)
282 { 330 goto err;
283 if ((i=i2d_ASN1_SET_OF_ASN1_OBJECT(sk,NULL, 331 } else if (sk) {
284 (I2D_OF(ASN1_OBJECT))i2d, 332 if ((i = i2d_ASN1_SET_OF_ASN1_OBJECT(sk,NULL,
285 V_ASN1_SEQUENCE, 333 (I2D_OF(ASN1_OBJECT))i2d, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL,
286 V_ASN1_UNIVERSAL, 334 IS_SEQUENCE)) <= 0)
287 IS_SEQUENCE))<=0) goto err; 335 goto err;
288 if (!(b=p=malloc((unsigned int)i))) 336 if (!(b = p = malloc((unsigned int)i)))
289 goto err; 337 goto err;
290 if (i2d_ASN1_SET_OF_ASN1_OBJECT(sk,&p,(I2D_OF(ASN1_OBJECT))i2d, 338 if (i2d_ASN1_SET_OF_ASN1_OBJECT(sk,&p,(I2D_OF(ASN1_OBJECT))i2d,
291 V_ASN1_SEQUENCE, 339 V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, IS_SEQUENCE) <= 0)
292 V_ASN1_UNIVERSAL, 340 goto err;
293 IS_SEQUENCE)<=0) goto err; 341 } else {
294 } 342 OCSPerr(OCSP_F_ASN1_STRING_ENCODE, OCSP_R_BAD_DATA);
295 else 343 goto err;
296 { 344 }
297 OCSPerr(OCSP_F_ASN1_STRING_ENCODE,OCSP_R_BAD_DATA); 345 if (!s && !(s = ASN1_STRING_new()))
346 goto err;
347 if (!(ASN1_STRING_set(s, b, i)))
298 goto err; 348 goto err;
299 }
300 if (!s && !(s = ASN1_STRING_new())) goto err;
301 if (!(ASN1_STRING_set(s, b, i))) goto err;
302 free(b); 349 free(b);
303 return s; 350 return s;
304err: 351err:
305 if (b) free(b); 352 free(b);
306 return NULL; 353 return NULL;
307 } 354}
308#endif 355#endif
309 356
310/* Nonce handling functions */ 357/* Nonce handling functions */
@@ -315,16 +362,19 @@ err:
315 * nonce, previous versions used the raw nonce. 362 * nonce, previous versions used the raw nonce.
316 */ 363 */
317 364
318static int ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts, unsigned char *val, int len) 365static int
319 { 366ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts, unsigned char *val, int len)
367{
320 unsigned char *tmpval; 368 unsigned char *tmpval;
321 ASN1_OCTET_STRING os; 369 ASN1_OCTET_STRING os;
322 int ret = 0; 370 int ret = 0;
323 if (len <= 0) len = OCSP_DEFAULT_NONCE_LENGTH; 371
372 if (len <= 0)
373 len = OCSP_DEFAULT_NONCE_LENGTH;
324 /* Create the OCTET STRING manually by writing out the header and 374 /* Create the OCTET STRING manually by writing out the header and
325 * appending the content octets. This avoids an extra memory allocation 375 * appending the content octets. This avoids an extra memory allocation
326 * operation in some cases. Applications should *NOT* do this because 376 * operation in some cases. Applications should *NOT* do this because
327 * it relies on library internals. 377 * it relies on library internals.
328 */ 378 */
329 os.length = ASN1_object_size(0, len, V_ASN1_OCTET_STRING); 379 os.length = ASN1_object_size(0, len, V_ASN1_OCTET_STRING);
330 os.data = malloc(os.length); 380 os.data = malloc(os.length);
@@ -336,30 +386,29 @@ static int ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts, unsigned char *val,
336 memcpy(tmpval, val, len); 386 memcpy(tmpval, val, len);
337 else 387 else
338 RAND_pseudo_bytes(tmpval, len); 388 RAND_pseudo_bytes(tmpval, len);
339 if(!X509V3_add1_i2d(exts, NID_id_pkix_OCSP_Nonce, 389 if (!X509V3_add1_i2d(exts, NID_id_pkix_OCSP_Nonce, &os, 0,
340 &os, 0, X509V3_ADD_REPLACE)) 390 X509V3_ADD_REPLACE))
341 goto err; 391 goto err;
342 ret = 1; 392 ret = 1;
343 err: 393err:
344 if (os.data) 394 free(os.data);
345 free(os.data);
346 return ret; 395 return ret;
347 } 396}
348
349 397
350/* Add nonce to an OCSP request */ 398/* Add nonce to an OCSP request */
351 399int
352int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len) 400OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len)
353 { 401{
354 return ocsp_add1_nonce(&req->tbsRequest->requestExtensions, val, len); 402 return ocsp_add1_nonce(&req->tbsRequest->requestExtensions, val, len);
355 } 403}
356 404
357/* Same as above but for a response */ 405/* Same as above but for a response */
358 406int
359int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len) 407OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len)
360 { 408{
361 return ocsp_add1_nonce(&resp->tbsResponseData->responseExtensions, val, len); 409 return ocsp_add1_nonce(&resp->tbsResponseData->responseExtensions, val,
362 } 410 len);
411}
363 412
364/* Check nonce validity in a request and response. 413/* Check nonce validity in a request and response.
365 * Return value reflects result: 414 * Return value reflects result:
@@ -373,9 +422,9 @@ int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len)
373 * If responder doesn't handle nonces return != 0 may be 422 * If responder doesn't handle nonces return != 0 may be
374 * necessary. return == 0 is always an error. 423 * necessary. return == 0 is always an error.
375 */ 424 */
376 425int
377int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs) 426OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs)
378 { 427{
379 /* 428 /*
380 * Since we are only interested in the presence or absence of 429 * Since we are only interested in the presence or absence of
381 * the nonce and comparing its value there is no need to use 430 * the nonce and comparing its value there is no need to use
@@ -383,136 +432,160 @@ int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs)
383 * ASN1_OCTET_STRING structure for the value which would be 432 * ASN1_OCTET_STRING structure for the value which would be
384 * freed immediately anyway. 433 * freed immediately anyway.
385 */ 434 */
386
387 int req_idx, resp_idx; 435 int req_idx, resp_idx;
388 X509_EXTENSION *req_ext, *resp_ext; 436 X509_EXTENSION *req_ext, *resp_ext;
437
389 req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1); 438 req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1);
390 resp_idx = OCSP_BASICRESP_get_ext_by_NID(bs, NID_id_pkix_OCSP_Nonce, -1); 439 resp_idx = OCSP_BASICRESP_get_ext_by_NID(bs, NID_id_pkix_OCSP_Nonce, -1);
391 /* Check both absent */ 440 /* Check both absent */
392 if((req_idx < 0) && (resp_idx < 0)) 441 if (req_idx < 0 && resp_idx < 0)
393 return 2; 442 return 2;
394 /* Check in request only */ 443 /* Check in request only */
395 if((req_idx >= 0) && (resp_idx < 0)) 444 if (req_idx >= 0 && resp_idx < 0)
396 return -1; 445 return -1;
397 /* Check in response but not request */ 446 /* Check in response but not request */
398 if((req_idx < 0) && (resp_idx >= 0)) 447 if (req_idx < 0 && resp_idx >= 0)
399 return 3; 448 return 3;
400 /* Otherwise nonce in request and response so retrieve the extensions */ 449 /* Otherwise nonce in request and response so retrieve the extensions */
401 req_ext = OCSP_REQUEST_get_ext(req, req_idx); 450 req_ext = OCSP_REQUEST_get_ext(req, req_idx);
402 resp_ext = OCSP_BASICRESP_get_ext(bs, resp_idx); 451 resp_ext = OCSP_BASICRESP_get_ext(bs, resp_idx);
403 if(ASN1_OCTET_STRING_cmp(req_ext->value, resp_ext->value)) 452 if (ASN1_OCTET_STRING_cmp(req_ext->value, resp_ext->value))
404 return 0; 453 return 0;
405 return 1; 454 return 1;
406 } 455}
407 456
408/* Copy the nonce value (if any) from an OCSP request to 457/* Copy the nonce value (if any) from an OCSP request to
409 * a response. 458 * a response.
410 */ 459 */
411 460int
412int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req) 461OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req)
413 { 462{
414 X509_EXTENSION *req_ext; 463 X509_EXTENSION *req_ext;
415 int req_idx; 464 int req_idx;
465
416 /* Check for nonce in request */ 466 /* Check for nonce in request */
417 req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1); 467 req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1);
418 /* If no nonce that's OK */ 468 /* If no nonce that's OK */
419 if (req_idx < 0) return 2; 469 if (req_idx < 0)
470 return 2;
420 req_ext = OCSP_REQUEST_get_ext(req, req_idx); 471 req_ext = OCSP_REQUEST_get_ext(req, req_idx);
421 return OCSP_BASICRESP_add_ext(resp, req_ext, -1); 472 return OCSP_BASICRESP_add_ext(resp, req_ext, -1);
422 } 473}
423 474
424X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim) 475X509_EXTENSION *
425 { 476OCSP_crlID_new(char *url, long *n, char *tim)
477{
426 X509_EXTENSION *x = NULL; 478 X509_EXTENSION *x = NULL;
427 OCSP_CRLID *cid = NULL; 479 OCSP_CRLID *cid = NULL;
428 480
429 if (!(cid = OCSP_CRLID_new())) goto err; 481 if (!(cid = OCSP_CRLID_new()))
430 if (url) 482 goto err;
431 { 483 if (url) {
432 if (!(cid->crlUrl = ASN1_IA5STRING_new())) goto err; 484 if (!(cid->crlUrl = ASN1_IA5STRING_new()))
433 if (!(ASN1_STRING_set(cid->crlUrl, url, -1))) goto err; 485 goto err;
434 } 486 if (!(ASN1_STRING_set(cid->crlUrl, url, -1)))
435 if (n) 487 goto err;
436 { 488 }
437 if (!(cid->crlNum = ASN1_INTEGER_new())) goto err; 489 if (n) {
438 if (!(ASN1_INTEGER_set(cid->crlNum, *n))) goto err; 490 if (!(cid->crlNum = ASN1_INTEGER_new()))
439 } 491 goto err;
440 if (tim) 492 if (!(ASN1_INTEGER_set(cid->crlNum, *n)))
441 { 493 goto err;
442 if (!(cid->crlTime = ASN1_GENERALIZEDTIME_new())) goto err; 494 }
495 if (tim) {
496 if (!(cid->crlTime = ASN1_GENERALIZEDTIME_new()))
497 goto err;
443 if (!(ASN1_GENERALIZEDTIME_set_string(cid->crlTime, tim))) 498 if (!(ASN1_GENERALIZEDTIME_set_string(cid->crlTime, tim)))
444 goto err; 499 goto err;
445 } 500 }
446 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_CrlID, 0, cid); 501 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_CrlID, 0, cid);
447err: 502err:
448 if (cid) OCSP_CRLID_free(cid); 503 if (cid)
504 OCSP_CRLID_free(cid);
449 return x; 505 return x;
450 } 506}
451 507
452/* AcceptableResponses ::= SEQUENCE OF OBJECT IDENTIFIER */ 508/* AcceptableResponses ::= SEQUENCE OF OBJECT IDENTIFIER */
453X509_EXTENSION *OCSP_accept_responses_new(char **oids) 509X509_EXTENSION *
454 { 510OCSP_accept_responses_new(char **oids)
511{
455 int nid; 512 int nid;
456 STACK_OF(ASN1_OBJECT) *sk = NULL; 513 STACK_OF(ASN1_OBJECT) *sk = NULL;
457 ASN1_OBJECT *o = NULL; 514 ASN1_OBJECT *o = NULL;
458 X509_EXTENSION *x = NULL; 515 X509_EXTENSION *x = NULL;
459 516
460 if (!(sk = sk_ASN1_OBJECT_new_null())) goto err; 517 if (!(sk = sk_ASN1_OBJECT_new_null()))
461 while (oids && *oids) 518 goto err;
462 { 519 while (oids && *oids) {
463 if ((nid=OBJ_txt2nid(*oids))!=NID_undef&&(o=OBJ_nid2obj(nid))) 520 if ((nid = OBJ_txt2nid(*oids)) != NID_undef &&
464 sk_ASN1_OBJECT_push(sk, o); 521 (o = OBJ_nid2obj(nid)))
522 sk_ASN1_OBJECT_push(sk, o);
465 oids++; 523 oids++;
466 } 524 }
467 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_acceptableResponses, 0, sk); 525 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_acceptableResponses, 0, sk);
468err: 526err:
469 if (sk) sk_ASN1_OBJECT_pop_free(sk, ASN1_OBJECT_free); 527 if (sk)
528 sk_ASN1_OBJECT_pop_free(sk, ASN1_OBJECT_free);
470 return x; 529 return x;
471 } 530}
472 531
473/* ArchiveCutoff ::= GeneralizedTime */ 532/* ArchiveCutoff ::= GeneralizedTime */
474X509_EXTENSION *OCSP_archive_cutoff_new(char* tim) 533X509_EXTENSION *
475 { 534OCSP_archive_cutoff_new(char* tim)
476 X509_EXTENSION *x=NULL; 535{
536 X509_EXTENSION *x = NULL;
477 ASN1_GENERALIZEDTIME *gt = NULL; 537 ASN1_GENERALIZEDTIME *gt = NULL;
478 538
479 if (!(gt = ASN1_GENERALIZEDTIME_new())) goto err; 539 if (!(gt = ASN1_GENERALIZEDTIME_new()))
480 if (!(ASN1_GENERALIZEDTIME_set_string(gt, tim))) goto err; 540 goto err;
541 if (!(ASN1_GENERALIZEDTIME_set_string(gt, tim)))
542 goto err;
481 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_archiveCutoff, 0, gt); 543 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_archiveCutoff, 0, gt);
482err: 544err:
483 if (gt) ASN1_GENERALIZEDTIME_free(gt); 545 if (gt)
546 ASN1_GENERALIZEDTIME_free(gt);
484 return x; 547 return x;
485 } 548}
486 549
487/* per ACCESS_DESCRIPTION parameter are oids, of which there are currently 550/* per ACCESS_DESCRIPTION parameter are oids, of which there are currently
488 * two--NID_ad_ocsp, NID_id_ad_caIssuers--and GeneralName value. This 551 * two--NID_ad_ocsp, NID_id_ad_caIssuers--and GeneralName value. This
489 * method forces NID_ad_ocsp and uniformResourceLocator [6] IA5String. 552 * method forces NID_ad_ocsp and uniformResourceLocator [6] IA5String.
490 */ 553 */
491X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, char **urls) 554X509_EXTENSION *
492 { 555OCSP_url_svcloc_new(X509_NAME* issuer, char **urls)
556{
493 X509_EXTENSION *x = NULL; 557 X509_EXTENSION *x = NULL;
494 ASN1_IA5STRING *ia5 = NULL; 558 ASN1_IA5STRING *ia5 = NULL;
495 OCSP_SERVICELOC *sloc = NULL; 559 OCSP_SERVICELOC *sloc = NULL;
496 ACCESS_DESCRIPTION *ad = NULL; 560 ACCESS_DESCRIPTION *ad = NULL;
497 561
498 if (!(sloc = OCSP_SERVICELOC_new())) goto err; 562 if (!(sloc = OCSP_SERVICELOC_new()))
499 if (!(sloc->issuer = X509_NAME_dup(issuer))) goto err; 563 goto err;
500 if (urls && *urls && !(sloc->locator = sk_ACCESS_DESCRIPTION_new_null())) goto err; 564 if (!(sloc->issuer = X509_NAME_dup(issuer)))
501 while (urls && *urls) 565 goto err;
502 { 566 if (urls && *urls &&
503 if (!(ad = ACCESS_DESCRIPTION_new())) goto err; 567 !(sloc->locator = sk_ACCESS_DESCRIPTION_new_null()))
504 if (!(ad->method=OBJ_nid2obj(NID_ad_OCSP))) goto err; 568 goto err;
505 if (!(ad->location = GENERAL_NAME_new())) goto err; 569 while (urls && *urls) {
506 if (!(ia5 = ASN1_IA5STRING_new())) goto err; 570 if (!(ad = ACCESS_DESCRIPTION_new()))
507 if (!ASN1_STRING_set((ASN1_STRING*)ia5, *urls, -1)) goto err; 571 goto err;
572 if (!(ad->method = OBJ_nid2obj(NID_ad_OCSP)))
573 goto err;
574 if (!(ad->location = GENERAL_NAME_new()))
575 goto err;
576 if (!(ia5 = ASN1_IA5STRING_new()))
577 goto err;
578 if (!ASN1_STRING_set((ASN1_STRING*)ia5, *urls, -1))
579 goto err;
508 ad->location->type = GEN_URI; 580 ad->location->type = GEN_URI;
509 ad->location->d.ia5 = ia5; 581 ad->location->d.ia5 = ia5;
510 if (!sk_ACCESS_DESCRIPTION_push(sloc->locator, ad)) goto err; 582 if (!sk_ACCESS_DESCRIPTION_push(sloc->locator, ad))
583 goto err;
511 urls++; 584 urls++;
512 } 585 }
513 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_serviceLocator, 0, sloc); 586 x = X509V3_EXT_i2d(NID_id_pkix_OCSP_serviceLocator, 0, sloc);
514err: 587err:
515 if (sloc) OCSP_SERVICELOC_free(sloc); 588 if (sloc)
589 OCSP_SERVICELOC_free(sloc);
516 return x; 590 return x;
517 } 591}
518
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_ht.c b/src/lib/libssl/src/crypto/ocsp/ocsp_ht.c
index b45eaf6767..fe4a7a1a72 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_ht.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_ht.c
@@ -79,7 +79,7 @@ struct ocsp_req_ctx_st {
79 BIO *io; /* BIO to perform I/O with */ 79 BIO *io; /* BIO to perform I/O with */
80 BIO *mem; /* Memory BIO response is built into */ 80 BIO *mem; /* Memory BIO response is built into */
81 unsigned long asn1_len; /* ASN1 length of response */ 81 unsigned long asn1_len; /* ASN1 length of response */
82 }; 82};
83 83
84#define OCSP_MAX_REQUEST_LENGTH (100 * 1024) 84#define OCSP_MAX_REQUEST_LENGTH (100 * 1024)
85#define OCSP_MAX_LINE_LEN 4096; 85#define OCSP_MAX_LINE_LEN 4096;
@@ -108,54 +108,57 @@ struct ocsp_req_ctx_st {
108 108
109static int parse_http_line1(char *line); 109static int parse_http_line1(char *line);
110 110
111void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx) 111void
112 { 112OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx)
113{
113 if (rctx->mem) 114 if (rctx->mem)
114 BIO_free(rctx->mem); 115 BIO_free(rctx->mem);
115 if (rctx->iobuf) 116 if (rctx->iobuf)
116 free(rctx->iobuf); 117 free(rctx->iobuf);
117 free(rctx); 118 free(rctx);
118 } 119}
119 120
120int OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, OCSP_REQUEST *req) 121int
121 { 122OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, OCSP_REQUEST *req)
123{
122 static const char req_hdr[] = 124 static const char req_hdr[] =
123 "Content-Type: application/ocsp-request\r\n" 125 "Content-Type: application/ocsp-request\r\n"
124 "Content-Length: %d\r\n\r\n"; 126 "Content-Length: %d\r\n\r\n";
125 if (BIO_printf(rctx->mem, req_hdr, i2d_OCSP_REQUEST(req, NULL)) <= 0) 127
128 if (BIO_printf(rctx->mem, req_hdr, i2d_OCSP_REQUEST(req, NULL)) <= 0)
126 return 0; 129 return 0;
127 if (i2d_OCSP_REQUEST_bio(rctx->mem, req) <= 0) 130 if (i2d_OCSP_REQUEST_bio(rctx->mem, req) <= 0)
128 return 0; 131 return 0;
129 rctx->state = OHS_ASN1_WRITE; 132 rctx->state = OHS_ASN1_WRITE;
130 rctx->asn1_len = BIO_get_mem_data(rctx->mem, NULL); 133 rctx->asn1_len = BIO_get_mem_data(rctx->mem, NULL);
131 return 1; 134 return 1;
132 } 135}
133 136
134int OCSP_REQ_CTX_add1_header(OCSP_REQ_CTX *rctx, 137int
135 const char *name, const char *value) 138OCSP_REQ_CTX_add1_header(OCSP_REQ_CTX *rctx, const char *name,
136 { 139 const char *value)
140{
137 if (!name) 141 if (!name)
138 return 0; 142 return 0;
139 if (BIO_puts(rctx->mem, name) <= 0) 143 if (BIO_puts(rctx->mem, name) <= 0)
140 return 0; 144 return 0;
141 if (value) 145 if (value) {
142 {
143 if (BIO_write(rctx->mem, ": ", 2) != 2) 146 if (BIO_write(rctx->mem, ": ", 2) != 2)
144 return 0; 147 return 0;
145 if (BIO_puts(rctx->mem, value) <= 0) 148 if (BIO_puts(rctx->mem, value) <= 0)
146 return 0; 149 return 0;
147 } 150 }
148 if (BIO_write(rctx->mem, "\r\n", 2) != 2) 151 if (BIO_write(rctx->mem, "\r\n", 2) != 2)
149 return 0; 152 return 0;
150 return 1; 153 return 1;
151 } 154}
152 155
153OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req, 156OCSP_REQ_CTX *
154 int maxline) 157OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req, int maxline)
155 { 158{
156 static const char post_hdr[] = "POST %s HTTP/1.0\r\n"; 159 static const char post_hdr[] = "POST %s HTTP/1.0\r\n";
157
158 OCSP_REQ_CTX *rctx; 160 OCSP_REQ_CTX *rctx;
161
159 rctx = malloc(sizeof(OCSP_REQ_CTX)); 162 rctx = malloc(sizeof(OCSP_REQ_CTX));
160 rctx->state = OHS_ERROR; 163 rctx->state = OHS_ERROR;
161 rctx->mem = BIO_new(BIO_s_mem()); 164 rctx->mem = BIO_new(BIO_s_mem());
@@ -174,7 +177,7 @@ OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req,
174 if (!path) 177 if (!path)
175 path = "/"; 178 path = "/";
176 179
177 if (BIO_printf(rctx->mem, post_hdr, path) <= 0) { 180 if (BIO_printf(rctx->mem, post_hdr, path) <= 0) {
178 free(rctx->iobuf); 181 free(rctx->iobuf);
179 BIO_free(rctx->mem); 182 BIO_free(rctx->mem);
180 free(rctx); 183 free(rctx);
@@ -189,49 +192,44 @@ OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req,
189 } 192 }
190 193
191 return rctx; 194 return rctx;
192 } 195}
193 196
194/* Parse the HTTP response. This will look like this: 197/* Parse the HTTP response. This will look like this:
195 * "HTTP/1.0 200 OK". We need to obtain the numeric code and 198 * "HTTP/1.0 200 OK". We need to obtain the numeric code and
196 * (optional) informational message. 199 * (optional) informational message.
197 */ 200 */
198 201static int
199static int parse_http_line1(char *line) 202parse_http_line1(char *line)
200 { 203{
201 int retcode; 204 int retcode;
202 char *p, *q, *r; 205 char *p, *q, *r;
203 /* Skip to first white space (passed protocol info) */
204 206
205 for(p = line; *p && !isspace((unsigned char)*p); p++) 207 /* Skip to first white space (passed protocol info) */
208 for (p = line; *p && !isspace((unsigned char)*p); p++)
206 continue; 209 continue;
207 if(!*p) 210 if (!*p) {
208 {
209 OCSPerr(OCSP_F_PARSE_HTTP_LINE1, 211 OCSPerr(OCSP_F_PARSE_HTTP_LINE1,
210 OCSP_R_SERVER_RESPONSE_PARSE_ERROR); 212 OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
211 return 0; 213 return 0;
212 } 214 }
213 215
214 /* Skip past white space to start of response code */ 216 /* Skip past white space to start of response code */
215 while(*p && isspace((unsigned char)*p)) 217 while (*p && isspace((unsigned char)*p))
216 p++; 218 p++;
217 219 if (!*p) {
218 if(!*p)
219 {
220 OCSPerr(OCSP_F_PARSE_HTTP_LINE1, 220 OCSPerr(OCSP_F_PARSE_HTTP_LINE1,
221 OCSP_R_SERVER_RESPONSE_PARSE_ERROR); 221 OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
222 return 0; 222 return 0;
223 } 223 }
224 224
225 /* Find end of response code: first whitespace after start of code */ 225 /* Find end of response code: first whitespace after start of code */
226 for(q = p; *q && !isspace((unsigned char)*q); q++) 226 for (q = p; *q && !isspace((unsigned char)*q); q++)
227 continue; 227 continue;
228 228 if (!*q) {
229 if(!*q)
230 {
231 OCSPerr(OCSP_F_PARSE_HTTP_LINE1, 229 OCSPerr(OCSP_F_PARSE_HTTP_LINE1,
232 OCSP_R_SERVER_RESPONSE_PARSE_ERROR); 230 OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
233 return 0; 231 return 0;
234 } 232 }
235 233
236 /* Set end of response code and start of message */ 234 /* Set end of response code and start of message */
237 *q++ = 0; 235 *q++ = 0;
@@ -239,94 +237,80 @@ static int parse_http_line1(char *line)
239 /* Attempt to parse numeric code */ 237 /* Attempt to parse numeric code */
240 retcode = strtoul(p, &r, 10); 238 retcode = strtoul(p, &r, 10);
241 239
242 if(*r) 240 if (*r)
243 return 0; 241 return 0;
244 242
245 /* Skip over any leading white space in message */ 243 /* Skip over any leading white space in message */
246 while(*q && isspace((unsigned char)*q)) 244 while (*q && isspace((unsigned char)*q))
247 q++; 245 q++;
248 246 if (*q) {
249 if(*q)
250 {
251 /* Finally zap any trailing white space in message (include 247 /* Finally zap any trailing white space in message (include
252 * CRLF) */ 248 * CRLF) */
253 249
254 /* We know q has a non white space character so this is OK */ 250 /* We know q has a non white space character so this is OK */
255 for(r = q + strlen(q) - 1; isspace((unsigned char)*r); r--) 251 for (r = q + strlen(q) - 1; isspace((unsigned char)*r); r--)
256 *r = 0; 252 *r = 0;
257 } 253 }
258 if(retcode != 200) 254 if (retcode != 200) {
259 {
260 OCSPerr(OCSP_F_PARSE_HTTP_LINE1, OCSP_R_SERVER_RESPONSE_ERROR); 255 OCSPerr(OCSP_F_PARSE_HTTP_LINE1, OCSP_R_SERVER_RESPONSE_ERROR);
261 if(!*q) 256 if (!*q)
262 ERR_asprintf_error_data("Code=%s", p); 257 ERR_asprintf_error_data("Code=%s", p);
263 else 258 else
264 ERR_asprintf_error_data("Code=%s,Reason=%s", p, q); 259 ERR_asprintf_error_data("Code=%s,Reason=%s", p, q);
265 return 0; 260 return 0;
266 } 261 }
267
268 262
269 return 1; 263 return 1;
264}
270 265
271 } 266int
272 267OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx)
273int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx) 268{
274 {
275 int i, n; 269 int i, n;
276 const unsigned char *p; 270 const unsigned char *p;
277 next_io: 271
278 if (!(rctx->state & OHS_NOREAD)) 272next_io:
279 { 273 if (!(rctx->state & OHS_NOREAD)) {
280 n = BIO_read(rctx->io, rctx->iobuf, rctx->iobuflen); 274 n = BIO_read(rctx->io, rctx->iobuf, rctx->iobuflen);
281 275
282 if (n <= 0) 276 if (n <= 0) {
283 {
284 if (BIO_should_retry(rctx->io)) 277 if (BIO_should_retry(rctx->io))
285 return -1; 278 return -1;
286 return 0; 279 return 0;
287 } 280 }
288 281
289 /* Write data to memory BIO */ 282 /* Write data to memory BIO */
290
291 if (BIO_write(rctx->mem, rctx->iobuf, n) != n) 283 if (BIO_write(rctx->mem, rctx->iobuf, n) != n)
292 return 0; 284 return 0;
293 } 285 }
294
295 switch(rctx->state)
296 {
297 286
298 case OHS_ASN1_WRITE: 287 switch (rctx->state) {
288 case OHS_ASN1_WRITE:
299 n = BIO_get_mem_data(rctx->mem, &p); 289 n = BIO_get_mem_data(rctx->mem, &p);
300
301 i = BIO_write(rctx->io, 290 i = BIO_write(rctx->io,
302 p + (n - rctx->asn1_len), rctx->asn1_len); 291 p + (n - rctx->asn1_len), rctx->asn1_len);
303 292 if (i <= 0) {
304 if (i <= 0)
305 {
306 if (BIO_should_retry(rctx->io)) 293 if (BIO_should_retry(rctx->io))
307 return -1; 294 return -1;
308 rctx->state = OHS_ERROR; 295 rctx->state = OHS_ERROR;
309 return 0; 296 return 0;
310 } 297 }
311 298
312 rctx->asn1_len -= i; 299 rctx->asn1_len -= i;
313
314 if (rctx->asn1_len > 0) 300 if (rctx->asn1_len > 0)
315 goto next_io; 301 goto next_io;
316 302
317 rctx->state = OHS_ASN1_FLUSH; 303 rctx->state = OHS_ASN1_FLUSH;
318 304
319 (void)BIO_reset(rctx->mem); 305 (void)BIO_reset(rctx->mem);
306 /* FALLTHROUGH */
320 307
321 case OHS_ASN1_FLUSH: 308 case OHS_ASN1_FLUSH:
322
323 i = BIO_flush(rctx->io); 309 i = BIO_flush(rctx->io);
324 310 if (i > 0) {
325 if (i > 0)
326 {
327 rctx->state = OHS_FIRSTLINE; 311 rctx->state = OHS_FIRSTLINE;
328 goto next_io; 312 goto next_io;
329 } 313 }
330 314
331 if (BIO_should_retry(rctx->io)) 315 if (BIO_should_retry(rctx->io))
332 return -1; 316 return -1;
@@ -334,79 +318,62 @@ int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx)
334 rctx->state = OHS_ERROR; 318 rctx->state = OHS_ERROR;
335 return 0; 319 return 0;
336 320
337 case OHS_ERROR: 321 case OHS_ERROR:
338 return 0; 322 return 0;
339 323
340 case OHS_FIRSTLINE: 324 case OHS_FIRSTLINE:
341 case OHS_HEADERS: 325 case OHS_HEADERS:
342
343 /* Attempt to read a line in */ 326 /* Attempt to read a line in */
344 327next_line:
345 next_line:
346 /* Due to &%^*$" memory BIO behaviour with BIO_gets we 328 /* Due to &%^*$" memory BIO behaviour with BIO_gets we
347 * have to check there's a complete line in there before 329 * have to check there's a complete line in there before
348 * calling BIO_gets or we'll just get a partial read. 330 * calling BIO_gets or we'll just get a partial read.
349 */ 331 */
350 n = BIO_get_mem_data(rctx->mem, &p); 332 n = BIO_get_mem_data(rctx->mem, &p);
351 if ((n <= 0) || !memchr(p, '\n', n)) 333 if ((n <= 0) || !memchr(p, '\n', n)) {
352 { 334 if (n >= rctx->iobuflen) {
353 if (n >= rctx->iobuflen)
354 {
355 rctx->state = OHS_ERROR; 335 rctx->state = OHS_ERROR;
356 return 0; 336 return 0;
357 }
358 goto next_io;
359 } 337 }
338 goto next_io;
339 }
360 n = BIO_gets(rctx->mem, (char *)rctx->iobuf, rctx->iobuflen); 340 n = BIO_gets(rctx->mem, (char *)rctx->iobuf, rctx->iobuflen);
361 341 if (n <= 0) {
362 if (n <= 0)
363 {
364 if (BIO_should_retry(rctx->mem)) 342 if (BIO_should_retry(rctx->mem))
365 goto next_io; 343 goto next_io;
366 rctx->state = OHS_ERROR; 344 rctx->state = OHS_ERROR;
367 return 0; 345 return 0;
368 } 346 }
369 347
370 /* Don't allow excessive lines */ 348 /* Don't allow excessive lines */
371 if (n == rctx->iobuflen) 349 if (n == rctx->iobuflen) {
372 {
373 rctx->state = OHS_ERROR; 350 rctx->state = OHS_ERROR;
374 return 0; 351 return 0;
375 } 352 }
376 353
377 /* First line */ 354 /* First line */
378 if (rctx->state == OHS_FIRSTLINE) 355 if (rctx->state == OHS_FIRSTLINE) {
379 { 356 if (parse_http_line1((char *)rctx->iobuf)) {
380 if (parse_http_line1((char *)rctx->iobuf))
381 {
382 rctx->state = OHS_HEADERS; 357 rctx->state = OHS_HEADERS;
383 goto next_line; 358 goto next_line;
384 } 359 } else {
385 else
386 {
387 rctx->state = OHS_ERROR; 360 rctx->state = OHS_ERROR;
388 return 0; 361 return 0;
389 }
390 } 362 }
391 else 363 } else {
392 {
393 /* Look for blank line: end of headers */ 364 /* Look for blank line: end of headers */
394 for (p = rctx->iobuf; *p; p++) 365 for (p = rctx->iobuf; *p; p++) {
395 {
396 if ((*p != '\r') && (*p != '\n')) 366 if ((*p != '\r') && (*p != '\n'))
397 break; 367 break;
398 } 368 }
399 if (*p) 369 if (*p)
400 goto next_line; 370 goto next_line;
401 371
402 rctx->state = OHS_ASN1_HEADER; 372 rctx->state = OHS_ASN1_HEADER;
373 }
374 /* FALLTRHOUGH */
403 375
404 } 376 case OHS_ASN1_HEADER:
405
406 /* Fall thru */
407
408
409 case OHS_ASN1_HEADER:
410 /* Now reading ASN1 header: can read at least 2 bytes which 377 /* Now reading ASN1 header: can read at least 2 bytes which
411 * is enough for ASN1 SEQUENCE header and either length field 378 * is enough for ASN1 SEQUENCE header and either length field
412 * or at least the length of the length field. 379 * or at least the length of the length field.
@@ -416,15 +383,13 @@ int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx)
416 goto next_io; 383 goto next_io;
417 384
418 /* Check it is an ASN1 SEQUENCE */ 385 /* Check it is an ASN1 SEQUENCE */
419 if (*p++ != (V_ASN1_SEQUENCE|V_ASN1_CONSTRUCTED)) 386 if (*p++ != (V_ASN1_SEQUENCE|V_ASN1_CONSTRUCTED)) {
420 {
421 rctx->state = OHS_ERROR; 387 rctx->state = OHS_ERROR;
422 return 0; 388 return 0;
423 } 389 }
424 390
425 /* Check out length field */ 391 /* Check out length field */
426 if (*p & 0x80) 392 if (*p & 0x80) {
427 {
428 /* If MSB set on initial length octet we can now 393 /* If MSB set on initial length octet we can now
429 * always read 6 octets: make sure we have them. 394 * always read 6 octets: make sure we have them.
430 */ 395 */
@@ -432,78 +397,64 @@ int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx)
432 goto next_io; 397 goto next_io;
433 n = *p & 0x7F; 398 n = *p & 0x7F;
434 /* Not NDEF or excessive length */ 399 /* Not NDEF or excessive length */
435 if (!n || (n > 4)) 400 if (!n || (n > 4)) {
436 {
437 rctx->state = OHS_ERROR; 401 rctx->state = OHS_ERROR;
438 return 0; 402 return 0;
439 } 403 }
440 p++; 404 p++;
441 rctx->asn1_len = 0; 405 rctx->asn1_len = 0;
442 for (i = 0; i < n; i++) 406 for (i = 0; i < n; i++) {
443 {
444 rctx->asn1_len <<= 8; 407 rctx->asn1_len <<= 8;
445 rctx->asn1_len |= *p++; 408 rctx->asn1_len |= *p++;
446 } 409 }
447 410
448 if (rctx->asn1_len > OCSP_MAX_REQUEST_LENGTH) 411 if (rctx->asn1_len > OCSP_MAX_REQUEST_LENGTH) {
449 {
450 rctx->state = OHS_ERROR; 412 rctx->state = OHS_ERROR;
451 return 0; 413 return 0;
452 } 414 }
453 415
454 rctx->asn1_len += n + 2; 416 rctx->asn1_len += n + 2;
455 } 417 } else
456 else
457 rctx->asn1_len = *p + 2; 418 rctx->asn1_len = *p + 2;
458 419
459 rctx->state = OHS_ASN1_CONTENT; 420 rctx->state = OHS_ASN1_CONTENT;
460 421
461 /* Fall thru */ 422 /* FALLTHROUGH */
462 423
463 case OHS_ASN1_CONTENT: 424 case OHS_ASN1_CONTENT:
464 n = BIO_get_mem_data(rctx->mem, &p); 425 n = BIO_get_mem_data(rctx->mem, &p);
465 if (n < (int)rctx->asn1_len) 426 if (n < (int)rctx->asn1_len)
466 goto next_io; 427 goto next_io;
467 428
468
469 *presp = d2i_OCSP_RESPONSE(NULL, &p, rctx->asn1_len); 429 *presp = d2i_OCSP_RESPONSE(NULL, &p, rctx->asn1_len);
470 if (*presp) 430 if (*presp) {
471 {
472 rctx->state = OHS_DONE; 431 rctx->state = OHS_DONE;
473 return 1; 432 return 1;
474 } 433 }
475 434
476 rctx->state = OHS_ERROR; 435 rctx->state = OHS_ERROR;
477 return 0; 436 return 0;
478 437
479 break; 438 case OHS_DONE:
480
481 case OHS_DONE:
482 return 1; 439 return 1;
483 440 }
484 }
485
486
487 441
488 return 0; 442 return 0;
489 443}
490
491 }
492 444
493/* Blocking OCSP request handler: now a special case of non-blocking I/O */ 445/* Blocking OCSP request handler: now a special case of non-blocking I/O */
494 446OCSP_RESPONSE *
495OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req) 447OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req)
496 { 448{
497 OCSP_RESPONSE *resp = NULL; 449 OCSP_RESPONSE *resp = NULL;
498 OCSP_REQ_CTX *ctx; 450 OCSP_REQ_CTX *ctx;
499 int rv; 451 int rv;
500 452
501 ctx = OCSP_sendreq_new(b, path, req, -1); 453 ctx = OCSP_sendreq_new(b, path, req, -1);
502 454
503 do 455 do {
504 {
505 rv = OCSP_sendreq_nbio(&resp, ctx); 456 rv = OCSP_sendreq_nbio(&resp, ctx);
506 } while ((rv == -1) && BIO_should_retry(b)); 457 } while ((rv == -1) && BIO_should_retry(b));
507 458
508 OCSP_REQ_CTX_free(ctx); 459 OCSP_REQ_CTX_free(ctx);
509 460
@@ -511,4 +462,4 @@ OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req)
511 return resp; 462 return resp;
512 463
513 return NULL; 464 return NULL;
514 } 465}
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_lib.c b/src/lib/libssl/src/crypto/ocsp/ocsp_lib.c
index 514cdabf2d..056bd27665 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_lib.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_lib.c
@@ -73,102 +73,112 @@
73 73
74/* Convert a certificate and its issuer to an OCSP_CERTID */ 74/* Convert a certificate and its issuer to an OCSP_CERTID */
75 75
76OCSP_CERTID *OCSP_cert_to_id(const EVP_MD *dgst, X509 *subject, X509 *issuer) 76OCSP_CERTID *
77OCSP_cert_to_id(const EVP_MD *dgst, X509 *subject, X509 *issuer)
77{ 78{
78 X509_NAME *iname; 79 X509_NAME *iname;
79 ASN1_INTEGER *serial; 80 ASN1_INTEGER *serial;
80 ASN1_BIT_STRING *ikey; 81 ASN1_BIT_STRING *ikey;
82
81#ifndef OPENSSL_NO_SHA1 83#ifndef OPENSSL_NO_SHA1
82 if(!dgst) dgst = EVP_sha1(); 84 if (!dgst)
85 dgst = EVP_sha1();
83#endif 86#endif
84 if (subject) 87 if (subject) {
85 {
86 iname = X509_get_issuer_name(subject); 88 iname = X509_get_issuer_name(subject);
87 serial = X509_get_serialNumber(subject); 89 serial = X509_get_serialNumber(subject);
88 } 90 } else {
89 else
90 {
91 iname = X509_get_subject_name(issuer); 91 iname = X509_get_subject_name(issuer);
92 serial = NULL; 92 serial = NULL;
93 } 93 }
94 ikey = X509_get0_pubkey_bitstr(issuer); 94 ikey = X509_get0_pubkey_bitstr(issuer);
95 return OCSP_cert_id_new(dgst, iname, ikey, serial); 95 return OCSP_cert_id_new(dgst, iname, ikey, serial);
96} 96}
97 97
98 98OCSP_CERTID *
99OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst, 99OCSP_cert_id_new(const EVP_MD *dgst, X509_NAME *issuerName,
100 X509_NAME *issuerName, 100 ASN1_BIT_STRING* issuerKey, ASN1_INTEGER *serialNumber)
101 ASN1_BIT_STRING* issuerKey, 101{
102 ASN1_INTEGER *serialNumber)
103 {
104 int nid; 102 int nid;
105 unsigned int i; 103 unsigned int i;
106 X509_ALGOR *alg; 104 X509_ALGOR *alg;
107 OCSP_CERTID *cid = NULL; 105 OCSP_CERTID *cid = NULL;
108 unsigned char md[EVP_MAX_MD_SIZE]; 106 unsigned char md[EVP_MAX_MD_SIZE];
109 107
110 if (!(cid = OCSP_CERTID_new())) goto err; 108 if (!(cid = OCSP_CERTID_new()))
109 goto err;
111 110
112 alg = cid->hashAlgorithm; 111 alg = cid->hashAlgorithm;
113 if (alg->algorithm != NULL) ASN1_OBJECT_free(alg->algorithm); 112 if (alg->algorithm != NULL)
114 if ((nid = EVP_MD_type(dgst)) == NID_undef) 113 ASN1_OBJECT_free(alg->algorithm);
115 { 114 if ((nid = EVP_MD_type(dgst)) == NID_undef) {
116 OCSPerr(OCSP_F_OCSP_CERT_ID_NEW,OCSP_R_UNKNOWN_NID); 115 OCSPerr(OCSP_F_OCSP_CERT_ID_NEW, OCSP_R_UNKNOWN_NID);
116 goto err;
117 }
118 if (!(alg->algorithm=OBJ_nid2obj(nid)))
119 goto err;
120 if ((alg->parameter=ASN1_TYPE_new()) == NULL)
117 goto err; 121 goto err;
118 }
119 if (!(alg->algorithm=OBJ_nid2obj(nid))) goto err;
120 if ((alg->parameter=ASN1_TYPE_new()) == NULL) goto err;
121 alg->parameter->type=V_ASN1_NULL; 122 alg->parameter->type=V_ASN1_NULL;
122 123
123 if (!X509_NAME_digest(issuerName, dgst, md, &i)) goto digerr; 124 if (!X509_NAME_digest(issuerName, dgst, md, &i))
124 if (!(ASN1_OCTET_STRING_set(cid->issuerNameHash, md, i))) goto err; 125 goto digerr;
126 if (!(ASN1_OCTET_STRING_set(cid->issuerNameHash, md, i)))
127 goto err;
125 128
126 /* Calculate the issuerKey hash, excluding tag and length */ 129 /* Calculate the issuerKey hash, excluding tag and length */
127 if (!EVP_Digest(issuerKey->data, issuerKey->length, md, &i, dgst, NULL)) 130 if (!EVP_Digest(issuerKey->data, issuerKey->length, md, &i, dgst, NULL))
128 goto err; 131 goto err;
129 132
130 if (!(ASN1_OCTET_STRING_set(cid->issuerKeyHash, md, i))) goto err; 133 if (!(ASN1_OCTET_STRING_set(cid->issuerKeyHash, md, i)))
134 goto err;
131 135
132 if (serialNumber) 136 if (serialNumber) {
133 {
134 ASN1_INTEGER_free(cid->serialNumber); 137 ASN1_INTEGER_free(cid->serialNumber);
135 if (!(cid->serialNumber = ASN1_INTEGER_dup(serialNumber))) goto err; 138 if (!(cid->serialNumber = ASN1_INTEGER_dup(serialNumber)))
136 } 139 goto err;
140 }
137 return cid; 141 return cid;
138digerr: 142digerr:
139 OCSPerr(OCSP_F_OCSP_CERT_ID_NEW,OCSP_R_DIGEST_ERR); 143 OCSPerr(OCSP_F_OCSP_CERT_ID_NEW, OCSP_R_DIGEST_ERR);
140err: 144err:
141 if (cid) OCSP_CERTID_free(cid); 145 if (cid)
146 OCSP_CERTID_free(cid);
142 return NULL; 147 return NULL;
143 } 148}
144 149
145int OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b) 150int
146 { 151OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b)
152{
147 int ret; 153 int ret;
154
148 ret = OBJ_cmp(a->hashAlgorithm->algorithm, b->hashAlgorithm->algorithm); 155 ret = OBJ_cmp(a->hashAlgorithm->algorithm, b->hashAlgorithm->algorithm);
149 if (ret) return ret; 156 if (ret)
157 return ret;
150 ret = ASN1_OCTET_STRING_cmp(a->issuerNameHash, b->issuerNameHash); 158 ret = ASN1_OCTET_STRING_cmp(a->issuerNameHash, b->issuerNameHash);
151 if (ret) return ret; 159 if (ret)
160 return ret;
152 return ASN1_OCTET_STRING_cmp(a->issuerKeyHash, b->issuerKeyHash); 161 return ASN1_OCTET_STRING_cmp(a->issuerKeyHash, b->issuerKeyHash);
153 } 162}
154 163
155int OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b) 164int
156 { 165OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b)
166{
157 int ret; 167 int ret;
168
158 ret = OCSP_id_issuer_cmp(a, b); 169 ret = OCSP_id_issuer_cmp(a, b);
159 if (ret) return ret; 170 if (ret)
171 return ret;
160 return ASN1_INTEGER_cmp(a->serialNumber, b->serialNumber); 172 return ASN1_INTEGER_cmp(a->serialNumber, b->serialNumber);
161 } 173}
162
163 174
164/* Parse a URL and split it up into host, port and path components and whether 175/* Parse a URL and split it up into host, port and path components and whether
165 * it is SSL. 176 * it is SSL.
166 */ 177 */
167 178int
168int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pssl) 179OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pssl)
169 { 180{
170 char *p, *buf; 181 char *p, *buf;
171
172 char *host, *port; 182 char *host, *port;
173 183
174 *phost = NULL; 184 *phost = NULL;
@@ -177,26 +187,23 @@ int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pss
177 187
178 /* dup the buffer since we are going to mess with it */ 188 /* dup the buffer since we are going to mess with it */
179 buf = BUF_strdup(url); 189 buf = BUF_strdup(url);
180 if (!buf) goto mem_err; 190 if (!buf)
191 goto mem_err;
181 192
182 /* Check for initial colon */ 193 /* Check for initial colon */
183 p = strchr(buf, ':'); 194 p = strchr(buf, ':');
184 195 if (!p)
185 if (!p) goto parse_err; 196 goto parse_err;
186 197
187 *(p++) = '\0'; 198 *(p++) = '\0';
188 199
189 if (!strcmp(buf, "http")) 200 if (!strcmp(buf, "http")) {
190 {
191 *pssl = 0; 201 *pssl = 0;
192 port = "80"; 202 port = "80";
193 } 203 } else if (!strcmp(buf, "https")) {
194 else if (!strcmp(buf, "https"))
195 {
196 *pssl = 1; 204 *pssl = 1;
197 port = "443"; 205 port = "443";
198 } 206 } else
199 else
200 goto parse_err; 207 goto parse_err;
201 208
202 /* Check for double slash */ 209 /* Check for double slash */
@@ -208,59 +215,56 @@ int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pss
208 host = p; 215 host = p;
209 216
210 /* Check for trailing part of path */ 217 /* Check for trailing part of path */
211
212 p = strchr(p, '/'); 218 p = strchr(p, '/');
213
214 if (!p) 219 if (!p)
215 *ppath = BUF_strdup("/"); 220 *ppath = BUF_strdup("/");
216 else 221 else {
217 {
218 *ppath = BUF_strdup(p); 222 *ppath = BUF_strdup(p);
219 /* Set start of path to 0 so hostname is valid */ 223 /* Set start of path to 0 so hostname is valid */
220 *p = '\0'; 224 *p = '\0';
221 } 225 }
222 226
223 if (!*ppath) goto mem_err; 227 if (!*ppath)
228 goto mem_err;
224 229
225 /* Look for optional ':' for port number */ 230 /* Look for optional ':' for port number */
226 if ((p = strchr(host, ':'))) 231 if ((p = strchr(host, ':'))) {
227 {
228 *p = 0; 232 *p = 0;
229 port = p + 1; 233 port = p + 1;
230 } 234 } else {
231 else
232 {
233 /* Not found: set default port */ 235 /* Not found: set default port */
234 if (*pssl) port = "443"; 236 if (*pssl)
235 else port = "80"; 237 port = "443";
236 } 238 else
239 port = "80";
240 }
237 241
238 *pport = BUF_strdup(port); 242 *pport = BUF_strdup(port);
239 if (!*pport) goto mem_err; 243 if (!*pport)
244 goto mem_err;
240 245
241 *phost = BUF_strdup(host); 246 *phost = BUF_strdup(host);
242 247
243 if (!*phost) goto mem_err; 248 if (!*phost)
249 goto mem_err;
244 250
245 free(buf); 251 free(buf);
246 252
247 return 1; 253 return 1;
248 254
249 mem_err: 255mem_err:
250 OCSPerr(OCSP_F_OCSP_PARSE_URL, ERR_R_MALLOC_FAILURE); 256 OCSPerr(OCSP_F_OCSP_PARSE_URL, ERR_R_MALLOC_FAILURE);
251 goto err; 257 goto err;
252 258
253 parse_err: 259parse_err:
254 OCSPerr(OCSP_F_OCSP_PARSE_URL, OCSP_R_ERROR_PARSING_URL); 260 OCSPerr(OCSP_F_OCSP_PARSE_URL, OCSP_R_ERROR_PARSING_URL);
255 261
256 262err:
257 err: 263 free(buf);
258 if (buf) free(buf); 264 free(*ppath);
259 if (*ppath) free(*ppath); 265 free(*pport);
260 if (*pport) free(*pport); 266 free(*phost);
261 if (*phost) free(*phost);
262 return 0; 267 return 0;
263 268}
264 }
265 269
266IMPLEMENT_ASN1_DUP_FUNCTION(OCSP_CERTID) 270IMPLEMENT_ASN1_DUP_FUNCTION(OCSP_CERTID)
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_prn.c b/src/lib/libssl/src/crypto/ocsp/ocsp_prn.c
index 87608ff399..9e4b81f061 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_prn.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_prn.c
@@ -66,8 +66,9 @@
66#include <openssl/ocsp.h> 66#include <openssl/ocsp.h>
67#include <openssl/pem.h> 67#include <openssl/pem.h>
68 68
69static int ocsp_certid_print(BIO *bp, OCSP_CERTID* a, int indent) 69static int
70 { 70ocsp_certid_print(BIO *bp, OCSP_CERTID* a, int indent)
71{
71 BIO_printf(bp, "%*sCertificate ID:\n", indent, ""); 72 BIO_printf(bp, "%*sCertificate ID:\n", indent, "");
72 indent += 2; 73 indent += 2;
73 BIO_printf(bp, "%*sHash Algorithm: ", indent, ""); 74 BIO_printf(bp, "%*sHash Algorithm: ", indent, "");
@@ -80,60 +81,68 @@ static int ocsp_certid_print(BIO *bp, OCSP_CERTID* a, int indent)
80 i2a_ASN1_INTEGER(bp, a->serialNumber); 81 i2a_ASN1_INTEGER(bp, a->serialNumber);
81 BIO_printf(bp, "\n"); 82 BIO_printf(bp, "\n");
82 return 1; 83 return 1;
83 } 84}
84 85
85typedef struct 86typedef struct {
86 {
87 long t; 87 long t;
88 const char *m; 88 const char *m;
89 } OCSP_TBLSTR; 89} OCSP_TBLSTR;
90 90
91static const char *table2string(long s, const OCSP_TBLSTR *ts, int len) 91static const char *
92table2string(long s, const OCSP_TBLSTR *ts, int len)
92{ 93{
93 const OCSP_TBLSTR *p; 94 const OCSP_TBLSTR *p;
95
94 for (p=ts; p < ts + len; p++) 96 for (p=ts; p < ts + len; p++)
95 if (p->t == s) 97 if (p->t == s)
96 return p->m; 98 return p->m;
97 return "(UNKNOWN)"; 99 return "(UNKNOWN)";
98} 100}
99 101
100const char *OCSP_response_status_str(long s) 102const char *
101 { 103OCSP_response_status_str(long s)
104{
102 static const OCSP_TBLSTR rstat_tbl[] = { 105 static const OCSP_TBLSTR rstat_tbl[] = {
103 { OCSP_RESPONSE_STATUS_SUCCESSFUL, "successful" }, 106 { OCSP_RESPONSE_STATUS_SUCCESSFUL, "successful" },
104 { OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, "malformedrequest" }, 107 { OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, "malformedrequest" },
105 { OCSP_RESPONSE_STATUS_INTERNALERROR, "internalerror" }, 108 { OCSP_RESPONSE_STATUS_INTERNALERROR, "internalerror" },
106 { OCSP_RESPONSE_STATUS_TRYLATER, "trylater" }, 109 { OCSP_RESPONSE_STATUS_TRYLATER, "trylater" },
107 { OCSP_RESPONSE_STATUS_SIGREQUIRED, "sigrequired" }, 110 { OCSP_RESPONSE_STATUS_SIGREQUIRED, "sigrequired" },
108 { OCSP_RESPONSE_STATUS_UNAUTHORIZED, "unauthorized" } }; 111 { OCSP_RESPONSE_STATUS_UNAUTHORIZED, "unauthorized" }
112 };
109 return table2string(s, rstat_tbl, 6); 113 return table2string(s, rstat_tbl, 6);
110 } 114}
111 115
112const char *OCSP_cert_status_str(long s) 116const char *
113 { 117OCSP_cert_status_str(long s)
118{
114 static const OCSP_TBLSTR cstat_tbl[] = { 119 static const OCSP_TBLSTR cstat_tbl[] = {
115 { V_OCSP_CERTSTATUS_GOOD, "good" }, 120 { V_OCSP_CERTSTATUS_GOOD, "good" },
116 { V_OCSP_CERTSTATUS_REVOKED, "revoked" }, 121 { V_OCSP_CERTSTATUS_REVOKED, "revoked" },
117 { V_OCSP_CERTSTATUS_UNKNOWN, "unknown" } }; 122 { V_OCSP_CERTSTATUS_UNKNOWN, "unknown" }
123 };
118 return table2string(s, cstat_tbl, 3); 124 return table2string(s, cstat_tbl, 3);
119 } 125}
120 126
121const char *OCSP_crl_reason_str(long s) 127const char *
122 { 128OCSP_crl_reason_str(long s)
129{
123 static const OCSP_TBLSTR reason_tbl[] = { 130 static const OCSP_TBLSTR reason_tbl[] = {
124 { OCSP_REVOKED_STATUS_UNSPECIFIED, "unspecified" }, 131 { OCSP_REVOKED_STATUS_UNSPECIFIED, "unspecified" },
125 { OCSP_REVOKED_STATUS_KEYCOMPROMISE, "keyCompromise" }, 132 { OCSP_REVOKED_STATUS_KEYCOMPROMISE, "keyCompromise" },
126 { OCSP_REVOKED_STATUS_CACOMPROMISE, "cACompromise" }, 133 { OCSP_REVOKED_STATUS_CACOMPROMISE, "cACompromise" },
127 { OCSP_REVOKED_STATUS_AFFILIATIONCHANGED, "affiliationChanged" }, 134 { OCSP_REVOKED_STATUS_AFFILIATIONCHANGED, "affiliationChanged" },
128 { OCSP_REVOKED_STATUS_SUPERSEDED, "superseded" }, 135 { OCSP_REVOKED_STATUS_SUPERSEDED, "superseded" },
129 { OCSP_REVOKED_STATUS_CESSATIONOFOPERATION, "cessationOfOperation" }, 136 { OCSP_REVOKED_STATUS_CESSATIONOFOPERATION, "cessationOfOperation" },
130 { OCSP_REVOKED_STATUS_CERTIFICATEHOLD, "certificateHold" }, 137 { OCSP_REVOKED_STATUS_CERTIFICATEHOLD, "certificateHold" },
131 { OCSP_REVOKED_STATUS_REMOVEFROMCRL, "removeFromCRL" } }; 138 { OCSP_REVOKED_STATUS_REMOVEFROMCRL, "removeFromCRL" }
139 };
132 return table2string(s, reason_tbl, 8); 140 return table2string(s, reason_tbl, 8);
133 } 141}
134 142
135int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* o, unsigned long flags) 143int
136 { 144OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* o, unsigned long flags)
145{
137 int i; 146 int i;
138 long l; 147 long l;
139 OCSP_CERTID* cid = NULL; 148 OCSP_CERTID* cid = NULL;
@@ -141,45 +150,45 @@ int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* o, unsigned long flags)
141 OCSP_REQINFO *inf = o->tbsRequest; 150 OCSP_REQINFO *inf = o->tbsRequest;
142 OCSP_SIGNATURE *sig = o->optionalSignature; 151 OCSP_SIGNATURE *sig = o->optionalSignature;
143 152
144 if (BIO_write(bp,"OCSP Request Data:\n",19) <= 0) goto err; 153 if (BIO_write(bp,"OCSP Request Data:\n",19) <= 0)
145 l=ASN1_INTEGER_get(inf->version); 154 goto err;
146 if (BIO_printf(bp," Version: %lu (0x%lx)",l+1,l) <= 0) goto err; 155 l = ASN1_INTEGER_get(inf->version);
147 if (inf->requestorName != NULL) 156 if (BIO_printf(bp," Version: %lu (0x%lx)",l+1,l) <= 0)
148 { 157 goto err;
158 if (inf->requestorName != NULL) {
149 if (BIO_write(bp,"\n Requestor Name: ",21) <= 0) 159 if (BIO_write(bp,"\n Requestor Name: ",21) <= 0)
150 goto err; 160 goto err;
151 GENERAL_NAME_print(bp, inf->requestorName); 161 GENERAL_NAME_print(bp, inf->requestorName);
152 } 162 }
153 if (BIO_write(bp,"\n Requestor List:\n",21) <= 0) goto err; 163 if (BIO_write(bp,"\n Requestor List:\n",21) <= 0)
154 for (i = 0; i < sk_OCSP_ONEREQ_num(inf->requestList); i++) 164 goto err;
155 { 165 for (i = 0; i < sk_OCSP_ONEREQ_num(inf->requestList); i++) {
156 one = sk_OCSP_ONEREQ_value(inf->requestList, i); 166 one = sk_OCSP_ONEREQ_value(inf->requestList, i);
157 cid = one->reqCert; 167 cid = one->reqCert;
158 ocsp_certid_print(bp, cid, 8); 168 ocsp_certid_print(bp, cid, 8);
159 if (!X509V3_extensions_print(bp, 169 if (!X509V3_extensions_print(bp, "Request Single Extensions",
160 "Request Single Extensions", 170 one->singleRequestExtensions, flags, 8))
161 one->singleRequestExtensions, flags, 8)) 171 goto err;
162 goto err; 172 }
163 }
164 if (!X509V3_extensions_print(bp, "Request Extensions", 173 if (!X509V3_extensions_print(bp, "Request Extensions",
165 inf->requestExtensions, flags, 4)) 174 inf->requestExtensions, flags, 4))
166 goto err; 175 goto err;
167 if (sig) 176 if (sig) {
168 { 177 X509_signature_print(bp, sig->signatureAlgorithm,
169 X509_signature_print(bp, sig->signatureAlgorithm, sig->signature); 178 sig->signature);
170 for (i=0; i<sk_X509_num(sig->certs); i++) 179 for (i=0; i<sk_X509_num(sig->certs); i++) {
171 {
172 X509_print(bp, sk_X509_value(sig->certs,i)); 180 X509_print(bp, sk_X509_value(sig->certs,i));
173 PEM_write_bio_X509(bp,sk_X509_value(sig->certs,i)); 181 PEM_write_bio_X509(bp,sk_X509_value(sig->certs,i));
174 }
175 } 182 }
183 }
176 return 1; 184 return 1;
177err: 185err:
178 return 0; 186 return 0;
179 } 187}
180 188
181int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags) 189int
182 { 190OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags)
191{
183 int i, ret = 0; 192 int i, ret = 0;
184 long l; 193 long l;
185 OCSP_CERTID *cid = NULL; 194 OCSP_CERTID *cid = NULL;
@@ -191,100 +200,107 @@ int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags)
191 OCSP_SINGLERESP *single = NULL; 200 OCSP_SINGLERESP *single = NULL;
192 OCSP_RESPBYTES *rb = o->responseBytes; 201 OCSP_RESPBYTES *rb = o->responseBytes;
193 202
194 if (BIO_puts(bp,"OCSP Response Data:\n") <= 0) goto err; 203 if (BIO_puts(bp,"OCSP Response Data:\n") <= 0)
195 l=ASN1_ENUMERATED_get(o->responseStatus); 204 goto err;
205 l = ASN1_ENUMERATED_get(o->responseStatus);
196 if (BIO_printf(bp," OCSP Response Status: %s (0x%lx)\n", 206 if (BIO_printf(bp," OCSP Response Status: %s (0x%lx)\n",
197 OCSP_response_status_str(l), l) <= 0) goto err; 207 OCSP_response_status_str(l), l) <= 0)
198 if (rb == NULL) return 1; 208 goto err;
199 if (BIO_puts(bp," Response Type: ") <= 0) 209 if (rb == NULL)
200 goto err; 210 return 1;
211 if (BIO_puts(bp," Response Type: ") <= 0)
212 goto err;
201 if(i2a_ASN1_OBJECT(bp, rb->responseType) <= 0) 213 if(i2a_ASN1_OBJECT(bp, rb->responseType) <= 0)
202 goto err; 214 goto err;
203 if (OBJ_obj2nid(rb->responseType) != NID_id_pkix_OCSP_basic) 215 if (OBJ_obj2nid(rb->responseType) != NID_id_pkix_OCSP_basic) {
204 {
205 BIO_puts(bp," (unknown response type)\n"); 216 BIO_puts(bp," (unknown response type)\n");
206 return 1; 217 return 1;
207 } 218 }
208 219
209 i = ASN1_STRING_length(rb->response); 220 i = ASN1_STRING_length(rb->response);
210 if (!(br = OCSP_response_get1_basic(o))) goto err; 221 if (!(br = OCSP_response_get1_basic(o)))
222 goto err;
211 rd = br->tbsResponseData; 223 rd = br->tbsResponseData;
212 l=ASN1_INTEGER_get(rd->version); 224 l = ASN1_INTEGER_get(rd->version);
213 if (BIO_printf(bp,"\n Version: %lu (0x%lx)\n", 225 if (BIO_printf(bp,"\n Version: %lu (0x%lx)\n", l+1,l) <= 0)
214 l+1,l) <= 0) goto err; 226 goto err;
215 if (BIO_puts(bp," Responder Id: ") <= 0) goto err; 227 if (BIO_puts(bp," Responder Id: ") <= 0)
228 goto err;
216 229
217 rid = rd->responderId; 230 rid = rd->responderId;
218 switch (rid->type) 231 switch (rid->type) {
219 { 232 case V_OCSP_RESPID_NAME:
220 case V_OCSP_RESPID_NAME: 233 X509_NAME_print_ex(bp, rid->value.byName, 0, XN_FLAG_ONELINE);
221 X509_NAME_print_ex(bp, rid->value.byName, 0, XN_FLAG_ONELINE); 234 break;
222 break; 235 case V_OCSP_RESPID_KEY:
223 case V_OCSP_RESPID_KEY: 236 i2a_ASN1_STRING(bp, rid->value.byKey, V_ASN1_OCTET_STRING);
224 i2a_ASN1_STRING(bp, rid->value.byKey, V_ASN1_OCTET_STRING); 237 break;
225 break; 238 }
226 }
227 239
228 if (BIO_printf(bp,"\n Produced At: ")<=0) goto err; 240 if (BIO_printf(bp,"\n Produced At: ")<=0)
229 if (!ASN1_GENERALIZEDTIME_print(bp, rd->producedAt)) goto err; 241 goto err;
230 if (BIO_printf(bp,"\n Responses:\n") <= 0) goto err; 242 if (!ASN1_GENERALIZEDTIME_print(bp, rd->producedAt))
231 for (i = 0; i < sk_OCSP_SINGLERESP_num(rd->responses); i++) 243 goto err;
232 { 244 if (BIO_printf(bp,"\n Responses:\n") <= 0)
233 if (! sk_OCSP_SINGLERESP_value(rd->responses, i)) continue; 245 goto err;
246 for (i = 0; i < sk_OCSP_SINGLERESP_num(rd->responses); i++) {
247 if (! sk_OCSP_SINGLERESP_value(rd->responses, i))
248 continue;
234 single = sk_OCSP_SINGLERESP_value(rd->responses, i); 249 single = sk_OCSP_SINGLERESP_value(rd->responses, i);
235 cid = single->certId; 250 cid = single->certId;
236 if(ocsp_certid_print(bp, cid, 4) <= 0) goto err; 251 if (ocsp_certid_print(bp, cid, 4) <= 0)
252 goto err;
237 cst = single->certStatus; 253 cst = single->certStatus;
238 if (BIO_printf(bp," Cert Status: %s", 254 if (BIO_printf(bp," Cert Status: %s",
239 OCSP_cert_status_str(cst->type)) <= 0) 255 OCSP_cert_status_str(cst->type)) <= 0)
240 goto err; 256 goto err;
241 if (cst->type == V_OCSP_CERTSTATUS_REVOKED) 257 if (cst->type == V_OCSP_CERTSTATUS_REVOKED) {
242 { 258 rev = cst->value.revoked;
243 rev = cst->value.revoked;
244 if (BIO_printf(bp, "\n Revocation Time: ") <= 0) 259 if (BIO_printf(bp, "\n Revocation Time: ") <= 0)
245 goto err;
246 if (!ASN1_GENERALIZEDTIME_print(bp,
247 rev->revocationTime))
248 goto err; 260 goto err;
249 if (rev->revocationReason) 261 if (!ASN1_GENERALIZEDTIME_print(bp,
250 { 262 rev->revocationTime))
251 l=ASN1_ENUMERATED_get(rev->revocationReason); 263 goto err;
252 if (BIO_printf(bp, 264 if (rev->revocationReason) {
253 "\n Revocation Reason: %s (0x%lx)", 265 l = ASN1_ENUMERATED_get(rev->revocationReason);
254 OCSP_crl_reason_str(l), l) <= 0) 266 if (BIO_printf(bp,
255 goto err; 267 "\n Revocation Reason: %s (0x%lx)",
256 } 268 OCSP_crl_reason_str(l), l) <= 0)
269 goto err;
257 } 270 }
258 if (BIO_printf(bp,"\n This Update: ") <= 0) goto err; 271 }
272 if (BIO_printf(bp,"\n This Update: ") <= 0)
273 goto err;
259 if (!ASN1_GENERALIZEDTIME_print(bp, single->thisUpdate)) 274 if (!ASN1_GENERALIZEDTIME_print(bp, single->thisUpdate))
260 goto err; 275 goto err;
261 if (single->nextUpdate) 276 if (single->nextUpdate) {
262 { 277 if (BIO_printf(bp,"\n Next Update: ") <= 0)
263 if (BIO_printf(bp,"\n Next Update: ") <= 0)goto err; 278 goto err;
264 if (!ASN1_GENERALIZEDTIME_print(bp,single->nextUpdate)) 279 if (!ASN1_GENERALIZEDTIME_print(bp,single->nextUpdate))
265 goto err; 280 goto err;
266 }
267 if (BIO_write(bp,"\n",1) <= 0) goto err;
268 if (!X509V3_extensions_print(bp,
269 "Response Single Extensions",
270 single->singleExtensions, flags, 8))
271 goto err;
272 if (BIO_write(bp,"\n",1) <= 0) goto err;
273 } 281 }
282 if (BIO_write(bp,"\n",1) <= 0)
283 goto err;
284 if (!X509V3_extensions_print(bp, "Response Single Extensions",
285 single->singleExtensions, flags, 8))
286 goto err;
287 if (BIO_write(bp,"\n",1) <= 0)
288 goto err;
289 }
274 if (!X509V3_extensions_print(bp, "Response Extensions", 290 if (!X509V3_extensions_print(bp, "Response Extensions",
275 rd->responseExtensions, flags, 4)) 291 rd->responseExtensions, flags, 4))
276 goto err; 292 goto err;
277 if(X509_signature_print(bp, br->signatureAlgorithm, br->signature) <= 0) 293 if (X509_signature_print(bp, br->signatureAlgorithm, br->signature) <=
278 goto err; 294 0)
295 goto err;
279 296
280 for (i=0; i<sk_X509_num(br->certs); i++) 297 for (i = 0; i < sk_X509_num(br->certs); i++) {
281 { 298 X509_print(bp, sk_X509_value(br->certs, i));
282 X509_print(bp, sk_X509_value(br->certs,i)); 299 PEM_write_bio_X509(bp,sk_X509_value(br->certs, i));
283 PEM_write_bio_X509(bp,sk_X509_value(br->certs,i)); 300 }
284 }
285 301
286 ret = 1; 302 ret = 1;
287err: 303err:
288 OCSP_BASICRESP_free(br); 304 OCSP_BASICRESP_free(br);
289 return ret; 305 return ret;
290 } 306}
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_srv.c b/src/lib/libssl/src/crypto/ocsp/ocsp_srv.c
index 1c606dd0b6..c14e8e2bc3 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_srv.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_srv.c
@@ -69,107 +69,118 @@
69 * relevant information from the request. 69 * relevant information from the request.
70 */ 70 */
71 71
72int OCSP_request_onereq_count(OCSP_REQUEST *req) 72int
73 { 73OCSP_request_onereq_count(OCSP_REQUEST *req)
74{
74 return sk_OCSP_ONEREQ_num(req->tbsRequest->requestList); 75 return sk_OCSP_ONEREQ_num(req->tbsRequest->requestList);
75 } 76}
76 77
77OCSP_ONEREQ *OCSP_request_onereq_get0(OCSP_REQUEST *req, int i) 78OCSP_ONEREQ *
78 { 79OCSP_request_onereq_get0(OCSP_REQUEST *req, int i)
80{
79 return sk_OCSP_ONEREQ_value(req->tbsRequest->requestList, i); 81 return sk_OCSP_ONEREQ_value(req->tbsRequest->requestList, i);
80 } 82}
81 83
82OCSP_CERTID *OCSP_onereq_get0_id(OCSP_ONEREQ *one) 84OCSP_CERTID *
83 { 85OCSP_onereq_get0_id(OCSP_ONEREQ *one)
86{
84 return one->reqCert; 87 return one->reqCert;
85 } 88}
86 89
87int OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd, 90int
88 ASN1_OCTET_STRING **pikeyHash, 91OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd,
89 ASN1_INTEGER **pserial, OCSP_CERTID *cid) 92 ASN1_OCTET_STRING **pikeyHash, ASN1_INTEGER **pserial, OCSP_CERTID *cid)
90 { 93{
91 if (!cid) return 0; 94 if (!cid)
92 if (pmd) *pmd = cid->hashAlgorithm->algorithm; 95 return 0;
93 if(piNameHash) *piNameHash = cid->issuerNameHash; 96 if (pmd)
94 if (pikeyHash) *pikeyHash = cid->issuerKeyHash; 97 *pmd = cid->hashAlgorithm->algorithm;
95 if (pserial) *pserial = cid->serialNumber; 98 if (piNameHash)
99 *piNameHash = cid->issuerNameHash;
100 if (pikeyHash)
101 *pikeyHash = cid->issuerKeyHash;
102 if (pserial)
103 *pserial = cid->serialNumber;
96 return 1; 104 return 1;
97 } 105}
98 106
99int OCSP_request_is_signed(OCSP_REQUEST *req) 107int
100 { 108OCSP_request_is_signed(OCSP_REQUEST *req)
101 if(req->optionalSignature) return 1; 109{
110 if (req->optionalSignature)
111 return 1;
102 return 0; 112 return 0;
103 } 113}
104 114
105/* Create an OCSP response and encode an optional basic response */ 115/* Create an OCSP response and encode an optional basic response */
106OCSP_RESPONSE *OCSP_response_create(int status, OCSP_BASICRESP *bs) 116OCSP_RESPONSE *
107 { 117OCSP_response_create(int status, OCSP_BASICRESP *bs)
108 OCSP_RESPONSE *rsp = NULL; 118{
119 OCSP_RESPONSE *rsp = NULL;
109 120
110 if (!(rsp = OCSP_RESPONSE_new())) goto err; 121 if (!(rsp = OCSP_RESPONSE_new()))
111 if (!(ASN1_ENUMERATED_set(rsp->responseStatus, status))) goto err; 122 goto err;
112 if (!bs) return rsp; 123 if (!(ASN1_ENUMERATED_set(rsp->responseStatus, status)))
113 if (!(rsp->responseBytes = OCSP_RESPBYTES_new())) goto err; 124 goto err;
125 if (!bs)
126 return rsp;
127 if (!(rsp->responseBytes = OCSP_RESPBYTES_new()))
128 goto err;
114 rsp->responseBytes->responseType = OBJ_nid2obj(NID_id_pkix_OCSP_basic); 129 rsp->responseBytes->responseType = OBJ_nid2obj(NID_id_pkix_OCSP_basic);
115 if (!ASN1_item_pack(bs, ASN1_ITEM_rptr(OCSP_BASICRESP), &rsp->responseBytes->response)) 130 if (!ASN1_item_pack(bs, ASN1_ITEM_rptr(OCSP_BASICRESP),
116 goto err; 131 &rsp->responseBytes->response))
132 goto err;
117 return rsp; 133 return rsp;
118err: 134err:
119 if (rsp) OCSP_RESPONSE_free(rsp); 135 if (rsp)
136 OCSP_RESPONSE_free(rsp);
120 return NULL; 137 return NULL;
121 } 138}
122
123 139
124OCSP_SINGLERESP *OCSP_basic_add1_status(OCSP_BASICRESP *rsp, 140OCSP_SINGLERESP *
125 OCSP_CERTID *cid, 141OCSP_basic_add1_status(OCSP_BASICRESP *rsp, OCSP_CERTID *cid, int status,
126 int status, int reason, 142 int reason, ASN1_TIME *revtime, ASN1_TIME *thisupd, ASN1_TIME *nextupd)
127 ASN1_TIME *revtime, 143{
128 ASN1_TIME *thisupd, ASN1_TIME *nextupd)
129 {
130 OCSP_SINGLERESP *single = NULL; 144 OCSP_SINGLERESP *single = NULL;
131 OCSP_CERTSTATUS *cs; 145 OCSP_CERTSTATUS *cs;
132 OCSP_REVOKEDINFO *ri; 146 OCSP_REVOKEDINFO *ri;
133 147
134 if(!rsp->tbsResponseData->responses && 148 if (!rsp->tbsResponseData->responses &&
135 !(rsp->tbsResponseData->responses = sk_OCSP_SINGLERESP_new_null())) 149 !(rsp->tbsResponseData->responses = sk_OCSP_SINGLERESP_new_null()))
136 goto err; 150 goto err;
137 151
138 if (!(single = OCSP_SINGLERESP_new())) 152 if (!(single = OCSP_SINGLERESP_new()))
139 goto err; 153 goto err;
140 154
141
142
143 if (!ASN1_TIME_to_generalizedtime(thisupd, &single->thisUpdate)) 155 if (!ASN1_TIME_to_generalizedtime(thisupd, &single->thisUpdate))
144 goto err; 156 goto err;
145 if (nextupd && 157 if (nextupd &&
146 !ASN1_TIME_to_generalizedtime(nextupd, &single->nextUpdate)) 158 !ASN1_TIME_to_generalizedtime(nextupd, &single->nextUpdate))
147 goto err; 159 goto err;
148 160
149 OCSP_CERTID_free(single->certId); 161 OCSP_CERTID_free(single->certId);
150 162
151 if(!(single->certId = OCSP_CERTID_dup(cid))) 163 if (!(single->certId = OCSP_CERTID_dup(cid)))
152 goto err; 164 goto err;
153 165
154 cs = single->certStatus; 166 cs = single->certStatus;
155 switch(cs->type = status) 167 switch(cs->type = status) {
156 {
157 case V_OCSP_CERTSTATUS_REVOKED: 168 case V_OCSP_CERTSTATUS_REVOKED:
158 if (!revtime) 169 if (!revtime) {
159 { 170 OCSPerr(OCSP_F_OCSP_BASIC_ADD1_STATUS,
160 OCSPerr(OCSP_F_OCSP_BASIC_ADD1_STATUS,OCSP_R_NO_REVOKED_TIME); 171 OCSP_R_NO_REVOKED_TIME);
172 goto err;
173 }
174 if (!(cs->value.revoked = ri = OCSP_REVOKEDINFO_new()))
161 goto err; 175 goto err;
162 }
163 if (!(cs->value.revoked = ri = OCSP_REVOKEDINFO_new())) goto err;
164 if (!ASN1_TIME_to_generalizedtime(revtime, &ri->revocationTime)) 176 if (!ASN1_TIME_to_generalizedtime(revtime, &ri->revocationTime))
165 goto err; 177 goto err;
166 if (reason != OCSP_REVOKED_STATUS_NOSTATUS) 178 if (reason != OCSP_REVOKED_STATUS_NOSTATUS) {
167 {
168 if (!(ri->revocationReason = ASN1_ENUMERATED_new())) 179 if (!(ri->revocationReason = ASN1_ENUMERATED_new()))
169 goto err; 180 goto err;
170 if (!(ASN1_ENUMERATED_set(ri->revocationReason, 181 if (!(ASN1_ENUMERATED_set(ri->revocationReason,
171 reason))) 182 reason)))
172 goto err; 183 goto err;
173 } 184 }
174 break; 185 break;
175 186
@@ -183,82 +194,80 @@ OCSP_SINGLERESP *OCSP_basic_add1_status(OCSP_BASICRESP *rsp,
183 194
184 default: 195 default:
185 goto err; 196 goto err;
186 197 }
187 }
188 if (!(sk_OCSP_SINGLERESP_push(rsp->tbsResponseData->responses, single))) 198 if (!(sk_OCSP_SINGLERESP_push(rsp->tbsResponseData->responses, single)))
189 goto err; 199 goto err;
190 return single; 200 return single;
191err: 201err:
192 OCSP_SINGLERESP_free(single); 202 OCSP_SINGLERESP_free(single);
193 return NULL; 203 return NULL;
194 } 204}
195 205
196/* Add a certificate to an OCSP request */ 206/* Add a certificate to an OCSP request */
197 207int
198int OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert) 208OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert)
199 { 209{
200 if (!resp->certs && !(resp->certs = sk_X509_new_null())) 210 if (!resp->certs && !(resp->certs = sk_X509_new_null()))
201 return 0; 211 return 0;
202 212
203 if(!sk_X509_push(resp->certs, cert)) return 0; 213 if (!sk_X509_push(resp->certs, cert))
214 return 0;
204 CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509); 215 CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509);
205 return 1; 216 return 1;
206 } 217}
207 218
208int OCSP_basic_sign(OCSP_BASICRESP *brsp, 219int
209 X509 *signer, EVP_PKEY *key, const EVP_MD *dgst, 220OCSP_basic_sign(OCSP_BASICRESP *brsp, X509 *signer, EVP_PKEY *key,
210 STACK_OF(X509) *certs, unsigned long flags) 221 const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags)
211 { 222{
212 int i; 223 int i;
213 OCSP_RESPID *rid; 224 OCSP_RESPID *rid;
214 225
215 if (!X509_check_private_key(signer, key)) 226 if (!X509_check_private_key(signer, key)) {
216 { 227 OCSPerr(OCSP_F_OCSP_BASIC_SIGN,
217 OCSPerr(OCSP_F_OCSP_BASIC_SIGN, OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); 228 OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
218 goto err; 229 goto err;
219 } 230 }
220 231
221 if(!(flags & OCSP_NOCERTS)) 232 if (!(flags & OCSP_NOCERTS)) {
222 { 233 if (!OCSP_basic_add1_cert(brsp, signer))
223 if(!OCSP_basic_add1_cert(brsp, signer))
224 goto err; 234 goto err;
225 for (i = 0; i < sk_X509_num(certs); i++) 235 for (i = 0; i < sk_X509_num(certs); i++) {
226 {
227 X509 *tmpcert = sk_X509_value(certs, i); 236 X509 *tmpcert = sk_X509_value(certs, i);
228 if(!OCSP_basic_add1_cert(brsp, tmpcert)) 237 if (!OCSP_basic_add1_cert(brsp, tmpcert))
229 goto err; 238 goto err;
230 }
231 } 239 }
240 }
232 241
233 rid = brsp->tbsResponseData->responderId; 242 rid = brsp->tbsResponseData->responderId;
234 if (flags & OCSP_RESPID_KEY) 243 if (flags & OCSP_RESPID_KEY) {
235 {
236 unsigned char md[SHA_DIGEST_LENGTH]; 244 unsigned char md[SHA_DIGEST_LENGTH];
245
237 X509_pubkey_digest(signer, EVP_sha1(), md, NULL); 246 X509_pubkey_digest(signer, EVP_sha1(), md, NULL);
238 if (!(rid->value.byKey = ASN1_OCTET_STRING_new())) 247 if (!(rid->value.byKey = ASN1_OCTET_STRING_new()))
239 goto err; 248 goto err;
240 if (!(ASN1_OCTET_STRING_set(rid->value.byKey, md, SHA_DIGEST_LENGTH))) 249 if (!(ASN1_OCTET_STRING_set(rid->value.byKey, md,
241 goto err; 250 SHA_DIGEST_LENGTH)))
251 goto err;
242 rid->type = V_OCSP_RESPID_KEY; 252 rid->type = V_OCSP_RESPID_KEY;
243 } 253 } else {
244 else
245 {
246 if (!X509_NAME_set(&rid->value.byName, 254 if (!X509_NAME_set(&rid->value.byName,
247 X509_get_subject_name(signer))) 255 X509_get_subject_name(signer)))
248 goto err; 256 goto err;
249 rid->type = V_OCSP_RESPID_NAME; 257 rid->type = V_OCSP_RESPID_NAME;
250 } 258 }
251 259
252 if (!(flags & OCSP_NOTIME) && 260 if (!(flags & OCSP_NOTIME) &&
253 !X509_gmtime_adj(brsp->tbsResponseData->producedAt, 0)) 261 !X509_gmtime_adj(brsp->tbsResponseData->producedAt, 0))
254 goto err; 262 goto err;
255 263
256 /* Right now, I think that not doing double hashing is the right 264 /* Right now, I think that not doing double hashing is the right
257 thing. -- Richard Levitte */ 265 thing. -- Richard Levitte */
258 266
259 if (!OCSP_BASICRESP_sign(brsp, key, dgst, 0)) goto err; 267 if (!OCSP_BASICRESP_sign(brsp, key, dgst, 0))
268 goto err;
260 269
261 return 1; 270 return 1;
262err: 271err:
263 return 0; 272 return 0;
264 } 273}
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c b/src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c
index 0b181d5abe..aede155871 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c
@@ -60,134 +60,137 @@
60#include <openssl/err.h> 60#include <openssl/err.h>
61#include <string.h> 61#include <string.h>
62 62
63static int ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs, STACK_OF(X509) *certs, 63static int ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs,
64 X509_STORE *st, unsigned long flags); 64 STACK_OF(X509) *certs, X509_STORE *st, unsigned long flags);
65static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id); 65static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id);
66static int ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain, unsigned long flags); 66static int ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain,
67 unsigned long flags);
67static int ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret); 68static int ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret);
68static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid, STACK_OF(OCSP_SINGLERESP) *sresp); 69static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,
70 STACK_OF(OCSP_SINGLERESP) *sresp);
69static int ocsp_check_delegated(X509 *x, int flags); 71static int ocsp_check_delegated(X509 *x, int flags);
70static int ocsp_req_find_signer(X509 **psigner, OCSP_REQUEST *req, X509_NAME *nm, STACK_OF(X509) *certs, 72static int ocsp_req_find_signer(X509 **psigner, OCSP_REQUEST *req,
71 X509_STORE *st, unsigned long flags); 73 X509_NAME *nm, STACK_OF(X509) *certs, X509_STORE *st,
74 unsigned long flags);
72 75
73/* Verify a basic response message */ 76/* Verify a basic response message */
74 77int
75int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, 78OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, X509_STORE *st,
76 X509_STORE *st, unsigned long flags) 79 unsigned long flags)
77 { 80{
78 X509 *signer, *x; 81 X509 *signer, *x;
79 STACK_OF(X509) *chain = NULL; 82 STACK_OF(X509) *chain = NULL;
80 X509_STORE_CTX ctx; 83 X509_STORE_CTX ctx;
81 int i, ret = 0; 84 int i, ret = 0;
85
82 ret = ocsp_find_signer(&signer, bs, certs, st, flags); 86 ret = ocsp_find_signer(&signer, bs, certs, st, flags);
83 if (!ret) 87 if (!ret) {
84 { 88 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,
85 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY, OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND); 89 OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND);
86 goto end; 90 goto end;
87 } 91 }
88 if ((ret == 2) && (flags & OCSP_TRUSTOTHER)) 92 if ((ret == 2) && (flags & OCSP_TRUSTOTHER))
89 flags |= OCSP_NOVERIFY; 93 flags |= OCSP_NOVERIFY;
90 if (!(flags & OCSP_NOSIGS)) 94 if (!(flags & OCSP_NOSIGS)) {
91 {
92 EVP_PKEY *skey; 95 EVP_PKEY *skey;
96
93 skey = X509_get_pubkey(signer); 97 skey = X509_get_pubkey(signer);
94 if (skey) 98 if (skey) {
95 {
96 ret = OCSP_BASICRESP_verify(bs, skey, 0); 99 ret = OCSP_BASICRESP_verify(bs, skey, 0);
97 EVP_PKEY_free(skey); 100 EVP_PKEY_free(skey);
98 } 101 }
99 if(!skey || ret <= 0) 102 if (!skey || ret <= 0) {
100 { 103 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,
101 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY, OCSP_R_SIGNATURE_FAILURE); 104 OCSP_R_SIGNATURE_FAILURE);
102 goto end; 105 goto end;
103 }
104 } 106 }
105 if (!(flags & OCSP_NOVERIFY)) 107 }
106 { 108 if (!(flags & OCSP_NOVERIFY)) {
107 int init_res; 109 int init_res;
110
108 if(flags & OCSP_NOCHAIN) 111 if(flags & OCSP_NOCHAIN)
109 init_res = X509_STORE_CTX_init(&ctx, st, signer, NULL); 112 init_res = X509_STORE_CTX_init(&ctx, st, signer, NULL);
110 else 113 else
111 init_res = X509_STORE_CTX_init(&ctx, st, signer, bs->certs); 114 init_res = X509_STORE_CTX_init(&ctx, st, signer,
112 if(!init_res) 115 bs->certs);
113 { 116 if (!init_res) {
114 ret = -1; 117 ret = -1;
115 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,ERR_R_X509_LIB); 118 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,ERR_R_X509_LIB);
116 goto end; 119 goto end;
117 } 120 }
118 121
119 X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_OCSP_HELPER); 122 X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_OCSP_HELPER);
120 ret = X509_verify_cert(&ctx); 123 ret = X509_verify_cert(&ctx);
121 chain = X509_STORE_CTX_get1_chain(&ctx); 124 chain = X509_STORE_CTX_get1_chain(&ctx);
122 X509_STORE_CTX_cleanup(&ctx); 125 X509_STORE_CTX_cleanup(&ctx);
123 if (ret <= 0) 126 if (ret <= 0) {
124 {
125 i = X509_STORE_CTX_get_error(&ctx); 127 i = X509_STORE_CTX_get_error(&ctx);
126 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,OCSP_R_CERTIFICATE_VERIFY_ERROR); 128 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,
129 OCSP_R_CERTIFICATE_VERIFY_ERROR);
127 ERR_asprintf_error_data("Verify error:%s", 130 ERR_asprintf_error_data("Verify error:%s",
128 X509_verify_cert_error_string(i)); 131 X509_verify_cert_error_string(i));
129 goto end; 132 goto end;
130 } 133 }
131 if(flags & OCSP_NOCHECKS) 134 if(flags & OCSP_NOCHECKS) {
132 {
133 ret = 1; 135 ret = 1;
134 goto end; 136 goto end;
135 } 137 }
136 /* At this point we have a valid certificate chain 138 /* At this point we have a valid certificate chain
137 * need to verify it against the OCSP issuer criteria. 139 * need to verify it against the OCSP issuer criteria.
138 */ 140 */
139 ret = ocsp_check_issuer(bs, chain, flags); 141 ret = ocsp_check_issuer(bs, chain, flags);
140 142
141 /* If fatal error or valid match then finish */ 143 /* If fatal error or valid match then finish */
142 if (ret != 0) goto end; 144 if (ret != 0)
145 goto end;
143 146
144 /* Easy case: explicitly trusted. Get root CA and 147 /* Easy case: explicitly trusted. Get root CA and
145 * check for explicit trust 148 * check for explicit trust
146 */ 149 */
147 if(flags & OCSP_NOEXPLICIT) goto end; 150 if (flags & OCSP_NOEXPLICIT)
151 goto end;
148 152
149 x = sk_X509_value(chain, sk_X509_num(chain) - 1); 153 x = sk_X509_value(chain, sk_X509_num(chain) - 1);
150 if(X509_check_trust(x, NID_OCSP_sign, 0) != X509_TRUST_TRUSTED) 154 if (X509_check_trust(x, NID_OCSP_sign, 0) !=
151 { 155 X509_TRUST_TRUSTED) {
152 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,OCSP_R_ROOT_CA_NOT_TRUSTED); 156 OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,
157 OCSP_R_ROOT_CA_NOT_TRUSTED);
153 goto end; 158 goto end;
154 }
155 ret = 1;
156 } 159 }
157 160 ret = 1;
158
159
160 end:
161 if(chain) sk_X509_pop_free(chain, X509_free);
162 return ret;
163 } 161 }
164 162
163end:
164 if (chain)
165 sk_X509_pop_free(chain, X509_free);
166 return ret;
167}
165 168
166static int ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs, STACK_OF(X509) *certs, 169static int
167 X509_STORE *st, unsigned long flags) 170ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
168 { 171 X509_STORE *st, unsigned long flags)
172{
169 X509 *signer; 173 X509 *signer;
170 OCSP_RESPID *rid = bs->tbsResponseData->responderId; 174 OCSP_RESPID *rid = bs->tbsResponseData->responderId;
171 if ((signer = ocsp_find_signer_sk(certs, rid))) 175
172 { 176 if ((signer = ocsp_find_signer_sk(certs, rid))) {
173 *psigner = signer; 177 *psigner = signer;
174 return 2; 178 return 2;
175 } 179 }
176 if(!(flags & OCSP_NOINTERN) && 180 if (!(flags & OCSP_NOINTERN) &&
177 (signer = ocsp_find_signer_sk(bs->certs, rid))) 181 (signer = ocsp_find_signer_sk(bs->certs, rid))) {
178 {
179 *psigner = signer; 182 *psigner = signer;
180 return 1; 183 return 1;
181 } 184 }
182 /* Maybe lookup from store if by subject name */ 185 /* Maybe lookup from store if by subject name */
183 186
184 *psigner = NULL; 187 *psigner = NULL;
185 return 0; 188 return 0;
186 } 189}
187
188 190
189static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id) 191static X509 *
190 { 192ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id)
193{
191 int i; 194 int i;
192 unsigned char tmphash[SHA_DIGEST_LENGTH], *keyhash; 195 unsigned char tmphash[SHA_DIGEST_LENGTH], *keyhash;
193 X509 *x; 196 X509 *x;
@@ -199,123 +202,124 @@ static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id)
199 /* Lookup by key hash */ 202 /* Lookup by key hash */
200 203
201 /* If key hash isn't SHA1 length then forget it */ 204 /* If key hash isn't SHA1 length then forget it */
202 if (id->value.byKey->length != SHA_DIGEST_LENGTH) return NULL; 205 if (id->value.byKey->length != SHA_DIGEST_LENGTH)
206 return NULL;
203 keyhash = id->value.byKey->data; 207 keyhash = id->value.byKey->data;
204 /* Calculate hash of each key and compare */ 208 /* Calculate hash of each key and compare */
205 for (i = 0; i < sk_X509_num(certs); i++) 209 for (i = 0; i < sk_X509_num(certs); i++) {
206 {
207 x = sk_X509_value(certs, i); 210 x = sk_X509_value(certs, i);
208 X509_pubkey_digest(x, EVP_sha1(), tmphash, NULL); 211 X509_pubkey_digest(x, EVP_sha1(), tmphash, NULL);
209 if(!memcmp(keyhash, tmphash, SHA_DIGEST_LENGTH)) 212 if (!memcmp(keyhash, tmphash, SHA_DIGEST_LENGTH))
210 return x; 213 return x;
211 }
212 return NULL;
213 } 214 }
215 return NULL;
216}
214 217
215 218static int
216static int ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain, unsigned long flags) 219ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain,
217 { 220 unsigned long flags)
221{
218 STACK_OF(OCSP_SINGLERESP) *sresp; 222 STACK_OF(OCSP_SINGLERESP) *sresp;
219 X509 *signer, *sca; 223 X509 *signer, *sca;
220 OCSP_CERTID *caid = NULL; 224 OCSP_CERTID *caid = NULL;
221 int i; 225 int i;
226
222 sresp = bs->tbsResponseData->responses; 227 sresp = bs->tbsResponseData->responses;
223 228
224 if (sk_X509_num(chain) <= 0) 229 if (sk_X509_num(chain) <= 0) {
225 { 230 OCSPerr(OCSP_F_OCSP_CHECK_ISSUER,
226 OCSPerr(OCSP_F_OCSP_CHECK_ISSUER, OCSP_R_NO_CERTIFICATES_IN_CHAIN); 231 OCSP_R_NO_CERTIFICATES_IN_CHAIN);
227 return -1; 232 return -1;
228 } 233 }
229 234
230 /* See if the issuer IDs match. */ 235 /* See if the issuer IDs match. */
231 i = ocsp_check_ids(sresp, &caid); 236 i = ocsp_check_ids(sresp, &caid);
232 237
233 /* If ID mismatch or other error then return */ 238 /* If ID mismatch or other error then return */
234 if (i <= 0) return i; 239 if (i <= 0)
240 return i;
235 241
236 signer = sk_X509_value(chain, 0); 242 signer = sk_X509_value(chain, 0);
237 /* Check to see if OCSP responder CA matches request CA */ 243 /* Check to see if OCSP responder CA matches request CA */
238 if (sk_X509_num(chain) > 1) 244 if (sk_X509_num(chain) > 1) {
239 {
240 sca = sk_X509_value(chain, 1); 245 sca = sk_X509_value(chain, 1);
241 i = ocsp_match_issuerid(sca, caid, sresp); 246 i = ocsp_match_issuerid(sca, caid, sresp);
242 if (i < 0) return i; 247 if (i < 0)
243 if (i) 248 return i;
244 { 249 if (i) {
245 /* We have a match, if extensions OK then success */ 250 /* We have a match, if extensions OK then success */
246 if (ocsp_check_delegated(signer, flags)) return 1; 251 if (ocsp_check_delegated(signer, flags))
252 return 1;
247 return 0; 253 return 0;
248 }
249 } 254 }
255 }
250 256
251 /* Otherwise check if OCSP request signed directly by request CA */ 257 /* Otherwise check if OCSP request signed directly by request CA */
252 return ocsp_match_issuerid(signer, caid, sresp); 258 return ocsp_match_issuerid(signer, caid, sresp);
253 } 259}
254
255 260
256/* Check the issuer certificate IDs for equality. If there is a mismatch with the same 261/* Check the issuer certificate IDs for equality. If there is a mismatch with the same
257 * algorithm then there's no point trying to match any certificates against the issuer. 262 * algorithm then there's no point trying to match any certificates against the issuer.
258 * If the issuer IDs all match then we just need to check equality against one of them. 263 * If the issuer IDs all match then we just need to check equality against one of them.
259 */ 264 */
260 265static int
261static int ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret) 266ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret)
262 { 267{
263 OCSP_CERTID *tmpid, *cid; 268 OCSP_CERTID *tmpid, *cid;
264 int i, idcount; 269 int i, idcount;
265 270
266 idcount = sk_OCSP_SINGLERESP_num(sresp); 271 idcount = sk_OCSP_SINGLERESP_num(sresp);
267 if (idcount <= 0) 272 if (idcount <= 0) {
268 { 273 OCSPerr(OCSP_F_OCSP_CHECK_IDS,
269 OCSPerr(OCSP_F_OCSP_CHECK_IDS, OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA); 274 OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA);
270 return -1; 275 return -1;
271 } 276 }
272 277
273 cid = sk_OCSP_SINGLERESP_value(sresp, 0)->certId; 278 cid = sk_OCSP_SINGLERESP_value(sresp, 0)->certId;
274 279
275 *ret = NULL; 280 *ret = NULL;
276 281
277 for (i = 1; i < idcount; i++) 282 for (i = 1; i < idcount; i++) {
278 {
279 tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId; 283 tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId;
280 /* Check to see if IDs match */ 284 /* Check to see if IDs match */
281 if (OCSP_id_issuer_cmp(cid, tmpid)) 285 if (OCSP_id_issuer_cmp(cid, tmpid)) {
282 {
283 /* If algoritm mismatch let caller deal with it */ 286 /* If algoritm mismatch let caller deal with it */
284 if (OBJ_cmp(tmpid->hashAlgorithm->algorithm, 287 if (OBJ_cmp(tmpid->hashAlgorithm->algorithm,
285 cid->hashAlgorithm->algorithm)) 288 cid->hashAlgorithm->algorithm))
286 return 2; 289 return 2;
287 /* Else mismatch */ 290 /* Else mismatch */
288 return 0; 291 return 0;
289 }
290 } 292 }
293 }
291 294
292 /* All IDs match: only need to check one ID */ 295 /* All IDs match: only need to check one ID */
293 *ret = cid; 296 *ret = cid;
294 return 1; 297 return 1;
295 } 298}
296 299
297 300static int
298static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid, 301ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,
299 STACK_OF(OCSP_SINGLERESP) *sresp) 302 STACK_OF(OCSP_SINGLERESP) *sresp)
300 { 303{
301 /* If only one ID to match then do it */ 304 /* If only one ID to match then do it */
302 if(cid) 305 if (cid) {
303 {
304 const EVP_MD *dgst; 306 const EVP_MD *dgst;
305 X509_NAME *iname; 307 X509_NAME *iname;
306 int mdlen; 308 int mdlen;
307 unsigned char md[EVP_MAX_MD_SIZE]; 309 unsigned char md[EVP_MAX_MD_SIZE];
308 if (!(dgst = EVP_get_digestbyobj(cid->hashAlgorithm->algorithm))) 310
309 { 311 if (!(dgst =
310 OCSPerr(OCSP_F_OCSP_MATCH_ISSUERID, OCSP_R_UNKNOWN_MESSAGE_DIGEST); 312 EVP_get_digestbyobj(cid->hashAlgorithm->algorithm))) {
313 OCSPerr(OCSP_F_OCSP_MATCH_ISSUERID,
314 OCSP_R_UNKNOWN_MESSAGE_DIGEST);
311 return -1; 315 return -1;
312 } 316 }
313 317
314 mdlen = EVP_MD_size(dgst); 318 mdlen = EVP_MD_size(dgst);
315 if (mdlen < 0) 319 if (mdlen < 0)
316 return -1; 320 return -1;
317 if ((cid->issuerNameHash->length != mdlen) || 321 if (cid->issuerNameHash->length != mdlen ||
318 (cid->issuerKeyHash->length != mdlen)) 322 cid->issuerKeyHash->length != mdlen)
319 return 0; 323 return 0;
320 iname = X509_get_subject_name(cert); 324 iname = X509_get_subject_name(cert);
321 if (!X509_NAME_digest(iname, dgst, md, NULL)) 325 if (!X509_NAME_digest(iname, dgst, md, NULL))
@@ -327,124 +331,123 @@ static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,
327 return 0; 331 return 0;
328 332
329 return 1; 333 return 1;
330 334 } else {
331 }
332 else
333 {
334 /* We have to match the whole lot */ 335 /* We have to match the whole lot */
335 int i, ret; 336 int i, ret;
336 OCSP_CERTID *tmpid; 337 OCSP_CERTID *tmpid;
337 for (i = 0; i < sk_OCSP_SINGLERESP_num(sresp); i++) 338
338 { 339 for (i = 0; i < sk_OCSP_SINGLERESP_num(sresp); i++) {
339 tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId; 340 tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId;
340 ret = ocsp_match_issuerid(cert, tmpid, NULL); 341 ret = ocsp_match_issuerid(cert, tmpid, NULL);
341 if (ret <= 0) return ret; 342 if (ret <= 0)
342 } 343 return ret;
343 return 1;
344 } 344 }
345 345 return 1;
346 } 346 }
347}
347 348
348static int ocsp_check_delegated(X509 *x, int flags) 349static int
349 { 350ocsp_check_delegated(X509 *x, int flags)
351{
350 X509_check_purpose(x, -1, 0); 352 X509_check_purpose(x, -1, 0);
351 if ((x->ex_flags & EXFLAG_XKUSAGE) && 353 if ((x->ex_flags & EXFLAG_XKUSAGE) && (x->ex_xkusage & XKU_OCSP_SIGN))
352 (x->ex_xkusage & XKU_OCSP_SIGN))
353 return 1; 354 return 1;
354 OCSPerr(OCSP_F_OCSP_CHECK_DELEGATED, OCSP_R_MISSING_OCSPSIGNING_USAGE); 355 OCSPerr(OCSP_F_OCSP_CHECK_DELEGATED, OCSP_R_MISSING_OCSPSIGNING_USAGE);
355 return 0; 356 return 0;
356 } 357}
357 358
358/* Verify an OCSP request. This is fortunately much easier than OCSP 359/* Verify an OCSP request. This is fortunately much easier than OCSP
359 * response verify. Just find the signers certificate and verify it 360 * response verify. Just find the signers certificate and verify it
360 * against a given trust value. 361 * against a given trust value.
361 */ 362 */
362 363int
363int OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *store, unsigned long flags) 364OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *store,
364 { 365 unsigned long flags)
366{
365 X509 *signer; 367 X509 *signer;
366 X509_NAME *nm; 368 X509_NAME *nm;
367 GENERAL_NAME *gen; 369 GENERAL_NAME *gen;
368 int ret; 370 int ret;
369 X509_STORE_CTX ctx; 371 X509_STORE_CTX ctx;
370 if (!req->optionalSignature) 372
371 { 373 if (!req->optionalSignature) {
372 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY, OCSP_R_REQUEST_NOT_SIGNED); 374 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY, OCSP_R_REQUEST_NOT_SIGNED);
373 return 0; 375 return 0;
374 } 376 }
375 gen = req->tbsRequest->requestorName; 377 gen = req->tbsRequest->requestorName;
376 if (!gen || gen->type != GEN_DIRNAME) 378 if (!gen || gen->type != GEN_DIRNAME) {
377 { 379 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,
378 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY, OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE); 380 OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE);
379 return 0; 381 return 0;
380 } 382 }
381 nm = gen->d.directoryName; 383 nm = gen->d.directoryName;
382 ret = ocsp_req_find_signer(&signer, req, nm, certs, store, flags); 384 ret = ocsp_req_find_signer(&signer, req, nm, certs, store, flags);
383 if (ret <= 0) 385 if (ret <= 0) {
384 { 386 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,
385 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY, OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND); 387 OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND);
386 return 0; 388 return 0;
387 } 389 }
388 if ((ret == 2) && (flags & OCSP_TRUSTOTHER)) 390 if ((ret == 2) && (flags & OCSP_TRUSTOTHER))
389 flags |= OCSP_NOVERIFY; 391 flags |= OCSP_NOVERIFY;
390 if (!(flags & OCSP_NOSIGS)) 392 if (!(flags & OCSP_NOSIGS)) {
391 {
392 EVP_PKEY *skey; 393 EVP_PKEY *skey;
394
393 skey = X509_get_pubkey(signer); 395 skey = X509_get_pubkey(signer);
394 ret = OCSP_REQUEST_verify(req, skey); 396 ret = OCSP_REQUEST_verify(req, skey);
395 EVP_PKEY_free(skey); 397 EVP_PKEY_free(skey);
396 if(ret <= 0) 398 if (ret <= 0) {
397 { 399 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,
398 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY, OCSP_R_SIGNATURE_FAILURE); 400 OCSP_R_SIGNATURE_FAILURE);
399 return 0; 401 return 0;
400 }
401 } 402 }
402 if (!(flags & OCSP_NOVERIFY)) 403 }
403 { 404 if (!(flags & OCSP_NOVERIFY)) {
404 int init_res; 405 int init_res;
405 if(flags & OCSP_NOCHAIN) 406
406 init_res = X509_STORE_CTX_init(&ctx, store, signer, NULL); 407 if (flags & OCSP_NOCHAIN)
408 init_res = X509_STORE_CTX_init(&ctx, store, signer,
409 NULL);
407 else 410 else
408 init_res = X509_STORE_CTX_init(&ctx, store, signer, 411 init_res = X509_STORE_CTX_init(&ctx, store, signer,
409 req->optionalSignature->certs); 412 req->optionalSignature->certs);
410 if(!init_res) 413 if (!init_res) {
411 {
412 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,ERR_R_X509_LIB); 414 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,ERR_R_X509_LIB);
413 return 0; 415 return 0;
414 } 416 }
415 417
416 X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_OCSP_HELPER); 418 X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_OCSP_HELPER);
417 X509_STORE_CTX_set_trust(&ctx, X509_TRUST_OCSP_REQUEST); 419 X509_STORE_CTX_set_trust(&ctx, X509_TRUST_OCSP_REQUEST);
418 ret = X509_verify_cert(&ctx); 420 ret = X509_verify_cert(&ctx);
419 X509_STORE_CTX_cleanup(&ctx); 421 X509_STORE_CTX_cleanup(&ctx);
420 if (ret <= 0) 422 if (ret <= 0) {
421 {
422 ret = X509_STORE_CTX_get_error(&ctx); 423 ret = X509_STORE_CTX_get_error(&ctx);
423 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,OCSP_R_CERTIFICATE_VERIFY_ERROR); 424 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,
425 OCSP_R_CERTIFICATE_VERIFY_ERROR);
424 ERR_asprintf_error_data("Verify error:%s", 426 ERR_asprintf_error_data("Verify error:%s",
425 X509_verify_cert_error_string(ret)); 427 X509_verify_cert_error_string(ret));
426 return 0; 428 return 0;
427 }
428 } 429 }
430 }
429 return 1; 431 return 1;
430 } 432}
431 433
432static int ocsp_req_find_signer(X509 **psigner, OCSP_REQUEST *req, X509_NAME *nm, STACK_OF(X509) *certs, 434static int
433 X509_STORE *st, unsigned long flags) 435ocsp_req_find_signer(X509 **psigner, OCSP_REQUEST *req, X509_NAME *nm,
434 { 436 STACK_OF(X509) *certs, X509_STORE *st, unsigned long flags)
437{
435 X509 *signer; 438 X509 *signer;
436 if(!(flags & OCSP_NOINTERN)) 439
437 { 440 if (!(flags & OCSP_NOINTERN)) {
438 signer = X509_find_by_subject(req->optionalSignature->certs, nm); 441 signer =
442 X509_find_by_subject(req->optionalSignature->certs, nm);
439 *psigner = signer; 443 *psigner = signer;
440 return 1; 444 return 1;
441 } 445 }
442 446
443 signer = X509_find_by_subject(certs, nm); 447 signer = X509_find_by_subject(certs, nm);
444 if (signer) 448 if (signer) {
445 {
446 *psigner = signer; 449 *psigner = signer;
447 return 2; 450 return 2;
448 }
449 return 0;
450 } 451 }
452 return 0;
453}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-10-24 00:47:01 +0000