diff options
Diffstat (limited to 'src/lib/libcrypto/x509v3/v3_ocsp.c')
| -rw-r--r-- | src/lib/libcrypto/x509v3/v3_ocsp.c | 230 |
1 files changed, 131 insertions, 99 deletions
diff --git a/src/lib/libcrypto/x509v3/v3_ocsp.c b/src/lib/libcrypto/x509v3/v3_ocsp.c index 0c165af314..2fef484b9a 100644 --- a/src/lib/libcrypto/x509v3/v3_ocsp.c +++ b/src/lib/libcrypto/x509v3/v3_ocsp.c | |||
| @@ -10,7 +10,7 @@ | |||
| 10 | * are met: | 10 | * are met: |
| 11 | * | 11 | * |
| 12 | * 1. Redistributions of source code must retain the above copyright | 12 | * 1. Redistributions of source code must retain the above copyright |
| 13 | * notice, this list of conditions and the following disclaimer. | 13 | * notice, this list of conditions and the following disclaimer. |
| 14 | * | 14 | * |
| 15 | * 2. Redistributions in binary form must reproduce the above copyright | 15 | * 2. Redistributions in binary form must reproduce the above copyright |
| 16 | * notice, this list of conditions and the following disclaimer in | 16 | * notice, this list of conditions and the following disclaimer in |
| @@ -69,59 +69,59 @@ | |||
| 69 | */ | 69 | */ |
| 70 | 70 | ||
| 71 | static int i2r_ocsp_crlid(const X509V3_EXT_METHOD *method, void *nonce, | 71 | static int i2r_ocsp_crlid(const X509V3_EXT_METHOD *method, void *nonce, |
| 72 | BIO *out, int indent); | 72 | BIO *out, int indent); |
| 73 | static int i2r_ocsp_acutoff(const X509V3_EXT_METHOD *method, void *nonce, | 73 | static int i2r_ocsp_acutoff(const X509V3_EXT_METHOD *method, void *nonce, |
| 74 | BIO *out, int indent); | 74 | BIO *out, int indent); |
| 75 | static int i2r_object(const X509V3_EXT_METHOD *method, void *obj, BIO *out, | 75 | static int i2r_object(const X509V3_EXT_METHOD *method, void *obj, BIO *out, |
| 76 | int indent); | 76 | int indent); |
| 77 | 77 | ||
| 78 | static void *ocsp_nonce_new(void); | 78 | static void *ocsp_nonce_new(void); |
| 79 | static int i2d_ocsp_nonce(void *a, unsigned char **pp); | 79 | static int i2d_ocsp_nonce(void *a, unsigned char **pp); |
| 80 | static void *d2i_ocsp_nonce(void *a, const unsigned char **pp, long length); | 80 | static void *d2i_ocsp_nonce(void *a, const unsigned char **pp, long length); |
| 81 | static void ocsp_nonce_free(void *a); | 81 | static void ocsp_nonce_free(void *a); |
| 82 | static int i2r_ocsp_nonce(const X509V3_EXT_METHOD *method, void *nonce, | 82 | static int i2r_ocsp_nonce(const X509V3_EXT_METHOD *method, void *nonce, |
| 83 | BIO *out, int indent); | 83 | BIO *out, int indent); |
| 84 | 84 | ||
| 85 | static int i2r_ocsp_nocheck(const X509V3_EXT_METHOD *method, | 85 | static int i2r_ocsp_nocheck(const X509V3_EXT_METHOD *method, |
| 86 | void *nocheck, BIO *out, int indent); | 86 | void *nocheck, BIO *out, int indent); |
| 87 | static void *s2i_ocsp_nocheck(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx, | 87 | static void *s2i_ocsp_nocheck(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx, |
| 88 | const char *str); | 88 | const char *str); |
| 89 | static int i2r_ocsp_serviceloc(const X509V3_EXT_METHOD *method, void *in, | 89 | static int i2r_ocsp_serviceloc(const X509V3_EXT_METHOD *method, void *in, |
| 90 | BIO *bp, int ind); | 90 | BIO *bp, int ind); |
| 91 | 91 | ||
| 92 | const X509V3_EXT_METHOD v3_ocsp_crlid = { | 92 | const X509V3_EXT_METHOD v3_ocsp_crlid = { |
| 93 | NID_id_pkix_OCSP_CrlID, 0, ASN1_ITEM_ref(OCSP_CRLID), | 93 | NID_id_pkix_OCSP_CrlID, 0, ASN1_ITEM_ref(OCSP_CRLID), |
| 94 | 0,0,0,0, | 94 | 0, 0, 0, 0, |
| 95 | 0,0, | 95 | 0, 0, |
| 96 | 0,0, | 96 | 0, 0, |
| 97 | i2r_ocsp_crlid,0, | 97 | i2r_ocsp_crlid, 0, |
| 98 | NULL | 98 | NULL |
| 99 | }; | 99 | }; |
| 100 | 100 | ||
| 101 | const X509V3_EXT_METHOD v3_ocsp_acutoff = { | 101 | const X509V3_EXT_METHOD v3_ocsp_acutoff = { |
| 102 | NID_id_pkix_OCSP_archiveCutoff, 0, ASN1_ITEM_ref(ASN1_GENERALIZEDTIME), | 102 | NID_id_pkix_OCSP_archiveCutoff, 0, ASN1_ITEM_ref(ASN1_GENERALIZEDTIME), |
| 103 | 0,0,0,0, | 103 | 0, 0, 0, 0, |
| 104 | 0,0, | 104 | 0, 0, |
| 105 | 0,0, | 105 | 0, 0, |
| 106 | i2r_ocsp_acutoff,0, | 106 | i2r_ocsp_acutoff, 0, |
| 107 | NULL | 107 | NULL |
| 108 | }; | 108 | }; |
| 109 | 109 | ||
| 110 | const X509V3_EXT_METHOD v3_crl_invdate = { | 110 | const X509V3_EXT_METHOD v3_crl_invdate = { |
| 111 | NID_invalidity_date, 0, ASN1_ITEM_ref(ASN1_GENERALIZEDTIME), | 111 | NID_invalidity_date, 0, ASN1_ITEM_ref(ASN1_GENERALIZEDTIME), |
| 112 | 0,0,0,0, | 112 | 0, 0, 0, 0, |
| 113 | 0,0, | 113 | 0, 0, |
| 114 | 0,0, | 114 | 0, 0, |
| 115 | i2r_ocsp_acutoff,0, | 115 | i2r_ocsp_acutoff, 0, |
| 116 | NULL | 116 | NULL |
| 117 | }; | 117 | }; |
| 118 | 118 | ||
| 119 | const X509V3_EXT_METHOD v3_crl_hold = { | 119 | const X509V3_EXT_METHOD v3_crl_hold = { |
| 120 | NID_hold_instruction_code, 0, ASN1_ITEM_ref(ASN1_OBJECT), | 120 | NID_hold_instruction_code, 0, ASN1_ITEM_ref(ASN1_OBJECT), |
| 121 | 0,0,0,0, | 121 | 0, 0, 0, 0, |
| 122 | 0,0, | 122 | 0, 0, |
| 123 | 0,0, | 123 | 0, 0, |
| 124 | i2r_object,0, | 124 | i2r_object, 0, |
| 125 | NULL | 125 | NULL |
| 126 | }; | 126 | }; |
| 127 | 127 | ||
| @@ -131,71 +131,82 @@ const X509V3_EXT_METHOD v3_ocsp_nonce = { | |||
| 131 | ocsp_nonce_free, | 131 | ocsp_nonce_free, |
| 132 | d2i_ocsp_nonce, | 132 | d2i_ocsp_nonce, |
| 133 | i2d_ocsp_nonce, | 133 | i2d_ocsp_nonce, |
| 134 | 0,0, | 134 | 0, 0, |
| 135 | 0,0, | 135 | 0, 0, |
| 136 | i2r_ocsp_nonce,0, | 136 | i2r_ocsp_nonce, 0, |
| 137 | NULL | 137 | NULL |
| 138 | }; | 138 | }; |
| 139 | 139 | ||
| 140 | const X509V3_EXT_METHOD v3_ocsp_nocheck = { | 140 | const X509V3_EXT_METHOD v3_ocsp_nocheck = { |
| 141 | NID_id_pkix_OCSP_noCheck, 0, ASN1_ITEM_ref(ASN1_NULL), | 141 | NID_id_pkix_OCSP_noCheck, 0, ASN1_ITEM_ref(ASN1_NULL), |
| 142 | 0,0,0,0, | 142 | 0, 0, 0, 0, |
| 143 | 0,s2i_ocsp_nocheck, | 143 | 0, s2i_ocsp_nocheck, |
| 144 | 0,0, | 144 | 0, 0, |
| 145 | i2r_ocsp_nocheck,0, | 145 | i2r_ocsp_nocheck, 0, |
| 146 | NULL | 146 | NULL |
| 147 | }; | 147 | }; |
| 148 | 148 | ||
| 149 | const X509V3_EXT_METHOD v3_ocsp_serviceloc = { | 149 | const X509V3_EXT_METHOD v3_ocsp_serviceloc = { |
| 150 | NID_id_pkix_OCSP_serviceLocator, 0, ASN1_ITEM_ref(OCSP_SERVICELOC), | 150 | NID_id_pkix_OCSP_serviceLocator, 0, ASN1_ITEM_ref(OCSP_SERVICELOC), |
| 151 | 0,0,0,0, | 151 | 0, 0, 0, 0, |
| 152 | 0,0, | 152 | 0, 0, |
| 153 | 0,0, | 153 | 0, 0, |
| 154 | i2r_ocsp_serviceloc,0, | 154 | i2r_ocsp_serviceloc, 0, |
| 155 | NULL | 155 | NULL |
| 156 | }; | 156 | }; |
| 157 | 157 | ||
| 158 | static int i2r_ocsp_crlid(const X509V3_EXT_METHOD *method, void *in, BIO *bp, | 158 | static int |
| 159 | int ind) | 159 | i2r_ocsp_crlid(const X509V3_EXT_METHOD *method, void *in, BIO *bp, int ind) |
| 160 | { | 160 | { |
| 161 | OCSP_CRLID *a = in; | 161 | OCSP_CRLID *a = in; |
| 162 | if (a->crlUrl) | 162 | if (a->crlUrl) { |
| 163 | { | 163 | if (BIO_printf(bp, "%*scrlUrl: ", ind, "") <= 0) |
| 164 | if (BIO_printf(bp, "%*scrlUrl: ", ind, "") <= 0) goto err; | 164 | goto err; |
| 165 | if (!ASN1_STRING_print(bp, (ASN1_STRING*)a->crlUrl)) goto err; | 165 | if (!ASN1_STRING_print(bp, (ASN1_STRING*)a->crlUrl)) |
| 166 | if (BIO_write(bp, "\n", 1) <= 0) goto err; | 166 | goto err; |
| 167 | } | 167 | if (BIO_write(bp, "\n", 1) <= 0) |
| 168 | if (a->crlNum) | 168 | goto err; |
| 169 | { | 169 | } |
| 170 | if (BIO_printf(bp, "%*scrlNum: ", ind, "") <= 0) goto err; | 170 | if (a->crlNum) { |
| 171 | if (i2a_ASN1_INTEGER(bp, a->crlNum) <= 0) goto err; | 171 | if (BIO_printf(bp, "%*scrlNum: ", ind, "") <= 0) |
| 172 | if (BIO_write(bp, "\n", 1) <= 0) goto err; | 172 | goto err; |
| 173 | } | 173 | if (i2a_ASN1_INTEGER(bp, a->crlNum) <= 0) |
| 174 | if (a->crlTime) | 174 | goto err; |
| 175 | { | 175 | if (BIO_write(bp, "\n", 1) <= 0) |
| 176 | if (BIO_printf(bp, "%*scrlTime: ", ind, "") <= 0) goto err; | 176 | goto err; |
| 177 | if (!ASN1_GENERALIZEDTIME_print(bp, a->crlTime)) goto err; | 177 | } |
| 178 | if (BIO_write(bp, "\n", 1) <= 0) goto err; | 178 | if (a->crlTime) { |
| 179 | } | 179 | if (BIO_printf(bp, "%*scrlTime: ", ind, "") <= 0) |
| 180 | goto err; | ||
| 181 | if (!ASN1_GENERALIZEDTIME_print(bp, a->crlTime)) | ||
| 182 | goto err; | ||
| 183 | if (BIO_write(bp, "\n", 1) <= 0) | ||
| 184 | goto err; | ||
| 185 | } | ||
| 180 | return 1; | 186 | return 1; |
| 181 | err: | 187 | |
| 188 | err: | ||
| 182 | return 0; | 189 | return 0; |
| 183 | } | 190 | } |
| 184 | 191 | ||
| 185 | static int i2r_ocsp_acutoff(const X509V3_EXT_METHOD *method, void *cutoff, | 192 | static int |
| 186 | BIO *bp, int ind) | 193 | i2r_ocsp_acutoff(const X509V3_EXT_METHOD *method, void *cutoff, BIO *bp, |
| 194 | int ind) | ||
| 187 | { | 195 | { |
| 188 | if (BIO_printf(bp, "%*s", ind, "") <= 0) return 0; | 196 | if (BIO_printf(bp, "%*s", ind, "") <= 0) |
| 189 | if(!ASN1_GENERALIZEDTIME_print(bp, cutoff)) return 0; | 197 | return 0; |
| 198 | if (!ASN1_GENERALIZEDTIME_print(bp, cutoff)) | ||
| 199 | return 0; | ||
| 190 | return 1; | 200 | return 1; |
| 191 | } | 201 | } |
| 192 | 202 | ||
| 193 | 203 | static int | |
| 194 | static int i2r_object(const X509V3_EXT_METHOD *method, void *oid, BIO *bp, | 204 | i2r_object(const X509V3_EXT_METHOD *method, void *oid, BIO *bp, int ind) |
| 195 | int ind) | ||
| 196 | { | 205 | { |
| 197 | if (BIO_printf(bp, "%*s", ind, "") <= 0) return 0; | 206 | if (BIO_printf(bp, "%*s", ind, "") <= 0) |
| 198 | if(i2a_ASN1_OBJECT(bp, oid) <= 0) return 0; | 207 | return 0; |
| 208 | if (i2a_ASN1_OBJECT(bp, oid) <= 0) | ||
| 209 | return 0; | ||
| 199 | return 1; | 210 | return 1; |
| 200 | } | 211 | } |
| 201 | 212 | ||
| @@ -203,87 +214,108 @@ static int i2r_object(const X509V3_EXT_METHOD *method, void *oid, BIO *bp, | |||
| 203 | * an ASN1 encoding at all: it just contains arbitrary data. | 214 | * an ASN1 encoding at all: it just contains arbitrary data. |
| 204 | */ | 215 | */ |
| 205 | 216 | ||
| 206 | static void *ocsp_nonce_new(void) | 217 | static void * |
| 218 | ocsp_nonce_new(void) | ||
| 207 | { | 219 | { |
| 208 | return ASN1_OCTET_STRING_new(); | 220 | return ASN1_OCTET_STRING_new(); |
| 209 | } | 221 | } |
| 210 | 222 | ||
| 211 | static int i2d_ocsp_nonce(void *a, unsigned char **pp) | 223 | static int |
| 224 | i2d_ocsp_nonce(void *a, unsigned char **pp) | ||
| 212 | { | 225 | { |
| 213 | ASN1_OCTET_STRING *os = a; | 226 | ASN1_OCTET_STRING *os = a; |
| 214 | if(pp) { | 227 | |
| 228 | if (pp) { | ||
| 215 | memcpy(*pp, os->data, os->length); | 229 | memcpy(*pp, os->data, os->length); |
| 216 | *pp += os->length; | 230 | *pp += os->length; |
| 217 | } | 231 | } |
| 218 | return os->length; | 232 | return os->length; |
| 219 | } | 233 | } |
| 220 | 234 | ||
| 221 | static void *d2i_ocsp_nonce(void *a, const unsigned char **pp, long length) | 235 | static void * |
| 236 | d2i_ocsp_nonce(void *a, const unsigned char **pp, long length) | ||
| 222 | { | 237 | { |
| 223 | ASN1_OCTET_STRING *os, **pos; | 238 | ASN1_OCTET_STRING *os, **pos; |
| 239 | |||
| 224 | pos = a; | 240 | pos = a; |
| 225 | if(!pos || !*pos) os = ASN1_OCTET_STRING_new(); | 241 | if (!pos || !*pos) |
| 226 | else os = *pos; | 242 | os = ASN1_OCTET_STRING_new(); |
| 227 | if(!ASN1_OCTET_STRING_set(os, *pp, length)) goto err; | 243 | else |
| 244 | os = *pos; | ||
| 245 | if (!ASN1_OCTET_STRING_set(os, *pp, length)) | ||
| 246 | goto err; | ||
| 228 | 247 | ||
| 229 | *pp += length; | 248 | *pp += length; |
| 230 | 249 | ||
| 231 | if(pos) *pos = os; | 250 | if (pos) |
| 251 | *pos = os; | ||
| 232 | return os; | 252 | return os; |
| 233 | 253 | ||
| 234 | err: | 254 | err: |
| 235 | if(os && (!pos || (*pos != os))) M_ASN1_OCTET_STRING_free(os); | 255 | if (os && (!pos || (*pos != os))) |
| 256 | M_ASN1_OCTET_STRING_free(os); | ||
| 236 | OCSPerr(OCSP_F_D2I_OCSP_NONCE, ERR_R_MALLOC_FAILURE); | 257 | OCSPerr(OCSP_F_D2I_OCSP_NONCE, ERR_R_MALLOC_FAILURE); |
| 237 | return NULL; | 258 | return NULL; |
| 238 | } | 259 | } |
| 239 | 260 | ||
| 240 | static void ocsp_nonce_free(void *a) | 261 | static void |
| 262 | ocsp_nonce_free(void *a) | ||
| 241 | { | 263 | { |
| 242 | M_ASN1_OCTET_STRING_free(a); | 264 | M_ASN1_OCTET_STRING_free(a); |
| 243 | } | 265 | } |
| 244 | 266 | ||
| 245 | static int i2r_ocsp_nonce(const X509V3_EXT_METHOD *method, void *nonce, | 267 | static int |
| 246 | BIO *out, int indent) | 268 | i2r_ocsp_nonce(const X509V3_EXT_METHOD *method, void *nonce, BIO *out, |
| 269 | int indent) | ||
| 247 | { | 270 | { |
| 248 | if(BIO_printf(out, "%*s", indent, "") <= 0) return 0; | 271 | if (BIO_printf(out, "%*s", indent, "") <= 0) |
| 249 | if(i2a_ASN1_STRING(out, nonce, V_ASN1_OCTET_STRING) <= 0) return 0; | 272 | return 0; |
| 273 | if (i2a_ASN1_STRING(out, nonce, V_ASN1_OCTET_STRING) <= 0) | ||
| 274 | return 0; | ||
| 250 | return 1; | 275 | return 1; |
| 251 | } | 276 | } |
| 252 | 277 | ||
| 253 | /* Nocheck is just a single NULL. Don't print anything and always set it */ | 278 | /* Nocheck is just a single NULL. Don't print anything and always set it */ |
| 254 | 279 | ||
| 255 | static int i2r_ocsp_nocheck(const X509V3_EXT_METHOD *method, void *nocheck, | 280 | static int |
| 256 | BIO *out, int indent) | 281 | i2r_ocsp_nocheck(const X509V3_EXT_METHOD *method, void *nocheck, BIO *out, |
| 282 | int indent) | ||
| 257 | { | 283 | { |
| 258 | return 1; | 284 | return 1; |
| 259 | } | 285 | } |
| 260 | 286 | ||
| 261 | static void *s2i_ocsp_nocheck(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx, | 287 | static void * |
| 262 | const char *str) | 288 | s2i_ocsp_nocheck(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx, |
| 289 | const char *str) | ||
| 263 | { | 290 | { |
| 264 | return ASN1_NULL_new(); | 291 | return ASN1_NULL_new(); |
| 265 | } | 292 | } |
| 266 | 293 | ||
| 267 | static int i2r_ocsp_serviceloc(const X509V3_EXT_METHOD *method, void *in, | 294 | static int |
| 268 | BIO *bp, int ind) | 295 | i2r_ocsp_serviceloc(const X509V3_EXT_METHOD *method, void *in, BIO *bp, int ind) |
| 269 | { | 296 | { |
| 270 | int i; | 297 | int i; |
| 271 | OCSP_SERVICELOC *a = in; | 298 | OCSP_SERVICELOC *a = in; |
| 272 | ACCESS_DESCRIPTION *ad; | 299 | ACCESS_DESCRIPTION *ad; |
| 273 | 300 | ||
| 274 | if (BIO_printf(bp, "%*sIssuer: ", ind, "") <= 0) goto err; | 301 | if (BIO_printf(bp, "%*sIssuer: ", ind, "") <= 0) |
| 275 | if (X509_NAME_print_ex(bp, a->issuer, 0, XN_FLAG_ONELINE) <= 0) goto err; | 302 | goto err; |
| 276 | for (i = 0; i < sk_ACCESS_DESCRIPTION_num(a->locator); i++) | 303 | if (X509_NAME_print_ex(bp, a->issuer, 0, XN_FLAG_ONELINE) <= 0) |
| 277 | { | 304 | goto err; |
| 278 | ad = sk_ACCESS_DESCRIPTION_value(a->locator,i); | 305 | for (i = 0; i < sk_ACCESS_DESCRIPTION_num(a->locator); i++) { |
| 279 | if (BIO_printf(bp, "\n%*s", (2*ind), "") <= 0) | 306 | ad = sk_ACCESS_DESCRIPTION_value(a->locator, i); |
| 280 | goto err; | 307 | if (BIO_printf(bp, "\n%*s", (2 * ind), "") <= 0) |
| 281 | if(i2a_ASN1_OBJECT(bp, ad->method) <= 0) goto err; | 308 | goto err; |
| 282 | if(BIO_puts(bp, " - ") <= 0) goto err; | 309 | if (i2a_ASN1_OBJECT(bp, ad->method) <= 0) |
| 283 | if(GENERAL_NAME_print(bp, ad->location) <= 0) goto err; | 310 | goto err; |
| 284 | } | 311 | if (BIO_puts(bp, " - ") <= 0) |
| 312 | goto err; | ||
| 313 | if (GENERAL_NAME_print(bp, ad->location) <= 0) | ||
| 314 | goto err; | ||
| 315 | } | ||
| 285 | return 1; | 316 | return 1; |
| 317 | |||
| 286 | err: | 318 | err: |
| 287 | return 0; | 319 | return 0; |
| 288 | } | 320 | } |
| 289 | #endif | 321 | #endif |
