1 /* 2 * Copyright 2001-2025 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <openssl/opensslconf.h> 11 12 #ifdef OPENSSL_SYS_VMS 13 /* So fd_set and friends get properly defined on OpenVMS */ 14 # define _XOPEN_SOURCE_EXTENDED 15 #endif 16 17 #include <stdio.h> 18 #include <stdlib.h> 19 #include <string.h> 20 #include <time.h> 21 #include <ctype.h> 22 23 /* Needs to be included before the openssl headers */ 24 #include "apps.h" 25 #include "http_server.h" 26 #include "progs.h" 27 #include "internal/sockets.h" 28 #include <openssl/e_os2.h> 29 #include <openssl/crypto.h> 30 #include <openssl/err.h> 31 #include <openssl/ssl.h> 32 #include <openssl/evp.h> 33 #include <openssl/bn.h> 34 #include <openssl/x509v3.h> 35 36 #if defined(OPENSSL_SYS_VXWORKS) 37 /* not supported */ 38 int setpgid(pid_t pid, pid_t pgid) 39 { 40 errno = ENOSYS; 41 return 0; 42 } 43 /* not supported */ 44 pid_t fork(void) 45 { 46 errno = ENOSYS; 47 return (pid_t) -1; 48 } 49 #endif 50 /* Maximum leeway in validity period: default 5 minutes */ 51 #define MAX_VALIDITY_PERIOD (5 * 60) 52 53 static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert, 54 const EVP_MD *cert_id_md, X509 *issuer, 55 STACK_OF(OCSP_CERTID) *ids); 56 static int add_ocsp_serial(OCSP_REQUEST **req, char *serial, 57 const EVP_MD *cert_id_md, X509 *issuer, 58 STACK_OF(OCSP_CERTID) *ids); 59 static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req, 60 STACK_OF(OPENSSL_STRING) *names, 61 STACK_OF(OCSP_CERTID) *ids, long nsec, 62 long maxage); 63 static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req, 64 CA_DB *db, STACK_OF(X509) *ca, X509 *rcert, 65 EVP_PKEY *rkey, const EVP_MD *md, 66 STACK_OF(OPENSSL_STRING) *sigopts, 67 STACK_OF(X509) *rother, unsigned long flags, 68 int nmin, int ndays, int badsig, 69 const EVP_MD *resp_md); 70 71 static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser); 72 static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio, 73 int timeout); 74 static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp); 75 static char *prog; 76 77 #ifdef HTTP_DAEMON 78 static int index_changed(CA_DB *); 79 #endif 80 81 typedef enum OPTION_choice { 82 OPT_COMMON, 83 OPT_OUTFILE, OPT_TIMEOUT, OPT_URL, OPT_HOST, OPT_PORT, 84 #ifndef OPENSSL_NO_SOCK 85 OPT_PROXY, OPT_NO_PROXY, 86 #endif 87 OPT_IGNORE_ERR, OPT_NOVERIFY, OPT_NONCE, OPT_NO_NONCE, 88 OPT_RESP_NO_CERTS, OPT_RESP_KEY_ID, OPT_NO_CERTS, 89 OPT_NO_SIGNATURE_VERIFY, OPT_NO_CERT_VERIFY, OPT_NO_CHAIN, 90 OPT_NO_CERT_CHECKS, OPT_NO_EXPLICIT, OPT_TRUST_OTHER, 91 OPT_NO_INTERN, OPT_BADSIG, OPT_TEXT, OPT_REQ_TEXT, OPT_RESP_TEXT, 92 OPT_REQIN, OPT_RESPIN, OPT_SIGNER, OPT_VAFILE, OPT_SIGN_OTHER, 93 OPT_VERIFY_OTHER, OPT_CAFILE, OPT_CAPATH, OPT_CASTORE, OPT_NOCAFILE, 94 OPT_NOCAPATH, OPT_NOCASTORE, 95 OPT_VALIDITY_PERIOD, OPT_STATUS_AGE, OPT_SIGNKEY, OPT_REQOUT, 96 OPT_RESPOUT, OPT_PATH, OPT_ISSUER, OPT_CERT, OPT_SERIAL, 97 OPT_INDEX, OPT_CA, OPT_NMIN, OPT_REQUEST, OPT_NDAYS, OPT_RSIGNER, 98 OPT_RKEY, OPT_ROTHER, OPT_RMD, OPT_RSIGOPT, OPT_HEADER, 99 OPT_PASSIN, 100 OPT_RCID, 101 OPT_V_ENUM, 102 OPT_MD, 103 OPT_MULTI, OPT_PROV_ENUM 104 } OPTION_CHOICE; 105 106 const OPTIONS ocsp_options[] = { 107 OPT_SECTION("General"), 108 {"help", OPT_HELP, '-', "Display this summary"}, 109 {"ignore_err", OPT_IGNORE_ERR, '-', 110 "Ignore error on OCSP request or response and continue running"}, 111 {"CAfile", OPT_CAFILE, '<', "Trusted certificates file"}, 112 {"CApath", OPT_CAPATH, '<', "Trusted certificates directory"}, 113 {"CAstore", OPT_CASTORE, ':', "Trusted certificates store URI"}, 114 {"no-CAfile", OPT_NOCAFILE, '-', 115 "Do not load the default certificates file"}, 116 {"no-CApath", OPT_NOCAPATH, '-', 117 "Do not load certificates from the default certificates directory"}, 118 {"no-CAstore", OPT_NOCASTORE, '-', 119 "Do not load certificates from the default certificates store"}, 120 121 OPT_SECTION("Responder"), 122 {"timeout", OPT_TIMEOUT, 'p', 123 "Connection timeout (in seconds) to the OCSP responder"}, 124 {"resp_no_certs", OPT_RESP_NO_CERTS, '-', 125 "Don't include any certificates in response"}, 126 #ifdef HTTP_DAEMON 127 {"multi", OPT_MULTI, 'p', "run multiple responder processes"}, 128 #endif 129 {"no_certs", OPT_NO_CERTS, '-', 130 "Don't include any certificates in signed request"}, 131 {"badsig", OPT_BADSIG, '-', 132 "Corrupt last byte of loaded OCSP response signature (for test)"}, 133 {"CA", OPT_CA, '<', "CA certificates"}, 134 {"nmin", OPT_NMIN, 'p', "Number of minutes before next update"}, 135 {"nrequest", OPT_REQUEST, 'p', 136 "Number of requests to accept (default unlimited)"}, 137 {"reqin", OPT_REQIN, 's', "File with the DER-encoded request"}, 138 {"signer", OPT_SIGNER, '<', "Certificate to sign OCSP request with"}, 139 {"sign_other", OPT_SIGN_OTHER, '<', 140 "Additional certificates to include in signed request"}, 141 {"index", OPT_INDEX, '<', "Certificate status index file"}, 142 {"ndays", OPT_NDAYS, 'p', "Number of days before next update"}, 143 {"rsigner", OPT_RSIGNER, '<', 144 "Responder certificate to sign responses with"}, 145 {"rkey", OPT_RKEY, '<', "Responder key to sign responses with"}, 146 {"passin", OPT_PASSIN, 's', "Responder key pass phrase source"}, 147 {"rother", OPT_ROTHER, '<', "Other certificates to include in response"}, 148 {"rmd", OPT_RMD, 's', "Digest Algorithm to use in signature of OCSP response"}, 149 {"rsigopt", OPT_RSIGOPT, 's', "OCSP response signature parameter in n:v form"}, 150 {"header", OPT_HEADER, 's', "key=value header to add"}, 151 {"rcid", OPT_RCID, 's', "Use specified algorithm for cert id in response"}, 152 {"", OPT_MD, '-', "Any supported digest algorithm (sha1,sha256, ... )"}, 153 154 OPT_SECTION("Client"), 155 {"url", OPT_URL, 's', "Responder URL"}, 156 {"host", OPT_HOST, 's', "TCP/IP hostname:port to connect to"}, 157 {"port", OPT_PORT, 'N', "Port to run responder on"}, 158 {"path", OPT_PATH, 's', "Path to use in OCSP request"}, 159 #ifndef OPENSSL_NO_SOCK 160 {"proxy", OPT_PROXY, 's', 161 "[http[s]://]host[:port][/path] of HTTP(S) proxy to use; path is ignored"}, 162 {"no_proxy", OPT_NO_PROXY, 's', 163 "List of addresses of servers not to use HTTP(S) proxy for"}, 164 {OPT_MORE_STR, 0, 0, 165 "Default from environment variable 'no_proxy', else 'NO_PROXY', else none"}, 166 #endif 167 {"out", OPT_OUTFILE, '>', "Output filename"}, 168 {"noverify", OPT_NOVERIFY, '-', "Don't verify response at all"}, 169 {"nonce", OPT_NONCE, '-', "Add OCSP nonce to request"}, 170 {"no_nonce", OPT_NO_NONCE, '-', "Don't add OCSP nonce to request"}, 171 {"no_signature_verify", OPT_NO_SIGNATURE_VERIFY, '-', 172 "Don't check signature on response"}, 173 {"resp_key_id", OPT_RESP_KEY_ID, '-', 174 "Identify response by signing certificate key ID"}, 175 {"no_cert_verify", OPT_NO_CERT_VERIFY, '-', 176 "Don't check signing certificate"}, 177 {"text", OPT_TEXT, '-', "Print text form of request and response"}, 178 {"req_text", OPT_REQ_TEXT, '-', "Print text form of request"}, 179 {"resp_text", OPT_RESP_TEXT, '-', "Print text form of response"}, 180 {"no_chain", OPT_NO_CHAIN, '-', "Don't chain verify response"}, 181 {"no_cert_checks", OPT_NO_CERT_CHECKS, '-', 182 "Don't do additional checks on signing certificate"}, 183 {"no_explicit", OPT_NO_EXPLICIT, '-', 184 "Do not explicitly check the chain, just verify the root"}, 185 {"trust_other", OPT_TRUST_OTHER, '-', 186 "Don't verify additional certificates"}, 187 {"no_intern", OPT_NO_INTERN, '-', 188 "Don't search certificates contained in response for signer"}, 189 {"respin", OPT_RESPIN, 's', "File with the DER-encoded response"}, 190 {"VAfile", OPT_VAFILE, '<', "Validator certificates file"}, 191 {"verify_other", OPT_VERIFY_OTHER, '<', 192 "Additional certificates to search for signer"}, 193 {"cert", OPT_CERT, '<', 194 "Certificate to check; may be given multiple times"}, 195 {"serial", OPT_SERIAL, 's', 196 "Serial number to check; may be given multiple times"}, 197 {"validity_period", OPT_VALIDITY_PERIOD, 'u', 198 "Maximum validity discrepancy in seconds"}, 199 {"signkey", OPT_SIGNKEY, 's', "Private key to sign OCSP request with"}, 200 {"reqout", OPT_REQOUT, 's', "Output file for the DER-encoded request"}, 201 {"respout", OPT_RESPOUT, 's', "Output file for the DER-encoded response"}, 202 {"issuer", OPT_ISSUER, '<', "Issuer certificate"}, 203 {"status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds"}, 204 205 OPT_V_OPTIONS, 206 OPT_PROV_OPTIONS, 207 {NULL} 208 }; 209 210 int ocsp_main(int argc, char **argv) 211 { 212 BIO *acbio = NULL, *cbio = NULL, *derbio = NULL, *out = NULL; 213 EVP_MD *cert_id_md = NULL, *rsign_md = NULL; 214 STACK_OF(OPENSSL_STRING) *rsign_sigopts = NULL; 215 int trailing_md = 0; 216 CA_DB *rdb = NULL; 217 EVP_PKEY *key = NULL, *rkey = NULL; 218 OCSP_BASICRESP *bs = NULL; 219 OCSP_REQUEST *req = NULL; 220 OCSP_RESPONSE *resp = NULL; 221 STACK_OF(CONF_VALUE) *headers = NULL; 222 STACK_OF(OCSP_CERTID) *ids = NULL; 223 STACK_OF(OPENSSL_STRING) *reqnames = NULL; 224 STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL; 225 STACK_OF(X509) *issuers = NULL; 226 X509 *issuer = NULL, *cert = NULL; 227 STACK_OF(X509) *rca_certs = NULL; 228 EVP_MD *resp_certid_md = NULL; 229 X509 *signer = NULL, *rsigner = NULL; 230 X509_STORE *store = NULL; 231 X509_VERIFY_PARAM *vpm = NULL; 232 const char *CAfile = NULL, *CApath = NULL, *CAstore = NULL; 233 char *header, *value, *respdigname = NULL; 234 char *host = NULL, *port = NULL, *path = "/", *outfile = NULL; 235 #ifndef OPENSSL_NO_SOCK 236 char *opt_proxy = NULL; 237 char *opt_no_proxy = NULL; 238 #endif 239 char *rca_filename = NULL, *reqin = NULL, *respin = NULL; 240 char *reqout = NULL, *respout = NULL, *ridx_filename = NULL; 241 char *rsignfile = NULL, *rkeyfile = NULL; 242 char *passinarg = NULL, *passin = NULL; 243 char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL; 244 char *signfile = NULL, *keyfile = NULL; 245 char *thost = NULL, *tport = NULL, *tpath = NULL; 246 int noCAfile = 0, noCApath = 0, noCAstore = 0; 247 int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1; 248 int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1; 249 int req_text = 0, resp_text = 0, res, ret = 1; 250 int req_timeout = -1; 251 long nsec = MAX_VALIDITY_PERIOD, maxage = -1; 252 unsigned long sign_flags = 0, verify_flags = 0, rflags = 0; 253 OPTION_CHOICE o; 254 255 if ((reqnames = sk_OPENSSL_STRING_new_null()) == NULL 256 || (ids = sk_OCSP_CERTID_new_null()) == NULL 257 || (vpm = X509_VERIFY_PARAM_new()) == NULL) 258 goto end; 259 260 opt_set_unknown_name("digest"); 261 prog = opt_init(argc, argv, ocsp_options); 262 while ((o = opt_next()) != OPT_EOF) { 263 switch (o) { 264 case OPT_EOF: 265 case OPT_ERR: 266 opthelp: 267 BIO_printf(bio_err, "%s: Use -help for summary.\n", prog); 268 goto end; 269 case OPT_HELP: 270 ret = 0; 271 opt_help(ocsp_options); 272 goto end; 273 case OPT_OUTFILE: 274 outfile = opt_arg(); 275 break; 276 case OPT_TIMEOUT: 277 #ifndef OPENSSL_NO_SOCK 278 req_timeout = atoi(opt_arg()); 279 #endif 280 break; 281 case OPT_URL: 282 OPENSSL_free(thost); 283 OPENSSL_free(tport); 284 OPENSSL_free(tpath); 285 thost = tport = tpath = NULL; 286 if (!OSSL_HTTP_parse_url(opt_arg(), &use_ssl, NULL /* userinfo */, 287 &host, &port, NULL /* port_num */, 288 &path, NULL /* qry */, NULL /* frag */)) { 289 BIO_printf(bio_err, "%s Error parsing -url argument\n", prog); 290 goto end; 291 } 292 thost = host; 293 tport = port; 294 tpath = path; 295 break; 296 case OPT_HOST: 297 host = opt_arg(); 298 break; 299 case OPT_PORT: 300 port = opt_arg(); 301 break; 302 case OPT_PATH: 303 path = opt_arg(); 304 break; 305 #ifndef OPENSSL_NO_SOCK 306 case OPT_PROXY: 307 opt_proxy = opt_arg(); 308 break; 309 case OPT_NO_PROXY: 310 opt_no_proxy = opt_arg(); 311 break; 312 #endif 313 case OPT_IGNORE_ERR: 314 ignore_err = 1; 315 break; 316 case OPT_NOVERIFY: 317 noverify = 1; 318 break; 319 case OPT_NONCE: 320 add_nonce = 2; 321 break; 322 case OPT_NO_NONCE: 323 add_nonce = 0; 324 break; 325 case OPT_RESP_NO_CERTS: 326 rflags |= OCSP_NOCERTS; 327 break; 328 case OPT_RESP_KEY_ID: 329 rflags |= OCSP_RESPID_KEY; 330 break; 331 case OPT_NO_CERTS: 332 sign_flags |= OCSP_NOCERTS; 333 break; 334 case OPT_NO_SIGNATURE_VERIFY: 335 verify_flags |= OCSP_NOSIGS; 336 break; 337 case OPT_NO_CERT_VERIFY: 338 verify_flags |= OCSP_NOVERIFY; 339 break; 340 case OPT_NO_CHAIN: 341 verify_flags |= OCSP_NOCHAIN; 342 break; 343 case OPT_NO_CERT_CHECKS: 344 verify_flags |= OCSP_NOCHECKS; 345 break; 346 case OPT_NO_EXPLICIT: 347 verify_flags |= OCSP_NOEXPLICIT; 348 break; 349 case OPT_TRUST_OTHER: 350 verify_flags |= OCSP_TRUSTOTHER; 351 break; 352 case OPT_NO_INTERN: 353 verify_flags |= OCSP_NOINTERN; 354 break; 355 case OPT_BADSIG: 356 badsig = 1; 357 break; 358 case OPT_TEXT: 359 req_text = resp_text = 1; 360 break; 361 case OPT_REQ_TEXT: 362 req_text = 1; 363 break; 364 case OPT_RESP_TEXT: 365 resp_text = 1; 366 break; 367 case OPT_REQIN: 368 reqin = opt_arg(); 369 break; 370 case OPT_RESPIN: 371 respin = opt_arg(); 372 break; 373 case OPT_SIGNER: 374 signfile = opt_arg(); 375 break; 376 case OPT_VAFILE: 377 verify_certfile = opt_arg(); 378 verify_flags |= OCSP_TRUSTOTHER; 379 break; 380 case OPT_SIGN_OTHER: 381 sign_certfile = opt_arg(); 382 break; 383 case OPT_VERIFY_OTHER: 384 verify_certfile = opt_arg(); 385 break; 386 case OPT_CAFILE: 387 CAfile = opt_arg(); 388 break; 389 case OPT_CAPATH: 390 CApath = opt_arg(); 391 break; 392 case OPT_CASTORE: 393 CAstore = opt_arg(); 394 break; 395 case OPT_NOCAFILE: 396 noCAfile = 1; 397 break; 398 case OPT_NOCAPATH: 399 noCApath = 1; 400 break; 401 case OPT_NOCASTORE: 402 noCAstore = 1; 403 break; 404 case OPT_V_CASES: 405 if (!opt_verify(o, vpm)) 406 goto end; 407 vpmtouched++; 408 break; 409 case OPT_VALIDITY_PERIOD: 410 opt_long(opt_arg(), &nsec); 411 break; 412 case OPT_STATUS_AGE: 413 opt_long(opt_arg(), &maxage); 414 break; 415 case OPT_SIGNKEY: 416 keyfile = opt_arg(); 417 break; 418 case OPT_REQOUT: 419 reqout = opt_arg(); 420 break; 421 case OPT_RESPOUT: 422 respout = opt_arg(); 423 break; 424 case OPT_ISSUER: 425 issuer = load_cert(opt_arg(), FORMAT_UNDEF, "issuer certificate"); 426 if (issuer == NULL) 427 goto end; 428 if (issuers == NULL) { 429 if ((issuers = sk_X509_new_null()) == NULL) 430 goto end; 431 } 432 if (!sk_X509_push(issuers, issuer)) 433 goto end; 434 break; 435 case OPT_CERT: 436 reset_unknown(); 437 X509_free(cert); 438 cert = load_cert(opt_arg(), FORMAT_UNDEF, "certificate"); 439 if (cert == NULL) 440 goto end; 441 if (cert_id_md == NULL) 442 cert_id_md = (EVP_MD *)EVP_sha1(); 443 if (!add_ocsp_cert(&req, cert, cert_id_md, issuer, ids)) 444 goto end; 445 if (!sk_OPENSSL_STRING_push(reqnames, opt_arg())) 446 goto end; 447 trailing_md = 0; 448 break; 449 case OPT_SERIAL: 450 reset_unknown(); 451 if (cert_id_md == NULL) 452 cert_id_md = (EVP_MD *)EVP_sha1(); 453 if (!add_ocsp_serial(&req, opt_arg(), cert_id_md, issuer, ids)) 454 goto end; 455 if (!sk_OPENSSL_STRING_push(reqnames, opt_arg())) 456 goto end; 457 trailing_md = 0; 458 break; 459 case OPT_INDEX: 460 ridx_filename = opt_arg(); 461 break; 462 case OPT_CA: 463 rca_filename = opt_arg(); 464 break; 465 case OPT_NMIN: 466 nmin = opt_int_arg(); 467 if (ndays == -1) 468 ndays = 0; 469 break; 470 case OPT_REQUEST: 471 accept_count = opt_int_arg(); 472 break; 473 case OPT_NDAYS: 474 ndays = atoi(opt_arg()); 475 break; 476 case OPT_RSIGNER: 477 rsignfile = opt_arg(); 478 break; 479 case OPT_RKEY: 480 rkeyfile = opt_arg(); 481 break; 482 case OPT_PASSIN: 483 passinarg = opt_arg(); 484 break; 485 case OPT_ROTHER: 486 rcertfile = opt_arg(); 487 break; 488 case OPT_RMD: /* Response MessageDigest */ 489 respdigname = opt_arg(); 490 break; 491 case OPT_RSIGOPT: 492 if (rsign_sigopts == NULL) 493 rsign_sigopts = sk_OPENSSL_STRING_new_null(); 494 if (rsign_sigopts == NULL 495 || !sk_OPENSSL_STRING_push(rsign_sigopts, opt_arg())) 496 goto end; 497 break; 498 case OPT_HEADER: 499 header = opt_arg(); 500 value = strchr(header, '='); 501 if (value == NULL) { 502 BIO_printf(bio_err, "Missing = in header key=value\n"); 503 goto opthelp; 504 } 505 *value++ = '\0'; 506 if (!X509V3_add_value(header, value, &headers)) 507 goto end; 508 break; 509 case OPT_RCID: 510 if (!opt_md(opt_arg(), &resp_certid_md)) 511 goto opthelp; 512 break; 513 case OPT_MD: 514 if (trailing_md) { 515 BIO_printf(bio_err, 516 "%s: Digest must be before -cert or -serial\n", 517 prog); 518 goto opthelp; 519 } 520 if (!opt_md(opt_unknown(), &cert_id_md)) 521 goto opthelp; 522 trailing_md = 1; 523 break; 524 case OPT_MULTI: 525 #ifdef HTTP_DAEMON 526 n_responders = atoi(opt_arg()); 527 #endif 528 break; 529 case OPT_PROV_CASES: 530 if (!opt_provider(o)) 531 goto end; 532 break; 533 } 534 } 535 536 /* No extra arguments. */ 537 if (!opt_check_rest_arg(NULL)) 538 goto opthelp; 539 540 if (trailing_md) { 541 BIO_printf(bio_err, "%s: Digest must be before -cert or -serial\n", 542 prog); 543 goto opthelp; 544 } 545 546 if (respdigname != NULL) { 547 if (!opt_md(respdigname, &rsign_md)) 548 goto end; 549 } 550 551 /* Have we anything to do? */ 552 if (req == NULL && reqin == NULL 553 && respin == NULL && !(port != NULL && ridx_filename != NULL)) 554 goto opthelp; 555 556 if (req == NULL && (add_nonce != 2)) 557 add_nonce = 0; 558 559 if (req == NULL && reqin != NULL) { 560 derbio = bio_open_default(reqin, 'r', FORMAT_ASN1); 561 if (derbio == NULL) 562 goto end; 563 req = d2i_OCSP_REQUEST_bio(derbio, NULL); 564 BIO_free(derbio); 565 if (req == NULL) { 566 BIO_printf(bio_err, "Error reading OCSP request\n"); 567 goto end; 568 } 569 } 570 571 if (req == NULL && port != NULL) { 572 #ifndef OPENSSL_NO_SOCK 573 acbio = http_server_init(prog, port, -1); 574 if (acbio == NULL) 575 goto end; 576 #else 577 BIO_printf(bio_err, "Cannot act as server - sockets not supported\n"); 578 goto end; 579 #endif 580 } 581 582 if (rsignfile != NULL) { 583 if (rkeyfile == NULL) 584 rkeyfile = rsignfile; 585 rsigner = load_cert(rsignfile, FORMAT_UNDEF, "responder certificate"); 586 if (rsigner == NULL) { 587 BIO_printf(bio_err, "Error loading responder certificate\n"); 588 goto end; 589 } 590 if (!load_certs(rca_filename, 0, &rca_certs, NULL, "CA certificates")) 591 goto end; 592 if (rcertfile != NULL) { 593 if (!load_certs(rcertfile, 0, &rother, NULL, 594 "responder other certificates")) 595 goto end; 596 } 597 if (!app_passwd(passinarg, NULL, &passin, NULL)) { 598 BIO_printf(bio_err, "Error getting password\n"); 599 goto end; 600 } 601 rkey = load_key(rkeyfile, FORMAT_UNDEF, 0, passin, NULL, 602 "responder private key"); 603 if (rkey == NULL) 604 goto end; 605 } 606 607 if (ridx_filename != NULL 608 && (rkey == NULL || rsigner == NULL || rca_certs == NULL)) { 609 BIO_printf(bio_err, 610 "Responder mode requires certificate, key, and CA.\n"); 611 goto end; 612 } 613 614 if (ridx_filename != NULL) { 615 rdb = load_index(ridx_filename, NULL); 616 if (rdb == NULL || index_index(rdb) <= 0) { 617 BIO_printf(bio_err, 618 "Problem with index file: %s (could not load/parse file)\n", 619 ridx_filename); 620 ret = 1; 621 goto end; 622 } 623 } 624 625 #ifdef HTTP_DAEMON 626 if (n_responders != 0 && acbio != NULL) 627 spawn_loop(prog); 628 if (acbio != NULL && req_timeout > 0) 629 signal(SIGALRM, socket_timeout); 630 #endif 631 632 if (acbio != NULL) 633 trace_log_message(-1, prog, 634 LOG_INFO, "waiting for OCSP client connections..."); 635 636 redo_accept: 637 638 if (acbio != NULL) { 639 #ifdef HTTP_DAEMON 640 if (index_changed(rdb)) { 641 CA_DB *newrdb = load_index(ridx_filename, NULL); 642 643 if (newrdb != NULL && index_index(newrdb) > 0) { 644 free_index(rdb); 645 rdb = newrdb; 646 } else { 647 free_index(newrdb); 648 trace_log_message(-1, prog, 649 LOG_ERR, "error reloading updated index: %s", 650 ridx_filename); 651 } 652 } 653 #endif 654 655 req = NULL; 656 res = do_responder(&req, &cbio, acbio, req_timeout); 657 if (res == 0) 658 goto redo_accept; 659 660 if (req == NULL) { 661 if (res == 1) { 662 resp = 663 OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, 664 NULL); 665 if (resp != NULL) 666 send_ocsp_response(cbio, resp); 667 } 668 goto done_resp; 669 } 670 } 671 672 if (req == NULL 673 && (signfile != NULL || reqout != NULL 674 || host != NULL || add_nonce || ridx_filename != NULL)) { 675 BIO_printf(bio_err, "Need an OCSP request for this operation!\n"); 676 goto end; 677 } 678 679 if (req != NULL && add_nonce) { 680 if (!OCSP_request_add1_nonce(req, NULL, -1)) 681 goto end; 682 } 683 684 if (signfile != NULL) { 685 if (keyfile == NULL) 686 keyfile = signfile; 687 signer = load_cert(signfile, FORMAT_UNDEF, "signer certificate"); 688 if (signer == NULL) { 689 BIO_printf(bio_err, "Error loading signer certificate\n"); 690 goto end; 691 } 692 if (sign_certfile != NULL) { 693 if (!load_certs(sign_certfile, 0, &sign_other, NULL, 694 "signer certificates")) 695 goto end; 696 } 697 key = load_key(keyfile, FORMAT_UNDEF, 0, NULL, NULL, 698 "signer private key"); 699 if (key == NULL) 700 goto end; 701 702 if (!OCSP_request_sign(req, signer, key, NULL, 703 sign_other, sign_flags)) { 704 BIO_printf(bio_err, "Error signing OCSP request\n"); 705 goto end; 706 } 707 } 708 709 out = bio_open_default(outfile, 'w', FORMAT_TEXT); 710 if (out == NULL) 711 goto end; 712 713 if (req_text && req != NULL) 714 OCSP_REQUEST_print(out, req, 0); 715 716 if (reqout != NULL) { 717 derbio = bio_open_default(reqout, 'w', FORMAT_ASN1); 718 if (derbio == NULL) 719 goto end; 720 i2d_OCSP_REQUEST_bio(derbio, req); 721 BIO_free(derbio); 722 } 723 724 if (rdb != NULL) { 725 make_ocsp_response(bio_err, &resp, req, rdb, rca_certs, rsigner, rkey, 726 rsign_md, rsign_sigopts, rother, rflags, nmin, ndays, 727 badsig, resp_certid_md); 728 if (resp == NULL) 729 goto end; 730 if (cbio != NULL) 731 send_ocsp_response(cbio, resp); 732 } else if (host != NULL) { 733 #ifndef OPENSSL_NO_SOCK 734 resp = process_responder(req, host, port, path, opt_proxy, opt_no_proxy, 735 use_ssl, headers, req_timeout); 736 if (resp == NULL) 737 goto end; 738 #else 739 BIO_printf(bio_err, 740 "Error creating connect BIO - sockets not supported\n"); 741 goto end; 742 #endif 743 } else if (respin != NULL) { 744 derbio = bio_open_default(respin, 'r', FORMAT_ASN1); 745 if (derbio == NULL) 746 goto end; 747 resp = d2i_OCSP_RESPONSE_bio(derbio, NULL); 748 BIO_free(derbio); 749 if (resp == NULL) { 750 BIO_printf(bio_err, "Error reading OCSP response\n"); 751 goto end; 752 } 753 } else { 754 ret = 0; 755 goto end; 756 } 757 758 done_resp: 759 760 if (respout != NULL) { 761 derbio = bio_open_default(respout, 'w', FORMAT_ASN1); 762 if (derbio == NULL) 763 goto end; 764 i2d_OCSP_RESPONSE_bio(derbio, resp); 765 BIO_free(derbio); 766 } 767 768 if (resp != NULL) { 769 i = OCSP_response_status(resp); 770 if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL) { 771 BIO_printf(out, "Responder Error: %s (%d)\n", 772 OCSP_response_status_str(i), i); 773 if (!ignore_err) 774 goto end; 775 } 776 777 if (resp_text) 778 OCSP_RESPONSE_print(out, resp, 0); 779 } 780 781 /* If running as responder don't verify our own response */ 782 if (cbio != NULL) { 783 /* If not unlimited, see if we took all we should. */ 784 if (accept_count != -1 && --accept_count <= 0) { 785 ret = 0; 786 goto end; 787 } 788 BIO_free_all(cbio); 789 cbio = NULL; 790 OCSP_REQUEST_free(req); 791 req = NULL; 792 OCSP_RESPONSE_free(resp); 793 resp = NULL; 794 goto redo_accept; 795 } 796 if (ridx_filename != NULL) { 797 ret = 0; 798 goto end; 799 } 800 801 if (store == NULL) { 802 store = setup_verify(CAfile, noCAfile, CApath, noCApath, 803 CAstore, noCAstore); 804 if (!store) 805 goto end; 806 } 807 if (vpmtouched) 808 X509_STORE_set1_param(store, vpm); 809 if (verify_certfile != NULL) { 810 if (!load_certs(verify_certfile, 0, &verify_other, NULL, 811 "validator certificates")) 812 goto end; 813 } 814 815 bs = OCSP_response_get1_basic(resp); 816 if (bs == NULL) { 817 BIO_printf(bio_err, "Error parsing response\n"); 818 goto end; 819 } 820 821 ret = 0; 822 823 if (!noverify) { 824 if (req != NULL && ((i = OCSP_check_nonce(req, bs)) <= 0)) { 825 if (i == -1) 826 BIO_printf(bio_err, "WARNING: no nonce in response\n"); 827 else { 828 BIO_printf(bio_err, "Nonce Verify error\n"); 829 ret = 1; 830 goto end; 831 } 832 } 833 834 i = OCSP_basic_verify(bs, verify_other, store, verify_flags); 835 if (i <= 0 && issuers) { 836 i = OCSP_basic_verify(bs, issuers, store, OCSP_TRUSTOTHER); 837 if (i > 0) 838 ERR_clear_error(); 839 } 840 if (i <= 0) { 841 BIO_printf(bio_err, "Response Verify Failure\n"); 842 ERR_print_errors(bio_err); 843 ret = 1; 844 } else { 845 BIO_printf(bio_err, "Response verify OK\n"); 846 } 847 } 848 849 if (!print_ocsp_summary(out, bs, req, reqnames, ids, nsec, maxage)) 850 ret = 1; 851 852 end: 853 ERR_print_errors(bio_err); 854 X509_free(signer); 855 X509_STORE_free(store); 856 X509_VERIFY_PARAM_free(vpm); 857 sk_OPENSSL_STRING_free(rsign_sigopts); 858 EVP_PKEY_free(key); 859 EVP_PKEY_free(rkey); 860 EVP_MD_free(cert_id_md); 861 EVP_MD_free(rsign_md); 862 EVP_MD_free(resp_certid_md); 863 X509_free(cert); 864 OSSL_STACK_OF_X509_free(issuers); 865 X509_free(rsigner); 866 OSSL_STACK_OF_X509_free(rca_certs); 867 free_index(rdb); 868 BIO_free_all(cbio); 869 BIO_free_all(acbio); 870 BIO_free_all(out); 871 OCSP_REQUEST_free(req); 872 OCSP_RESPONSE_free(resp); 873 OCSP_BASICRESP_free(bs); 874 sk_OPENSSL_STRING_free(reqnames); 875 sk_OCSP_CERTID_free(ids); 876 OSSL_STACK_OF_X509_free(sign_other); 877 OSSL_STACK_OF_X509_free(verify_other); 878 sk_CONF_VALUE_pop_free(headers, X509V3_conf_free); 879 OPENSSL_free(thost); 880 OPENSSL_free(tport); 881 OPENSSL_free(tpath); 882 883 return ret; 884 } 885 886 #ifdef HTTP_DAEMON 887 888 static int index_changed(CA_DB *rdb) 889 { 890 struct stat sb; 891 892 if (rdb != NULL && stat(rdb->dbfname, &sb) != -1) { 893 if (rdb->dbst.st_mtime != sb.st_mtime 894 || rdb->dbst.st_ctime != sb.st_ctime 895 || rdb->dbst.st_ino != sb.st_ino 896 || rdb->dbst.st_dev != sb.st_dev) { 897 syslog(LOG_INFO, "index file changed, reloading"); 898 return 1; 899 } 900 } 901 return 0; 902 } 903 904 #endif 905 906 static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert, 907 const EVP_MD *cert_id_md, X509 *issuer, 908 STACK_OF(OCSP_CERTID) *ids) 909 { 910 OCSP_CERTID *id; 911 912 if (issuer == NULL) { 913 BIO_printf(bio_err, "No issuer certificate specified\n"); 914 return 0; 915 } 916 if (*req == NULL) 917 *req = OCSP_REQUEST_new(); 918 if (*req == NULL) 919 goto err; 920 id = OCSP_cert_to_id(cert_id_md, cert, issuer); 921 if (id == NULL || !sk_OCSP_CERTID_push(ids, id)) 922 goto err; 923 if (!OCSP_request_add0_id(*req, id)) 924 goto err; 925 return 1; 926 927 err: 928 BIO_printf(bio_err, "Error Creating OCSP request\n"); 929 return 0; 930 } 931 932 static int add_ocsp_serial(OCSP_REQUEST **req, char *serial, 933 const EVP_MD *cert_id_md, X509 *issuer, 934 STACK_OF(OCSP_CERTID) *ids) 935 { 936 OCSP_CERTID *id; 937 const X509_NAME *iname; 938 ASN1_BIT_STRING *ikey; 939 ASN1_INTEGER *sno; 940 941 if (issuer == NULL) { 942 BIO_printf(bio_err, "No issuer certificate specified\n"); 943 return 0; 944 } 945 if (*req == NULL) 946 *req = OCSP_REQUEST_new(); 947 if (*req == NULL) 948 goto err; 949 iname = X509_get_subject_name(issuer); 950 ikey = X509_get0_pubkey_bitstr(issuer); 951 sno = s2i_ASN1_INTEGER(NULL, serial); 952 if (sno == NULL) { 953 BIO_printf(bio_err, "Error converting serial number %s\n", serial); 954 return 0; 955 } 956 id = OCSP_cert_id_new(cert_id_md, iname, ikey, sno); 957 ASN1_INTEGER_free(sno); 958 if (id == NULL || !sk_OCSP_CERTID_push(ids, id)) 959 goto err; 960 if (!OCSP_request_add0_id(*req, id)) 961 goto err; 962 return 1; 963 964 err: 965 BIO_printf(bio_err, "Error Creating OCSP request\n"); 966 return 0; 967 } 968 969 static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req, 970 STACK_OF(OPENSSL_STRING) *names, 971 STACK_OF(OCSP_CERTID) *ids, long nsec, 972 long maxage) 973 { 974 OCSP_CERTID *id; 975 const char *name; 976 int i, status, reason; 977 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd; 978 int ret = 1; 979 980 if (req == NULL || !sk_OPENSSL_STRING_num(names)) 981 return 1; 982 983 if (bs == NULL || !sk_OCSP_CERTID_num(ids)) 984 return 0; 985 986 for (i = 0; i < sk_OCSP_CERTID_num(ids); i++) { 987 id = sk_OCSP_CERTID_value(ids, i); 988 name = sk_OPENSSL_STRING_value(names, i); 989 BIO_printf(out, "%s: ", name); 990 991 if (!OCSP_resp_find_status(bs, id, &status, &reason, 992 &rev, &thisupd, &nextupd)) { 993 BIO_puts(out, "ERROR: No Status found.\n"); 994 ret = 0; 995 continue; 996 } 997 998 /* 999 * Check validity: if invalid write to output BIO so we know which 1000 * response this refers to. 1001 */ 1002 if (!OCSP_check_validity(thisupd, nextupd, nsec, maxage)) { 1003 BIO_puts(out, "WARNING: Status times invalid.\n"); 1004 ERR_print_errors(out); 1005 } 1006 BIO_printf(out, "%s\n", OCSP_cert_status_str(status)); 1007 1008 BIO_puts(out, "\tThis Update: "); 1009 ASN1_GENERALIZEDTIME_print(out, thisupd); 1010 BIO_puts(out, "\n"); 1011 1012 if (nextupd) { 1013 BIO_puts(out, "\tNext Update: "); 1014 ASN1_GENERALIZEDTIME_print(out, nextupd); 1015 BIO_puts(out, "\n"); 1016 } 1017 1018 if (status != V_OCSP_CERTSTATUS_REVOKED) 1019 continue; 1020 1021 if (reason != -1) 1022 BIO_printf(out, "\tReason: %s\n", OCSP_crl_reason_str(reason)); 1023 1024 BIO_puts(out, "\tRevocation Time: "); 1025 ASN1_GENERALIZEDTIME_print(out, rev); 1026 BIO_puts(out, "\n"); 1027 } 1028 return ret; 1029 } 1030 1031 static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req, 1032 CA_DB *db, STACK_OF(X509) *ca, X509 *rcert, 1033 EVP_PKEY *rkey, const EVP_MD *rmd, 1034 STACK_OF(OPENSSL_STRING) *sigopts, 1035 STACK_OF(X509) *rother, unsigned long flags, 1036 int nmin, int ndays, int badsig, 1037 const EVP_MD *resp_md) 1038 { 1039 ASN1_TIME *thisupd = NULL, *nextupd = NULL; 1040 OCSP_CERTID *cid; 1041 OCSP_BASICRESP *bs = NULL; 1042 int i, id_count; 1043 EVP_MD_CTX *mctx = NULL; 1044 EVP_PKEY_CTX *pkctx = NULL; 1045 1046 id_count = OCSP_request_onereq_count(req); 1047 1048 if (id_count <= 0) { 1049 *resp = 1050 OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL); 1051 goto end; 1052 } 1053 1054 bs = OCSP_BASICRESP_new(); 1055 if (bs == NULL) { 1056 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, bs); 1057 goto end; 1058 } 1059 thisupd = X509_gmtime_adj(NULL, 0); 1060 if (ndays != -1) 1061 nextupd = X509_time_adj_ex(NULL, ndays, nmin * 60, NULL); 1062 1063 /* Examine each certificate id in the request */ 1064 for (i = 0; i < id_count; i++) { 1065 OCSP_ONEREQ *one; 1066 ASN1_INTEGER *serial; 1067 char **inf; 1068 int jj; 1069 int found = 0; 1070 ASN1_OBJECT *cert_id_md_oid; 1071 const EVP_MD *cert_id_md; 1072 OCSP_CERTID *cid_resp_md = NULL; 1073 1074 one = OCSP_request_onereq_get0(req, i); 1075 cid = OCSP_onereq_get0_id(one); 1076 1077 OCSP_id_get0_info(NULL, &cert_id_md_oid, NULL, NULL, cid); 1078 1079 cert_id_md = EVP_get_digestbyobj(cert_id_md_oid); 1080 if (cert_id_md == NULL) { 1081 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, 1082 NULL); 1083 goto end; 1084 } 1085 for (jj = 0; jj < sk_X509_num(ca) && !found; jj++) { 1086 X509 *ca_cert = sk_X509_value(ca, jj); 1087 OCSP_CERTID *ca_id = OCSP_cert_to_id(cert_id_md, NULL, ca_cert); 1088 1089 if (OCSP_id_issuer_cmp(ca_id, cid) == 0) { 1090 found = 1; 1091 if (resp_md != NULL) 1092 cid_resp_md = OCSP_cert_to_id(resp_md, NULL, ca_cert); 1093 } 1094 OCSP_CERTID_free(ca_id); 1095 } 1096 OCSP_id_get0_info(NULL, NULL, NULL, &serial, cid); 1097 inf = lookup_serial(db, serial); 1098 1099 /* at this point, we can have cid be an alias of cid_resp_md */ 1100 cid = (cid_resp_md != NULL) ? cid_resp_md : cid; 1101 1102 if (!found) { 1103 OCSP_basic_add1_status(bs, cid, 1104 V_OCSP_CERTSTATUS_UNKNOWN, 1105 0, NULL, thisupd, nextupd); 1106 continue; 1107 } 1108 if (inf == NULL) { 1109 OCSP_basic_add1_status(bs, cid, 1110 V_OCSP_CERTSTATUS_UNKNOWN, 1111 0, NULL, thisupd, nextupd); 1112 } else if (inf[DB_type][0] == DB_TYPE_VAL) { 1113 OCSP_basic_add1_status(bs, cid, 1114 V_OCSP_CERTSTATUS_GOOD, 1115 0, NULL, thisupd, nextupd); 1116 } else if (inf[DB_type][0] == DB_TYPE_REV) { 1117 ASN1_OBJECT *inst = NULL; 1118 ASN1_TIME *revtm = NULL; 1119 ASN1_GENERALIZEDTIME *invtm = NULL; 1120 OCSP_SINGLERESP *single; 1121 int reason = -1; 1122 1123 unpack_revinfo(&revtm, &reason, &inst, &invtm, inf[DB_rev_date]); 1124 single = OCSP_basic_add1_status(bs, cid, 1125 V_OCSP_CERTSTATUS_REVOKED, 1126 reason, revtm, thisupd, nextupd); 1127 if (single == NULL) { 1128 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, 1129 NULL); 1130 goto end; 1131 } 1132 if (invtm != NULL) 1133 OCSP_SINGLERESP_add1_ext_i2d(single, NID_invalidity_date, 1134 invtm, 0, 0); 1135 else if (inst != NULL) 1136 OCSP_SINGLERESP_add1_ext_i2d(single, 1137 NID_hold_instruction_code, inst, 1138 0, 0); 1139 ASN1_OBJECT_free(inst); 1140 ASN1_TIME_free(revtm); 1141 ASN1_GENERALIZEDTIME_free(invtm); 1142 } 1143 OCSP_CERTID_free(cid_resp_md); 1144 } 1145 1146 OCSP_copy_nonce(bs, req); 1147 1148 mctx = EVP_MD_CTX_new(); 1149 if (mctx == NULL || !EVP_DigestSignInit(mctx, &pkctx, rmd, NULL, rkey)) { 1150 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, NULL); 1151 goto end; 1152 } 1153 for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) { 1154 char *sigopt = sk_OPENSSL_STRING_value(sigopts, i); 1155 1156 if (pkey_ctrl_string(pkctx, sigopt) <= 0) { 1157 BIO_printf(err, "parameter error \"%s\"\n", sigopt); 1158 ERR_print_errors(bio_err); 1159 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, 1160 NULL); 1161 goto end; 1162 } 1163 } 1164 if (!OCSP_basic_sign_ctx(bs, rcert, mctx, rother, flags)) { 1165 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, bs); 1166 goto end; 1167 } 1168 1169 if (badsig) { 1170 const ASN1_OCTET_STRING *sig = OCSP_resp_get0_signature(bs); 1171 corrupt_signature(sig); 1172 } 1173 1174 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_SUCCESSFUL, bs); 1175 1176 end: 1177 EVP_MD_CTX_free(mctx); 1178 ASN1_TIME_free(thisupd); 1179 ASN1_TIME_free(nextupd); 1180 OCSP_BASICRESP_free(bs); 1181 } 1182 1183 static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser) 1184 { 1185 int i; 1186 BIGNUM *bn = NULL; 1187 char *itmp, *row[DB_NUMBER], **rrow; 1188 for (i = 0; i < DB_NUMBER; i++) 1189 row[i] = NULL; 1190 bn = ASN1_INTEGER_to_BN(ser, NULL); 1191 OPENSSL_assert(bn); /* FIXME: should report an error at this 1192 * point and abort */ 1193 if (BN_is_zero(bn)) { 1194 itmp = OPENSSL_strdup("00"); 1195 OPENSSL_assert(itmp); 1196 } else { 1197 itmp = BN_bn2hex(bn); 1198 } 1199 row[DB_serial] = itmp; 1200 BN_free(bn); 1201 rrow = TXT_DB_get_by_index(db->db, DB_serial, row); 1202 OPENSSL_free(itmp); 1203 return rrow; 1204 } 1205 1206 static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio, 1207 int timeout) 1208 { 1209 #ifndef OPENSSL_NO_SOCK 1210 return http_server_get_asn1_req(ASN1_ITEM_rptr(OCSP_REQUEST), 1211 (ASN1_VALUE **)preq, NULL, pcbio, acbio, 1212 NULL /* found_keep_alive */, 1213 prog, 1 /* accept_get */, timeout); 1214 #else 1215 BIO_printf(bio_err, 1216 "Error getting OCSP request - sockets not supported\n"); 1217 *preq = NULL; 1218 return 0; 1219 #endif 1220 } 1221 1222 static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp) 1223 { 1224 #ifndef OPENSSL_NO_SOCK 1225 return http_server_send_asn1_resp(prog, cbio, 1226 0 /* no keep-alive */, 1227 "application/ocsp-response", 1228 ASN1_ITEM_rptr(OCSP_RESPONSE), 1229 (const ASN1_VALUE *)resp); 1230 #else 1231 BIO_printf(bio_err, 1232 "Error sending OCSP response - sockets not supported\n"); 1233 return 0; 1234 #endif 1235 } 1236 1237 #ifndef OPENSSL_NO_SOCK 1238 OCSP_RESPONSE *process_responder(OCSP_REQUEST *req, const char *host, 1239 const char *port, const char *path, 1240 const char *proxy, const char *no_proxy, 1241 int use_ssl, STACK_OF(CONF_VALUE) *headers, 1242 int req_timeout) 1243 { 1244 SSL_CTX *ctx = NULL; 1245 OCSP_RESPONSE *resp = NULL; 1246 1247 if (use_ssl == 1) { 1248 ctx = SSL_CTX_new(TLS_client_method()); 1249 if (ctx == NULL) { 1250 BIO_printf(bio_err, "Error creating SSL context.\n"); 1251 goto end; 1252 } 1253 } 1254 1255 resp = (OCSP_RESPONSE *) 1256 app_http_post_asn1(host, port, path, proxy, no_proxy, 1257 ctx, headers, "application/ocsp-request", 1258 (ASN1_VALUE *)req, ASN1_ITEM_rptr(OCSP_REQUEST), 1259 "application/ocsp-response", 1260 req_timeout, ASN1_ITEM_rptr(OCSP_RESPONSE)); 1261 1262 if (resp == NULL) 1263 BIO_printf(bio_err, "Error querying OCSP responder\n"); 1264 1265 end: 1266 SSL_CTX_free(ctx); 1267 return resp; 1268 } 1269 #endif 1270