1 /* 2 * Copyright 2001-2025 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <openssl/opensslconf.h> 11 12 #ifdef OPENSSL_SYS_VMS 13 /* So fd_set and friends get properly defined on OpenVMS */ 14 # define _XOPEN_SOURCE_EXTENDED 15 #endif 16 17 #include <stdio.h> 18 #include <stdlib.h> 19 #include <string.h> 20 #include <time.h> 21 #include <ctype.h> 22 23 /* Needs to be included before the openssl headers */ 24 #include "apps.h" 25 #include "http_server.h" 26 #include "progs.h" 27 #include "internal/sockets.h" 28 #include <openssl/e_os2.h> 29 #include <openssl/crypto.h> 30 #include <openssl/err.h> 31 #include <openssl/ssl.h> 32 #include <openssl/evp.h> 33 #include <openssl/bn.h> 34 #include <openssl/x509v3.h> 35 36 #if defined(OPENSSL_SYS_VXWORKS) 37 /* not supported */ 38 int setpgid(pid_t pid, pid_t pgid) 39 { 40 errno = ENOSYS; 41 return 0; 42 } 43 /* not supported */ 44 pid_t fork(void) 45 { 46 errno = ENOSYS; 47 return (pid_t) -1; 48 } 49 #endif 50 /* Maximum leeway in validity period: default 5 minutes */ 51 #define MAX_VALIDITY_PERIOD (5 * 60) 52 53 static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert, 54 const EVP_MD *cert_id_md, X509 *issuer, 55 STACK_OF(OCSP_CERTID) *ids); 56 static int add_ocsp_serial(OCSP_REQUEST **req, char *serial, 57 const EVP_MD *cert_id_md, X509 *issuer, 58 STACK_OF(OCSP_CERTID) *ids); 59 static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req, 60 STACK_OF(OPENSSL_STRING) *names, 61 STACK_OF(OCSP_CERTID) *ids, long nsec, 62 long maxage); 63 static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req, 64 CA_DB *db, STACK_OF(X509) *ca, X509 *rcert, 65 EVP_PKEY *rkey, const EVP_MD *md, 66 STACK_OF(OPENSSL_STRING) *sigopts, 67 STACK_OF(X509) *rother, unsigned long flags, 68 int nmin, int ndays, int badsig, 69 const EVP_MD *resp_md); 70 71 static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser); 72 static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio, 73 int timeout); 74 static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp); 75 static char *prog; 76 77 #ifdef HTTP_DAEMON 78 static int index_changed(CA_DB *); 79 #endif 80 81 typedef enum OPTION_choice { 82 OPT_COMMON, 83 OPT_OUTFILE, OPT_TIMEOUT, OPT_URL, OPT_HOST, OPT_PORT, 84 #ifndef OPENSSL_NO_SOCK 85 OPT_PROXY, OPT_NO_PROXY, 86 #endif 87 OPT_IGNORE_ERR, OPT_NOVERIFY, OPT_NONCE, OPT_NO_NONCE, 88 OPT_RESP_NO_CERTS, OPT_RESP_KEY_ID, OPT_NO_CERTS, 89 OPT_NO_SIGNATURE_VERIFY, OPT_NO_CERT_VERIFY, OPT_NO_CHAIN, 90 OPT_NO_CERT_CHECKS, OPT_NO_EXPLICIT, OPT_TRUST_OTHER, 91 OPT_NO_INTERN, OPT_BADSIG, OPT_TEXT, OPT_REQ_TEXT, OPT_RESP_TEXT, 92 OPT_REQIN, OPT_RESPIN, OPT_SIGNER, OPT_VAFILE, OPT_SIGN_OTHER, 93 OPT_VERIFY_OTHER, OPT_CAFILE, OPT_CAPATH, OPT_CASTORE, OPT_NOCAFILE, 94 OPT_NOCAPATH, OPT_NOCASTORE, 95 OPT_VALIDITY_PERIOD, OPT_STATUS_AGE, OPT_SIGNKEY, OPT_REQOUT, 96 OPT_RESPOUT, OPT_PATH, OPT_ISSUER, OPT_CERT, OPT_SERIAL, 97 OPT_INDEX, OPT_CA, OPT_NMIN, OPT_REQUEST, OPT_NDAYS, OPT_RSIGNER, 98 OPT_RKEY, OPT_ROTHER, OPT_RMD, OPT_RSIGOPT, OPT_HEADER, 99 OPT_PASSIN, 100 OPT_RCID, 101 OPT_V_ENUM, 102 OPT_MD, 103 OPT_MULTI, OPT_PROV_ENUM 104 } OPTION_CHOICE; 105 106 const OPTIONS ocsp_options[] = { 107 OPT_SECTION("General"), 108 {"help", OPT_HELP, '-', "Display this summary"}, 109 {"ignore_err", OPT_IGNORE_ERR, '-', 110 "Ignore error on OCSP request or response and continue running"}, 111 {"CAfile", OPT_CAFILE, '<', "Trusted certificates file"}, 112 {"CApath", OPT_CAPATH, '<', "Trusted certificates directory"}, 113 {"CAstore", OPT_CASTORE, ':', "Trusted certificates store URI"}, 114 {"no-CAfile", OPT_NOCAFILE, '-', 115 "Do not load the default certificates file"}, 116 {"no-CApath", OPT_NOCAPATH, '-', 117 "Do not load certificates from the default certificates directory"}, 118 {"no-CAstore", OPT_NOCASTORE, '-', 119 "Do not load certificates from the default certificates store"}, 120 121 OPT_SECTION("Responder"), 122 {"timeout", OPT_TIMEOUT, 'p', 123 "Connection timeout (in seconds) to the OCSP responder"}, 124 {"resp_no_certs", OPT_RESP_NO_CERTS, '-', 125 "Don't include any certificates in response"}, 126 #ifdef HTTP_DAEMON 127 {"multi", OPT_MULTI, 'p', "run multiple responder processes"}, 128 #endif 129 {"no_certs", OPT_NO_CERTS, '-', 130 "Don't include any certificates in signed request"}, 131 {"badsig", OPT_BADSIG, '-', 132 "Corrupt last byte of loaded OCSP response signature (for test)"}, 133 {"CA", OPT_CA, '<', "CA certificates"}, 134 {"nmin", OPT_NMIN, 'p', "Number of minutes before next update"}, 135 {"nrequest", OPT_REQUEST, 'p', 136 "Number of requests to accept (default unlimited)"}, 137 {"reqin", OPT_REQIN, 's', "File with the DER-encoded request"}, 138 {"signer", OPT_SIGNER, '<', "Certificate to sign OCSP request with"}, 139 {"sign_other", OPT_SIGN_OTHER, '<', 140 "Additional certificates to include in signed request"}, 141 {"index", OPT_INDEX, '<', "Certificate status index file"}, 142 {"ndays", OPT_NDAYS, 'p', "Number of days before next update"}, 143 {"rsigner", OPT_RSIGNER, '<', 144 "Responder certificate to sign responses with"}, 145 {"rkey", OPT_RKEY, '<', "Responder key to sign responses with"}, 146 {"passin", OPT_PASSIN, 's', "Responder key pass phrase source"}, 147 {"rother", OPT_ROTHER, '<', "Other certificates to include in response"}, 148 {"rmd", OPT_RMD, 's', "Digest Algorithm to use in signature of OCSP response"}, 149 {"rsigopt", OPT_RSIGOPT, 's', "OCSP response signature parameter in n:v form"}, 150 {"header", OPT_HEADER, 's', "key=value header to add"}, 151 {"rcid", OPT_RCID, 's', "Use specified algorithm for cert id in response"}, 152 {"", OPT_MD, '-', "Any supported digest algorithm (sha1,sha256, ... )"}, 153 154 OPT_SECTION("Client"), 155 {"url", OPT_URL, 's', "Responder URL"}, 156 {"host", OPT_HOST, 's', "TCP/IP hostname:port to connect to"}, 157 {"port", OPT_PORT, 'N', "Port to run responder on"}, 158 {"path", OPT_PATH, 's', "Path to use in OCSP request"}, 159 #ifndef OPENSSL_NO_SOCK 160 {"proxy", OPT_PROXY, 's', 161 "[http[s]://]host[:port][/path] of HTTP(S) proxy to use; path is ignored"}, 162 {"no_proxy", OPT_NO_PROXY, 's', 163 "List of addresses of servers not to use HTTP(S) proxy for"}, 164 {OPT_MORE_STR, 0, 0, 165 "Default from environment variable 'no_proxy', else 'NO_PROXY', else none"}, 166 #endif 167 {"out", OPT_OUTFILE, '>', "Output filename"}, 168 {"noverify", OPT_NOVERIFY, '-', "Don't verify response at all"}, 169 {"nonce", OPT_NONCE, '-', "Add OCSP nonce to request"}, 170 {"no_nonce", OPT_NO_NONCE, '-', "Don't add OCSP nonce to request"}, 171 {"no_signature_verify", OPT_NO_SIGNATURE_VERIFY, '-', 172 "Don't check signature on response"}, 173 {"resp_key_id", OPT_RESP_KEY_ID, '-', 174 "Identify response by signing certificate key ID"}, 175 {"no_cert_verify", OPT_NO_CERT_VERIFY, '-', 176 "Don't check signing certificate"}, 177 {"text", OPT_TEXT, '-', "Print text form of request and response"}, 178 {"req_text", OPT_REQ_TEXT, '-', "Print text form of request"}, 179 {"resp_text", OPT_RESP_TEXT, '-', "Print text form of response"}, 180 {"no_chain", OPT_NO_CHAIN, '-', "Don't chain verify response"}, 181 {"no_cert_checks", OPT_NO_CERT_CHECKS, '-', 182 "Don't do additional checks on signing certificate"}, 183 {"no_explicit", OPT_NO_EXPLICIT, '-', 184 "Do not explicitly check the chain, just verify the root"}, 185 {"trust_other", OPT_TRUST_OTHER, '-', 186 "Don't verify additional certificates"}, 187 {"no_intern", OPT_NO_INTERN, '-', 188 "Don't search certificates contained in response for signer"}, 189 {"respin", OPT_RESPIN, 's', "File with the DER-encoded response"}, 190 {"VAfile", OPT_VAFILE, '<', "Validator certificates file"}, 191 {"verify_other", OPT_VERIFY_OTHER, '<', 192 "Additional certificates to search for signer"}, 193 {"cert", OPT_CERT, '<', 194 "Certificate to check; may be given multiple times"}, 195 {"serial", OPT_SERIAL, 's', 196 "Serial number to check; may be given multiple times"}, 197 {"validity_period", OPT_VALIDITY_PERIOD, 'u', 198 "Maximum validity discrepancy in seconds"}, 199 {"signkey", OPT_SIGNKEY, 's', "Private key to sign OCSP request with"}, 200 {"reqout", OPT_REQOUT, 's', "Output file for the DER-encoded request"}, 201 {"respout", OPT_RESPOUT, 's', "Output file for the DER-encoded response"}, 202 {"issuer", OPT_ISSUER, '<', "Issuer certificate"}, 203 {"status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds"}, 204 205 OPT_V_OPTIONS, 206 OPT_PROV_OPTIONS, 207 {NULL} 208 }; 209 210 int ocsp_main(int argc, char **argv) 211 { 212 BIO *acbio = NULL, *cbio = NULL, *derbio = NULL, *out = NULL; 213 EVP_MD *cert_id_md = NULL, *rsign_md = NULL; 214 STACK_OF(OPENSSL_STRING) *rsign_sigopts = NULL; 215 int trailing_md = 0; 216 CA_DB *rdb = NULL; 217 EVP_PKEY *key = NULL, *rkey = NULL; 218 OCSP_BASICRESP *bs = NULL; 219 OCSP_REQUEST *req = NULL; 220 OCSP_RESPONSE *resp = NULL; 221 STACK_OF(CONF_VALUE) *headers = NULL; 222 STACK_OF(OCSP_CERTID) *ids = NULL; 223 STACK_OF(OPENSSL_STRING) *reqnames = NULL; 224 STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL; 225 STACK_OF(X509) *issuers = NULL; 226 X509 *issuer = NULL, *cert = NULL; 227 STACK_OF(X509) *rca_certs = NULL; 228 EVP_MD *resp_certid_md = NULL; 229 X509 *signer = NULL, *rsigner = NULL; 230 X509_STORE *store = NULL; 231 X509_VERIFY_PARAM *vpm = NULL; 232 const char *CAfile = NULL, *CApath = NULL, *CAstore = NULL; 233 char *header, *value, *respdigname = NULL; 234 char *host = NULL, *port = NULL, *path = "/", *outfile = NULL; 235 #ifndef OPENSSL_NO_SOCK 236 char *opt_proxy = NULL; 237 char *opt_no_proxy = NULL; 238 #endif 239 char *rca_filename = NULL, *reqin = NULL, *respin = NULL; 240 char *reqout = NULL, *respout = NULL, *ridx_filename = NULL; 241 char *rsignfile = NULL, *rkeyfile = NULL; 242 char *passinarg = NULL, *passin = NULL; 243 char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL; 244 char *signfile = NULL, *keyfile = NULL; 245 char *thost = NULL, *tport = NULL, *tpath = NULL; 246 int noCAfile = 0, noCApath = 0, noCAstore = 0; 247 int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1; 248 int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1; 249 int req_text = 0, resp_text = 0, res, ret = 1; 250 int req_timeout = -1; 251 long nsec = MAX_VALIDITY_PERIOD, maxage = -1; 252 unsigned long sign_flags = 0, verify_flags = 0, rflags = 0; 253 OPTION_CHOICE o; 254 255 if ((reqnames = sk_OPENSSL_STRING_new_null()) == NULL 256 || (ids = sk_OCSP_CERTID_new_null()) == NULL 257 || (vpm = X509_VERIFY_PARAM_new()) == NULL) 258 goto end; 259 260 opt_set_unknown_name("digest"); 261 prog = opt_init(argc, argv, ocsp_options); 262 while ((o = opt_next()) != OPT_EOF) { 263 switch (o) { 264 case OPT_EOF: 265 case OPT_ERR: 266 opthelp: 267 BIO_printf(bio_err, "%s: Use -help for summary.\n", prog); 268 goto end; 269 case OPT_HELP: 270 ret = 0; 271 opt_help(ocsp_options); 272 goto end; 273 case OPT_OUTFILE: 274 outfile = opt_arg(); 275 break; 276 case OPT_TIMEOUT: 277 #ifndef OPENSSL_NO_SOCK 278 req_timeout = atoi(opt_arg()); 279 #endif 280 break; 281 case OPT_URL: 282 OPENSSL_free(thost); 283 OPENSSL_free(tport); 284 OPENSSL_free(tpath); 285 thost = tport = tpath = NULL; 286 if (!OSSL_HTTP_parse_url(opt_arg(), &use_ssl, NULL /* userinfo */, 287 &host, &port, NULL /* port_num */, 288 &path, NULL /* qry */, NULL /* frag */)) { 289 BIO_printf(bio_err, "%s Error parsing -url argument\n", prog); 290 goto end; 291 } 292 thost = host; 293 tport = port; 294 tpath = path; 295 break; 296 case OPT_HOST: 297 host = opt_arg(); 298 break; 299 case OPT_PORT: 300 port = opt_arg(); 301 break; 302 case OPT_PATH: 303 path = opt_arg(); 304 break; 305 #ifndef OPENSSL_NO_SOCK 306 case OPT_PROXY: 307 opt_proxy = opt_arg(); 308 break; 309 case OPT_NO_PROXY: 310 opt_no_proxy = opt_arg(); 311 break; 312 #endif 313 case OPT_IGNORE_ERR: 314 ignore_err = 1; 315 break; 316 case OPT_NOVERIFY: 317 noverify = 1; 318 break; 319 case OPT_NONCE: 320 add_nonce = 2; 321 break; 322 case OPT_NO_NONCE: 323 add_nonce = 0; 324 break; 325 case OPT_RESP_NO_CERTS: 326 rflags |= OCSP_NOCERTS; 327 break; 328 case OPT_RESP_KEY_ID: 329 rflags |= OCSP_RESPID_KEY; 330 break; 331 case OPT_NO_CERTS: 332 sign_flags |= OCSP_NOCERTS; 333 break; 334 case OPT_NO_SIGNATURE_VERIFY: 335 verify_flags |= OCSP_NOSIGS; 336 break; 337 case OPT_NO_CERT_VERIFY: 338 verify_flags |= OCSP_NOVERIFY; 339 break; 340 case OPT_NO_CHAIN: 341 verify_flags |= OCSP_NOCHAIN; 342 break; 343 case OPT_NO_CERT_CHECKS: 344 verify_flags |= OCSP_NOCHECKS; 345 break; 346 case OPT_NO_EXPLICIT: 347 verify_flags |= OCSP_NOEXPLICIT; 348 break; 349 case OPT_TRUST_OTHER: 350 verify_flags |= OCSP_TRUSTOTHER; 351 break; 352 case OPT_NO_INTERN: 353 verify_flags |= OCSP_NOINTERN; 354 break; 355 case OPT_BADSIG: 356 badsig = 1; 357 break; 358 case OPT_TEXT: 359 req_text = resp_text = 1; 360 break; 361 case OPT_REQ_TEXT: 362 req_text = 1; 363 break; 364 case OPT_RESP_TEXT: 365 resp_text = 1; 366 break; 367 case OPT_REQIN: 368 reqin = opt_arg(); 369 break; 370 case OPT_RESPIN: 371 respin = opt_arg(); 372 break; 373 case OPT_SIGNER: 374 signfile = opt_arg(); 375 break; 376 case OPT_VAFILE: 377 verify_certfile = opt_arg(); 378 verify_flags |= OCSP_TRUSTOTHER; 379 break; 380 case OPT_SIGN_OTHER: 381 sign_certfile = opt_arg(); 382 break; 383 case OPT_VERIFY_OTHER: 384 verify_certfile = opt_arg(); 385 break; 386 case OPT_CAFILE: 387 CAfile = opt_arg(); 388 break; 389 case OPT_CAPATH: 390 CApath = opt_arg(); 391 break; 392 case OPT_CASTORE: 393 CAstore = opt_arg(); 394 break; 395 case OPT_NOCAFILE: 396 noCAfile = 1; 397 break; 398 case OPT_NOCAPATH: 399 noCApath = 1; 400 break; 401 case OPT_NOCASTORE: 402 noCAstore = 1; 403 break; 404 case OPT_V_CASES: 405 if (!opt_verify(o, vpm)) 406 goto end; 407 vpmtouched++; 408 break; 409 case OPT_VALIDITY_PERIOD: 410 opt_long(opt_arg(), &nsec); 411 break; 412 case OPT_STATUS_AGE: 413 opt_long(opt_arg(), &maxage); 414 break; 415 case OPT_SIGNKEY: 416 keyfile = opt_arg(); 417 break; 418 case OPT_REQOUT: 419 reqout = opt_arg(); 420 break; 421 case OPT_RESPOUT: 422 respout = opt_arg(); 423 break; 424 case OPT_ISSUER: 425 issuer = load_cert(opt_arg(), FORMAT_UNDEF, "issuer certificate"); 426 if (issuer == NULL) 427 goto end; 428 if (issuers == NULL) { 429 if ((issuers = sk_X509_new_null()) == NULL) 430 goto end; 431 } 432 if (!sk_X509_push(issuers, issuer)) 433 goto end; 434 break; 435 case OPT_CERT: 436 reset_unknown(); 437 X509_free(cert); 438 cert = load_cert(opt_arg(), FORMAT_UNDEF, "certificate"); 439 if (cert == NULL) 440 goto end; 441 if (cert_id_md == NULL) 442 cert_id_md = (EVP_MD *)EVP_sha1(); 443 if (!add_ocsp_cert(&req, cert, cert_id_md, issuer, ids)) 444 goto end; 445 if (!sk_OPENSSL_STRING_push(reqnames, opt_arg())) 446 goto end; 447 trailing_md = 0; 448 break; 449 case OPT_SERIAL: 450 reset_unknown(); 451 if (cert_id_md == NULL) 452 cert_id_md = (EVP_MD *)EVP_sha1(); 453 if (!add_ocsp_serial(&req, opt_arg(), cert_id_md, issuer, ids)) 454 goto end; 455 if (!sk_OPENSSL_STRING_push(reqnames, opt_arg())) 456 goto end; 457 trailing_md = 0; 458 break; 459 case OPT_INDEX: 460 ridx_filename = opt_arg(); 461 break; 462 case OPT_CA: 463 rca_filename = opt_arg(); 464 break; 465 case OPT_NMIN: 466 nmin = opt_int_arg(); 467 if (ndays == -1) 468 ndays = 0; 469 break; 470 case OPT_REQUEST: 471 accept_count = opt_int_arg(); 472 break; 473 case OPT_NDAYS: 474 ndays = atoi(opt_arg()); 475 break; 476 case OPT_RSIGNER: 477 rsignfile = opt_arg(); 478 break; 479 case OPT_RKEY: 480 rkeyfile = opt_arg(); 481 break; 482 case OPT_PASSIN: 483 passinarg = opt_arg(); 484 break; 485 case OPT_ROTHER: 486 rcertfile = opt_arg(); 487 break; 488 case OPT_RMD: /* Response MessageDigest */ 489 respdigname = opt_arg(); 490 break; 491 case OPT_RSIGOPT: 492 if (rsign_sigopts == NULL) 493 rsign_sigopts = sk_OPENSSL_STRING_new_null(); 494 if (rsign_sigopts == NULL 495 || !sk_OPENSSL_STRING_push(rsign_sigopts, opt_arg())) 496 goto end; 497 break; 498 case OPT_HEADER: 499 header = opt_arg(); 500 value = strchr(header, '='); 501 if (value == NULL) { 502 BIO_printf(bio_err, "Missing = in header key=value\n"); 503 goto opthelp; 504 } 505 *value++ = '\0'; 506 if (!X509V3_add_value(header, value, &headers)) 507 goto end; 508 break; 509 case OPT_RCID: 510 if (!opt_md(opt_arg(), &resp_certid_md)) 511 goto opthelp; 512 break; 513 case OPT_MD: 514 if (trailing_md) { 515 BIO_printf(bio_err, 516 "%s: Digest must be before -cert or -serial\n", 517 prog); 518 goto opthelp; 519 } 520 if (!opt_md(opt_unknown(), &cert_id_md)) 521 goto opthelp; 522 trailing_md = 1; 523 break; 524 case OPT_MULTI: 525 #ifdef HTTP_DAEMON 526 n_responders = atoi(opt_arg()); 527 #endif 528 break; 529 case OPT_PROV_CASES: 530 if (!opt_provider(o)) 531 goto end; 532 break; 533 } 534 } 535 536 /* No extra arguments. */ 537 if (!opt_check_rest_arg(NULL)) 538 goto opthelp; 539 540 if (trailing_md) { 541 BIO_printf(bio_err, "%s: Digest must be before -cert or -serial\n", 542 prog); 543 goto opthelp; 544 } 545 546 if (respdigname != NULL) { 547 if (!opt_md(respdigname, &rsign_md)) 548 goto end; 549 } 550 551 /* Have we anything to do? */ 552 if (req == NULL && reqin == NULL 553 && respin == NULL && !(port != NULL && ridx_filename != NULL)) 554 goto opthelp; 555 556 if (req == NULL && (add_nonce != 2)) 557 add_nonce = 0; 558 559 if (req == NULL && reqin != NULL) { 560 derbio = bio_open_default(reqin, 'r', FORMAT_ASN1); 561 if (derbio == NULL) 562 goto end; 563 req = d2i_OCSP_REQUEST_bio(derbio, NULL); 564 BIO_free(derbio); 565 if (req == NULL) { 566 BIO_printf(bio_err, "Error reading OCSP request\n"); 567 goto end; 568 } 569 } 570 571 if (req == NULL && port != NULL) { 572 #ifndef OPENSSL_NO_SOCK 573 acbio = http_server_init(prog, port, -1); 574 if (acbio == NULL) 575 goto end; 576 #else 577 BIO_printf(bio_err, "Cannot act as server - sockets not supported\n"); 578 goto end; 579 #endif 580 } 581 582 if (rsignfile != NULL) { 583 if (rkeyfile == NULL) 584 rkeyfile = rsignfile; 585 rsigner = load_cert(rsignfile, FORMAT_UNDEF, "responder certificate"); 586 if (rsigner == NULL) { 587 BIO_printf(bio_err, "Error loading responder certificate\n"); 588 goto end; 589 } 590 if (!load_certs(rca_filename, 0, &rca_certs, NULL, "CA certificates")) 591 goto end; 592 if (rcertfile != NULL) { 593 if (!load_certs(rcertfile, 0, &rother, NULL, 594 "responder other certificates")) 595 goto end; 596 } 597 if (!app_passwd(passinarg, NULL, &passin, NULL)) { 598 BIO_printf(bio_err, "Error getting password\n"); 599 goto end; 600 } 601 rkey = load_key(rkeyfile, FORMAT_UNDEF, 0, passin, NULL, 602 "responder private key"); 603 if (rkey == NULL) 604 goto end; 605 } 606 607 if (ridx_filename != NULL 608 && (rkey == NULL || rsigner == NULL || rca_certs == NULL)) { 609 BIO_printf(bio_err, 610 "Responder mode requires certificate, key, and CA.\n"); 611 goto end; 612 } 613 614 if (ridx_filename != NULL) { 615 rdb = load_index(ridx_filename, NULL); 616 if (rdb == NULL || index_index(rdb) <= 0) { 617 BIO_printf(bio_err, 618 "Problem with index file: %s (could not load/parse file)\n", 619 ridx_filename); 620 ret = 1; 621 goto end; 622 } 623 } 624 625 #ifdef HTTP_DAEMON 626 if (n_responders != 0 && acbio != NULL) 627 spawn_loop(prog); 628 if (acbio != NULL && req_timeout > 0) 629 signal(SIGALRM, socket_timeout); 630 #endif 631 632 if (acbio != NULL) 633 trace_log_message(-1, prog, 634 LOG_INFO, "waiting for OCSP client connections..."); 635 636 redo_accept: 637 638 if (acbio != NULL) { 639 #ifdef HTTP_DAEMON 640 if (index_changed(rdb)) { 641 CA_DB *newrdb = load_index(ridx_filename, NULL); 642 643 if (newrdb != NULL && index_index(newrdb) > 0) { 644 free_index(rdb); 645 rdb = newrdb; 646 } else { 647 free_index(newrdb); 648 trace_log_message(-1, prog, 649 LOG_ERR, "error reloading updated index: %s", 650 ridx_filename); 651 } 652 } 653 #endif 654 655 req = NULL; 656 res = do_responder(&req, &cbio, acbio, req_timeout); 657 if (res == 0) 658 goto redo_accept; 659 660 if (req == NULL) { 661 if (res == 1) { 662 resp = 663 OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, 664 NULL); 665 send_ocsp_response(cbio, resp); 666 } 667 goto done_resp; 668 } 669 } 670 671 if (req == NULL 672 && (signfile != NULL || reqout != NULL 673 || host != NULL || add_nonce || ridx_filename != NULL)) { 674 BIO_printf(bio_err, "Need an OCSP request for this operation!\n"); 675 goto end; 676 } 677 678 if (req != NULL && add_nonce) { 679 if (!OCSP_request_add1_nonce(req, NULL, -1)) 680 goto end; 681 } 682 683 if (signfile != NULL) { 684 if (keyfile == NULL) 685 keyfile = signfile; 686 signer = load_cert(signfile, FORMAT_UNDEF, "signer certificate"); 687 if (signer == NULL) { 688 BIO_printf(bio_err, "Error loading signer certificate\n"); 689 goto end; 690 } 691 if (sign_certfile != NULL) { 692 if (!load_certs(sign_certfile, 0, &sign_other, NULL, 693 "signer certificates")) 694 goto end; 695 } 696 key = load_key(keyfile, FORMAT_UNDEF, 0, NULL, NULL, 697 "signer private key"); 698 if (key == NULL) 699 goto end; 700 701 if (!OCSP_request_sign(req, signer, key, NULL, 702 sign_other, sign_flags)) { 703 BIO_printf(bio_err, "Error signing OCSP request\n"); 704 goto end; 705 } 706 } 707 708 out = bio_open_default(outfile, 'w', FORMAT_TEXT); 709 if (out == NULL) 710 goto end; 711 712 if (req_text && req != NULL) 713 OCSP_REQUEST_print(out, req, 0); 714 715 if (reqout != NULL) { 716 derbio = bio_open_default(reqout, 'w', FORMAT_ASN1); 717 if (derbio == NULL) 718 goto end; 719 i2d_OCSP_REQUEST_bio(derbio, req); 720 BIO_free(derbio); 721 } 722 723 if (rdb != NULL) { 724 make_ocsp_response(bio_err, &resp, req, rdb, rca_certs, rsigner, rkey, 725 rsign_md, rsign_sigopts, rother, rflags, nmin, ndays, 726 badsig, resp_certid_md); 727 if (resp == NULL) 728 goto end; 729 if (cbio != NULL) 730 send_ocsp_response(cbio, resp); 731 } else if (host != NULL) { 732 #ifndef OPENSSL_NO_SOCK 733 resp = process_responder(req, host, port, path, opt_proxy, opt_no_proxy, 734 use_ssl, headers, req_timeout); 735 if (resp == NULL) 736 goto end; 737 #else 738 BIO_printf(bio_err, 739 "Error creating connect BIO - sockets not supported\n"); 740 goto end; 741 #endif 742 } else if (respin != NULL) { 743 derbio = bio_open_default(respin, 'r', FORMAT_ASN1); 744 if (derbio == NULL) 745 goto end; 746 resp = d2i_OCSP_RESPONSE_bio(derbio, NULL); 747 BIO_free(derbio); 748 if (resp == NULL) { 749 BIO_printf(bio_err, "Error reading OCSP response\n"); 750 goto end; 751 } 752 } else { 753 ret = 0; 754 goto end; 755 } 756 757 done_resp: 758 759 if (respout != NULL) { 760 derbio = bio_open_default(respout, 'w', FORMAT_ASN1); 761 if (derbio == NULL) 762 goto end; 763 i2d_OCSP_RESPONSE_bio(derbio, resp); 764 BIO_free(derbio); 765 } 766 767 i = OCSP_response_status(resp); 768 if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL) { 769 BIO_printf(out, "Responder Error: %s (%d)\n", 770 OCSP_response_status_str(i), i); 771 if (!ignore_err) 772 goto end; 773 } 774 775 if (resp_text) 776 OCSP_RESPONSE_print(out, resp, 0); 777 778 /* If running as responder don't verify our own response */ 779 if (cbio != NULL) { 780 /* If not unlimited, see if we took all we should. */ 781 if (accept_count != -1 && --accept_count <= 0) { 782 ret = 0; 783 goto end; 784 } 785 BIO_free_all(cbio); 786 cbio = NULL; 787 OCSP_REQUEST_free(req); 788 req = NULL; 789 OCSP_RESPONSE_free(resp); 790 resp = NULL; 791 goto redo_accept; 792 } 793 if (ridx_filename != NULL) { 794 ret = 0; 795 goto end; 796 } 797 798 if (store == NULL) { 799 store = setup_verify(CAfile, noCAfile, CApath, noCApath, 800 CAstore, noCAstore); 801 if (!store) 802 goto end; 803 } 804 if (vpmtouched) 805 X509_STORE_set1_param(store, vpm); 806 if (verify_certfile != NULL) { 807 if (!load_certs(verify_certfile, 0, &verify_other, NULL, 808 "validator certificates")) 809 goto end; 810 } 811 812 bs = OCSP_response_get1_basic(resp); 813 if (bs == NULL) { 814 BIO_printf(bio_err, "Error parsing response\n"); 815 goto end; 816 } 817 818 ret = 0; 819 820 if (!noverify) { 821 if (req != NULL && ((i = OCSP_check_nonce(req, bs)) <= 0)) { 822 if (i == -1) 823 BIO_printf(bio_err, "WARNING: no nonce in response\n"); 824 else { 825 BIO_printf(bio_err, "Nonce Verify error\n"); 826 ret = 1; 827 goto end; 828 } 829 } 830 831 i = OCSP_basic_verify(bs, verify_other, store, verify_flags); 832 if (i <= 0 && issuers) { 833 i = OCSP_basic_verify(bs, issuers, store, OCSP_TRUSTOTHER); 834 if (i > 0) 835 ERR_clear_error(); 836 } 837 if (i <= 0) { 838 BIO_printf(bio_err, "Response Verify Failure\n"); 839 ERR_print_errors(bio_err); 840 ret = 1; 841 } else { 842 BIO_printf(bio_err, "Response verify OK\n"); 843 } 844 } 845 846 if (!print_ocsp_summary(out, bs, req, reqnames, ids, nsec, maxage)) 847 ret = 1; 848 849 end: 850 ERR_print_errors(bio_err); 851 X509_free(signer); 852 X509_STORE_free(store); 853 X509_VERIFY_PARAM_free(vpm); 854 sk_OPENSSL_STRING_free(rsign_sigopts); 855 EVP_PKEY_free(key); 856 EVP_PKEY_free(rkey); 857 EVP_MD_free(cert_id_md); 858 EVP_MD_free(rsign_md); 859 EVP_MD_free(resp_certid_md); 860 X509_free(cert); 861 OSSL_STACK_OF_X509_free(issuers); 862 X509_free(rsigner); 863 OSSL_STACK_OF_X509_free(rca_certs); 864 free_index(rdb); 865 BIO_free_all(cbio); 866 BIO_free_all(acbio); 867 BIO_free_all(out); 868 OCSP_REQUEST_free(req); 869 OCSP_RESPONSE_free(resp); 870 OCSP_BASICRESP_free(bs); 871 sk_OPENSSL_STRING_free(reqnames); 872 sk_OCSP_CERTID_free(ids); 873 OSSL_STACK_OF_X509_free(sign_other); 874 OSSL_STACK_OF_X509_free(verify_other); 875 sk_CONF_VALUE_pop_free(headers, X509V3_conf_free); 876 OPENSSL_free(thost); 877 OPENSSL_free(tport); 878 OPENSSL_free(tpath); 879 880 return ret; 881 } 882 883 #ifdef HTTP_DAEMON 884 885 static int index_changed(CA_DB *rdb) 886 { 887 struct stat sb; 888 889 if (rdb != NULL && stat(rdb->dbfname, &sb) != -1) { 890 if (rdb->dbst.st_mtime != sb.st_mtime 891 || rdb->dbst.st_ctime != sb.st_ctime 892 || rdb->dbst.st_ino != sb.st_ino 893 || rdb->dbst.st_dev != sb.st_dev) { 894 syslog(LOG_INFO, "index file changed, reloading"); 895 return 1; 896 } 897 } 898 return 0; 899 } 900 901 #endif 902 903 static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert, 904 const EVP_MD *cert_id_md, X509 *issuer, 905 STACK_OF(OCSP_CERTID) *ids) 906 { 907 OCSP_CERTID *id; 908 909 if (issuer == NULL) { 910 BIO_printf(bio_err, "No issuer certificate specified\n"); 911 return 0; 912 } 913 if (*req == NULL) 914 *req = OCSP_REQUEST_new(); 915 if (*req == NULL) 916 goto err; 917 id = OCSP_cert_to_id(cert_id_md, cert, issuer); 918 if (id == NULL || !sk_OCSP_CERTID_push(ids, id)) 919 goto err; 920 if (!OCSP_request_add0_id(*req, id)) 921 goto err; 922 return 1; 923 924 err: 925 BIO_printf(bio_err, "Error Creating OCSP request\n"); 926 return 0; 927 } 928 929 static int add_ocsp_serial(OCSP_REQUEST **req, char *serial, 930 const EVP_MD *cert_id_md, X509 *issuer, 931 STACK_OF(OCSP_CERTID) *ids) 932 { 933 OCSP_CERTID *id; 934 const X509_NAME *iname; 935 ASN1_BIT_STRING *ikey; 936 ASN1_INTEGER *sno; 937 938 if (issuer == NULL) { 939 BIO_printf(bio_err, "No issuer certificate specified\n"); 940 return 0; 941 } 942 if (*req == NULL) 943 *req = OCSP_REQUEST_new(); 944 if (*req == NULL) 945 goto err; 946 iname = X509_get_subject_name(issuer); 947 ikey = X509_get0_pubkey_bitstr(issuer); 948 sno = s2i_ASN1_INTEGER(NULL, serial); 949 if (sno == NULL) { 950 BIO_printf(bio_err, "Error converting serial number %s\n", serial); 951 return 0; 952 } 953 id = OCSP_cert_id_new(cert_id_md, iname, ikey, sno); 954 ASN1_INTEGER_free(sno); 955 if (id == NULL || !sk_OCSP_CERTID_push(ids, id)) 956 goto err; 957 if (!OCSP_request_add0_id(*req, id)) 958 goto err; 959 return 1; 960 961 err: 962 BIO_printf(bio_err, "Error Creating OCSP request\n"); 963 return 0; 964 } 965 966 static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req, 967 STACK_OF(OPENSSL_STRING) *names, 968 STACK_OF(OCSP_CERTID) *ids, long nsec, 969 long maxage) 970 { 971 OCSP_CERTID *id; 972 const char *name; 973 int i, status, reason; 974 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd; 975 int ret = 1; 976 977 if (req == NULL || !sk_OPENSSL_STRING_num(names)) 978 return 1; 979 980 if (bs == NULL || !sk_OCSP_CERTID_num(ids)) 981 return 0; 982 983 for (i = 0; i < sk_OCSP_CERTID_num(ids); i++) { 984 id = sk_OCSP_CERTID_value(ids, i); 985 name = sk_OPENSSL_STRING_value(names, i); 986 BIO_printf(out, "%s: ", name); 987 988 if (!OCSP_resp_find_status(bs, id, &status, &reason, 989 &rev, &thisupd, &nextupd)) { 990 BIO_puts(out, "ERROR: No Status found.\n"); 991 ret = 0; 992 continue; 993 } 994 995 /* 996 * Check validity: if invalid write to output BIO so we know which 997 * response this refers to. 998 */ 999 if (!OCSP_check_validity(thisupd, nextupd, nsec, maxage)) { 1000 BIO_puts(out, "WARNING: Status times invalid.\n"); 1001 ERR_print_errors(out); 1002 } 1003 BIO_printf(out, "%s\n", OCSP_cert_status_str(status)); 1004 1005 BIO_puts(out, "\tThis Update: "); 1006 ASN1_GENERALIZEDTIME_print(out, thisupd); 1007 BIO_puts(out, "\n"); 1008 1009 if (nextupd) { 1010 BIO_puts(out, "\tNext Update: "); 1011 ASN1_GENERALIZEDTIME_print(out, nextupd); 1012 BIO_puts(out, "\n"); 1013 } 1014 1015 if (status != V_OCSP_CERTSTATUS_REVOKED) 1016 continue; 1017 1018 if (reason != -1) 1019 BIO_printf(out, "\tReason: %s\n", OCSP_crl_reason_str(reason)); 1020 1021 BIO_puts(out, "\tRevocation Time: "); 1022 ASN1_GENERALIZEDTIME_print(out, rev); 1023 BIO_puts(out, "\n"); 1024 } 1025 return ret; 1026 } 1027 1028 static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req, 1029 CA_DB *db, STACK_OF(X509) *ca, X509 *rcert, 1030 EVP_PKEY *rkey, const EVP_MD *rmd, 1031 STACK_OF(OPENSSL_STRING) *sigopts, 1032 STACK_OF(X509) *rother, unsigned long flags, 1033 int nmin, int ndays, int badsig, 1034 const EVP_MD *resp_md) 1035 { 1036 ASN1_TIME *thisupd = NULL, *nextupd = NULL; 1037 OCSP_CERTID *cid; 1038 OCSP_BASICRESP *bs = NULL; 1039 int i, id_count; 1040 EVP_MD_CTX *mctx = NULL; 1041 EVP_PKEY_CTX *pkctx = NULL; 1042 1043 id_count = OCSP_request_onereq_count(req); 1044 1045 if (id_count <= 0) { 1046 *resp = 1047 OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL); 1048 goto end; 1049 } 1050 1051 bs = OCSP_BASICRESP_new(); 1052 if (bs == NULL) { 1053 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, bs); 1054 goto end; 1055 } 1056 thisupd = X509_gmtime_adj(NULL, 0); 1057 if (ndays != -1) 1058 nextupd = X509_time_adj_ex(NULL, ndays, nmin * 60, NULL); 1059 1060 /* Examine each certificate id in the request */ 1061 for (i = 0; i < id_count; i++) { 1062 OCSP_ONEREQ *one; 1063 ASN1_INTEGER *serial; 1064 char **inf; 1065 int jj; 1066 int found = 0; 1067 ASN1_OBJECT *cert_id_md_oid; 1068 const EVP_MD *cert_id_md; 1069 OCSP_CERTID *cid_resp_md = NULL; 1070 1071 one = OCSP_request_onereq_get0(req, i); 1072 cid = OCSP_onereq_get0_id(one); 1073 1074 OCSP_id_get0_info(NULL, &cert_id_md_oid, NULL, NULL, cid); 1075 1076 cert_id_md = EVP_get_digestbyobj(cert_id_md_oid); 1077 if (cert_id_md == NULL) { 1078 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, 1079 NULL); 1080 goto end; 1081 } 1082 for (jj = 0; jj < sk_X509_num(ca) && !found; jj++) { 1083 X509 *ca_cert = sk_X509_value(ca, jj); 1084 OCSP_CERTID *ca_id = OCSP_cert_to_id(cert_id_md, NULL, ca_cert); 1085 1086 if (OCSP_id_issuer_cmp(ca_id, cid) == 0) { 1087 found = 1; 1088 if (resp_md != NULL) 1089 cid_resp_md = OCSP_cert_to_id(resp_md, NULL, ca_cert); 1090 } 1091 OCSP_CERTID_free(ca_id); 1092 } 1093 OCSP_id_get0_info(NULL, NULL, NULL, &serial, cid); 1094 inf = lookup_serial(db, serial); 1095 1096 /* at this point, we can have cid be an alias of cid_resp_md */ 1097 cid = (cid_resp_md != NULL) ? cid_resp_md : cid; 1098 1099 if (!found) { 1100 OCSP_basic_add1_status(bs, cid, 1101 V_OCSP_CERTSTATUS_UNKNOWN, 1102 0, NULL, thisupd, nextupd); 1103 continue; 1104 } 1105 if (inf == NULL) { 1106 OCSP_basic_add1_status(bs, cid, 1107 V_OCSP_CERTSTATUS_UNKNOWN, 1108 0, NULL, thisupd, nextupd); 1109 } else if (inf[DB_type][0] == DB_TYPE_VAL) { 1110 OCSP_basic_add1_status(bs, cid, 1111 V_OCSP_CERTSTATUS_GOOD, 1112 0, NULL, thisupd, nextupd); 1113 } else if (inf[DB_type][0] == DB_TYPE_REV) { 1114 ASN1_OBJECT *inst = NULL; 1115 ASN1_TIME *revtm = NULL; 1116 ASN1_GENERALIZEDTIME *invtm = NULL; 1117 OCSP_SINGLERESP *single; 1118 int reason = -1; 1119 1120 unpack_revinfo(&revtm, &reason, &inst, &invtm, inf[DB_rev_date]); 1121 single = OCSP_basic_add1_status(bs, cid, 1122 V_OCSP_CERTSTATUS_REVOKED, 1123 reason, revtm, thisupd, nextupd); 1124 if (single == NULL) { 1125 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, 1126 NULL); 1127 goto end; 1128 } 1129 if (invtm != NULL) 1130 OCSP_SINGLERESP_add1_ext_i2d(single, NID_invalidity_date, 1131 invtm, 0, 0); 1132 else if (inst != NULL) 1133 OCSP_SINGLERESP_add1_ext_i2d(single, 1134 NID_hold_instruction_code, inst, 1135 0, 0); 1136 ASN1_OBJECT_free(inst); 1137 ASN1_TIME_free(revtm); 1138 ASN1_GENERALIZEDTIME_free(invtm); 1139 } 1140 OCSP_CERTID_free(cid_resp_md); 1141 } 1142 1143 OCSP_copy_nonce(bs, req); 1144 1145 mctx = EVP_MD_CTX_new(); 1146 if (mctx == NULL || !EVP_DigestSignInit(mctx, &pkctx, rmd, NULL, rkey)) { 1147 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, NULL); 1148 goto end; 1149 } 1150 for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) { 1151 char *sigopt = sk_OPENSSL_STRING_value(sigopts, i); 1152 1153 if (pkey_ctrl_string(pkctx, sigopt) <= 0) { 1154 BIO_printf(err, "parameter error \"%s\"\n", sigopt); 1155 ERR_print_errors(bio_err); 1156 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, 1157 NULL); 1158 goto end; 1159 } 1160 } 1161 if (!OCSP_basic_sign_ctx(bs, rcert, mctx, rother, flags)) { 1162 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, bs); 1163 goto end; 1164 } 1165 1166 if (badsig) { 1167 const ASN1_OCTET_STRING *sig = OCSP_resp_get0_signature(bs); 1168 corrupt_signature(sig); 1169 } 1170 1171 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_SUCCESSFUL, bs); 1172 1173 end: 1174 EVP_MD_CTX_free(mctx); 1175 ASN1_TIME_free(thisupd); 1176 ASN1_TIME_free(nextupd); 1177 OCSP_BASICRESP_free(bs); 1178 } 1179 1180 static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser) 1181 { 1182 int i; 1183 BIGNUM *bn = NULL; 1184 char *itmp, *row[DB_NUMBER], **rrow; 1185 for (i = 0; i < DB_NUMBER; i++) 1186 row[i] = NULL; 1187 bn = ASN1_INTEGER_to_BN(ser, NULL); 1188 OPENSSL_assert(bn); /* FIXME: should report an error at this 1189 * point and abort */ 1190 if (BN_is_zero(bn)) { 1191 itmp = OPENSSL_strdup("00"); 1192 OPENSSL_assert(itmp); 1193 } else { 1194 itmp = BN_bn2hex(bn); 1195 } 1196 row[DB_serial] = itmp; 1197 BN_free(bn); 1198 rrow = TXT_DB_get_by_index(db->db, DB_serial, row); 1199 OPENSSL_free(itmp); 1200 return rrow; 1201 } 1202 1203 static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio, 1204 int timeout) 1205 { 1206 #ifndef OPENSSL_NO_SOCK 1207 return http_server_get_asn1_req(ASN1_ITEM_rptr(OCSP_REQUEST), 1208 (ASN1_VALUE **)preq, NULL, pcbio, acbio, 1209 NULL /* found_keep_alive */, 1210 prog, 1 /* accept_get */, timeout); 1211 #else 1212 BIO_printf(bio_err, 1213 "Error getting OCSP request - sockets not supported\n"); 1214 *preq = NULL; 1215 return 0; 1216 #endif 1217 } 1218 1219 static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp) 1220 { 1221 #ifndef OPENSSL_NO_SOCK 1222 return http_server_send_asn1_resp(prog, cbio, 1223 0 /* no keep-alive */, 1224 "application/ocsp-response", 1225 ASN1_ITEM_rptr(OCSP_RESPONSE), 1226 (const ASN1_VALUE *)resp); 1227 #else 1228 BIO_printf(bio_err, 1229 "Error sending OCSP response - sockets not supported\n"); 1230 return 0; 1231 #endif 1232 } 1233 1234 #ifndef OPENSSL_NO_SOCK 1235 OCSP_RESPONSE *process_responder(OCSP_REQUEST *req, const char *host, 1236 const char *port, const char *path, 1237 const char *proxy, const char *no_proxy, 1238 int use_ssl, STACK_OF(CONF_VALUE) *headers, 1239 int req_timeout) 1240 { 1241 SSL_CTX *ctx = NULL; 1242 OCSP_RESPONSE *resp = NULL; 1243 1244 if (use_ssl == 1) { 1245 ctx = SSL_CTX_new(TLS_client_method()); 1246 if (ctx == NULL) { 1247 BIO_printf(bio_err, "Error creating SSL context.\n"); 1248 goto end; 1249 } 1250 } 1251 1252 resp = (OCSP_RESPONSE *) 1253 app_http_post_asn1(host, port, path, proxy, no_proxy, 1254 ctx, headers, "application/ocsp-request", 1255 (ASN1_VALUE *)req, ASN1_ITEM_rptr(OCSP_REQUEST), 1256 "application/ocsp-response", 1257 req_timeout, ASN1_ITEM_rptr(OCSP_RESPONSE)); 1258 1259 if (resp == NULL) 1260 BIO_printf(bio_err, "Error querying OCSP responder\n"); 1261 1262 end: 1263 SSL_CTX_free(ctx); 1264 return resp; 1265 } 1266 #endif 1267