1 /* 2 * Copyright 2001-2026 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <openssl/opensslconf.h> 11 12 #ifdef OPENSSL_SYS_VMS 13 /* So fd_set and friends get properly defined on OpenVMS */ 14 #define _XOPEN_SOURCE_EXTENDED 15 #endif 16 17 #include <stdio.h> 18 #include <stdlib.h> 19 #include <string.h> 20 #include <time.h> 21 #include <ctype.h> 22 23 /* Needs to be included before the openssl headers */ 24 #include "apps.h" 25 #include "http_server.h" 26 #include "progs.h" 27 #include "internal/sockets.h" 28 #include <openssl/e_os2.h> 29 #include <openssl/crypto.h> 30 #include <openssl/err.h> 31 #include <openssl/ssl.h> 32 #include <openssl/evp.h> 33 #include <openssl/bn.h> 34 #include <openssl/x509v3.h> 35 36 #if defined(OPENSSL_SYS_VXWORKS) 37 /* not supported */ 38 int setpgid(pid_t pid, pid_t pgid) 39 { 40 errno = ENOSYS; 41 return 0; 42 } 43 /* not supported */ 44 pid_t fork(void) 45 { 46 errno = ENOSYS; 47 return (pid_t)-1; 48 } 49 #endif 50 /* Maximum leeway in validity period: default 5 minutes */ 51 #define MAX_VALIDITY_PERIOD (5 * 60) 52 53 static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert, 54 const EVP_MD *cert_id_md, X509 *issuer, 55 STACK_OF(OCSP_CERTID) *ids); 56 static int add_ocsp_serial(OCSP_REQUEST **req, char *serial, 57 const EVP_MD *cert_id_md, X509 *issuer, 58 STACK_OF(OCSP_CERTID) *ids); 59 static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req, 60 STACK_OF(OPENSSL_STRING) *names, 61 STACK_OF(OCSP_CERTID) *ids, long nsec, 62 long maxage); 63 static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req, 64 CA_DB *db, STACK_OF(X509) *ca, X509 *rcert, 65 EVP_PKEY *rkey, const EVP_MD *md, 66 STACK_OF(OPENSSL_STRING) *sigopts, 67 STACK_OF(X509) *rother, unsigned long flags, 68 int nmin, int ndays, int badsig, 69 const EVP_MD *resp_md); 70 71 static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser); 72 static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio, 73 int timeout); 74 static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp); 75 static char *prog; 76 77 #ifdef HTTP_DAEMON 78 static int index_changed(CA_DB *); 79 #endif 80 81 typedef enum OPTION_choice { 82 OPT_COMMON, 83 OPT_OUTFILE, 84 OPT_TIMEOUT, 85 OPT_URL, 86 OPT_HOST, 87 OPT_PORT, 88 #ifndef OPENSSL_NO_SOCK 89 OPT_PROXY, 90 OPT_NO_PROXY, 91 #endif 92 OPT_IGNORE_ERR, 93 OPT_NOVERIFY, 94 OPT_NONCE, 95 OPT_NO_NONCE, 96 OPT_RESP_NO_CERTS, 97 OPT_RESP_KEY_ID, 98 OPT_NO_CERTS, 99 OPT_NO_SIGNATURE_VERIFY, 100 OPT_NO_CERT_VERIFY, 101 OPT_NO_CHAIN, 102 OPT_NO_CERT_CHECKS, 103 OPT_NO_EXPLICIT, 104 OPT_TRUST_OTHER, 105 OPT_NO_INTERN, 106 OPT_BADSIG, 107 OPT_TEXT, 108 OPT_REQ_TEXT, 109 OPT_RESP_TEXT, 110 OPT_REQIN, 111 OPT_RESPIN, 112 OPT_SIGNER, 113 OPT_VAFILE, 114 OPT_SIGN_OTHER, 115 OPT_VERIFY_OTHER, 116 OPT_CAFILE, 117 OPT_CAPATH, 118 OPT_CASTORE, 119 OPT_NOCAFILE, 120 OPT_NOCAPATH, 121 OPT_NOCASTORE, 122 OPT_VALIDITY_PERIOD, 123 OPT_STATUS_AGE, 124 OPT_SIGNKEY, 125 OPT_REQOUT, 126 OPT_RESPOUT, 127 OPT_PATH, 128 OPT_ISSUER, 129 OPT_CERT, 130 OPT_SERIAL, 131 OPT_INDEX, 132 OPT_CA, 133 OPT_NMIN, 134 OPT_REQUEST, 135 OPT_NDAYS, 136 OPT_RSIGNER, 137 OPT_RKEY, 138 OPT_ROTHER, 139 OPT_RMD, 140 OPT_RSIGOPT, 141 OPT_HEADER, 142 OPT_PASSIN, 143 OPT_RCID, 144 OPT_V_ENUM, 145 OPT_MD, 146 OPT_MULTI, 147 OPT_PROV_ENUM 148 } OPTION_CHOICE; 149 150 const OPTIONS ocsp_options[] = { 151 OPT_SECTION("General"), 152 { "help", OPT_HELP, '-', "Display this summary" }, 153 { "ignore_err", OPT_IGNORE_ERR, '-', 154 "Ignore error on OCSP request or response and continue running" }, 155 { "CAfile", OPT_CAFILE, '<', "Trusted certificates file" }, 156 { "CApath", OPT_CAPATH, '<', "Trusted certificates directory" }, 157 { "CAstore", OPT_CASTORE, ':', "Trusted certificates store URI" }, 158 { "no-CAfile", OPT_NOCAFILE, '-', 159 "Do not load the default certificates file" }, 160 { "no-CApath", OPT_NOCAPATH, '-', 161 "Do not load certificates from the default certificates directory" }, 162 { "no-CAstore", OPT_NOCASTORE, '-', 163 "Do not load certificates from the default certificates store" }, 164 165 OPT_SECTION("Responder"), 166 { "timeout", OPT_TIMEOUT, 'p', 167 "Connection timeout (in seconds) to the OCSP responder" }, 168 { "resp_no_certs", OPT_RESP_NO_CERTS, '-', 169 "Don't include any certificates in response" }, 170 #ifdef HTTP_DAEMON 171 { "multi", OPT_MULTI, 'p', "run multiple responder processes" }, 172 #endif 173 { "no_certs", OPT_NO_CERTS, '-', 174 "Don't include any certificates in signed request" }, 175 { "badsig", OPT_BADSIG, '-', 176 "Corrupt last byte of loaded OCSP response signature (for test)" }, 177 { "CA", OPT_CA, '<', "CA certificates" }, 178 { "nmin", OPT_NMIN, 'p', "Number of minutes before next update" }, 179 { "nrequest", OPT_REQUEST, 'p', 180 "Number of requests to accept (default unlimited)" }, 181 { "reqin", OPT_REQIN, 's', "File with the DER-encoded request" }, 182 { "signer", OPT_SIGNER, '<', "Certificate to sign OCSP request with" }, 183 { "sign_other", OPT_SIGN_OTHER, '<', 184 "Additional certificates to include in signed request" }, 185 { "index", OPT_INDEX, '<', "Certificate status index file" }, 186 { "ndays", OPT_NDAYS, 'p', "Number of days before next update" }, 187 { "rsigner", OPT_RSIGNER, '<', 188 "Responder certificate to sign responses with" }, 189 { "rkey", OPT_RKEY, '<', "Responder key to sign responses with" }, 190 { "passin", OPT_PASSIN, 's', "Responder key pass phrase source" }, 191 { "rother", OPT_ROTHER, '<', "Other certificates to include in response" }, 192 { "rmd", OPT_RMD, 's', "Digest Algorithm to use in signature of OCSP response" }, 193 { "rsigopt", OPT_RSIGOPT, 's', "OCSP response signature parameter in n:v form" }, 194 { "header", OPT_HEADER, 's', "key=value header to add" }, 195 { "rcid", OPT_RCID, 's', "Use specified algorithm for cert id in response" }, 196 { "", OPT_MD, '-', "Any supported digest algorithm (sha1,sha256, ... )" }, 197 198 OPT_SECTION("Client"), 199 { "url", OPT_URL, 's', "Responder URL" }, 200 { "host", OPT_HOST, 's', "TCP/IP hostname:port to connect to" }, 201 { "port", OPT_PORT, 'N', "Port to run responder on" }, 202 { "path", OPT_PATH, 's', "Path to use in OCSP request" }, 203 #ifndef OPENSSL_NO_SOCK 204 { "proxy", OPT_PROXY, 's', 205 "[http[s]://]host[:port][/path] of HTTP(S) proxy to use; path is ignored" }, 206 { "no_proxy", OPT_NO_PROXY, 's', 207 "List of addresses of servers not to use HTTP(S) proxy for" }, 208 { OPT_MORE_STR, 0, 0, 209 "Default from environment variable 'no_proxy', else 'NO_PROXY', else none" }, 210 #endif 211 { "out", OPT_OUTFILE, '>', "Output filename" }, 212 { "noverify", OPT_NOVERIFY, '-', "Don't verify response at all" }, 213 { "nonce", OPT_NONCE, '-', "Add OCSP nonce to request" }, 214 { "no_nonce", OPT_NO_NONCE, '-', "Don't add OCSP nonce to request" }, 215 { "no_signature_verify", OPT_NO_SIGNATURE_VERIFY, '-', 216 "Don't check signature on response" }, 217 { "resp_key_id", OPT_RESP_KEY_ID, '-', 218 "Identify response by signing certificate key ID" }, 219 { "no_cert_verify", OPT_NO_CERT_VERIFY, '-', 220 "Don't check signing certificate" }, 221 { "text", OPT_TEXT, '-', "Print text form of request and response" }, 222 { "req_text", OPT_REQ_TEXT, '-', "Print text form of request" }, 223 { "resp_text", OPT_RESP_TEXT, '-', "Print text form of response" }, 224 { "no_chain", OPT_NO_CHAIN, '-', "Don't chain verify response" }, 225 { "no_cert_checks", OPT_NO_CERT_CHECKS, '-', 226 "Don't do additional checks on signing certificate" }, 227 { "no_explicit", OPT_NO_EXPLICIT, '-', 228 "Do not explicitly check the chain, just verify the root" }, 229 { "trust_other", OPT_TRUST_OTHER, '-', 230 "Don't verify additional certificates" }, 231 { "no_intern", OPT_NO_INTERN, '-', 232 "Don't search certificates contained in response for signer" }, 233 { "respin", OPT_RESPIN, 's', "File with the DER-encoded response" }, 234 { "VAfile", OPT_VAFILE, '<', "Validator certificates file" }, 235 { "verify_other", OPT_VERIFY_OTHER, '<', 236 "Additional certificates to search for signer" }, 237 { "cert", OPT_CERT, '<', 238 "Certificate to check; may be given multiple times" }, 239 { "serial", OPT_SERIAL, 's', 240 "Serial number to check; may be given multiple times" }, 241 { "validity_period", OPT_VALIDITY_PERIOD, 'u', 242 "Maximum validity discrepancy in seconds" }, 243 { "signkey", OPT_SIGNKEY, 's', "Private key to sign OCSP request with" }, 244 { "reqout", OPT_REQOUT, 's', "Output file for the DER-encoded request" }, 245 { "respout", OPT_RESPOUT, 's', "Output file for the DER-encoded response" }, 246 { "issuer", OPT_ISSUER, '<', "Issuer certificate" }, 247 { "status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds" }, 248 249 OPT_V_OPTIONS, 250 OPT_PROV_OPTIONS, 251 { NULL } 252 }; 253 254 int ocsp_main(int argc, char **argv) 255 { 256 BIO *acbio = NULL, *cbio = NULL, *derbio = NULL, *out = NULL; 257 EVP_MD *cert_id_md = NULL, *rsign_md = NULL; 258 STACK_OF(OPENSSL_STRING) *rsign_sigopts = NULL; 259 int trailing_md = 0; 260 CA_DB *rdb = NULL; 261 EVP_PKEY *key = NULL, *rkey = NULL; 262 OCSP_BASICRESP *bs = NULL; 263 OCSP_REQUEST *req = NULL; 264 OCSP_RESPONSE *resp = NULL; 265 STACK_OF(CONF_VALUE) *headers = NULL; 266 STACK_OF(OCSP_CERTID) *ids = NULL; 267 STACK_OF(OPENSSL_STRING) *reqnames = NULL; 268 STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL; 269 STACK_OF(X509) *issuers = NULL; 270 X509 *issuer = NULL, *cert = NULL; 271 STACK_OF(X509) *rca_certs = NULL; 272 EVP_MD *resp_certid_md = NULL; 273 X509 *signer = NULL, *rsigner = NULL; 274 X509_STORE *store = NULL; 275 X509_VERIFY_PARAM *vpm = NULL; 276 const char *CAfile = NULL, *CApath = NULL, *CAstore = NULL; 277 char *header, *value, *respdigname = NULL; 278 char *host = NULL, *port = NULL, *path = "/", *outfile = NULL; 279 #ifndef OPENSSL_NO_SOCK 280 char *opt_proxy = NULL; 281 char *opt_no_proxy = NULL; 282 #endif 283 char *rca_filename = NULL, *reqin = NULL, *respin = NULL; 284 char *reqout = NULL, *respout = NULL, *ridx_filename = NULL; 285 char *rsignfile = NULL, *rkeyfile = NULL; 286 char *passinarg = NULL, *passin = NULL; 287 char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL; 288 char *signfile = NULL, *keyfile = NULL; 289 char *thost = NULL, *tport = NULL, *tpath = NULL; 290 int noCAfile = 0, noCApath = 0, noCAstore = 0; 291 int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1; 292 int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1; 293 int req_text = 0, resp_text = 0, res, ret = 1; 294 int req_timeout = -1; 295 long nsec = MAX_VALIDITY_PERIOD, maxage = -1; 296 unsigned long sign_flags = 0, verify_flags = 0, rflags = 0; 297 OPTION_CHOICE o; 298 299 if ((reqnames = sk_OPENSSL_STRING_new_null()) == NULL 300 || (ids = sk_OCSP_CERTID_new_null()) == NULL 301 || (vpm = X509_VERIFY_PARAM_new()) == NULL) 302 goto end; 303 304 opt_set_unknown_name("digest"); 305 prog = opt_init(argc, argv, ocsp_options); 306 while ((o = opt_next()) != OPT_EOF) { 307 switch (o) { 308 case OPT_EOF: 309 case OPT_ERR: 310 opthelp: 311 BIO_printf(bio_err, "%s: Use -help for summary.\n", prog); 312 goto end; 313 case OPT_HELP: 314 ret = 0; 315 opt_help(ocsp_options); 316 goto end; 317 case OPT_OUTFILE: 318 outfile = opt_arg(); 319 break; 320 case OPT_TIMEOUT: 321 #ifndef OPENSSL_NO_SOCK 322 req_timeout = atoi(opt_arg()); 323 #endif 324 break; 325 case OPT_URL: 326 OPENSSL_free(thost); 327 OPENSSL_free(tport); 328 OPENSSL_free(tpath); 329 thost = tport = tpath = NULL; 330 if (!OSSL_HTTP_parse_url(opt_arg(), &use_ssl, NULL /* userinfo */, 331 &host, &port, NULL /* port_num */, 332 &path, NULL /* qry */, NULL /* frag */)) { 333 BIO_printf(bio_err, "%s Error parsing -url argument\n", prog); 334 goto end; 335 } 336 thost = host; 337 tport = port; 338 tpath = path; 339 break; 340 case OPT_HOST: 341 host = opt_arg(); 342 break; 343 case OPT_PORT: 344 port = opt_arg(); 345 break; 346 case OPT_PATH: 347 path = opt_arg(); 348 break; 349 #ifndef OPENSSL_NO_SOCK 350 case OPT_PROXY: 351 opt_proxy = opt_arg(); 352 break; 353 case OPT_NO_PROXY: 354 opt_no_proxy = opt_arg(); 355 break; 356 #endif 357 case OPT_IGNORE_ERR: 358 ignore_err = 1; 359 break; 360 case OPT_NOVERIFY: 361 noverify = 1; 362 break; 363 case OPT_NONCE: 364 add_nonce = 2; 365 break; 366 case OPT_NO_NONCE: 367 add_nonce = 0; 368 break; 369 case OPT_RESP_NO_CERTS: 370 rflags |= OCSP_NOCERTS; 371 break; 372 case OPT_RESP_KEY_ID: 373 rflags |= OCSP_RESPID_KEY; 374 break; 375 case OPT_NO_CERTS: 376 sign_flags |= OCSP_NOCERTS; 377 break; 378 case OPT_NO_SIGNATURE_VERIFY: 379 verify_flags |= OCSP_NOSIGS; 380 break; 381 case OPT_NO_CERT_VERIFY: 382 verify_flags |= OCSP_NOVERIFY; 383 break; 384 case OPT_NO_CHAIN: 385 verify_flags |= OCSP_NOCHAIN; 386 break; 387 case OPT_NO_CERT_CHECKS: 388 verify_flags |= OCSP_NOCHECKS; 389 break; 390 case OPT_NO_EXPLICIT: 391 verify_flags |= OCSP_NOEXPLICIT; 392 break; 393 case OPT_TRUST_OTHER: 394 verify_flags |= OCSP_TRUSTOTHER; 395 break; 396 case OPT_NO_INTERN: 397 verify_flags |= OCSP_NOINTERN; 398 break; 399 case OPT_BADSIG: 400 badsig = 1; 401 break; 402 case OPT_TEXT: 403 req_text = resp_text = 1; 404 break; 405 case OPT_REQ_TEXT: 406 req_text = 1; 407 break; 408 case OPT_RESP_TEXT: 409 resp_text = 1; 410 break; 411 case OPT_REQIN: 412 reqin = opt_arg(); 413 break; 414 case OPT_RESPIN: 415 respin = opt_arg(); 416 break; 417 case OPT_SIGNER: 418 signfile = opt_arg(); 419 break; 420 case OPT_VAFILE: 421 verify_certfile = opt_arg(); 422 verify_flags |= OCSP_TRUSTOTHER; 423 break; 424 case OPT_SIGN_OTHER: 425 sign_certfile = opt_arg(); 426 break; 427 case OPT_VERIFY_OTHER: 428 verify_certfile = opt_arg(); 429 break; 430 case OPT_CAFILE: 431 CAfile = opt_arg(); 432 break; 433 case OPT_CAPATH: 434 CApath = opt_arg(); 435 break; 436 case OPT_CASTORE: 437 CAstore = opt_arg(); 438 break; 439 case OPT_NOCAFILE: 440 noCAfile = 1; 441 break; 442 case OPT_NOCAPATH: 443 noCApath = 1; 444 break; 445 case OPT_NOCASTORE: 446 noCAstore = 1; 447 break; 448 case OPT_V_CASES: 449 if (!opt_verify(o, vpm)) 450 goto end; 451 vpmtouched++; 452 break; 453 case OPT_VALIDITY_PERIOD: 454 opt_long(opt_arg(), &nsec); 455 break; 456 case OPT_STATUS_AGE: 457 opt_long(opt_arg(), &maxage); 458 break; 459 case OPT_SIGNKEY: 460 keyfile = opt_arg(); 461 break; 462 case OPT_REQOUT: 463 reqout = opt_arg(); 464 break; 465 case OPT_RESPOUT: 466 respout = opt_arg(); 467 break; 468 case OPT_ISSUER: 469 issuer = load_cert(opt_arg(), FORMAT_UNDEF, "issuer certificate"); 470 if (issuer == NULL) 471 goto end; 472 if (issuers == NULL) { 473 if ((issuers = sk_X509_new_null()) == NULL) { 474 X509_free(issuer); 475 goto end; 476 } 477 } 478 if (!sk_X509_push(issuers, issuer)) { 479 X509_free(issuer); 480 goto end; 481 } 482 break; 483 case OPT_CERT: 484 reset_unknown(); 485 X509_free(cert); 486 cert = load_cert(opt_arg(), FORMAT_UNDEF, "certificate"); 487 if (cert == NULL) 488 goto end; 489 if (cert_id_md == NULL) 490 cert_id_md = (EVP_MD *)EVP_sha1(); 491 if (!add_ocsp_cert(&req, cert, cert_id_md, issuer, ids)) 492 goto end; 493 if (!sk_OPENSSL_STRING_push(reqnames, opt_arg())) 494 goto end; 495 trailing_md = 0; 496 break; 497 case OPT_SERIAL: 498 reset_unknown(); 499 if (cert_id_md == NULL) 500 cert_id_md = (EVP_MD *)EVP_sha1(); 501 if (!add_ocsp_serial(&req, opt_arg(), cert_id_md, issuer, ids)) 502 goto end; 503 if (!sk_OPENSSL_STRING_push(reqnames, opt_arg())) 504 goto end; 505 trailing_md = 0; 506 break; 507 case OPT_INDEX: 508 ridx_filename = opt_arg(); 509 break; 510 case OPT_CA: 511 rca_filename = opt_arg(); 512 break; 513 case OPT_NMIN: 514 nmin = opt_int_arg(); 515 if (ndays == -1) 516 ndays = 0; 517 break; 518 case OPT_REQUEST: 519 accept_count = opt_int_arg(); 520 break; 521 case OPT_NDAYS: 522 ndays = atoi(opt_arg()); 523 break; 524 case OPT_RSIGNER: 525 rsignfile = opt_arg(); 526 break; 527 case OPT_RKEY: 528 rkeyfile = opt_arg(); 529 break; 530 case OPT_PASSIN: 531 passinarg = opt_arg(); 532 break; 533 case OPT_ROTHER: 534 rcertfile = opt_arg(); 535 break; 536 case OPT_RMD: /* Response MessageDigest */ 537 respdigname = opt_arg(); 538 break; 539 case OPT_RSIGOPT: 540 if (rsign_sigopts == NULL) 541 rsign_sigopts = sk_OPENSSL_STRING_new_null(); 542 if (rsign_sigopts == NULL 543 || !sk_OPENSSL_STRING_push(rsign_sigopts, opt_arg())) 544 goto end; 545 break; 546 case OPT_HEADER: 547 header = opt_arg(); 548 value = strchr(header, '='); 549 if (value == NULL) { 550 BIO_printf(bio_err, "Missing = in header key=value\n"); 551 goto opthelp; 552 } 553 *value++ = '\0'; 554 if (!X509V3_add_value(header, value, &headers)) 555 goto end; 556 break; 557 case OPT_RCID: 558 if (!opt_md(opt_arg(), &resp_certid_md)) 559 goto opthelp; 560 break; 561 case OPT_MD: 562 if (trailing_md) { 563 BIO_printf(bio_err, 564 "%s: Digest must be before -cert or -serial\n", 565 prog); 566 goto opthelp; 567 } 568 if (!opt_md(opt_unknown(), &cert_id_md)) 569 goto opthelp; 570 trailing_md = 1; 571 break; 572 case OPT_MULTI: 573 #ifdef HTTP_DAEMON 574 n_responders = atoi(opt_arg()); 575 #endif 576 break; 577 case OPT_PROV_CASES: 578 if (!opt_provider(o)) 579 goto end; 580 break; 581 } 582 } 583 584 /* No extra arguments. */ 585 if (!opt_check_rest_arg(NULL)) 586 goto opthelp; 587 588 if (trailing_md) { 589 BIO_printf(bio_err, "%s: Digest must be before -cert or -serial\n", 590 prog); 591 goto opthelp; 592 } 593 594 if (respdigname != NULL) { 595 if (!opt_md(respdigname, &rsign_md)) 596 goto end; 597 } 598 599 /* Have we anything to do? */ 600 if (req == NULL && reqin == NULL 601 && respin == NULL && !(port != NULL && ridx_filename != NULL)) 602 goto opthelp; 603 604 if (req == NULL && (add_nonce != 2)) 605 add_nonce = 0; 606 607 if (req == NULL && reqin != NULL) { 608 derbio = bio_open_default(reqin, 'r', FORMAT_ASN1); 609 if (derbio == NULL) 610 goto end; 611 req = d2i_OCSP_REQUEST_bio(derbio, NULL); 612 BIO_free(derbio); 613 if (req == NULL) { 614 BIO_printf(bio_err, "Error reading OCSP request\n"); 615 goto end; 616 } 617 } 618 619 if (req == NULL && port != NULL) { 620 #ifndef OPENSSL_NO_SOCK 621 acbio = http_server_init(prog, port, -1); 622 if (acbio == NULL) 623 goto end; 624 #else 625 BIO_printf(bio_err, "Cannot act as server - sockets not supported\n"); 626 goto end; 627 #endif 628 } 629 630 if (rsignfile != NULL) { 631 if (rkeyfile == NULL) 632 rkeyfile = rsignfile; 633 rsigner = load_cert(rsignfile, FORMAT_UNDEF, "responder certificate"); 634 if (rsigner == NULL) { 635 BIO_printf(bio_err, "Error loading responder certificate\n"); 636 goto end; 637 } 638 if (!load_certs(rca_filename, 0, &rca_certs, NULL, "CA certificates")) 639 goto end; 640 if (rcertfile != NULL) { 641 if (!load_certs(rcertfile, 0, &rother, NULL, 642 "responder other certificates")) 643 goto end; 644 } 645 if (!app_passwd(passinarg, NULL, &passin, NULL)) { 646 BIO_printf(bio_err, "Error getting password\n"); 647 goto end; 648 } 649 rkey = load_key(rkeyfile, FORMAT_UNDEF, 0, passin, NULL, 650 "responder private key"); 651 if (rkey == NULL) 652 goto end; 653 } 654 655 if (ridx_filename != NULL 656 && (rkey == NULL || rsigner == NULL || rca_certs == NULL)) { 657 BIO_printf(bio_err, 658 "Responder mode requires certificate, key, and CA.\n"); 659 goto end; 660 } 661 662 if (ridx_filename != NULL) { 663 rdb = load_index(ridx_filename, NULL); 664 if (rdb == NULL || index_index(rdb) <= 0) { 665 BIO_printf(bio_err, 666 "Problem with index file: %s (could not load/parse file)\n", 667 ridx_filename); 668 ret = 1; 669 goto end; 670 } 671 } 672 673 #ifdef HTTP_DAEMON 674 if (n_responders != 0 && acbio != NULL) 675 spawn_loop(prog); 676 if (acbio != NULL && req_timeout > 0) 677 signal(SIGALRM, socket_timeout); 678 #endif 679 680 if (acbio != NULL) 681 trace_log_message(-1, prog, 682 LOG_INFO, "waiting for OCSP client connections..."); 683 684 redo_accept: 685 686 if (acbio != NULL) { 687 #ifdef HTTP_DAEMON 688 if (index_changed(rdb)) { 689 CA_DB *newrdb = load_index(ridx_filename, NULL); 690 691 if (newrdb != NULL && index_index(newrdb) > 0) { 692 free_index(rdb); 693 rdb = newrdb; 694 } else { 695 free_index(newrdb); 696 trace_log_message(-1, prog, 697 LOG_ERR, "error reloading updated index: %s", 698 ridx_filename); 699 } 700 } 701 #endif 702 703 req = NULL; 704 res = do_responder(&req, &cbio, acbio, req_timeout); 705 if (res == 0) 706 goto redo_accept; 707 708 if (req == NULL) { 709 if (res == 1) { 710 resp = OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, 711 NULL); 712 if (resp != NULL) 713 send_ocsp_response(cbio, resp); 714 } 715 goto done_resp; 716 } 717 } 718 719 if (req == NULL 720 && (signfile != NULL || reqout != NULL 721 || host != NULL || add_nonce || ridx_filename != NULL)) { 722 BIO_printf(bio_err, "Need an OCSP request for this operation!\n"); 723 goto end; 724 } 725 726 if (req != NULL && add_nonce) { 727 if (!OCSP_request_add1_nonce(req, NULL, -1)) 728 goto end; 729 } 730 731 if (signfile != NULL) { 732 if (keyfile == NULL) 733 keyfile = signfile; 734 signer = load_cert(signfile, FORMAT_UNDEF, "signer certificate"); 735 if (signer == NULL) { 736 BIO_printf(bio_err, "Error loading signer certificate\n"); 737 goto end; 738 } 739 if (sign_certfile != NULL) { 740 if (!load_certs(sign_certfile, 0, &sign_other, NULL, 741 "signer certificates")) 742 goto end; 743 } 744 key = load_key(keyfile, FORMAT_UNDEF, 0, NULL, NULL, 745 "signer private key"); 746 if (key == NULL) 747 goto end; 748 749 if (!OCSP_request_sign(req, signer, key, NULL, 750 sign_other, sign_flags)) { 751 BIO_printf(bio_err, "Error signing OCSP request\n"); 752 goto end; 753 } 754 } 755 756 out = bio_open_default(outfile, 'w', FORMAT_TEXT); 757 if (out == NULL) 758 goto end; 759 760 if (req_text && req != NULL) 761 OCSP_REQUEST_print(out, req, 0); 762 763 if (reqout != NULL) { 764 derbio = bio_open_default(reqout, 'w', FORMAT_ASN1); 765 if (derbio == NULL) 766 goto end; 767 i2d_OCSP_REQUEST_bio(derbio, req); 768 BIO_free(derbio); 769 } 770 771 if (rdb != NULL) { 772 make_ocsp_response(bio_err, &resp, req, rdb, rca_certs, rsigner, rkey, 773 rsign_md, rsign_sigopts, rother, rflags, nmin, ndays, 774 badsig, resp_certid_md); 775 if (resp == NULL) 776 goto end; 777 if (cbio != NULL) 778 send_ocsp_response(cbio, resp); 779 } else if (host != NULL) { 780 #ifndef OPENSSL_NO_SOCK 781 resp = process_responder(req, host, port, path, opt_proxy, opt_no_proxy, 782 use_ssl, headers, req_timeout); 783 if (resp == NULL) 784 goto end; 785 #else 786 BIO_printf(bio_err, 787 "Error creating connect BIO - sockets not supported\n"); 788 goto end; 789 #endif 790 } else if (respin != NULL) { 791 derbio = bio_open_default(respin, 'r', FORMAT_ASN1); 792 if (derbio == NULL) 793 goto end; 794 resp = d2i_OCSP_RESPONSE_bio(derbio, NULL); 795 BIO_free(derbio); 796 if (resp == NULL) { 797 BIO_printf(bio_err, "Error reading OCSP response\n"); 798 goto end; 799 } 800 } else { 801 ret = 0; 802 goto end; 803 } 804 805 done_resp: 806 807 if (respout != NULL) { 808 derbio = bio_open_default(respout, 'w', FORMAT_ASN1); 809 if (derbio == NULL) 810 goto end; 811 i2d_OCSP_RESPONSE_bio(derbio, resp); 812 BIO_free(derbio); 813 } 814 815 if (resp != NULL) { 816 i = OCSP_response_status(resp); 817 if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL) { 818 BIO_printf(out, "Responder Error: %s (%d)\n", 819 OCSP_response_status_str(i), i); 820 if (!ignore_err) 821 goto end; 822 } 823 824 if (resp_text) 825 OCSP_RESPONSE_print(out, resp, 0); 826 } 827 828 /* If running as responder don't verify our own response */ 829 if (cbio != NULL) { 830 /* If not unlimited, see if we took all we should. */ 831 if (accept_count != -1 && --accept_count <= 0) { 832 ret = 0; 833 goto end; 834 } 835 BIO_free_all(cbio); 836 cbio = NULL; 837 OCSP_REQUEST_free(req); 838 req = NULL; 839 OCSP_RESPONSE_free(resp); 840 resp = NULL; 841 goto redo_accept; 842 } 843 if (ridx_filename != NULL) { 844 ret = 0; 845 goto end; 846 } 847 848 if (store == NULL) { 849 store = setup_verify(CAfile, noCAfile, CApath, noCApath, 850 CAstore, noCAstore); 851 if (!store) 852 goto end; 853 } 854 if (vpmtouched) 855 X509_STORE_set1_param(store, vpm); 856 if (verify_certfile != NULL) { 857 if (!load_certs(verify_certfile, 0, &verify_other, NULL, 858 "validator certificates")) 859 goto end; 860 } 861 862 bs = OCSP_response_get1_basic(resp); 863 if (bs == NULL) { 864 BIO_printf(bio_err, "Error parsing response\n"); 865 goto end; 866 } 867 868 ret = 0; 869 870 if (!noverify) { 871 if (req != NULL && ((i = OCSP_check_nonce(req, bs)) <= 0)) { 872 if (i == -1) 873 BIO_printf(bio_err, "WARNING: no nonce in response\n"); 874 else { 875 BIO_printf(bio_err, "Nonce Verify error\n"); 876 ret = 1; 877 goto end; 878 } 879 } 880 881 i = OCSP_basic_verify(bs, verify_other, store, verify_flags); 882 if (i <= 0 && issuers) { 883 i = OCSP_basic_verify(bs, issuers, store, verify_flags); 884 if (i > 0) 885 ERR_clear_error(); 886 } 887 if (i <= 0) { 888 BIO_printf(bio_err, "Response Verify Failure\n"); 889 ERR_print_errors(bio_err); 890 ret = 1; 891 } else { 892 BIO_printf(bio_err, "Response verify OK\n"); 893 } 894 } 895 896 if (!print_ocsp_summary(out, bs, req, reqnames, ids, nsec, maxage)) 897 ret = 1; 898 899 end: 900 ERR_print_errors(bio_err); 901 X509_free(signer); 902 X509_STORE_free(store); 903 X509_VERIFY_PARAM_free(vpm); 904 sk_OPENSSL_STRING_free(rsign_sigopts); 905 EVP_PKEY_free(key); 906 EVP_PKEY_free(rkey); 907 EVP_MD_free(cert_id_md); 908 EVP_MD_free(rsign_md); 909 EVP_MD_free(resp_certid_md); 910 X509_free(cert); 911 OSSL_STACK_OF_X509_free(issuers); 912 X509_free(rsigner); 913 OSSL_STACK_OF_X509_free(rca_certs); 914 free_index(rdb); 915 BIO_free_all(cbio); 916 BIO_free_all(acbio); 917 BIO_free_all(out); 918 OCSP_REQUEST_free(req); 919 OCSP_RESPONSE_free(resp); 920 OCSP_BASICRESP_free(bs); 921 sk_OPENSSL_STRING_free(reqnames); 922 sk_OCSP_CERTID_free(ids); 923 OSSL_STACK_OF_X509_free(sign_other); 924 OSSL_STACK_OF_X509_free(verify_other); 925 sk_CONF_VALUE_pop_free(headers, X509V3_conf_free); 926 OPENSSL_free(thost); 927 OPENSSL_free(tport); 928 OPENSSL_free(tpath); 929 930 return ret; 931 } 932 933 #ifdef HTTP_DAEMON 934 935 static int index_changed(CA_DB *rdb) 936 { 937 struct stat sb; 938 939 if (rdb != NULL && stat(rdb->dbfname, &sb) != -1) { 940 if (rdb->dbst.st_mtime != sb.st_mtime 941 || rdb->dbst.st_ctime != sb.st_ctime 942 || rdb->dbst.st_ino != sb.st_ino 943 || rdb->dbst.st_dev != sb.st_dev) { 944 syslog(LOG_INFO, "index file changed, reloading"); 945 return 1; 946 } 947 } 948 return 0; 949 } 950 951 #endif 952 953 static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert, 954 const EVP_MD *cert_id_md, X509 *issuer, 955 STACK_OF(OCSP_CERTID) *ids) 956 { 957 OCSP_CERTID *id; 958 959 if (issuer == NULL) { 960 BIO_printf(bio_err, "No issuer certificate specified\n"); 961 return 0; 962 } 963 if (*req == NULL) 964 *req = OCSP_REQUEST_new(); 965 if (*req == NULL) 966 goto err; 967 id = OCSP_cert_to_id(cert_id_md, cert, issuer); 968 if (id == NULL || !sk_OCSP_CERTID_push(ids, id)) 969 goto err; 970 if (!OCSP_request_add0_id(*req, id)) 971 goto err; 972 return 1; 973 974 err: 975 BIO_printf(bio_err, "Error Creating OCSP request\n"); 976 return 0; 977 } 978 979 static int add_ocsp_serial(OCSP_REQUEST **req, char *serial, 980 const EVP_MD *cert_id_md, X509 *issuer, 981 STACK_OF(OCSP_CERTID) *ids) 982 { 983 OCSP_CERTID *id; 984 const X509_NAME *iname; 985 ASN1_BIT_STRING *ikey; 986 ASN1_INTEGER *sno; 987 988 if (issuer == NULL) { 989 BIO_printf(bio_err, "No issuer certificate specified\n"); 990 return 0; 991 } 992 if (*req == NULL) 993 *req = OCSP_REQUEST_new(); 994 if (*req == NULL) 995 goto err; 996 iname = X509_get_subject_name(issuer); 997 ikey = X509_get0_pubkey_bitstr(issuer); 998 sno = s2i_ASN1_INTEGER(NULL, serial); 999 if (sno == NULL) { 1000 BIO_printf(bio_err, "Error converting serial number %s\n", serial); 1001 return 0; 1002 } 1003 id = OCSP_cert_id_new(cert_id_md, iname, ikey, sno); 1004 ASN1_INTEGER_free(sno); 1005 if (id == NULL || !sk_OCSP_CERTID_push(ids, id)) 1006 goto err; 1007 if (!OCSP_request_add0_id(*req, id)) 1008 goto err; 1009 return 1; 1010 1011 err: 1012 BIO_printf(bio_err, "Error Creating OCSP request\n"); 1013 return 0; 1014 } 1015 1016 static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req, 1017 STACK_OF(OPENSSL_STRING) *names, 1018 STACK_OF(OCSP_CERTID) *ids, long nsec, 1019 long maxage) 1020 { 1021 OCSP_CERTID *id; 1022 const char *name; 1023 int i, status, reason; 1024 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd; 1025 int ret = 1; 1026 1027 if (req == NULL || !sk_OPENSSL_STRING_num(names)) 1028 return 1; 1029 1030 if (bs == NULL || !sk_OCSP_CERTID_num(ids)) 1031 return 0; 1032 1033 for (i = 0; i < sk_OCSP_CERTID_num(ids); i++) { 1034 id = sk_OCSP_CERTID_value(ids, i); 1035 name = sk_OPENSSL_STRING_value(names, i); 1036 BIO_printf(out, "%s: ", name); 1037 1038 if (!OCSP_resp_find_status(bs, id, &status, &reason, 1039 &rev, &thisupd, &nextupd)) { 1040 BIO_puts(out, "ERROR: No Status found.\n"); 1041 ret = 0; 1042 continue; 1043 } 1044 1045 /* 1046 * Check validity: if invalid write to output BIO so we know which 1047 * response this refers to. 1048 */ 1049 if (!OCSP_check_validity(thisupd, nextupd, nsec, maxage)) { 1050 BIO_puts(out, "WARNING: Status times invalid.\n"); 1051 ERR_print_errors(out); 1052 } 1053 BIO_printf(out, "%s\n", OCSP_cert_status_str(status)); 1054 1055 BIO_puts(out, "\tThis Update: "); 1056 ASN1_GENERALIZEDTIME_print(out, thisupd); 1057 BIO_puts(out, "\n"); 1058 1059 if (nextupd) { 1060 BIO_puts(out, "\tNext Update: "); 1061 ASN1_GENERALIZEDTIME_print(out, nextupd); 1062 BIO_puts(out, "\n"); 1063 } 1064 1065 if (status != V_OCSP_CERTSTATUS_REVOKED) 1066 continue; 1067 1068 if (reason != -1) 1069 BIO_printf(out, "\tReason: %s\n", OCSP_crl_reason_str(reason)); 1070 1071 BIO_puts(out, "\tRevocation Time: "); 1072 ASN1_GENERALIZEDTIME_print(out, rev); 1073 BIO_puts(out, "\n"); 1074 } 1075 return ret; 1076 } 1077 1078 static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req, 1079 CA_DB *db, STACK_OF(X509) *ca, X509 *rcert, 1080 EVP_PKEY *rkey, const EVP_MD *rmd, 1081 STACK_OF(OPENSSL_STRING) *sigopts, 1082 STACK_OF(X509) *rother, unsigned long flags, 1083 int nmin, int ndays, int badsig, 1084 const EVP_MD *resp_md) 1085 { 1086 ASN1_TIME *thisupd = NULL, *nextupd = NULL; 1087 OCSP_CERTID *cid; 1088 OCSP_BASICRESP *bs = NULL; 1089 int i, id_count; 1090 EVP_MD_CTX *mctx = NULL; 1091 EVP_PKEY_CTX *pkctx = NULL; 1092 1093 id_count = OCSP_request_onereq_count(req); 1094 1095 if (id_count <= 0) { 1096 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL); 1097 goto end; 1098 } 1099 1100 bs = OCSP_BASICRESP_new(); 1101 if (bs == NULL) { 1102 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, bs); 1103 goto end; 1104 } 1105 thisupd = X509_gmtime_adj(NULL, 0); 1106 if (ndays != -1) 1107 nextupd = X509_time_adj_ex(NULL, ndays, nmin * 60, NULL); 1108 1109 /* Examine each certificate id in the request */ 1110 for (i = 0; i < id_count; i++) { 1111 OCSP_ONEREQ *one; 1112 ASN1_INTEGER *serial; 1113 char **inf; 1114 int jj; 1115 int found = 0; 1116 ASN1_OBJECT *cert_id_md_oid; 1117 const EVP_MD *cert_id_md; 1118 OCSP_CERTID *cid_resp_md = NULL; 1119 1120 one = OCSP_request_onereq_get0(req, i); 1121 cid = OCSP_onereq_get0_id(one); 1122 1123 OCSP_id_get0_info(NULL, &cert_id_md_oid, NULL, NULL, cid); 1124 1125 cert_id_md = EVP_get_digestbyobj(cert_id_md_oid); 1126 if (cert_id_md == NULL) { 1127 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, 1128 NULL); 1129 goto end; 1130 } 1131 for (jj = 0; jj < sk_X509_num(ca) && !found; jj++) { 1132 X509 *ca_cert = sk_X509_value(ca, jj); 1133 OCSP_CERTID *ca_id = OCSP_cert_to_id(cert_id_md, NULL, ca_cert); 1134 1135 if (ca_id == NULL) { 1136 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, 1137 NULL); 1138 goto end; 1139 } 1140 1141 if (OCSP_id_issuer_cmp(ca_id, cid) == 0) { 1142 found = 1; 1143 if (resp_md != NULL) 1144 cid_resp_md = OCSP_cert_to_id(resp_md, NULL, ca_cert); 1145 } 1146 OCSP_CERTID_free(ca_id); 1147 } 1148 OCSP_id_get0_info(NULL, NULL, NULL, &serial, cid); 1149 inf = lookup_serial(db, serial); 1150 1151 /* at this point, we can have cid be an alias of cid_resp_md */ 1152 cid = (cid_resp_md != NULL) ? cid_resp_md : cid; 1153 1154 if (!found) { 1155 OCSP_basic_add1_status(bs, cid, 1156 V_OCSP_CERTSTATUS_UNKNOWN, 1157 0, NULL, thisupd, nextupd); 1158 continue; 1159 } 1160 if (inf == NULL) { 1161 OCSP_basic_add1_status(bs, cid, 1162 V_OCSP_CERTSTATUS_UNKNOWN, 1163 0, NULL, thisupd, nextupd); 1164 } else if (inf[DB_type][0] == DB_TYPE_VAL) { 1165 OCSP_basic_add1_status(bs, cid, 1166 V_OCSP_CERTSTATUS_GOOD, 1167 0, NULL, thisupd, nextupd); 1168 } else if (inf[DB_type][0] == DB_TYPE_REV) { 1169 ASN1_OBJECT *inst = NULL; 1170 ASN1_TIME *revtm = NULL; 1171 ASN1_GENERALIZEDTIME *invtm = NULL; 1172 OCSP_SINGLERESP *single; 1173 int reason = -1; 1174 1175 unpack_revinfo(&revtm, &reason, &inst, &invtm, inf[DB_rev_date]); 1176 single = OCSP_basic_add1_status(bs, cid, 1177 V_OCSP_CERTSTATUS_REVOKED, 1178 reason, revtm, thisupd, nextupd); 1179 if (single == NULL) { 1180 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, 1181 NULL); 1182 goto end; 1183 } 1184 if (invtm != NULL) 1185 OCSP_SINGLERESP_add1_ext_i2d(single, NID_invalidity_date, 1186 invtm, 0, 0); 1187 else if (inst != NULL) 1188 OCSP_SINGLERESP_add1_ext_i2d(single, 1189 NID_hold_instruction_code, inst, 1190 0, 0); 1191 ASN1_OBJECT_free(inst); 1192 ASN1_TIME_free(revtm); 1193 ASN1_GENERALIZEDTIME_free(invtm); 1194 } 1195 OCSP_CERTID_free(cid_resp_md); 1196 } 1197 1198 OCSP_copy_nonce(bs, req); 1199 1200 mctx = EVP_MD_CTX_new(); 1201 if (mctx == NULL || !EVP_DigestSignInit(mctx, &pkctx, rmd, NULL, rkey)) { 1202 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, NULL); 1203 goto end; 1204 } 1205 for (i = 0; i < sk_OPENSSL_STRING_num(sigopts); i++) { 1206 char *sigopt = sk_OPENSSL_STRING_value(sigopts, i); 1207 1208 if (pkey_ctrl_string(pkctx, sigopt) <= 0) { 1209 BIO_printf(err, "parameter error \"%s\"\n", sigopt); 1210 ERR_print_errors(bio_err); 1211 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, 1212 NULL); 1213 goto end; 1214 } 1215 } 1216 if (!OCSP_basic_sign_ctx(bs, rcert, mctx, rother, flags)) { 1217 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, bs); 1218 goto end; 1219 } 1220 1221 if (badsig) { 1222 const ASN1_OCTET_STRING *sig = OCSP_resp_get0_signature(bs); 1223 corrupt_signature(sig); 1224 } 1225 1226 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_SUCCESSFUL, bs); 1227 1228 end: 1229 EVP_MD_CTX_free(mctx); 1230 ASN1_TIME_free(thisupd); 1231 ASN1_TIME_free(nextupd); 1232 OCSP_BASICRESP_free(bs); 1233 } 1234 1235 static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser) 1236 { 1237 int i; 1238 BIGNUM *bn = NULL; 1239 char *itmp, *row[DB_NUMBER], **rrow; 1240 for (i = 0; i < DB_NUMBER; i++) 1241 row[i] = NULL; 1242 bn = ASN1_INTEGER_to_BN(ser, NULL); 1243 OPENSSL_assert(bn); /* FIXME: should report an error at this 1244 * point and abort */ 1245 if (BN_is_zero(bn)) { 1246 itmp = OPENSSL_strdup("00"); 1247 OPENSSL_assert(itmp); 1248 } else { 1249 itmp = BN_bn2hex(bn); 1250 } 1251 row[DB_serial] = itmp; 1252 BN_free(bn); 1253 rrow = TXT_DB_get_by_index(db->db, DB_serial, row); 1254 OPENSSL_free(itmp); 1255 return rrow; 1256 } 1257 1258 static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio, 1259 int timeout) 1260 { 1261 #ifndef OPENSSL_NO_SOCK 1262 return http_server_get_asn1_req(ASN1_ITEM_rptr(OCSP_REQUEST), 1263 (ASN1_VALUE **)preq, NULL, pcbio, acbio, 1264 NULL /* found_keep_alive */, 1265 prog, 1 /* accept_get */, timeout); 1266 #else 1267 BIO_printf(bio_err, 1268 "Error getting OCSP request - sockets not supported\n"); 1269 *preq = NULL; 1270 return 0; 1271 #endif 1272 } 1273 1274 static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp) 1275 { 1276 #ifndef OPENSSL_NO_SOCK 1277 return http_server_send_asn1_resp(prog, cbio, 1278 0 /* no keep-alive */, 1279 "application/ocsp-response", 1280 ASN1_ITEM_rptr(OCSP_RESPONSE), 1281 (const ASN1_VALUE *)resp); 1282 #else 1283 BIO_printf(bio_err, 1284 "Error sending OCSP response - sockets not supported\n"); 1285 return 0; 1286 #endif 1287 } 1288 1289 #ifndef OPENSSL_NO_SOCK 1290 OCSP_RESPONSE *process_responder(OCSP_REQUEST *req, const char *host, 1291 const char *port, const char *path, 1292 const char *proxy, const char *no_proxy, 1293 int use_ssl, STACK_OF(CONF_VALUE) *headers, 1294 int req_timeout) 1295 { 1296 SSL_CTX *ctx = NULL; 1297 OCSP_RESPONSE *resp = NULL; 1298 1299 if (use_ssl == 1) { 1300 ctx = SSL_CTX_new(TLS_client_method()); 1301 if (ctx == NULL) { 1302 BIO_printf(bio_err, "Error creating SSL context.\n"); 1303 goto end; 1304 } 1305 } 1306 1307 resp = (OCSP_RESPONSE *) 1308 app_http_post_asn1(host, port, path, proxy, no_proxy, 1309 ctx, headers, "application/ocsp-request", 1310 (ASN1_VALUE *)req, ASN1_ITEM_rptr(OCSP_REQUEST), 1311 "application/ocsp-response", 1312 req_timeout, ASN1_ITEM_rptr(OCSP_RESPONSE)); 1313 1314 if (resp == NULL) 1315 BIO_printf(bio_err, "Error querying OCSP responder\n"); 1316 1317 end: 1318 SSL_CTX_free(ctx); 1319 return resp; 1320 } 1321 #endif 1322