apps/ocsp.c

   1 /* ocsp.c */
   2 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
   3  * project 2000.
   4  */
   5 /* ====================================================================
   6  * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * 3. All advertising materials mentioning features or use of this
  21  *    software must display the following acknowledgment:
  22  *    "This product includes software developed by the OpenSSL Project
  23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24  *
  25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26  *    endorse or promote products derived from this software without
  27  *    prior written permission. For written permission, please contact
  28  *    licensing@OpenSSL.org.
  29  *
  30  * 5. Products derived from this software may not be called "OpenSSL"
  31  *    nor may "OpenSSL" appear in their names without prior written
  32  *    permission of the OpenSSL Project.
  33  *
  34  * 6. Redistributions of any form whatsoever must retain the following
  35  *    acknowledgment:
  36  *    "This product includes software developed by the OpenSSL Project
  37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38  *
  39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50  * OF THE POSSIBILITY OF SUCH DAMAGE.
  51  * ====================================================================
  52  *
  53  * This product includes cryptographic software written by Eric Young
  54  * (eay@cryptsoft.com).  This product includes software written by Tim
  55  * Hudson (tjh@cryptsoft.com).
  56  *
  57  */
  58
  59 #include <stdio.h>
  60 #include <string.h>
  61 #include <openssl/pem.h>
  62 #include <openssl/ocsp.h>
  63 #include <openssl/err.h>
  64 #include <openssl/ssl.h>
  65 #include "apps.h"
  66
  67 /* Maximum leeway in validity period: default 5 minutes */
  68 #define MAX_VALIDITY_PERIOD     (5 * 60)
  69
  70 /* CA index.txt definitions */
  71 #define DB_type         0
  72 #define DB_exp_date     1
  73 #define DB_rev_date     2
  74 #define DB_serial       3       /* index - unique */
  75 #define DB_file         4
  76 #define DB_name         5       /* index - unique for active */
  77 #define DB_NUMBER       6
  78
  79 #define DB_TYPE_REV     'R'
  80 #define DB_TYPE_EXP     'E'
  81 #define DB_TYPE_VAL     'V'
  82
  83 static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert, X509 *issuer,
  84                                 STACK_OF(OCSP_CERTID) *ids);
  85 static int add_ocsp_serial(OCSP_REQUEST **req, char *serial, X509 *issuer,
  86                                 STACK_OF(OCSP_CERTID) *ids);
  87 static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
  88                                 STACK *names, STACK_OF(OCSP_CERTID) *ids,
  89                                 long nsec, long maxage);
  90
  91 static int make_ocsp_response(OCSP_RESPONSE **resp, OCSP_REQUEST *req, TXT_DB *db,
  92                         X509 *ca, X509 *rcert, EVP_PKEY *rkey,
  93                         STACK_OF(X509) *rother, unsigned long flags,
  94                         int nmin, int ndays);
  95
  96 static char **lookup_serial(TXT_DB *db, ASN1_INTEGER *ser);
  97 static OCSP_REQUEST *do_responder(BIO **cbio, char *port);
  98 static int send_ocsp_response(BIO *cbio, OCSP_RESPONSE *resp);
  99
 100 #undef PROG
 101 #define PROG ocsp_main
 102
 103 int MAIN(int, char **);
 104
 105 int MAIN(int argc, char **argv)
 106         {
 107         ENGINE *e = NULL;
 108         char **args;
 109         char *host = NULL, *port = NULL, *path = "/";
 110         char *reqin = NULL, *respin = NULL;
 111         char *reqout = NULL, *respout = NULL;
 112         char *signfile = NULL, *keyfile = NULL;
 113         char *rsignfile = NULL, *rkeyfile = NULL;
 114         char *outfile = NULL;
 115         int add_nonce = 1, noverify = 0, use_ssl = -1;
 116         OCSP_REQUEST *req = NULL;
 117         OCSP_RESPONSE *resp = NULL;
 118         OCSP_BASICRESP *bs = NULL;
 119         X509 *issuer = NULL, *cert = NULL;
 120         X509 *signer = NULL, *rsigner = NULL;
 121         EVP_PKEY *key = NULL, *rkey = NULL;
 122         BIO *cbio = NULL, *derbio = NULL;
 123         BIO *out = NULL;
 124         int req_text = 0, resp_text = 0;
 125         long nsec = MAX_VALIDITY_PERIOD, maxage = -1;
 126         char *CAfile = NULL, *CApath = NULL;
 127         X509_STORE *store = NULL;
 128         SSL_CTX *ctx = NULL;
 129         STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL;
 130         char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
 131         unsigned long sign_flags = 0, verify_flags = 0, rflags = 0;
 132         int ret = 1;
 133         int badarg = 0;
 134         int i;
 135         STACK *reqnames = NULL;
 136         STACK_OF(OCSP_CERTID) *ids = NULL;
 137
 138         X509 *rca_cert = NULL;
 139         char *ridx_filename = NULL;
 140         char *rca_filename = NULL;
 141         TXT_DB *rdb = NULL;
 142         int nmin = 0, ndays = -1;
 143
 144         if (bio_err == NULL) bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
 145         SSL_load_error_strings();
 146         args = argv + 1;
 147         reqnames = sk_new_null();
 148         ids = sk_OCSP_CERTID_new_null();
 149         while (!badarg && *args && *args[0] == '-')
 150                 {
 151                 if (!strcmp(*args, "-out"))
 152                         {
 153                         if (args[1])
 154                                 {
 155                                 args++;
 156                                 outfile = *args;
 157                                 }
 158                         else badarg = 1;
 159                         }
 160                 else if (!strcmp(*args, "-url"))
 161                         {
 162                         if (args[1])
 163                                 {
 164                                 args++;
 165                                 if (!OCSP_parse_url(*args, &host, &port, &path, &use_ssl))
 166                                         {
 167                                         BIO_printf(bio_err, "Error parsing URL\n");
 168                                         badarg = 1;
 169                                         }
 170                                 }
 171                         else badarg = 1;
 172                         }
 173                 else if (!strcmp(*args, "-host"))
 174                         {
 175                         if (args[1])
 176                                 {
 177                                 args++;
 178                                 host = *args;
 179                                 }
 180                         else badarg = 1;
 181                         }
 182                 else if (!strcmp(*args, "-port"))
 183                         {
 184                         if (args[1])
 185                                 {
 186                                 args++;
 187                                 port = *args;
 188                                 }
 189                         else badarg = 1;
 190                         }
 191                 else if (!strcmp(*args, "-noverify"))
 192                         noverify = 1;
 193                 else if (!strcmp(*args, "-nonce"))
 194                         add_nonce = 2;
 195                 else if (!strcmp(*args, "-no_nonce"))
 196                         add_nonce = 0;
 197                 else if (!strcmp(*args, "-responder_no_certs"))
 198                         rflags |= OCSP_NOCERTS;
 199                 else if (!strcmp(*args, "-responder_no_time"))
 200                         rflags |= OCSP_NOTIME;
 201                 else if (!strcmp(*args, "-responder_key_id"))
 202                         rflags |= OCSP_RESPID_KEY;
 203                 else if (!strcmp(*args, "-no_certs"))
 204                         sign_flags |= OCSP_NOCERTS;
 205                 else if (!strcmp(*args, "-no_signature_verify"))
 206                         verify_flags |= OCSP_NOSIGS;
 207                 else if (!strcmp(*args, "-no_cert_verify"))
 208                         verify_flags |= OCSP_NOVERIFY;
 209                 else if (!strcmp(*args, "-no_chain"))
 210                         verify_flags |= OCSP_NOCHAIN;
 211                 else if (!strcmp(*args, "-no_cert_checks"))
 212                         verify_flags |= OCSP_NOCHECKS;
 213                 else if (!strcmp(*args, "-no_explicit"))
 214                         verify_flags |= OCSP_NOEXPLICIT;
 215                 else if (!strcmp(*args, "-trust_other"))
 216                         verify_flags |= OCSP_TRUSTOTHER;
 217                 else if (!strcmp(*args, "-no_intern"))
 218                         verify_flags |= OCSP_NOINTERN;
 219                 else if (!strcmp(*args, "-text"))
 220                         {
 221                         req_text = 1;
 222                         resp_text = 1;
 223                         }
 224                 else if (!strcmp(*args, "-req_text"))
 225                         req_text = 1;
 226                 else if (!strcmp(*args, "-resp_text"))
 227                         resp_text = 1;
 228                 else if (!strcmp(*args, "-reqin"))
 229                         {
 230                         if (args[1])
 231                                 {
 232                                 args++;
 233                                 reqin = *args;
 234                                 }
 235                         else badarg = 1;
 236                         }
 237                 else if (!strcmp(*args, "-respin"))
 238                         {
 239                         if (args[1])
 240                                 {
 241                                 args++;
 242                                 respin = *args;
 243                                 }
 244                         else badarg = 1;
 245                         }
 246                 else if (!strcmp(*args, "-signer"))
 247                         {
 248                         if (args[1])
 249                                 {
 250                                 args++;
 251                                 signfile = *args;
 252                                 }
 253                         else badarg = 1;
 254                         }
 255                 else if (!strcmp (*args, "-VAfile"))
 256                         {
 257                         if (args[1])
 258                                 {
 259                                 args++;
 260                                 verify_certfile = *args;
 261                                 verify_flags |= OCSP_TRUSTOTHER;
 262                                 }
 263                         else badarg = 1;
 264                         }
 265                 else if (!strcmp(*args, "-sign_other"))
 266                         {
 267                         if (args[1])
 268                                 {
 269                                 args++;
 270                                 sign_certfile = *args;
 271                                 }
 272                         else badarg = 1;
 273                         }
 274                 else if (!strcmp(*args, "-verify_other"))
 275                         {
 276                         if (args[1])
 277                                 {
 278                                 args++;
 279                                 verify_certfile = *args;
 280                                 }
 281                         else badarg = 1;
 282                         }
 283                 else if (!strcmp (*args, "-CAfile"))
 284                         {
 285                         if (args[1])
 286                                 {
 287                                 args++;
 288                                 CAfile = *args;
 289                                 }
 290                         else badarg = 1;
 291                         }
 292                 else if (!strcmp (*args, "-CApath"))
 293                         {
 294                         if (args[1])
 295                                 {
 296                                 args++;
 297                                 CApath = *args;
 298                                 }
 299                         else badarg = 1;
 300                         }
 301                 else if (!strcmp (*args, "-validity_period"))
 302                         {
 303                         if (args[1])
 304                                 {
 305                                 args++;
 306                                 nsec = atol(*args);
 307                                 if (nsec < 0)
 308                                         {
 309                                         BIO_printf(bio_err,
 310                                                 "Illegal validity period %s\n",
 311                                                 *args);
 312                                         badarg = 1;
 313                                         }
 314                                 }
 315                         else badarg = 1;
 316                         }
 317                 else if (!strcmp (*args, "-status_age"))
 318                         {
 319                         if (args[1])
 320                                 {
 321                                 args++;
 322                                 maxage = atol(*args);
 323                                 if (maxage < 0)
 324                                         {
 325                                         BIO_printf(bio_err,
 326                                                 "Illegal validity age %s\n",
 327                                                 *args);
 328                                         badarg = 1;
 329                                         }
 330                                 }
 331                         else badarg = 1;
 332                         }
 333                  else if (!strcmp(*args, "-signkey"))
 334                         {
 335                         if (args[1])
 336                                 {
 337                                 args++;
 338                                 keyfile = *args;
 339                                 }
 340                         else badarg = 1;
 341                         }
 342                 else if (!strcmp(*args, "-reqout"))
 343                         {
 344                         if (args[1])
 345                                 {
 346                                 args++;
 347                                 reqout = *args;
 348                                 }
 349                         else badarg = 1;
 350                         }
 351                 else if (!strcmp(*args, "-respout"))
 352                         {
 353                         if (args[1])
 354                                 {
 355                                 args++;
 356                                 respout = *args;
 357                                 }
 358                         else badarg = 1;
 359                         }
 360                  else if (!strcmp(*args, "-path"))
 361                         {
 362                         if (args[1])
 363                                 {
 364                                 args++;
 365                                 path = *args;
 366                                 }
 367                         else badarg = 1;
 368                         }
 369                 else if (!strcmp(*args, "-issuer"))
 370                         {
 371                         if (args[1])
 372                                 {
 373                                 args++;
 374                                 X509_free(issuer);
 375                                 issuer = load_cert(bio_err, *args, FORMAT_PEM,
 376                                         NULL, e, "issuer certificate");
 377                                 if(!issuer) goto end;
 378                                 }
 379                         else badarg = 1;
 380                         }
 381                 else if (!strcmp (*args, "-cert"))
 382                         {
 383                         if (args[1])
 384                                 {
 385                                 args++;
 386                                 X509_free(cert);
 387                                 cert = load_cert(bio_err, *args, FORMAT_PEM,
 388                                         NULL, e, "certificate");
 389                                 if(!cert) goto end;
 390                                 if(!add_ocsp_cert(&req, cert, issuer, ids))
 391                                         goto end;
 392                                 if(!sk_push(reqnames, *args))
 393                                         goto end;
 394                                 }
 395                         else badarg = 1;
 396                         }
 397                 else if (!strcmp(*args, "-serial"))
 398                         {
 399                         if (args[1])
 400                                 {
 401                                 args++;
 402                                 if(!add_ocsp_serial(&req, *args, issuer, ids))
 403                                         goto end;
 404                                 if(!sk_push(reqnames, *args))
 405                                         goto end;
 406                                 }
 407                         else badarg = 1;
 408                         }
 409                 else if (!strcmp(*args, "-index"))
 410                         {
 411                         if (args[1])
 412                                 {
 413                                 args++;
 414                                 ridx_filename = *args;
 415                                 }
 416                         else badarg = 1;
 417                         }
 418                 else if (!strcmp(*args, "-CA"))
 419                         {
 420                         if (args[1])
 421                                 {
 422                                 args++;
 423                                 rca_filename = *args;
 424                                 }
 425                         else badarg = 1;
 426                         }
 427                 else if (!strcmp (*args, "-nmin"))
 428                         {
 429                         if (args[1])
 430                                 {
 431                                 args++;
 432                                 nmin = atol(*args);
 433                                 if (nmin < 0)
 434                                         {
 435                                         BIO_printf(bio_err,
 436                                                 "Illegal update period %s\n",
 437                                                 *args);
 438                                         badarg = 1;
 439                                         }
 440                                 }
 441                                 if (ndays == -1)
 442                                         ndays = 0;
 443                         else badarg = 1;
 444                         }
 445                 else if (!strcmp (*args, "-ndays"))
 446                         {
 447                         if (args[1])
 448                                 {
 449                                 args++;
 450                                 ndays = atol(*args);
 451                                 if (ndays < 0)
 452                                         {
 453                                         BIO_printf(bio_err,
 454                                                 "Illegal update period %s\n",
 455                                                 *args);
 456                                         badarg = 1;
 457                                         }
 458                                 }
 459                         else badarg = 1;
 460                         }
 461                 else if (!strcmp(*args, "-rsigner"))
 462                         {
 463                         if (args[1])
 464                                 {
 465                                 args++;
 466                                 rsignfile = *args;
 467                                 }
 468                         else badarg = 1;
 469                         }
 470                 else if (!strcmp(*args, "-rkey"))
 471                         {
 472                         if (args[1])
 473                                 {
 474                                 args++;
 475                                 rkeyfile = *args;
 476                                 }
 477                         else badarg = 1;
 478                         }
 479                 else if (!strcmp(*args, "-rother"))
 480                         {
 481                         if (args[1])
 482                                 {
 483                                 args++;
 484                                 rcertfile = *args;
 485                                 }
 486                         else badarg = 1;
 487                         }
 488                 else badarg = 1;
 489                 args++;
 490                 }
 491
 492         /* Have we anything to do? */
 493         if (!req && !reqin && !respin && !(port && ridx_filename)) badarg = 1;
 494
 495         if (badarg)
 496                 {
 497                 BIO_printf (bio_err, "OCSP utility\n");
 498                 BIO_printf (bio_err, "Usage ocsp [options]\n");
 499                 BIO_printf (bio_err, "where options are\n");
 500                 BIO_printf (bio_err, "-out file          output filename\n");
 501                 BIO_printf (bio_err, "-issuer file       issuer certificate\n");
 502                 BIO_printf (bio_err, "-cert file         certificate to check\n");
 503                 BIO_printf (bio_err, "-serial n          serial number to check\n");
 504                 BIO_printf (bio_err, "-signer file       certificate to sign OCSP request with\n");
 505                 BIO_printf (bio_err, "-signkey file      private key to sign OCSP request with\n");
 506                 BIO_printf (bio_err, "-sign_certs file   additional certificates to include in signed request\n");
 507                 BIO_printf (bio_err, "-no_certs          don't include any certificates in signed request\n");
 508                 BIO_printf (bio_err, "-req_text          print text form of request\n");
 509                 BIO_printf (bio_err, "-resp_text         print text form of response\n");
 510                 BIO_printf (bio_err, "-text              print text form of request and response\n");
 511                 BIO_printf (bio_err, "-reqout file       write DER encoded OCSP request to \"file\"\n");
 512                 BIO_printf (bio_err, "-respout file      write DER encoded OCSP reponse to \"file\"\n");
 513                 BIO_printf (bio_err, "-reqin file        read DER encoded OCSP request from \"file\"\n");
 514                 BIO_printf (bio_err, "-respin file       read DER encoded OCSP reponse from \"file\"\n");
 515                 BIO_printf (bio_err, "-nonce             add OCSP nonce to request\n");
 516                 BIO_printf (bio_err, "-no_nonce          don't add OCSP nonce to request\n");
 517                 BIO_printf (bio_err, "-url URL           OCSP responder URL\n");
 518                 BIO_printf (bio_err, "-host host:n       send OCSP request to host on port n\n");
 519                 BIO_printf (bio_err, "-path              path to use in OCSP request\n");
 520                 BIO_printf (bio_err, "-CApath dir        trusted certificates directory\n");
 521                 BIO_printf (bio_err, "-CAfile file       trusted certificates file\n");
 522                 BIO_printf (bio_err, "-VAfile file       validator certificates file\n");
 523                 BIO_printf (bio_err, "-validity_period n maximum validity discrepancy in seconds\n");
 524                 BIO_printf (bio_err, "-status_age n      maximum status age in seconds\n");
 525                 BIO_printf (bio_err, "-noverify          don't verify response at all\n");
 526                 BIO_printf (bio_err, "-verify_certs file additional certificates to search for signer\n");
 527                 BIO_printf (bio_err, "-trust_other       don't verify additional certificates\n");
 528                 BIO_printf (bio_err, "-no_intern         don't search certificates contained in response for signer\n");
 529                 BIO_printf (bio_err, "-no_sig_verify     don't check signature on response\n");
 530                 BIO_printf (bio_err, "-no_cert_verify    don't check signing certificate\n");
 531                 BIO_printf (bio_err, "-no_chain          don't chain verify response\n");
 532                 BIO_printf (bio_err, "-no_cert_checks    don't do additional checks on signing certificate\n");
 533                 goto end;
 534                 }
 535
 536         if(outfile) out = BIO_new_file(outfile, "w");
 537         else out = BIO_new_fp(stdout, BIO_NOCLOSE);
 538
 539         if(!out)
 540                 {
 541                 BIO_printf(bio_err, "Error opening output file\n");
 542                 goto end;
 543                 }
 544
 545         if (!req && (add_nonce != 2)) add_nonce = 0;
 546
 547         if (!req && reqin)
 548                 {
 549                 derbio = BIO_new_file(reqin, "rb");
 550                 if (!derbio)
 551                         {
 552                         BIO_printf(bio_err, "Error Opening OCSP request file\n");
 553                         goto end;
 554                         }
 555                 req = d2i_OCSP_REQUEST_bio(derbio, NULL);
 556                 BIO_free(derbio);
 557                 if(!req)
 558                         {
 559                         BIO_printf(bio_err, "Error reading OCSP request\n");
 560                         goto end;
 561                         }
 562                 }
 563
 564         if (!req && port)
 565                 {
 566                 req = do_responder(&cbio, port);
 567                 if (!req && !cbio)
 568                         goto end;
 569                 if (!req && cbio)
 570                         {
 571                         resp = OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL);
 572                         send_ocsp_response(cbio, resp);
 573                         goto done_resp;
 574                         }
 575                 }
 576
 577         if (!req && (signfile || reqout || host || add_nonce || ridx_filename))
 578                 {
 579                 BIO_printf(bio_err, "Need an OCSP request for this operation!\n");
 580                 goto end;
 581                 }
 582
 583         if (req && add_nonce) OCSP_request_add1_nonce(req, NULL, -1);
 584
 585         if (signfile)
 586                 {
 587                 if (!keyfile) keyfile = signfile;
 588                 signer = load_cert(bio_err, signfile, FORMAT_PEM,
 589                         NULL, e, "signer certificate");
 590                 if (!signer)
 591                         {
 592                         BIO_printf(bio_err, "Error loading signer certificate\n");
 593                         goto end;
 594                         }
 595                 if (sign_certfile)
 596                         {
 597                         sign_other = load_certs(bio_err, sign_certfile, FORMAT_PEM,
 598                                 NULL, e, "signer certificates");
 599                         if (!sign_other) goto end;
 600                         }
 601                 key = load_key(bio_err, keyfile, FORMAT_PEM, NULL, NULL,
 602                         "signer private key");
 603                 if (!key)
 604                         goto end;
 605                 if (!OCSP_request_sign(req, signer, key, EVP_sha1(), sign_other, sign_flags))
 606                         {
 607                         BIO_printf(bio_err, "Error signing OCSP request\n");
 608                         goto end;
 609                         }
 610                 }
 611
 612         if (req_text && req) OCSP_REQUEST_print(out, req, 0);
 613
 614         if (rsignfile)
 615                 {
 616                 if (!rkeyfile) rkeyfile = rsignfile;
 617                 rsigner = load_cert(bio_err, rsignfile, FORMAT_PEM,
 618                         NULL, e, "responder certificate");
 619                 if (!rsigner)
 620                         {
 621                         BIO_printf(bio_err, "Error loading responder certificate\n");
 622                         goto end;
 623                         }
 624                 rca_cert = load_cert(bio_err, rca_filename, FORMAT_PEM,
 625                         NULL, e, "CA certificate");
 626                 if (rcertfile)
 627                         {
 628                         rother = load_certs(bio_err, sign_certfile, FORMAT_PEM,
 629                                 NULL, e, "responder other certificates");
 630                         if (!sign_other) goto end;
 631                         }
 632                 rkey = load_key(bio_err, rkeyfile, FORMAT_PEM, NULL, NULL,
 633                         "responder private key");
 634                 if (!rkey)
 635                         goto end;
 636                 }
 637
 638         if (ridx_filename && (!rkey || !rsigner || !rca_cert))
 639                 {
 640                 BIO_printf(bio_err, "Need a responder certificate, key and CA for this operation!\n");
 641                 goto end;
 642                 }
 643
 644         if (ridx_filename)
 645                 {
 646                 BIO *db_bio = NULL;
 647                 db_bio = BIO_new_file(ridx_filename, "r");
 648                 if (!db_bio)
 649                         {
 650                         BIO_printf(bio_err, "Error opening index file %s\n", ridx_filename);
 651                         goto end;
 652                         }
 653                 rdb = TXT_DB_read(db_bio, DB_NUMBER);
 654                 BIO_free(db_bio);
 655                 if (!rdb)
 656                         {
 657                         BIO_printf(bio_err, "Error reading index file %s\n", ridx_filename);
 658                         goto end;
 659                         }
 660                 if (!make_serial_index(rdb))
 661                         goto end;
 662                 i = make_ocsp_response(&resp, req, rdb, rca_cert, rsigner, rkey, rother, rflags, nmin, ndays);
 663                 if (cbio)
 664                         send_ocsp_response(cbio, resp);
 665                 }
 666         else if (host)
 667                 {
 668                 cbio = BIO_new_connect(host);
 669                 if (!cbio)
 670                         {
 671                         BIO_printf(bio_err, "Error creating connect BIO\n");
 672                         goto end;
 673                         }
 674                 if (port) BIO_set_conn_port(cbio, port);
 675                 if (use_ssl == 1)
 676                         {
 677                         BIO *sbio;
 678                         ctx = SSL_CTX_new(SSLv23_client_method());
 679                         SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
 680                         sbio = BIO_new_ssl(ctx, 1);
 681                         cbio = BIO_push(sbio, cbio);
 682                         }
 683                 if (BIO_do_connect(cbio) <= 0)
 684                         {
 685                         BIO_printf(bio_err, "Error connecting BIO\n");
 686                         goto end;
 687                         }
 688                 resp = OCSP_sendreq_bio(cbio, path, req);
 689                 BIO_free_all(cbio);
 690                 cbio = NULL;
 691                 if (!resp)
 692                         {
 693                         BIO_printf(bio_err, "Error querying OCSP responsder\n");
 694                         goto end;
 695                         }
 696                 }
 697         else if (respin)
 698                 {
 699                 derbio = BIO_new_file(respin, "rb");
 700                 if (!derbio)
 701                         {
 702                         BIO_printf(bio_err, "Error Opening OCSP response file\n");
 703                         goto end;
 704                         }
 705                 resp = d2i_OCSP_RESPONSE_bio(derbio, NULL);
 706                 BIO_free(derbio);
 707                 if(!resp)
 708                         {
 709                         BIO_printf(bio_err, "Error reading OCSP response\n");
 710                         goto end;
 711                         }
 712
 713                 }
 714         else
 715                 {
 716                 ret = 0;
 717                 goto end;
 718                 }
 719
 720         done_resp:
 721
 722         if (respout)
 723                 {
 724                 derbio = BIO_new_file(respout, "wb");
 725                 if(!derbio)
 726                         {
 727                         BIO_printf(bio_err, "Error opening file %s\n", respout);
 728                         goto end;
 729                         }
 730                 i2d_OCSP_RESPONSE_bio(derbio, resp);
 731                 BIO_free(derbio);
 732                 }
 733
 734         i = OCSP_response_status(resp);
 735
 736         if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL)
 737                 {
 738                 BIO_printf(out, "Responder Error: %s (%ld)\n",
 739                                 OCSP_response_status_str(i), i);
 740                 ret = 0;
 741                 goto end;
 742                 }
 743
 744         if (resp_text) OCSP_RESPONSE_print(out, resp, 0);
 745
 746         /* If running as responder don't verify our own response */
 747         if (cbio)
 748                 goto end;
 749
 750         store = setup_verify(bio_err, CAfile, CApath);
 751         if(!store) goto end;
 752         if (verify_certfile)
 753                 {
 754                 verify_other = load_certs(bio_err, verify_certfile, FORMAT_PEM,
 755                         NULL, e, "validator certificate");
 756                 if (!verify_other) goto end;
 757                 }
 758
 759         bs = OCSP_response_get1_basic(resp);
 760
 761         if (!bs)
 762                 {
 763                 BIO_printf(bio_err, "Error parsing response\n");
 764                 goto end;
 765                 }
 766
 767         if (!noverify)
 768                 {
 769                 if (req && ((i = OCSP_check_nonce(req, bs)) <= 0))
 770                         {
 771                         if (i == -1)
 772                                 BIO_printf(bio_err, "WARNING: no nonce in response\n");
 773                         else
 774                                 {
 775                                 BIO_printf(bio_err, "Nonce Verify error\n");
 776                                 goto end;
 777                                 }
 778                         }
 779
 780                 i = OCSP_basic_verify(bs, verify_other, store, verify_flags);
 781                 if (i < 0) i = OCSP_basic_verify(bs, NULL, store, 0);
 782
 783                 if(i <= 0)
 784                         {
 785                         BIO_printf(bio_err, "Response Verify Failure\n", i);
 786                         ERR_print_errors(bio_err);
 787                         }
 788                 else
 789                         BIO_printf(bio_err, "Response verify OK\n");
 790
 791                 }
 792
 793         if (!print_ocsp_summary(out, bs, req, reqnames, ids, nsec, maxage))
 794                 goto end;
 795
 796         ret = 0;
 797
 798 end:
 799         ERR_print_errors(bio_err);
 800         X509_free(signer);
 801         X509_STORE_free(store);
 802         EVP_PKEY_free(key);
 803         EVP_PKEY_free(rkey);
 804         X509_free(issuer);
 805         X509_free(cert);
 806         X509_free(rsigner);
 807         X509_free(rca_cert);
 808         TXT_DB_free(rdb);
 809         BIO_free_all(cbio);
 810         BIO_free(out);
 811         OCSP_REQUEST_free(req);
 812         OCSP_RESPONSE_free(resp);
 813         OCSP_BASICRESP_free(bs);
 814         sk_free(reqnames);
 815         sk_OCSP_CERTID_free(ids);
 816         sk_X509_pop_free(sign_other, X509_free);
 817         sk_X509_pop_free(verify_other, X509_free);
 818
 819         if (use_ssl != -1)
 820                 {
 821                 OPENSSL_free(host);
 822                 OPENSSL_free(port);
 823                 OPENSSL_free(path);
 824                 SSL_CTX_free(ctx);
 825                 }
 826
 827         EXIT(ret);
 828 }
 829
 830 static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert, X509 *issuer,
 831                                 STACK_OF(OCSP_CERTID) *ids)
 832         {
 833         OCSP_CERTID *id;
 834         if(!issuer)
 835                 {
 836                 BIO_printf(bio_err, "No issuer certificate specified\n");
 837                 return 0;
 838                 }
 839         if(!*req) *req = OCSP_REQUEST_new();
 840         if(!*req) goto err;
 841         id = OCSP_cert_to_id(NULL, cert, issuer);
 842         if(!id || !sk_OCSP_CERTID_push(ids, id)) goto err;
 843         if(!OCSP_request_add0_id(*req, id)) goto err;
 844         return 1;
 845
 846         err:
 847         BIO_printf(bio_err, "Error Creating OCSP request\n");
 848         return 0;
 849         }
 850
 851 static int add_ocsp_serial(OCSP_REQUEST **req, char *serial, X509 *issuer,
 852                                 STACK_OF(OCSP_CERTID) *ids)
 853         {
 854         OCSP_CERTID *id;
 855         X509_NAME *iname;
 856         ASN1_BIT_STRING *ikey;
 857         ASN1_INTEGER *sno;
 858         if(!issuer)
 859                 {
 860                 BIO_printf(bio_err, "No issuer certificate specified\n");
 861                 return 0;
 862                 }
 863         if(!*req) *req = OCSP_REQUEST_new();
 864         if(!*req) goto err;
 865         iname = X509_get_subject_name(issuer);
 866         ikey = X509_get0_pubkey_bitstr(issuer);
 867         sno = s2i_ASN1_INTEGER(NULL, serial);
 868         if(!sno)
 869                 {
 870                 BIO_printf(bio_err, "Error converting serial number %s\n", serial);
 871                 return 0;
 872                 }
 873         id = OCSP_cert_id_new(EVP_sha1(), iname, ikey, sno);
 874         ASN1_INTEGER_free(sno);
 875         if(!id || !sk_OCSP_CERTID_push(ids, id)) goto err;
 876         if(!OCSP_request_add0_id(*req, id)) goto err;
 877         return 1;
 878
 879         err:
 880         BIO_printf(bio_err, "Error Creating OCSP request\n");
 881         return 0;
 882         }
 883
 884 static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
 885                                         STACK *names, STACK_OF(OCSP_CERTID) *ids,
 886                                         long nsec, long maxage)
 887         {
 888         OCSP_CERTID *id;
 889         char *name;
 890         int i;
 891
 892         int status, reason;
 893
 894         ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
 895
 896         if (!bs || !req || !sk_num(names) || !sk_OCSP_CERTID_num(ids))
 897                 return 1;
 898
 899         for (i = 0; i < sk_OCSP_CERTID_num(ids); i++)
 900                 {
 901                 id = sk_OCSP_CERTID_value(ids, i);
 902                 name = sk_value(names, i);
 903                 BIO_printf(out, "%s: ", name);
 904
 905                 if(!OCSP_resp_find_status(bs, id, &status, &reason,
 906                                         &rev, &thisupd, &nextupd))
 907                         {
 908                         BIO_puts(out, "ERROR: No Status found.\n");
 909                         continue;
 910                         }
 911
 912                 /* Check validity: if invalid write to output BIO so we
 913                  * know which response this refers to.
 914                  */
 915                 if (!OCSP_check_validity(thisupd, nextupd, nsec, maxage))
 916                         {
 917                         BIO_puts(out, "WARNING: Status times invalid.\n");
 918                         ERR_print_errors(out);
 919                         }
 920                 BIO_printf(out, "%s\n", OCSP_cert_status_str(status));
 921
 922                 BIO_puts(out, "\tThis Update: ");
 923                 ASN1_GENERALIZEDTIME_print(out, thisupd);
 924                 BIO_puts(out, "\n");
 925
 926                 if(nextupd)
 927                         {
 928                         BIO_puts(out, "\tNext Update: ");
 929                         ASN1_GENERALIZEDTIME_print(out, nextupd);
 930                         BIO_puts(out, "\n");
 931                         }
 932
 933                 if (status != V_OCSP_CERTSTATUS_REVOKED)
 934                         continue;
 935
 936                 if (reason != -1)
 937                         BIO_printf(out, "\tReason: %s\n",
 938                                 OCSP_crl_reason_str(reason));
 939
 940                 BIO_puts(out, "\tRevocation Time: ");
 941                 ASN1_GENERALIZEDTIME_print(out, rev);
 942                 BIO_puts(out, "\n");
 943                 }
 944
 945         return 1;
 946         }
 947
 948
 949 static int make_ocsp_response(OCSP_RESPONSE **resp, OCSP_REQUEST *req, TXT_DB *db,
 950                         X509 *ca, X509 *rcert, EVP_PKEY *rkey,
 951                         STACK_OF(X509) *rother, unsigned long flags,
 952                         int nmin, int ndays)
 953         {
 954         ASN1_TIME *thisupd = NULL, *nextupd = NULL;
 955         OCSP_CERTID *cid, *ca_id = NULL;
 956         OCSP_BASICRESP *bs = NULL;
 957         int i, id_count, ret = 1;
 958
 959
 960         id_count = OCSP_request_onereq_count(req);
 961
 962         if (id_count <= 0)
 963                 {
 964                 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL);
 965                 goto end;
 966                 }
 967
 968         ca_id = OCSP_cert_to_id(EVP_sha1(), NULL, ca);
 969
 970         bs = OCSP_BASICRESP_new();
 971         thisupd = X509_gmtime_adj(NULL, 0);
 972         if (ndays != -1)
 973                 nextupd = X509_gmtime_adj(NULL, nmin * 60 + ndays * 3600 * 24 );
 974
 975         /* Examine each certificate id in the request */
 976         for (i = 0; i < id_count; i++)
 977                 {
 978                 OCSP_ONEREQ *one;
 979                 ASN1_INTEGER *serial;
 980                 char **inf;
 981                 one = OCSP_request_onereq_get0(req, i);
 982                 cid = OCSP_onereq_get0_id(one);
 983                 /* Is this request about our CA? */
 984                 if (OCSP_id_issuer_cmp(ca_id, cid))
 985                         {
 986                         OCSP_basic_add1_status(bs, cid,
 987                                                 V_OCSP_CERTSTATUS_UNKNOWN,
 988                                                 0, NULL,
 989                                                 thisupd, nextupd);
 990                         continue;
 991                         }
 992                 OCSP_id_get0_info(NULL, NULL, NULL, &serial, cid);
 993                 inf = lookup_serial(db, serial);
 994                 if (!inf)
 995                         OCSP_basic_add1_status(bs, cid,
 996                                                 V_OCSP_CERTSTATUS_UNKNOWN,
 997                                                 0, NULL,
 998                                                 thisupd, nextupd);
 999                 else if (inf[DB_type][0] == DB_TYPE_VAL)
1000                         OCSP_basic_add1_status(bs, cid,
1001                                                 V_OCSP_CERTSTATUS_GOOD,
1002                                                 0, NULL,
1003                                                 thisupd, nextupd);
1004                 else if (inf[DB_type][0] == DB_TYPE_REV)
1005                         {
1006                         ASN1_OBJECT *inst = NULL;
1007                         ASN1_TIME *revtm = NULL;
1008                         ASN1_GENERALIZEDTIME *invtm = NULL;
1009                         OCSP_SINGLERESP *single;
1010                         int reason = -1;
1011                         unpack_revinfo(&revtm, &reason, &inst, &invtm, inf[DB_rev_date]);
1012                         single = OCSP_basic_add1_status(bs, cid,
1013                                                 V_OCSP_CERTSTATUS_REVOKED,
1014                                                 reason, revtm,
1015                                                 thisupd, nextupd);
1016                         if (invtm)
1017                                 OCSP_SINGLERESP_add1_ext_i2d(single, NID_invalidity_date, invtm, 0, 0);
1018                         else if (inst)
1019                                 OCSP_SINGLERESP_add1_ext_i2d(single, NID_hold_instruction_code, inst, 0, 0);
1020                         ASN1_OBJECT_free(inst);
1021                         ASN1_TIME_free(revtm);
1022                         ASN1_GENERALIZEDTIME_free(invtm);
1023                         }
1024                 }
1025
1026         OCSP_copy_nonce(bs, req);
1027
1028         OCSP_basic_sign(bs, rcert, rkey, EVP_sha1(), rother, flags);
1029
1030         *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_SUCCESSFUL, bs);
1031
1032         end:
1033         ASN1_TIME_free(thisupd);
1034         ASN1_TIME_free(nextupd);
1035         OCSP_CERTID_free(ca_id);
1036         OCSP_BASICRESP_free(bs);
1037         return ret;
1038
1039         }
1040
1041 static char **lookup_serial(TXT_DB *db, ASN1_INTEGER *ser)
1042         {
1043         int i;
1044         BIGNUM *bn = NULL;
1045         char *itmp, *row[DB_NUMBER],**rrow;
1046         for (i = 0; i < DB_NUMBER; i++) row[i] = NULL;
1047         bn = ASN1_INTEGER_to_BN(ser,NULL);
1048         itmp = BN_bn2hex(bn);
1049         row[DB_serial] = itmp;
1050         BN_free(bn);
1051         rrow=TXT_DB_get_by_index(db,DB_serial,row);
1052         OPENSSL_free(itmp);
1053         return rrow;
1054         }
1055
1056 /* Quick and dirty OCSP server: read in and parse input request */
1057
1058 static OCSP_REQUEST *do_responder(BIO **pcbio, char *port)
1059         {
1060         int have_post = 0, len;
1061         OCSP_REQUEST *req = NULL;
1062         char inbuf[1024];
1063         BIO *acbio = NULL, *bufbio = NULL, *cbio = NULL;
1064         bufbio = BIO_new(BIO_f_buffer());
1065         if (!bufbio)
1066                 goto err;
1067         acbio = BIO_new_accept(port);
1068         if (!acbio)
1069                 goto err;
1070         BIO_set_accept_bios(acbio, bufbio);
1071         bufbio = NULL;
1072
1073         if (BIO_do_accept(acbio) <= 0)
1074                 {
1075                         BIO_printf(bio_err, "Error setting up accept BIO\n");
1076                         ERR_print_errors(bio_err);
1077                         goto err;
1078                 }
1079
1080         BIO_printf(bio_err, "Waiting for OCSP client connection...\n");
1081
1082         if (BIO_do_accept(acbio) <= 0)
1083                 {
1084                         BIO_printf(bio_err, "Error accepting connection\n");
1085                         ERR_print_errors(bio_err);
1086                         goto err;
1087                 }
1088
1089         BIO_printf(bio_err, "Connection Established\n");
1090
1091
1092         cbio = BIO_pop(acbio);
1093         BIO_free_all(acbio);
1094         acbio = NULL;
1095
1096         for(;;)
1097                 {
1098                 len = BIO_gets(cbio, inbuf, 1024);
1099                 if (len <= 0) goto err;
1100                 /* Look for "POST" signalling start of query */
1101                 if (!have_post)
1102                         {
1103                         if(strncmp(inbuf, "POST", 4))
1104                                 {
1105                                 BIO_printf(bio_err, "Invalid request\n");
1106                                 goto err;
1107                                 }
1108                         have_post = 1;
1109                         }
1110                 /* Look for end of headers */
1111                 if ((inbuf[0] == '\r') || (inbuf[0] == '\n'))
1112                         break;
1113                 }
1114
1115         /* Try to read OCSP request */
1116
1117         req = d2i_OCSP_REQUEST_bio(cbio, NULL);
1118
1119         *pcbio = cbio;
1120
1121         if (!req)
1122                 {
1123                 BIO_printf(bio_err, "Error parsing OCSP request\n");
1124                 ERR_print_errors(bio_err);
1125                 }
1126
1127         return req;
1128
1129         err:
1130         BIO_free_all(acbio);
1131         BIO_free_all(cbio);
1132         BIO_free(bufbio);
1133         OCSP_REQUEST_free(req);
1134         return NULL;
1135         }
1136
1137 static int send_ocsp_response(BIO *cbio, OCSP_RESPONSE *resp)
1138         {
1139         char http_resp[] =
1140                 "HTTP/1.0 200 OK\r\nContent-type: application/ocsp-response\r\n"
1141                 "Content-Length: %d\r\n\r\n";
1142         if (!cbio)
1143                 return 0;
1144         BIO_printf(cbio, http_resp, i2d_OCSP_RESPONSE(resp, NULL));
1145         i2d_OCSP_RESPONSE_bio(cbio, resp);
1146         BIO_flush(cbio);
1147         return 1;
1148         }
1149