# include <stdlib.h>
# include <string.h>
# include <time.h>
+# include <ctype.h>
# include "apps.h" /* needs to be included before the openssl
* headers! */
# include <openssl/e_os2.h>
OPT_NO_CERT_CHECKS, OPT_NO_EXPLICIT, OPT_TRUST_OTHER,
OPT_NO_INTERN, OPT_BADSIG, OPT_TEXT, OPT_REQ_TEXT, OPT_RESP_TEXT,
OPT_REQIN, OPT_RESPIN, OPT_SIGNER, OPT_VAFILE, OPT_SIGN_OTHER,
- OPT_VERIFY_OTHER, OPT_CAFILE, OPT_CAPATH,
+ OPT_VERIFY_OTHER, OPT_CAFILE, OPT_CAPATH, OPT_NOCAFILE, OPT_NOCAPATH,
OPT_VALIDITY_PERIOD, OPT_STATUS_AGE, OPT_SIGNKEY, OPT_REQOUT,
OPT_RESPOUT, OPT_PATH, OPT_ISSUER, OPT_CERT, OPT_SERIAL,
OPT_INDEX, OPT_CA, OPT_NMIN, OPT_REQUEST, OPT_NDAYS, OPT_RSIGNER,
"Additional certificates to search for signer"},
{"CAfile", OPT_CAFILE, '<', "Trusted certificates file"},
{"CApath", OPT_CAPATH, '<', "Trusted certificates directory"},
+ {"no-CAfile", OPT_NOCAFILE, '-',
+ "Do not load the default certificates file"},
+ {"no-CApath", OPT_NOCAPATH, '-',
+ "Do not load certificates from the default certificates directory"},
{"validity_period", OPT_VALIDITY_PERIOD, 'u',
"Maximum validity discrepancy in seconds"},
{"status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds"},
char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
char *signfile = NULL, *keyfile = NULL;
char *thost = NULL, *tport = NULL, *tpath = NULL;
+ int noCAfile = 0, noCApath = 0;
int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1;
int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1;
int req_text = 0, resp_text = 0, req_timeout = -1, ret = 1;
req_timeout = atoi(opt_arg());
break;
case OPT_URL:
- if (thost)
- OPENSSL_free(thost);
- if (tport)
- OPENSSL_free(tport);
- if (tpath)
- OPENSSL_free(tpath);
+ OPENSSL_free(thost);
+ OPENSSL_free(tport);
+ OPENSSL_free(tpath);
+ thost = tport = tpath = NULL;
if (!OCSP_parse_url(opt_arg(), &host, &port, &path, &use_ssl)) {
BIO_printf(bio_err, "%s Error parsing URL\n", prog);
goto end;
case OPT_CAPATH:
CApath = opt_arg();
break;
+ case OPT_NOCAFILE:
+ noCAfile = 1;
+ break;
+ case OPT_NOCAPATH:
+ noCApath = 1;
+ break;
case OPT_V_CASES:
if (!opt_verify(o, vpm))
goto end;
path = opt_arg();
break;
case OPT_ISSUER:
- X509_free(issuer);
issuer = load_cert(opt_arg(), FORMAT_PEM,
NULL, NULL, "issuer certificate");
if (issuer == NULL)
goto end;
- if ((issuers = sk_X509_new_null()) == NULL)
- goto end;
+ if (issuers == NULL) {
+ if ((issuers = sk_X509_new_null()) == NULL)
+ goto end;
+ }
sk_X509_push(issuers, issuer);
break;
case OPT_CERT:
if (!req && !reqin && !respin && !(port && ridx_filename))
goto opthelp;
- out = bio_open_default(outfile, "w");
+ out = bio_open_default(outfile, 'w', FORMAT_TEXT);
if (out == NULL)
goto end;
add_nonce = 0;
if (!req && reqin) {
- derbio = bio_open_default(reqin, "rb");
+ derbio = bio_open_default(reqin, 'r', FORMAT_ASN1);
if (derbio == NULL)
goto end;
req = d2i_OCSP_REQUEST_bio(derbio, NULL);
OCSP_REQUEST_print(out, req, 0);
if (reqout) {
- derbio = bio_open_default(reqout, "wb");
+ derbio = bio_open_default(reqout, 'w', FORMAT_ASN1);
if (derbio == NULL)
goto end;
i2d_OCSP_REQUEST_bio(derbio, req);
goto end;
# endif
} else if (respin) {
- derbio = bio_open_default(respin, "rb");
+ derbio = bio_open_default(respin, 'r', FORMAT_ASN1);
if (derbio == NULL)
goto end;
resp = d2i_OCSP_RESPONSE_bio(derbio, NULL);
done_resp:
if (respout) {
- derbio = bio_open_default(respout, "wb");
+ derbio = bio_open_default(respout, 'w', FORMAT_ASN1);
if (derbio == NULL)
goto end;
i2d_OCSP_RESPONSE_bio(derbio, resp);
/* If running as responder don't verify our own response */
if (cbio) {
- if (--accept_count <= 0) {
+ /* If not unlimited, see if we took all we should. */
+ if (accept_count != -1 && --accept_count <= 0) {
ret = 0;
goto end;
}
}
if (!store) {
- store = setup_verify(CAfile, CApath);
+ store = setup_verify(CAfile, CApath, noCAfile, noCApath);
if (!store)
goto end;
}
ERR_print_errors(bio_err);
X509_free(signer);
X509_STORE_free(store);
- if (vpm)
- X509_VERIFY_PARAM_free(vpm);
+ X509_VERIFY_PARAM_free(vpm);
EVP_PKEY_free(key);
EVP_PKEY_free(rkey);
X509_free(cert);
+ sk_X509_pop_free(issuers, X509_free);
X509_free(rsigner);
X509_free(rca_cert);
free_index(rdb);
sk_X509_pop_free(sign_other, X509_free);
sk_X509_pop_free(verify_other, X509_free);
sk_CONF_VALUE_pop_free(headers, X509V3_conf_free);
-
- if (thost)
- OPENSSL_free(thost);
- if (tport)
- OPENSSL_free(tport);
- if (tpath)
- OPENSSL_free(tpath);
+ OPENSSL_free(thost);
+ OPENSSL_free(tport);
+ OPENSSL_free(tpath);
return (ret);
}
NULL);
goto end;
}
- if (ca_id)
- OCSP_CERTID_free(ca_id);
+ OCSP_CERTID_free(ca_id);
ca_id = OCSP_cert_to_id(cert_id_md, NULL, ca);
/* Is this request about our CA? */
{
BIO *acbio = NULL, *bufbio = NULL;
- bufbio = BIO_new(BIO_f_buffer());
- if (!bufbio)
- goto err;
-# ifndef OPENSSL_NO_SOCK
- acbio = BIO_new_accept(port);
-# else
+# ifdef OPENSSL_NO_SOCK
BIO_printf(bio_err,
"Error setting up accept BIO - sockets not supported.\n");
+ return NULL;
# endif
- if (!acbio)
+ bufbio = BIO_new(BIO_f_buffer());
+ if (!bufbio)
+ goto err;
+ acbio = BIO_new(BIO_s_accept());
+ if (acbio == NULL
+ || BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) < 0
+ || BIO_set_accept_port(acbio, port) < 0) {
+ BIO_printf(bio_err, "Error setting up accept BIO\n");
+ ERR_print_errors(bio_err);
goto err;
+ }
+
BIO_set_accept_bios(acbio, bufbio);
bufbio = NULL;
-
if (BIO_do_accept(acbio) <= 0) {
- BIO_printf(bio_err, "Error setting up accept BIO\n");
+ BIO_printf(bio_err, "Error starting accept\n");
ERR_print_errors(bio_err);
goto err;
}
return NULL;
}
+
+/*
+ * Decode %xx URL-decoding in-place. Ignores mal-formed sequences.
+ */
+static int urldecode(char *p)
+{
+ unsigned char *out = (unsigned char *)p;
+ unsigned char *save = out;
+
+ for (; *p; p++) {
+ if (*p != '%')
+ *out++ = *p;
+ else if (isxdigit(p[1]) && isxdigit(p[2])) {
+ *out++ = (app_hex(p[1]) << 4) | app_hex(p[2]);
+ p += 2;
+ }
+ else
+ return -1;
+ }
+ *out = '\0';
+ return (int)(out - save);
+}
+
static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio,
const char *port)
{
int len;
OCSP_REQUEST *req = NULL;
- char inbuf[2048];
- BIO *cbio = NULL;
+ char inbuf[2048], reqbuf[2048];
+ char *p, *q;
+ BIO *cbio = NULL, *getbio = NULL, *b64 = NULL;
if (BIO_do_accept(acbio) <= 0) {
BIO_printf(bio_err, "Error accepting connection\n");
*pcbio = cbio;
/* Read the request line. */
- len = BIO_gets(cbio, inbuf, sizeof inbuf);
+ len = BIO_gets(cbio, reqbuf, sizeof reqbuf);
if (len <= 0)
return 1;
- if (strncmp(inbuf, "POST", 4) != 0) {
- BIO_printf(bio_err, "Invalid request\n");
+ if (strncmp(reqbuf, "GET ", 4) == 0) {
+ /* Expecting GET {sp} /URL {sp} HTTP/1.x */
+ for (p = reqbuf + 4; *p == ' '; ++p)
+ continue;
+ if (*p != '/') {
+ BIO_printf(bio_err, "Invalid request -- bad URL\n");
+ return 1;
+ }
+ p++;
+
+ /* Splice off the HTTP version identifier. */
+ for (q = p; *q; q++)
+ if (*q == ' ')
+ break;
+ if (strncmp(q, " HTTP/1.", 8) != 0) {
+ BIO_printf(bio_err, "Invalid request -- bad HTTP vesion\n");
+ return 1;
+ }
+ *q = '\0';
+ len = urldecode(p);
+ if (len <= 0) {
+ BIO_printf(bio_err, "Invalid request -- bad URL encoding\n");
+ return 1;
+ }
+ if ((getbio = BIO_new_mem_buf(p, len)) == NULL
+ || (b64 = BIO_new(BIO_f_base64())) == NULL) {
+ BIO_printf(bio_err, "Could not allocate memory\n");
+ ERR_print_errors(bio_err);
+ return 1;
+ }
+ BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
+ getbio = BIO_push(b64, getbio);
+ } else if (strncmp(reqbuf, "POST ", 5) != 0) {
+ BIO_printf(bio_err, "Invalid request -- bad HTTP verb\n");
return 1;
}
+
+ /* Read and skip past the headers. */
for (;;) {
len = BIO_gets(cbio, inbuf, sizeof inbuf);
if (len <= 0)
return 1;
- /* Look for end of headers */
if ((inbuf[0] == '\r') || (inbuf[0] == '\n'))
break;
}
/* Try to read OCSP request */
- req = d2i_OCSP_REQUEST_bio(cbio, NULL);
+ if (getbio) {
+ req = d2i_OCSP_REQUEST_bio(getbio, NULL);
+ BIO_free_all(getbio);
+ } else
+ req = d2i_OCSP_REQUEST_bio(cbio, NULL);
if (!req) {
BIO_printf(bio_err, "Error parsing OCSP request\n");
}
err:
- if (ctx)
- OCSP_REQ_CTX_free(ctx);
+ OCSP_REQ_CTX_free(ctx);
return rsp;
}
OCSP_RESPONSE *process_responder(OCSP_REQUEST *req,
const char *host, const char *path,
const char *port, int use_ssl,
- const STACK_OF(CONF_VALUE) *headers,
+ STACK_OF(CONF_VALUE) *headers,
int req_timeout)
{
BIO *cbio = NULL;
SSL_CTX *ctx = NULL;
OCSP_RESPONSE *resp = NULL;
+ int found, i;
+
cbio = BIO_new_connect(host);
if (!cbio) {
BIO_printf(bio_err, "Error creating connect BIO\n");
BIO_set_conn_port(cbio, port);
if (use_ssl == 1) {
BIO *sbio;
- ctx = SSL_CTX_new(SSLv23_client_method());
+ ctx = SSL_CTX_new(TLS_client_method());
if (ctx == NULL) {
BIO_printf(bio_err, "Error creating SSL context.\n");
goto end;
sbio = BIO_new_ssl(ctx, 1);
cbio = BIO_push(sbio, cbio);
}
+ for (found = i = 0; i < sk_CONF_VALUE_num(headers); i++) {
+ CONF_VALUE *hdr = sk_CONF_VALUE_value(headers, i);
+ if (strcasecmp("host", hdr->name) == 0) {
+ found = 1;
+ break;
+ }
+ }
+
+ if (!found && !X509V3_add_value("Host", host, &headers))
+ BIO_printf(bio_err, "Error setting HTTP Host header\n");
+
resp = query_responder(cbio, path, headers, req, req_timeout);
if (!resp)
BIO_printf(bio_err, "Error querying OCSP responder\n");
projects / openssl.git / blobdiff