X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=apps%2Focsp.c;h=7a5f84e527d0eae46b172c4023e8740d1ca3c327;hp=d8e45ccd4388ba5510f8738cc37841782ec6c694;hb=HEAD;hpb=79b2a2f2eedb9d6b24a3f6748332328cf54568fb diff --git a/apps/ocsp.c b/apps/ocsp.c index d8e45ccd43..4b682dca92 100644 --- a/apps/ocsp.c +++ b/apps/ocsp.c @@ -1,5 +1,5 @@ /* - * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2001-2023 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -33,12 +33,6 @@ #include #include -#if defined(__TANDEM) -# if defined(OPENSSL_TANDEM_FLOSS) -# include -# endif -#endif - #if defined(OPENSSL_SYS_VXWORKS) /* not supported */ int setpgid(pid_t pid, pid_t pgid) @@ -135,8 +129,8 @@ const OPTIONS ocsp_options[] = { {"no_certs", OPT_NO_CERTS, '-', "Don't include any certificates in signed request"}, {"badsig", OPT_BADSIG, '-', - "Corrupt last byte of loaded OSCP response signature (for test)"}, - {"CA", OPT_CA, '<', "CA certificate"}, + "Corrupt last byte of loaded OCSP response signature (for test)"}, + {"CA", OPT_CA, '<', "CA certificates"}, {"nmin", OPT_NMIN, 'p', "Number of minutes before next update"}, {"nrequest", OPT_REQUEST, 'p', "Number of requests to accept (default unlimited)"}, @@ -196,8 +190,10 @@ const OPTIONS ocsp_options[] = { {"VAfile", OPT_VAFILE, '<', "Validator certificates file"}, {"verify_other", OPT_VERIFY_OTHER, '<', "Additional certificates to search for signer"}, - {"cert", OPT_CERT, '<', "Certificate to check"}, - {"serial", OPT_SERIAL, 's', "Serial number to check"}, + {"cert", OPT_CERT, '<', + "Certificate to check; may be given multiple times"}, + {"serial", OPT_SERIAL, 's', + "Serial number to check; may be given multiple times"}, {"validity_period", OPT_VALIDITY_PERIOD, 'u', "Maximum validity discrepancy in seconds"}, {"signkey", OPT_SIGNKEY, 's', "Private key to sign OCSP request with"}, @@ -228,7 +224,7 @@ int ocsp_main(int argc, char **argv) STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL; STACK_OF(X509) *issuers = NULL; X509 *issuer = NULL, *cert = NULL; - STACK_OF(X509) *rca_cert = NULL; + STACK_OF(X509) *rca_certs = NULL; EVP_MD *resp_certid_md = NULL; X509 *signer = NULL, *rsigner = NULL; X509_STORE *store = NULL; @@ -261,6 +257,7 @@ int ocsp_main(int argc, char **argv) || (vpm = X509_VERIFY_PARAM_new()) == NULL) goto end; + opt_set_unknown_name("digest"); prog = opt_init(argc, argv, ocsp_options); while ((o = opt_next()) != OPT_EOF) { switch (o) { @@ -436,6 +433,7 @@ int ocsp_main(int argc, char **argv) goto end; break; case OPT_CERT: + reset_unknown(); X509_free(cert); cert = load_cert(opt_arg(), FORMAT_UNDEF, "certificate"); if (cert == NULL) @@ -449,6 +447,7 @@ int ocsp_main(int argc, char **argv) trailing_md = 0; break; case OPT_SERIAL: + reset_unknown(); if (cert_id_md == NULL) cert_id_md = (EVP_MD *)EVP_sha1(); if (!add_ocsp_serial(&req, opt_arg(), cert_id_md, issuer, ids)) @@ -524,7 +523,7 @@ int ocsp_main(int argc, char **argv) break; case OPT_MULTI: #ifdef HTTP_DAEMON - multi = atoi(opt_arg()); + n_responders = atoi(opt_arg()); #endif break; case OPT_PROV_CASES: @@ -592,7 +591,7 @@ int ocsp_main(int argc, char **argv) BIO_printf(bio_err, "Error loading responder certificate\n"); goto end; } - if (!load_certs(rca_filename, 0, &rca_cert, NULL, "CA certificates")) + if (!load_certs(rca_filename, 0, &rca_certs, NULL, "CA certificates")) goto end; if (rcertfile != NULL) { if (!load_certs(rcertfile, 0, &rother, NULL, @@ -610,7 +609,7 @@ int ocsp_main(int argc, char **argv) } if (ridx_filename != NULL - && (rkey == NULL || rsigner == NULL || rca_cert == NULL)) { + && (rkey == NULL || rsigner == NULL || rca_certs == NULL)) { BIO_printf(bio_err, "Responder mode requires certificate, key, and CA.\n"); goto end; @@ -628,14 +627,15 @@ int ocsp_main(int argc, char **argv) } #ifdef HTTP_DAEMON - if (multi && acbio != NULL) + if (n_responders != 0 && acbio != NULL) spawn_loop(prog); if (acbio != NULL && req_timeout > 0) signal(SIGALRM, socket_timeout); #endif if (acbio != NULL) - log_message(prog, LOG_INFO, "waiting for OCSP client connections..."); + trace_log_message(-1, prog, + LOG_INFO, "waiting for OCSP client connections..."); redo_accept: @@ -649,8 +649,9 @@ redo_accept: rdb = newrdb; } else { free_index(newrdb); - log_message(prog, LOG_ERR, "error reloading updated index: %s", - ridx_filename); + trace_log_message(-1, prog, + LOG_ERR, "error reloading updated index: %s", + ridx_filename); } } #endif @@ -720,9 +721,11 @@ redo_accept: } if (rdb != NULL) { - make_ocsp_response(bio_err, &resp, req, rdb, rca_cert, rsigner, rkey, + make_ocsp_response(bio_err, &resp, req, rdb, rca_certs, rsigner, rkey, rsign_md, rsign_sigopts, rother, rflags, nmin, ndays, badsig, resp_certid_md); + if (resp == NULL) + goto end; if (cbio != NULL) send_ocsp_response(cbio, resp); } else if (host != NULL) { @@ -857,7 +860,7 @@ redo_accept: X509_free(cert); OSSL_STACK_OF_X509_free(issuers); X509_free(rsigner); - OSSL_STACK_OF_X509_free(rca_cert); + OSSL_STACK_OF_X509_free(rca_certs); free_index(rdb); BIO_free_all(cbio); BIO_free_all(acbio); @@ -1114,6 +1117,11 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req single = OCSP_basic_add1_status(bs, cid, V_OCSP_CERTSTATUS_REVOKED, reason, revtm, thisupd, nextupd); + if (single == NULL) { + *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, + NULL); + goto end; + } if (invtm != NULL) OCSP_SINGLERESP_add1_ext_i2d(single, NID_invalidity_date, invtm, 0, 0); @@ -1175,10 +1183,12 @@ static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser) bn = ASN1_INTEGER_to_BN(ser, NULL); OPENSSL_assert(bn); /* FIXME: should report an error at this * point and abort */ - if (BN_is_zero(bn)) + if (BN_is_zero(bn)) { itmp = OPENSSL_strdup("00"); - else + OPENSSL_assert(itmp); + } else { itmp = BN_bn2hex(bn); + } row[DB_serial] = itmp; BN_free(bn); rrow = TXT_DB_get_by_index(db->db, DB_serial, row); @@ -1205,7 +1215,7 @@ static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio, static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp) { #ifndef OPENSSL_NO_SOCK - return http_server_send_asn1_resp(cbio, + return http_server_send_asn1_resp(prog, cbio, 0 /* no keep-alive */, "application/ocsp-response", ASN1_ITEM_rptr(OCSP_RESPONSE),