1c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org/* ocsp_srv.c */ 2c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL 3c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * project 2001. 4c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org */ 5c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org/* ==================================================================== 6c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved. 7c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 8c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * Redistribution and use in source and binary forms, with or without 9c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * modification, are permitted provided that the following conditions 10c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * are met: 11c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 12c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 1. Redistributions of source code must retain the above copyright 13c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * notice, this list of conditions and the following disclaimer. 14c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 15c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 2. Redistributions in binary form must reproduce the above copyright 16c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * notice, this list of conditions and the following disclaimer in 17c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * the documentation and/or other materials provided with the 18c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * distribution. 19c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 20c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 3. All advertising materials mentioning features or use of this 21c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * software must display the following acknowledgment: 22c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * "This product includes software developed by the OpenSSL Project 23c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 24c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 25c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * endorse or promote products derived from this software without 27c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * prior written permission. For written permission, please contact 28c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * openssl-core@openssl.org. 29c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 30c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 5. Products derived from this software may not be called "OpenSSL" 31c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * nor may "OpenSSL" appear in their names without prior written 32c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * permission of the OpenSSL Project. 33c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 34c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 6. Redistributions of any form whatsoever must retain the following 35c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * acknowledgment: 36c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * "This product includes software developed by the OpenSSL Project 37c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 38c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 39c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * OF THE POSSIBILITY OF SUCH DAMAGE. 51c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * ==================================================================== 52c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 53c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * This product includes cryptographic software written by Eric Young 54c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * (eay@cryptsoft.com). This product includes software written by Tim 55c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * Hudson (tjh@cryptsoft.com). 56c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * 57c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org */ 58c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 59c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org#include <stdio.h> 60c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org#include <cryptlib.h> 61c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org#include <openssl/objects.h> 62c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org#include <openssl/rand.h> 63c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org#include <openssl/x509.h> 64c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org#include <openssl/pem.h> 65c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org#include <openssl/x509v3.h> 66c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org#include <openssl/ocsp.h> 67c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 68c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org/* Utility functions related to sending OCSP responses and extracting 69c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org * relevant information from the request. 70c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org */ 71c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 72c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.orgint OCSP_request_onereq_count(OCSP_REQUEST *req) 73c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 74c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return sk_OCSP_ONEREQ_num(req->tbsRequest->requestList); 75c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 76c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 77c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.orgOCSP_ONEREQ *OCSP_request_onereq_get0(OCSP_REQUEST *req, int i) 78c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 79c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return sk_OCSP_ONEREQ_value(req->tbsRequest->requestList, i); 80c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 81c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 82c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.orgOCSP_CERTID *OCSP_onereq_get0_id(OCSP_ONEREQ *one) 83c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 84c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return one->reqCert; 85c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 86c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 87c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.orgint OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd, 88c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org ASN1_OCTET_STRING **pikeyHash, 89c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org ASN1_INTEGER **pserial, OCSP_CERTID *cid) 90c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 91c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!cid) return 0; 92c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (pmd) *pmd = cid->hashAlgorithm->algorithm; 93c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if(piNameHash) *piNameHash = cid->issuerNameHash; 94c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (pikeyHash) *pikeyHash = cid->issuerKeyHash; 95c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (pserial) *pserial = cid->serialNumber; 96c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return 1; 97c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 98c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 99c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.orgint OCSP_request_is_signed(OCSP_REQUEST *req) 100c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 101c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if(req->optionalSignature) return 1; 102c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return 0; 103c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 104c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 105c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org/* Create an OCSP response and encode an optional basic response */ 106c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.orgOCSP_RESPONSE *OCSP_response_create(int status, OCSP_BASICRESP *bs) 107c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 108c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org OCSP_RESPONSE *rsp = NULL; 109c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 110c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!(rsp = OCSP_RESPONSE_new())) goto err; 111c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!(ASN1_ENUMERATED_set(rsp->responseStatus, status))) goto err; 112c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!bs) return rsp; 113c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!(rsp->responseBytes = OCSP_RESPBYTES_new())) goto err; 114c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org rsp->responseBytes->responseType = OBJ_nid2obj(NID_id_pkix_OCSP_basic); 115c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!ASN1_item_pack(bs, ASN1_ITEM_rptr(OCSP_BASICRESP), &rsp->responseBytes->response)) 116c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 117c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return rsp; 118c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.orgerr: 119c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (rsp) OCSP_RESPONSE_free(rsp); 120c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return NULL; 121c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 122c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 123c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 124c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.orgOCSP_SINGLERESP *OCSP_basic_add1_status(OCSP_BASICRESP *rsp, 125c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org OCSP_CERTID *cid, 126c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org int status, int reason, 127c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org ASN1_TIME *revtime, 128c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org ASN1_TIME *thisupd, ASN1_TIME *nextupd) 129c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 130c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org OCSP_SINGLERESP *single = NULL; 131c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org OCSP_CERTSTATUS *cs; 132c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org OCSP_REVOKEDINFO *ri; 133c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 134c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if(!rsp->tbsResponseData->responses && 135c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org !(rsp->tbsResponseData->responses = sk_OCSP_SINGLERESP_new_null())) 136c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 137c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 138c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!(single = OCSP_SINGLERESP_new())) 139c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 140c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 141c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 142c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 143c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!ASN1_TIME_to_generalizedtime(thisupd, &single->thisUpdate)) 144c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 145c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (nextupd && 146c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org !ASN1_TIME_to_generalizedtime(nextupd, &single->nextUpdate)) 147c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 148c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 149c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org OCSP_CERTID_free(single->certId); 150c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 151c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if(!(single->certId = OCSP_CERTID_dup(cid))) 152c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 153c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 154c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org cs = single->certStatus; 155c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org switch(cs->type = status) 156c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 157c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org case V_OCSP_CERTSTATUS_REVOKED: 158c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!revtime) 159c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 160c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org OCSPerr(OCSP_F_OCSP_BASIC_ADD1_STATUS,OCSP_R_NO_REVOKED_TIME); 161c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 162c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 163c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!(cs->value.revoked = ri = OCSP_REVOKEDINFO_new())) goto err; 164c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!ASN1_TIME_to_generalizedtime(revtime, &ri->revocationTime)) 165c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 166c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (reason != OCSP_REVOKED_STATUS_NOSTATUS) 167c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 168c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!(ri->revocationReason = ASN1_ENUMERATED_new())) 169c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 170c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!(ASN1_ENUMERATED_set(ri->revocationReason, 171c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org reason))) 172c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 173c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 174c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org break; 175c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 176c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org case V_OCSP_CERTSTATUS_GOOD: 177c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org cs->value.good = ASN1_NULL_new(); 178c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org break; 179c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 180c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org case V_OCSP_CERTSTATUS_UNKNOWN: 181c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org cs->value.unknown = ASN1_NULL_new(); 182c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org break; 183c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 184c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org default: 185c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 186c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 187c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 188c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!(sk_OCSP_SINGLERESP_push(rsp->tbsResponseData->responses, single))) 189c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 190c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return single; 191c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.orgerr: 192c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org OCSP_SINGLERESP_free(single); 193c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return NULL; 194c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 195c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 196c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org/* Add a certificate to an OCSP request */ 197c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 198c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.orgint OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert) 199c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 200c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!resp->certs && !(resp->certs = sk_X509_new_null())) 201c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return 0; 202c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 203c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if(!sk_X509_push(resp->certs, cert)) return 0; 204c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509); 205c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return 1; 206c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 207c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 208c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.orgint OCSP_basic_sign(OCSP_BASICRESP *brsp, 209c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org X509 *signer, EVP_PKEY *key, const EVP_MD *dgst, 210c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org STACK_OF(X509) *certs, unsigned long flags) 211c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 212c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org int i; 213c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org OCSP_RESPID *rid; 214c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 215c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!X509_check_private_key(signer, key)) 216c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 217c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org OCSPerr(OCSP_F_OCSP_BASIC_SIGN, OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); 218c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 219c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 220c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 221c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if(!(flags & OCSP_NOCERTS)) 222c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 223c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if(!OCSP_basic_add1_cert(brsp, signer)) 224c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 225c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org for (i = 0; i < sk_X509_num(certs); i++) 226c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 227c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org X509 *tmpcert = sk_X509_value(certs, i); 228c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if(!OCSP_basic_add1_cert(brsp, tmpcert)) 229c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 230c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 231c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 232c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 233c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org rid = brsp->tbsResponseData->responderId; 234c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (flags & OCSP_RESPID_KEY) 235c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 236c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org unsigned char md[SHA_DIGEST_LENGTH]; 237c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org X509_pubkey_digest(signer, EVP_sha1(), md, NULL); 238c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!(rid->value.byKey = ASN1_OCTET_STRING_new())) 239c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 240c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!(ASN1_OCTET_STRING_set(rid->value.byKey, md, SHA_DIGEST_LENGTH))) 241c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 242c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org rid->type = V_OCSP_RESPID_KEY; 243c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 244c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org else 245c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org { 246c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!X509_NAME_set(&rid->value.byName, 247c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org X509_get_subject_name(signer))) 248c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 249c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org rid->type = V_OCSP_RESPID_NAME; 250c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 251c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 252c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!(flags & OCSP_NOTIME) && 253c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org !X509_gmtime_adj(brsp->tbsResponseData->producedAt, 0)) 254c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org goto err; 255c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 256c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org /* Right now, I think that not doing double hashing is the right 257c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org thing. -- Richard Levitte */ 258c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 259c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org if (!OCSP_BASICRESP_sign(brsp, key, dgst, 0)) goto err; 260c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org 261c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return 1; 262c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.orgerr: 263c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org return 0; 264c9490d33b98b7affb729b5f1db13cb0a348471aagl@chromium.org } 265