1*0Sstevel@tonic-gate /* ocsp_ext.c */ 2*0Sstevel@tonic-gate /* Written by Tom Titchener <Tom_Titchener@groove.net> for the OpenSSL 3*0Sstevel@tonic-gate * project. */ 4*0Sstevel@tonic-gate 5*0Sstevel@tonic-gate /* History: 6*0Sstevel@tonic-gate This file was transfered to Richard Levitte from CertCo by Kathy 7*0Sstevel@tonic-gate Weinhold in mid-spring 2000 to be included in OpenSSL or released 8*0Sstevel@tonic-gate as a patch kit. */ 9*0Sstevel@tonic-gate 10*0Sstevel@tonic-gate /* ==================================================================== 11*0Sstevel@tonic-gate * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. 12*0Sstevel@tonic-gate * 13*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 14*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 15*0Sstevel@tonic-gate * are met: 16*0Sstevel@tonic-gate * 17*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright 18*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 21*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in 22*0Sstevel@tonic-gate * the documentation and/or other materials provided with the 23*0Sstevel@tonic-gate * distribution. 24*0Sstevel@tonic-gate * 25*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this 26*0Sstevel@tonic-gate * software must display the following acknowledgment: 27*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 28*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 29*0Sstevel@tonic-gate * 30*0Sstevel@tonic-gate * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 31*0Sstevel@tonic-gate * endorse or promote products derived from this software without 32*0Sstevel@tonic-gate * prior written permission. For written permission, please contact 33*0Sstevel@tonic-gate * openssl-core@openssl.org. 34*0Sstevel@tonic-gate * 35*0Sstevel@tonic-gate * 5. Products derived from this software may not be called "OpenSSL" 36*0Sstevel@tonic-gate * nor may "OpenSSL" appear in their names without prior written 37*0Sstevel@tonic-gate * permission of the OpenSSL Project. 38*0Sstevel@tonic-gate * 39*0Sstevel@tonic-gate * 6. Redistributions of any form whatsoever must retain the following 40*0Sstevel@tonic-gate * acknowledgment: 41*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 42*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 43*0Sstevel@tonic-gate * 44*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 45*0Sstevel@tonic-gate * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 46*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 47*0Sstevel@tonic-gate * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 48*0Sstevel@tonic-gate * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 49*0Sstevel@tonic-gate * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 50*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 51*0Sstevel@tonic-gate * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 52*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 53*0Sstevel@tonic-gate * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 54*0Sstevel@tonic-gate * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 55*0Sstevel@tonic-gate * OF THE POSSIBILITY OF SUCH DAMAGE. 56*0Sstevel@tonic-gate * ==================================================================== 57*0Sstevel@tonic-gate * 58*0Sstevel@tonic-gate * This product includes cryptographic software written by Eric Young 59*0Sstevel@tonic-gate * (eay@cryptsoft.com). This product includes software written by Tim 60*0Sstevel@tonic-gate * Hudson (tjh@cryptsoft.com). 61*0Sstevel@tonic-gate * 62*0Sstevel@tonic-gate */ 63*0Sstevel@tonic-gate 64*0Sstevel@tonic-gate #include <stdio.h> 65*0Sstevel@tonic-gate #include <cryptlib.h> 66*0Sstevel@tonic-gate #include <openssl/objects.h> 67*0Sstevel@tonic-gate #include <openssl/x509.h> 68*0Sstevel@tonic-gate #include <openssl/ocsp.h> 69*0Sstevel@tonic-gate #include <openssl/rand.h> 70*0Sstevel@tonic-gate #include <openssl/x509v3.h> 71*0Sstevel@tonic-gate 72*0Sstevel@tonic-gate /* Standard wrapper functions for extensions */ 73*0Sstevel@tonic-gate 74*0Sstevel@tonic-gate /* OCSP request extensions */ 75*0Sstevel@tonic-gate 76*0Sstevel@tonic-gate int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x) 77*0Sstevel@tonic-gate { 78*0Sstevel@tonic-gate return(X509v3_get_ext_count(x->tbsRequest->requestExtensions)); 79*0Sstevel@tonic-gate } 80*0Sstevel@tonic-gate 81*0Sstevel@tonic-gate int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos) 82*0Sstevel@tonic-gate { 83*0Sstevel@tonic-gate return(X509v3_get_ext_by_NID(x->tbsRequest->requestExtensions,nid,lastpos)); 84*0Sstevel@tonic-gate } 85*0Sstevel@tonic-gate 86*0Sstevel@tonic-gate int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj, int lastpos) 87*0Sstevel@tonic-gate { 88*0Sstevel@tonic-gate return(X509v3_get_ext_by_OBJ(x->tbsRequest->requestExtensions,obj,lastpos)); 89*0Sstevel@tonic-gate } 90*0Sstevel@tonic-gate 91*0Sstevel@tonic-gate int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos) 92*0Sstevel@tonic-gate { 93*0Sstevel@tonic-gate return(X509v3_get_ext_by_critical(x->tbsRequest->requestExtensions,crit,lastpos)); 94*0Sstevel@tonic-gate } 95*0Sstevel@tonic-gate 96*0Sstevel@tonic-gate X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc) 97*0Sstevel@tonic-gate { 98*0Sstevel@tonic-gate return(X509v3_get_ext(x->tbsRequest->requestExtensions,loc)); 99*0Sstevel@tonic-gate } 100*0Sstevel@tonic-gate 101*0Sstevel@tonic-gate X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc) 102*0Sstevel@tonic-gate { 103*0Sstevel@tonic-gate return(X509v3_delete_ext(x->tbsRequest->requestExtensions,loc)); 104*0Sstevel@tonic-gate } 105*0Sstevel@tonic-gate 106*0Sstevel@tonic-gate void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx) 107*0Sstevel@tonic-gate { 108*0Sstevel@tonic-gate return X509V3_get_d2i(x->tbsRequest->requestExtensions, nid, crit, idx); 109*0Sstevel@tonic-gate } 110*0Sstevel@tonic-gate 111*0Sstevel@tonic-gate int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, int crit, 112*0Sstevel@tonic-gate unsigned long flags) 113*0Sstevel@tonic-gate { 114*0Sstevel@tonic-gate return X509V3_add1_i2d(&x->tbsRequest->requestExtensions, nid, value, crit, flags); 115*0Sstevel@tonic-gate } 116*0Sstevel@tonic-gate 117*0Sstevel@tonic-gate int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc) 118*0Sstevel@tonic-gate { 119*0Sstevel@tonic-gate return(X509v3_add_ext(&(x->tbsRequest->requestExtensions),ex,loc) != NULL); 120*0Sstevel@tonic-gate } 121*0Sstevel@tonic-gate 122*0Sstevel@tonic-gate /* Single extensions */ 123*0Sstevel@tonic-gate 124*0Sstevel@tonic-gate int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x) 125*0Sstevel@tonic-gate { 126*0Sstevel@tonic-gate return(X509v3_get_ext_count(x->singleRequestExtensions)); 127*0Sstevel@tonic-gate } 128*0Sstevel@tonic-gate 129*0Sstevel@tonic-gate int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos) 130*0Sstevel@tonic-gate { 131*0Sstevel@tonic-gate return(X509v3_get_ext_by_NID(x->singleRequestExtensions,nid,lastpos)); 132*0Sstevel@tonic-gate } 133*0Sstevel@tonic-gate 134*0Sstevel@tonic-gate int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj, int lastpos) 135*0Sstevel@tonic-gate { 136*0Sstevel@tonic-gate return(X509v3_get_ext_by_OBJ(x->singleRequestExtensions,obj,lastpos)); 137*0Sstevel@tonic-gate } 138*0Sstevel@tonic-gate 139*0Sstevel@tonic-gate int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos) 140*0Sstevel@tonic-gate { 141*0Sstevel@tonic-gate return(X509v3_get_ext_by_critical(x->singleRequestExtensions,crit,lastpos)); 142*0Sstevel@tonic-gate } 143*0Sstevel@tonic-gate 144*0Sstevel@tonic-gate X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc) 145*0Sstevel@tonic-gate { 146*0Sstevel@tonic-gate return(X509v3_get_ext(x->singleRequestExtensions,loc)); 147*0Sstevel@tonic-gate } 148*0Sstevel@tonic-gate 149*0Sstevel@tonic-gate X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc) 150*0Sstevel@tonic-gate { 151*0Sstevel@tonic-gate return(X509v3_delete_ext(x->singleRequestExtensions,loc)); 152*0Sstevel@tonic-gate } 153*0Sstevel@tonic-gate 154*0Sstevel@tonic-gate void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx) 155*0Sstevel@tonic-gate { 156*0Sstevel@tonic-gate return X509V3_get_d2i(x->singleRequestExtensions, nid, crit, idx); 157*0Sstevel@tonic-gate } 158*0Sstevel@tonic-gate 159*0Sstevel@tonic-gate int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit, 160*0Sstevel@tonic-gate unsigned long flags) 161*0Sstevel@tonic-gate { 162*0Sstevel@tonic-gate return X509V3_add1_i2d(&x->singleRequestExtensions, nid, value, crit, flags); 163*0Sstevel@tonic-gate } 164*0Sstevel@tonic-gate 165*0Sstevel@tonic-gate int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc) 166*0Sstevel@tonic-gate { 167*0Sstevel@tonic-gate return(X509v3_add_ext(&(x->singleRequestExtensions),ex,loc) != NULL); 168*0Sstevel@tonic-gate } 169*0Sstevel@tonic-gate 170*0Sstevel@tonic-gate /* OCSP Basic response */ 171*0Sstevel@tonic-gate 172*0Sstevel@tonic-gate int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x) 173*0Sstevel@tonic-gate { 174*0Sstevel@tonic-gate return(X509v3_get_ext_count(x->tbsResponseData->responseExtensions)); 175*0Sstevel@tonic-gate } 176*0Sstevel@tonic-gate 177*0Sstevel@tonic-gate int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos) 178*0Sstevel@tonic-gate { 179*0Sstevel@tonic-gate return(X509v3_get_ext_by_NID(x->tbsResponseData->responseExtensions,nid,lastpos)); 180*0Sstevel@tonic-gate } 181*0Sstevel@tonic-gate 182*0Sstevel@tonic-gate int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj, int lastpos) 183*0Sstevel@tonic-gate { 184*0Sstevel@tonic-gate return(X509v3_get_ext_by_OBJ(x->tbsResponseData->responseExtensions,obj,lastpos)); 185*0Sstevel@tonic-gate } 186*0Sstevel@tonic-gate 187*0Sstevel@tonic-gate int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit, int lastpos) 188*0Sstevel@tonic-gate { 189*0Sstevel@tonic-gate return(X509v3_get_ext_by_critical(x->tbsResponseData->responseExtensions,crit,lastpos)); 190*0Sstevel@tonic-gate } 191*0Sstevel@tonic-gate 192*0Sstevel@tonic-gate X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc) 193*0Sstevel@tonic-gate { 194*0Sstevel@tonic-gate return(X509v3_get_ext(x->tbsResponseData->responseExtensions,loc)); 195*0Sstevel@tonic-gate } 196*0Sstevel@tonic-gate 197*0Sstevel@tonic-gate X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc) 198*0Sstevel@tonic-gate { 199*0Sstevel@tonic-gate return(X509v3_delete_ext(x->tbsResponseData->responseExtensions,loc)); 200*0Sstevel@tonic-gate } 201*0Sstevel@tonic-gate 202*0Sstevel@tonic-gate void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit, int *idx) 203*0Sstevel@tonic-gate { 204*0Sstevel@tonic-gate return X509V3_get_d2i(x->tbsResponseData->responseExtensions, nid, crit, idx); 205*0Sstevel@tonic-gate } 206*0Sstevel@tonic-gate 207*0Sstevel@tonic-gate int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value, int crit, 208*0Sstevel@tonic-gate unsigned long flags) 209*0Sstevel@tonic-gate { 210*0Sstevel@tonic-gate return X509V3_add1_i2d(&x->tbsResponseData->responseExtensions, nid, value, crit, flags); 211*0Sstevel@tonic-gate } 212*0Sstevel@tonic-gate 213*0Sstevel@tonic-gate int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc) 214*0Sstevel@tonic-gate { 215*0Sstevel@tonic-gate return(X509v3_add_ext(&(x->tbsResponseData->responseExtensions),ex,loc) != NULL); 216*0Sstevel@tonic-gate } 217*0Sstevel@tonic-gate 218*0Sstevel@tonic-gate /* OCSP single response extensions */ 219*0Sstevel@tonic-gate 220*0Sstevel@tonic-gate int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x) 221*0Sstevel@tonic-gate { 222*0Sstevel@tonic-gate return(X509v3_get_ext_count(x->singleExtensions)); 223*0Sstevel@tonic-gate } 224*0Sstevel@tonic-gate 225*0Sstevel@tonic-gate int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos) 226*0Sstevel@tonic-gate { 227*0Sstevel@tonic-gate return(X509v3_get_ext_by_NID(x->singleExtensions,nid,lastpos)); 228*0Sstevel@tonic-gate } 229*0Sstevel@tonic-gate 230*0Sstevel@tonic-gate int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj, int lastpos) 231*0Sstevel@tonic-gate { 232*0Sstevel@tonic-gate return(X509v3_get_ext_by_OBJ(x->singleExtensions,obj,lastpos)); 233*0Sstevel@tonic-gate } 234*0Sstevel@tonic-gate 235*0Sstevel@tonic-gate int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit, int lastpos) 236*0Sstevel@tonic-gate { 237*0Sstevel@tonic-gate return(X509v3_get_ext_by_critical(x->singleExtensions,crit,lastpos)); 238*0Sstevel@tonic-gate } 239*0Sstevel@tonic-gate 240*0Sstevel@tonic-gate X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc) 241*0Sstevel@tonic-gate { 242*0Sstevel@tonic-gate return(X509v3_get_ext(x->singleExtensions,loc)); 243*0Sstevel@tonic-gate } 244*0Sstevel@tonic-gate 245*0Sstevel@tonic-gate X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc) 246*0Sstevel@tonic-gate { 247*0Sstevel@tonic-gate return(X509v3_delete_ext(x->singleExtensions,loc)); 248*0Sstevel@tonic-gate } 249*0Sstevel@tonic-gate 250*0Sstevel@tonic-gate void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit, int *idx) 251*0Sstevel@tonic-gate { 252*0Sstevel@tonic-gate return X509V3_get_d2i(x->singleExtensions, nid, crit, idx); 253*0Sstevel@tonic-gate } 254*0Sstevel@tonic-gate 255*0Sstevel@tonic-gate int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value, int crit, 256*0Sstevel@tonic-gate unsigned long flags) 257*0Sstevel@tonic-gate { 258*0Sstevel@tonic-gate return X509V3_add1_i2d(&x->singleExtensions, nid, value, crit, flags); 259*0Sstevel@tonic-gate } 260*0Sstevel@tonic-gate 261*0Sstevel@tonic-gate int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc) 262*0Sstevel@tonic-gate { 263*0Sstevel@tonic-gate return(X509v3_add_ext(&(x->singleExtensions),ex,loc) != NULL); 264*0Sstevel@tonic-gate } 265*0Sstevel@tonic-gate 266*0Sstevel@tonic-gate /* also CRL Entry Extensions */ 267*0Sstevel@tonic-gate 268*0Sstevel@tonic-gate ASN1_STRING *ASN1_STRING_encode(ASN1_STRING *s, int (*i2d)(), 269*0Sstevel@tonic-gate char *data, STACK_OF(ASN1_OBJECT) *sk) 270*0Sstevel@tonic-gate { 271*0Sstevel@tonic-gate int i; 272*0Sstevel@tonic-gate unsigned char *p, *b = NULL; 273*0Sstevel@tonic-gate 274*0Sstevel@tonic-gate if (data) 275*0Sstevel@tonic-gate { 276*0Sstevel@tonic-gate if ((i=i2d(data,NULL)) <= 0) goto err; 277*0Sstevel@tonic-gate if (!(b=p=(unsigned char*)OPENSSL_malloc((unsigned int)i))) 278*0Sstevel@tonic-gate goto err; 279*0Sstevel@tonic-gate if (i2d(data, &p) <= 0) goto err; 280*0Sstevel@tonic-gate } 281*0Sstevel@tonic-gate else if (sk) 282*0Sstevel@tonic-gate { 283*0Sstevel@tonic-gate if ((i=i2d_ASN1_SET_OF_ASN1_OBJECT(sk,NULL,i2d,V_ASN1_SEQUENCE, 284*0Sstevel@tonic-gate V_ASN1_UNIVERSAL,IS_SEQUENCE))<=0) goto err; 285*0Sstevel@tonic-gate if (!(b=p=(unsigned char*)OPENSSL_malloc((unsigned int)i))) 286*0Sstevel@tonic-gate goto err; 287*0Sstevel@tonic-gate if (i2d_ASN1_SET_OF_ASN1_OBJECT(sk,&p,i2d,V_ASN1_SEQUENCE, 288*0Sstevel@tonic-gate V_ASN1_UNIVERSAL,IS_SEQUENCE)<=0) goto err; 289*0Sstevel@tonic-gate } 290*0Sstevel@tonic-gate else 291*0Sstevel@tonic-gate { 292*0Sstevel@tonic-gate OCSPerr(OCSP_F_ASN1_STRING_ENCODE,OCSP_R_BAD_DATA); 293*0Sstevel@tonic-gate goto err; 294*0Sstevel@tonic-gate } 295*0Sstevel@tonic-gate if (!s && !(s = ASN1_STRING_new())) goto err; 296*0Sstevel@tonic-gate if (!(ASN1_STRING_set(s, b, i))) goto err; 297*0Sstevel@tonic-gate OPENSSL_free(b); 298*0Sstevel@tonic-gate return s; 299*0Sstevel@tonic-gate err: 300*0Sstevel@tonic-gate if (b) OPENSSL_free(b); 301*0Sstevel@tonic-gate return NULL; 302*0Sstevel@tonic-gate } 303*0Sstevel@tonic-gate 304*0Sstevel@tonic-gate /* Nonce handling functions */ 305*0Sstevel@tonic-gate 306*0Sstevel@tonic-gate /* Add a nonce to an extension stack. A nonce can be specificed or if NULL 307*0Sstevel@tonic-gate * a random nonce will be generated. 308*0Sstevel@tonic-gate * Note: OpenSSL 0.9.7d and later create an OCTET STRING containing the 309*0Sstevel@tonic-gate * nonce, previous versions used the raw nonce. 310*0Sstevel@tonic-gate */ 311*0Sstevel@tonic-gate 312*0Sstevel@tonic-gate static int ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts, unsigned char *val, int len) 313*0Sstevel@tonic-gate { 314*0Sstevel@tonic-gate unsigned char *tmpval; 315*0Sstevel@tonic-gate ASN1_OCTET_STRING os; 316*0Sstevel@tonic-gate int ret = 0; 317*0Sstevel@tonic-gate if (len <= 0) len = OCSP_DEFAULT_NONCE_LENGTH; 318*0Sstevel@tonic-gate /* Create the OCTET STRING manually by writing out the header and 319*0Sstevel@tonic-gate * appending the content octets. This avoids an extra memory allocation 320*0Sstevel@tonic-gate * operation in some cases. Applications should *NOT* do this because 321*0Sstevel@tonic-gate * it relies on library internals. 322*0Sstevel@tonic-gate */ 323*0Sstevel@tonic-gate os.length = ASN1_object_size(0, len, V_ASN1_OCTET_STRING); 324*0Sstevel@tonic-gate os.data = OPENSSL_malloc(os.length); 325*0Sstevel@tonic-gate if (os.data == NULL) 326*0Sstevel@tonic-gate goto err; 327*0Sstevel@tonic-gate tmpval = os.data; 328*0Sstevel@tonic-gate ASN1_put_object(&tmpval, 0, len, V_ASN1_OCTET_STRING, V_ASN1_UNIVERSAL); 329*0Sstevel@tonic-gate if (val) 330*0Sstevel@tonic-gate memcpy(tmpval, val, len); 331*0Sstevel@tonic-gate else 332*0Sstevel@tonic-gate RAND_pseudo_bytes(tmpval, len); 333*0Sstevel@tonic-gate if(!X509V3_add1_i2d(exts, NID_id_pkix_OCSP_Nonce, 334*0Sstevel@tonic-gate &os, 0, X509V3_ADD_REPLACE)) 335*0Sstevel@tonic-gate goto err; 336*0Sstevel@tonic-gate ret = 1; 337*0Sstevel@tonic-gate err: 338*0Sstevel@tonic-gate if (os.data) 339*0Sstevel@tonic-gate OPENSSL_free(os.data); 340*0Sstevel@tonic-gate return ret; 341*0Sstevel@tonic-gate } 342*0Sstevel@tonic-gate 343*0Sstevel@tonic-gate 344*0Sstevel@tonic-gate /* Add nonce to an OCSP request */ 345*0Sstevel@tonic-gate 346*0Sstevel@tonic-gate int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len) 347*0Sstevel@tonic-gate { 348*0Sstevel@tonic-gate return ocsp_add1_nonce(&req->tbsRequest->requestExtensions, val, len); 349*0Sstevel@tonic-gate } 350*0Sstevel@tonic-gate 351*0Sstevel@tonic-gate /* Same as above but for a response */ 352*0Sstevel@tonic-gate 353*0Sstevel@tonic-gate int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len) 354*0Sstevel@tonic-gate { 355*0Sstevel@tonic-gate return ocsp_add1_nonce(&resp->tbsResponseData->responseExtensions, val, len); 356*0Sstevel@tonic-gate } 357*0Sstevel@tonic-gate 358*0Sstevel@tonic-gate /* Check nonce validity in a request and response. 359*0Sstevel@tonic-gate * Return value reflects result: 360*0Sstevel@tonic-gate * 1: nonces present and equal. 361*0Sstevel@tonic-gate * 2: nonces both absent. 362*0Sstevel@tonic-gate * 3: nonce present in response only. 363*0Sstevel@tonic-gate * 0: nonces both present and not equal. 364*0Sstevel@tonic-gate * -1: nonce in request only. 365*0Sstevel@tonic-gate * 366*0Sstevel@tonic-gate * For most responders clients can check return > 0. 367*0Sstevel@tonic-gate * If responder doesn't handle nonces return != 0 may be 368*0Sstevel@tonic-gate * necessary. return == 0 is always an error. 369*0Sstevel@tonic-gate */ 370*0Sstevel@tonic-gate 371*0Sstevel@tonic-gate int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs) 372*0Sstevel@tonic-gate { 373*0Sstevel@tonic-gate /* 374*0Sstevel@tonic-gate * Since we are only interested in the presence or absence of 375*0Sstevel@tonic-gate * the nonce and comparing its value there is no need to use 376*0Sstevel@tonic-gate * the X509V3 routines: this way we can avoid them allocating an 377*0Sstevel@tonic-gate * ASN1_OCTET_STRING structure for the value which would be 378*0Sstevel@tonic-gate * freed immediately anyway. 379*0Sstevel@tonic-gate */ 380*0Sstevel@tonic-gate 381*0Sstevel@tonic-gate int req_idx, resp_idx; 382*0Sstevel@tonic-gate X509_EXTENSION *req_ext, *resp_ext; 383*0Sstevel@tonic-gate req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1); 384*0Sstevel@tonic-gate resp_idx = OCSP_BASICRESP_get_ext_by_NID(bs, NID_id_pkix_OCSP_Nonce, -1); 385*0Sstevel@tonic-gate /* Check both absent */ 386*0Sstevel@tonic-gate if((req_idx < 0) && (resp_idx < 0)) 387*0Sstevel@tonic-gate return 2; 388*0Sstevel@tonic-gate /* Check in request only */ 389*0Sstevel@tonic-gate if((req_idx >= 0) && (resp_idx < 0)) 390*0Sstevel@tonic-gate return -1; 391*0Sstevel@tonic-gate /* Check in response but not request */ 392*0Sstevel@tonic-gate if((req_idx < 0) && (resp_idx >= 0)) 393*0Sstevel@tonic-gate return 3; 394*0Sstevel@tonic-gate /* Otherwise nonce in request and response so retrieve the extensions */ 395*0Sstevel@tonic-gate req_ext = OCSP_REQUEST_get_ext(req, req_idx); 396*0Sstevel@tonic-gate resp_ext = OCSP_BASICRESP_get_ext(bs, resp_idx); 397*0Sstevel@tonic-gate if(ASN1_OCTET_STRING_cmp(req_ext->value, resp_ext->value)) 398*0Sstevel@tonic-gate return 0; 399*0Sstevel@tonic-gate return 1; 400*0Sstevel@tonic-gate } 401*0Sstevel@tonic-gate 402*0Sstevel@tonic-gate /* Copy the nonce value (if any) from an OCSP request to 403*0Sstevel@tonic-gate * a response. 404*0Sstevel@tonic-gate */ 405*0Sstevel@tonic-gate 406*0Sstevel@tonic-gate int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req) 407*0Sstevel@tonic-gate { 408*0Sstevel@tonic-gate X509_EXTENSION *req_ext; 409*0Sstevel@tonic-gate int req_idx; 410*0Sstevel@tonic-gate /* Check for nonce in request */ 411*0Sstevel@tonic-gate req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1); 412*0Sstevel@tonic-gate /* If no nonce that's OK */ 413*0Sstevel@tonic-gate if (req_idx < 0) return 2; 414*0Sstevel@tonic-gate req_ext = OCSP_REQUEST_get_ext(req, req_idx); 415*0Sstevel@tonic-gate return OCSP_BASICRESP_add_ext(resp, req_ext, -1); 416*0Sstevel@tonic-gate } 417*0Sstevel@tonic-gate 418*0Sstevel@tonic-gate X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim) 419*0Sstevel@tonic-gate { 420*0Sstevel@tonic-gate X509_EXTENSION *x = NULL; 421*0Sstevel@tonic-gate OCSP_CRLID *cid = NULL; 422*0Sstevel@tonic-gate 423*0Sstevel@tonic-gate if (!(cid = OCSP_CRLID_new())) goto err; 424*0Sstevel@tonic-gate if (url) 425*0Sstevel@tonic-gate { 426*0Sstevel@tonic-gate if (!(cid->crlUrl = ASN1_IA5STRING_new())) goto err; 427*0Sstevel@tonic-gate if (!(ASN1_STRING_set(cid->crlUrl, url, -1))) goto err; 428*0Sstevel@tonic-gate } 429*0Sstevel@tonic-gate if (n) 430*0Sstevel@tonic-gate { 431*0Sstevel@tonic-gate if (!(cid->crlNum = ASN1_INTEGER_new())) goto err; 432*0Sstevel@tonic-gate if (!(ASN1_INTEGER_set(cid->crlNum, *n))) goto err; 433*0Sstevel@tonic-gate } 434*0Sstevel@tonic-gate if (tim) 435*0Sstevel@tonic-gate { 436*0Sstevel@tonic-gate if (!(cid->crlTime = ASN1_GENERALIZEDTIME_new())) goto err; 437*0Sstevel@tonic-gate if (!(ASN1_GENERALIZEDTIME_set_string(cid->crlTime, tim))) 438*0Sstevel@tonic-gate goto err; 439*0Sstevel@tonic-gate } 440*0Sstevel@tonic-gate if (!(x = X509_EXTENSION_new())) goto err; 441*0Sstevel@tonic-gate if (!(x->object = OBJ_nid2obj(NID_id_pkix_OCSP_CrlID))) goto err; 442*0Sstevel@tonic-gate if (!(ASN1_STRING_encode(x->value,i2d_OCSP_CRLID,(char*)cid,NULL))) 443*0Sstevel@tonic-gate goto err; 444*0Sstevel@tonic-gate OCSP_CRLID_free(cid); 445*0Sstevel@tonic-gate return x; 446*0Sstevel@tonic-gate err: 447*0Sstevel@tonic-gate if (x) X509_EXTENSION_free(x); 448*0Sstevel@tonic-gate if (cid) OCSP_CRLID_free(cid); 449*0Sstevel@tonic-gate return NULL; 450*0Sstevel@tonic-gate } 451*0Sstevel@tonic-gate 452*0Sstevel@tonic-gate /* AcceptableResponses ::= SEQUENCE OF OBJECT IDENTIFIER */ 453*0Sstevel@tonic-gate X509_EXTENSION *OCSP_accept_responses_new(char **oids) 454*0Sstevel@tonic-gate { 455*0Sstevel@tonic-gate int nid; 456*0Sstevel@tonic-gate STACK_OF(ASN1_OBJECT) *sk = NULL; 457*0Sstevel@tonic-gate ASN1_OBJECT *o = NULL; 458*0Sstevel@tonic-gate X509_EXTENSION *x = NULL; 459*0Sstevel@tonic-gate 460*0Sstevel@tonic-gate if (!(sk = sk_ASN1_OBJECT_new_null())) goto err; 461*0Sstevel@tonic-gate while (oids && *oids) 462*0Sstevel@tonic-gate { 463*0Sstevel@tonic-gate if ((nid=OBJ_txt2nid(*oids))!=NID_undef&&(o=OBJ_nid2obj(nid))) 464*0Sstevel@tonic-gate sk_ASN1_OBJECT_push(sk, o); 465*0Sstevel@tonic-gate oids++; 466*0Sstevel@tonic-gate } 467*0Sstevel@tonic-gate if (!(x = X509_EXTENSION_new())) goto err; 468*0Sstevel@tonic-gate if (!(x->object = OBJ_nid2obj(NID_id_pkix_OCSP_acceptableResponses))) 469*0Sstevel@tonic-gate goto err; 470*0Sstevel@tonic-gate if (!(ASN1_STRING_encode(x->value,i2d_ASN1_OBJECT,NULL,sk))) 471*0Sstevel@tonic-gate goto err; 472*0Sstevel@tonic-gate sk_ASN1_OBJECT_pop_free(sk, ASN1_OBJECT_free); 473*0Sstevel@tonic-gate return x; 474*0Sstevel@tonic-gate err: 475*0Sstevel@tonic-gate if (x) X509_EXTENSION_free(x); 476*0Sstevel@tonic-gate if (sk) sk_ASN1_OBJECT_pop_free(sk, ASN1_OBJECT_free); 477*0Sstevel@tonic-gate return NULL; 478*0Sstevel@tonic-gate } 479*0Sstevel@tonic-gate 480*0Sstevel@tonic-gate /* ArchiveCutoff ::= GeneralizedTime */ 481*0Sstevel@tonic-gate X509_EXTENSION *OCSP_archive_cutoff_new(char* tim) 482*0Sstevel@tonic-gate { 483*0Sstevel@tonic-gate X509_EXTENSION *x=NULL; 484*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME *gt = NULL; 485*0Sstevel@tonic-gate 486*0Sstevel@tonic-gate if (!(gt = ASN1_GENERALIZEDTIME_new())) goto err; 487*0Sstevel@tonic-gate if (!(ASN1_GENERALIZEDTIME_set_string(gt, tim))) goto err; 488*0Sstevel@tonic-gate if (!(x = X509_EXTENSION_new())) goto err; 489*0Sstevel@tonic-gate if (!(x->object=OBJ_nid2obj(NID_id_pkix_OCSP_archiveCutoff)))goto err; 490*0Sstevel@tonic-gate if (!(ASN1_STRING_encode(x->value,i2d_ASN1_GENERALIZEDTIME, 491*0Sstevel@tonic-gate (char*)gt,NULL))) goto err; 492*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME_free(gt); 493*0Sstevel@tonic-gate return x; 494*0Sstevel@tonic-gate err: 495*0Sstevel@tonic-gate if (gt) ASN1_GENERALIZEDTIME_free(gt); 496*0Sstevel@tonic-gate if (x) X509_EXTENSION_free(x); 497*0Sstevel@tonic-gate return NULL; 498*0Sstevel@tonic-gate } 499*0Sstevel@tonic-gate 500*0Sstevel@tonic-gate /* per ACCESS_DESCRIPTION parameter are oids, of which there are currently 501*0Sstevel@tonic-gate * two--NID_ad_ocsp, NID_id_ad_caIssuers--and GeneralName value. This 502*0Sstevel@tonic-gate * method forces NID_ad_ocsp and uniformResourceLocator [6] IA5String. 503*0Sstevel@tonic-gate */ 504*0Sstevel@tonic-gate X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, char **urls) 505*0Sstevel@tonic-gate { 506*0Sstevel@tonic-gate X509_EXTENSION *x = NULL; 507*0Sstevel@tonic-gate ASN1_IA5STRING *ia5 = NULL; 508*0Sstevel@tonic-gate OCSP_SERVICELOC *sloc = NULL; 509*0Sstevel@tonic-gate ACCESS_DESCRIPTION *ad = NULL; 510*0Sstevel@tonic-gate 511*0Sstevel@tonic-gate if (!(sloc = OCSP_SERVICELOC_new())) goto err; 512*0Sstevel@tonic-gate if (!(sloc->issuer = X509_NAME_dup(issuer))) goto err; 513*0Sstevel@tonic-gate if (urls && *urls && !(sloc->locator = sk_ACCESS_DESCRIPTION_new_null())) goto err; 514*0Sstevel@tonic-gate while (urls && *urls) 515*0Sstevel@tonic-gate { 516*0Sstevel@tonic-gate if (!(ad = ACCESS_DESCRIPTION_new())) goto err; 517*0Sstevel@tonic-gate if (!(ad->method=OBJ_nid2obj(NID_ad_OCSP))) goto err; 518*0Sstevel@tonic-gate if (!(ad->location = GENERAL_NAME_new())) goto err; 519*0Sstevel@tonic-gate if (!(ia5 = ASN1_IA5STRING_new())) goto err; 520*0Sstevel@tonic-gate if (!ASN1_STRING_set((ASN1_STRING*)ia5, *urls, -1)) goto err; 521*0Sstevel@tonic-gate ad->location->type = GEN_URI; 522*0Sstevel@tonic-gate ad->location->d.ia5 = ia5; 523*0Sstevel@tonic-gate if (!sk_ACCESS_DESCRIPTION_push(sloc->locator, ad)) goto err; 524*0Sstevel@tonic-gate urls++; 525*0Sstevel@tonic-gate } 526*0Sstevel@tonic-gate if (!(x = X509_EXTENSION_new())) goto err; 527*0Sstevel@tonic-gate if (!(x->object = OBJ_nid2obj(NID_id_pkix_OCSP_serviceLocator))) 528*0Sstevel@tonic-gate goto err; 529*0Sstevel@tonic-gate if (!(ASN1_STRING_encode(x->value, i2d_OCSP_SERVICELOC, 530*0Sstevel@tonic-gate (char*)sloc, NULL))) goto err; 531*0Sstevel@tonic-gate OCSP_SERVICELOC_free(sloc); 532*0Sstevel@tonic-gate return x; 533*0Sstevel@tonic-gate err: 534*0Sstevel@tonic-gate if (x) X509_EXTENSION_free(x); 535*0Sstevel@tonic-gate if (sloc) OCSP_SERVICELOC_free(sloc); 536*0Sstevel@tonic-gate return NULL; 537*0Sstevel@tonic-gate } 538*0Sstevel@tonic-gate 539