1 /* ocsp_ext.c */ 2 /* Written by Tom Titchener <Tom_Titchener@groove.net> for the OpenSSL 3 * project. */ 4 5 /* History: 6 This file was transfered to Richard Levitte from CertCo by Kathy 7 Weinhold in mid-spring 2000 to be included in OpenSSL or released 8 as a patch kit. */ 9 10 /* ==================================================================== 11 * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 17 * 1. Redistributions of source code must retain the above copyright 18 * notice, this list of conditions and the following disclaimer. 19 * 20 * 2. Redistributions in binary form must reproduce the above copyright 21 * notice, this list of conditions and the following disclaimer in 22 * the documentation and/or other materials provided with the 23 * distribution. 24 * 25 * 3. All advertising materials mentioning features or use of this 26 * software must display the following acknowledgment: 27 * "This product includes software developed by the OpenSSL Project 28 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 29 * 30 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 31 * endorse or promote products derived from this software without 32 * prior written permission. For written permission, please contact 33 * openssl-core@openssl.org. 34 * 35 * 5. Products derived from this software may not be called "OpenSSL" 36 * nor may "OpenSSL" appear in their names without prior written 37 * permission of the OpenSSL Project. 38 * 39 * 6. Redistributions of any form whatsoever must retain the following 40 * acknowledgment: 41 * "This product includes software developed by the OpenSSL Project 42 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 43 * 44 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 45 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 46 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 47 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 48 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 49 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 50 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 51 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 53 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 54 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 55 * OF THE POSSIBILITY OF SUCH DAMAGE. 56 * ==================================================================== 57 * 58 * This product includes cryptographic software written by Eric Young 59 * (eay@cryptsoft.com). This product includes software written by Tim 60 * Hudson (tjh@cryptsoft.com). 61 * 62 */ 63 64 #include <stdio.h> 65 #include <cryptlib.h> 66 #include <openssl/objects.h> 67 #include <openssl/x509.h> 68 #include <openssl/ocsp.h> 69 #include <openssl/rand.h> 70 #include <openssl/x509v3.h> 71 72 /* Standard wrapper functions for extensions */ 73 74 /* OCSP request extensions */ 75 76 int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x) 77 { 78 return(X509v3_get_ext_count(x->tbsRequest->requestExtensions)); 79 } 80 81 int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos) 82 { 83 return(X509v3_get_ext_by_NID(x->tbsRequest->requestExtensions,nid,lastpos)); 84 } 85 86 int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj, int lastpos) 87 { 88 return(X509v3_get_ext_by_OBJ(x->tbsRequest->requestExtensions,obj,lastpos)); 89 } 90 91 int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos) 92 { 93 return(X509v3_get_ext_by_critical(x->tbsRequest->requestExtensions,crit,lastpos)); 94 } 95 96 X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc) 97 { 98 return(X509v3_get_ext(x->tbsRequest->requestExtensions,loc)); 99 } 100 101 X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc) 102 { 103 return(X509v3_delete_ext(x->tbsRequest->requestExtensions,loc)); 104 } 105 106 void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx) 107 { 108 return X509V3_get_d2i(x->tbsRequest->requestExtensions, nid, crit, idx); 109 } 110 111 int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, int crit, 112 unsigned long flags) 113 { 114 return X509V3_add1_i2d(&x->tbsRequest->requestExtensions, nid, value, crit, flags); 115 } 116 117 int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc) 118 { 119 return(X509v3_add_ext(&(x->tbsRequest->requestExtensions),ex,loc) != NULL); 120 } 121 122 /* Single extensions */ 123 124 int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x) 125 { 126 return(X509v3_get_ext_count(x->singleRequestExtensions)); 127 } 128 129 int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos) 130 { 131 return(X509v3_get_ext_by_NID(x->singleRequestExtensions,nid,lastpos)); 132 } 133 134 int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj, int lastpos) 135 { 136 return(X509v3_get_ext_by_OBJ(x->singleRequestExtensions,obj,lastpos)); 137 } 138 139 int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos) 140 { 141 return(X509v3_get_ext_by_critical(x->singleRequestExtensions,crit,lastpos)); 142 } 143 144 X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc) 145 { 146 return(X509v3_get_ext(x->singleRequestExtensions,loc)); 147 } 148 149 X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc) 150 { 151 return(X509v3_delete_ext(x->singleRequestExtensions,loc)); 152 } 153 154 void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx) 155 { 156 return X509V3_get_d2i(x->singleRequestExtensions, nid, crit, idx); 157 } 158 159 int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit, 160 unsigned long flags) 161 { 162 return X509V3_add1_i2d(&x->singleRequestExtensions, nid, value, crit, flags); 163 } 164 165 int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc) 166 { 167 return(X509v3_add_ext(&(x->singleRequestExtensions),ex,loc) != NULL); 168 } 169 170 /* OCSP Basic response */ 171 172 int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x) 173 { 174 return(X509v3_get_ext_count(x->tbsResponseData->responseExtensions)); 175 } 176 177 int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos) 178 { 179 return(X509v3_get_ext_by_NID(x->tbsResponseData->responseExtensions,nid,lastpos)); 180 } 181 182 int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj, int lastpos) 183 { 184 return(X509v3_get_ext_by_OBJ(x->tbsResponseData->responseExtensions,obj,lastpos)); 185 } 186 187 int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit, int lastpos) 188 { 189 return(X509v3_get_ext_by_critical(x->tbsResponseData->responseExtensions,crit,lastpos)); 190 } 191 192 X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc) 193 { 194 return(X509v3_get_ext(x->tbsResponseData->responseExtensions,loc)); 195 } 196 197 X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc) 198 { 199 return(X509v3_delete_ext(x->tbsResponseData->responseExtensions,loc)); 200 } 201 202 void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit, int *idx) 203 { 204 return X509V3_get_d2i(x->tbsResponseData->responseExtensions, nid, crit, idx); 205 } 206 207 int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value, int crit, 208 unsigned long flags) 209 { 210 return X509V3_add1_i2d(&x->tbsResponseData->responseExtensions, nid, value, crit, flags); 211 } 212 213 int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc) 214 { 215 return(X509v3_add_ext(&(x->tbsResponseData->responseExtensions),ex,loc) != NULL); 216 } 217 218 /* OCSP single response extensions */ 219 220 int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x) 221 { 222 return(X509v3_get_ext_count(x->singleExtensions)); 223 } 224 225 int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos) 226 { 227 return(X509v3_get_ext_by_NID(x->singleExtensions,nid,lastpos)); 228 } 229 230 int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj, int lastpos) 231 { 232 return(X509v3_get_ext_by_OBJ(x->singleExtensions,obj,lastpos)); 233 } 234 235 int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit, int lastpos) 236 { 237 return(X509v3_get_ext_by_critical(x->singleExtensions,crit,lastpos)); 238 } 239 240 X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc) 241 { 242 return(X509v3_get_ext(x->singleExtensions,loc)); 243 } 244 245 X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc) 246 { 247 return(X509v3_delete_ext(x->singleExtensions,loc)); 248 } 249 250 void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit, int *idx) 251 { 252 return X509V3_get_d2i(x->singleExtensions, nid, crit, idx); 253 } 254 255 int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value, int crit, 256 unsigned long flags) 257 { 258 return X509V3_add1_i2d(&x->singleExtensions, nid, value, crit, flags); 259 } 260 261 int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc) 262 { 263 return(X509v3_add_ext(&(x->singleExtensions),ex,loc) != NULL); 264 } 265 266 /* also CRL Entry Extensions */ 267 268 ASN1_STRING *ASN1_STRING_encode(ASN1_STRING *s, int (*i2d)(), 269 char *data, STACK_OF(ASN1_OBJECT) *sk) 270 { 271 int i; 272 unsigned char *p, *b = NULL; 273 274 if (data) 275 { 276 if ((i=i2d(data,NULL)) <= 0) goto err; 277 if (!(b=p=(unsigned char*)OPENSSL_malloc((unsigned int)i))) 278 goto err; 279 if (i2d(data, &p) <= 0) goto err; 280 } 281 else if (sk) 282 { 283 if ((i=i2d_ASN1_SET_OF_ASN1_OBJECT(sk,NULL,i2d,V_ASN1_SEQUENCE, 284 V_ASN1_UNIVERSAL,IS_SEQUENCE))<=0) goto err; 285 if (!(b=p=(unsigned char*)OPENSSL_malloc((unsigned int)i))) 286 goto err; 287 if (i2d_ASN1_SET_OF_ASN1_OBJECT(sk,&p,i2d,V_ASN1_SEQUENCE, 288 V_ASN1_UNIVERSAL,IS_SEQUENCE)<=0) goto err; 289 } 290 else 291 { 292 OCSPerr(OCSP_F_ASN1_STRING_ENCODE,OCSP_R_BAD_DATA); 293 goto err; 294 } 295 if (!s && !(s = ASN1_STRING_new())) goto err; 296 if (!(ASN1_STRING_set(s, b, i))) goto err; 297 OPENSSL_free(b); 298 return s; 299 err: 300 if (b) OPENSSL_free(b); 301 return NULL; 302 } 303 304 /* Nonce handling functions */ 305 306 /* Add a nonce to an extension stack. A nonce can be specificed or if NULL 307 * a random nonce will be generated. 308 */ 309 310 static int ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts, unsigned char *val, int len) 311 { 312 unsigned char *tmpval; 313 ASN1_OCTET_STRING os; 314 int ret = 0; 315 if (len <= 0) len = OCSP_DEFAULT_NONCE_LENGTH; 316 if (val) tmpval = val; 317 else 318 { 319 if (!(tmpval = OPENSSL_malloc(len))) goto err; 320 RAND_pseudo_bytes(tmpval, len); 321 } 322 os.data = tmpval; 323 os.length = len; 324 if(!X509V3_add1_i2d(exts, NID_id_pkix_OCSP_Nonce, 325 &os, 0, X509V3_ADD_REPLACE)) 326 goto err; 327 ret = 1; 328 err: 329 if(!val) OPENSSL_free(tmpval); 330 return ret; 331 } 332 333 334 /* Add nonce to an OCSP request */ 335 336 int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len) 337 { 338 return ocsp_add1_nonce(&req->tbsRequest->requestExtensions, val, len); 339 } 340 341 /* Same as above but for a response */ 342 343 int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len) 344 { 345 return ocsp_add1_nonce(&resp->tbsResponseData->responseExtensions, val, len); 346 } 347 348 /* Check nonce validity in a request and response. 349 * Return value reflects result: 350 * 1: nonces present and equal. 351 * 2: nonces both absent. 352 * 3: nonce present in response only. 353 * 0: nonces both present and not equal. 354 * -1: nonce in request only. 355 * 356 * For most responders clients can check return > 0. 357 * If responder doesn't handle nonces return != 0 may be 358 * necessary. return == 0 is always an error. 359 */ 360 361 int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs) 362 { 363 /* 364 * Since we are only interested in the presence or absence of 365 * the nonce and comparing its value there is no need to use 366 * the X509V3 routines: this way we can avoid them allocating an 367 * ASN1_OCTET_STRING structure for the value which would be 368 * freed immediately anyway. 369 */ 370 371 int req_idx, resp_idx; 372 X509_EXTENSION *req_ext, *resp_ext; 373 req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1); 374 resp_idx = OCSP_BASICRESP_get_ext_by_NID(bs, NID_id_pkix_OCSP_Nonce, -1); 375 /* Check both absent */ 376 if((req_idx < 0) && (resp_idx < 0)) 377 return 2; 378 /* Check in request only */ 379 if((req_idx >= 0) && (resp_idx < 0)) 380 return -1; 381 /* Check in response but not request */ 382 if((req_idx < 0) && (resp_idx >= 0)) 383 return 3; 384 /* Otherwise nonce in request and response so retrieve the extensions */ 385 req_ext = OCSP_REQUEST_get_ext(req, req_idx); 386 resp_ext = OCSP_BASICRESP_get_ext(bs, resp_idx); 387 if(ASN1_OCTET_STRING_cmp(req_ext->value, resp_ext->value)) 388 return 0; 389 return 1; 390 } 391 392 /* Copy the nonce value (if any) from an OCSP request to 393 * a response. 394 */ 395 396 int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req) 397 { 398 X509_EXTENSION *req_ext; 399 int req_idx; 400 /* Check for nonce in request */ 401 req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1); 402 /* If no nonce that's OK */ 403 if (req_idx < 0) return 2; 404 req_ext = OCSP_REQUEST_get_ext(req, req_idx); 405 return OCSP_BASICRESP_add_ext(resp, req_ext, -1); 406 } 407 408 X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim) 409 { 410 X509_EXTENSION *x = NULL; 411 OCSP_CRLID *cid = NULL; 412 413 if (!(cid = OCSP_CRLID_new())) goto err; 414 if (url) 415 { 416 if (!(cid->crlUrl = ASN1_IA5STRING_new())) goto err; 417 if (!(ASN1_STRING_set(cid->crlUrl, url, -1))) goto err; 418 } 419 if (n) 420 { 421 if (!(cid->crlNum = ASN1_INTEGER_new())) goto err; 422 if (!(ASN1_INTEGER_set(cid->crlNum, *n))) goto err; 423 } 424 if (tim) 425 { 426 if (!(cid->crlTime = ASN1_GENERALIZEDTIME_new())) goto err; 427 if (!(ASN1_GENERALIZEDTIME_set_string(cid->crlTime, tim))) 428 goto err; 429 } 430 if (!(x = X509_EXTENSION_new())) goto err; 431 if (!(x->object = OBJ_nid2obj(NID_id_pkix_OCSP_CrlID))) goto err; 432 if (!(ASN1_STRING_encode(x->value,i2d_OCSP_CRLID,(char*)cid,NULL))) 433 goto err; 434 OCSP_CRLID_free(cid); 435 return x; 436 err: 437 if (x) X509_EXTENSION_free(x); 438 if (cid) OCSP_CRLID_free(cid); 439 return NULL; 440 } 441 442 /* AcceptableResponses ::= SEQUENCE OF OBJECT IDENTIFIER */ 443 X509_EXTENSION *OCSP_accept_responses_new(char **oids) 444 { 445 int nid; 446 STACK_OF(ASN1_OBJECT) *sk = NULL; 447 ASN1_OBJECT *o = NULL; 448 X509_EXTENSION *x = NULL; 449 450 if (!(sk = sk_ASN1_OBJECT_new_null())) goto err; 451 while (oids && *oids) 452 { 453 if ((nid=OBJ_txt2nid(*oids))!=NID_undef&&(o=OBJ_nid2obj(nid))) 454 sk_ASN1_OBJECT_push(sk, o); 455 oids++; 456 } 457 if (!(x = X509_EXTENSION_new())) goto err; 458 if (!(x->object = OBJ_nid2obj(NID_id_pkix_OCSP_acceptableResponses))) 459 goto err; 460 if (!(ASN1_STRING_encode(x->value,i2d_ASN1_OBJECT,NULL,sk))) 461 goto err; 462 sk_ASN1_OBJECT_pop_free(sk, ASN1_OBJECT_free); 463 return x; 464 err: 465 if (x) X509_EXTENSION_free(x); 466 if (sk) sk_ASN1_OBJECT_pop_free(sk, ASN1_OBJECT_free); 467 return NULL; 468 } 469 470 /* ArchiveCutoff ::= GeneralizedTime */ 471 X509_EXTENSION *OCSP_archive_cutoff_new(char* tim) 472 { 473 X509_EXTENSION *x=NULL; 474 ASN1_GENERALIZEDTIME *gt = NULL; 475 476 if (!(gt = ASN1_GENERALIZEDTIME_new())) goto err; 477 if (!(ASN1_GENERALIZEDTIME_set_string(gt, tim))) goto err; 478 if (!(x = X509_EXTENSION_new())) goto err; 479 if (!(x->object=OBJ_nid2obj(NID_id_pkix_OCSP_archiveCutoff)))goto err; 480 if (!(ASN1_STRING_encode(x->value,i2d_ASN1_GENERALIZEDTIME, 481 (char*)gt,NULL))) goto err; 482 ASN1_GENERALIZEDTIME_free(gt); 483 return x; 484 err: 485 if (gt) ASN1_GENERALIZEDTIME_free(gt); 486 if (x) X509_EXTENSION_free(x); 487 return NULL; 488 } 489 490 /* per ACCESS_DESCRIPTION parameter are oids, of which there are currently 491 * two--NID_ad_ocsp, NID_id_ad_caIssuers--and GeneralName value. This 492 * method forces NID_ad_ocsp and uniformResourceLocator [6] IA5String. 493 */ 494 X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, char **urls) 495 { 496 X509_EXTENSION *x = NULL; 497 ASN1_IA5STRING *ia5 = NULL; 498 OCSP_SERVICELOC *sloc = NULL; 499 ACCESS_DESCRIPTION *ad = NULL; 500 501 if (!(sloc = OCSP_SERVICELOC_new())) goto err; 502 if (!(sloc->issuer = X509_NAME_dup(issuer))) goto err; 503 if (urls && *urls && !(sloc->locator = sk_ACCESS_DESCRIPTION_new_null())) goto err; 504 while (urls && *urls) 505 { 506 if (!(ad = ACCESS_DESCRIPTION_new())) goto err; 507 if (!(ad->method=OBJ_nid2obj(NID_ad_OCSP))) goto err; 508 if (!(ad->location = GENERAL_NAME_new())) goto err; 509 if (!(ia5 = ASN1_IA5STRING_new())) goto err; 510 if (!ASN1_STRING_set((ASN1_STRING*)ia5, *urls, -1)) goto err; 511 ad->location->type = GEN_URI; 512 ad->location->d.ia5 = ia5; 513 if (!sk_ACCESS_DESCRIPTION_push(sloc->locator, ad)) goto err; 514 urls++; 515 } 516 if (!(x = X509_EXTENSION_new())) goto err; 517 if (!(x->object = OBJ_nid2obj(NID_id_pkix_OCSP_serviceLocator))) 518 goto err; 519 if (!(ASN1_STRING_encode(x->value, i2d_OCSP_SERVICELOC, 520 (char*)sloc, NULL))) goto err; 521 OCSP_SERVICELOC_free(sloc); 522 return x; 523 err: 524 if (x) X509_EXTENSION_free(x); 525 if (sloc) OCSP_SERVICELOC_free(sloc); 526 return NULL; 527 } 528 529