A local copy of OpenSSL from GitHub
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

264 lines
6.8 KiB

  1. /*
  2. * Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. # include <stdio.h>
  10. # include "internal/cryptlib.h"
  11. # include <openssl/conf.h>
  12. # include <openssl/asn1.h>
  13. # include <openssl/ocsp.h>
  14. # include "ocsp_lcl.h"
  15. # include <openssl/x509v3.h>
  16. # include "../x509v3/ext_dat.h"
  17. /*
  18. * OCSP extensions and a couple of CRL entry extensions
  19. */
  20. static int i2r_ocsp_crlid(const X509V3_EXT_METHOD *method, void *nonce,
  21. BIO *out, int indent);
  22. static int i2r_ocsp_acutoff(const X509V3_EXT_METHOD *method, void *nonce,
  23. BIO *out, int indent);
  24. static int i2r_object(const X509V3_EXT_METHOD *method, void *obj, BIO *out,
  25. int indent);
  26. static void *ocsp_nonce_new(void);
  27. static int i2d_ocsp_nonce(void *a, unsigned char **pp);
  28. static void *d2i_ocsp_nonce(void *a, const unsigned char **pp, long length);
  29. static void ocsp_nonce_free(void *a);
  30. static int i2r_ocsp_nonce(const X509V3_EXT_METHOD *method, void *nonce,
  31. BIO *out, int indent);
  32. static int i2r_ocsp_nocheck(const X509V3_EXT_METHOD *method,
  33. void *nocheck, BIO *out, int indent);
  34. static void *s2i_ocsp_nocheck(const X509V3_EXT_METHOD *method,
  35. X509V3_CTX *ctx, const char *str);
  36. static int i2r_ocsp_serviceloc(const X509V3_EXT_METHOD *method, void *in,
  37. BIO *bp, int ind);
  38. const X509V3_EXT_METHOD v3_ocsp_crlid = {
  39. NID_id_pkix_OCSP_CrlID, 0, ASN1_ITEM_ref(OCSP_CRLID),
  40. 0, 0, 0, 0,
  41. 0, 0,
  42. 0, 0,
  43. i2r_ocsp_crlid, 0,
  44. NULL
  45. };
  46. const X509V3_EXT_METHOD v3_ocsp_acutoff = {
  47. NID_id_pkix_OCSP_archiveCutoff, 0, ASN1_ITEM_ref(ASN1_GENERALIZEDTIME),
  48. 0, 0, 0, 0,
  49. 0, 0,
  50. 0, 0,
  51. i2r_ocsp_acutoff, 0,
  52. NULL
  53. };
  54. const X509V3_EXT_METHOD v3_crl_invdate = {
  55. NID_invalidity_date, 0, ASN1_ITEM_ref(ASN1_GENERALIZEDTIME),
  56. 0, 0, 0, 0,
  57. 0, 0,
  58. 0, 0,
  59. i2r_ocsp_acutoff, 0,
  60. NULL
  61. };
  62. const X509V3_EXT_METHOD v3_crl_hold = {
  63. NID_hold_instruction_code, 0, ASN1_ITEM_ref(ASN1_OBJECT),
  64. 0, 0, 0, 0,
  65. 0, 0,
  66. 0, 0,
  67. i2r_object, 0,
  68. NULL
  69. };
  70. const X509V3_EXT_METHOD v3_ocsp_nonce = {
  71. NID_id_pkix_OCSP_Nonce, 0, NULL,
  72. ocsp_nonce_new,
  73. ocsp_nonce_free,
  74. d2i_ocsp_nonce,
  75. i2d_ocsp_nonce,
  76. 0, 0,
  77. 0, 0,
  78. i2r_ocsp_nonce, 0,
  79. NULL
  80. };
  81. const X509V3_EXT_METHOD v3_ocsp_nocheck = {
  82. NID_id_pkix_OCSP_noCheck, 0, ASN1_ITEM_ref(ASN1_NULL),
  83. 0, 0, 0, 0,
  84. 0, s2i_ocsp_nocheck,
  85. 0, 0,
  86. i2r_ocsp_nocheck, 0,
  87. NULL
  88. };
  89. const X509V3_EXT_METHOD v3_ocsp_serviceloc = {
  90. NID_id_pkix_OCSP_serviceLocator, 0, ASN1_ITEM_ref(OCSP_SERVICELOC),
  91. 0, 0, 0, 0,
  92. 0, 0,
  93. 0, 0,
  94. i2r_ocsp_serviceloc, 0,
  95. NULL
  96. };
  97. static int i2r_ocsp_crlid(const X509V3_EXT_METHOD *method, void *in, BIO *bp,
  98. int ind)
  99. {
  100. OCSP_CRLID *a = in;
  101. if (a->crlUrl) {
  102. if (BIO_printf(bp, "%*scrlUrl: ", ind, "") <= 0)
  103. goto err;
  104. if (!ASN1_STRING_print(bp, (ASN1_STRING *)a->crlUrl))
  105. goto err;
  106. if (BIO_write(bp, "\n", 1) <= 0)
  107. goto err;
  108. }
  109. if (a->crlNum) {
  110. if (BIO_printf(bp, "%*scrlNum: ", ind, "") <= 0)
  111. goto err;
  112. if (i2a_ASN1_INTEGER(bp, a->crlNum) <= 0)
  113. goto err;
  114. if (BIO_write(bp, "\n", 1) <= 0)
  115. goto err;
  116. }
  117. if (a->crlTime) {
  118. if (BIO_printf(bp, "%*scrlTime: ", ind, "") <= 0)
  119. goto err;
  120. if (!ASN1_GENERALIZEDTIME_print(bp, a->crlTime))
  121. goto err;
  122. if (BIO_write(bp, "\n", 1) <= 0)
  123. goto err;
  124. }
  125. return 1;
  126. err:
  127. return 0;
  128. }
  129. static int i2r_ocsp_acutoff(const X509V3_EXT_METHOD *method, void *cutoff,
  130. BIO *bp, int ind)
  131. {
  132. if (BIO_printf(bp, "%*s", ind, "") <= 0)
  133. return 0;
  134. if (!ASN1_GENERALIZEDTIME_print(bp, cutoff))
  135. return 0;
  136. return 1;
  137. }
  138. static int i2r_object(const X509V3_EXT_METHOD *method, void *oid, BIO *bp,
  139. int ind)
  140. {
  141. if (BIO_printf(bp, "%*s", ind, "") <= 0)
  142. return 0;
  143. if (i2a_ASN1_OBJECT(bp, oid) <= 0)
  144. return 0;
  145. return 1;
  146. }
  147. /*
  148. * OCSP nonce. This is needs special treatment because it doesn't have an
  149. * ASN1 encoding at all: it just contains arbitrary data.
  150. */
  151. static void *ocsp_nonce_new(void)
  152. {
  153. return ASN1_OCTET_STRING_new();
  154. }
  155. static int i2d_ocsp_nonce(void *a, unsigned char **pp)
  156. {
  157. ASN1_OCTET_STRING *os = a;
  158. if (pp) {
  159. memcpy(*pp, os->data, os->length);
  160. *pp += os->length;
  161. }
  162. return os->length;
  163. }
  164. static void *d2i_ocsp_nonce(void *a, const unsigned char **pp, long length)
  165. {
  166. ASN1_OCTET_STRING *os, **pos;
  167. pos = a;
  168. if (pos == NULL || *pos == NULL) {
  169. os = ASN1_OCTET_STRING_new();
  170. if (os == NULL)
  171. goto err;
  172. } else {
  173. os = *pos;
  174. }
  175. if (!ASN1_OCTET_STRING_set(os, *pp, length))
  176. goto err;
  177. *pp += length;
  178. if (pos)
  179. *pos = os;
  180. return os;
  181. err:
  182. if ((pos == NULL) || (*pos != os))
  183. ASN1_OCTET_STRING_free(os);
  184. OCSPerr(OCSP_F_D2I_OCSP_NONCE, ERR_R_MALLOC_FAILURE);
  185. return NULL;
  186. }
  187. static void ocsp_nonce_free(void *a)
  188. {
  189. ASN1_OCTET_STRING_free(a);
  190. }
  191. static int i2r_ocsp_nonce(const X509V3_EXT_METHOD *method, void *nonce,
  192. BIO *out, int indent)
  193. {
  194. if (BIO_printf(out, "%*s", indent, "") <= 0)
  195. return 0;
  196. if (i2a_ASN1_STRING(out, nonce, V_ASN1_OCTET_STRING) <= 0)
  197. return 0;
  198. return 1;
  199. }
  200. /* Nocheck is just a single NULL. Don't print anything and always set it */
  201. static int i2r_ocsp_nocheck(const X509V3_EXT_METHOD *method, void *nocheck,
  202. BIO *out, int indent)
  203. {
  204. return 1;
  205. }
  206. static void *s2i_ocsp_nocheck(const X509V3_EXT_METHOD *method,
  207. X509V3_CTX *ctx, const char *str)
  208. {
  209. return ASN1_NULL_new();
  210. }
  211. static int i2r_ocsp_serviceloc(const X509V3_EXT_METHOD *method, void *in,
  212. BIO *bp, int ind)
  213. {
  214. int i;
  215. OCSP_SERVICELOC *a = in;
  216. ACCESS_DESCRIPTION *ad;
  217. if (BIO_printf(bp, "%*sIssuer: ", ind, "") <= 0)
  218. goto err;
  219. if (X509_NAME_print_ex(bp, a->issuer, 0, XN_FLAG_ONELINE) <= 0)
  220. goto err;
  221. for (i = 0; i < sk_ACCESS_DESCRIPTION_num(a->locator); i++) {
  222. ad = sk_ACCESS_DESCRIPTION_value(a->locator, i);
  223. if (BIO_printf(bp, "\n%*s", (2 * ind), "") <= 0)
  224. goto err;
  225. if (i2a_ASN1_OBJECT(bp, ad->method) <= 0)
  226. goto err;
  227. if (BIO_puts(bp, " - ") <= 0)
  228. goto err;
  229. if (GENERAL_NAME_print(bp, ad->location) <= 0)
  230. goto err;
  231. }
  232. return 1;
  233. err:
  234. return 0;
  235. }