diff options
| -rw-r--r-- | CHANGES | 3 | ||||
| -rw-r--r-- | STATUS | 5 | ||||
| -rw-r--r-- | crypto/ocsp/Makefile.ssl | 4 | ||||
| -rw-r--r-- | crypto/ocsp/ocsp.h | 16 | ||||
| -rw-r--r-- | crypto/ocsp/ocsp_asn.c | 143 | ||||
| -rw-r--r-- | crypto/ocsp/ocsp_cid.c | 75 | ||||
| -rw-r--r-- | crypto/ocsp/ocsp_lib.c | 15 | ||||
| -rw-r--r-- | crypto/ocsp/ocsp_req.c | 194 | ||||
| -rw-r--r-- | crypto/ocsp/ocsp_res.c | 672 | ||||
| -rw-r--r-- | crypto/ocsp/ocsp_sig.c | 70 |
10 files changed, 173 insertions, 1024 deletions
@@ -3,6 +3,9 @@ Changes between 0.9.6 and 0.9.7 [xx XXX 2000] + *) Reimplement the OCSP ASN1 module using the new code. + [Steve Henson] + *) Update the X509V3 code to permit the use of an ASN1_ITEM structure for its ASN1 operations. The old style function pointers still exist for now but they will eventually go away. @@ -1,6 +1,6 @@ OpenSSL STATUS Last modified at - ______________ $Date: 2000/11/19 14:11:03 $ + ______________ $Date: 2000/12/13 18:21:47 $ DEVELOPMENT STATE @@ -24,8 +24,9 @@ o Steve is currently working on (in no particular order): ASN1 code redesign, butchery, replacement. + OCSP EVP cipher enhancement. - /* Proper (or at least usable) certificate chain verification. */ + Enhanced certificate chain verification. Private key, certificate and CRL API and implementation. Developing and bugfixing PKCS#7 (S/MIME code). Various X509 issues: character sets, certificate request extensions. diff --git a/crypto/ocsp/Makefile.ssl b/crypto/ocsp/Makefile.ssl index bae9226844..cadaeba830 100644 --- a/crypto/ocsp/Makefile.ssl +++ b/crypto/ocsp/Makefile.ssl @@ -22,10 +22,10 @@ TEST= APPS= LIB=$(TOP)/libcrypto.a -LIBSRC= ocsp_req.c ocsp_res.c ocsp_sig.c ocsp_cid.c ocsp_ext.c \ +LIBSRC= ocsp_asn.c ocsp_req.c ocsp_res.c ocsp_sig.c ocsp_cid.c ocsp_ext.c \ ocsp_lib.c ocsp_err.c #ocsp_v3.c -LIBOBJ= ocsp_req.o ocsp_res.o ocsp_sig.o ocsp_cid.o ocsp_ext.o \ +LIBOBJ= ocsp_asn.o ocsp_req.o ocsp_res.o ocsp_sig.o ocsp_cid.o ocsp_ext.o \ ocsp_lib.o ocsp_err.o #ocsp_v3.o diff --git a/crypto/ocsp/ocsp.h b/crypto/ocsp/ocsp.h index 4899a1ae49..4807205a84 100644 --- a/crypto/ocsp/ocsp.h +++ b/crypto/ocsp/ocsp.h @@ -177,11 +177,11 @@ typedef struct ocsp_response_st * byName [1] Name, * byKey [2] KeyHash } */ -#define V_OCSP_RESPID_NAME 1 -#define V_OCSP_RESPID_KEY 2 +#define V_OCSP_RESPID_NAME 0 +#define V_OCSP_RESPID_KEY 1 typedef struct ocsp_responder_id_st { - int tag; + int type; union { X509_NAME* byName; ASN1_OCTET_STRING *byKey; @@ -211,10 +211,12 @@ typedef struct ocsp_revoked_info_st #define V_OCSP_CERTSTATUS_UNKNOWN 2 typedef struct ocsp_cert_status_st { - int tag; - /* good [0] IMPLICIT NULL */ - OCSP_REVOKEDINFO *revoked; - /* unknown [2] OCSP_UNKNOWNINFO *unknown, which is NULL */ + int type; + union { + ASN1_NULL *good; + OCSP_REVOKEDINFO *revoked; + ASN1_NULL *unknown; + } value; } OCSP_CERTSTATUS; /* SingleResponse ::= SEQUENCE { diff --git a/crypto/ocsp/ocsp_asn.c b/crypto/ocsp/ocsp_asn.c new file mode 100644 index 0000000000..a61b0aed39 --- /dev/null +++ b/crypto/ocsp/ocsp_asn.c @@ -0,0 +1,143 @@ +/* ocsp.c */ +/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL + * project 2000. + */ +/* ==================================================================== + * Copyright (c) 2000 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ +#include <openssl/asn1.h> +#include <openssl/asn1t.h> +#include <openssl/ocsp.h> + +ASN1_SEQUENCE(OCSP_SIGNATURE) = { + ASN1_SIMPLE(OCSP_SIGNATURE, signatureAlgorithm, X509_ALGOR), + ASN1_SIMPLE(OCSP_SIGNATURE, signature, ASN1_BIT_STRING), + ASN1_SEQUENCE_OF(OCSP_SIGNATURE, certs, X509) +} ASN1_SEQUENCE_END(OCSP_SIGNATURE); + +ASN1_SEQUENCE(OCSP_CERTID) = { + ASN1_SIMPLE(OCSP_CERTID, hashAlgorithm, X509_ALGOR), + ASN1_SIMPLE(OCSP_CERTID, issuerNameHash, ASN1_OCTET_STRING), + ASN1_SIMPLE(OCSP_CERTID, issuerKeyHash, ASN1_OCTET_STRING), + ASN1_SIMPLE(OCSP_CERTID, serialNumber, ASN1_INTEGER) +} ASN1_SEQUENCE_END(OCSP_CERTID); + +ASN1_SEQUENCE(OCSP_ONEREQ) = { + ASN1_SIMPLE(OCSP_ONEREQ, reqCert, OCSP_CERTID), + ASN1_EXP_SEQUENCE_OF_OPT(OCSP_ONEREQ, singleRequestExtensions, X509_EXTENSION, 0) +} ASN1_SEQUENCE_END(OCSP_ONEREQ); + +ASN1_SEQUENCE(OCSP_REQINFO) = { + ASN1_EXP_OPT(OCSP_REQINFO, version, ASN1_INTEGER, 0), + ASN1_EXP_OPT(OCSP_REQINFO, requestorName, GENERAL_NAME, 1), + ASN1_SEQUENCE_OF(OCSP_REQINFO, requestList, OCSP_ONEREQ), + ASN1_EXP_SEQUENCE_OF_OPT(OCSP_REQINFO, requestExtensions, X509_EXTENSION, 2) +} ASN1_SEQUENCE_END(OCSP_REQINFO); + +ASN1_SEQUENCE(OCSP_REQUEST) = { + ASN1_SIMPLE(OCSP_REQUEST, tbsRequest, OCSP_REQINFO), + ASN1_EXP_OPT(OCSP_REQUEST, optionalSignature, OCSP_SIGNATURE, 0) +} ASN1_SEQUENCE_END(OCSP_REQUEST); + + +/* OCSP_RESPONSE templates */ + +ASN1_SEQUENCE(OCSP_RESPBYTES) = { + ASN1_SIMPLE(OCSP_RESPBYTES, responseType, ASN1_OBJECT), + ASN1_SIMPLE(OCSP_RESPBYTES, response, ASN1_OCTET_STRING) +} ASN1_SEQUENCE_END(OCSP_RESPBYTES); + +ASN1_SEQUENCE(OCSP_RESPONSE) = { + ASN1_SIMPLE(OCSP_RESPONSE, responseStatus, ASN1_ENUMERATED), + ASN1_EXP_OPT(OCSP_RESPONSE, responseBytes, OCSP_RESPBYTES, 0) +} ASN1_SEQUENCE_END(OCSP_RESPONSE); + +ASN1_CHOICE(OCSP_RESPID) = { + ASN1_EXP(OCSP_RESPID, value.byName, X509_NAME, 1), + ASN1_IMP(OCSP_RESPID, value.byKey, ASN1_OCTET_STRING, 2) +} ASN1_CHOICE_END(OCSP_RESPID); + +ASN1_SEQUENCE(OCSP_REVOKEDINFO) = { + ASN1_SIMPLE(OCSP_REVOKEDINFO, revocationTime, ASN1_GENERALIZEDTIME), + ASN1_EXP_OPT(OCSP_REVOKEDINFO, revocationReason, ASN1_ENUMERATED, 0) +} ASN1_SEQUENCE_END(OCSP_REVOKEDINFO); + +ASN1_CHOICE(OCSP_CERTSTATUS) = { + ASN1_IMP(OCSP_CERTSTATUS, value.good, ASN1_NULL, 0), + ASN1_IMP(OCSP_CERTSTATUS, value.revoked, OCSP_REVOKEDINFO, 1), + ASN1_IMP(OCSP_CERTSTATUS, value.unknown, ASN1_NULL, 2) +} ASN1_CHOICE_END(OCSP_CERTSTATUS); + +ASN1_SEQUENCE(OCSP_SINGLERESP) = { + ASN1_SIMPLE(OCSP_SINGLERESP, certId, OCSP_CERTID), + ASN1_SIMPLE(OCSP_SINGLERESP, certStatus, OCSP_CERTSTATUS), + ASN1_SIMPLE(OCSP_SINGLERESP, thisUpdate, ASN1_GENERALIZEDTIME), + ASN1_EXP_OPT(OCSP_SINGLERESP, nextUpdate, ASN1_GENERALIZEDTIME, 0), + ASN1_EXP_SEQUENCE_OF_OPT(OCSP_SINGLERESP, singleExtensions, X509_EXTENSION, 1) +} ASN1_SEQUENCE_END(OCSP_SINGLERESP); + +ASN1_SEQUENCE(OCSP_RESPDATA) = { + ASN1_EXP_OPT(OCSP_RESPDATA, version, ASN1_INTEGER, 0), + ASN1_SIMPLE(OCSP_RESPDATA, responderId, OCSP_RESPID), + ASN1_SIMPLE(OCSP_RESPDATA, producedAt, ASN1_GENERALIZEDTIME), + ASN1_SEQUENCE_OF(OCSP_RESPDATA, responses, OCSP_SINGLERESP), + ASN1_EXP_SEQUENCE_OF_OPT(OCSP_RESPDATA, responseExtensions, X509_EXTENSION, 1) +} ASN1_SEQUENCE_END(OCSP_RESPDATA); + +ASN1_SEQUENCE(OCSP_BASICRESP) = { + ASN1_SIMPLE(OCSP_BASICRESP, tbsResponseData, OCSP_RESPDATA), + ASN1_SIMPLE(OCSP_BASICRESP, signatureAlgorithm, X509_ALGOR), + ASN1_SIMPLE(OCSP_BASICRESP, signature, ASN1_BIT_STRING), + ASN1_EXP_SEQUENCE_OF_OPT(OCSP_BASICRESP, certs, X509, 0) +} ASN1_SEQUENCE_END(OCSP_BASICRESP); + diff --git a/crypto/ocsp/ocsp_cid.c b/crypto/ocsp/ocsp_cid.c index b27531b5e2..ba25229b8f 100644 --- a/crypto/ocsp/ocsp_cid.c +++ b/crypto/ocsp/ocsp_cid.c @@ -62,85 +62,10 @@ */ #include <openssl/bio.h> -#include <openssl/asn1_mac.h> #include <openssl/err.h> #include <openssl/ocsp.h> #include <openssl/x509.h> -/* Make sure we work well with older variants of OpenSSL */ -#ifndef OPENSSL_malloc -#define OPENSSL_malloc Malloc -#endif -#ifndef OPENSSL_realloc -#define OPENSSL_realloc Realloc -#endif -#ifndef OPENSSL_free -#define OPENSSL_free Free -#endif - -OCSP_CERTID *OCSP_CERTID_new(void) - { - ASN1_CTX c; - OCSP_CERTID *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_CERTID); - M_ASN1_New(ret->hashAlgorithm, X509_ALGOR_new); - M_ASN1_New(ret->issuerNameHash, ASN1_OCTET_STRING_new); - M_ASN1_New(ret->issuerKeyHash, ASN1_OCTET_STRING_new); - M_ASN1_New(ret->serialNumber, ASN1_INTEGER_new); - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_CERTID_NEW); - } - -void OCSP_CERTID_free(OCSP_CERTID *a) - { - if (a == NULL) return; - X509_ALGOR_free(a->hashAlgorithm); - ASN1_OCTET_STRING_free(a->issuerNameHash); - ASN1_OCTET_STRING_free(a->issuerKeyHash); - ASN1_INTEGER_free(a->serialNumber); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_CERTID(OCSP_CERTID *a, - unsigned char **pp) - { - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len(a->hashAlgorithm, i2d_X509_ALGOR); - M_ASN1_I2D_len(a->issuerNameHash, i2d_ASN1_OCTET_STRING); - M_ASN1_I2D_len(a->issuerKeyHash, i2d_ASN1_OCTET_STRING); - M_ASN1_I2D_len(a->serialNumber, i2d_ASN1_INTEGER); - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put(a->hashAlgorithm, i2d_X509_ALGOR); - M_ASN1_I2D_put(a->issuerNameHash, i2d_ASN1_OCTET_STRING); - M_ASN1_I2D_put(a->issuerKeyHash, i2d_ASN1_OCTET_STRING); - M_ASN1_I2D_put(a->serialNumber, i2d_ASN1_INTEGER); - M_ASN1_I2D_finish(); - } - -OCSP_CERTID *d2i_OCSP_CERTID(OCSP_CERTID **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_CERTID *,OCSP_CERTID_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - M_ASN1_D2I_get(ret->hashAlgorithm, d2i_X509_ALGOR); - M_ASN1_D2I_get(ret->issuerNameHash, d2i_ASN1_OCTET_STRING); - M_ASN1_D2I_get(ret->issuerKeyHash, d2i_ASN1_OCTET_STRING); - M_ASN1_D2I_get(ret->serialNumber, d2i_ASN1_INTEGER); - - /* protect against malformed CERTID's */ - if (ASN1_STRING_length(ret->issuerNameHash) == 0 || - ASN1_STRING_length(ret->issuerKeyHash) == 0 || - ASN1_STRING_length(ret->serialNumber) == 0) - goto err; - - M_ASN1_D2I_Finish(a,OCSP_CERTID_free,ASN1_F_D2I_OCSP_CERTID); - } - int i2a_OCSP_CERTID(BIO *bp, OCSP_CERTID* a) { diff --git a/crypto/ocsp/ocsp_lib.c b/crypto/ocsp/ocsp_lib.c index d04213df3f..f633ca749b 100644 --- a/crypto/ocsp/ocsp_lib.c +++ b/crypto/ocsp/ocsp_lib.c @@ -64,7 +64,6 @@ #include <stdio.h> #include <cryptlib.h> #include <openssl/objects.h> -#include <openssl/asn1_mac.h> #include <openssl/x509.h> #include <openssl/pem.h> #include <openssl/x509v3.h> @@ -142,14 +141,14 @@ OCSP_CERTSTATUS *OCSP_cert_status_new(int status, int reason, char *tim) OCSP_CERTSTATUS *cs = NULL; if (!(cs = OCSP_CERTSTATUS_new())) goto err; - if ((cs->tag = status) == V_OCSP_CERTSTATUS_REVOKED) + if ((cs->type = status) == V_OCSP_CERTSTATUS_REVOKED) { if (!time) { OCSPerr(OCSP_F_CERT_STATUS_NEW,OCSP_R_REVOKED_NO_TIME); goto err; } - if (!(cs->revoked = ri = OCSP_REVOKEDINFO_new())) goto err; + if (!(cs->value.revoked = ri = OCSP_REVOKEDINFO_new())) goto err; if (!ASN1_GENERALIZEDTIME_set_string(ri->revocationTime,tim)) goto err; if (reason != OCSP_REVOKED_STATUS_NOSTATUS) @@ -239,7 +238,7 @@ err: return 0; } -OCSP_BASICRESP *OCSP_basic_response_new(int tag, +OCSP_BASICRESP *OCSP_basic_response_new(int type, X509* cert, STACK_OF(X509_EXTENSION) *extensions) { @@ -251,7 +250,7 @@ OCSP_BASICRESP *OCSP_basic_response_new(int tag, if (!(rsp = OCSP_BASICRESP_new())) goto err; rid = rsp->tbsResponseData->responderId; - switch (rid->tag = tag) + switch (rid->type = type) { case V_OCSP_RESPID_NAME: /* cert is user cert */ @@ -601,11 +600,11 @@ int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o) goto err; cst = single->certStatus; if (BIO_printf(bp,"\n Cert Status: %s (0x%x)", - ocspCertStatus2string(cst->tag), cst->tag) <= 0) + ocspCertStatus2string(cst->type), cst->type) <= 0) goto err; - if (cst->tag == V_OCSP_CERTSTATUS_REVOKED) + if (cst->type == V_OCSP_CERTSTATUS_REVOKED) { - rev = cst->revoked; + rev = cst->value.revoked; if (BIO_printf(bp, "\n Revocation Time: ") <= 0) goto err; if (!ASN1_GENERALIZEDTIME_print(bp, diff --git a/crypto/ocsp/ocsp_req.c b/crypto/ocsp/ocsp_req.c index e1be8bdf3a..eb3a09e31b 100644 --- a/crypto/ocsp/ocsp_req.c +++ b/crypto/ocsp/ocsp_req.c @@ -62,101 +62,11 @@ */ #include <openssl/bio.h> -#include <openssl/asn1_mac.h> +#include <openssl/asn1.h> #include <openssl/err.h> #include <openssl/ocsp.h> #include <openssl/x509v3.h> -/* Make sure we work well with older variants of OpenSSL */ -#ifndef OPENSSL_malloc -#define OPENSSL_malloc Malloc -#endif -#ifndef OPENSSL_realloc -#define OPENSSL_realloc Realloc -#endif -#ifndef OPENSSL_free -#define OPENSSL_free Free -#endif - -IMPLEMENT_STACK_OF(OCSP_ONEREQ) -IMPLEMENT_ASN1_SET_OF(OCSP_ONEREQ) - -OCSP_REQINFO *OCSP_REQINFO_new(void) - { - OCSP_REQINFO *ret=NULL; - ASN1_CTX c; - - M_ASN1_New_Malloc(ret, OCSP_REQINFO); - ret->version = NULL; - ret->requestorName = NULL; - ret->requestList = NULL; - ret->requestExtensions = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_REQINFO_NEW); - } - -void OCSP_REQINFO_free(OCSP_REQINFO *a) - { - if (a == NULL) return; - ASN1_INTEGER_free(a->version); - GENERAL_NAME_free(a->requestorName); - sk_OCSP_ONEREQ_pop_free(a->requestList, OCSP_ONEREQ_free); - sk_X509_EXTENSION_pop_free(a->requestExtensions, X509_EXTENSION_free); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_REQINFO(OCSP_REQINFO *a, - unsigned char **pp) - { - int v1=0,v2=0,v3=0; - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1); - M_ASN1_I2D_len_EXP_opt(a->requestorName,i2d_GENERAL_NAME,1,v2); - M_ASN1_I2D_len_SEQUENCE_type(OCSP_ONEREQ, - a->requestList, i2d_OCSP_ONEREQ); - M_ASN1_I2D_len_EXP_SEQUENCE_opt_type(X509_EXTENSION, - a->requestExtensions, i2d_X509_EXTENSION,2,V_ASN1_SEQUENCE,v3); - - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1); - M_ASN1_I2D_put_EXP_opt(a->requestorName,i2d_GENERAL_NAME,1,v2); - M_ASN1_I2D_put_SEQUENCE_type(OCSP_ONEREQ,a->requestList,i2d_OCSP_ONEREQ); - M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(X509_EXTENSION,a->requestExtensions,i2d_X509_EXTENSION,2,V_ASN1_SEQUENCE,v3); - - M_ASN1_I2D_finish(); - } - -OCSP_REQINFO *d2i_OCSP_REQINFO(OCSP_REQINFO **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_REQINFO *,OCSP_REQINFO_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - /* we have the optional version field */ - if (M_ASN1_next == (V_ASN1_CONTEXT_SPECIFIC | V_ASN1_CONSTRUCTED | 0)) - { M_ASN1_D2I_get_EXP_opt(ret->version,d2i_ASN1_INTEGER,0);} - else - { - if (ret->version != NULL) - { - ASN1_INTEGER_free(ret->version); - ret->version=NULL; - } - } - M_ASN1_D2I_get_EXP_opt(ret->requestorName,d2i_GENERAL_NAME,1); - M_ASN1_D2I_get_seq_type(OCSP_ONEREQ, ret->requestList, - d2i_OCSP_ONEREQ,OCSP_ONEREQ_free); - /* there is no M_ASN1_D2I_get_EXP_seq* code, so - we're using the set version */ - M_ASN1_D2I_get_EXP_set_opt_type(X509_EXTENSION, - ret->requestExtensions,d2i_X509_EXTENSION, - X509_EXTENSION_free,2,V_ASN1_SEQUENCE); - M_ASN1_D2I_Finish(a,OCSP_REQINFO_free,ASN1_F_D2I_OCSP_REQINFO); - } - int i2a_OCSP_REQINFO(BIO *bp, OCSP_REQINFO* a) { @@ -183,53 +93,6 @@ int i2a_OCSP_REQINFO(BIO *bp, return j; } -OCSP_REQUEST *OCSP_REQUEST_new(void) - { - ASN1_CTX c; - OCSP_REQUEST *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_REQUEST); - M_ASN1_New(ret->tbsRequest, OCSP_REQINFO_new); - ret->optionalSignature = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_REQUEST_NEW); - } - -void OCSP_REQUEST_free(OCSP_REQUEST *a) - { - if (a == NULL) return; - OCSP_REQINFO_free(a->tbsRequest); - OCSP_SIGNATURE_free(a->optionalSignature); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_REQUEST(OCSP_REQUEST *a, - unsigned char **pp) - { - int v=0; - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len(a->tbsRequest, i2d_OCSP_REQINFO); - M_ASN1_I2D_len_EXP_opt(a->optionalSignature, i2d_OCSP_SIGNATURE, 0, v); - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put(a->tbsRequest, i2d_OCSP_REQINFO); - M_ASN1_I2D_put_EXP_opt(a->optionalSignature, i2d_OCSP_SIGNATURE, 0, v); - M_ASN1_I2D_finish(); - } - -OCSP_REQUEST *d2i_OCSP_REQUEST(OCSP_REQUEST **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_REQUEST *,OCSP_REQUEST_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - M_ASN1_D2I_get(ret->tbsRequest, d2i_OCSP_REQINFO); - M_ASN1_D2I_get_EXP_opt(ret->optionalSignature, d2i_OCSP_SIGNATURE, 0); - M_ASN1_D2I_Finish(a,OCSP_REQUEST_free,ASN1_F_D2I_OCSP_REQUEST); - } - int i2a_OCSP_REQUEST(BIO *bp, OCSP_REQUEST* a) { @@ -238,61 +101,6 @@ int i2a_OCSP_REQUEST(BIO *bp, return a->optionalSignature ? 2 : 1; } -OCSP_ONEREQ *OCSP_ONEREQ_new(void) - { - ASN1_CTX c; - OCSP_ONEREQ *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_ONEREQ); - M_ASN1_New(ret->reqCert, OCSP_CERTID_new); - ret->singleRequestExtensions = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_ONEREQ_NEW); - } - -void OCSP_ONEREQ_free(OCSP_ONEREQ *a) - { - if (a == NULL) return; - OCSP_CERTID_free(a->reqCert); - sk_X509_EXTENSION_pop_free(a->singleRequestExtensions, X509_EXTENSION_free); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_ONEREQ(OCSP_ONEREQ *a, - unsigned char **pp) - { - int v=0; - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len(a->reqCert, i2d_OCSP_CERTID); - M_ASN1_I2D_len_EXP_SEQUENCE_opt_type(X509_EXTENSION, - a->singleRequestExtensions, i2d_X509_EXTENSION, 0, - V_ASN1_SEQUENCE, v); - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put(a->reqCert, i2d_OCSP_CERTID); - M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(X509_EXTENSION, - a->singleRequestExtensions, i2d_X509_EXTENSION, 0, - V_ASN1_SEQUENCE, v); - M_ASN1_I2D_finish(); - } - -OCSP_ONEREQ *d2i_OCSP_ONEREQ(OCSP_ONEREQ **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_ONEREQ *,OCSP_ONEREQ_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - M_ASN1_D2I_get(ret->reqCert, d2i_OCSP_CERTID); - /* there is no M_ASN1_D2I_get_EXP_seq* code, so - we're using the set version */ - M_ASN1_D2I_get_EXP_set_opt_type(X509_EXTENSION, - ret->singleRequestExtensions, d2i_X509_EXTENSION, - X509_EXTENSION_free, 0, V_ASN1_SEQUENCE); - M_ASN1_D2I_Finish(a,OCSP_ONEREQ_free,ASN1_F_D2I_OCSP_ONEREQ); - } - int i2a_OCSP_ONEREQ(BIO *bp, OCSP_ONEREQ* a) { diff --git a/crypto/ocsp/ocsp_res.c b/crypto/ocsp/ocsp_res.c index 34443aba11..986ab8ebb5 100644 --- a/crypto/ocsp/ocsp_res.c +++ b/crypto/ocsp/ocsp_res.c @@ -63,71 +63,11 @@ #include <openssl/err.h> #include <openssl/objects.h> -#include <openssl/asn1_mac.h> +#include <openssl/asn1.h> #include <openssl/ocsp.h> #include <openssl/x509.h> #include <openssl/x509v3.h> -/* Make sure we work well with older variants of OpenSSL */ -#ifndef OPENSSL_malloc -#define OPENSSL_malloc Malloc -#endif -#ifndef OPENSSL_realloc -#define OPENSSL_realloc Realloc -#endif -#ifndef OPENSSL_free -#define OPENSSL_free Free -#endif - -IMPLEMENT_STACK_OF(OCSP_SINGLERESP) -IMPLEMENT_ASN1_SET_OF(OCSP_SINGLERESP) - -OCSP_RESPBYTES *OCSP_RESPBYTES_new(void) - { - ASN1_CTX c; - OCSP_RESPBYTES *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_RESPBYTES); - M_ASN1_New(ret->responseType, ASN1_OBJECT_new); - M_ASN1_New(ret->response, ASN1_OCTET_STRING_new); - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_RESPBYTES_NEW); - } - -void OCSP_RESPBYTES_free(OCSP_RESPBYTES *a) - { - if (a == NULL) return; - ASN1_OBJECT_free(a->responseType); - ASN1_OCTET_STRING_free(a->response); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_RESPBYTES(OCSP_RESPBYTES *a, - unsigned char **pp) - { - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len(a->responseType, i2d_ASN1_OBJECT); - M_ASN1_I2D_len(a->response, i2d_ASN1_OCTET_STRING); - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put(a->responseType, i2d_ASN1_OBJECT); - M_ASN1_I2D_put(a->response, i2d_ASN1_OCTET_STRING); - M_ASN1_I2D_finish(); - } - -OCSP_RESPBYTES *d2i_OCSP_RESPBYTES(OCSP_RESPBYTES **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_RESPBYTES *,OCSP_RESPBYTES_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - M_ASN1_D2I_get(ret->responseType, d2i_ASN1_OBJECT); - M_ASN1_D2I_get(ret->response, d2i_ASN1_OCTET_STRING); - M_ASN1_D2I_Finish(a,OCSP_RESPBYTES_free,ASN1_F_D2I_OCSP_RESPBYTES); - } - int i2a_OCSP_RESPBYTES(BIO *bp, OCSP_RESPBYTES* a) { @@ -136,53 +76,6 @@ int i2a_OCSP_RESPBYTES(BIO *bp, return 2; } -OCSP_RESPONSE *OCSP_RESPONSE_new(void) - { - ASN1_CTX c; - OCSP_RESPONSE *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_RESPONSE); - M_ASN1_New(ret->responseStatus, ASN1_ENUMERATED_new); - ret->responseBytes = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_RESPONSE_NEW); - } - -void OCSP_RESPONSE_free(OCSP_RESPONSE *a) - { - if (a == NULL) return; - ASN1_ENUMERATED_free(a->responseStatus); - OCSP_RESPBYTES_free(a->responseBytes); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_RESPONSE(OCSP_RESPONSE *a, - unsigned char **pp) - { - int v=0; - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len(a->responseStatus, i2d_ASN1_ENUMERATED); - M_ASN1_I2D_len_EXP_opt(a->responseBytes, i2d_OCSP_RESPBYTES, 0, v); - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put(a->responseStatus, i2d_ASN1_ENUMERATED); - M_ASN1_I2D_put_EXP_opt(a->responseBytes, i2d_OCSP_RESPBYTES, 0, v); - M_ASN1_I2D_finish(); - } - -OCSP_RESPONSE *d2i_OCSP_RESPONSE(OCSP_RESPONSE **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_RESPONSE *,OCSP_RESPONSE_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - M_ASN1_D2I_get(ret->responseStatus, d2i_ASN1_ENUMERATED); - M_ASN1_D2I_get_EXP_opt(ret->responseBytes, d2i_OCSP_RESPBYTES, 0); - M_ASN1_D2I_Finish(a,OCSP_RESPONSE_free,ASN1_F_D2I_OCSP_RESPONSE); - } - int i2a_OCSP_RESPONSE(BIO *bp, OCSP_RESPONSE* a) { i2a_ASN1_STRING(bp, a->responseStatus, V_ASN1_ENUMERATED); @@ -190,93 +83,9 @@ int i2a_OCSP_RESPONSE(BIO *bp, OCSP_RESPONSE* a) return a->responseBytes ? 2 : 1; } -OCSP_RESPID *OCSP_RESPID_new(void) - { - ASN1_CTX c; - OCSP_RESPID *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_RESPID); - ret->tag = -1; - ret->value.byName = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_RESPID_NEW); - } - -void OCSP_RESPID_free(OCSP_RESPID *a) - { - if (a == NULL) return; - switch (a->tag) - { - case V_OCSP_RESPID_NAME: - X509_NAME_free(a->value.byName); - break; - case V_OCSP_RESPID_KEY: - ASN1_OCTET_STRING_free(a->value.byKey); - break; - } - OPENSSL_free((char *)a); - } - -int i2d_OCSP_RESPID(OCSP_RESPID *a, unsigned char **pp) - { - int v=0; - M_ASN1_I2D_vars(a); - switch (a->tag) - { - case V_OCSP_RESPID_NAME: - v = i2d_X509_NAME(a->value.byName,NULL); - ret += ASN1_object_size(1, v, V_OCSP_RESPID_NAME); - if (pp==NULL) return ret; - p=*pp; - ASN1_put_object(&p, 1, v, - V_OCSP_RESPID_NAME, - V_ASN1_CONTEXT_SPECIFIC); - i2d_X509_NAME(a->value.byName,&p); - break; - case V_OCSP_RESPID_KEY: - v = i2d_ASN1_OCTET_STRING(a->value.byKey,NULL); - ret += ASN1_object_size(1, v, V_OCSP_RESPID_KEY); - if (pp==NULL) return ret; - p=*pp; - ASN1_put_object(&p, 1, v, - V_OCSP_RESPID_KEY, - V_ASN1_CONTEXT_SPECIFIC); - i2d_ASN1_OCTET_STRING(a->value.byKey,&p); - break; - } - if (pp && *pp) *pp=p; - return(r); - } - -OCSP_RESPID *d2i_OCSP_RESPID(OCSP_RESPID **a, - unsigned char **pp, - long length) - { - int inf,xclass; - M_ASN1_D2I_vars(a,OCSP_RESPID *,OCSP_RESPID_new); - - M_ASN1_D2I_Init(); - c.slen = length; /* simulate sequence */ - inf=ASN1_get_object(&c.p,&c.slen,&ret->tag,&xclass,c.slen); - if (inf & 0x80) goto err; - switch (ret->tag) - { - case V_OCSP_RESPID_NAME: - M_ASN1_D2I_get(ret->value.byName, d2i_X509_NAME); - break; - case V_OCSP_RESPID_KEY: - M_ASN1_D2I_get(ret->value.byKey, d2i_ASN1_OCTET_STRING); - break; - default: - ASN1err(ASN1_F_D2I_OCSP_RESPID,ASN1_R_BAD_TYPE); - break; - } - M_ASN1_D2I_Finish(a,OCSP_RESPID_free,ASN1_F_D2I_OCSP_RESPID); - } - int i2a_OCSP_RESPID(BIO *bp, OCSP_RESPID* a) { - switch (a->tag) + switch (a->type) { case V_OCSP_RESPID_NAME: X509_NAME_print(bp, a->value.byName, 16); @@ -289,89 +98,6 @@ int i2a_OCSP_RESPID(BIO *bp, OCSP_RESPID* a) return 1; } -OCSP_RESPDATA *OCSP_RESPDATA_new(void) - { - ASN1_CTX c; - OCSP_RESPDATA *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_RESPDATA); - ret->version = NULL; - M_ASN1_New(ret->responderId, OCSP_RESPID_new); - M_ASN1_New(ret->producedAt, ASN1_GENERALIZEDTIME_new); - ret->responses = NULL; - ret->responseExtensions = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_RESPDATA_NEW); - } - -void OCSP_RESPDATA_free(OCSP_RESPDATA *a) - { - if (a == NULL) return; - ASN1_INTEGER_free(a->version); - OCSP_RESPID_free(a->responderId); - ASN1_GENERALIZEDTIME_free(a->producedAt); - sk_OCSP_SINGLERESP_pop_free(a->responses, OCSP_SINGLERESP_free); - sk_X509_EXTENSION_pop_free(a->responseExtensions, X509_EXTENSION_free); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_RESPDATA(OCSP_RESPDATA *a, - unsigned char **pp) - { - int v1=0,v2=0; - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len_EXP_opt(a->version, i2d_ASN1_INTEGER, 0, v1); - M_ASN1_I2D_len(a->responderId, i2d_OCSP_RESPID); - M_ASN1_I2D_len(a->producedAt, i2d_ASN1_GENERALIZEDTIME); - M_ASN1_I2D_len_SEQUENCE_type(OCSP_SINGLERESP, a->responses, - i2d_OCSP_SINGLERESP); - M_ASN1_I2D_len_EXP_SEQUENCE_opt_type(X509_EXTENSION, - a->responseExtensions, i2d_X509_EXTENSION, 1, - V_ASN1_SEQUENCE, v2); - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put_EXP_opt(a->version, i2d_ASN1_INTEGER, 0, v1); - M_ASN1_I2D_put(a->responderId, i2d_OCSP_RESPID); - M_ASN1_I2D_put(a->producedAt, i2d_ASN1_GENERALIZEDTIME); - M_ASN1_I2D_put_SEQUENCE_type(OCSP_SINGLERESP, a->responses, - i2d_OCSP_SINGLERESP); - M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(X509_EXTENSION, - a->responseExtensions, i2d_X509_EXTENSION, 1, - V_ASN1_SEQUENCE, v2); - M_ASN1_I2D_finish(); - } - -OCSP_RESPDATA *d2i_OCSP_RESPDATA(OCSP_RESPDATA **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_RESPDATA *,OCSP_RESPDATA_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - /* we have the optional version field */ - if (M_ASN1_next == (V_ASN1_CONTEXT_SPECIFIC | V_ASN1_CONSTRUCTED | 0)) - { M_ASN1_D2I_get_EXP_opt(ret->version,d2i_ASN1_INTEGER,0);} - else - { - if (ret->version != NULL) - { - ASN1_INTEGER_free(ret->version); - ret->version=NULL; - } - } - M_ASN1_D2I_get(ret->responderId, d2i_OCSP_RESPID); - M_ASN1_D2I_get(ret->producedAt, d2i_ASN1_GENERALIZEDTIME); - M_ASN1_D2I_get_seq_type(OCSP_SINGLERESP, ret->responses, - d2i_OCSP_SINGLERESP, OCSP_SINGLERESP_free); - /* there is no M_ASN1_D2I_get_EXP_seq* code, so - we're using the set version */ - M_ASN1_D2I_get_EXP_set_opt_type(X509_EXTENSION, - ret->responseExtensions, d2i_X509_EXTENSION, - X509_EXTENSION_free, 1, V_ASN1_SEQUENCE); - M_ASN1_D2I_Finish(a,OCSP_RESPDATA_free,ASN1_F_D2I_OCSP_RESPDATA); - } - int i2a_OCSP_RESPDATA(BIO *bp, OCSP_RESPDATA* a) { int i, j=2; @@ -404,67 +130,6 @@ int i2a_OCSP_RESPDATA(BIO *bp, OCSP_RESPDATA* a) return j; } -OCSP_BASICRESP *OCSP_BASICRESP_new(void) - { - ASN1_CTX c; - OCSP_BASICRESP *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_BASICRESP); - M_ASN1_New(ret->tbsResponseData, OCSP_RESPDATA_new); - M_ASN1_New(ret->signatureAlgorithm, X509_ALGOR_new); - M_ASN1_New(ret->signature, ASN1_BIT_STRING_new); - ret->certs = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_BASICRESP_NEW); - } - -void OCSP_BASICRESP_free(OCSP_BASICRESP *a) - { - if (a == NULL) return; - OCSP_RESPDATA_free(a->tbsResponseData); - X509_ALGOR_free(a->signatureAlgorithm); - ASN1_BIT_STRING_free(a->signature); - sk_X509_pop_free(a->certs, X509_free); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_BASICRESP(OCSP_BASICRESP *a, unsigned char **pp) - { - int v=0; - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len(a->tbsResponseData, i2d_OCSP_RESPDATA); - M_ASN1_I2D_len(a->signatureAlgorithm, i2d_X509_ALGOR); - M_ASN1_I2D_len(a->signature, i2d_ASN1_BIT_STRING); - M_ASN1_I2D_len_EXP_SEQUENCE_opt_type(X509, a->certs, - i2d_X509, 0, V_ASN1_SEQUENCE, v); - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put(a->tbsResponseData, i2d_OCSP_RESPDATA); - M_ASN1_I2D_put(a->signatureAlgorithm, i2d_X509_ALGOR); - M_ASN1_I2D_put(a->signature, i2d_ASN1_BIT_STRING); - M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(X509, a->certs, - i2d_X509, 0, V_ASN1_SEQUENCE, v); - M_ASN1_I2D_finish(); - } - -OCSP_BASICRESP *d2i_OCSP_BASICRESP(OCSP_BASICRESP **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_BASICRESP *,OCSP_BASICRESP_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - M_ASN1_D2I_get(ret->tbsResponseData, d2i_OCSP_RESPDATA); - M_ASN1_D2I_get(ret->signatureAlgorithm, d2i_X509_ALGOR); - M_ASN1_D2I_get(ret->signature, d2i_ASN1_BIT_STRING); - /* there is no M_ASN1_D2I_get_EXP_seq* code, so - we're using the set version */ - M_ASN1_D2I_get_EXP_set_opt_type(X509, ret->certs, d2i_X509, - X509_free, 0, V_ASN1_SEQUENCE); - M_ASN1_D2I_Finish(a,OCSP_BASICRESP_free,ASN1_F_D2I_OCSP_BASICRESP); - } - int i2a_OCSP_BASICRESP(BIO *bp, OCSP_BASICRESP* a) { int i, j=3; @@ -486,52 +151,6 @@ int i2a_OCSP_BASICRESP(BIO *bp, OCSP_BASICRESP* a) return j; } -OCSP_REVOKEDINFO *OCSP_REVOKEDINFO_new(void) - { - ASN1_CTX c; - OCSP_REVOKEDINFO *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_REVOKEDINFO); - M_ASN1_New(ret->revocationTime, ASN1_GENERALIZEDTIME_new); - ret->revocationReason = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_REVOKEDINFO_NEW); - } - -void OCSP_REVOKEDINFO_free(OCSP_REVOKEDINFO *a) - { - if (a == NULL) return; - ASN1_GENERALIZEDTIME_free(a->revocationTime); - ASN1_ENUMERATED_free(a->revocationReason); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_REVOKEDINFO(OCSP_REVOKEDINFO *a, unsigned char **pp) - { - int v=0; - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len(a->revocationTime, i2d_ASN1_GENERALIZEDTIME); - M_ASN1_I2D_len_EXP_opt(a->revocationReason, i2d_ASN1_ENUMERATED, 0, v); - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put(a->revocationTime, i2d_ASN1_GENERALIZEDTIME); - M_ASN1_I2D_put_EXP_opt(a->revocationReason, i2d_ASN1_ENUMERATED, 0, v); - M_ASN1_I2D_finish(); - } - -OCSP_REVOKEDINFO *d2i_OCSP_REVOKEDINFO(OCSP_REVOKEDINFO **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_REVOKEDINFO *,OCSP_REVOKEDINFO_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - M_ASN1_D2I_get(ret->revocationTime, d2i_ASN1_GENERALIZEDTIME); - M_ASN1_D2I_get_EXP_opt(ret->revocationReason, d2i_ASN1_ENUMERATED, 0); - M_ASN1_D2I_Finish(a,OCSP_REVOKEDINFO_free,ASN1_F_D2I_OCSP_REVOKEDINFO); - } - int i2a_OCSP_REVOKEDINFO(BIO *bp, OCSP_REVOKEDINFO* a) { int i=0; @@ -544,133 +163,16 @@ int i2a_OCSP_REVOKEDINFO(BIO *bp, OCSP_REVOKEDINFO* a) return i; } -OCSP_CERTSTATUS *OCSP_CERTSTATUS_new(void) - - { - ASN1_CTX c; - OCSP_CERTSTATUS *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_CERTSTATUS); - ret->tag = -1; - ret->revoked = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_CERTSTATUS_NEW); - } - -void OCSP_CERTSTATUS_free(OCSP_CERTSTATUS *a) - { - if (a == NULL) return; - OCSP_REVOKEDINFO_free(a->revoked); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_CERTSTATUS(OCSP_CERTSTATUS *a, unsigned char **pp) - { - unsigned char *qq; - M_ASN1_I2D_vars(a); - ret += 0; /* shush, compiler, shush... */ - if (a == NULL) return(0); - switch (a->tag) - { - case V_OCSP_CERTSTATUS_GOOD: - case V_OCSP_CERTSTATUS_UNKNOWN: - r = 2; - if (pp) - { - qq=p=*pp; - ASN1_put_object(&p,0,0, - V_ASN1_NULL,V_ASN1_UNIVERSAL); - *qq=(V_ASN1_CONTEXT_SPECIFIC|a->tag| - (*qq&V_ASN1_CONSTRUCTED)); - } - break; - case V_OCSP_CERTSTATUS_REVOKED: - r = i2d_OCSP_REVOKEDINFO(a->revoked,NULL); - if (pp) - { - p=*pp; - M_ASN1_I2D_put_IMP_opt(a->revoked, - i2d_OCSP_REVOKEDINFO, - a->tag); - } - break; - - } - if (pp && *pp) *pp=p; - return(r); - } - -OCSP_CERTSTATUS *d2i_OCSP_CERTSTATUS(OCSP_CERTSTATUS **a, - unsigned char **pp, - long length) - { - int tag, xclass, error=0; - long len; - unsigned char *p, *q, t; - OCSP_CERTSTATUS* ret=NULL; - - if ((a == NULL) || ((*a) == NULL)) - { - if ((ret=(OCSP_CERTSTATUS*)OCSP_CERTSTATUS_new()) == NULL) - goto err; - } - else ret=(*a); - p=*pp; - ret->tag = (*p & ~(V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC)); - switch (ret->tag) - { - case V_OCSP_CERTSTATUS_GOOD: - case V_OCSP_CERTSTATUS_UNKNOWN: - ret->revoked = NULL; - q=p; - ASN1_get_object(&p,&len,&tag,&xclass,length); - if (len) - { - error = ASN1_R_BAD_TYPE; - goto err; - } - break; - case V_OCSP_CERTSTATUS_REVOKED: - q=p; - ASN1_get_object(&q,&len,&tag,&xclass,length); - t=*p; - *p=(t&~V_ASN1_PRIMATIVE_TAG)|V_ASN1_SEQUENCE; - q=p; - if (d2i_OCSP_REVOKEDINFO(&ret->revoked, - &p,length) == NULL) - goto err; - *q=t; - if ((p-q) != (len+2)) - { - error = ASN1_R_BAD_TYPE; - goto err; - } - break; - default: - ASN1err(ASN1_F_D2I_OCSP_CERTSTATUS,ASN1_R_BAD_TYPE); - break; - } - *pp=p; - if (a != NULL) (*a)=ret; - return(ret); -err: - ASN1err(ASN1_F_D2I_OCSP_CERTSTATUS,error); - asn1_add_error(*pp,(int)(q- *pp)); - if ((ret != NULL) && ((a == NULL) || (*a != ret))) - OCSP_CERTSTATUS_free(ret); - return(NULL); - } - int i2a_OCSP_CERTSTATUS(BIO *bp, OCSP_CERTSTATUS* a) { - switch (a->tag) + switch (a->type) { case V_OCSP_CERTSTATUS_GOOD: BIO_puts(bp, "CertStatus: good"); break; case V_OCSP_CERTSTATUS_REVOKED: BIO_puts(bp, "CertStatus: revoked"); - i2a_OCSP_REVOKEDINFO(bp, a->revoked); + i2a_OCSP_REVOKEDINFO(bp, a->value.revoked); break; case V_OCSP_CERTSTATUS_UNKNOWN: BIO_puts(bp, "CertStatus: unknown"); @@ -679,71 +181,6 @@ int i2a_OCSP_CERTSTATUS(BIO *bp, OCSP_CERTSTATUS* a) return 1; } -OCSP_SINGLERESP *OCSP_SINGLERESP_new(void) - { - ASN1_CTX c; - OCSP_SINGLERESP *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_SINGLERESP); - M_ASN1_New(ret->certId, OCSP_CERTID_new); - M_ASN1_New(ret->certStatus, OCSP_CERTSTATUS_new); - M_ASN1_New(ret->thisUpdate, ASN1_GENERALIZEDTIME_new); - ret->nextUpdate = NULL; - ret->singleExtensions = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_SINGLERESP_NEW); - } - -void OCSP_SINGLERESP_free(OCSP_SINGLERESP *a) - { - if (a == NULL) return; - OCSP_CERTID_free(a->certId); - OCSP_CERTSTATUS_free(a->certStatus); - ASN1_GENERALIZEDTIME_free(a->thisUpdate); - ASN1_GENERALIZEDTIME_free(a->nextUpdate); - sk_X509_EXTENSION_pop_free(a->singleExtensions, X509_EXTENSION_free); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_SINGLERESP(OCSP_SINGLERESP *a, unsigned char **pp) - { - int v1=0,v2=0; - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len(a->certId, i2d_OCSP_CERTID); - M_ASN1_I2D_len(a->certStatus, i2d_OCSP_CERTSTATUS); - M_ASN1_I2D_len(a->thisUpdate, i2d_ASN1_GENERALIZEDTIME); - M_ASN1_I2D_len_EXP_opt(a->nextUpdate, i2d_ASN1_GENERALIZEDTIME, 0, v1); - M_ASN1_I2D_len_EXP_SEQUENCE_opt_type(X509_EXTENSION, - a->singleExtensions, i2d_X509_EXTENSION, 1, V_ASN1_SEQUENCE, v2); - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put(a->certId, i2d_OCSP_CERTID); - M_ASN1_I2D_put(a->certStatus, i2d_OCSP_CERTSTATUS); - M_ASN1_I2D_put(a->thisUpdate, i2d_ASN1_GENERALIZEDTIME); - M_ASN1_I2D_put_EXP_opt(a->nextUpdate, i2d_ASN1_GENERALIZEDTIME, 0, v1); - M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(X509_EXTENSION, - a->singleExtensions, i2d_X509_EXTENSION, 1, V_ASN1_SEQUENCE, v2); - M_ASN1_I2D_finish(); - } - -OCSP_SINGLERESP *d2i_OCSP_SINGLERESP(OCSP_SINGLERESP **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_SINGLERESP *,OCSP_SINGLERESP_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - M_ASN1_D2I_get(ret->certId, d2i_OCSP_CERTID); - M_ASN1_D2I_get(ret->certStatus, d2i_OCSP_CERTSTATUS); - M_ASN1_D2I_get(ret->thisUpdate, d2i_ASN1_GENERALIZEDTIME); - M_ASN1_D2I_get_EXP_opt(ret->nextUpdate, d2i_ASN1_GENERALIZEDTIME, 0); - /* there is no M_ASN1_D2I_get_EXP_seq*, so had to use set here*/ - M_ASN1_D2I_get_EXP_set_opt_type(X509_EXTENSION, ret->singleExtensions, - d2i_X509_EXTENSION, X509_EXTENSION_free, 1, V_ASN1_SEQUENCE); - M_ASN1_D2I_Finish(a,OCSP_SINGLERESP_free,ASN1_F_D2I_OCSP_SINGLERESP); - } - int i2a_OCSP_SINGLERESP(BIO *bp, OCSP_SINGLERESP* a) { int /* XXX i, */ j=3; @@ -772,58 +209,6 @@ int i2a_OCSP_SINGLERESP(BIO *bp, OCSP_SINGLERESP* a) return j; } -OCSP_CRLID *OCSP_CRLID_new(void) - { - ASN1_CTX c; - OCSP_CRLID *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_CRLID); - ret->crlUrl = NULL; - ret->crlNum = NULL; - ret->crlTime = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_CRLID_NEW); - } - -void OCSP_CRLID_free(OCSP_CRLID *a) - { - if (a == NULL) return; - ASN1_IA5STRING_free(a->crlUrl); - ASN1_INTEGER_free(a->crlNum); - ASN1_GENERALIZEDTIME_free(a->crlTime); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_CRLID(OCSP_CRLID *a, - unsigned char **pp) - { - int v1=0,v2=0,v3=0; - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len_EXP_opt(a->crlUrl, i2d_ASN1_IA5STRING, 0, v1); - M_ASN1_I2D_len_EXP_opt(a->crlNum, i2d_ASN1_INTEGER, 1, v2); - M_ASN1_I2D_len_EXP_opt(a->crlTime, i2d_ASN1_GENERALIZEDTIME, 2, v3); - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put_EXP_opt(a->crlUrl, i2d_ASN1_IA5STRING, 0, v1); - M_ASN1_I2D_put_EXP_opt(a->crlNum, i2d_ASN1_INTEGER, 1, v2); - M_ASN1_I2D_put_EXP_opt(a->crlTime, i2d_ASN1_GENERALIZEDTIME, 2, v3); - M_ASN1_I2D_finish(); - } - -OCSP_CRLID *d2i_OCSP_CRLID(OCSP_CRLID **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_CRLID *,OCSP_CRLID_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - M_ASN1_D2I_get_EXP_opt(ret->crlUrl, d2i_ASN1_IA5STRING, 0); - M_ASN1_D2I_get_EXP_opt(ret->crlNum, d2i_ASN1_INTEGER, 1); - M_ASN1_D2I_get_EXP_opt(ret->crlTime, d2i_ASN1_GENERALIZEDTIME, 2); - M_ASN1_D2I_Finish(a,OCSP_CRLID_free,ASN1_F_D2I_OCSP_CRLID); - } - int i2a_OCSP_CRLID(BIO *bp, OCSP_CRLID* a) { int i = 0; @@ -834,55 +219,6 @@ int i2a_OCSP_CRLID(BIO *bp, OCSP_CRLID* a) return i; } -OCSP_SERVICELOC *OCSP_SERVICELOC_new(void) - { - ASN1_CTX c; - OCSP_SERVICELOC *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_SERVICELOC); - M_ASN1_New(ret->issuer, X509_NAME_new); - ret->locator = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_SERVICELOC_NEW); - } - -void OCSP_SERVICELOC_free(OCSP_SERVICELOC *a) - { - if (a == NULL) return; - X509_NAME_free(a->issuer); - sk_ACCESS_DESCRIPTION_pop_free(a->locator, ACCESS_DESCRIPTION_free); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_SERVICELOC(OCSP_SERVICELOC *a, - unsigned char **pp) - { - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len(a->issuer, i2d_X509_NAME); - M_ASN1_I2D_len_SEQUENCE_opt_type(ACCESS_DESCRIPTION, - a->locator, i2d_ACCESS_DESCRIPTION); - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put(a->issuer, i2d_X509_NAME); - M_ASN1_I2D_put_SEQUENCE_opt_type(ACCESS_DESCRIPTION, - a->locator, i2d_ACCESS_DESCRIPTION); - M_ASN1_I2D_finish(); - } - -OCSP_SERVICELOC *d2i_OCSP_SERVICELOC(OCSP_SERVICELOC **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_SERVICELOC *,OCSP_SERVICELOC_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - M_ASN1_D2I_get(ret->issuer, d2i_X509_NAME); - M_ASN1_D2I_get_seq_opt_type(ACCESS_DESCRIPTION, ret->locator, - d2i_ACCESS_DESCRIPTION,ACCESS_DESCRIPTION_free); - M_ASN1_D2I_Finish(a,OCSP_SERVICELOC_free,ASN1_F_D2I_OCSP_SERVICELOC); - } - int i2a_OCSP_SERVICELOC(BIO *bp, OCSP_SERVICELOC* a) { diff --git a/crypto/ocsp/ocsp_sig.c b/crypto/ocsp/ocsp_sig.c index c94167eabe..f9f3afb820 100644 --- a/crypto/ocsp/ocsp_sig.c +++ b/crypto/ocsp/ocsp_sig.c @@ -62,79 +62,11 @@ */ #include <openssl/bio.h> -#include <openssl/asn1_mac.h> +#include <openssl/asn1.h> #include <openssl/err.h> #include <openssl/ocsp.h> #include <openssl/x509.h> -/* Make sure we work well with older variants of OpenSSL */ -#ifndef OPENSSL_malloc -#define OPENSSL_malloc Malloc -#endif -#ifndef OPENSSL_realloc -#define OPENSSL_realloc Realloc -#endif -#ifndef OPENSSL_free -#define OPENSSL_free Free -#endif - -OCSP_SIGNATURE *OCSP_SIGNATURE_new(void) - { - ASN1_CTX c; - OCSP_SIGNATURE *ret=NULL; - - M_ASN1_New_Malloc(ret, OCSP_SIGNATURE); - M_ASN1_New(ret->signatureAlgorithm, X509_ALGOR_new); - M_ASN1_New(ret->signature, ASN1_BIT_STRING_new); - ret->certs = NULL; - return(ret); - M_ASN1_New_Error(ASN1_F_OCSP_SIGNATURE_NEW); - } - -void OCSP_SIGNATURE_free(OCSP_SIGNATURE *a) - { - if (a == NULL) return; - X509_ALGOR_free(a->signatureAlgorithm); - ASN1_BIT_STRING_free(a->signature); - if (a->certs) sk_X509_pop_free(a->certs, X509_free); - OPENSSL_free((char *)a); - } - -int i2d_OCSP_SIGNATURE(OCSP_SIGNATURE *a, - unsigned char **pp) - { - int v=0; - M_ASN1_I2D_vars(a); - - M_ASN1_I2D_len(a->signatureAlgorithm, i2d_X509_ALGOR); - M_ASN1_I2D_len(a->signature, i2d_ASN1_BIT_STRING); - M_ASN1_I2D_len_EXP_SEQUENCE_opt_type(X509, a->certs, i2d_X509, - 0, V_ASN1_SEQUENCE, v); - M_ASN1_I2D_seq_total(); - M_ASN1_I2D_put(a->signatureAlgorithm, i2d_X509_ALGOR); - M_ASN1_I2D_put(a->signature, i2d_ASN1_BIT_STRING); - M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(X509, a->certs, i2d_X509, 0, - V_ASN1_SEQUENCE, v); - M_ASN1_I2D_finish(); - } - -OCSP_SIGNATURE *d2i_OCSP_SIGNATURE(OCSP_SIGNATURE **a, - unsigned char **pp, - long length) - { - M_ASN1_D2I_vars(a,OCSP_SIGNATURE *,OCSP_SIGNATURE_new); - - M_ASN1_D2I_Init(); - M_ASN1_D2I_start_sequence(); - M_ASN1_D2I_get(ret->signatureAlgorithm, d2i_X509_ALGOR); - M_ASN1_D2I_get(ret->signature, d2i_ASN1_BIT_STRING); - /* there is no M_ASN1_D2I_get_EXP_seq* code, so - we're using the set version */ - M_ASN1_D2I_get_EXP_set_opt_type(X509, ret->certs, d2i_X509, - X509_free, 0, V_ASN1_SEQUENCE); - M_ASN1_D2I_Finish(a,OCSP_SIGNATURE_free,ASN1_F_D2I_OCSP_SIGNATURE); - } - int i2a_OCSP_SIGNATURE(BIO *bp, OCSP_SIGNATURE* a) { |