diff options
author | Richard Levitte <levitte@openssl.org> | 2000-10-27 11:05:35 +0000 |
---|---|---|
committer | Richard Levitte <levitte@openssl.org> | 2000-10-27 11:05:35 +0000 |
commit | eb64730b9cb6fe9cb5bfa4b0b54bf8c9193ced2b (patch) | |
tree | 0149f424193ee8b5cc38e590ba4766d829e8e2f7 /crypto | |
parent | 34a1488220e7b6338d750ae5a00853c4ee89d267 (diff) |
The majority of the OCSP code from CertCo.
Diffstat (limited to 'crypto')
-rw-r--r-- | crypto/asn1/asn1.h | 30 | ||||
-rw-r--r-- | crypto/asn1/asn1_err.c | 30 | ||||
-rw-r--r-- | crypto/asn1/t_x509.c | 50 | ||||
-rw-r--r-- | crypto/err/err.h | 2 | ||||
-rw-r--r-- | crypto/err/openssl.ec | 1 | ||||
-rw-r--r-- | crypto/ocsp/Makefile.ssl | 243 | ||||
-rw-r--r-- | crypto/ocsp/ocsp.h | 591 | ||||
-rw-r--r-- | crypto/ocsp/ocsp_cid.c | 157 | ||||
-rw-r--r-- | crypto/ocsp/ocsp_err.c | 116 | ||||
-rw-r--r-- | crypto/ocsp/ocsp_ext.c | 347 | ||||
-rw-r--r-- | crypto/ocsp/ocsp_lib.c | 791 | ||||
-rw-r--r-- | crypto/ocsp/ocsp_req.c | 316 | ||||
-rw-r--r-- | crypto/ocsp/ocsp_res.c | 896 | ||||
-rw-r--r-- | crypto/ocsp/ocsp_sig.c | 157 | ||||
-rw-r--r-- | crypto/stack/safestack.h | 58 | ||||
-rw-r--r-- | crypto/x509/x509.h | 1 | ||||
-rw-r--r-- | crypto/x509v3/v3_info.c | 9 | ||||
-rw-r--r-- | crypto/x509v3/x509v3.h | 1 |
18 files changed, 3796 insertions, 0 deletions
diff --git a/crypto/asn1/asn1.h b/crypto/asn1/asn1.h index 6f956b1963..3daf4e483a 100644 --- a/crypto/asn1/asn1.h +++ b/crypto/asn1/asn1.h @@ -956,6 +956,21 @@ void ASN1_STRING_TABLE_cleanup(void); #define ASN1_F_D2I_NETSCAPE_SPKAC 143 #define ASN1_F_D2I_NETSCAPE_SPKI 144 #define ASN1_F_D2I_NOTICEREF 268 +#define ASN1_F_D2I_OCSP_BASICRESP 293 +#define ASN1_F_D2I_OCSP_CERTID 294 +#define ASN1_F_D2I_OCSP_CERTSTATUS 295 +#define ASN1_F_D2I_OCSP_CRLID 296 +#define ASN1_F_D2I_OCSP_ONEREQ 297 +#define ASN1_F_D2I_OCSP_REQINFO 298 +#define ASN1_F_D2I_OCSP_REQUEST 299 +#define ASN1_F_D2I_OCSP_RESPBYTES 300 +#define ASN1_F_D2I_OCSP_RESPDATA 301 +#define ASN1_F_D2I_OCSP_RESPID 302 +#define ASN1_F_D2I_OCSP_RESPONSE 303 +#define ASN1_F_D2I_OCSP_REVOKEDINFO 304 +#define ASN1_F_D2I_OCSP_SERVICELOC 305 +#define ASN1_F_D2I_OCSP_SIGNATURE 306 +#define ASN1_F_D2I_OCSP_SINGLERESP 307 #define ASN1_F_D2I_OTHERNAME 287 #define ASN1_F_D2I_PBE2PARAM 262 #define ASN1_F_D2I_PBEPARAM 249 @@ -1027,6 +1042,21 @@ void ASN1_STRING_TABLE_cleanup(void); #define ASN1_F_NETSCAPE_SPKAC_NEW 190 #define ASN1_F_NETSCAPE_SPKI_NEW 191 #define ASN1_F_NOTICEREF_NEW 272 +#define ASN1_F_OCSP_BASICRESP_NEW 308 +#define ASN1_F_OCSP_CERTID_NEW 309 +#define ASN1_F_OCSP_CERTSTATUS_NEW 310 +#define ASN1_F_OCSP_CRLID_NEW 311 +#define ASN1_F_OCSP_ONEREQ_NEW 312 +#define ASN1_F_OCSP_REQINFO_NEW 313 +#define ASN1_F_OCSP_REQUEST_NEW 314 +#define ASN1_F_OCSP_RESPBYTES_NEW 315 +#define ASN1_F_OCSP_RESPDATA_NEW 316 +#define ASN1_F_OCSP_RESPID_NEW 317 +#define ASN1_F_OCSP_RESPONSE_NEW 318 +#define ASN1_F_OCSP_REVOKEDINFO_NEW 319 +#define ASN1_F_OCSP_SERVICELOC_NEW 320 +#define ASN1_F_OCSP_SIGNATURE_NEW 321 +#define ASN1_F_OCSP_SINGLERESP_NEW 322 #define ASN1_F_OTHERNAME_NEW 288 #define ASN1_F_PBE2PARAM_NEW 264 #define ASN1_F_PBEPARAM_NEW 251 diff --git a/crypto/asn1/asn1_err.c b/crypto/asn1/asn1_err.c index cecd555c88..3a53cb33c5 100644 --- a/crypto/asn1/asn1_err.c +++ b/crypto/asn1/asn1_err.c @@ -141,6 +141,21 @@ static ERR_STRING_DATA ASN1_str_functs[]= {ERR_PACK(0,ASN1_F_D2I_NETSCAPE_SPKAC,0), "d2i_NETSCAPE_SPKAC"}, {ERR_PACK(0,ASN1_F_D2I_NETSCAPE_SPKI,0), "d2i_NETSCAPE_SPKI"}, {ERR_PACK(0,ASN1_F_D2I_NOTICEREF,0), "d2i_NOTICEREF"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_BASICRESP,0), "d2i_OCSP_BASICRESP"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_CERTID,0), "d2i_OCSP_CERTID"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_CERTSTATUS,0), "d2i_OCSP_CERTSTATUS"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_CRLID,0), "d2i_OCSP_CRLID"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_ONEREQ,0), "d2i_OCSP_ONEREQ"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_REQINFO,0), "d2i_OCSP_REQINFO"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_REQUEST,0), "d2i_OCSP_REQUEST"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_RESPBYTES,0), "d2i_OCSP_RESPBYTES"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_RESPDATA,0), "d2i_OCSP_RESPDATA"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_RESPID,0), "d2i_OCSP_RESPID"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_RESPONSE,0), "d2i_OCSP_RESPONSE"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_REVOKEDINFO,0), "d2i_OCSP_REVOKEDINFO"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_SERVICELOC,0), "d2i_OCSP_SERVICELOC"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_SIGNATURE,0), "d2i_OCSP_SIGNATURE"}, +{ERR_PACK(0,ASN1_F_D2I_OCSP_SINGLERESP,0), "d2i_OCSP_SINGLERESP"}, {ERR_PACK(0,ASN1_F_D2I_OTHERNAME,0), "d2i_OTHERNAME"}, {ERR_PACK(0,ASN1_F_D2I_PBE2PARAM,0), "d2i_PBE2PARAM"}, {ERR_PACK(0,ASN1_F_D2I_PBEPARAM,0), "d2i_PBEPARAM"}, @@ -212,6 +227,21 @@ static ERR_STRING_DATA ASN1_str_functs[]= {ERR_PACK(0,ASN1_F_NETSCAPE_SPKAC_NEW,0), "NETSCAPE_SPKAC_new"}, {ERR_PACK(0,ASN1_F_NETSCAPE_SPKI_NEW,0), "NETSCAPE_SPKI_new"}, {ERR_PACK(0,ASN1_F_NOTICEREF_NEW,0), "NOTICEREF_new"}, +{ERR_PACK(0,ASN1_F_OCSP_BASICRESP_NEW,0), "OCSP_BASICRESP_new"}, +{ERR_PACK(0,ASN1_F_OCSP_CERTID_NEW,0), "OCSP_CERTID_new"}, +{ERR_PACK(0,ASN1_F_OCSP_CERTSTATUS_NEW,0), "OCSP_CERTSTATUS_new"}, +{ERR_PACK(0,ASN1_F_OCSP_CRLID_NEW,0), "OCSP_CRLID_new"}, +{ERR_PACK(0,ASN1_F_OCSP_ONEREQ_NEW,0), "OCSP_ONEREQ_new"}, +{ERR_PACK(0,ASN1_F_OCSP_REQINFO_NEW,0), "OCSP_REQINFO_new"}, +{ERR_PACK(0,ASN1_F_OCSP_REQUEST_NEW,0), "OCSP_REQUEST_new"}, +{ERR_PACK(0,ASN1_F_OCSP_RESPBYTES_NEW,0), "OCSP_RESPBYTES_new"}, +{ERR_PACK(0,ASN1_F_OCSP_RESPDATA_NEW,0), "OCSP_RESPDATA_new"}, +{ERR_PACK(0,ASN1_F_OCSP_RESPID_NEW,0), "OCSP_RESPID_new"}, +{ERR_PACK(0,ASN1_F_OCSP_RESPONSE_NEW,0), "OCSP_RESPONSE_new"}, +{ERR_PACK(0,ASN1_F_OCSP_REVOKEDINFO_NEW,0), "OCSP_REVOKEDINFO_new"}, +{ERR_PACK(0,ASN1_F_OCSP_SERVICELOC_NEW,0), "OCSP_SERVICELOC_new"}, +{ERR_PACK(0,ASN1_F_OCSP_SIGNATURE_NEW,0), "OCSP_SIGNATURE_new"}, +{ERR_PACK(0,ASN1_F_OCSP_SINGLERESP_NEW,0), "OCSP_SINGLERESP_new"}, {ERR_PACK(0,ASN1_F_OTHERNAME_NEW,0), "OTHERNAME_new"}, {ERR_PACK(0,ASN1_F_PBE2PARAM_NEW,0), "PBE2PARAM_new"}, {ERR_PACK(0,ASN1_F_PBEPARAM_NEW,0), "PBEPARAM_new"}, diff --git a/crypto/asn1/t_x509.c b/crypto/asn1/t_x509.c index f2979bf5a7..823c20860c 100644 --- a/crypto/asn1/t_x509.c +++ b/crypto/asn1/t_x509.c @@ -282,6 +282,56 @@ err: return(ret); } +int X509_ocspid_print (BIO *bp, X509 *x) + { + unsigned char *der=NULL ; + unsigned char *dertmp; + int derlen; + int i; + SHA_CTX SHA1buf ; + unsigned char SHA1md[SHA_DIGEST_LENGTH]; + + /* display the hash of the subject as it would appear + in OCSP requests */ + if (BIO_printf(bp," Subject OCSP hash: ") <= 0) + goto err; + derlen = i2d_X509_NAME(x->cert_info->subject, NULL); + if ((der = dertmp = (unsigned char *)OPENSSL_malloc (derlen)) == NULL) + goto err; + i2d_X509_NAME(x->cert_info->subject, &dertmp); + + SHA1_Init(&SHA1buf); + SHA1_Update(&SHA1buf, der, derlen); + SHA1_Final(SHA1md,&SHA1buf); + for (i=0; i < SHA_DIGEST_LENGTH; i++) + { + if (BIO_printf(bp,"%02X",SHA1md[i]) <= 0) goto err; + } + OPENSSL_free (der); + der=NULL; + + /* display the hash of the public key as it would appear + in OCSP requests */ + if (BIO_printf(bp,"\n Public key OCSP hash: ") <= 0) + goto err; + + SHA1_Init(&SHA1buf); + SHA1_Update(&SHA1buf, x->cert_info->key->public_key->data, + x->cert_info->key->public_key->length); + SHA1_Final(SHA1md,&SHA1buf); + for (i=0; i < SHA_DIGEST_LENGTH; i++) + { + if (BIO_printf(bp,"%02X",SHA1md[i]) <= 0) + goto err; + } + BIO_printf(bp,"\n"); + + return (1); +err: + if (der != NULL) OPENSSL_free(der); + return(0); + } + int ASN1_STRING_print(BIO *bp, ASN1_STRING *v) { int i,n; diff --git a/crypto/err/err.h b/crypto/err/err.h index 7388a4a937..b4ced575df 100644 --- a/crypto/err/err.h +++ b/crypto/err/err.h @@ -133,6 +133,7 @@ typedef struct err_state_st #define ERR_LIB_RAND 36 #define ERR_LIB_DSO 37 #define ERR_LIB_ENGINE 38 +#define ERR_LIB_OCSP 39 #define ERR_LIB_USER 128 @@ -163,6 +164,7 @@ typedef struct err_state_st #define RANDerr(f,r) ERR_PUT_error(ERR_LIB_RAND,(f),(r),ERR_file_name,__LINE__) #define DSOerr(f,r) ERR_PUT_error(ERR_LIB_DSO,(f),(r),ERR_file_name,__LINE__) #define ENGINEerr(f,r) ERR_PUT_error(ERR_LIB_ENGINE,(f),(r),ERR_file_name,__LINE__) +#define OCSPerr(f,r) ERR_PUT_error(ERR_LIB_OCSP,(f),(r),ERR_file_name,__LINE__) /* Borland C seems too stupid to be able to shift and do longs in * the pre-processor :-( */ diff --git a/crypto/err/openssl.ec b/crypto/err/openssl.ec index 861d680e07..9bd267bda2 100644 --- a/crypto/err/openssl.ec +++ b/crypto/err/openssl.ec @@ -9,6 +9,7 @@ L EVP crypto/evp/evp.h crypto/evp/evp_err.c L BUF crypto/buffer/buffer.h crypto/buffer/buf_err.c L BIO crypto/bio/bio.h crypto/bio/bio_err.c L OBJ crypto/objects/objects.h crypto/objects/obj_err.c +L OCSP crypto/ocsp/ocsp.h crypto/ocsp/ocsp_err.c L PEM crypto/pem/pem.h crypto/pem/pem_err.c L X509 crypto/x509/x509.h crypto/x509/x509_err.c L NONE crypto/x509/x509_vfy.h NONE diff --git a/crypto/ocsp/Makefile.ssl b/crypto/ocsp/Makefile.ssl new file mode 100644 index 0000000000..4f6378cd34 --- /dev/null +++ b/crypto/ocsp/Makefile.ssl @@ -0,0 +1,243 @@ +# +# OpenSSL/ocsp/Makefile.ssl +# + +DIR= ocsp +TOP= ../.. +CC= cc +INCLUDES= -I.. -I../../include +CFLAG=-g +INSTALL_PREFIX= +OPENSSLDIR= /usr/local/ssl +INSTALLTOP=/usr/local/ssl +MAKE= make -f Makefile.ssl +MAKEDEPEND= $(TOP)/util/domd $(TOP) +MAKEFILE= Makefile.ssl +AR= ar r + +CFLAGS= $(INCLUDES) $(CFLAG) + +GENERAL=Makefile README +TEST= +APPS= + +LIB=$(TOP)/libcrypto.a +LIBSRC= ocsp_req.c ocsp_res.c ocsp_sig.c ocsp_cid.c ocsp_ext.c \ + ocsp_lib.c ocsp_err.c +#ocsp_v3.c +LIBOBJ= ocsp_req.o ocsp_res.o ocsp_sig.o ocsp_cid.o ocsp_ext.o \ + ocsp_lib.o ocsp_err.o +#ocsp_v3.o + +SRC= $(LIBSRC) + +EXHEADER= ocsp.h +HEADER= $(EXHEADER) + +ALL= $(GENERAL) $(SRC) $(HEADER) + +top: + (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all) + +all: lib + +lib: $(LIBOBJ) + $(AR) $(LIB) $(LIBOBJ) + $(RANLIB) $(LIB) + @touch lib + +files: + perl $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO + +links: + $(TOP)/util/point.sh Makefile.ssl Makefile ; + $(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER) + $(PERL) $(TOP)/util/mklink.pl ../../test $(TEST) + $(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS) + +install: + @for i in $(EXHEADER) ; \ + do \ + (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \ + chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \ + done; + +tags: + ctags $(SRC) + +tests: + +lint: + lint -DLINT $(INCLUDES) $(SRC)>fluff + +depend: + $(MAKEDEPEND) $(INCLUDES) $(DEPFLAG) $(LIBSRC) + +dclean: + $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new + mv -f Makefile.new $(MAKEFILE) + +clean: + rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff + +# DO NOT DELETE THIS LINE -- make depend depends on it. + +ocsp_cid.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h +ocsp_cid.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h +ocsp_cid.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h +ocsp_cid.o: ../../include/openssl/cast.h ../../include/openssl/conf.h +ocsp_cid.o: ../../include/openssl/crypto.h ../../include/openssl/des.h +ocsp_cid.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h +ocsp_cid.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h +ocsp_cid.o: ../../include/openssl/err.h ../../include/openssl/evp.h +ocsp_cid.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h +ocsp_cid.o: ../../include/openssl/md2.h ../../include/openssl/md4.h +ocsp_cid.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h +ocsp_cid.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h +ocsp_cid.o: ../../include/openssl/ocsp.h ../../include/openssl/opensslconf.h +ocsp_cid.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h +ocsp_cid.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h +ocsp_cid.o: ../../include/openssl/rc5.h +ocsp_cid.o: ../../include/openssl/rijndael-alg-fst.h +ocsp_cid.o: ../../include/openssl/rijndael.h ../../include/openssl/ripemd.h +ocsp_cid.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h +ocsp_cid.o: ../../include/openssl/sha.h ../../include/openssl/stack.h +ocsp_cid.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h +ocsp_cid.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h +ocsp_err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h +ocsp_err.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h +ocsp_err.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h +ocsp_err.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h +ocsp_err.o: ../../include/openssl/des.h ../../include/openssl/dh.h +ocsp_err.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h +ocsp_err.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h +ocsp_err.o: ../../include/openssl/evp.h ../../include/openssl/idea.h +ocsp_err.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h +ocsp_err.o: ../../include/openssl/md4.h ../../include/openssl/md5.h +ocsp_err.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h +ocsp_err.o: ../../include/openssl/objects.h ../../include/openssl/ocsp.h +ocsp_err.o: ../../include/openssl/opensslconf.h +ocsp_err.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h +ocsp_err.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h +ocsp_err.o: ../../include/openssl/rc5.h +ocsp_err.o: ../../include/openssl/rijndael-alg-fst.h +ocsp_err.o: ../../include/openssl/rijndael.h ../../include/openssl/ripemd.h +ocsp_err.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h +ocsp_err.o: ../../include/openssl/sha.h ../../include/openssl/stack.h +ocsp_err.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h +ocsp_err.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h +ocsp_ext.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h +ocsp_ext.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h +ocsp_ext.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h +ocsp_ext.o: ../../include/openssl/cast.h ../../include/openssl/conf.h +ocsp_ext.o: ../../include/openssl/crypto.h ../../include/openssl/des.h +ocsp_ext.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h +ocsp_ext.o: ../../include/openssl/e_os.h ../../include/openssl/e_os.h +ocsp_ext.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h +ocsp_ext.o: ../../include/openssl/evp.h ../../include/openssl/idea.h +ocsp_ext.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h +ocsp_ext.o: ../../include/openssl/md4.h ../../include/openssl/md5.h +ocsp_ext.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h +ocsp_ext.o: ../../include/openssl/objects.h ../../include/openssl/ocsp.h +ocsp_ext.o: ../../include/openssl/opensslconf.h +ocsp_ext.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h +ocsp_ext.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h +ocsp_ext.o: ../../include/openssl/rc5.h +ocsp_ext.o: ../../include/openssl/rijndael-alg-fst.h +ocsp_ext.o: ../../include/openssl/rijndael.h ../../include/openssl/ripemd.h +ocsp_ext.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h +ocsp_ext.o: ../../include/openssl/sha.h ../../include/openssl/stack.h +ocsp_ext.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h +ocsp_ext.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h +ocsp_ext.o: ../cryptlib.h +ocsp_lib.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h +ocsp_lib.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h +ocsp_lib.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h +ocsp_lib.o: ../../include/openssl/cast.h ../../include/openssl/conf.h +ocsp_lib.o: ../../include/openssl/crypto.h ../../include/openssl/des.h +ocsp_lib.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h +ocsp_lib.o: ../../include/openssl/e_os.h ../../include/openssl/e_os.h +ocsp_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h +ocsp_lib.o: ../../include/openssl/evp.h ../../include/openssl/idea.h +ocsp_lib.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h +ocsp_lib.o: ../../include/openssl/md4.h ../../include/openssl/md5.h +ocsp_lib.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h +ocsp_lib.o: ../../include/openssl/objects.h ../../include/openssl/ocsp.h +ocsp_lib.o: ../../include/openssl/opensslconf.h +ocsp_lib.o: ../../include/openssl/opensslv.h ../../include/openssl/pem.h +ocsp_lib.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs7.h +ocsp_lib.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h +ocsp_lib.o: ../../include/openssl/rc5.h +ocsp_lib.o: ../../include/openssl/rijndael-alg-fst.h +ocsp_lib.o: ../../include/openssl/rijndael.h ../../include/openssl/ripemd.h +ocsp_lib.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h +ocsp_lib.o: ../../include/openssl/sha.h ../../include/openssl/stack.h +ocsp_lib.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h +ocsp_lib.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h +ocsp_lib.o: ../cryptlib.h +ocsp_req.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h +ocsp_req.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h +ocsp_req.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h +ocsp_req.o: ../../include/openssl/cast.h ../../include/openssl/conf.h +ocsp_req.o: ../../include/openssl/crypto.h ../../include/openssl/des.h +ocsp_req.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h +ocsp_req.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h +ocsp_req.o: ../../include/openssl/err.h ../../include/openssl/evp.h +ocsp_req.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h +ocsp_req.o: ../../include/openssl/md2.h ../../include/openssl/md4.h +ocsp_req.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h +ocsp_req.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h +ocsp_req.o: ../../include/openssl/ocsp.h ../../include/openssl/opensslconf.h +ocsp_req.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h +ocsp_req.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h +ocsp_req.o: ../../include/openssl/rc5.h +ocsp_req.o: ../../include/openssl/rijndael-alg-fst.h +ocsp_req.o: ../../include/openssl/rijndael.h ../../include/openssl/ripemd.h +ocsp_req.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h +ocsp_req.o: ../../include/openssl/sha.h ../../include/openssl/stack.h +ocsp_req.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h +ocsp_req.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h +ocsp_res.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h +ocsp_res.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h +ocsp_res.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h +ocsp_res.o: ../../include/openssl/cast.h ../../include/openssl/conf.h +ocsp_res.o: ../../include/openssl/crypto.h ../../include/openssl/des.h +ocsp_res.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h +ocsp_res.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h +ocsp_res.o: ../../include/openssl/err.h ../../include/openssl/evp.h +ocsp_res.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h +ocsp_res.o: ../../include/openssl/md2.h ../../include/openssl/md4.h +ocsp_res.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h +ocsp_res.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h +ocsp_res.o: ../../include/openssl/ocsp.h ../../include/openssl/opensslconf.h +ocsp_res.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h +ocsp_res.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h +ocsp_res.o: ../../include/openssl/rc5.h +ocsp_res.o: ../../include/openssl/rijndael-alg-fst.h +ocsp_res.o: ../../include/openssl/rijndael.h ../../include/openssl/ripemd.h +ocsp_res.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h +ocsp_res.o: ../../include/openssl/sha.h ../../include/openssl/stack.h +ocsp_res.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h +ocsp_res.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h +ocsp_sig.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h +ocsp_sig.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h +ocsp_sig.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h +ocsp_sig.o: ../../include/openssl/cast.h ../../include/openssl/conf.h +ocsp_sig.o: ../../include/openssl/crypto.h ../../include/openssl/des.h +ocsp_sig.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h +ocsp_sig.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h +ocsp_sig.o: ../../include/openssl/err.h ../../include/openssl/evp.h +ocsp_sig.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h +ocsp_sig.o: ../../include/openssl/md2.h ../../include/openssl/md4.h +ocsp_sig.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h +ocsp_sig.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h +ocsp_sig.o: ../../include/openssl/ocsp.h ../../include/openssl/opensslconf.h +ocsp_sig.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h +ocsp_sig.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h +ocsp_sig.o: ../../include/openssl/rc5.h +ocsp_sig.o: ../../include/openssl/rijndael-alg-fst.h +ocsp_sig.o: ../../include/openssl/rijndael.h ../../include/openssl/ripemd.h +ocsp_sig.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h +ocsp_sig.o: ../../include/openssl/sha.h ../../include/openssl/stack.h +ocsp_sig.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h +ocsp_sig.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h diff --git a/crypto/ocsp/ocsp.h b/crypto/ocsp/ocsp.h new file mode 100644 index 0000000000..34563bf9c4 --- /dev/null +++ b/crypto/ocsp/ocsp.h @@ -0,0 +1,591 @@ +/* ocsp.h */ +/* Written by Tom Titchener <Tom_Titchener@groove.net> for the OpenSSL + * project. */ + +/* History: + This file was transfered to Richard Levitte from CertCo by Kathy + Weinhold in mid-spring 2000 to be included in OpenSSL or released + as a patch kit. */ + +/* ==================================================================== + * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#ifndef HEADER_OCSP_H +#define HEADER_OCSP_H + +#include <openssl/x509.h> +#include <openssl/x509v3.h> +#include <openssl/safestack.h> + +#ifdef __cplusplus +extern "C" { +#endif + +/* CertID ::= SEQUENCE { + * hashAlgorithm AlgorithmIdentifier, + * issuerNameHash OCTET STRING, -- Hash of Issuer's DN + * issuerKeyHash OCTET STRING, -- Hash of Issuers public key (excluding the tag & length fields) + * serialNumber CertificateSerialNumber } + */ +typedef struct ocsp_cert_id_st + { + X509_ALGOR *hashAlgorithm; + ASN1_OCTET_STRING *issuerNameHash; + ASN1_OCTET_STRING *issuerKeyHash; + ASN1_INTEGER *serialNumber; + } OCSP_CERTID; + +/* Request ::= SEQUENCE { + * reqCert CertID, + * singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL } + */ +typedef struct ocsp_one_request_st + { + OCSP_CERTID *reqCert; + STACK_OF(X509_EXTENSION) *singleRequestExtensions; + } OCSP_ONEREQ; + +DECLARE_STACK_OF(OCSP_ONEREQ) +DECLARE_ASN1_SET_OF(OCSP_ONEREQ) + + +/* TBSRequest ::= SEQUENCE { + * version [0] EXPLICIT Version DEFAULT v1, + * requestorName [1] EXPLICIT GeneralName OPTIONAL, + * requestList SEQUENCE OF Request, + * requestExtensions [2] EXPLICIT Extensions OPTIONAL } + */ +typedef struct ocsp_req_info_st + { + ASN1_INTEGER *version; + GENERAL_NAME *requestorName; + STACK_OF(OCSP_ONEREQ) *requestList; + STACK_OF(X509_EXTENSION) *requestExtensions; + } OCSP_REQINFO; + +/* Signature ::= SEQUENCE { + * signatureAlgorithm AlgorithmIdentifier, + * signature BIT STRING, + * certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL } + */ +typedef struct ocsp_signature_st + { + X509_ALGOR *signatureAlgorithm; + ASN1_BIT_STRING *signature; + STACK_OF(X509) *certs; + } OCSP_SIGNATURE; + +/* OCSPRequest ::= SEQUENCE { + * tbsRequest TBSRequest, + * optionalSignature [0] EXPLICIT Signature OPTIONAL } + */ +typedef struct ocsp_request_st + { + OCSP_REQINFO *tbsRequest; + OCSP_SIGNATURE *optionalSignature; /* OPTIONAL */ + } OCSP_REQUEST; + +/* OCSPResponseStatus ::= ENUMERATED { + * successful (0), --Response has valid confirmations + * malformedRequest (1), --Illegal confirmation request + * internalError (2), --Internal error in issuer + * tryLater (3), --Try again later + * --(4) is not used + * sigRequired (5), --Must sign the request + * unauthorized (6) --Request unauthorized + * } + */ +#define OCSP_RESPONSE_STATUS_SUCCESSFULL 0 +#define OCSP_RESPONSE_STATUS_MALFORMEDREQUEST 1 +#define OCSP_RESPONSE_STATUS_INTERNALERROR 2 +#define OCSP_RESPONSE_STATUS_TRYLATER 3 +#define OCSP_RESPONSE_STATUS_SIGREQUIRED 5 +#define OCSP_RESPONSE_STATUS_UNAUTHORIZED 6 + +/* ResponseBytes ::= SEQUENCE { + * responseType OBJECT IDENTIFIER, + * response OCTET STRING } + */ +typedef struct ocsp_resp_bytes_st + { + ASN1_OBJECT *responseType; + ASN1_OCTET_STRING *response; + } OCSP_RESPBYTES; + +/* OCSPResponse ::= SEQUENCE { + * responseStatus OCSPResponseStatus, + * responseBytes [0] EXPLICIT ResponseBytes OPTIONAL } + */ +typedef struct ocsp_response_st + { + ASN1_ENUMERATED *responseStatus; + OCSP_RESPBYTES *responseBytes; + } OCSP_RESPONSE; + +/* ResponderID ::= CHOICE { + * byName [1] Name, + * byKey [2] KeyHash } + */ +#define V_OCSP_RESPID_NAME 1 +#define V_OCSP_RESPID_KEY 2 +typedef struct ocsp_responder_id_st + { + int tag; + union { + X509_NAME* byName; + ASN1_OCTET_STRING *byKey; + } value; + } OCSP_RESPID; +/* KeyHash ::= OCTET STRING --SHA-1 hash of responder's public key + * --(excluding the tag and length fields) + */ + +/* RevokedInfo ::= SEQUENCE { + * revocationTime GeneralizedTime, + * revocationReason [0] EXPLICIT CRLReason OPTIONAL } + */ +typedef struct ocsp_revoked_info_st + { + ASN1_GENERALIZEDTIME *revocationTime; + ASN1_ENUMERATED *revocationReason; + } OCSP_REVOKEDINFO; + +/* CertStatus ::= CHOICE { + * good [0] IMPLICIT NULL, + * revoked [1] IMPLICIT RevokedInfo, + * unknown [2] IMPLICIT UnknownInfo } + */ +#define V_OCSP_CERTSTATUS_GOOD 0 +#define V_OCSP_CERTSTATUS_REVOKED 1 +#define V_OCSP_CERTSTATUS_UNKNOWN 2 +typedef struct ocsp_cert_status_st + { + int tag; + /* good [0] IMPLICIT NULL */ + OCSP_REVOKEDINFO *revoked; + /* unknown [2] OCSP_UNKNOWNINFO *unknown, which is NULL */ + } OCSP_CERTSTATUS; + +/* SingleResponse ::= SEQUENCE { + * certID CertID, + * certStatus CertStatus, + * thisUpdate GeneralizedTime, + * nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL, + * singleExtensions [1] EXPLICIT Extensions OPTIONAL } + */ +typedef struct ocsp_single_response_st + { + OCSP_CERTID *certId; + OCSP_CERTSTATUS *certStatus; + ASN1_GENERALIZEDTIME *thisUpdate; + ASN1_GENERALIZEDTIME *nextUpdate; + STACK_OF(X509_EXTENSION) *singleExtensions; + } OCSP_SINGLERESP; + +DECLARE_STACK_OF(OCSP_SINGLERESP) +DECLARE_ASN1_SET_OF(OCSP_SINGLERESP) + +/* ResponseData ::= SEQUENCE { + * version [0] EXPLICIT Version DEFAULT v1, + * responderID ResponderID, + * producedAt GeneralizedTime, + * responses SEQUENCE OF SingleResponse, + * responseExtensions [1] EXPLICIT Extensions OPTIONAL } + */ +typedef struct ocsp_response_data_st + { + ASN1_INTEGER *version; + OCSP_RESPID *responderId; + ASN1_GENERALIZEDTIME *producedAt; + STACK_OF(OCSP_SINGLERESP) *responses; + STACK_OF(X509_EXTENSION) *responseExtensions; + } OCSP_RESPDATA; + +/* BasicOCSPResponse ::= SEQUENCE { + * tbsResponseData ResponseData, + * signatureAlgorithm AlgorithmIdentifier, + * signature BIT STRING, + * certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL } + */ + /* Note 1: + The value for "signature" is specified in the OCSP rfc2560 as follows: + "The value for the signature SHALL be computed on the hash of the DER + encoding ResponseData." This means that you must hash the DER-encoded + tbsResponseData, and then run it through a crypto-signing function, which + will (at least w/RSA) do a hash-'n'-private-encrypt operation. This seems + a bit odd, but that's the spec. Also note that the data structures do not + leave anywhere to independently specify the algorithm used for the initial + hash. So, we look at the signature-specification algorithm, and try to do + something intelligent. -- Kathy Weinhold, CertCo */ + /* Note 2: + It seems that the mentioned passage from RFC 2560 (section 4.2.1) is open + for interpretation. I've done tests against another responder, and found + that it doesn't do the double hashing that the RFC seems to say one + should. Therefore, all relevant functions take a flag saying which + variant should be used. -- Richard Levitte, OpenSSL team and CeloCom */ +typedef struct ocsp_basic_response_st + { + OCSP_RESPDATA *tbsResponseData; + X509_ALGOR *signatureAlgorithm; + ASN1_BIT_STRING *signature; + STACK_OF(X509) *certs; + } OCSP_BASICRESP; + +/* + * CRLReason ::= ENUMERATED { + * unspecified (0), + * keyCompromise (1), + * cACompromise (2), + * affiliationChanged (3), + * superseded (4), + * cessationOfOperation (5), + * certificateHold (6), + * removeFromCRL (8) } + */ +#define OCSP_REVOKED_STATUS_NOSTATUS -1 +#define OCSP_REVOKED_STATUS_UNSPECIFIED 0 +#define OCSP_REVOKED_STATUS_KEYCOMPROMISE 1 +#define OCSP_REVOKED_STATUS_CACOMPROMISE 2 +#define OCSP_REVOKED_STATUS_AFFILIATIONCHANGED 3 +#define OCSP_REVOKED_STATUS_SUPERSEDED 4 +#define OCSP_REVOKED_STATUS_CESSATIONOFOPERATION 5 +#define OCSP_REVOKED_STATUS_CERTIFICATEHOLD 6 +#define OCSP_REVOKED_STATUS_REMOVEFROMCRL 8 + +/* CrlID ::= SEQUENCE { + * crlUrl [0] EXPLICIT IA5St |