Xuyi Wang / wolfSSL

wolfSSL SSL/TLS library, support up to TLS1.3

Dependents:   OS

src/ocsp.c@15:117db924cf7c, 2018-08-18 (annotated)

Committer:
wolfSSL
Date:
Sat Aug 18 22:20:43 2018 +0000
Revision:
15:117db924cf7c
Child:
17:ff9d1e86ad5f
wolfSSL 3.15.3

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 15:117db924cf7c 1 /* ocsp.c
wolfSSL 15:117db924cf7c 2 *
wolfSSL 15:117db924cf7c 3 * Copyright (C) 2006-2017 wolfSSL Inc.
wolfSSL 15:117db924cf7c 4 *
wolfSSL 15:117db924cf7c 5 * This file is part of wolfSSL.
wolfSSL 15:117db924cf7c 6 *
wolfSSL 15:117db924cf7c 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 15:117db924cf7c 8 * it under the terms of the GNU General Public License as published by
wolfSSL 15:117db924cf7c 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 15:117db924cf7c 10 * (at your option) any later version.
wolfSSL 15:117db924cf7c 11 *
wolfSSL 15:117db924cf7c 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 15:117db924cf7c 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 15:117db924cf7c 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 15:117db924cf7c 15 * GNU General Public License for more details.
wolfSSL 15:117db924cf7c 16 *
wolfSSL 15:117db924cf7c 17 * You should have received a copy of the GNU General Public License
wolfSSL 15:117db924cf7c 18 * along with this program; if not, write to the Free Software
wolfSSL 15:117db924cf7c 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
wolfSSL 15:117db924cf7c 20 */
wolfSSL 15:117db924cf7c 21
wolfSSL 15:117db924cf7c 22
wolfSSL 15:117db924cf7c 23 /* Name change compatibility layer no longer needs to be included here */
wolfSSL 15:117db924cf7c 24
wolfSSL 15:117db924cf7c 25 #ifdef HAVE_CONFIG_H
wolfSSL 15:117db924cf7c 26 #include <config.h>
wolfSSL 15:117db924cf7c 27 #endif
wolfSSL 15:117db924cf7c 28
wolfSSL 15:117db924cf7c 29 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 15:117db924cf7c 30
wolfSSL 15:117db924cf7c 31 #ifndef WOLFCRYPT_ONLY
wolfSSL 15:117db924cf7c 32 #ifdef HAVE_OCSP
wolfSSL 15:117db924cf7c 33
wolfSSL 15:117db924cf7c 34 #include <wolfssl/error-ssl.h>
wolfSSL 15:117db924cf7c 35 #include <wolfssl/ocsp.h>
wolfSSL 15:117db924cf7c 36 #include <wolfssl/internal.h>
wolfSSL 15:117db924cf7c 37
wolfSSL 15:117db924cf7c 38 #ifdef NO_INLINE
wolfSSL 15:117db924cf7c 39 #include <wolfssl/wolfcrypt/misc.h>
wolfSSL 15:117db924cf7c 40 #else
wolfSSL 15:117db924cf7c 41 #define WOLFSSL_MISC_INCLUDED
wolfSSL 15:117db924cf7c 42 #include <wolfcrypt/src/misc.c>
wolfSSL 15:117db924cf7c 43 #endif
wolfSSL 15:117db924cf7c 44
wolfSSL 15:117db924cf7c 45
wolfSSL 15:117db924cf7c 46 int InitOCSP(WOLFSSL_OCSP* ocsp, WOLFSSL_CERT_MANAGER* cm)
wolfSSL 15:117db924cf7c 47 {
wolfSSL 15:117db924cf7c 48 WOLFSSL_ENTER("InitOCSP");
wolfSSL 15:117db924cf7c 49
wolfSSL 15:117db924cf7c 50 ForceZero(ocsp, sizeof(WOLFSSL_OCSP));
wolfSSL 15:117db924cf7c 51
wolfSSL 15:117db924cf7c 52 if (wc_InitMutex(&ocsp->ocspLock) != 0)
wolfSSL 15:117db924cf7c 53 return BAD_MUTEX_E;
wolfSSL 15:117db924cf7c 54
wolfSSL 15:117db924cf7c 55 ocsp->cm = cm;
wolfSSL 15:117db924cf7c 56
wolfSSL 15:117db924cf7c 57 return 0;
wolfSSL 15:117db924cf7c 58 }
wolfSSL 15:117db924cf7c 59
wolfSSL 15:117db924cf7c 60
wolfSSL 15:117db924cf7c 61 static int InitOcspEntry(OcspEntry* entry, OcspRequest* request)
wolfSSL 15:117db924cf7c 62 {
wolfSSL 15:117db924cf7c 63 WOLFSSL_ENTER("InitOcspEntry");
wolfSSL 15:117db924cf7c 64
wolfSSL 15:117db924cf7c 65 ForceZero(entry, sizeof(OcspEntry));
wolfSSL 15:117db924cf7c 66
wolfSSL 15:117db924cf7c 67 XMEMCPY(entry->issuerHash, request->issuerHash, OCSP_DIGEST_SIZE);
wolfSSL 15:117db924cf7c 68 XMEMCPY(entry->issuerKeyHash, request->issuerKeyHash, OCSP_DIGEST_SIZE);
wolfSSL 15:117db924cf7c 69
wolfSSL 15:117db924cf7c 70 return 0;
wolfSSL 15:117db924cf7c 71 }
wolfSSL 15:117db924cf7c 72
wolfSSL 15:117db924cf7c 73
wolfSSL 15:117db924cf7c 74 static void FreeOcspEntry(OcspEntry* entry, void* heap)
wolfSSL 15:117db924cf7c 75 {
wolfSSL 15:117db924cf7c 76 CertStatus *status, *next;
wolfSSL 15:117db924cf7c 77
wolfSSL 15:117db924cf7c 78 WOLFSSL_ENTER("FreeOcspEntry");
wolfSSL 15:117db924cf7c 79
wolfSSL 15:117db924cf7c 80 for (status = entry->status; status; status = next) {
wolfSSL 15:117db924cf7c 81 next = status->next;
wolfSSL 15:117db924cf7c 82
wolfSSL 15:117db924cf7c 83 if (status->rawOcspResponse)
wolfSSL 15:117db924cf7c 84 XFREE(status->rawOcspResponse, heap, DYNAMIC_TYPE_OCSP_STATUS);
wolfSSL 15:117db924cf7c 85
wolfSSL 15:117db924cf7c 86 XFREE(status, heap, DYNAMIC_TYPE_OCSP_STATUS);
wolfSSL 15:117db924cf7c 87 }
wolfSSL 15:117db924cf7c 88
wolfSSL 15:117db924cf7c 89 (void)heap;
wolfSSL 15:117db924cf7c 90 }
wolfSSL 15:117db924cf7c 91
wolfSSL 15:117db924cf7c 92
wolfSSL 15:117db924cf7c 93 void FreeOCSP(WOLFSSL_OCSP* ocsp, int dynamic)
wolfSSL 15:117db924cf7c 94 {
wolfSSL 15:117db924cf7c 95 OcspEntry *entry, *next;
wolfSSL 15:117db924cf7c 96
wolfSSL 15:117db924cf7c 97 WOLFSSL_ENTER("FreeOCSP");
wolfSSL 15:117db924cf7c 98
wolfSSL 15:117db924cf7c 99 for (entry = ocsp->ocspList; entry; entry = next) {
wolfSSL 15:117db924cf7c 100 next = entry->next;
wolfSSL 15:117db924cf7c 101 FreeOcspEntry(entry, ocsp->cm->heap);
wolfSSL 15:117db924cf7c 102 XFREE(entry, ocsp->cm->heap, DYNAMIC_TYPE_OCSP_ENTRY);
wolfSSL 15:117db924cf7c 103 }
wolfSSL 15:117db924cf7c 104
wolfSSL 15:117db924cf7c 105 wc_FreeMutex(&ocsp->ocspLock);
wolfSSL 15:117db924cf7c 106
wolfSSL 15:117db924cf7c 107 if (dynamic)
wolfSSL 15:117db924cf7c 108 XFREE(ocsp, ocsp->cm->heap, DYNAMIC_TYPE_OCSP);
wolfSSL 15:117db924cf7c 109
wolfSSL 15:117db924cf7c 110 }
wolfSSL 15:117db924cf7c 111
wolfSSL 15:117db924cf7c 112
wolfSSL 15:117db924cf7c 113 static int xstat2err(int st)
wolfSSL 15:117db924cf7c 114 {
wolfSSL 15:117db924cf7c 115 switch (st) {
wolfSSL 15:117db924cf7c 116 case CERT_GOOD:
wolfSSL 15:117db924cf7c 117 return 0;
wolfSSL 15:117db924cf7c 118 case CERT_REVOKED:
wolfSSL 15:117db924cf7c 119 return OCSP_CERT_REVOKED;
wolfSSL 15:117db924cf7c 120 default:
wolfSSL 15:117db924cf7c 121 return OCSP_CERT_UNKNOWN;
wolfSSL 15:117db924cf7c 122 }
wolfSSL 15:117db924cf7c 123 }
wolfSSL 15:117db924cf7c 124
wolfSSL 15:117db924cf7c 125 int CheckCertOCSP_ex(WOLFSSL_OCSP* ocsp, DecodedCert* cert, buffer* responseBuffer, WOLFSSL* ssl)
wolfSSL 15:117db924cf7c 126 {
wolfSSL 15:117db924cf7c 127 int ret = OCSP_LOOKUP_FAIL;
wolfSSL 15:117db924cf7c 128
wolfSSL 15:117db924cf7c 129 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 130 OcspRequest* ocspRequest;
wolfSSL 15:117db924cf7c 131 #else
wolfSSL 15:117db924cf7c 132 OcspRequest ocspRequest[1];
wolfSSL 15:117db924cf7c 133 #endif
wolfSSL 15:117db924cf7c 134
wolfSSL 15:117db924cf7c 135 WOLFSSL_ENTER("CheckCertOCSP");
wolfSSL 15:117db924cf7c 136
wolfSSL 15:117db924cf7c 137
wolfSSL 15:117db924cf7c 138 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 139 ocspRequest = (OcspRequest*)XMALLOC(sizeof(OcspRequest), NULL,
wolfSSL 15:117db924cf7c 140 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 141 if (ocspRequest == NULL) {
wolfSSL 15:117db924cf7c 142 WOLFSSL_LEAVE("CheckCertOCSP", MEMORY_ERROR);
wolfSSL 15:117db924cf7c 143 return MEMORY_E;
wolfSSL 15:117db924cf7c 144 }
wolfSSL 15:117db924cf7c 145 #endif
wolfSSL 15:117db924cf7c 146
wolfSSL 15:117db924cf7c 147 if (InitOcspRequest(ocspRequest, cert, ocsp->cm->ocspSendNonce,
wolfSSL 15:117db924cf7c 148 ocsp->cm->heap) == 0) {
wolfSSL 15:117db924cf7c 149 ocspRequest->ssl = ssl;
wolfSSL 15:117db924cf7c 150 ret = CheckOcspRequest(ocsp, ocspRequest, responseBuffer);
wolfSSL 15:117db924cf7c 151
wolfSSL 15:117db924cf7c 152 FreeOcspRequest(ocspRequest);
wolfSSL 15:117db924cf7c 153 }
wolfSSL 15:117db924cf7c 154
wolfSSL 15:117db924cf7c 155 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 156 XFREE(ocspRequest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 157 #endif
wolfSSL 15:117db924cf7c 158
wolfSSL 15:117db924cf7c 159 WOLFSSL_LEAVE("CheckCertOCSP", ret);
wolfSSL 15:117db924cf7c 160 return ret;
wolfSSL 15:117db924cf7c 161 }
wolfSSL 15:117db924cf7c 162 int CheckCertOCSP(WOLFSSL_OCSP* ocsp, DecodedCert* cert, buffer* responseBuffer)
wolfSSL 15:117db924cf7c 163 {
wolfSSL 15:117db924cf7c 164 return CheckCertOCSP_ex(ocsp, cert, responseBuffer, NULL);
wolfSSL 15:117db924cf7c 165 }
wolfSSL 15:117db924cf7c 166
wolfSSL 15:117db924cf7c 167 static int GetOcspEntry(WOLFSSL_OCSP* ocsp, OcspRequest* request,
wolfSSL 15:117db924cf7c 168 OcspEntry** entry)
wolfSSL 15:117db924cf7c 169 {
wolfSSL 15:117db924cf7c 170 WOLFSSL_ENTER("GetOcspEntry");
wolfSSL 15:117db924cf7c 171
wolfSSL 15:117db924cf7c 172 *entry = NULL;
wolfSSL 15:117db924cf7c 173
wolfSSL 15:117db924cf7c 174 if (wc_LockMutex(&ocsp->ocspLock) != 0) {
wolfSSL 15:117db924cf7c 175 WOLFSSL_LEAVE("CheckCertOCSP", BAD_MUTEX_E);
wolfSSL 15:117db924cf7c 176 return BAD_MUTEX_E;
wolfSSL 15:117db924cf7c 177 }
wolfSSL 15:117db924cf7c 178
wolfSSL 15:117db924cf7c 179 for (*entry = ocsp->ocspList; *entry; *entry = (*entry)->next)
wolfSSL 15:117db924cf7c 180 if (XMEMCMP((*entry)->issuerHash, request->issuerHash,
wolfSSL 15:117db924cf7c 181 OCSP_DIGEST_SIZE) == 0
wolfSSL 15:117db924cf7c 182 && XMEMCMP((*entry)->issuerKeyHash, request->issuerKeyHash,
wolfSSL 15:117db924cf7c 183 OCSP_DIGEST_SIZE) == 0)
wolfSSL 15:117db924cf7c 184 break;
wolfSSL 15:117db924cf7c 185
wolfSSL 15:117db924cf7c 186 if (*entry == NULL) {
wolfSSL 15:117db924cf7c 187 *entry = (OcspEntry*)XMALLOC(sizeof(OcspEntry),
wolfSSL 15:117db924cf7c 188 ocsp->cm->heap, DYNAMIC_TYPE_OCSP_ENTRY);
wolfSSL 15:117db924cf7c 189 if (*entry) {
wolfSSL 15:117db924cf7c 190 InitOcspEntry(*entry, request);
wolfSSL 15:117db924cf7c 191 (*entry)->next = ocsp->ocspList;
wolfSSL 15:117db924cf7c 192 ocsp->ocspList = *entry;
wolfSSL 15:117db924cf7c 193 }
wolfSSL 15:117db924cf7c 194 }
wolfSSL 15:117db924cf7c 195
wolfSSL 15:117db924cf7c 196 wc_UnLockMutex(&ocsp->ocspLock);
wolfSSL 15:117db924cf7c 197
wolfSSL 15:117db924cf7c 198 return *entry ? 0 : MEMORY_ERROR;
wolfSSL 15:117db924cf7c 199 }
wolfSSL 15:117db924cf7c 200
wolfSSL 15:117db924cf7c 201
wolfSSL 15:117db924cf7c 202 static int GetOcspStatus(WOLFSSL_OCSP* ocsp, OcspRequest* request,
wolfSSL 15:117db924cf7c 203 OcspEntry* entry, CertStatus** status, buffer* responseBuffer)
wolfSSL 15:117db924cf7c 204 {
wolfSSL 15:117db924cf7c 205 int ret = OCSP_INVALID_STATUS;
wolfSSL 15:117db924cf7c 206
wolfSSL 15:117db924cf7c 207 WOLFSSL_ENTER("GetOcspStatus");
wolfSSL 15:117db924cf7c 208
wolfSSL 15:117db924cf7c 209 *status = NULL;
wolfSSL 15:117db924cf7c 210
wolfSSL 15:117db924cf7c 211 if (wc_LockMutex(&ocsp->ocspLock) != 0) {
wolfSSL 15:117db924cf7c 212 WOLFSSL_LEAVE("CheckCertOCSP", BAD_MUTEX_E);
wolfSSL 15:117db924cf7c 213 return BAD_MUTEX_E;
wolfSSL 15:117db924cf7c 214 }
wolfSSL 15:117db924cf7c 215
wolfSSL 15:117db924cf7c 216 for (*status = entry->status; *status; *status = (*status)->next)
wolfSSL 15:117db924cf7c 217 if ((*status)->serialSz == request->serialSz
wolfSSL 15:117db924cf7c 218 && !XMEMCMP((*status)->serial, request->serial, (*status)->serialSz))
wolfSSL 15:117db924cf7c 219 break;
wolfSSL 15:117db924cf7c 220
wolfSSL 15:117db924cf7c 221 if (responseBuffer && *status && !(*status)->rawOcspResponse) {
wolfSSL 15:117db924cf7c 222 /* force fetching again */
wolfSSL 15:117db924cf7c 223 ret = OCSP_INVALID_STATUS;
wolfSSL 15:117db924cf7c 224 }
wolfSSL 15:117db924cf7c 225 else if (*status) {
wolfSSL 15:117db924cf7c 226 #ifndef NO_ASN_TIME
wolfSSL 15:117db924cf7c 227 if (ValidateDate((*status)->thisDate, (*status)->thisDateFormat, BEFORE)
wolfSSL 15:117db924cf7c 228 && ((*status)->nextDate[0] != 0)
wolfSSL 15:117db924cf7c 229 && ValidateDate((*status)->nextDate, (*status)->nextDateFormat, AFTER))
wolfSSL 15:117db924cf7c 230 #endif
wolfSSL 15:117db924cf7c 231 {
wolfSSL 15:117db924cf7c 232 ret = xstat2err((*status)->status);
wolfSSL 15:117db924cf7c 233
wolfSSL 15:117db924cf7c 234 if (responseBuffer) {
wolfSSL 15:117db924cf7c 235 responseBuffer->buffer = (byte*)XMALLOC(
wolfSSL 15:117db924cf7c 236 (*status)->rawOcspResponseSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 237
wolfSSL 15:117db924cf7c 238 if (responseBuffer->buffer) {
wolfSSL 15:117db924cf7c 239 responseBuffer->length = (*status)->rawOcspResponseSz;
wolfSSL 15:117db924cf7c 240 XMEMCPY(responseBuffer->buffer,
wolfSSL 15:117db924cf7c 241 (*status)->rawOcspResponse,
wolfSSL 15:117db924cf7c 242 (*status)->rawOcspResponseSz);
wolfSSL 15:117db924cf7c 243 }
wolfSSL 15:117db924cf7c 244 }
wolfSSL 15:117db924cf7c 245 }
wolfSSL 15:117db924cf7c 246 }
wolfSSL 15:117db924cf7c 247
wolfSSL 15:117db924cf7c 248 wc_UnLockMutex(&ocsp->ocspLock);
wolfSSL 15:117db924cf7c 249
wolfSSL 15:117db924cf7c 250 return ret;
wolfSSL 15:117db924cf7c 251 }
wolfSSL 15:117db924cf7c 252
wolfSSL 15:117db924cf7c 253 /* Check that the response for validity. Store result in status.
wolfSSL 15:117db924cf7c 254 *
wolfSSL 15:117db924cf7c 255 * ocsp Context object for OCSP status.
wolfSSL 15:117db924cf7c 256 * response OCSP response message data.
wolfSSL 15:117db924cf7c 257 * responseSz Length of OCSP response message data.
wolfSSL 15:117db924cf7c 258 * reponseBuffer Buffer object to return the response with.
wolfSSL 15:117db924cf7c 259 * status The certificate status object.
wolfSSL 15:117db924cf7c 260 * entry The OCSP entry for this certificate.
wolfSSL 15:117db924cf7c 261 * returns OCSP_LOOKUP_FAIL when the response is bad and 0 otherwise.
wolfSSL 15:117db924cf7c 262 */
wolfSSL 15:117db924cf7c 263 static int CheckResponse(WOLFSSL_OCSP* ocsp, byte* response, int responseSz,
wolfSSL 15:117db924cf7c 264 buffer* responseBuffer, CertStatus* status,
wolfSSL 15:117db924cf7c 265 OcspEntry* entry, OcspRequest* ocspRequest)
wolfSSL 15:117db924cf7c 266 {
wolfSSL 15:117db924cf7c 267 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 268 CertStatus* newStatus;
wolfSSL 15:117db924cf7c 269 OcspResponse* ocspResponse;
wolfSSL 15:117db924cf7c 270 #else
wolfSSL 15:117db924cf7c 271 CertStatus newStatus[1];
wolfSSL 15:117db924cf7c 272 OcspResponse ocspResponse[1];
wolfSSL 15:117db924cf7c 273 #endif
wolfSSL 15:117db924cf7c 274 int ret;
wolfSSL 15:117db924cf7c 275 int validated = 0; /* ocsp validation flag */
wolfSSL 15:117db924cf7c 276
wolfSSL 15:117db924cf7c 277 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 278 newStatus = (CertStatus*)XMALLOC(sizeof(CertStatus), NULL,
wolfSSL 15:117db924cf7c 279 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 280 ocspResponse = (OcspResponse*)XMALLOC(sizeof(OcspResponse), NULL,
wolfSSL 15:117db924cf7c 281 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 282
wolfSSL 15:117db924cf7c 283 if (newStatus == NULL || ocspResponse == NULL) {
wolfSSL 15:117db924cf7c 284 if (newStatus) XFREE(newStatus, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 285 if (ocspResponse) XFREE(ocspResponse, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 286
wolfSSL 15:117db924cf7c 287 WOLFSSL_LEAVE("CheckCertOCSP", MEMORY_ERROR);
wolfSSL 15:117db924cf7c 288 return MEMORY_E;
wolfSSL 15:117db924cf7c 289 }
wolfSSL 15:117db924cf7c 290 #endif
wolfSSL 15:117db924cf7c 291 XMEMSET(newStatus, 0, sizeof(CertStatus));
wolfSSL 15:117db924cf7c 292
wolfSSL 15:117db924cf7c 293 InitOcspResponse(ocspResponse, newStatus, response, responseSz);
wolfSSL 15:117db924cf7c 294 ret = OcspResponseDecode(ocspResponse, ocsp->cm, ocsp->cm->heap, 0);
wolfSSL 15:117db924cf7c 295 if (ret != 0) {
wolfSSL 15:117db924cf7c 296 WOLFSSL_MSG("OcspResponseDecode failed");
wolfSSL 15:117db924cf7c 297 goto end;
wolfSSL 15:117db924cf7c 298 }
wolfSSL 15:117db924cf7c 299
wolfSSL 15:117db924cf7c 300 if (ocspResponse->responseStatus != OCSP_SUCCESSFUL) {
wolfSSL 15:117db924cf7c 301 WOLFSSL_MSG("OcspResponse status bad");
wolfSSL 15:117db924cf7c 302 goto end;
wolfSSL 15:117db924cf7c 303 }
wolfSSL 15:117db924cf7c 304 if (ocspRequest != NULL) {
wolfSSL 15:117db924cf7c 305 ret = CompareOcspReqResp(ocspRequest, ocspResponse);
wolfSSL 15:117db924cf7c 306 if (ret != 0) {
wolfSSL 15:117db924cf7c 307 goto end;
wolfSSL 15:117db924cf7c 308 }
wolfSSL 15:117db924cf7c 309 }
wolfSSL 15:117db924cf7c 310
wolfSSL 15:117db924cf7c 311 if (responseBuffer) {
wolfSSL 15:117db924cf7c 312 responseBuffer->buffer = (byte*)XMALLOC(responseSz, ocsp->cm->heap,
wolfSSL 15:117db924cf7c 313 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 314
wolfSSL 15:117db924cf7c 315 if (responseBuffer->buffer) {
wolfSSL 15:117db924cf7c 316 responseBuffer->length = responseSz;
wolfSSL 15:117db924cf7c 317 XMEMCPY(responseBuffer->buffer, response, responseSz);
wolfSSL 15:117db924cf7c 318 }
wolfSSL 15:117db924cf7c 319 }
wolfSSL 15:117db924cf7c 320
wolfSSL 15:117db924cf7c 321 ret = xstat2err(ocspResponse->status->status);
wolfSSL 15:117db924cf7c 322 if (ret == 0) {
wolfSSL 15:117db924cf7c 323 validated = 1;
wolfSSL 15:117db924cf7c 324 }
wolfSSL 15:117db924cf7c 325
wolfSSL 15:117db924cf7c 326 if (wc_LockMutex(&ocsp->ocspLock) != 0) {
wolfSSL 15:117db924cf7c 327 ret = BAD_MUTEX_E;
wolfSSL 15:117db924cf7c 328 goto end;
wolfSSL 15:117db924cf7c 329 }
wolfSSL 15:117db924cf7c 330
wolfSSL 15:117db924cf7c 331 if (status != NULL) {
wolfSSL 15:117db924cf7c 332 if (status->rawOcspResponse) {
wolfSSL 15:117db924cf7c 333 XFREE(status->rawOcspResponse, ocsp->cm->heap,
wolfSSL 15:117db924cf7c 334 DYNAMIC_TYPE_OCSP_STATUS);
wolfSSL 15:117db924cf7c 335 }
wolfSSL 15:117db924cf7c 336
wolfSSL 15:117db924cf7c 337 /* Replace existing certificate entry with updated */
wolfSSL 15:117db924cf7c 338 XMEMCPY(status, newStatus, sizeof(CertStatus));
wolfSSL 15:117db924cf7c 339 }
wolfSSL 15:117db924cf7c 340 else {
wolfSSL 15:117db924cf7c 341 /* Save new certificate entry */
wolfSSL 15:117db924cf7c 342 status = (CertStatus*)XMALLOC(sizeof(CertStatus),
wolfSSL 15:117db924cf7c 343 ocsp->cm->heap, DYNAMIC_TYPE_OCSP_STATUS);
wolfSSL 15:117db924cf7c 344 if (status != NULL) {
wolfSSL 15:117db924cf7c 345 XMEMCPY(status, newStatus, sizeof(CertStatus));
wolfSSL 15:117db924cf7c 346 status->next = entry->status;
wolfSSL 15:117db924cf7c 347 entry->status = status;
wolfSSL 15:117db924cf7c 348 entry->totalStatus++;
wolfSSL 15:117db924cf7c 349 }
wolfSSL 15:117db924cf7c 350 }
wolfSSL 15:117db924cf7c 351
wolfSSL 15:117db924cf7c 352 if (status && responseBuffer && responseBuffer->buffer) {
wolfSSL 15:117db924cf7c 353 status->rawOcspResponse = (byte*)XMALLOC(responseBuffer->length,
wolfSSL 15:117db924cf7c 354 ocsp->cm->heap,
wolfSSL 15:117db924cf7c 355 DYNAMIC_TYPE_OCSP_STATUS);
wolfSSL 15:117db924cf7c 356
wolfSSL 15:117db924cf7c 357 if (status->rawOcspResponse) {
wolfSSL 15:117db924cf7c 358 status->rawOcspResponseSz = responseBuffer->length;
wolfSSL 15:117db924cf7c 359 XMEMCPY(status->rawOcspResponse, responseBuffer->buffer,
wolfSSL 15:117db924cf7c 360 responseBuffer->length);
wolfSSL 15:117db924cf7c 361 }
wolfSSL 15:117db924cf7c 362 }
wolfSSL 15:117db924cf7c 363
wolfSSL 15:117db924cf7c 364 wc_UnLockMutex(&ocsp->ocspLock);
wolfSSL 15:117db924cf7c 365
wolfSSL 15:117db924cf7c 366 end:
wolfSSL 15:117db924cf7c 367 if (ret == 0 && validated == 1) {
wolfSSL 15:117db924cf7c 368 WOLFSSL_MSG("New OcspResponse validated");
wolfSSL 15:117db924cf7c 369 } else if (ret != OCSP_CERT_REVOKED) {
wolfSSL 15:117db924cf7c 370 ret = OCSP_LOOKUP_FAIL;
wolfSSL 15:117db924cf7c 371 }
wolfSSL 15:117db924cf7c 372
wolfSSL 15:117db924cf7c 373 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 374 XFREE(newStatus, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 375 XFREE(ocspResponse, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 376 #endif
wolfSSL 15:117db924cf7c 377 return ret;
wolfSSL 15:117db924cf7c 378 }
wolfSSL 15:117db924cf7c 379
wolfSSL 15:117db924cf7c 380 /* 0 on success */
wolfSSL 15:117db924cf7c 381 int CheckOcspRequest(WOLFSSL_OCSP* ocsp, OcspRequest* ocspRequest,
wolfSSL 15:117db924cf7c 382 buffer* responseBuffer)
wolfSSL 15:117db924cf7c 383 {
wolfSSL 15:117db924cf7c 384 OcspEntry* entry = NULL;
wolfSSL 15:117db924cf7c 385 CertStatus* status = NULL;
wolfSSL 15:117db924cf7c 386 byte* request = NULL;
wolfSSL 15:117db924cf7c 387 int requestSz = 2048;
wolfSSL 15:117db924cf7c 388 int responseSz = 0;
wolfSSL 15:117db924cf7c 389 byte* response = NULL;
wolfSSL 15:117db924cf7c 390 const char* url = NULL;
wolfSSL 15:117db924cf7c 391 int urlSz = 0;
wolfSSL 15:117db924cf7c 392 int ret = -1;
wolfSSL 15:117db924cf7c 393 WOLFSSL* ssl;
wolfSSL 15:117db924cf7c 394 void* ioCtx;
wolfSSL 15:117db924cf7c 395
wolfSSL 15:117db924cf7c 396 WOLFSSL_ENTER("CheckOcspRequest");
wolfSSL 15:117db924cf7c 397
wolfSSL 15:117db924cf7c 398 if (ocsp == NULL || ocspRequest == NULL)
wolfSSL 15:117db924cf7c 399 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 400
wolfSSL 15:117db924cf7c 401 if (responseBuffer) {
wolfSSL 15:117db924cf7c 402 responseBuffer->buffer = NULL;
wolfSSL 15:117db924cf7c 403 responseBuffer->length = 0;
wolfSSL 15:117db924cf7c 404 }
wolfSSL 15:117db924cf7c 405
wolfSSL 15:117db924cf7c 406 ret = GetOcspEntry(ocsp, ocspRequest, &entry);
wolfSSL 15:117db924cf7c 407 if (ret != 0)
wolfSSL 15:117db924cf7c 408 return ret;
wolfSSL 15:117db924cf7c 409
wolfSSL 15:117db924cf7c 410 ret = GetOcspStatus(ocsp, ocspRequest, entry, &status, responseBuffer);
wolfSSL 15:117db924cf7c 411 if (ret != OCSP_INVALID_STATUS)
wolfSSL 15:117db924cf7c 412 return ret;
wolfSSL 15:117db924cf7c 413
wolfSSL 15:117db924cf7c 414 /* get SSL and IOCtx */
wolfSSL 15:117db924cf7c 415 ssl = (WOLFSSL*)ocspRequest->ssl;
wolfSSL 15:117db924cf7c 416 ioCtx = (ssl && ssl->ocspIOCtx != NULL) ?
wolfSSL 15:117db924cf7c 417 ssl->ocspIOCtx : ocsp->cm->ocspIOCtx;
wolfSSL 15:117db924cf7c 418
wolfSSL 15:117db924cf7c 419 #if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
wolfSSL 15:117db924cf7c 420 if (ocsp->statusCb != NULL && ssl != NULL) {
wolfSSL 15:117db924cf7c 421 ret = ocsp->statusCb(ssl, ioCtx);
wolfSSL 15:117db924cf7c 422 if (ret == 0) {
wolfSSL 15:117db924cf7c 423 ret = wolfSSL_get_ocsp_response(ssl, &response);
wolfSSL 15:117db924cf7c 424 ret = CheckResponse(ocsp, response, ret, responseBuffer, status,
wolfSSL 15:117db924cf7c 425 entry, NULL);
wolfSSL 15:117db924cf7c 426 if (response != NULL)
wolfSSL 15:117db924cf7c 427 XFREE(response, NULL, DYNAMIC_TYPE_OPENSSL);
wolfSSL 15:117db924cf7c 428 return ret;
wolfSSL 15:117db924cf7c 429 }
wolfSSL 15:117db924cf7c 430 return OCSP_LOOKUP_FAIL;
wolfSSL 15:117db924cf7c 431 }
wolfSSL 15:117db924cf7c 432 #endif
wolfSSL 15:117db924cf7c 433
wolfSSL 15:117db924cf7c 434 if (ocsp->cm->ocspUseOverrideURL) {
wolfSSL 15:117db924cf7c 435 url = ocsp->cm->ocspOverrideURL;
wolfSSL 15:117db924cf7c 436 if (url != NULL && url[0] != '\0')
wolfSSL 15:117db924cf7c 437 urlSz = (int)XSTRLEN(url);
wolfSSL 15:117db924cf7c 438 else
wolfSSL 15:117db924cf7c 439 return OCSP_NEED_URL;
wolfSSL 15:117db924cf7c 440 }
wolfSSL 15:117db924cf7c 441 else if (ocspRequest->urlSz != 0 && ocspRequest->url != NULL) {
wolfSSL 15:117db924cf7c 442 url = (const char *)ocspRequest->url;
wolfSSL 15:117db924cf7c 443 urlSz = ocspRequest->urlSz;
wolfSSL 15:117db924cf7c 444 }
wolfSSL 15:117db924cf7c 445 else {
wolfSSL 15:117db924cf7c 446 /* cert doesn't have extAuthInfo, assuming CERT_GOOD */
wolfSSL 15:117db924cf7c 447 return 0;
wolfSSL 15:117db924cf7c 448 }
wolfSSL 15:117db924cf7c 449
wolfSSL 15:117db924cf7c 450 request = (byte*)XMALLOC(requestSz, ocsp->cm->heap, DYNAMIC_TYPE_OCSP);
wolfSSL 15:117db924cf7c 451 if (request == NULL) {
wolfSSL 15:117db924cf7c 452 WOLFSSL_LEAVE("CheckCertOCSP", MEMORY_ERROR);
wolfSSL 15:117db924cf7c 453 return MEMORY_ERROR;
wolfSSL 15:117db924cf7c 454 }
wolfSSL 15:117db924cf7c 455
wolfSSL 15:117db924cf7c 456 requestSz = EncodeOcspRequest(ocspRequest, request, requestSz);
wolfSSL 15:117db924cf7c 457 if (requestSz > 0 && ocsp->cm->ocspIOCb) {
wolfSSL 15:117db924cf7c 458 responseSz = ocsp->cm->ocspIOCb(ioCtx, url, urlSz,
wolfSSL 15:117db924cf7c 459 request, requestSz, &response);
wolfSSL 15:117db924cf7c 460 }
wolfSSL 15:117db924cf7c 461 if (responseSz == WOLFSSL_CBIO_ERR_WANT_READ) {
wolfSSL 15:117db924cf7c 462 ret = OCSP_WANT_READ;
wolfSSL 15:117db924cf7c 463 }
wolfSSL 15:117db924cf7c 464
wolfSSL 15:117db924cf7c 465 XFREE(request, ocsp->cm->heap, DYNAMIC_TYPE_OCSP);
wolfSSL 15:117db924cf7c 466
wolfSSL 15:117db924cf7c 467 if (responseSz >= 0 && response) {
wolfSSL 15:117db924cf7c 468 ret = CheckResponse(ocsp, response, responseSz, responseBuffer, status,
wolfSSL 15:117db924cf7c 469 entry, ocspRequest);
wolfSSL 15:117db924cf7c 470 }
wolfSSL 15:117db924cf7c 471
wolfSSL 15:117db924cf7c 472 if (response != NULL && ocsp->cm->ocspRespFreeCb)
wolfSSL 15:117db924cf7c 473 ocsp->cm->ocspRespFreeCb(ioCtx, response);
wolfSSL 15:117db924cf7c 474
wolfSSL 15:117db924cf7c 475 WOLFSSL_LEAVE("CheckOcspRequest", ret);
wolfSSL 15:117db924cf7c 476 return ret;
wolfSSL 15:117db924cf7c 477 }
wolfSSL 15:117db924cf7c 478
wolfSSL 15:117db924cf7c 479 #if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
wolfSSL 15:117db924cf7c 480
wolfSSL 15:117db924cf7c 481 int wolfSSL_OCSP_resp_find_status(WOLFSSL_OCSP_BASICRESP *bs,
wolfSSL 15:117db924cf7c 482 WOLFSSL_OCSP_CERTID* id, int* status, int* reason,
wolfSSL 15:117db924cf7c 483 WOLFSSL_ASN1_TIME** revtime, WOLFSSL_ASN1_TIME** thisupd,
wolfSSL 15:117db924cf7c 484 WOLFSSL_ASN1_TIME** nextupd)
wolfSSL 15:117db924cf7c 485 {
wolfSSL 15:117db924cf7c 486 if (bs == NULL || id == NULL)
wolfSSL 15:117db924cf7c 487 return WOLFSSL_FAILURE;
wolfSSL 15:117db924cf7c 488
wolfSSL 15:117db924cf7c 489 /* Only supporting one certificate status in asn.c. */
wolfSSL 15:117db924cf7c 490 if (CompareOcspReqResp(id, bs) != 0)
wolfSSL 15:117db924cf7c 491 return WOLFSSL_FAILURE;
wolfSSL 15:117db924cf7c 492
wolfSSL 15:117db924cf7c 493 if (status != NULL)
wolfSSL 15:117db924cf7c 494 *status = bs->status->status;
wolfSSL 15:117db924cf7c 495 if (thisupd != NULL)
wolfSSL 15:117db924cf7c 496 *thisupd = (WOLFSSL_ASN1_TIME*)bs->status->thisDateAsn;
wolfSSL 15:117db924cf7c 497 if (nextupd != NULL)
wolfSSL 15:117db924cf7c 498 *nextupd = (WOLFSSL_ASN1_TIME*)bs->status->nextDateAsn;
wolfSSL 15:117db924cf7c 499
wolfSSL 15:117db924cf7c 500 /* TODO: Not needed for Nginx. */
wolfSSL 15:117db924cf7c 501 if (reason != NULL)
wolfSSL 15:117db924cf7c 502 *reason = 0;
wolfSSL 15:117db924cf7c 503 if (revtime != NULL)
wolfSSL 15:117db924cf7c 504 *revtime = NULL;
wolfSSL 15:117db924cf7c 505
wolfSSL 15:117db924cf7c 506 return WOLFSSL_SUCCESS;
wolfSSL 15:117db924cf7c 507 }
wolfSSL 15:117db924cf7c 508
wolfSSL 15:117db924cf7c 509 const char *wolfSSL_OCSP_cert_status_str(long s)
wolfSSL 15:117db924cf7c 510 {
wolfSSL 15:117db924cf7c 511 switch (s) {
wolfSSL 15:117db924cf7c 512 case CERT_GOOD:
wolfSSL 15:117db924cf7c 513 return "good";
wolfSSL 15:117db924cf7c 514 case CERT_REVOKED:
wolfSSL 15:117db924cf7c 515 return "revoked";
wolfSSL 15:117db924cf7c 516 case CERT_UNKNOWN:
wolfSSL 15:117db924cf7c 517 return "unknown";
wolfSSL 15:117db924cf7c 518 default:
wolfSSL 15:117db924cf7c 519 return "(UNKNOWN)";
wolfSSL 15:117db924cf7c 520 }
wolfSSL 15:117db924cf7c 521 }
wolfSSL 15:117db924cf7c 522
wolfSSL 15:117db924cf7c 523 int wolfSSL_OCSP_check_validity(WOLFSSL_ASN1_TIME* thisupd,
wolfSSL 15:117db924cf7c 524 WOLFSSL_ASN1_TIME* nextupd, long sec, long maxsec)
wolfSSL 15:117db924cf7c 525 {
wolfSSL 15:117db924cf7c 526 (void)thisupd;
wolfSSL 15:117db924cf7c 527 (void)nextupd;
wolfSSL 15:117db924cf7c 528 (void)sec;
wolfSSL 15:117db924cf7c 529 (void)maxsec;
wolfSSL 15:117db924cf7c 530 /* Dates validated in DecodeSingleResponse. */
wolfSSL 15:117db924cf7c 531 return WOLFSSL_SUCCESS;
wolfSSL 15:117db924cf7c 532 }
wolfSSL 15:117db924cf7c 533
wolfSSL 15:117db924cf7c 534 void wolfSSL_OCSP_CERTID_free(WOLFSSL_OCSP_CERTID* certId)
wolfSSL 15:117db924cf7c 535 {
wolfSSL 15:117db924cf7c 536 FreeOcspRequest(certId);
wolfSSL 15:117db924cf7c 537 XFREE(certId, NULL, DYNAMIC_TYPE_OPENSSL);
wolfSSL 15:117db924cf7c 538 }
wolfSSL 15:117db924cf7c 539
wolfSSL 15:117db924cf7c 540 WOLFSSL_OCSP_CERTID* wolfSSL_OCSP_cert_to_id(
wolfSSL 15:117db924cf7c 541 const WOLFSSL_EVP_MD *dgst, const WOLFSSL_X509 *subject,
wolfSSL 15:117db924cf7c 542 const WOLFSSL_X509 *issuer)
wolfSSL 15:117db924cf7c 543 {
wolfSSL 15:117db924cf7c 544 WOLFSSL_OCSP_CERTID* certId;
wolfSSL 15:117db924cf7c 545 DecodedCert cert;
wolfSSL 15:117db924cf7c 546 WOLFSSL_CERT_MANAGER* cm;
wolfSSL 15:117db924cf7c 547 int ret;
wolfSSL 15:117db924cf7c 548 DerBuffer* derCert = NULL;
wolfSSL 15:117db924cf7c 549
wolfSSL 15:117db924cf7c 550 (void)dgst;
wolfSSL 15:117db924cf7c 551
wolfSSL 15:117db924cf7c 552 cm = wolfSSL_CertManagerNew();
wolfSSL 15:117db924cf7c 553 if (cm == NULL)
wolfSSL 15:117db924cf7c 554 return NULL;
wolfSSL 15:117db924cf7c 555
wolfSSL 15:117db924cf7c 556 ret = AllocDer(&derCert, issuer->derCert->length,
wolfSSL 15:117db924cf7c 557 issuer->derCert->type, NULL);
wolfSSL 15:117db924cf7c 558 if (ret == 0) {
wolfSSL 15:117db924cf7c 559 /* AddCA() frees the buffer. */
wolfSSL 15:117db924cf7c 560 XMEMCPY(derCert->buffer, issuer->derCert->buffer,
wolfSSL 15:117db924cf7c 561 issuer->derCert->length);
wolfSSL 15:117db924cf7c 562 AddCA(cm, &derCert, WOLFSSL_USER_CA, 1);
wolfSSL 15:117db924cf7c 563 }
wolfSSL 15:117db924cf7c 564
wolfSSL 15:117db924cf7c 565 certId = (WOLFSSL_OCSP_CERTID*)XMALLOC(sizeof(WOLFSSL_OCSP_CERTID), NULL,
wolfSSL 15:117db924cf7c 566 DYNAMIC_TYPE_OPENSSL);
wolfSSL 15:117db924cf7c 567 if (certId != NULL) {
wolfSSL 15:117db924cf7c 568 InitDecodedCert(&cert, subject->derCert->buffer,
wolfSSL 15:117db924cf7c 569 subject->derCert->length, NULL);
wolfSSL 15:117db924cf7c 570 if (ParseCertRelative(&cert, CERT_TYPE, VERIFY_OCSP, cm) != 0) {
wolfSSL 15:117db924cf7c 571 XFREE(certId, NULL, DYNAMIC_TYPE_OPENSSL);
wolfSSL 15:117db924cf7c 572 certId = NULL;
wolfSSL 15:117db924cf7c 573 }
wolfSSL 15:117db924cf7c 574 else {
wolfSSL 15:117db924cf7c 575 ret = InitOcspRequest(certId, &cert, 0, NULL);
wolfSSL 15:117db924cf7c 576 if (ret != 0) {
wolfSSL 15:117db924cf7c 577 XFREE(certId, NULL, DYNAMIC_TYPE_OPENSSL);
wolfSSL 15:117db924cf7c 578 certId = NULL;
wolfSSL 15:117db924cf7c 579 }
wolfSSL 15:117db924cf7c 580 }
wolfSSL 15:117db924cf7c 581 FreeDecodedCert(&cert);
wolfSSL 15:117db924cf7c 582 }
wolfSSL 15:117db924cf7c 583
wolfSSL 15:117db924cf7c 584 wolfSSL_CertManagerFree(cm);
wolfSSL 15:117db924cf7c 585
wolfSSL 15:117db924cf7c 586 return certId;
wolfSSL 15:117db924cf7c 587 }
wolfSSL 15:117db924cf7c 588
wolfSSL 15:117db924cf7c 589 void wolfSSL_OCSP_BASICRESP_free(WOLFSSL_OCSP_BASICRESP* basicResponse)
wolfSSL 15:117db924cf7c 590 {
wolfSSL 15:117db924cf7c 591 wolfSSL_OCSP_RESPONSE_free(basicResponse);
wolfSSL 15:117db924cf7c 592 }
wolfSSL 15:117db924cf7c 593
wolfSSL 15:117db924cf7c 594 /* Signature verified in DecodeBasicOcspResponse.
wolfSSL 15:117db924cf7c 595 * But no store available to verify certificate. */
wolfSSL 15:117db924cf7c 596 int wolfSSL_OCSP_basic_verify(WOLFSSL_OCSP_BASICRESP *bs,
wolfSSL 15:117db924cf7c 597 WOLF_STACK_OF(WOLFSSL_X509) *certs, WOLFSSL_X509_STORE *st, unsigned long flags)
wolfSSL 15:117db924cf7c 598 {
wolfSSL 15:117db924cf7c 599 DecodedCert cert;
wolfSSL 15:117db924cf7c 600 int ret = WOLFSSL_SUCCESS;
wolfSSL 15:117db924cf7c 601
wolfSSL 15:117db924cf7c 602 (void)certs;
wolfSSL 15:117db924cf7c 603
wolfSSL 15:117db924cf7c 604 if (flags & OCSP_NOVERIFY)
wolfSSL 15:117db924cf7c 605 return WOLFSSL_SUCCESS;
wolfSSL 15:117db924cf7c 606
wolfSSL 15:117db924cf7c 607 #ifdef OPENSSL_EXTRA
wolfSSL 15:117db924cf7c 608 if (bs->verifyError != OCSP_VERIFY_ERROR_NONE)
wolfSSL 15:117db924cf7c 609 return WOLFSSL_FAILURE;
wolfSSL 15:117db924cf7c 610 #endif
wolfSSL 15:117db924cf7c 611
wolfSSL 15:117db924cf7c 612 InitDecodedCert(&cert, bs->cert, bs->certSz, NULL);
wolfSSL 15:117db924cf7c 613 if (ParseCertRelative(&cert, CERT_TYPE, VERIFY, st->cm) < 0)
wolfSSL 15:117db924cf7c 614 ret = WOLFSSL_FAILURE;
wolfSSL 15:117db924cf7c 615 FreeDecodedCert(&cert);
wolfSSL 15:117db924cf7c 616
wolfSSL 15:117db924cf7c 617 return ret;
wolfSSL 15:117db924cf7c 618 }
wolfSSL 15:117db924cf7c 619
wolfSSL 15:117db924cf7c 620 void wolfSSL_OCSP_RESPONSE_free(OcspResponse* response)
wolfSSL 15:117db924cf7c 621 {
wolfSSL 15:117db924cf7c 622 if (response->status != NULL)
wolfSSL 15:117db924cf7c 623 XFREE(response->status, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 624 if (response->source != NULL)
wolfSSL 15:117db924cf7c 625 XFREE(response->source, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 626 XFREE(response, NULL, DYNAMIC_TYPE_OPENSSL);
wolfSSL 15:117db924cf7c 627 }
wolfSSL 15:117db924cf7c 628
wolfSSL 15:117db924cf7c 629 OcspResponse* wolfSSL_d2i_OCSP_RESPONSE_bio(WOLFSSL_BIO* bio,
wolfSSL 15:117db924cf7c 630 OcspResponse** response)
wolfSSL 15:117db924cf7c 631 {
wolfSSL 15:117db924cf7c 632 byte* data;
wolfSSL 15:117db924cf7c 633 byte* p;
wolfSSL 15:117db924cf7c 634 int len;
wolfSSL 15:117db924cf7c 635 int dataAlloced = 0;
wolfSSL 15:117db924cf7c 636 OcspResponse* ret = NULL;
wolfSSL 15:117db924cf7c 637
wolfSSL 15:117db924cf7c 638 if (bio == NULL)
wolfSSL 15:117db924cf7c 639 return NULL;
wolfSSL 15:117db924cf7c 640
wolfSSL 15:117db924cf7c 641 if (bio->type == WOLFSSL_BIO_MEMORY) {
wolfSSL 15:117db924cf7c 642 len = wolfSSL_BIO_get_mem_data(bio, &data);
wolfSSL 15:117db924cf7c 643 if (len <= 0 || data == NULL) {
wolfSSL 15:117db924cf7c 644 return NULL;
wolfSSL 15:117db924cf7c 645 }
wolfSSL 15:117db924cf7c 646 }
wolfSSL 15:117db924cf7c 647 #ifndef NO_FILESYSTEM
wolfSSL 15:117db924cf7c 648 else if (bio->type == WOLFSSL_BIO_FILE) {
wolfSSL 15:117db924cf7c 649 long i;
wolfSSL 15:117db924cf7c 650 long l;
wolfSSL 15:117db924cf7c 651
wolfSSL 15:117db924cf7c 652 i = XFTELL(bio->file);
wolfSSL 15:117db924cf7c 653 if (i < 0)
wolfSSL 15:117db924cf7c 654 return NULL;
wolfSSL 15:117db924cf7c 655 XFSEEK(bio->file, 0, SEEK_END);
wolfSSL 15:117db924cf7c 656 l = XFTELL(bio->file);
wolfSSL 15:117db924cf7c 657 if (l < 0)
wolfSSL 15:117db924cf7c 658 return NULL;
wolfSSL 15:117db924cf7c 659 if (XFSEEK(bio->file, i, SEEK_SET) != 0)
wolfSSL 15:117db924cf7c 660 return NULL;
wolfSSL 15:117db924cf7c 661
wolfSSL 15:117db924cf7c 662 /* check calculated length */
wolfSSL 15:117db924cf7c 663 if (l - i <= 0)
wolfSSL 15:117db924cf7c 664 return NULL;
wolfSSL 15:117db924cf7c 665
wolfSSL 15:117db924cf7c 666 data = (byte*)XMALLOC(l - i, 0, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 667 if (data == NULL)
wolfSSL 15:117db924cf7c 668 return NULL;
wolfSSL 15:117db924cf7c 669 dataAlloced = 1;
wolfSSL 15:117db924cf7c 670
wolfSSL 15:117db924cf7c 671 len = wolfSSL_BIO_read(bio, (char *)data, (int)l);
wolfSSL 15:117db924cf7c 672 }
wolfSSL 15:117db924cf7c 673 #endif
wolfSSL 15:117db924cf7c 674 else
wolfSSL 15:117db924cf7c 675 return NULL;
wolfSSL 15:117db924cf7c 676
wolfSSL 15:117db924cf7c 677 if (len > 0) {
wolfSSL 15:117db924cf7c 678 p = data;
wolfSSL 15:117db924cf7c 679 ret = wolfSSL_d2i_OCSP_RESPONSE(response, (const unsigned char **)&p, len);
wolfSSL 15:117db924cf7c 680 }
wolfSSL 15:117db924cf7c 681
wolfSSL 15:117db924cf7c 682 if (dataAlloced)
wolfSSL 15:117db924cf7c 683 XFREE(data, 0, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 684
wolfSSL 15:117db924cf7c 685 return ret;
wolfSSL 15:117db924cf7c 686 }
wolfSSL 15:117db924cf7c 687
wolfSSL 15:117db924cf7c 688 OcspResponse* wolfSSL_d2i_OCSP_RESPONSE(OcspResponse** response,
wolfSSL 15:117db924cf7c 689 const unsigned char** data, int len)
wolfSSL 15:117db924cf7c 690 {
wolfSSL 15:117db924cf7c 691 OcspResponse *resp = NULL;
wolfSSL 15:117db924cf7c 692 word32 idx = 0;
wolfSSL 15:117db924cf7c 693 int length = 0;
wolfSSL 15:117db924cf7c 694
wolfSSL 15:117db924cf7c 695 if (data == NULL)
wolfSSL 15:117db924cf7c 696 return NULL;
wolfSSL 15:117db924cf7c 697
wolfSSL 15:117db924cf7c 698 if (response != NULL)
wolfSSL 15:117db924cf7c 699 resp = *response;
wolfSSL 15:117db924cf7c 700 if (resp == NULL) {
wolfSSL 15:117db924cf7c 701 resp = (OcspResponse*)XMALLOC(sizeof(OcspResponse), NULL,
wolfSSL 15:117db924cf7c 702 DYNAMIC_TYPE_OPENSSL);
wolfSSL 15:117db924cf7c 703 if (resp == NULL)
wolfSSL 15:117db924cf7c 704 return NULL;
wolfSSL 15:117db924cf7c 705 XMEMSET(resp, 0, sizeof(OcspResponse));
wolfSSL 15:117db924cf7c 706 }
wolfSSL 15:117db924cf7c 707
wolfSSL 15:117db924cf7c 708 resp->source = (byte*)XMALLOC(len, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 709 if (resp->source == NULL) {
wolfSSL 15:117db924cf7c 710 XFREE(resp, NULL, DYNAMIC_TYPE_OPENSSL);
wolfSSL 15:117db924cf7c 711 return NULL;
wolfSSL 15:117db924cf7c 712 }
wolfSSL 15:117db924cf7c 713 resp->status = (CertStatus*)XMALLOC(sizeof(CertStatus), NULL,
wolfSSL 15:117db924cf7c 714 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 715 if (resp->status == NULL) {
wolfSSL 15:117db924cf7c 716 XFREE(resp->source, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 717 XFREE(resp, NULL, DYNAMIC_TYPE_OPENSSL);
wolfSSL 15:117db924cf7c 718 return NULL;
wolfSSL 15:117db924cf7c 719 }
wolfSSL 15:117db924cf7c 720
wolfSSL 15:117db924cf7c 721 XMEMCPY(resp->source, *data, len);
wolfSSL 15:117db924cf7c 722 resp->maxIdx = len;
wolfSSL 15:117db924cf7c 723
wolfSSL 15:117db924cf7c 724 if (OcspResponseDecode(resp, NULL, NULL, 1) != 0) {
wolfSSL 15:117db924cf7c 725 wolfSSL_OCSP_RESPONSE_free(resp);
wolfSSL 15:117db924cf7c 726 return NULL;
wolfSSL 15:117db924cf7c 727 }
wolfSSL 15:117db924cf7c 728
wolfSSL 15:117db924cf7c 729 if (GetSequence(*data, &idx, &length, len) >= 0)
wolfSSL 15:117db924cf7c 730 (*data) += idx + length;
wolfSSL 15:117db924cf7c 731
wolfSSL 15:117db924cf7c 732 return resp;
wolfSSL 15:117db924cf7c 733 }
wolfSSL 15:117db924cf7c 734
wolfSSL 15:117db924cf7c 735 int wolfSSL_i2d_OCSP_RESPONSE(OcspResponse* response,
wolfSSL 15:117db924cf7c 736 unsigned char** data)
wolfSSL 15:117db924cf7c 737 {
wolfSSL 15:117db924cf7c 738 if (data == NULL)
wolfSSL 15:117db924cf7c 739 return response->maxIdx;
wolfSSL 15:117db924cf7c 740
wolfSSL 15:117db924cf7c 741 XMEMCPY(*data, response->source, response->maxIdx);
wolfSSL 15:117db924cf7c 742 return response->maxIdx;
wolfSSL 15:117db924cf7c 743 }
wolfSSL 15:117db924cf7c 744
wolfSSL 15:117db924cf7c 745 int wolfSSL_OCSP_response_status(OcspResponse *response)
wolfSSL 15:117db924cf7c 746 {
wolfSSL 15:117db924cf7c 747 return response->responseStatus;
wolfSSL 15:117db924cf7c 748 }
wolfSSL 15:117db924cf7c 749
wolfSSL 15:117db924cf7c 750 const char *wolfSSL_OCSP_response_status_str(long s)
wolfSSL 15:117db924cf7c 751 {
wolfSSL 15:117db924cf7c 752 switch (s) {
wolfSSL 15:117db924cf7c 753 case OCSP_SUCCESSFUL:
wolfSSL 15:117db924cf7c 754 return "successful";
wolfSSL 15:117db924cf7c 755 case OCSP_MALFORMED_REQUEST:
wolfSSL 15:117db924cf7c 756 return "malformedrequest";
wolfSSL 15:117db924cf7c 757 case OCSP_INTERNAL_ERROR:
wolfSSL 15:117db924cf7c 758 return "internalerror";
wolfSSL 15:117db924cf7c 759 case OCSP_TRY_LATER:
wolfSSL 15:117db924cf7c 760 return "trylater";
wolfSSL 15:117db924cf7c 761 case OCSP_SIG_REQUIRED:
wolfSSL 15:117db924cf7c 762 return "sigrequired";
wolfSSL 15:117db924cf7c 763 case OCSP_UNAUTHROIZED:
wolfSSL 15:117db924cf7c 764 return "unauthorized";
wolfSSL 15:117db924cf7c 765 default:
wolfSSL 15:117db924cf7c 766 return "(UNKNOWN)";
wolfSSL 15:117db924cf7c 767 }
wolfSSL 15:117db924cf7c 768 }
wolfSSL 15:117db924cf7c 769
wolfSSL 15:117db924cf7c 770 WOLFSSL_OCSP_BASICRESP* wolfSSL_OCSP_response_get1_basic(OcspResponse* response)
wolfSSL 15:117db924cf7c 771 {
wolfSSL 15:117db924cf7c 772 WOLFSSL_OCSP_BASICRESP* bs;
wolfSSL 15:117db924cf7c 773
wolfSSL 15:117db924cf7c 774 bs = (WOLFSSL_OCSP_BASICRESP*)XMALLOC(sizeof(WOLFSSL_OCSP_BASICRESP), NULL,
wolfSSL 15:117db924cf7c 775 DYNAMIC_TYPE_OPENSSL);
wolfSSL 15:117db924cf7c 776 if (bs == NULL)
wolfSSL 15:117db924cf7c 777 return NULL;
wolfSSL 15:117db924cf7c 778
wolfSSL 15:117db924cf7c 779 XMEMCPY(bs, response, sizeof(OcspResponse));
wolfSSL 15:117db924cf7c 780 bs->status = (CertStatus*)XMALLOC(sizeof(CertStatus), NULL,
wolfSSL 15:117db924cf7c 781 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 782 bs->source = (byte*)XMALLOC(bs->maxIdx, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 783 if (bs->status == NULL || bs->source == NULL) {
wolfSSL 15:117db924cf7c 784 if (bs->status) XFREE(bs->status, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 785 if (bs->source) XFREE(bs->source, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 786 wolfSSL_OCSP_RESPONSE_free(bs);
wolfSSL 15:117db924cf7c 787 bs = NULL;
wolfSSL 15:117db924cf7c 788 }
wolfSSL 15:117db924cf7c 789 else {
wolfSSL 15:117db924cf7c 790 XMEMCPY(bs->status, response->status, sizeof(CertStatus));
wolfSSL 15:117db924cf7c 791 XMEMCPY(bs->source, response->source, response->maxIdx);
wolfSSL 15:117db924cf7c 792 }
wolfSSL 15:117db924cf7c 793 return bs;
wolfSSL 15:117db924cf7c 794 }
wolfSSL 15:117db924cf7c 795
wolfSSL 15:117db924cf7c 796 OcspRequest* wolfSSL_OCSP_REQUEST_new(void)
wolfSSL 15:117db924cf7c 797 {
wolfSSL 15:117db924cf7c 798 OcspRequest* request;
wolfSSL 15:117db924cf7c 799
wolfSSL 15:117db924cf7c 800 request = (OcspRequest*)XMALLOC(sizeof(OcspRequest), NULL,
wolfSSL 15:117db924cf7c 801 DYNAMIC_TYPE_OPENSSL);
wolfSSL 15:117db924cf7c 802 if (request != NULL)
wolfSSL 15:117db924cf7c 803 XMEMSET(request, 0, sizeof(OcspRequest));
wolfSSL 15:117db924cf7c 804
wolfSSL 15:117db924cf7c 805 return request;
wolfSSL 15:117db924cf7c 806 }
wolfSSL 15:117db924cf7c 807
wolfSSL 15:117db924cf7c 808 void wolfSSL_OCSP_REQUEST_free(OcspRequest* request)
wolfSSL 15:117db924cf7c 809 {
wolfSSL 15:117db924cf7c 810 FreeOcspRequest(request);
wolfSSL 15:117db924cf7c 811 XFREE(request, NULL, DYNAMIC_TYPE_OPENSSL);
wolfSSL 15:117db924cf7c 812 }
wolfSSL 15:117db924cf7c 813
wolfSSL 15:117db924cf7c 814 int wolfSSL_i2d_OCSP_REQUEST(OcspRequest* request, unsigned char** data)
wolfSSL 15:117db924cf7c 815 {
wolfSSL 15:117db924cf7c 816 word32 size;
wolfSSL 15:117db924cf7c 817
wolfSSL 15:117db924cf7c 818 size = EncodeOcspRequest(request, NULL, 0);
wolfSSL 15:117db924cf7c 819 if (size <= 0 || data == NULL)
wolfSSL 15:117db924cf7c 820 return size;
wolfSSL 15:117db924cf7c 821
wolfSSL 15:117db924cf7c 822 return EncodeOcspRequest(request, *data, size);
wolfSSL 15:117db924cf7c 823 }
wolfSSL 15:117db924cf7c 824
wolfSSL 15:117db924cf7c 825 WOLFSSL_OCSP_ONEREQ* wolfSSL_OCSP_request_add0_id(OcspRequest *req,
wolfSSL 15:117db924cf7c 826 WOLFSSL_OCSP_CERTID *cid)
wolfSSL 15:117db924cf7c 827 {
wolfSSL 15:117db924cf7c 828 if (req == NULL || cid == NULL)
wolfSSL 15:117db924cf7c 829 return NULL;
wolfSSL 15:117db924cf7c 830
wolfSSL 15:117db924cf7c 831 FreeOcspRequest(req);
wolfSSL 15:117db924cf7c 832 XMEMCPY(req, cid, sizeof(OcspRequest));
wolfSSL 15:117db924cf7c 833
wolfSSL 15:117db924cf7c 834 if (cid->serial != NULL) {
wolfSSL 15:117db924cf7c 835 req->serial = (byte*)XMALLOC(cid->serialSz, NULL,
wolfSSL 15:117db924cf7c 836 DYNAMIC_TYPE_OCSP_REQUEST);
wolfSSL 15:117db924cf7c 837 req->url = (byte*)XMALLOC(cid->urlSz, NULL, DYNAMIC_TYPE_OCSP_REQUEST);
wolfSSL 15:117db924cf7c 838 if (req->serial == NULL || req->url == NULL) {
wolfSSL 15:117db924cf7c 839 FreeOcspRequest(req);
wolfSSL 15:117db924cf7c 840 return NULL;
wolfSSL 15:117db924cf7c 841 }
wolfSSL 15:117db924cf7c 842
wolfSSL 15:117db924cf7c 843 XMEMCPY(req->serial, cid->serial, cid->serialSz);
wolfSSL 15:117db924cf7c 844 XMEMCPY(req->url, cid->url, cid->urlSz);
wolfSSL 15:117db924cf7c 845 }
wolfSSL 15:117db924cf7c 846
wolfSSL 15:117db924cf7c 847 wolfSSL_OCSP_REQUEST_free(cid);
wolfSSL 15:117db924cf7c 848
wolfSSL 15:117db924cf7c 849 return req;
wolfSSL 15:117db924cf7c 850 }
wolfSSL 15:117db924cf7c 851
wolfSSL 15:117db924cf7c 852 #endif
wolfSSL 15:117db924cf7c 853
wolfSSL 15:117db924cf7c 854 #else /* HAVE_OCSP */
wolfSSL 15:117db924cf7c 855
wolfSSL 15:117db924cf7c 856
wolfSSL 15:117db924cf7c 857 #ifdef _MSC_VER
wolfSSL 15:117db924cf7c 858 /* 4206 warning for blank file */
wolfSSL 15:117db924cf7c 859 #pragma warning(disable: 4206)
wolfSSL 15:117db924cf7c 860 #endif
wolfSSL 15:117db924cf7c 861
wolfSSL 15:117db924cf7c 862
wolfSSL 15:117db924cf7c 863 #endif /* HAVE_OCSP */
wolfSSL 15:117db924cf7c 864 #endif /* WOLFCRYPT_ONLY */
wolfSSL 15:117db924cf7c 865
wolfSSL 15:117db924cf7c 866