1 /* $OpenBSD: ocsp_lib.c,v 1.28 2024/08/28 06:27:19 tb Exp $ */
2 /* Written by Tom Titchener <Tom_Titchener@groove.net> for the OpenSSL
3 * project. */
4
5 /* History:
6 This file was transfered to Richard Levitte from CertCo by Kathy
7 Weinhold in mid-spring 2000 to be included in OpenSSL or released
8 as a patch kit. */
9
10 /* ====================================================================
11 * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 *
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 *
20 * 2. Redistributions in binary form must reproduce the above copyright
21 * notice, this list of conditions and the following disclaimer in
22 * the documentation and/or other materials provided with the
23 * distribution.
24 *
25 * 3. All advertising materials mentioning features or use of this
26 * software must display the following acknowledgment:
27 * "This product includes software developed by the OpenSSL Project
28 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
29 *
30 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
31 * endorse or promote products derived from this software without
32 * prior written permission. For written permission, please contact
33 * openssl-core@openssl.org.
34 *
35 * 5. Products derived from this software may not be called "OpenSSL"
36 * nor may "OpenSSL" appear in their names without prior written
37 * permission of the OpenSSL Project.
38 *
39 * 6. Redistributions of any form whatsoever must retain the following
40 * acknowledgment:
41 * "This product includes software developed by the OpenSSL Project
42 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
43 *
44 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
45 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
46 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
47 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
48 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
49 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
50 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
51 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
53 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
54 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
55 * OF THE POSSIBILITY OF SUCH DAMAGE.
56 * ====================================================================
57 *
58 * This product includes cryptographic software written by Eric Young
59 * (eay@cryptsoft.com). This product includes software written by Tim
60 * Hudson (tjh@cryptsoft.com).
61 *
62 */
63
64 #include <stdio.h>
65 #include <string.h>
66
67 #include <openssl/opensslconf.h>
68
69 #include <openssl/asn1t.h>
70 #include <openssl/err.h>
71 #include <openssl/objects.h>
72 #include <openssl/ocsp.h>
73 #include <openssl/pem.h>
74 #include <openssl/x509.h>
75 #include <openssl/x509v3.h>
76
77 #include "ocsp_local.h"
78 #include "x509_local.h"
79
80 /* Convert a certificate and its issuer to an OCSP_CERTID */
81
82 OCSP_CERTID *
OCSP_cert_to_id(const EVP_MD * dgst,const X509 * subject,const X509 * issuer)83 OCSP_cert_to_id(const EVP_MD *dgst, const X509 *subject, const X509 *issuer)
84 {
85 X509_NAME *iname;
86 const ASN1_INTEGER *serial;
87 ASN1_BIT_STRING *ikey;
88
89 #ifndef OPENSSL_NO_SHA1
90 if (!dgst)
91 dgst = EVP_sha1();
92 #endif
93 if (subject) {
94 iname = X509_get_issuer_name(subject);
95 serial = X509_get0_serialNumber(subject);
96 } else {
97 iname = X509_get_subject_name(issuer);
98 serial = NULL;
99 }
100 if ((ikey = X509_get0_pubkey_bitstr(issuer)) == NULL)
101 return NULL;
102
103 return OCSP_cert_id_new(dgst, iname, ikey, serial);
104 }
105 LCRYPTO_ALIAS(OCSP_cert_to_id);
106
107 OCSP_CERTID *
OCSP_cert_id_new(const EVP_MD * dgst,const X509_NAME * issuerName,const ASN1_BIT_STRING * issuerKey,const ASN1_INTEGER * serialNumber)108 OCSP_cert_id_new(const EVP_MD *dgst, const X509_NAME *issuerName,
109 const ASN1_BIT_STRING *issuerKey, const ASN1_INTEGER *serialNumber)
110 {
111 int nid;
112 unsigned int i;
113 OCSP_CERTID *cid = NULL;
114 unsigned char md[EVP_MAX_MD_SIZE];
115
116 if ((cid = OCSP_CERTID_new()) == NULL)
117 goto err;
118
119 if ((nid = EVP_MD_type(dgst)) == NID_undef) {
120 OCSPerror(OCSP_R_UNKNOWN_NID);
121 goto err;
122 }
123 if (!X509_ALGOR_set0_by_nid(cid->hashAlgorithm, nid, V_ASN1_NULL, NULL))
124 goto err;
125
126 if (!X509_NAME_digest(issuerName, dgst, md, &i)) {
127 OCSPerror(OCSP_R_DIGEST_ERR);
128 goto err;
129 }
130 if (!ASN1_OCTET_STRING_set(cid->issuerNameHash, md, i))
131 goto err;
132
133 /* Calculate the issuerKey hash, excluding tag and length */
134 if (!EVP_Digest(issuerKey->data, issuerKey->length, md, &i, dgst, NULL))
135 goto err;
136
137 if (!ASN1_OCTET_STRING_set(cid->issuerKeyHash, md, i))
138 goto err;
139
140 if (serialNumber != NULL) {
141 ASN1_INTEGER_free(cid->serialNumber);
142 if ((cid->serialNumber = ASN1_INTEGER_dup(serialNumber)) == NULL)
143 goto err;
144 }
145
146 return cid;
147
148 err:
149 OCSP_CERTID_free(cid);
150
151 return NULL;
152 }
153 LCRYPTO_ALIAS(OCSP_cert_id_new);
154
155 int
OCSP_id_issuer_cmp(OCSP_CERTID * a,OCSP_CERTID * b)156 OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b)
157 {
158 int ret;
159
160 /*
161 * XXX - should we really ignore parameters here? We probably need to
162 * consider omitted parameters and explicit ASN.1 NULL as equal for
163 * the SHAs, so don't blindly switch to X509_ALGOR_cmp().
164 */
165 ret = OBJ_cmp(a->hashAlgorithm->algorithm, b->hashAlgorithm->algorithm);
166 if (ret)
167 return ret;
168 ret = ASN1_OCTET_STRING_cmp(a->issuerNameHash, b->issuerNameHash);
169 if (ret)
170 return ret;
171 return ASN1_OCTET_STRING_cmp(a->issuerKeyHash, b->issuerKeyHash);
172 }
173 LCRYPTO_ALIAS(OCSP_id_issuer_cmp);
174
175 int
OCSP_id_cmp(OCSP_CERTID * a,OCSP_CERTID * b)176 OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b)
177 {
178 int ret;
179
180 ret = OCSP_id_issuer_cmp(a, b);
181 if (ret)
182 return ret;
183 return ASN1_INTEGER_cmp(a->serialNumber, b->serialNumber);
184 }
185 LCRYPTO_ALIAS(OCSP_id_cmp);
186
187 /* Parse a URL and split it up into host, port and path components and whether
188 * it is SSL.
189 */
190 int
OCSP_parse_url(const char * url,char ** phost,char ** pport,char ** ppath,int * pssl)191 OCSP_parse_url(const char *url, char **phost, char **pport, char **ppath,
192 int *pssl)
193 {
194 char *host, *path, *port, *tmp;
195
196 *phost = *pport = *ppath = NULL;
197 *pssl = 0;
198
199 if (strncmp(url, "https://", 8) == 0) {
200 *pssl = 1;
201 host = strdup(url + 8);
202 } else if (strncmp(url, "http://", 7) == 0)
203 host = strdup(url + 7);
204 else {
205 OCSPerror(OCSP_R_ERROR_PARSING_URL);
206 return 0;
207 }
208 if (host == NULL) {
209 OCSPerror(ERR_R_MALLOC_FAILURE);
210 return 0;
211 }
212
213 if ((tmp = strchr(host, '/')) != NULL) {
214 path = strdup(tmp);
215 *tmp = '\0';
216 } else
217 path = strdup("/");
218
219 if ((tmp = strchr(host, ':')) != NULL ) {
220 port = strdup(tmp + 1);
221 *tmp = '\0';
222 } else {
223 if (*pssl)
224 port = strdup("443");
225 else
226 port = strdup("80");
227 }
228
229 if (path == NULL || port == NULL) {
230 free(host);
231 free(path);
232 free(port);
233 OCSPerror(ERR_R_MALLOC_FAILURE);
234 return 0;
235 }
236
237 *phost = host;
238 *ppath = path;
239 *pport = port;
240 return 1;
241 }
242 LCRYPTO_ALIAS(OCSP_parse_url);
243
244 OCSP_CERTID *
OCSP_CERTID_dup(OCSP_CERTID * x)245 OCSP_CERTID_dup(OCSP_CERTID *x)
246 {
247 return ASN1_item_dup(&OCSP_CERTID_it, x);
248 }
249 LCRYPTO_ALIAS(OCSP_CERTID_dup);
250