2015-01-22 11:40:55 +08:00
|
|
|
/*
|
|
|
|
* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL project
|
|
|
|
* 2000.
|
2001-01-13 09:48:38 +08:00
|
|
|
*/
|
|
|
|
/* ====================================================================
|
|
|
|
* Copyright (c) 1999 The OpenSSL Project. All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
*
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
2015-01-22 11:40:55 +08:00
|
|
|
* notice, this list of conditions and the following disclaimer.
|
2001-01-13 09:48:38 +08:00
|
|
|
*
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in
|
|
|
|
* the documentation and/or other materials provided with the
|
|
|
|
* distribution.
|
|
|
|
*
|
|
|
|
* 3. All advertising materials mentioning features or use of this
|
|
|
|
* software must display the following acknowledgment:
|
|
|
|
* "This product includes software developed by the OpenSSL Project
|
|
|
|
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
|
|
|
|
*
|
|
|
|
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
|
|
|
* endorse or promote products derived from this software without
|
|
|
|
* prior written permission. For written permission, please contact
|
|
|
|
* licensing@OpenSSL.org.
|
|
|
|
*
|
|
|
|
* 5. Products derived from this software may not be called "OpenSSL"
|
|
|
|
* nor may "OpenSSL" appear in their names without prior written
|
|
|
|
* permission of the OpenSSL Project.
|
|
|
|
*
|
|
|
|
* 6. Redistributions of any form whatsoever must retain the following
|
|
|
|
* acknowledgment:
|
|
|
|
* "This product includes software developed by the OpenSSL Project
|
|
|
|
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
|
|
|
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
|
|
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
|
|
|
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
|
|
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
|
|
|
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
|
|
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
|
|
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
* ====================================================================
|
|
|
|
*
|
|
|
|
* This product includes cryptographic software written by Eric Young
|
|
|
|
* (eay@cryptsoft.com). This product includes software written by Tim
|
|
|
|
* Hudson (tjh@cryptsoft.com).
|
|
|
|
*
|
|
|
|
*/
|
2003-02-14 09:02:58 +08:00
|
|
|
#ifndef OPENSSL_NO_OCSP
|
2001-01-13 09:48:38 +08:00
|
|
|
|
2015-01-22 11:40:55 +08:00
|
|
|
# ifdef OPENSSL_SYS_VMS
|
|
|
|
# define _XOPEN_SOURCE_EXTENDED/* So fd_set and friends get properly defined
|
|
|
|
* on OpenVMS */
|
|
|
|
# endif
|
|
|
|
|
|
|
|
# define USE_SOCKETS
|
|
|
|
|
|
|
|
# include <stdio.h>
|
|
|
|
# include <stdlib.h>
|
|
|
|
# include <string.h>
|
|
|
|
# include <time.h>
|
2015-05-14 02:41:53 +08:00
|
|
|
# include <ctype.h>
|
2015-01-22 11:40:55 +08:00
|
|
|
# include "apps.h" /* needs to be included before the openssl
|
|
|
|
* headers! */
|
|
|
|
# include <openssl/e_os2.h>
|
|
|
|
# include <openssl/crypto.h>
|
|
|
|
# include <openssl/err.h>
|
|
|
|
# include <openssl/ssl.h>
|
|
|
|
# include <openssl/evp.h>
|
|
|
|
# include <openssl/bn.h>
|
|
|
|
# include <openssl/x509v3.h>
|
|
|
|
|
|
|
|
# if defined(NETWARE_CLIB)
|
2008-01-04 06:43:04 +08:00
|
|
|
# ifdef NETWARE_BSDSOCK
|
2015-01-22 11:40:55 +08:00
|
|
|
# include <sys/socket.h>
|
|
|
|
# include <sys/bsdskt.h>
|
2008-01-04 06:43:04 +08:00
|
|
|
# else
|
2015-01-22 11:40:55 +08:00
|
|
|
# include <novsock2.h>
|
2008-01-04 06:43:04 +08:00
|
|
|
# endif
|
2015-01-22 11:40:55 +08:00
|
|
|
# elif defined(NETWARE_LIBC)
|
2008-01-04 06:43:04 +08:00
|
|
|
# ifdef NETWARE_BSDSOCK
|
2015-01-22 11:40:55 +08:00
|
|
|
# include <sys/select.h>
|
2008-01-04 06:43:04 +08:00
|
|
|
# else
|
2015-01-22 11:40:55 +08:00
|
|
|
# include <novsock2.h>
|
2008-01-04 06:43:04 +08:00
|
|
|
# endif
|
2015-01-22 11:40:55 +08:00
|
|
|
# endif
|
2001-02-24 21:50:06 +08:00
|
|
|
|
2015-01-22 11:40:55 +08:00
|
|
|
/* Maximum leeway in validity period: default 5 minutes */
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
# define MAX_VALIDITY_PERIOD (5 * 60)
|
2015-01-22 11:40:55 +08:00
|
|
|
|
|
|
|
static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert,
|
|
|
|
const EVP_MD *cert_id_md, X509 *issuer,
|
|
|
|
STACK_OF(OCSP_CERTID) *ids);
|
|
|
|
static int add_ocsp_serial(OCSP_REQUEST **req, char *serial,
|
|
|
|
const EVP_MD *cert_id_md, X509 *issuer,
|
|
|
|
STACK_OF(OCSP_CERTID) *ids);
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
static void print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
|
2015-01-22 11:40:55 +08:00
|
|
|
STACK_OF(OPENSSL_STRING) *names,
|
|
|
|
STACK_OF(OCSP_CERTID) *ids, long nsec,
|
|
|
|
long maxage);
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
static void make_ocsp_response(OCSP_RESPONSE **resp, OCSP_REQUEST *req,
|
2015-01-22 11:40:55 +08:00
|
|
|
CA_DB *db, X509 *ca, X509 *rcert,
|
|
|
|
EVP_PKEY *rkey, const EVP_MD *md,
|
|
|
|
STACK_OF(X509) *rother, unsigned long flags,
|
|
|
|
int nmin, int ndays, int badsig);
|
2001-07-13 04:41:51 +08:00
|
|
|
|
2003-04-04 00:33:03 +08:00
|
|
|
static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser);
|
2013-10-07 19:41:43 +08:00
|
|
|
static BIO *init_responder(const char *port);
|
2015-01-22 11:40:55 +08:00
|
|
|
static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio,
|
|
|
|
const char *port);
|
2001-07-13 04:41:51 +08:00
|
|
|
static int send_ocsp_response(BIO *cbio, OCSP_RESPONSE *resp);
|
2015-10-18 07:16:23 +08:00
|
|
|
static OCSP_RESPONSE *query_responder(BIO *cbio, const char *host,
|
|
|
|
const char *path,
|
2015-01-22 11:40:55 +08:00
|
|
|
const STACK_OF(CONF_VALUE) *headers,
|
|
|
|
OCSP_REQUEST *req, int req_timeout);
|
2001-07-13 04:41:51 +08:00
|
|
|
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
typedef enum OPTION_choice {
|
|
|
|
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
|
|
|
|
OPT_OUTFILE, OPT_TIMEOUT, OPT_URL, OPT_HOST, OPT_PORT,
|
|
|
|
OPT_IGNORE_ERR, OPT_NOVERIFY, OPT_NONCE, OPT_NO_NONCE,
|
|
|
|
OPT_RESP_NO_CERTS, OPT_RESP_KEY_ID, OPT_NO_CERTS,
|
|
|
|
OPT_NO_SIGNATURE_VERIFY, OPT_NO_CERT_VERIFY, OPT_NO_CHAIN,
|
|
|
|
OPT_NO_CERT_CHECKS, OPT_NO_EXPLICIT, OPT_TRUST_OTHER,
|
|
|
|
OPT_NO_INTERN, OPT_BADSIG, OPT_TEXT, OPT_REQ_TEXT, OPT_RESP_TEXT,
|
|
|
|
OPT_REQIN, OPT_RESPIN, OPT_SIGNER, OPT_VAFILE, OPT_SIGN_OTHER,
|
2015-09-22 23:00:52 +08:00
|
|
|
OPT_VERIFY_OTHER, OPT_CAFILE, OPT_CAPATH, OPT_NOCAFILE, OPT_NOCAPATH,
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
OPT_VALIDITY_PERIOD, OPT_STATUS_AGE, OPT_SIGNKEY, OPT_REQOUT,
|
2015-04-26 04:04:42 +08:00
|
|
|
OPT_RESPOUT, OPT_PATH, OPT_ISSUER, OPT_CERT, OPT_SERIAL,
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
OPT_INDEX, OPT_CA, OPT_NMIN, OPT_REQUEST, OPT_NDAYS, OPT_RSIGNER,
|
|
|
|
OPT_RKEY, OPT_ROTHER, OPT_RMD, OPT_HEADER,
|
|
|
|
OPT_V_ENUM,
|
|
|
|
OPT_MD
|
|
|
|
} OPTION_CHOICE;
|
|
|
|
|
|
|
|
OPTIONS ocsp_options[] = {
|
|
|
|
{"help", OPT_HELP, '-', "Display this summary"},
|
|
|
|
{"out", OPT_OUTFILE, '>', "Output filename"},
|
|
|
|
{"timeout", OPT_TIMEOUT, 'p'},
|
|
|
|
{"url", OPT_URL, 's', "Responder URL"},
|
|
|
|
{"host", OPT_HOST, 's', "host:prot top to connect to"},
|
|
|
|
{"port", OPT_PORT, 'p', "Port to run responder on"},
|
|
|
|
{"ignore_err", OPT_IGNORE_ERR, '-'},
|
|
|
|
{"noverify", OPT_NOVERIFY, '-', "Don't verify response at all"},
|
|
|
|
{"nonce", OPT_NONCE, '-', "Add OCSP nonce to request"},
|
|
|
|
{"no_nonce", OPT_NO_NONCE, '-', "Don't add OCSP nonce to request"},
|
|
|
|
{"resp_no_certs", OPT_RESP_NO_CERTS, '-',
|
|
|
|
"Don't include any certificates in response"},
|
|
|
|
{"resp_key_id", OPT_RESP_KEY_ID, '-',
|
|
|
|
"Identify reponse by signing certificate key ID"},
|
|
|
|
{"no_certs", OPT_NO_CERTS, '-',
|
|
|
|
"Don't include any certificates in signed request"},
|
|
|
|
{"no_signature_verify", OPT_NO_SIGNATURE_VERIFY, '-',
|
|
|
|
"Don't check signature on response"},
|
|
|
|
{"no_cert_verify", OPT_NO_CERT_VERIFY, '-',
|
|
|
|
"Don't check signing certificate"},
|
|
|
|
{"no_chain", OPT_NO_CHAIN, '-', "Don't chain verify response"},
|
|
|
|
{"no_cert_checks", OPT_NO_CERT_CHECKS, '-',
|
|
|
|
"Don't do additional checks on signing certificate"},
|
|
|
|
{"no_explicit", OPT_NO_EXPLICIT, '-'},
|
|
|
|
{"trust_other", OPT_TRUST_OTHER, '-',
|
|
|
|
"Don't verify additional certificates"},
|
|
|
|
{"no_intern", OPT_NO_INTERN, '-',
|
|
|
|
"Don't search certificates contained in response for signer"},
|
|
|
|
{"badsig", OPT_BADSIG, '-'},
|
|
|
|
{"text", OPT_TEXT, '-', "Print text form of request and response"},
|
|
|
|
{"req_text", OPT_REQ_TEXT, '-', "Print text form of request"},
|
|
|
|
{"resp_text", OPT_RESP_TEXT, '-', "Print text form of response"},
|
|
|
|
{"reqin", OPT_REQIN, 's', "File with the DER-encoded request"},
|
|
|
|
{"respin", OPT_RESPIN, 's', "File with the DER-encoded response"},
|
|
|
|
{"signer", OPT_SIGNER, '<', "Certificate to sign OCSP request with"},
|
|
|
|
{"VAfile", OPT_VAFILE, '<', "Validator certificates file"},
|
|
|
|
{"sign_other", OPT_SIGN_OTHER, '<',
|
|
|
|
"Additional certificates to include in signed request"},
|
|
|
|
{"verify_other", OPT_VERIFY_OTHER, '<',
|
|
|
|
"Additional certificates to search for signer"},
|
|
|
|
{"CAfile", OPT_CAFILE, '<', "Trusted certificates file"},
|
|
|
|
{"CApath", OPT_CAPATH, '<', "Trusted certificates directory"},
|
2015-09-22 23:00:52 +08:00
|
|
|
{"no-CAfile", OPT_NOCAFILE, '-',
|
|
|
|
"Do not load the default certificates file"},
|
|
|
|
{"no-CApath", OPT_NOCAPATH, '-',
|
|
|
|
"Do not load certificates from the default certificates directory"},
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
{"validity_period", OPT_VALIDITY_PERIOD, 'u',
|
|
|
|
"Maximum validity discrepancy in seconds"},
|
|
|
|
{"status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds"},
|
|
|
|
{"signkey", OPT_SIGNKEY, 's', "Private key to sign OCSP request with"},
|
|
|
|
{"reqout", OPT_REQOUT, 's', "Output file for the DER-encoded request"},
|
|
|
|
{"respout", OPT_RESPOUT, 's', "Output file for the DER-encoded response"},
|
|
|
|
{"path", OPT_PATH, 's', "Path to use in OCSP request"},
|
2015-04-26 04:04:42 +08:00
|
|
|
{"issuer", OPT_ISSUER, '<', "Issuer certificate"},
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
{"cert", OPT_CERT, '<', "Certificate to check"},
|
|
|
|
{"serial", OPT_SERIAL, 's', "Nerial number to check"},
|
|
|
|
{"index", OPT_INDEX, '<', "Certificate status index file"},
|
|
|
|
{"CA", OPT_CA, '<', "CA certificate"},
|
|
|
|
{"nmin", OPT_NMIN, 'p', "Number of minutes before next update"},
|
|
|
|
{"nrequest", OPT_REQUEST, 'p',
|
|
|
|
"Number of requests to accept (default unlimited)"},
|
|
|
|
{"ndays", OPT_NDAYS, 'p', "Number of days before next update"},
|
|
|
|
{"rsigner", OPT_RSIGNER, '<',
|
|
|
|
"Sesponder certificate to sign responses with"},
|
|
|
|
{"rkey", OPT_RKEY, '<', "Responder key to sign responses with"},
|
|
|
|
{"rother", OPT_ROTHER, '<', "Other certificates to include in response"},
|
|
|
|
{"rmd", OPT_RMD, 's'},
|
|
|
|
{"header", OPT_HEADER, 's', "key=value header to add"},
|
|
|
|
{"", OPT_MD, '-', "Any supported digest"},
|
|
|
|
OPT_V_OPTIONS,
|
|
|
|
{NULL}
|
|
|
|
};
|
|
|
|
|
|
|
|
int ocsp_main(int argc, char **argv)
|
2015-01-22 11:40:55 +08:00
|
|
|
{
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
BIO *acbio = NULL, *cbio = NULL, *derbio = NULL, *out = NULL;
|
|
|
|
const EVP_MD *cert_id_md = NULL, *rsign_md = NULL;
|
|
|
|
CA_DB *rdb = NULL;
|
|
|
|
EVP_PKEY *key = NULL, *rkey = NULL;
|
|
|
|
OCSP_BASICRESP *bs = NULL;
|
2015-01-22 11:40:55 +08:00
|
|
|
OCSP_REQUEST *req = NULL;
|
|
|
|
OCSP_RESPONSE *resp = NULL;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
STACK_OF(CONF_VALUE) *headers = NULL;
|
|
|
|
STACK_OF(OCSP_CERTID) *ids = NULL;
|
|
|
|
STACK_OF(OPENSSL_STRING) *reqnames = NULL;
|
|
|
|
STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL;
|
2015-04-27 01:12:04 +08:00
|
|
|
STACK_OF(X509) *issuers = NULL;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
X509 *issuer = NULL, *cert = NULL, *rca_cert = NULL;
|
2015-01-22 11:40:55 +08:00
|
|
|
X509 *signer = NULL, *rsigner = NULL;
|
|
|
|
X509_STORE *store = NULL;
|
|
|
|
X509_VERIFY_PARAM *vpm = NULL;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
char *CAfile = NULL, *CApath = NULL, *header, *value;
|
|
|
|
char *host = NULL, *port = NULL, *path = "/", *outfile = NULL;
|
|
|
|
char *rca_filename = NULL, *reqin = NULL, *respin = NULL;
|
|
|
|
char *reqout = NULL, *respout = NULL, *ridx_filename = NULL;
|
|
|
|
char *rsignfile = NULL, *rkeyfile = NULL;
|
2015-01-22 11:40:55 +08:00
|
|
|
char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
char *signfile = NULL, *keyfile = NULL;
|
|
|
|
char *thost = NULL, *tport = NULL, *tpath = NULL;
|
2015-09-22 23:00:52 +08:00
|
|
|
int noCAfile = 0, noCApath = 0;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1;
|
|
|
|
int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1;
|
|
|
|
int req_text = 0, resp_text = 0, req_timeout = -1, ret = 1;
|
|
|
|
long nsec = MAX_VALIDITY_PERIOD, maxage = -1;
|
2015-01-22 11:40:55 +08:00
|
|
|
unsigned long sign_flags = 0, verify_flags = 0, rflags = 0;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
OPTION_CHOICE o;
|
|
|
|
char *prog;
|
2015-01-22 11:40:55 +08:00
|
|
|
|
|
|
|
reqnames = sk_OPENSSL_STRING_new_null();
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
if (!reqnames)
|
|
|
|
goto end;
|
2015-01-22 11:40:55 +08:00
|
|
|
ids = sk_OCSP_CERTID_new_null();
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
if (!ids)
|
|
|
|
goto end;
|
|
|
|
if ((vpm = X509_VERIFY_PARAM_new()) == NULL)
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
prog = opt_init(argc, argv, ocsp_options);
|
|
|
|
while ((o = opt_next()) != OPT_EOF) {
|
|
|
|
switch (o) {
|
|
|
|
case OPT_EOF:
|
|
|
|
case OPT_ERR:
|
|
|
|
opthelp:
|
|
|
|
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
|
|
|
|
goto end;
|
|
|
|
case OPT_HELP:
|
|
|
|
ret = 0;
|
|
|
|
opt_help(ocsp_options);
|
|
|
|
goto end;
|
|
|
|
case OPT_OUTFILE:
|
|
|
|
outfile = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_TIMEOUT:
|
|
|
|
req_timeout = atoi(opt_arg());
|
|
|
|
break;
|
|
|
|
case OPT_URL:
|
2015-05-01 22:02:07 +08:00
|
|
|
OPENSSL_free(thost);
|
|
|
|
OPENSSL_free(tport);
|
|
|
|
OPENSSL_free(tpath);
|
2015-06-13 21:29:10 +08:00
|
|
|
thost = tport = tpath = NULL;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
if (!OCSP_parse_url(opt_arg(), &host, &port, &path, &use_ssl)) {
|
|
|
|
BIO_printf(bio_err, "%s Error parsing URL\n", prog);
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
thost = host;
|
|
|
|
tport = port;
|
|
|
|
tpath = path;
|
|
|
|
break;
|
|
|
|
case OPT_HOST:
|
|
|
|
host = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_PORT:
|
|
|
|
port = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_IGNORE_ERR:
|
2015-01-22 11:40:55 +08:00
|
|
|
ignore_err = 1;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_NOVERIFY:
|
2015-01-22 11:40:55 +08:00
|
|
|
noverify = 1;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_NONCE:
|
2015-01-22 11:40:55 +08:00
|
|
|
add_nonce = 2;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_NO_NONCE:
|
2015-01-22 11:40:55 +08:00
|
|
|
add_nonce = 0;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_RESP_NO_CERTS:
|
2015-01-22 11:40:55 +08:00
|
|
|
rflags |= OCSP_NOCERTS;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_RESP_KEY_ID:
|
2015-01-22 11:40:55 +08:00
|
|
|
rflags |= OCSP_RESPID_KEY;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_NO_CERTS:
|
2015-01-22 11:40:55 +08:00
|
|
|
sign_flags |= OCSP_NOCERTS;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_NO_SIGNATURE_VERIFY:
|
2015-01-22 11:40:55 +08:00
|
|
|
verify_flags |= OCSP_NOSIGS;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_NO_CERT_VERIFY:
|
2015-01-22 11:40:55 +08:00
|
|
|
verify_flags |= OCSP_NOVERIFY;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_NO_CHAIN:
|
2015-01-22 11:40:55 +08:00
|
|
|
verify_flags |= OCSP_NOCHAIN;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_NO_CERT_CHECKS:
|
2015-01-22 11:40:55 +08:00
|
|
|
verify_flags |= OCSP_NOCHECKS;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_NO_EXPLICIT:
|
2015-01-22 11:40:55 +08:00
|
|
|
verify_flags |= OCSP_NOEXPLICIT;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_TRUST_OTHER:
|
2015-01-22 11:40:55 +08:00
|
|
|
verify_flags |= OCSP_TRUSTOTHER;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_NO_INTERN:
|
2015-01-22 11:40:55 +08:00
|
|
|
verify_flags |= OCSP_NOINTERN;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_BADSIG:
|
2015-01-22 11:40:55 +08:00
|
|
|
badsig = 1;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_TEXT:
|
|
|
|
req_text = resp_text = 1;
|
|
|
|
break;
|
|
|
|
case OPT_REQ_TEXT:
|
2015-01-22 11:40:55 +08:00
|
|
|
req_text = 1;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_RESP_TEXT:
|
2015-01-22 11:40:55 +08:00
|
|
|
resp_text = 1;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_REQIN:
|
|
|
|
reqin = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_RESPIN:
|
|
|
|
respin = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_SIGNER:
|
|
|
|
signfile = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_VAFILE:
|
|
|
|
verify_certfile = opt_arg();
|
|
|
|
verify_flags |= OCSP_TRUSTOTHER;
|
|
|
|
break;
|
|
|
|
case OPT_SIGN_OTHER:
|
|
|
|
sign_certfile = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_VERIFY_OTHER:
|
|
|
|
verify_certfile = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_CAFILE:
|
|
|
|
CAfile = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_CAPATH:
|
|
|
|
CApath = opt_arg();
|
|
|
|
break;
|
2015-09-22 23:00:52 +08:00
|
|
|
case OPT_NOCAFILE:
|
|
|
|
noCAfile = 1;
|
|
|
|
break;
|
|
|
|
case OPT_NOCAPATH:
|
|
|
|
noCApath = 1;
|
|
|
|
break;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
case OPT_V_CASES:
|
|
|
|
if (!opt_verify(o, vpm))
|
2015-01-22 11:40:55 +08:00
|
|
|
goto end;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
vpmtouched++;
|
|
|
|
break;
|
|
|
|
case OPT_VALIDITY_PERIOD:
|
|
|
|
opt_long(opt_arg(), &nsec);
|
|
|
|
break;
|
|
|
|
case OPT_STATUS_AGE:
|
|
|
|
opt_long(opt_arg(), &maxage);
|
|
|
|
break;
|
|
|
|
case OPT_SIGNKEY:
|
|
|
|
keyfile = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_REQOUT:
|
|
|
|
reqout = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_RESPOUT:
|
|
|
|
respout = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_PATH:
|
|
|
|
path = opt_arg();
|
|
|
|
break;
|
2015-04-26 04:04:42 +08:00
|
|
|
case OPT_ISSUER:
|
|
|
|
issuer = load_cert(opt_arg(), FORMAT_PEM,
|
|
|
|
NULL, NULL, "issuer certificate");
|
|
|
|
if (issuer == NULL)
|
|
|
|
goto end;
|
2015-10-18 07:04:10 +08:00
|
|
|
if (issuers == NULL) {
|
|
|
|
if ((issuers = sk_X509_new_null()) == NULL)
|
|
|
|
goto end;
|
|
|
|
}
|
2015-04-26 04:04:42 +08:00
|
|
|
sk_X509_push(issuers, issuer);
|
|
|
|
break;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
case OPT_CERT:
|
|
|
|
X509_free(cert);
|
|
|
|
cert = load_cert(opt_arg(), FORMAT_PEM,
|
|
|
|
NULL, NULL, "certificate");
|
|
|
|
if (cert == NULL)
|
|
|
|
goto end;
|
|
|
|
if (cert_id_md == NULL)
|
|
|
|
cert_id_md = EVP_sha1();
|
|
|
|
if (!add_ocsp_cert(&req, cert, cert_id_md, issuer, ids))
|
|
|
|
goto end;
|
|
|
|
if (!sk_OPENSSL_STRING_push(reqnames, opt_arg()))
|
|
|
|
goto end;
|
|
|
|
break;
|
|
|
|
case OPT_SERIAL:
|
|
|
|
if (cert_id_md == NULL)
|
|
|
|
cert_id_md = EVP_sha1();
|
|
|
|
if (!add_ocsp_serial(&req, opt_arg(), cert_id_md, issuer, ids))
|
|
|
|
goto end;
|
|
|
|
if (!sk_OPENSSL_STRING_push(reqnames, opt_arg()))
|
|
|
|
goto end;
|
|
|
|
break;
|
|
|
|
case OPT_INDEX:
|
|
|
|
ridx_filename = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_CA:
|
|
|
|
rca_filename = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_NMIN:
|
|
|
|
opt_int(opt_arg(), &nmin);
|
2015-01-22 11:40:55 +08:00
|
|
|
if (ndays == -1)
|
|
|
|
ndays = 0;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
break;
|
|
|
|
case OPT_REQUEST:
|
|
|
|
opt_int(opt_arg(), &accept_count);
|
|
|
|
break;
|
|
|
|
case OPT_NDAYS:
|
|
|
|
ndays = atoi(opt_arg());
|
|
|
|
break;
|
|
|
|
case OPT_RSIGNER:
|
|
|
|
rsignfile = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_RKEY:
|
|
|
|
rkeyfile = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_ROTHER:
|
|
|
|
rcertfile = opt_arg();
|
|
|
|
break;
|
|
|
|
case OPT_RMD:
|
|
|
|
if (!opt_md(opt_arg(), &rsign_md))
|
|
|
|
goto end;
|
|
|
|
break;
|
|
|
|
case OPT_HEADER:
|
|
|
|
header = opt_arg();
|
|
|
|
value = strchr(header, '=');
|
|
|
|
if (value == NULL) {
|
|
|
|
BIO_printf(bio_err, "Missing = in header key=value\n");
|
|
|
|
goto opthelp;
|
|
|
|
}
|
|
|
|
*value++ = '\0';
|
|
|
|
if (!X509V3_add_value(header, value, &headers))
|
|
|
|
goto end;
|
|
|
|
break;
|
|
|
|
case OPT_MD:
|
|
|
|
if (cert_id_md != NULL) {
|
|
|
|
BIO_printf(bio_err,
|
|
|
|
"%s: Digest must be before -cert or -serial\n",
|
|
|
|
prog);
|
|
|
|
goto opthelp;
|
|
|
|
}
|
|
|
|
if (!opt_md(opt_unknown(), &cert_id_md))
|
|
|
|
goto opthelp;
|
|
|
|
break;
|
2015-01-22 11:40:55 +08:00
|
|
|
}
|
|
|
|
}
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
argc = opt_num_rest();
|
|
|
|
argv = opt_rest();
|
2015-01-22 11:40:55 +08:00
|
|
|
|
|
|
|
/* Have we anything to do? */
|
|
|
|
if (!req && !reqin && !respin && !(port && ridx_filename))
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
goto opthelp;
|
2015-01-22 11:40:55 +08:00
|
|
|
|
2015-09-04 18:49:06 +08:00
|
|
|
out = bio_open_default(outfile, 'w', FORMAT_TEXT);
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
if (out == NULL)
|
2015-01-22 11:40:55 +08:00
|
|
|
goto end;
|
|
|
|
|
|
|
|
if (!req && (add_nonce != 2))
|
|
|
|
add_nonce = 0;
|
|
|
|
|
|
|
|
if (!req && reqin) {
|
2015-09-04 18:49:06 +08:00
|
|
|
derbio = bio_open_default(reqin, 'r', FORMAT_ASN1);
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
if (derbio == NULL)
|
2015-01-22 11:40:55 +08:00
|
|
|
goto end;
|
|
|
|
req = d2i_OCSP_REQUEST_bio(derbio, NULL);
|
|
|
|
BIO_free(derbio);
|
|
|
|
if (!req) {
|
|
|
|
BIO_printf(bio_err, "Error reading OCSP request\n");
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!req && port) {
|
|
|
|
acbio = init_responder(port);
|
|
|
|
if (!acbio)
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
GH650: Minor tidying around the ocsp app
The ocsp utility is something of a jack-of-all-trades; most anything
related to the OCSP can be done with it. In particular, the manual
page calls out that it can be used as either a client or a server
of the protocol, but there are also a few things that it can do
which do not quite fit into either role, such as encoding an OCSP
request but not sending it, printing out a text form of an OCSP
response (or request) from a file akin to the asn1parse utility,
or performing a lookup into the server-side revocation database
without actually sending a request or response. All three of these
are documented as examples in the manual page, but the documentation
prior to this commit is somewhat misleading, in that when printing
the text form of an OCSP response, the code also attempts to
verify the response, displaying an error message and returning
failure if the response does not verify. (It is possible that
the response would be able to verify with the given example, since
the default trust roots are used for that verification, but OCSP
responses frequently have alternate certification authorities
that would require passing -CAfile or -CApath for verification.)
Tidy up the documentation by passing -noverify for the case of
converting from binary to textual representation, and also
change a few instances of -respin to -reqin as appropriate, note
that the -url option provides the same functionality as the -host
and -path options, clarify that the example that saves an OCSP
response to a file will also perform verification on that response,
and fix a couple grammar nits in the manual page.
Also remove an always-true conditional for rdb != NULL -- there
are no codepaths in which it could be initialized at the time of
this check.
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-10 10:29:21 +08:00
|
|
|
if (rsignfile) {
|
2015-01-22 11:40:55 +08:00
|
|
|
if (!rkeyfile)
|
|
|
|
rkeyfile = rsignfile;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
rsigner = load_cert(rsignfile, FORMAT_PEM,
|
|
|
|
NULL, NULL, "responder certificate");
|
2015-01-22 11:40:55 +08:00
|
|
|
if (!rsigner) {
|
|
|
|
BIO_printf(bio_err, "Error loading responder certificate\n");
|
|
|
|
goto end;
|
|
|
|
}
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
rca_cert = load_cert(rca_filename, FORMAT_PEM,
|
|
|
|
NULL, NULL, "CA certificate");
|
2015-01-22 11:40:55 +08:00
|
|
|
if (rcertfile) {
|
2016-01-16 13:08:38 +08:00
|
|
|
if (!load_certs(rcertfile, &rother, FORMAT_PEM, NULL, NULL,
|
|
|
|
"responder other certificates"))
|
2015-01-22 11:40:55 +08:00
|
|
|
goto end;
|
|
|
|
}
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
rkey = load_key(rkeyfile, FORMAT_PEM, 0, NULL, NULL,
|
2015-01-22 11:40:55 +08:00
|
|
|
"responder private key");
|
|
|
|
if (!rkey)
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
if (acbio)
|
|
|
|
BIO_printf(bio_err, "Waiting for OCSP client connections...\n");
|
|
|
|
|
|
|
|
redo_accept:
|
|
|
|
|
|
|
|
if (acbio) {
|
|
|
|
if (!do_responder(&req, &cbio, acbio, port))
|
|
|
|
goto end;
|
|
|
|
if (!req) {
|
|
|
|
resp =
|
|
|
|
OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST,
|
|
|
|
NULL);
|
|
|
|
send_ocsp_response(cbio, resp);
|
|
|
|
goto done_resp;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!req && (signfile || reqout || host || add_nonce || ridx_filename)) {
|
|
|
|
BIO_printf(bio_err, "Need an OCSP request for this operation!\n");
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (req && add_nonce)
|
|
|
|
OCSP_request_add1_nonce(req, NULL, -1);
|
|
|
|
|
|
|
|
if (signfile) {
|
|
|
|
if (!keyfile)
|
|
|
|
keyfile = signfile;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
signer = load_cert(signfile, FORMAT_PEM,
|
|
|
|
NULL, NULL, "signer certificate");
|
2015-01-22 11:40:55 +08:00
|
|
|
if (!signer) {
|
|
|
|
BIO_printf(bio_err, "Error loading signer certificate\n");
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
if (sign_certfile) {
|
2016-01-16 13:08:38 +08:00
|
|
|
if (!load_certs(sign_certfile, &sign_other, FORMAT_PEM, NULL, NULL,
|
|
|
|
"signer certificates"))
|
2015-01-22 11:40:55 +08:00
|
|
|
goto end;
|
|
|
|
}
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
key = load_key(keyfile, FORMAT_PEM, 0, NULL, NULL,
|
2015-01-22 11:40:55 +08:00
|
|
|
"signer private key");
|
|
|
|
if (!key)
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
if (!OCSP_request_sign
|
|
|
|
(req, signer, key, NULL, sign_other, sign_flags)) {
|
|
|
|
BIO_printf(bio_err, "Error signing OCSP request\n");
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (req_text && req)
|
|
|
|
OCSP_REQUEST_print(out, req, 0);
|
|
|
|
|
|
|
|
if (reqout) {
|
2015-09-04 18:49:06 +08:00
|
|
|
derbio = bio_open_default(reqout, 'w', FORMAT_ASN1);
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
if (derbio == NULL)
|
2015-01-22 11:40:55 +08:00
|
|
|
goto end;
|
|
|
|
i2d_OCSP_REQUEST_bio(derbio, req);
|
|
|
|
BIO_free(derbio);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (ridx_filename && (!rkey || !rsigner || !rca_cert)) {
|
|
|
|
BIO_printf(bio_err,
|
|
|
|
"Need a responder certificate, key and CA for this operation!\n");
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (ridx_filename && !rdb) {
|
|
|
|
rdb = load_index(ridx_filename, NULL);
|
|
|
|
if (!rdb)
|
|
|
|
goto end;
|
|
|
|
if (!index_index(rdb))
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (rdb) {
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
make_ocsp_response(&resp, req, rdb, rca_cert, rsigner, rkey,
|
2015-01-22 11:40:55 +08:00
|
|
|
rsign_md, rother, rflags, nmin, ndays, badsig);
|
|
|
|
if (cbio)
|
|
|
|
send_ocsp_response(cbio, resp);
|
|
|
|
} else if (host) {
|
|
|
|
# ifndef OPENSSL_NO_SOCK
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
resp = process_responder(req, host, path,
|
2015-01-22 11:40:55 +08:00
|
|
|
port, use_ssl, headers, req_timeout);
|
|
|
|
if (!resp)
|
|
|
|
goto end;
|
|
|
|
# else
|
|
|
|
BIO_printf(bio_err,
|
|
|
|
"Error creating connect BIO - sockets not supported.\n");
|
|
|
|
goto end;
|
|
|
|
# endif
|
|
|
|
} else if (respin) {
|
2015-09-04 18:49:06 +08:00
|
|
|
derbio = bio_open_default(respin, 'r', FORMAT_ASN1);
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
if (derbio == NULL)
|
2015-01-22 11:40:55 +08:00
|
|
|
goto end;
|
|
|
|
resp = d2i_OCSP_RESPONSE_bio(derbio, NULL);
|
|
|
|
BIO_free(derbio);
|
|
|
|
if (!resp) {
|
|
|
|
BIO_printf(bio_err, "Error reading OCSP response\n");
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
ret = 0;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
|
|
|
done_resp:
|
|
|
|
|
|
|
|
if (respout) {
|
2015-09-04 18:49:06 +08:00
|
|
|
derbio = bio_open_default(respout, 'w', FORMAT_ASN1);
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
if (derbio == NULL)
|
2015-01-22 11:40:55 +08:00
|
|
|
goto end;
|
|
|
|
i2d_OCSP_RESPONSE_bio(derbio, resp);
|
|
|
|
BIO_free(derbio);
|
|
|
|
}
|
|
|
|
|
|
|
|
i = OCSP_response_status(resp);
|
|
|
|
if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
|
|
|
|
BIO_printf(out, "Responder Error: %s (%d)\n",
|
|
|
|
OCSP_response_status_str(i), i);
|
|
|
|
if (ignore_err)
|
|
|
|
goto redo_accept;
|
|
|
|
ret = 0;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (resp_text)
|
|
|
|
OCSP_RESPONSE_print(out, resp, 0);
|
|
|
|
|
|
|
|
/* If running as responder don't verify our own response */
|
|
|
|
if (cbio) {
|
2015-07-30 09:38:22 +08:00
|
|
|
/* If not unlimited, see if we took all we should. */
|
|
|
|
if (accept_count != -1 && --accept_count <= 0) {
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
ret = 0;
|
|
|
|
goto end;
|
2015-01-22 11:40:55 +08:00
|
|
|
}
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
BIO_free_all(cbio);
|
|
|
|
cbio = NULL;
|
|
|
|
OCSP_REQUEST_free(req);
|
|
|
|
req = NULL;
|
|
|
|
OCSP_RESPONSE_free(resp);
|
|
|
|
resp = NULL;
|
|
|
|
goto redo_accept;
|
|
|
|
}
|
|
|
|
if (ridx_filename) {
|
2015-01-22 11:40:55 +08:00
|
|
|
ret = 0;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
if (!store) {
|
2015-09-22 23:00:52 +08:00
|
|
|
store = setup_verify(CAfile, CApath, noCAfile, noCApath);
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
if (!store)
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
if (vpmtouched)
|
2015-01-22 11:40:55 +08:00
|
|
|
X509_STORE_set1_param(store, vpm);
|
|
|
|
if (verify_certfile) {
|
2016-01-16 13:08:38 +08:00
|
|
|
if (!load_certs(verify_certfile, &verify_other, FORMAT_PEM, NULL, NULL,
|
|
|
|
"validator certificate"))
|
2015-01-22 11:40:55 +08:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
|
|
|
bs = OCSP_response_get1_basic(resp);
|
|
|
|
if (!bs) {
|
|
|
|
BIO_printf(bio_err, "Error parsing response\n");
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = 0;
|
|
|
|
|
|
|
|
if (!noverify) {
|
|
|
|
if (req && ((i = OCSP_check_nonce(req, bs)) <= 0)) {
|
|
|
|
if (i == -1)
|
|
|
|
BIO_printf(bio_err, "WARNING: no nonce in response\n");
|
|
|
|
else {
|
|
|
|
BIO_printf(bio_err, "Nonce Verify error\n");
|
|
|
|
ret = 1;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
i = OCSP_basic_verify(bs, verify_other, store, verify_flags);
|
2015-04-26 04:04:42 +08:00
|
|
|
if (i <= 0 && issuers) {
|
|
|
|
i = OCSP_basic_verify(bs, issuers, store, OCSP_TRUSTOTHER);
|
|
|
|
if (i > 0)
|
|
|
|
ERR_clear_error();
|
|
|
|
}
|
2015-01-22 11:40:55 +08:00
|
|
|
if (i <= 0) {
|
|
|
|
BIO_printf(bio_err, "Response Verify Failure\n");
|
|
|
|
ERR_print_errors(bio_err);
|
|
|
|
ret = 1;
|
|
|
|
} else
|
|
|
|
BIO_printf(bio_err, "Response verify OK\n");
|
|
|
|
|
|
|
|
}
|
|
|
|
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
print_ocsp_summary(out, bs, req, reqnames, ids, nsec, maxage);
|
2015-01-22 11:40:55 +08:00
|
|
|
|
|
|
|
end:
|
|
|
|
ERR_print_errors(bio_err);
|
|
|
|
X509_free(signer);
|
|
|
|
X509_STORE_free(store);
|
2015-05-01 05:33:59 +08:00
|
|
|
X509_VERIFY_PARAM_free(vpm);
|
2015-01-22 11:40:55 +08:00
|
|
|
EVP_PKEY_free(key);
|
|
|
|
EVP_PKEY_free(rkey);
|
|
|
|
X509_free(cert);
|
2015-10-18 07:04:10 +08:00
|
|
|
sk_X509_pop_free(issuers, X509_free);
|
2015-01-22 11:40:55 +08:00
|
|
|
X509_free(rsigner);
|
|
|
|
X509_free(rca_cert);
|
|
|
|
free_index(rdb);
|
|
|
|
BIO_free_all(cbio);
|
|
|
|
BIO_free_all(acbio);
|
|
|
|
BIO_free(out);
|
|
|
|
OCSP_REQUEST_free(req);
|
|
|
|
OCSP_RESPONSE_free(resp);
|
|
|
|
OCSP_BASICRESP_free(bs);
|
|
|
|
sk_OPENSSL_STRING_free(reqnames);
|
|
|
|
sk_OCSP_CERTID_free(ids);
|
|
|
|
sk_X509_pop_free(sign_other, X509_free);
|
|
|
|
sk_X509_pop_free(verify_other, X509_free);
|
|
|
|
sk_CONF_VALUE_pop_free(headers, X509V3_conf_free);
|
2015-05-01 22:02:07 +08:00
|
|
|
OPENSSL_free(thost);
|
|
|
|
OPENSSL_free(tport);
|
|
|
|
OPENSSL_free(tpath);
|
2015-01-22 11:40:55 +08:00
|
|
|
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
return (ret);
|
2001-01-13 09:48:38 +08:00
|
|
|
}
|
|
|
|
|
2015-01-22 11:40:55 +08:00
|
|
|
static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert,
|
|
|
|
const EVP_MD *cert_id_md, X509 *issuer,
|
|
|
|
STACK_OF(OCSP_CERTID) *ids)
|
|
|
|
{
|
|
|
|
OCSP_CERTID *id;
|
|
|
|
if (!issuer) {
|
|
|
|
BIO_printf(bio_err, "No issuer certificate specified\n");
|
|
|
|
return 0;
|
|
|
|
}
|
2015-10-30 19:18:04 +08:00
|
|
|
if (*req == NULL)
|
2015-01-22 11:40:55 +08:00
|
|
|
*req = OCSP_REQUEST_new();
|
2015-10-30 19:18:04 +08:00
|
|
|
if (*req == NULL)
|
2015-01-22 11:40:55 +08:00
|
|
|
goto err;
|
|
|
|
id = OCSP_cert_to_id(cert_id_md, cert, issuer);
|
|
|
|
if (!id || !sk_OCSP_CERTID_push(ids, id))
|
|
|
|
goto err;
|
|
|
|
if (!OCSP_request_add0_id(*req, id))
|
|
|
|
goto err;
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
err:
|
|
|
|
BIO_printf(bio_err, "Error Creating OCSP request\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int add_ocsp_serial(OCSP_REQUEST **req, char *serial,
|
|
|
|
const EVP_MD *cert_id_md, X509 *issuer,
|
|
|
|
STACK_OF(OCSP_CERTID) *ids)
|
|
|
|
{
|
|
|
|
OCSP_CERTID *id;
|
|
|
|
X509_NAME *iname;
|
|
|
|
ASN1_BIT_STRING *ikey;
|
|
|
|
ASN1_INTEGER *sno;
|
|
|
|
if (!issuer) {
|
|
|
|
BIO_printf(bio_err, "No issuer certificate specified\n");
|
|
|
|
return 0;
|
|
|
|
}
|
2015-10-30 19:18:04 +08:00
|
|
|
if (*req == NULL)
|
2015-01-22 11:40:55 +08:00
|
|
|
*req = OCSP_REQUEST_new();
|
2015-10-30 19:18:04 +08:00
|
|
|
if (*req == NULL)
|
2015-01-22 11:40:55 +08:00
|
|
|
goto err;
|
|
|
|
iname = X509_get_subject_name(issuer);
|
|
|
|
ikey = X509_get0_pubkey_bitstr(issuer);
|
|
|
|
sno = s2i_ASN1_INTEGER(NULL, serial);
|
|
|
|
if (!sno) {
|
|
|
|
BIO_printf(bio_err, "Error converting serial number %s\n", serial);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
id = OCSP_cert_id_new(cert_id_md, iname, ikey, sno);
|
|
|
|
ASN1_INTEGER_free(sno);
|
2015-10-30 19:18:04 +08:00
|
|
|
if (id == NULL || !sk_OCSP_CERTID_push(ids, id))
|
2015-01-22 11:40:55 +08:00
|
|
|
goto err;
|
|
|
|
if (!OCSP_request_add0_id(*req, id))
|
|
|
|
goto err;
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
err:
|
|
|
|
BIO_printf(bio_err, "Error Creating OCSP request\n");
|
|
|
|
return 0;
|
|
|
|
}
|
2001-01-19 09:32:23 +08:00
|
|
|
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
static void print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
|
2015-01-22 11:40:55 +08:00
|
|
|
STACK_OF(OPENSSL_STRING) *names,
|
|
|
|
STACK_OF(OCSP_CERTID) *ids, long nsec,
|
|
|
|
long maxage)
|
|
|
|
{
|
|
|
|
OCSP_CERTID *id;
|
|
|
|
char *name;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
int i, status, reason;
|
2015-01-22 11:40:55 +08:00
|
|
|
ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
|
|
|
|
|
|
|
|
if (!bs || !req || !sk_OPENSSL_STRING_num(names)
|
|
|
|
|| !sk_OCSP_CERTID_num(ids))
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
return;
|
2015-01-22 11:40:55 +08:00
|
|
|
|
|
|
|
for (i = 0; i < sk_OCSP_CERTID_num(ids); i++) {
|
|
|
|
id = sk_OCSP_CERTID_value(ids, i);
|
|
|
|
name = sk_OPENSSL_STRING_value(names, i);
|
|
|
|
BIO_printf(out, "%s: ", name);
|
|
|
|
|
|
|
|
if (!OCSP_resp_find_status(bs, id, &status, &reason,
|
|
|
|
&rev, &thisupd, &nextupd)) {
|
|
|
|
BIO_puts(out, "ERROR: No Status found.\n");
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check validity: if invalid write to output BIO so we know which
|
|
|
|
* response this refers to.
|
|
|
|
*/
|
|
|
|
if (!OCSP_check_validity(thisupd, nextupd, nsec, maxage)) {
|
|
|
|
BIO_puts(out, "WARNING: Status times invalid.\n");
|
|
|
|
ERR_print_errors(out);
|
|
|
|
}
|
|
|
|
BIO_printf(out, "%s\n", OCSP_cert_status_str(status));
|
|
|
|
|
|
|
|
BIO_puts(out, "\tThis Update: ");
|
|
|
|
ASN1_GENERALIZEDTIME_print(out, thisupd);
|
|
|
|
BIO_puts(out, "\n");
|
|
|
|
|
|
|
|
if (nextupd) {
|
|
|
|
BIO_puts(out, "\tNext Update: ");
|
|
|
|
ASN1_GENERALIZEDTIME_print(out, nextupd);
|
|
|
|
BIO_puts(out, "\n");
|
|
|
|
}
|
|
|
|
|
|
|
|
if (status != V_OCSP_CERTSTATUS_REVOKED)
|
|
|
|
continue;
|
|
|
|
|
|
|
|
if (reason != -1)
|
|
|
|
BIO_printf(out, "\tReason: %s\n", OCSP_crl_reason_str(reason));
|
|
|
|
|
|
|
|
BIO_puts(out, "\tRevocation Time: ");
|
|
|
|
ASN1_GENERALIZEDTIME_print(out, rev);
|
|
|
|
BIO_puts(out, "\n");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
static void make_ocsp_response(OCSP_RESPONSE **resp, OCSP_REQUEST *req,
|
2015-01-22 11:40:55 +08:00
|
|
|
CA_DB *db, X509 *ca, X509 *rcert,
|
|
|
|
EVP_PKEY *rkey, const EVP_MD *rmd,
|
|
|
|
STACK_OF(X509) *rother, unsigned long flags,
|
|
|
|
int nmin, int ndays, int badsig)
|
|
|
|
{
|
|
|
|
ASN1_TIME *thisupd = NULL, *nextupd = NULL;
|
|
|
|
OCSP_CERTID *cid, *ca_id = NULL;
|
|
|
|
OCSP_BASICRESP *bs = NULL;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
int i, id_count;
|
2015-01-22 11:40:55 +08:00
|
|
|
|
|
|
|
id_count = OCSP_request_onereq_count(req);
|
|
|
|
|
|
|
|
if (id_count <= 0) {
|
|
|
|
*resp =
|
|
|
|
OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL);
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
|
|
|
bs = OCSP_BASICRESP_new();
|
|
|
|
thisupd = X509_gmtime_adj(NULL, 0);
|
|
|
|
if (ndays != -1)
|
2016-01-14 08:25:25 +08:00
|
|
|
nextupd = X509_time_adj_ex(NULL, ndays, nmin * 60, NULL);
|
2015-01-22 11:40:55 +08:00
|
|
|
|
|
|
|
/* Examine each certificate id in the request */
|
|
|
|
for (i = 0; i < id_count; i++) {
|
|
|
|
OCSP_ONEREQ *one;
|
|
|
|
ASN1_INTEGER *serial;
|
|
|
|
char **inf;
|
|
|
|
ASN1_OBJECT *cert_id_md_oid;
|
|
|
|
const EVP_MD *cert_id_md;
|
|
|
|
one = OCSP_request_onereq_get0(req, i);
|
|
|
|
cid = OCSP_onereq_get0_id(one);
|
|
|
|
|
|
|
|
OCSP_id_get0_info(NULL, &cert_id_md_oid, NULL, NULL, cid);
|
|
|
|
|
|
|
|
cert_id_md = EVP_get_digestbyobj(cert_id_md_oid);
|
|
|
|
if (!cert_id_md) {
|
|
|
|
*resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR,
|
|
|
|
NULL);
|
|
|
|
goto end;
|
|
|
|
}
|
2015-05-02 02:37:16 +08:00
|
|
|
OCSP_CERTID_free(ca_id);
|
2015-01-22 11:40:55 +08:00
|
|
|
ca_id = OCSP_cert_to_id(cert_id_md, NULL, ca);
|
|
|
|
|
|
|
|
/* Is this request about our CA? */
|
|
|
|
if (OCSP_id_issuer_cmp(ca_id, cid)) {
|
|
|
|
OCSP_basic_add1_status(bs, cid,
|
|
|
|
V_OCSP_CERTSTATUS_UNKNOWN,
|
|
|
|
0, NULL, thisupd, nextupd);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
OCSP_id_get0_info(NULL, NULL, NULL, &serial, cid);
|
|
|
|
inf = lookup_serial(db, serial);
|
|
|
|
if (!inf)
|
|
|
|
OCSP_basic_add1_status(bs, cid,
|
|
|
|
V_OCSP_CERTSTATUS_UNKNOWN,
|
|
|
|
0, NULL, thisupd, nextupd);
|
|
|
|
else if (inf[DB_type][0] == DB_TYPE_VAL)
|
|
|
|
OCSP_basic_add1_status(bs, cid,
|
|
|
|
V_OCSP_CERTSTATUS_GOOD,
|
|
|
|
0, NULL, thisupd, nextupd);
|
|
|
|
else if (inf[DB_type][0] == DB_TYPE_REV) {
|
|
|
|
ASN1_OBJECT *inst = NULL;
|
|
|
|
ASN1_TIME *revtm = NULL;
|
|
|
|
ASN1_GENERALIZEDTIME *invtm = NULL;
|
|
|
|
OCSP_SINGLERESP *single;
|
|
|
|
int reason = -1;
|
|
|
|
unpack_revinfo(&revtm, &reason, &inst, &invtm, inf[DB_rev_date]);
|
|
|
|
single = OCSP_basic_add1_status(bs, cid,
|
|
|
|
V_OCSP_CERTSTATUS_REVOKED,
|
|
|
|
reason, revtm, thisupd, nextupd);
|
|
|
|
if (invtm)
|
|
|
|
OCSP_SINGLERESP_add1_ext_i2d(single, NID_invalidity_date,
|
|
|
|
invtm, 0, 0);
|
|
|
|
else if (inst)
|
|
|
|
OCSP_SINGLERESP_add1_ext_i2d(single,
|
|
|
|
NID_hold_instruction_code, inst,
|
|
|
|
0, 0);
|
|
|
|
ASN1_OBJECT_free(inst);
|
|
|
|
ASN1_TIME_free(revtm);
|
|
|
|
ASN1_GENERALIZEDTIME_free(invtm);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
OCSP_copy_nonce(bs, req);
|
|
|
|
|
|
|
|
OCSP_basic_sign(bs, rcert, rkey, rmd, rother, flags);
|
|
|
|
|
2015-03-05 21:41:11 +08:00
|
|
|
if (badsig) {
|
|
|
|
ASN1_OCTET_STRING *sig = OCSP_resp_get0_signature(bs);
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
unsigned char *sigptr = ASN1_STRING_data(sig);
|
2015-03-05 21:41:11 +08:00
|
|
|
sigptr[ASN1_STRING_length(sig) - 1] ^= 0x1;
|
|
|
|
}
|
2015-01-22 11:40:55 +08:00
|
|
|
|
|
|
|
*resp = OCSP_response_create(OCSP_RESPONSE_STATUS_SUCCESSFUL, bs);
|
|
|
|
|
|
|
|
end:
|
|
|
|
ASN1_TIME_free(thisupd);
|
|
|
|
ASN1_TIME_free(nextupd);
|
|
|
|
OCSP_CERTID_free(ca_id);
|
|
|
|
OCSP_BASICRESP_free(bs);
|
|
|
|
}
|
2001-07-13 04:41:51 +08:00
|
|
|
|
2003-04-04 00:33:03 +08:00
|
|
|
static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser)
|
2015-01-22 11:40:55 +08:00
|
|
|
{
|
|
|
|
int i;
|
|
|
|
BIGNUM *bn = NULL;
|
|
|
|
char *itmp, *row[DB_NUMBER], **rrow;
|
|
|
|
for (i = 0; i < DB_NUMBER; i++)
|
|
|
|
row[i] = NULL;
|
|
|
|
bn = ASN1_INTEGER_to_BN(ser, NULL);
|
|
|
|
OPENSSL_assert(bn); /* FIXME: should report an error at this
|
|
|
|
* point and abort */
|
|
|
|
if (BN_is_zero(bn))
|
Rename some BUF_xxx to OPENSSL_xxx
Rename BUF_{strdup,strlcat,strlcpy,memdup,strndup,strnlen}
to OPENSSL_{strdup,strlcat,strlcpy,memdup,strndup,strnlen}
Add #define's for the old names.
Add CRYPTO_{memdup,strndup}, called by OPENSSL_{memdup,strndup} macros.
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-12-17 05:12:24 +08:00
|
|
|
itmp = OPENSSL_strdup("00");
|
2015-01-22 11:40:55 +08:00
|
|
|
else
|
|
|
|
itmp = BN_bn2hex(bn);
|
|
|
|
row[DB_serial] = itmp;
|
|
|
|
BN_free(bn);
|
|
|
|
rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
|
|
|
|
OPENSSL_free(itmp);
|
|
|
|
return rrow;
|
|
|
|
}
|
2001-07-13 04:41:51 +08:00
|
|
|
|
|
|
|
/* Quick and dirty OCSP server: read in and parse input request */
|
|
|
|
|
2013-10-07 19:41:43 +08:00
|
|
|
static BIO *init_responder(const char *port)
|
2015-01-22 11:40:55 +08:00
|
|
|
{
|
|
|
|
BIO *acbio = NULL, *bufbio = NULL;
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
|
2015-05-02 22:44:31 +08:00
|
|
|
# ifdef OPENSSL_NO_SOCK
|
2015-01-22 11:40:55 +08:00
|
|
|
BIO_printf(bio_err,
|
|
|
|
"Error setting up accept BIO - sockets not supported.\n");
|
2015-05-02 22:44:31 +08:00
|
|
|
return NULL;
|
2015-01-22 11:40:55 +08:00
|
|
|
# endif
|
2015-05-02 22:44:31 +08:00
|
|
|
bufbio = BIO_new(BIO_f_buffer());
|
2015-10-30 19:18:04 +08:00
|
|
|
if (bufbio == NULL)
|
2015-01-22 11:40:55 +08:00
|
|
|
goto err;
|
2015-05-02 22:44:31 +08:00
|
|
|
acbio = BIO_new(BIO_s_accept());
|
|
|
|
if (acbio == NULL
|
|
|
|
|| BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) < 0
|
|
|
|
|| BIO_set_accept_port(acbio, port) < 0) {
|
|
|
|
BIO_printf(bio_err, "Error setting up accept BIO\n");
|
|
|
|
ERR_print_errors(bio_err);
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
2015-01-22 11:40:55 +08:00
|
|
|
BIO_set_accept_bios(acbio, bufbio);
|
|
|
|
bufbio = NULL;
|
|
|
|
if (BIO_do_accept(acbio) <= 0) {
|
2015-05-02 22:44:31 +08:00
|
|
|
BIO_printf(bio_err, "Error starting accept\n");
|
2015-01-22 11:40:55 +08:00
|
|
|
ERR_print_errors(bio_err);
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
|
|
|
return acbio;
|
|
|
|
|
|
|
|
err:
|
|
|
|
BIO_free_all(acbio);
|
|
|
|
BIO_free(bufbio);
|
|
|
|
return NULL;
|
|
|
|
}
|
2001-07-13 04:41:51 +08:00
|
|
|
|
2015-04-30 05:37:04 +08:00
|
|
|
|
2015-05-02 11:36:11 +08:00
|
|
|
/*
|
|
|
|
* Decode %xx URL-decoding in-place. Ignores mal-formed sequences.
|
|
|
|
*/
|
|
|
|
static int urldecode(char *p)
|
2015-04-30 05:37:04 +08:00
|
|
|
{
|
|
|
|
unsigned char *out = (unsigned char *)p;
|
2015-05-02 11:36:11 +08:00
|
|
|
unsigned char *save = out;
|
2015-04-30 05:37:04 +08:00
|
|
|
|
|
|
|
for (; *p; p++) {
|
|
|
|
if (*p != '%')
|
|
|
|
*out++ = *p;
|
2015-05-02 11:36:11 +08:00
|
|
|
else if (isxdigit(p[1]) && isxdigit(p[2])) {
|
2015-04-30 05:37:04 +08:00
|
|
|
*out++ = (app_hex(p[1]) << 4) | app_hex(p[2]);
|
|
|
|
p += 2;
|
|
|
|
}
|
2015-05-02 11:36:11 +08:00
|
|
|
else
|
|
|
|
return -1;
|
2015-04-30 05:37:04 +08:00
|
|
|
}
|
2015-05-02 11:36:11 +08:00
|
|
|
*out = '\0';
|
|
|
|
return (int)(out - save);
|
2015-04-30 05:37:04 +08:00
|
|
|
}
|
|
|
|
|
2013-10-07 19:41:43 +08:00
|
|
|
static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio,
|
2015-01-22 11:40:55 +08:00
|
|
|
const char *port)
|
|
|
|
{
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
int len;
|
2015-01-22 11:40:55 +08:00
|
|
|
OCSP_REQUEST *req = NULL;
|
2015-05-02 11:36:11 +08:00
|
|
|
char inbuf[2048], reqbuf[2048];
|
2015-04-30 05:37:04 +08:00
|
|
|
char *p, *q;
|
|
|
|
BIO *cbio = NULL, *getbio = NULL, *b64 = NULL;
|
2015-01-22 11:40:55 +08:00
|
|
|
|
|
|
|
if (BIO_do_accept(acbio) <= 0) {
|
|
|
|
BIO_printf(bio_err, "Error accepting connection\n");
|
|
|
|
ERR_print_errors(bio_err);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
cbio = BIO_pop(acbio);
|
|
|
|
*pcbio = cbio;
|
|
|
|
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
/* Read the request line. */
|
2015-05-02 11:36:11 +08:00
|
|
|
len = BIO_gets(cbio, reqbuf, sizeof reqbuf);
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
if (len <= 0)
|
|
|
|
return 1;
|
2015-05-02 11:36:11 +08:00
|
|
|
if (strncmp(reqbuf, "GET ", 4) == 0) {
|
2015-04-30 05:37:04 +08:00
|
|
|
/* Expecting GET {sp} /URL {sp} HTTP/1.x */
|
2015-05-02 11:36:11 +08:00
|
|
|
for (p = reqbuf + 4; *p == ' '; ++p)
|
2015-04-30 05:37:04 +08:00
|
|
|
continue;
|
2015-05-02 11:36:11 +08:00
|
|
|
if (*p != '/') {
|
|
|
|
BIO_printf(bio_err, "Invalid request -- bad URL\n");
|
|
|
|
return 1;
|
2015-04-30 05:37:04 +08:00
|
|
|
}
|
2015-05-02 11:36:11 +08:00
|
|
|
p++;
|
|
|
|
|
2015-04-30 05:37:04 +08:00
|
|
|
/* Splice off the HTTP version identifier. */
|
|
|
|
for (q = p; *q; q++)
|
2015-05-02 11:36:11 +08:00
|
|
|
if (*q == ' ')
|
2015-04-30 05:37:04 +08:00
|
|
|
break;
|
2015-05-02 11:36:11 +08:00
|
|
|
if (strncmp(q, " HTTP/1.", 8) != 0) {
|
|
|
|
BIO_printf(bio_err, "Invalid request -- bad HTTP vesion\n");
|
2015-04-30 05:37:04 +08:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
*q = '\0';
|
2015-05-02 11:36:11 +08:00
|
|
|
len = urldecode(p);
|
|
|
|
if (len <= 0) {
|
|
|
|
BIO_printf(bio_err, "Invalid request -- bad URL encoding\n");
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
if ((getbio = BIO_new_mem_buf(p, len)) == NULL
|
|
|
|
|| (b64 = BIO_new(BIO_f_base64())) == NULL) {
|
|
|
|
BIO_printf(bio_err, "Could not allocate memory\n");
|
|
|
|
ERR_print_errors(bio_err);
|
|
|
|
return 1;
|
|
|
|
}
|
2015-04-30 05:37:04 +08:00
|
|
|
BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
|
|
|
|
getbio = BIO_push(b64, getbio);
|
2015-05-02 11:36:11 +08:00
|
|
|
} else if (strncmp(reqbuf, "POST ", 5) != 0) {
|
|
|
|
BIO_printf(bio_err, "Invalid request -- bad HTTP verb\n");
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
return 1;
|
|
|
|
}
|
2015-05-02 11:36:11 +08:00
|
|
|
|
|
|
|
/* Read and skip past the headers. */
|
2015-01-22 11:40:55 +08:00
|
|
|
for (;;) {
|
|
|
|
len = BIO_gets(cbio, inbuf, sizeof inbuf);
|
|
|
|
if (len <= 0)
|
|
|
|
return 1;
|
|
|
|
if ((inbuf[0] == '\r') || (inbuf[0] == '\n'))
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Try to read OCSP request */
|
2015-04-30 05:37:04 +08:00
|
|
|
if (getbio) {
|
|
|
|
req = d2i_OCSP_REQUEST_bio(getbio, NULL);
|
|
|
|
BIO_free_all(getbio);
|
|
|
|
} else
|
|
|
|
req = d2i_OCSP_REQUEST_bio(cbio, NULL);
|
2015-01-22 11:40:55 +08:00
|
|
|
|
|
|
|
if (!req) {
|
|
|
|
BIO_printf(bio_err, "Error parsing OCSP request\n");
|
|
|
|
ERR_print_errors(bio_err);
|
|
|
|
}
|
|
|
|
|
|
|
|
*preq = req;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
}
|
2001-07-13 04:41:51 +08:00
|
|
|
|
|
|
|
static int send_ocsp_response(BIO *cbio, OCSP_RESPONSE *resp)
|
2015-01-22 11:40:55 +08:00
|
|
|
{
|
|
|
|
char http_resp[] =
|
|
|
|
"HTTP/1.0 200 OK\r\nContent-type: application/ocsp-response\r\n"
|
|
|
|
"Content-Length: %d\r\n\r\n";
|
|
|
|
if (!cbio)
|
|
|
|
return 0;
|
|
|
|
BIO_printf(cbio, http_resp, i2d_OCSP_RESPONSE(resp, NULL));
|
|
|
|
i2d_OCSP_RESPONSE_bio(cbio, resp);
|
|
|
|
(void)BIO_flush(cbio);
|
|
|
|
return 1;
|
|
|
|
}
|
2001-07-13 04:41:51 +08:00
|
|
|
|
2015-10-18 07:16:23 +08:00
|
|
|
static OCSP_RESPONSE *query_responder(BIO *cbio, const char *host,
|
|
|
|
const char *path,
|
2015-01-22 11:40:55 +08:00
|
|
|
const STACK_OF(CONF_VALUE) *headers,
|
|
|
|
OCSP_REQUEST *req, int req_timeout)
|
|
|
|
{
|
|
|
|
int fd;
|
|
|
|
int rv;
|
|
|
|
int i;
|
2015-10-18 07:16:23 +08:00
|
|
|
int add_host = 1;
|
2015-01-22 11:40:55 +08:00
|
|
|
OCSP_REQ_CTX *ctx = NULL;
|
|
|
|
OCSP_RESPONSE *rsp = NULL;
|
|
|
|
fd_set confds;
|
|
|
|
struct timeval tv;
|
|
|
|
|
|
|
|
if (req_timeout != -1)
|
|
|
|
BIO_set_nbio(cbio, 1);
|
|
|
|
|
|
|
|
rv = BIO_do_connect(cbio);
|
|
|
|
|
|
|
|
if ((rv <= 0) && ((req_timeout == -1) || !BIO_should_retry(cbio))) {
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
BIO_puts(bio_err, "Error connecting BIO\n");
|
2015-01-22 11:40:55 +08:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2015-10-02 21:16:08 +08:00
|
|
|
if (BIO_get_fd(cbio, &fd) < 0) {
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
BIO_puts(bio_err, "Can't get connection fd\n");
|
2015-01-22 11:40:55 +08:00
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (req_timeout != -1 && rv <= 0) {
|
|
|
|
FD_ZERO(&confds);
|
|
|
|
openssl_fdset(fd, &confds);
|
|
|
|
tv.tv_usec = 0;
|
|
|
|
tv.tv_sec = req_timeout;
|
|
|
|
rv = select(fd + 1, NULL, (void *)&confds, NULL, &tv);
|
|
|
|
if (rv == 0) {
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
BIO_puts(bio_err, "Timeout on connect\n");
|
2015-01-22 11:40:55 +08:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
ctx = OCSP_sendreq_new(cbio, path, NULL, -1);
|
2015-10-30 19:18:04 +08:00
|
|
|
if (ctx == NULL)
|
2015-01-22 11:40:55 +08:00
|
|
|
return NULL;
|
|
|
|
|
|
|
|
for (i = 0; i < sk_CONF_VALUE_num(headers); i++) {
|
|
|
|
CONF_VALUE *hdr = sk_CONF_VALUE_value(headers, i);
|
2015-10-18 07:16:23 +08:00
|
|
|
if (add_host == 1 && strcasecmp("host", hdr->name) == 0)
|
|
|
|
add_host = 0;
|
2015-01-22 11:40:55 +08:00
|
|
|
if (!OCSP_REQ_CTX_add1_header(ctx, hdr->name, hdr->value))
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
2015-10-18 07:16:23 +08:00
|
|
|
if (add_host == 1 && OCSP_REQ_CTX_add1_header(ctx, "Host", host) == 0)
|
|
|
|
goto err;
|
|
|
|
|
2015-01-22 11:40:55 +08:00
|
|
|
if (!OCSP_REQ_CTX_set1_req(ctx, req))
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
for (;;) {
|
|
|
|
rv = OCSP_sendreq_nbio(&rsp, ctx);
|
|
|
|
if (rv != -1)
|
|
|
|
break;
|
|
|
|
if (req_timeout == -1)
|
|
|
|
continue;
|
|
|
|
FD_ZERO(&confds);
|
|
|
|
openssl_fdset(fd, &confds);
|
|
|
|
tv.tv_usec = 0;
|
|
|
|
tv.tv_sec = req_timeout;
|
|
|
|
if (BIO_should_read(cbio))
|
|
|
|
rv = select(fd + 1, (void *)&confds, NULL, NULL, &tv);
|
|
|
|
else if (BIO_should_write(cbio))
|
|
|
|
rv = select(fd + 1, NULL, (void *)&confds, NULL, &tv);
|
|
|
|
else {
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
BIO_puts(bio_err, "Unexpected retry condition\n");
|
2015-01-22 11:40:55 +08:00
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
if (rv == 0) {
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
BIO_puts(bio_err, "Timeout on request\n");
|
2015-01-22 11:40:55 +08:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (rv == -1) {
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
BIO_puts(bio_err, "Select error\n");
|
2015-01-22 11:40:55 +08:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
err:
|
2015-05-01 06:10:52 +08:00
|
|
|
OCSP_REQ_CTX_free(ctx);
|
2015-01-22 11:40:55 +08:00
|
|
|
|
|
|
|
return rsp;
|
|
|
|
}
|
2006-07-17 21:26:54 +08:00
|
|
|
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
OCSP_RESPONSE *process_responder(OCSP_REQUEST *req,
|
2015-01-22 11:40:55 +08:00
|
|
|
const char *host, const char *path,
|
|
|
|
const char *port, int use_ssl,
|
2015-08-10 23:37:48 +08:00
|
|
|
STACK_OF(CONF_VALUE) *headers,
|
2015-01-22 11:40:55 +08:00
|
|
|
int req_timeout)
|
|
|
|
{
|
|
|
|
BIO *cbio = NULL;
|
|
|
|
SSL_CTX *ctx = NULL;
|
|
|
|
OCSP_RESPONSE *resp = NULL;
|
2015-08-04 19:23:00 +08:00
|
|
|
|
2015-01-22 11:40:55 +08:00
|
|
|
cbio = BIO_new_connect(host);
|
|
|
|
if (!cbio) {
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
BIO_printf(bio_err, "Error creating connect BIO\n");
|
2015-01-22 11:40:55 +08:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
if (port)
|
|
|
|
BIO_set_conn_port(cbio, port);
|
|
|
|
if (use_ssl == 1) {
|
|
|
|
BIO *sbio;
|
2015-03-31 07:18:31 +08:00
|
|
|
ctx = SSL_CTX_new(TLS_client_method());
|
2015-01-22 11:40:55 +08:00
|
|
|
if (ctx == NULL) {
|
Big apps cleanup (option-parsing, etc)
This is merges the old "rsalz-monolith" branch over to master. The biggest
change is that option parsing switch from cascasding 'else if strcmp("-foo")'
to a utility routine and somethin akin to getopt. Also, an error in the
command line no longer prints the full summary; use -help (or --help :)
for that. There have been many other changes and code-cleanup, see
bullet list below.
Special thanks to Matt for the long and detailed code review.
TEMPORARY:
For now, comment out CRYPTO_mem_leaks() at end of main
Tickets closed:
RT3515: Use 3DES in pkcs12 if built with no-rc2
RT1766: s_client -reconnect and -starttls broke
RT2932: Catch write errors
RT2604: port should be 'unsigned short'
RT2983: total_bytes undeclared #ifdef RENEG
RT1523: Add -nocert to fix output in x509 app
RT3508: Remove unused variable introduced by b09eb24
RT3511: doc fix; req default serial is random
RT1325,2973: Add more extensions to c_rehash
RT2119,3407: Updated to dgst.pod
RT2379: Additional typo fix
RT2693: Extra include of string.h
RT2880: HFS is case-insensitive filenames
RT3246: req command prints version number wrong
Other changes; incompatibilities marked with *:
Add SCSV support
Add -misalign to speed command
Make dhparam, dsaparam, ecparam, x509 output C in proper style
Make some internal ocsp.c functions void
Only display cert usages with -help in verify
Use global bio_err, remove "BIO*err" parameter from functions
For filenames, - always means stdin (or stdout as appropriate)
Add aliases for -des/aes "wrap" ciphers.
*Remove support for IISSGC (server gated crypto)
*The undocumented OCSP -header flag is now "-header name=value"
*Documented the OCSP -header flag
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-25 03:26:15 +08:00
|
|
|
BIO_printf(bio_err, "Error creating SSL context.\n");
|
2015-01-22 11:40:55 +08:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
|
|
|
|
sbio = BIO_new_ssl(ctx, 1);
|
|
|
|
cbio = BIO_push(sbio, cbio);
|
|
|
|
}
|
2015-08-04 19:23:00 +08:00
|
|
|
|
2015-10-18 07:16:23 +08:00
|
|
|
resp = query_responder(cbio, host, path, headers, req, req_timeout);
|
2015-01-22 11:40:55 +08:00
|
|
|
if (!resp)
|
|
|
|
BIO_printf(bio_err, "Error querying OCSP responder\n");
|
|
|
|
end:
|
2015-03-25 23:31:18 +08:00
|
|
|
BIO_free_all(cbio);
|
2015-04-11 22:22:36 +08:00
|
|
|
SSL_CTX_free(ctx);
|
2015-01-22 11:40:55 +08:00
|
|
|
return resp;
|
|
|
|
}
|
2007-09-27 05:56:59 +08:00
|
|
|
|
2003-02-14 09:02:58 +08:00
|
|
|
#endif
|