mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-02-17 14:32:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

APPS/ocsp: fix case where reqin and outfile are the same

Browse Source 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
This commit is contained in:
Dr. David von Oheimb 2024-09-27 07:49:22 +02:00 committed by Tomas Mraz
parent 1dbb67c4f1
commit 421e8d7af8
3 changed files with 38 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
apps/ocsp.c
View File

@ -553,10 +553,6 @@ int ocsp_main(int argc, char **argv)
&& respin == NULL && !(port != NULL && ridx_filename != NULL)) && respin == NULL && !(port != NULL && ridx_filename != NULL))
goto opthelp; goto opthelp;
out = bio_open_default(outfile, 'w', FORMAT_TEXT);
if (out == NULL)
goto end;
if (req == NULL && (add_nonce != 2)) if (req == NULL && (add_nonce != 2))
add_nonce = 0; add_nonce = 0;
@ -709,6 +705,10 @@ redo_accept:
} }
} }
out = bio_open_default(outfile, 'w', FORMAT_TEXT);
if (out == NULL)
goto end;
if (req_text && req != NULL) if (req_text && req != NULL)
OCSP_REQUEST_print(out, req, 0); OCSP_REQUEST_print(out, req, 0);

17
doc/man1/openssl-ocsp.pod.in
View File

@ -24,10 +24,10 @@ B<openssl> B<ocsp>
[B<-req_text>] [B<-req_text>]
[B<-resp_text>] [B<-resp_text>]
[B<-text>] [B<-text>]
[B<-reqout> I<file>] [B<-reqout> I<filename>]
[B<-respout> I<file>] [B<-respout> I<filename>]
[B<-reqin> I<file>] [B<-reqin> I<filename>]
[B<-respin> I<file>] [B<-respin> I<filename>]
[B<-url> I<URL>] [B<-url> I<URL>]
[B<-host> I<host>:I<port>] [B<-host> I<host>:I<port>]
[B<-path> I<pathname>] [B<-path> I<pathname>]
@ -155,11 +155,14 @@ a nonce is automatically added specifying B<-no_nonce> overrides this.
Print out the text form of the OCSP request, response or both respectively. Print out the text form of the OCSP request, response or both respectively.
=item B<-reqout> I<file>, B<-respout> I<file> =item B<-reqout> I<file>, B<-respout> I<filename>
Write out the DER encoded certificate request or response to I<file>. Write out the DER-encoded OCSP request or response to I<filename>.
The output filename can be the same as the input filename,
which leads to replacing the file contents.
Note that file I/O is not atomic. The output file is truncated and then written.
=item B<-reqin> I<file>, B<-respin> I<file> =item B<-reqin> I<file>, B<-respin> I<filename>
Read OCSP request or response file from I<file>. These option are ignored Read OCSP request or response file from I<file>. These option are ignored
if OCSP request or response creation is implied by other options (for example if OCSP request or response creation is implied by other options (for example

27
test/recipes/80-test_ocsp.t
View File

@ -14,6 +14,7 @@ use POSIX;
use File::Spec::Functions qw/devnull catfile/; use File::Spec::Functions qw/devnull catfile/;
use File::Basename; use File::Basename;
use File::Copy; use File::Copy;
use File::Compare qw/compare/;
use OpenSSL::Test qw/:DEFAULT with pipe srctop_dir data_file/; use OpenSSL::Test qw/:DEFAULT with pipe srctop_dir data_file/;
use OpenSSL::Test::Utils; use OpenSSL::Test::Utils;
@ -51,7 +52,7 @@ sub test_ocsp {
$title); }); $title); });
} }
plan tests => 11; plan tests => 12;
subtest "=== VALID OCSP RESPONSES ===" => sub { subtest "=== VALID OCSP RESPONSES ===" => sub {
plan tests => 7; plan tests => 7;
@ -220,9 +221,29 @@ subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
"D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0, 0); "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0, 0);
}; };
my $cert = data_file("cert.pem");
my $key = data_file("key.pem");
subtest "=== OCSP API TESTS===" => sub { subtest "=== OCSP API TESTS===" => sub {
plan tests => 1; plan tests => 1;
ok(run(test(["ocspapitest", data_file("cert.pem"), data_file("key.pem")])), ok(run(test(["ocspapitest", $cert, $key])),
"running ocspapitest"); "running ocspapitest");
} };
subtest "=== OCSP handling of identical input and output files ===" => sub {
plan tests => 5;
my $inout1 = "req.der";
my $backup1 = "backup.der";
ok(run(app(['openssl', 'ocsp', '-issuer', $cert, '-cert', $cert,
'-reqout', $inout1])), "produce dummy request input");
copy($inout1, $backup1);
ok(run(app(['openssl', 'ocsp', '-reqin', $inout1, '-reqout', $inout1])));
ok(!compare($inout1, $backup1), "copied request $inout1 did not change");
my $inout2 = "ND1.dat";
my $backup2 = "backup.dat";
copy($inout2, $backup2);
ok(run(app(['openssl', 'ocsp', '-respin', $inout2, '-respout', $inout2, '-noverify'])));
ok(!compare($inout2, $backup2), "copied response $inout2 did not change");
};