2012-04-13 20:39:19 +04:00
|
|
|
/* ocsp.c
|
|
|
|
*
|
2013-02-06 00:44:17 +04:00
|
|
|
* Copyright (C) 2006-2013 wolfSSL Inc.
|
2012-04-13 20:39:19 +04:00
|
|
|
*
|
|
|
|
* This file is part of CyaSSL.
|
|
|
|
*
|
|
|
|
* CyaSSL is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License as published by
|
|
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
|
|
* (at your option) any later version.
|
|
|
|
*
|
|
|
|
* CyaSSL is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
#include <config.h>
|
|
|
|
#endif
|
|
|
|
|
2013-04-10 22:04:29 +04:00
|
|
|
#include <cyassl/ctaocrypt/settings.h>
|
|
|
|
|
2012-05-31 01:40:25 +04:00
|
|
|
#ifdef HAVE_OCSP
|
|
|
|
|
2014-03-25 22:39:07 +04:00
|
|
|
#include <cyassl/error-ssl.h>
|
2012-05-03 01:45:30 +04:00
|
|
|
#include <cyassl/ocsp.h>
|
2012-05-06 10:38:28 +04:00
|
|
|
#include <cyassl/internal.h>
|
2012-05-03 01:45:30 +04:00
|
|
|
|
|
|
|
|
2013-12-28 00:11:47 +04:00
|
|
|
int InitOCSP(CYASSL_OCSP* ocsp, CYASSL_CERT_MANAGER* cm)
|
2012-05-03 01:45:30 +04:00
|
|
|
{
|
2013-12-28 00:11:47 +04:00
|
|
|
CYASSL_ENTER("InitOCSP");
|
|
|
|
XMEMSET(ocsp, 0, sizeof(*ocsp));
|
|
|
|
ocsp->cm = cm;
|
2014-02-01 04:59:13 +04:00
|
|
|
if (InitMutex(&ocsp->ocspLock) != 0)
|
|
|
|
return BAD_MUTEX_E;
|
2012-05-03 01:45:30 +04:00
|
|
|
|
2013-12-28 00:11:47 +04:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static int InitOCSP_Entry(OCSP_Entry* ocspe, DecodedCert* cert)
|
|
|
|
{
|
|
|
|
CYASSL_ENTER("InitOCSP_Entry");
|
|
|
|
|
2014-02-01 04:59:13 +04:00
|
|
|
XMEMSET(ocspe, 0, sizeof(*ocspe));
|
2013-12-28 00:11:47 +04:00
|
|
|
XMEMCPY(ocspe->issuerHash, cert->issuerHash, SHA_DIGEST_SIZE);
|
|
|
|
XMEMCPY(ocspe->issuerKeyHash, cert->issuerKeyHash, SHA_DIGEST_SIZE);
|
|
|
|
|
|
|
|
return 0;
|
2012-05-03 01:45:30 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2012-06-01 04:29:32 +04:00
|
|
|
static void FreeOCSP_Entry(OCSP_Entry* ocspe)
|
|
|
|
{
|
|
|
|
CertStatus* tmp = ocspe->status;
|
|
|
|
|
|
|
|
CYASSL_ENTER("FreeOCSP_Entry");
|
|
|
|
|
|
|
|
while (tmp) {
|
|
|
|
CertStatus* next = tmp->next;
|
|
|
|
XFREE(tmp, NULL, DYNAMIC_TYPE_OCSP_STATUS);
|
|
|
|
tmp = next;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2013-12-28 00:11:47 +04:00
|
|
|
void FreeOCSP(CYASSL_OCSP* ocsp, int dynamic)
|
2012-05-03 01:45:30 +04:00
|
|
|
{
|
2012-06-01 04:29:32 +04:00
|
|
|
OCSP_Entry* tmp = ocsp->ocspList;
|
|
|
|
|
2013-12-28 00:11:47 +04:00
|
|
|
CYASSL_ENTER("FreeOCSP");
|
|
|
|
|
2012-06-01 04:29:32 +04:00
|
|
|
while (tmp) {
|
|
|
|
OCSP_Entry* next = tmp->next;
|
|
|
|
FreeOCSP_Entry(tmp);
|
|
|
|
XFREE(tmp, NULL, DYNAMIC_TYPE_OCSP_ENTRY);
|
|
|
|
tmp = next;
|
|
|
|
}
|
|
|
|
|
2014-02-01 04:59:13 +04:00
|
|
|
FreeMutex(&ocsp->ocspLock);
|
2013-12-28 00:11:47 +04:00
|
|
|
if (dynamic)
|
|
|
|
XFREE(ocsp, NULL, DYNAMIC_TYPE_OCSP);
|
2012-06-01 04:29:32 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2012-06-01 22:57:03 +04:00
|
|
|
static int xstat2err(int stat)
|
|
|
|
{
|
|
|
|
switch (stat) {
|
|
|
|
case CERT_GOOD:
|
|
|
|
return 0;
|
|
|
|
case CERT_REVOKED:
|
|
|
|
return OCSP_CERT_REVOKED;
|
|
|
|
default:
|
|
|
|
return OCSP_CERT_UNKNOWN;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2013-12-28 00:11:47 +04:00
|
|
|
int CheckCertOCSP(CYASSL_OCSP* ocsp, DecodedCert* cert)
|
2012-06-01 04:29:32 +04:00
|
|
|
{
|
2012-12-20 06:09:05 +04:00
|
|
|
byte* ocspReqBuf = NULL;
|
2013-01-04 05:19:56 +04:00
|
|
|
int ocspReqSz = 2048;
|
2012-06-01 04:29:32 +04:00
|
|
|
byte* ocspRespBuf = NULL;
|
|
|
|
OcspRequest ocspRequest;
|
|
|
|
OcspResponse ocspResponse;
|
2014-02-01 04:59:13 +04:00
|
|
|
int result = -1;
|
2012-06-01 04:29:32 +04:00
|
|
|
OCSP_Entry* ocspe;
|
2014-02-01 04:59:13 +04:00
|
|
|
CertStatus* certStatus = NULL;
|
|
|
|
CertStatus newStatus;
|
2013-01-04 05:19:56 +04:00
|
|
|
const char *url;
|
|
|
|
int urlSz;
|
2012-06-01 04:29:32 +04:00
|
|
|
|
2013-12-28 00:11:47 +04:00
|
|
|
CYASSL_ENTER("CheckCertOCSP");
|
2012-06-01 04:29:32 +04:00
|
|
|
|
2014-02-01 04:59:13 +04:00
|
|
|
if (LockMutex(&ocsp->ocspLock) != 0) {
|
|
|
|
CYASSL_LEAVE("CheckCertOCSP", BAD_MUTEX_E);
|
|
|
|
return BAD_MUTEX_E;
|
2012-06-01 04:29:32 +04:00
|
|
|
}
|
|
|
|
|
2014-02-01 04:59:13 +04:00
|
|
|
ocspe = ocsp->ocspList;
|
|
|
|
while (ocspe) {
|
|
|
|
if (XMEMCMP(ocspe->issuerHash, cert->issuerHash, SHA_DIGEST_SIZE) == 0
|
|
|
|
&& XMEMCMP(ocspe->issuerKeyHash, cert->issuerKeyHash,
|
|
|
|
SHA_DIGEST_SIZE) == 0)
|
|
|
|
break;
|
|
|
|
else
|
|
|
|
ocspe = ocspe->next;
|
2012-06-01 04:29:32 +04:00
|
|
|
}
|
|
|
|
|
2014-02-01 04:59:13 +04:00
|
|
|
if (ocspe == NULL) {
|
|
|
|
ocspe = (OCSP_Entry*)XMALLOC(sizeof(OCSP_Entry),
|
|
|
|
NULL, DYNAMIC_TYPE_OCSP_ENTRY);
|
|
|
|
if (ocspe != NULL) {
|
|
|
|
InitOCSP_Entry(ocspe, cert);
|
|
|
|
ocspe->next = ocsp->ocspList;
|
|
|
|
ocsp->ocspList = ocspe;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
UnLockMutex(&ocsp->ocspLock);
|
|
|
|
CYASSL_LEAVE("CheckCertOCSP", MEMORY_ERROR);
|
|
|
|
return MEMORY_ERROR;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
certStatus = ocspe->status;
|
|
|
|
while (certStatus) {
|
|
|
|
if (certStatus->serialSz == cert->serialSz &&
|
|
|
|
XMEMCMP(certStatus->serial, cert->serial, cert->serialSz) == 0)
|
|
|
|
break;
|
|
|
|
else
|
|
|
|
certStatus = certStatus->next;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (certStatus != NULL) {
|
2012-06-01 22:57:03 +04:00
|
|
|
if (!ValidateDate(certStatus->thisDate,
|
|
|
|
certStatus->thisDateFormat, BEFORE) ||
|
|
|
|
(certStatus->nextDate[0] == 0) ||
|
|
|
|
!ValidateDate(certStatus->nextDate,
|
2014-02-01 04:59:13 +04:00
|
|
|
certStatus->nextDateFormat, AFTER)) {
|
2012-06-01 22:57:03 +04:00
|
|
|
CYASSL_MSG("\tinvalid status date, looking up cert");
|
|
|
|
}
|
2014-02-01 04:59:13 +04:00
|
|
|
else {
|
2012-06-01 22:57:03 +04:00
|
|
|
result = xstat2err(certStatus->status);
|
2014-02-01 04:59:13 +04:00
|
|
|
UnLockMutex(&ocsp->ocspLock);
|
|
|
|
CYASSL_LEAVE("CheckCertOCSP", result);
|
2012-06-01 22:57:03 +04:00
|
|
|
return result;
|
|
|
|
}
|
2012-06-01 04:29:32 +04:00
|
|
|
}
|
2013-01-04 05:19:56 +04:00
|
|
|
|
2014-02-01 04:59:13 +04:00
|
|
|
UnLockMutex(&ocsp->ocspLock);
|
|
|
|
|
2013-12-28 00:11:47 +04:00
|
|
|
if (ocsp->cm->ocspUseOverrideURL) {
|
|
|
|
url = ocsp->cm->ocspOverrideURL;
|
|
|
|
if (url != NULL && url[0] != '\0')
|
2013-01-04 05:19:56 +04:00
|
|
|
urlSz = (int)XSTRLEN(url);
|
|
|
|
else
|
|
|
|
return OCSP_NEED_URL;
|
|
|
|
}
|
2013-06-20 22:07:54 +04:00
|
|
|
else if (cert->extAuthInfoSz != 0 && cert->extAuthInfo != NULL) {
|
2013-01-04 05:19:56 +04:00
|
|
|
url = (const char *)cert->extAuthInfo;
|
|
|
|
urlSz = cert->extAuthInfoSz;
|
|
|
|
}
|
2013-05-25 04:23:07 +04:00
|
|
|
else {
|
2014-02-01 04:59:13 +04:00
|
|
|
/* cert doesn't have extAuthInfo, assuming CERT_GOOD */
|
2013-05-25 04:23:07 +04:00
|
|
|
return 0;
|
|
|
|
}
|
2013-01-04 05:19:56 +04:00
|
|
|
|
2012-12-20 06:09:05 +04:00
|
|
|
ocspReqBuf = (byte*)XMALLOC(ocspReqSz, NULL, DYNAMIC_TYPE_IN_BUFFER);
|
|
|
|
if (ocspReqBuf == NULL) {
|
2014-02-01 04:59:13 +04:00
|
|
|
CYASSL_LEAVE("CheckCertOCSP", MEMORY_ERROR);
|
2012-12-20 06:09:05 +04:00
|
|
|
return MEMORY_ERROR;
|
|
|
|
}
|
2013-12-28 00:11:47 +04:00
|
|
|
InitOcspRequest(&ocspRequest, cert, ocsp->cm->ocspSendNonce,
|
|
|
|
ocspReqBuf, ocspReqSz);
|
2012-06-01 04:29:32 +04:00
|
|
|
ocspReqSz = EncodeOcspRequest(&ocspRequest);
|
2013-01-04 05:19:56 +04:00
|
|
|
|
2014-02-01 04:59:13 +04:00
|
|
|
if (ocsp->cm->ocspIOCb)
|
2013-12-28 00:11:47 +04:00
|
|
|
result = ocsp->cm->ocspIOCb(ocsp->cm->ocspIOCtx, url, urlSz,
|
2014-02-01 04:59:13 +04:00
|
|
|
ocspReqBuf, ocspReqSz, &ocspRespBuf);
|
2013-01-04 05:19:56 +04:00
|
|
|
|
2013-02-21 03:26:22 +04:00
|
|
|
if (result >= 0 && ocspRespBuf) {
|
2014-02-01 04:59:13 +04:00
|
|
|
XMEMSET(&newStatus, 0, sizeof(CertStatus));
|
|
|
|
|
|
|
|
InitOcspResponse(&ocspResponse, &newStatus, ocspRespBuf, result);
|
2012-12-20 06:09:05 +04:00
|
|
|
OcspResponseDecode(&ocspResponse);
|
|
|
|
|
2014-02-01 04:59:13 +04:00
|
|
|
if (ocspResponse.responseStatus != OCSP_SUCCESSFUL)
|
2012-06-01 04:29:32 +04:00
|
|
|
result = OCSP_LOOKUP_FAIL;
|
2014-02-01 04:59:13 +04:00
|
|
|
else {
|
|
|
|
if (CompareOcspReqResp(&ocspRequest, &ocspResponse) == 0) {
|
2012-12-20 06:09:05 +04:00
|
|
|
result = xstat2err(ocspResponse.status->status);
|
2014-02-01 04:59:13 +04:00
|
|
|
|
|
|
|
if (LockMutex(&ocsp->ocspLock) != 0)
|
|
|
|
result = BAD_MUTEX_E;
|
|
|
|
else {
|
|
|
|
if (certStatus != NULL)
|
|
|
|
/* Replace existing certificate entry with updated */
|
|
|
|
XMEMCPY(certStatus, &newStatus, sizeof(CertStatus));
|
|
|
|
else {
|
|
|
|
/* Save new certificate entry */
|
|
|
|
certStatus = (CertStatus*)XMALLOC(sizeof(CertStatus),
|
|
|
|
NULL, DYNAMIC_TYPE_OCSP_STATUS);
|
|
|
|
if (certStatus != NULL) {
|
|
|
|
XMEMCPY(certStatus, &newStatus, sizeof(CertStatus));
|
|
|
|
certStatus->next = ocspe->status;
|
|
|
|
ocspe->status = certStatus;
|
|
|
|
ocspe->totalStatus++;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
UnLockMutex(&ocsp->ocspLock);
|
|
|
|
}
|
2012-12-20 06:09:05 +04:00
|
|
|
}
|
|
|
|
else
|
|
|
|
result = OCSP_LOOKUP_FAIL;
|
2012-06-01 04:29:32 +04:00
|
|
|
}
|
|
|
|
}
|
2014-02-01 04:59:13 +04:00
|
|
|
else
|
2013-01-05 01:13:20 +04:00
|
|
|
result = OCSP_LOOKUP_FAIL;
|
|
|
|
|
2014-02-01 04:59:13 +04:00
|
|
|
if (ocspReqBuf != NULL)
|
2012-12-20 06:09:05 +04:00
|
|
|
XFREE(ocspReqBuf, NULL, DYNAMIC_TYPE_IN_BUFFER);
|
2014-02-01 04:59:13 +04:00
|
|
|
|
|
|
|
if (ocspRespBuf != NULL && ocsp->cm->ocspRespFreeCb)
|
2013-12-28 00:11:47 +04:00
|
|
|
ocsp->cm->ocspRespFreeCb(ocsp->cm->ocspIOCtx, ocspRespBuf);
|
2012-05-06 10:38:28 +04:00
|
|
|
|
2014-02-01 04:59:13 +04:00
|
|
|
CYASSL_LEAVE("CheckCertOCSP", result);
|
2012-05-08 04:19:52 +04:00
|
|
|
return result;
|
2012-05-03 01:45:30 +04:00
|
|
|
}
|
2012-04-13 20:39:19 +04:00
|
|
|
|
|
|
|
|
2014-02-01 04:59:13 +04:00
|
|
|
#else /* HAVE_OCSP */
|
|
|
|
|
|
|
|
|
|
|
|
#ifdef _MSC_VER
|
|
|
|
/* 4206 warning for blank file */
|
|
|
|
#pragma warning(disable: 4206)
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
2012-04-13 20:39:19 +04:00
|
|
|
#endif /* HAVE_OCSP */
|
|
|
|
|