Latest update.
This commit is contained in:
+80
-53
@@ -115,7 +115,7 @@ static int acfd = (int) INVALID_SOCKET;
|
||||
static int index_changed(CA_DB *);
|
||||
static void spawn_loop(void);
|
||||
static int print_syslog(const char *str, size_t len, void *levPtr);
|
||||
static void sock_timeout(int signum);
|
||||
static void socket_timeout(int signum);
|
||||
# endif
|
||||
|
||||
# ifndef OPENSSL_NO_SOCK
|
||||
@@ -134,11 +134,13 @@ typedef enum OPTION_choice {
|
||||
OPT_NO_CERT_CHECKS, OPT_NO_EXPLICIT, OPT_TRUST_OTHER,
|
||||
OPT_NO_INTERN, OPT_BADSIG, OPT_TEXT, OPT_REQ_TEXT, OPT_RESP_TEXT,
|
||||
OPT_REQIN, OPT_RESPIN, OPT_SIGNER, OPT_VAFILE, OPT_SIGN_OTHER,
|
||||
OPT_VERIFY_OTHER, OPT_CAFILE, OPT_CAPATH, OPT_NOCAFILE, OPT_NOCAPATH,
|
||||
OPT_VERIFY_OTHER, OPT_CAFILE, OPT_CAPATH, OPT_CASTORE, OPT_NOCAFILE,
|
||||
OPT_NOCAPATH, OPT_NOCASTORE,
|
||||
OPT_VALIDITY_PERIOD, OPT_STATUS_AGE, OPT_SIGNKEY, OPT_REQOUT,
|
||||
OPT_RESPOUT, OPT_PATH, OPT_ISSUER, OPT_CERT, OPT_SERIAL,
|
||||
OPT_INDEX, OPT_CA, OPT_NMIN, OPT_REQUEST, OPT_NDAYS, OPT_RSIGNER,
|
||||
OPT_RKEY, OPT_ROTHER, OPT_RMD, OPT_RSIGOPT, OPT_HEADER,
|
||||
OPT_PASSIN,
|
||||
OPT_RCID,
|
||||
OPT_V_ENUM,
|
||||
OPT_MD,
|
||||
@@ -146,31 +148,70 @@ typedef enum OPTION_choice {
|
||||
} OPTION_CHOICE;
|
||||
|
||||
const OPTIONS ocsp_options[] = {
|
||||
OPT_SECTION("General"),
|
||||
{"help", OPT_HELP, '-', "Display this summary"},
|
||||
{"out", OPT_OUTFILE, '>', "Output filename"},
|
||||
{"timeout", OPT_TIMEOUT, 'p',
|
||||
"Connection timeout (in seconds) to the OCSP responder"},
|
||||
{"url", OPT_URL, 's', "Responder URL"},
|
||||
{"host", OPT_HOST, 's', "TCP/IP hostname:port to connect to"},
|
||||
{"port", OPT_PORT, 'p', "Port to run responder on"},
|
||||
{"ignore_err", OPT_IGNORE_ERR, '-',
|
||||
"Ignore error on OCSP request or response and continue running"},
|
||||
{"noverify", OPT_NOVERIFY, '-', "Don't verify response at all"},
|
||||
{"nonce", OPT_NONCE, '-', "Add OCSP nonce to request"},
|
||||
{"no_nonce", OPT_NO_NONCE, '-', "Don't add OCSP nonce to request"},
|
||||
{"CAfile", OPT_CAFILE, '<', "Trusted certificates file"},
|
||||
{"CApath", OPT_CAPATH, '<', "Trusted certificates directory"},
|
||||
{"CAstore", OPT_CASTORE, ':', "Trusted certificates store URI"},
|
||||
{"no-CAfile", OPT_NOCAFILE, '-',
|
||||
"Do not load the default certificates file"},
|
||||
{"no-CApath", OPT_NOCAPATH, '-',
|
||||
"Do not load certificates from the default certificates directory"},
|
||||
{"no-CAstore", OPT_NOCAPATH, '-',
|
||||
"Do not load certificates from the default certificates store"},
|
||||
|
||||
OPT_SECTION("Responder"),
|
||||
{"timeout", OPT_TIMEOUT, 'p',
|
||||
"Connection timeout (in seconds) to the OCSP responder"},
|
||||
{"resp_no_certs", OPT_RESP_NO_CERTS, '-',
|
||||
"Don't include any certificates in response"},
|
||||
{"resp_key_id", OPT_RESP_KEY_ID, '-',
|
||||
"Identify response by signing certificate key ID"},
|
||||
# ifdef OCSP_DAEMON
|
||||
{"multi", OPT_MULTI, 'p', "run multiple responder processes"},
|
||||
# endif
|
||||
{"no_certs", OPT_NO_CERTS, '-',
|
||||
"Don't include any certificates in signed request"},
|
||||
{"badsig", OPT_BADSIG, '-',
|
||||
"Corrupt last byte of loaded OSCP response signature (for test)"},
|
||||
{"CA", OPT_CA, '<', "CA certificate"},
|
||||
{"nmin", OPT_NMIN, 'p', "Number of minutes before next update"},
|
||||
{"nrequest", OPT_REQUEST, 'p',
|
||||
"Number of requests to accept (default unlimited)"},
|
||||
{"reqin", OPT_REQIN, 's', "File with the DER-encoded request"},
|
||||
{"signer", OPT_SIGNER, '<', "Certificate to sign OCSP request with"},
|
||||
{"sign_other", OPT_SIGN_OTHER, '<',
|
||||
"Additional certificates to include in signed request"},
|
||||
{"index", OPT_INDEX, '<', "Certificate status index file"},
|
||||
{"ndays", OPT_NDAYS, 'p', "Number of days before next update"},
|
||||
{"rsigner", OPT_RSIGNER, '<',
|
||||
"Responder certificate to sign responses with"},
|
||||
{"rkey", OPT_RKEY, '<', "Responder key to sign responses with"},
|
||||
{"passin", OPT_PASSIN, 's', "Responder key pass phrase source"},
|
||||
{"rother", OPT_ROTHER, '<', "Other certificates to include in response"},
|
||||
{"rmd", OPT_RMD, 's', "Digest Algorithm to use in signature of OCSP response"},
|
||||
{"rsigopt", OPT_RSIGOPT, 's', "OCSP response signature parameter in n:v form"},
|
||||
{"header", OPT_HEADER, 's', "key=value header to add"},
|
||||
{"rcid", OPT_RCID, 's', "Use specified algorithm for cert id in response"},
|
||||
{"", OPT_MD, '-', "Any supported digest algorithm (sha1,sha256, ... )"},
|
||||
|
||||
OPT_SECTION("Client"),
|
||||
{"url", OPT_URL, 's', "Responder URL"},
|
||||
{"host", OPT_HOST, 's', "TCP/IP hostname:port to connect to"},
|
||||
{"port", OPT_PORT, 'p', "Port to run responder on"},
|
||||
{"out", OPT_OUTFILE, '>', "Output filename"},
|
||||
{"noverify", OPT_NOVERIFY, '-', "Don't verify response at all"},
|
||||
{"nonce", OPT_NONCE, '-', "Add OCSP nonce to request"},
|
||||
{"no_nonce", OPT_NO_NONCE, '-', "Don't add OCSP nonce to request"},
|
||||
{"no_signature_verify", OPT_NO_SIGNATURE_VERIFY, '-',
|
||||
"Don't check signature on response"},
|
||||
{"resp_key_id", OPT_RESP_KEY_ID, '-',
|
||||
"Identify response by signing certificate key ID"},
|
||||
{"no_cert_verify", OPT_NO_CERT_VERIFY, '-',
|
||||
"Don't check signing certificate"},
|
||||
{"text", OPT_TEXT, '-', "Print text form of request and response"},
|
||||
{"req_text", OPT_REQ_TEXT, '-', "Print text form of request"},
|
||||
{"resp_text", OPT_RESP_TEXT, '-', "Print text form of response"},
|
||||
{"no_chain", OPT_NO_CHAIN, '-', "Don't chain verify response"},
|
||||
{"no_cert_checks", OPT_NO_CERT_CHECKS, '-',
|
||||
"Don't do additional checks on signing certificate"},
|
||||
@@ -180,50 +221,21 @@ const OPTIONS ocsp_options[] = {
|
||||
"Don't verify additional certificates"},
|
||||
{"no_intern", OPT_NO_INTERN, '-',
|
||||
"Don't search certificates contained in response for signer"},
|
||||
{"badsig", OPT_BADSIG, '-',
|
||||
"Corrupt last byte of loaded OSCP response signature (for test)"},
|
||||
{"text", OPT_TEXT, '-', "Print text form of request and response"},
|
||||
{"req_text", OPT_REQ_TEXT, '-', "Print text form of request"},
|
||||
{"resp_text", OPT_RESP_TEXT, '-', "Print text form of response"},
|
||||
{"reqin", OPT_REQIN, 's', "File with the DER-encoded request"},
|
||||
{"respin", OPT_RESPIN, 's', "File with the DER-encoded response"},
|
||||
{"signer", OPT_SIGNER, '<', "Certificate to sign OCSP request with"},
|
||||
{"VAfile", OPT_VAFILE, '<', "Validator certificates file"},
|
||||
{"sign_other", OPT_SIGN_OTHER, '<',
|
||||
"Additional certificates to include in signed request"},
|
||||
{"verify_other", OPT_VERIFY_OTHER, '<',
|
||||
"Additional certificates to search for signer"},
|
||||
{"CAfile", OPT_CAFILE, '<', "Trusted certificates file"},
|
||||
{"CApath", OPT_CAPATH, '<', "Trusted certificates directory"},
|
||||
{"no-CAfile", OPT_NOCAFILE, '-',
|
||||
"Do not load the default certificates file"},
|
||||
{"no-CApath", OPT_NOCAPATH, '-',
|
||||
"Do not load certificates from the default certificates directory"},
|
||||
{"path", OPT_PATH, 's', "Path to use in OCSP request"},
|
||||
{"cert", OPT_CERT, '<', "Certificate to check"},
|
||||
{"serial", OPT_SERIAL, 's', "Serial number to check"},
|
||||
{"validity_period", OPT_VALIDITY_PERIOD, 'u',
|
||||
"Maximum validity discrepancy in seconds"},
|
||||
{"status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds"},
|
||||
{"signkey", OPT_SIGNKEY, 's', "Private key to sign OCSP request with"},
|
||||
{"reqout", OPT_REQOUT, 's', "Output file for the DER-encoded request"},
|
||||
{"respout", OPT_RESPOUT, 's', "Output file for the DER-encoded response"},
|
||||
{"path", OPT_PATH, 's', "Path to use in OCSP request"},
|
||||
{"issuer", OPT_ISSUER, '<', "Issuer certificate"},
|
||||
{"cert", OPT_CERT, '<', "Certificate to check"},
|
||||
{"serial", OPT_SERIAL, 's', "Serial number to check"},
|
||||
{"index", OPT_INDEX, '<', "Certificate status index file"},
|
||||
{"CA", OPT_CA, '<', "CA certificate"},
|
||||
{"nmin", OPT_NMIN, 'p', "Number of minutes before next update"},
|
||||
{"nrequest", OPT_REQUEST, 'p',
|
||||
"Number of requests to accept (default unlimited)"},
|
||||
{"ndays", OPT_NDAYS, 'p', "Number of days before next update"},
|
||||
{"rsigner", OPT_RSIGNER, '<',
|
||||
"Responder certificate to sign responses with"},
|
||||
{"rkey", OPT_RKEY, '<', "Responder key to sign responses with"},
|
||||
{"rother", OPT_ROTHER, '<', "Other certificates to include in response"},
|
||||
{"rmd", OPT_RMD, 's', "Digest Algorithm to use in signature of OCSP response"},
|
||||
{"rsigopt", OPT_RSIGOPT, 's', "OCSP response signature parameter in n:v form"},
|
||||
{"header", OPT_HEADER, 's', "key=value header to add"},
|
||||
{"rcid", OPT_RCID, 's', "Use specified algorithm for cert id in response"},
|
||||
{"", OPT_MD, '-', "Any supported digest algorithm (sha1,sha256, ... )"},
|
||||
{"status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds"},
|
||||
|
||||
OPT_V_OPTIONS,
|
||||
{NULL}
|
||||
};
|
||||
@@ -250,16 +262,17 @@ int ocsp_main(int argc, char **argv)
|
||||
X509 *signer = NULL, *rsigner = NULL;
|
||||
X509_STORE *store = NULL;
|
||||
X509_VERIFY_PARAM *vpm = NULL;
|
||||
const char *CAfile = NULL, *CApath = NULL;
|
||||
const char *CAfile = NULL, *CApath = NULL, *CAstore = NULL;
|
||||
char *header, *value;
|
||||
char *host = NULL, *port = NULL, *path = "/", *outfile = NULL;
|
||||
char *rca_filename = NULL, *reqin = NULL, *respin = NULL;
|
||||
char *reqout = NULL, *respout = NULL, *ridx_filename = NULL;
|
||||
char *rsignfile = NULL, *rkeyfile = NULL;
|
||||
char *passinarg = NULL, *passin = NULL;
|
||||
char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
|
||||
char *signfile = NULL, *keyfile = NULL;
|
||||
char *thost = NULL, *tport = NULL, *tpath = NULL;
|
||||
int noCAfile = 0, noCApath = 0;
|
||||
int noCAfile = 0, noCApath = 0, noCAstore = 0;
|
||||
int accept_count = -1, add_nonce = 1, noverify = 0, use_ssl = -1;
|
||||
int vpmtouched = 0, badsig = 0, i, ignore_err = 0, nmin = 0, ndays = -1;
|
||||
int req_text = 0, resp_text = 0, ret = 1;
|
||||
@@ -395,12 +408,18 @@ int ocsp_main(int argc, char **argv)
|
||||
case OPT_CAPATH:
|
||||
CApath = opt_arg();
|
||||
break;
|
||||
case OPT_CASTORE:
|
||||
CAstore = opt_arg();
|
||||
break;
|
||||
case OPT_NOCAFILE:
|
||||
noCAfile = 1;
|
||||
break;
|
||||
case OPT_NOCAPATH:
|
||||
noCApath = 1;
|
||||
break;
|
||||
case OPT_NOCASTORE:
|
||||
noCAstore = 1;
|
||||
break;
|
||||
case OPT_V_CASES:
|
||||
if (!opt_verify(o, vpm))
|
||||
goto end;
|
||||
@@ -479,6 +498,9 @@ int ocsp_main(int argc, char **argv)
|
||||
case OPT_RKEY:
|
||||
rkeyfile = opt_arg();
|
||||
break;
|
||||
case OPT_PASSIN:
|
||||
passinarg = opt_arg();
|
||||
break;
|
||||
case OPT_ROTHER:
|
||||
rcertfile = opt_arg();
|
||||
break;
|
||||
@@ -581,7 +603,11 @@ int ocsp_main(int argc, char **argv)
|
||||
"responder other certificates"))
|
||||
goto end;
|
||||
}
|
||||
rkey = load_key(rkeyfile, FORMAT_PEM, 0, NULL, NULL,
|
||||
if (!app_passwd(passinarg, NULL, &passin, NULL)) {
|
||||
BIO_printf(bio_err, "Error getting password\n");
|
||||
goto end;
|
||||
}
|
||||
rkey = load_key(rkeyfile, FORMAT_PEM, 0, passin, NULL,
|
||||
"responder private key");
|
||||
if (rkey == NULL)
|
||||
goto end;
|
||||
@@ -606,7 +632,7 @@ int ocsp_main(int argc, char **argv)
|
||||
if (multi && acbio != NULL)
|
||||
spawn_loop();
|
||||
if (acbio != NULL && req_timeout > 0)
|
||||
signal(SIGALRM, sock_timeout);
|
||||
signal(SIGALRM, socket_timeout);
|
||||
#endif
|
||||
|
||||
if (acbio != NULL)
|
||||
@@ -765,7 +791,8 @@ redo_accept:
|
||||
}
|
||||
|
||||
if (store == NULL) {
|
||||
store = setup_verify(CAfile, CApath, noCAfile, noCApath);
|
||||
store = setup_verify(CAfile, noCAfile, CApath, noCApath,
|
||||
CAstore, noCAstore);
|
||||
if (!store)
|
||||
goto end;
|
||||
}
|
||||
@@ -1372,7 +1399,7 @@ static int urldecode(char *p)
|
||||
# endif
|
||||
|
||||
# ifdef OCSP_DAEMON
|
||||
static void sock_timeout(int signum)
|
||||
static void socket_timeout(int signum)
|
||||
{
|
||||
if (acfd != (int)INVALID_SOCKET)
|
||||
(void)shutdown(acfd, SHUT_RD);
|
||||
|
||||
Reference in New Issue
Block a user