Allow various options to be included for signing and verify of

OCSP responses.

Documentation to follow...

Urgh.. this conflicted with the -VAfile patch I hope I haven't
broken it.

diff --git a/CHANGES b/CHANGES
index 4c59e64dbfc7029575581f2c2da93a83b66701d4..c67a1864f8f0d0f4877301a8e9d1de64e7f0f337 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,10 @@
 
  Changes between 0.9.6 and 0.9.7  [xx XXX 2000]
 
+  *) Additional options to ocsp utility to allow flags to be set and
+     additional certificates supplied.
+     [Steve Henson]
+
   *) Add the option -VAfile to 'openssl ocsp', so the user can give the
      OCSP client a number of certificate to only verify the response
      signature against.

diff --git a/apps/ocsp.c b/apps/ocsp.c
index 1ea4f9d2ef09b748b3a0c52f47f40b162ac11c8c..8eaf1f7644bd38babfea264c990ab4f01bda0262 100644 (file)
--- a/apps/ocsp.c
+++ b/apps/ocsp.c
@@ -94,9 +94,10 @@ int MAIN(int argc, char **argv)
        BIO *out = NULL;
        int req_text = 0, resp_text = 0;
        char *CAfile = NULL, *CApath = NULL;
-        char *VAfile = NULL;
        X509_STORE *store = NULL;
-        STACK_OF(X509) *VAstore = NULL;
+       STACK_OF(X509) *sign_other = NULL, *verify_other = NULL;
+       char *sign_certfile = NULL, *verify_certfile = NULL;
+       unsigned long sign_flags = 0, verify_flags = 0;
        int ret = 1;
        int badarg = 0;
        int i;
@@ -133,6 +134,22 @@ int MAIN(int argc, char **argv)
                        add_nonce = 2;
                else if (!strcmp(*args, "-no_nonce"))
                        add_nonce = 0;
+               else if (!strcmp(*args, "-no_certs"))
+                       sign_flags |= OCSP_NOCERTS;
+               else if (!strcmp(*args, "-no_signature_verify"))
+                       verify_flags |= OCSP_NOSIGS;
+               else if (!strcmp(*args, "-no_cert_verify"))
+                       verify_flags |= OCSP_NOVERIFY;
+               else if (!strcmp(*args, "-no_chain"))
+                       verify_flags |= OCSP_NOCHAIN;
+               else if (!strcmp(*args, "-no_cert_checks"))
+                       verify_flags |= OCSP_NOCHECKS;
+               else if (!strcmp(*args, "-no_explicit"))
+                       verify_flags |= OCSP_NOEXPLICIT;
+               else if (!strcmp(*args, "-trust_other"))
+                       verify_flags |= OCSP_TRUSTOTHER;
+               else if (!strcmp(*args, "-no_intern"))
+                       verify_flags |= OCSP_NOINTERN;
                else if (!strcmp(*args, "-text"))
                        {
                        req_text = 1;
@@ -174,7 +191,26 @@ int MAIN(int argc, char **argv)
                        if (args[1])
                                {
                                args++;
-                               VAfile = *args;
+                               verify_certfile = *args;
+                               verify_flags |= OCSP_TRUSTOTHER;
+                               }
+                       else badarg = 1;
+                       }
+               else if (!strcmp(*args, "-sign_other"))
+                       {
+                       if (args[1])
+                               {
+                               args++;
+                               sign_certfile = *args;
+                               }
+                       else badarg = 1;
+                       }
+               else if (!strcmp(*args, "-verify_other"))
+                       {
+                       if (args[1])
+                               {
+                               args++;
+                               verify_certfile = *args;
                                }
                        else badarg = 1;
                        }
@@ -282,27 +318,36 @@ int MAIN(int argc, char **argv)
                BIO_printf (bio_err, "OCSP utility\n");
                BIO_printf (bio_err, "Usage ocsp [options]\n");
                BIO_printf (bio_err, "where options are\n");
-               BIO_printf (bio_err, "-out file     output filename\n");
-               BIO_printf (bio_err, "-issuer file  issuer certificate\n");
-               BIO_printf (bio_err, "-cert file    certificate to check\n");
-               BIO_printf (bio_err, "-serial n     serial number to check\n");
-               BIO_printf (bio_err, "-signer file  certificate to sign OCSP request with\n");
-               BIO_printf (bio_err, "-signkey file private key to sign OCSP request with\n");
-               BIO_printf (bio_err, "-req_text     print text form of request\n");
-               BIO_printf (bio_err, "-resp_text    print text form of response\n");
-               BIO_printf (bio_err, "-text         print text form of request and response\n");
-               BIO_printf (bio_err, "-reqout file  write DER encoded OCSP request to \"file\"\n");
-               BIO_printf (bio_err, "-respout file write DER encoded OCSP reponse to \"file\"\n");
-               BIO_printf (bio_err, "-reqin file   read DER encoded OCSP request from \"file\"\n");
-               BIO_printf (bio_err, "-respin file  read DER encoded OCSP reponse from \"file\"\n");
-               BIO_printf (bio_err, "-nonce        add OCSP nonce to request\n");
-               BIO_printf (bio_err, "-no_nonce     don't add OCSP nonce to request\n");
-               BIO_printf (bio_err, "-host host:n  send OCSP request to host on port n\n");
-               BIO_printf (bio_err, "-path         path to use in OCSP request\n");
-               BIO_printf (bio_err, "-CApath dir   trusted certificates directory\n");
-               BIO_printf (bio_err, "-CAfile file  trusted certificates file\n");
-               BIO_printf (bio_err, "-VAfile file  validator certificates file\n");
-               BIO_printf (bio_err, "-noverify     don't verify response\n");
+               BIO_printf (bio_err, "-out file          output filename\n");
+               BIO_printf (bio_err, "-issuer file       issuer certificate\n");
+               BIO_printf (bio_err, "-cert file         certificate to check\n");
+               BIO_printf (bio_err, "-serial n          serial number to check\n");
+               BIO_printf (bio_err, "-signer file       certificate to sign OCSP request with\n");
+               BIO_printf (bio_err, "-signkey file      private key to sign OCSP request with\n");
+               BIO_printf (bio_err, "-sign_certs file   additional certificates to include in signed request");
+               BIO_printf (bio_err, "-no_certs          don't include any certificates in signed request");
+               BIO_printf (bio_err, "-req_text          print text form of request\n");
+               BIO_printf (bio_err, "-resp_text         print text form of response\n");
+               BIO_printf (bio_err, "-text              print text form of request and response\n");
+               BIO_printf (bio_err, "-reqout file       write DER encoded OCSP request to \"file\"\n");
+               BIO_printf (bio_err, "-respout file      write DER encoded OCSP reponse to \"file\"\n");
+               BIO_printf (bio_err, "-reqin file        read DER encoded OCSP request from \"file\"\n");
+               BIO_printf (bio_err, "-respin file       read DER encoded OCSP reponse from \"file\"\n");
+               BIO_printf (bio_err, "-nonce             add OCSP nonce to request\n");
+               BIO_printf (bio_err, "-no_nonce          don't add OCSP nonce to request\n");
+               BIO_printf (bio_err, "-host host:n       send OCSP request to host on port n\n");
+               BIO_printf (bio_err, "-path              path to use in OCSP request\n");
+               BIO_printf (bio_err, "-CApath dir        trusted certificates directory\n");
+               BIO_printf (bio_err, "-CAfile file       trusted certificates file\n");
+               BIO_printf (bio_err, "-VAfile file       validator certificates file\n");
+               BIO_printf (bio_err, "-noverify          don't verify response at all\n");
+               BIO_printf (bio_err, "-verify_certs file additional certificates to search for signer");
+               BIO_printf (bio_err, "-trust_other       don't verify additional certificates");
+               BIO_printf (bio_err, "-no_intern         don't search certificates contained in response for signer");
+               BIO_printf (bio_err, "-no_sig_verify     don't check signature on response");
+               BIO_printf (bio_err, "-no_cert_verify    don't check signing certificate");
+               BIO_printf (bio_err, "-no_chain          don't chain verify response");
+               BIO_printf (bio_err, "-no_cert_checks    don't do additional checks on signing certificate");
                goto end;
                }
 
@@ -351,13 +396,18 @@ int MAIN(int argc, char **argv)
                        BIO_printf(bio_err, "Error loading signer certificate\n");
                        goto end;
                        }
+               if (sign_certfile)
+                       {
+                       sign_other = load_certs(bio_err, sign_certfile, FORMAT_PEM);
+                       if (!sign_other) goto end;
+                       }
                key = load_key(bio_err, keyfile, FORMAT_PEM, NULL, NULL);
                if (!key)
                        {
                        BIO_printf(bio_err, "Error loading signer private key\n");
                        goto end;
                        }
-               if (!OCSP_request_sign(req, signer, key, EVP_sha1(), NULL, 0))
+               if (!OCSP_request_sign(req, signer, key, EVP_sha1(), sign_other, sign_flags))
                        {
                        BIO_printf(bio_err, "Error signing OCSP request\n");
                        goto end;
@@ -449,8 +499,11 @@ int MAIN(int argc, char **argv)
 
        store = setup_verify(bio_err, CAfile, CApath);
        if(!store) goto end;
-
-        if (VAfile) VAstore = load_certs(bio_err, VAfile, FORMAT_PEM);
+       if (verify_certfile)
+               {
+               verify_other = load_certs(bio_err, verify_certfile, FORMAT_PEM);
+               if (!verify_other) goto end;
+               }
 
        bs = OCSP_response_get1_basic(resp);
 
@@ -468,7 +521,7 @@ int MAIN(int argc, char **argv)
                        goto end;
                        }
 
-               i = OCSP_basic_verify(bs, VAstore, store, OCSP_TRUSTOTHER);
+               i = OCSP_basic_verify(bs, verify_other, store, verify_flags);
                 if (i < 0) i = OCSP_basic_verify(bs, NULL, store, 0);
 
                if(i <= 0)
@@ -490,7 +543,6 @@ end:
        ERR_print_errors(bio_err);
        X509_free(signer);
        X509_STORE_free(store);
-        sk_X509_free(VAstore);
        EVP_PKEY_free(key);
        X509_free(issuer);
        X509_free(cert);
@@ -501,6 +553,8 @@ end:
        OCSP_BASICRESP_free(bs);
        sk_free(reqnames);
        sk_OCSP_CERTID_free(ids);
+       sk_X509_pop_free(sign_other, X509_free);
+       sk_X509_pop_free(verify_other, X509_free);
 
        EXIT(ret);
 }