PR: 2064, 728 (0c690586) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

CHANGES

+4 −0

Original line number	Diff line number	Diff line
		@@ -4,6 +4,10 @@

		Changes between 0.9.8k and 1.0 [xx XXX xxxx]

		*) Update OCSP request code to permit adding custom headers to the request:
		some responders need this.
		[Steve Henson]

		*) The function EVP_PKEY_sign() returns <=0 on error: check return code
		correctly.
		[Julia Lawall <julia@diku.dk>]

apps/apps.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -259,6 +259,7 @@ ENGINE setup_engine(BIO err, const char *engine, int debug);
		#ifndef OPENSSL_NO_OCSP
		OCSP_RESPONSE process_responder(BIO err, OCSP_REQUEST *req,
		char host, char path, char *port, int use_ssl,
		STACK_OF(CONF_VALUE) *headers,
		int req_timeout);
		#endif

apps/ocsp.c

+34 −8

Original line number	Diff line number	Diff line
		@@ -75,6 +75,7 @@
		#include <openssl/ssl.h>
		#include <openssl/evp.h>
		#include <openssl/bn.h>
		#include <openssl/x509v3.h>

		#if defined(NETWARE_CLIB)
		# ifdef NETWARE_BSDSOCK
		@@ -113,6 +114,7 @@ static BIO init_responder(char port);
		static int do_responder(OCSP_REQUEST preq, BIO pcbio, BIO acbio, char port);
		static int send_ocsp_response(BIO cbio, OCSP_RESPONSE resp);
		static OCSP_RESPONSE query_responder(BIO err, BIO cbio, char path,
		STACK_OF(CONF_VALUE) *headers,
		OCSP_REQUEST *req, int req_timeout);

		#undef PROG
		@@ -131,6 +133,7 @@ int MAIN(int argc, char **argv)
		char rsignfile = NULL, rkeyfile = NULL;
		char *outfile = NULL;
		int add_nonce = 1, noverify = 0, use_ssl = -1;
		STACK_OF(CONF_VALUE) *headers = NULL;
		OCSP_REQUEST *req = NULL;
		OCSP_RESPONSE *resp = NULL;
		OCSP_BASICRESP *bs = NULL;
		@@ -230,6 +233,16 @@ int MAIN(int argc, char **argv)
		}
		else badarg = 1;
		}
		else if (!strcmp(*args, "-header"))
		{
		if (args[1] && args[2])
		{
		if (!X509V3_add_value(args[1], args[2], &headers))
		goto end;
		args += 2;
		}
		else badarg = 1;
		}
		else if (!strcmp(*args, "-ignore_err"))
		ignore_err = 1;
		else if (!strcmp(*args, "-noverify"))
		@@ -756,7 +769,7 @@ int MAIN(int argc, char **argv)
		{
		#ifndef OPENSSL_NO_SOCK
		resp = process_responder(bio_err, req, host, path,
		port, use_ssl, req_timeout);
		port, use_ssl, headers, req_timeout);
		if (!resp)
		goto end;
		#else
		@@ -905,6 +918,7 @@ end:
		sk_OCSP_CERTID_free(ids);
		sk_X509_pop_free(sign_other, X509_free);
		sk_X509_pop_free(verify_other, X509_free);
		sk_CONF_VALUE_pop_free(headers, X509V3_conf_free);

		if (use_ssl != -1)
		{
		@@ -1260,10 +1274,12 @@ static int send_ocsp_response(BIO cbio, OCSP_RESPONSE resp)
		}

		static OCSP_RESPONSE query_responder(BIO err, BIO cbio, char path,
		STACK_OF(CONF_VALUE) *headers,
		OCSP_REQUEST *req, int req_timeout)
		{
		int fd;
		int rv;
		int i;
		OCSP_REQ_CTX *ctx = NULL;
		OCSP_RESPONSE *rsp = NULL;
		fd_set confds;
		@@ -1280,16 +1296,13 @@ static OCSP_RESPONSE query_responder(BIO err, BIO cbio, char path,
		return NULL;
		}

		if (req_timeout == -1)
		return OCSP_sendreq_bio(cbio, path, req);

		if (BIO_get_fd(cbio, &fd) <= 0)
		{
		BIO_puts(err, "Can't get connection fd\n");
		goto err;
		}

		if (rv <= 0)
		if (req_timeout != -1 && rv <= 0)
		{
		FD_ZERO(&confds);
		openssl_fdset(fd, &confds);
		@@ -1304,15 +1317,27 @@ static OCSP_RESPONSE query_responder(BIO err, BIO cbio, char path,
		}


		ctx = OCSP_sendreq_new(cbio, path, req, -1);
		ctx = OCSP_sendreq_new(cbio, path, NULL, -1);
		if (!ctx)
		return NULL;

		for (i = 0; i < sk_CONF_VALUE_num(headers); i++)
		{
		CONF_VALUE *hdr = sk_CONF_VALUE_value(headers, i);
		if (!OCSP_REQ_CTX_add1_header(ctx, hdr->name, hdr->value))
		goto err;
		}

		if (!OCSP_REQ_CTX_set1_req(ctx, req))
		goto err;

		for (;;)
		{
		rv = OCSP_sendreq_nbio(&rsp, ctx);
		if (rv != -1)
		break;
		if (req_timeout == -1)
		continue;
		FD_ZERO(&confds);
		openssl_fdset(fd, &confds);
		tv.tv_usec = 0;
		@@ -1347,6 +1372,7 @@ static OCSP_RESPONSE query_responder(BIO err, BIO cbio, char path,

		OCSP_RESPONSE process_responder(BIO err, OCSP_REQUEST *req,
		char host, char path, char *port, int use_ssl,
		STACK_OF(CONF_VALUE) *headers,
		int req_timeout)
		{
		BIO *cbio = NULL;
		@@ -1381,7 +1407,7 @@ OCSP_RESPONSE process_responder(BIO err, OCSP_REQUEST *req,
		sbio = BIO_new_ssl(ctx, 1);
		cbio = BIO_push(sbio, cbio);
		}
		resp = query_responder(err, cbio, path, req, req_timeout);
		resp = query_responder(err, cbio, path, headers, req, req_timeout);
		if (!resp)
		BIO_printf(bio_err, "Error querying OCSP responsder\n");
		end:

apps/s_server.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -787,7 +787,7 @@ BIO_printf(err, "cert_status: received %d ids\n", sk_OCSP_RESPID_num(ids));
		if (!OCSP_REQUEST_add_ext(req, ext, -1))
		goto err;
		}
		resp = process_responder(err, req, host, path, port, use_ssl,
		resp = process_responder(err, req, host, path, port, use_ssl, NULL,
		srctx->timeout);
		if (!resp)
		{

crypto/ocsp/ocsp.h

+3 −0

Original line number	Diff line number	Diff line
		@@ -406,6 +406,9 @@ OCSP_REQ_CTX OCSP_sendreq_new(BIO io, char path, OCSP_REQUEST req,
		int maxline);
		int OCSP_sendreq_nbio(OCSP_RESPONSE *presp, OCSP_REQ_CTX rctx);
		void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx);
		int OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX rctx, OCSP_REQUEST req);
		int OCSP_REQ_CTX_add1_header(OCSP_REQ_CTX *rctx,
		const char name, const char value);

		OCSP_CERTID OCSP_cert_to_id(const EVP_MD dgst, X509 subject, X509 issuer);

Admin message