diff options
Diffstat (limited to 'security/nss/cmd/ocspclnt')
| -rw-r--r-- | security/nss/cmd/ocspclnt/Makefile | 45 | ||||
| -rw-r--r-- | security/nss/cmd/ocspclnt/manifest.mn | 24 | ||||
| -rw-r--r-- | security/nss/cmd/ocspclnt/ocspclnt.c | 1243 | ||||
| -rw-r--r-- | security/nss/cmd/ocspclnt/ocspclnt.gyp | 25 |
4 files changed, 1337 insertions, 0 deletions
diff --git a/security/nss/cmd/ocspclnt/Makefile b/security/nss/cmd/ocspclnt/Makefile new file mode 100644 index 000000000..265ea5601 --- /dev/null +++ b/security/nss/cmd/ocspclnt/Makefile @@ -0,0 +1,45 @@ +#! gmake +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +####################################################################### +# (1) Include initial platform-independent assignments (MANDATORY). # +####################################################################### + +include manifest.mn + +####################################################################### +# (2) Include "global" configuration information. (OPTIONAL) # +####################################################################### + +include $(CORE_DEPTH)/coreconf/config.mk + +####################################################################### +# (3) Include "component" configuration information. (OPTIONAL) # +####################################################################### + +####################################################################### +# (4) Include "local" platform-dependent assignments (OPTIONAL). # +####################################################################### + +include ../platlibs.mk + +####################################################################### +# (5) Execute "global" rules. (OPTIONAL) # +####################################################################### + +include $(CORE_DEPTH)/coreconf/rules.mk + +####################################################################### +# (6) Execute "component" rules. (OPTIONAL) # +####################################################################### + + +####################################################################### +# (7) Execute "local" rules. (OPTIONAL). # +####################################################################### + + +include ../platrules.mk diff --git a/security/nss/cmd/ocspclnt/manifest.mn b/security/nss/cmd/ocspclnt/manifest.mn new file mode 100644 index 000000000..a2794a383 --- /dev/null +++ b/security/nss/cmd/ocspclnt/manifest.mn @@ -0,0 +1,24 @@ +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +CORE_DEPTH = ../.. + +# MODULE public and private header directories are implicitly REQUIRED. +MODULE = nss + +CSRCS = \ + ocspclnt.c \ + $(NULL) + +# headers for the MODULE (defined above) are implicitly required. +REQUIRES = dbm seccmd + +# WINNT uses EXTRA_LIBS as the list of libs to link in. +# Unix uses OS_LIBS for that purpose. +# We can solve this via conditional makefile code, but +# can't do this in manifest.mn because OS_ARCH isn't defined there. +# So, look in the local Makefile for the defines for the list of libs. + +PROGRAM = ocspclnt diff --git a/security/nss/cmd/ocspclnt/ocspclnt.c b/security/nss/cmd/ocspclnt/ocspclnt.c new file mode 100644 index 000000000..afcb7e13f --- /dev/null +++ b/security/nss/cmd/ocspclnt/ocspclnt.c @@ -0,0 +1,1243 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* + * Test program for client-side OCSP. + */ + +#include "secutil.h" +#include "nspr.h" +#include "plgetopt.h" +#include "nss.h" +#include "cert.h" +#include "ocsp.h" +#include "xconst.h" /* + * XXX internal header file; needed to get at + * cert_DecodeAuthInfoAccessExtension -- would be + * nice to not need this, but that would require + * better/different APIs. + */ + +#ifndef NO_PP /* \ + * Compile with this every once in a while to be \ + * sure that no dependencies on it get added \ + * outside of the pretty-printing routines. \ + */ +#include "ocspti.h" /* internals for pretty-printing routines *only* */ +#endif /* NO_PP */ + +#if defined(_WIN32) +#include "fcntl.h" +#include "io.h" +#endif + +#define DEFAULT_DB_DIR "~/.netscape" + +/* global */ +char *program_name; + +static void +synopsis(char *program_name) +{ + PRFileDesc *pr_stderr; + + pr_stderr = PR_STDERR; + PR_fprintf(pr_stderr, "Usage:"); + PR_fprintf(pr_stderr, + "\t%s -p [-d <dir>]\n", + program_name); + PR_fprintf(pr_stderr, + "\t%s -P [-d <dir>]\n", + program_name); + PR_fprintf(pr_stderr, + "\t%s -r <name> [-a] [-L] [-s <name>] [-d <dir>]\n", + program_name); + PR_fprintf(pr_stderr, + "\t%s -R <name> [-a] [-l <location>] [-s <name>] [-d <dir>]\n", + program_name); + PR_fprintf(pr_stderr, + "\t%s -S <name> [-a] [-l <location> -t <name>]\n", + program_name); + PR_fprintf(pr_stderr, + "\t\t [-s <name>] [-w <time>] [-d <dir>]\n"); + PR_fprintf(pr_stderr, + "\t%s -V <name> [-a] -u <usage> [-l <location> -t <name>]\n", + program_name); + PR_fprintf(pr_stderr, + "\t\t [-s <name>] [-w <time>] [-d <dir>]\n"); +} + +static void +short_usage(char *program_name) +{ + PR_fprintf(PR_STDERR, + "Type %s -H for more detailed descriptions\n", + program_name); + synopsis(program_name); +} + +static void +long_usage(char *program_name) +{ + PRFileDesc *pr_stderr; + + pr_stderr = PR_STDERR; + synopsis(program_name); + PR_fprintf(pr_stderr, "\nCommands (must specify exactly one):\n"); + PR_fprintf(pr_stderr, + " %-13s Pretty-print a binary request read from stdin\n", + "-p"); + PR_fprintf(pr_stderr, + " %-13s Pretty-print a binary response read from stdin\n", + "-P"); + PR_fprintf(pr_stderr, + " %-13s Create a request for cert \"nickname\" on stdout\n", + "-r nickname"); + PR_fprintf(pr_stderr, + " %-13s Get response for cert \"nickname\", dump to stdout\n", + "-R nickname"); + PR_fprintf(pr_stderr, + " %-13s Get status for cert \"nickname\"\n", + "-S nickname"); + PR_fprintf(pr_stderr, + " %-13s Fully verify cert \"nickname\", w/ status check\n", + "-V nickname"); + PR_fprintf(pr_stderr, + "\n %-10s also can be the name of the file with DER or\n" + " %-13s PEM(use -a option) cert encoding\n", + "nickname", ""); + PR_fprintf(pr_stderr, "Options:\n"); + PR_fprintf(pr_stderr, + " %-13s Decode input cert from PEM format. DER is default\n", + "-a"); + PR_fprintf(pr_stderr, + " %-13s Add the service locator extension to the request\n", + "-L"); + PR_fprintf(pr_stderr, + " %-13s Find security databases in \"dbdir\" (default %s)\n", + "-d dbdir", DEFAULT_DB_DIR); + PR_fprintf(pr_stderr, + " %-13s Use \"location\" as URL of responder\n", + "-l location"); + PR_fprintf(pr_stderr, + " %-13s Trust cert \"nickname\" as response signer\n", + "-t nickname"); + PR_fprintf(pr_stderr, + " %-13s Sign requests with cert \"nickname\"\n", + "-s nickname"); + PR_fprintf(pr_stderr, + " %-13s Type of certificate usage for verification:\n", + "-u usage"); + PR_fprintf(pr_stderr, + "%-17s c SSL Client\n", ""); + PR_fprintf(pr_stderr, + "%-17s s SSL Server\n", ""); + PR_fprintf(pr_stderr, + "%-17s e Email Recipient\n", ""); + PR_fprintf(pr_stderr, + "%-17s E Email Signer\n", ""); + PR_fprintf(pr_stderr, + "%-17s S Object Signer\n", ""); + PR_fprintf(pr_stderr, + "%-17s C CA\n", ""); + PR_fprintf(pr_stderr, + " %-13s Validity time (default current time), one of:\n", + "-w time"); + PR_fprintf(pr_stderr, + "%-17s %-25s (GMT)\n", "", "YYMMDDhhmm[ss]Z"); + PR_fprintf(pr_stderr, + "%-17s %-25s (later than GMT)\n", "", "YYMMDDhhmm[ss]+hhmm"); + PR_fprintf(pr_stderr, + "%-17s %-25s (earlier than GMT)\n", "", "YYMMDDhhmm[ss]-hhmm"); +} + +#if defined(WIN32) +/* We're going to write binary data to stdout, or read binary from stdin. + * We must put stdout or stdin into O_BINARY mode or else + outgoing \n's will become \r\n's, and incoming \r\n's will become \n's. +*/ +static SECStatus +make_file_binary(FILE *binfile) +{ + int smrv = _setmode(_fileno(binfile), _O_BINARY); + if (smrv == -1) { + fprintf(stderr, "%s: Cannot change stdout to binary mode.\n", + program_name); + } + return smrv; +} +#define MAKE_FILE_BINARY make_file_binary +#else +#define MAKE_FILE_BINARY(file) +#endif + +/* + * XXX This is a generic function that would probably make a good + * replacement for SECU_DER_Read (which is not at all specific to DER, + * despite its name), but that requires fixing all of the tools... + * Still, it should be done, whenenver I/somebody has the time. + * (Also, consider whether this actually belongs in the security + * library itself, not just in the command library.) + * + * This function takes an open file (a PRFileDesc *) and reads the + * entire file into a SECItem. (Obviously, the file is intended to + * be small enough that such a thing is advisable.) Both the SECItem + * and the buffer it points to are allocated from the heap; the caller + * is expected to free them. ("SECITEM_FreeItem(item, PR_TRUE)") + */ +static SECItem * +read_file_into_item(PRFileDesc *in_file, SECItemType si_type) +{ + PRStatus prv; + SECItem *item; + PRFileInfo file_info; + PRInt32 bytes_read; + + prv = PR_GetOpenFileInfo(in_file, &file_info); + if (prv != PR_SUCCESS) + return NULL; + + if (file_info.size == 0) { + /* XXX Need a better error; just grabbed this one for expediency. */ + PORT_SetError(SEC_ERROR_INPUT_LEN); + return NULL; + } + + if (file_info.size > 0xffff) { /* I think this is too big. */ + PORT_SetError(SEC_ERROR_NO_MEMORY); + return NULL; + } + + item = PORT_Alloc(sizeof(SECItem)); + if (item == NULL) + return NULL; + + item->type = si_type; + item->len = (unsigned int)file_info.size; + item->data = PORT_Alloc((size_t)item->len); + if (item->data == NULL) + goto loser; + + bytes_read = PR_Read(in_file, item->data, (PRInt32)item->len); + if (bytes_read < 0) { + /* Something went wrong; error is already set for us. */ + goto loser; + } else if (bytes_read == 0) { + /* Something went wrong; we read nothing. But no system/nspr error. */ + /* XXX Need to set an error here. */ + goto loser; + } else if (item->len != (unsigned int)bytes_read) { + /* Something went wrong; we read less (or more!?) than we expected. */ + /* XXX Need to set an error here. */ + goto loser; + } + + return item; + +loser: + SECITEM_FreeItem(item, PR_TRUE); + return NULL; +} + +/* + * Create a DER-encoded OCSP request (for the certificate whose nickname + * is "name") and dump it out. + */ +static SECStatus +create_request(FILE *out_file, CERTCertDBHandle *handle, CERTCertificate *cert, + PRBool add_service_locator, PRBool add_acceptable_responses) +{ + CERTCertList *certs = NULL; + CERTCertificate *myCert = NULL; + CERTOCSPRequest *request = NULL; + PRTime now = PR_Now(); + SECItem *encoding = NULL; + SECStatus rv = SECFailure; + + if (handle == NULL || cert == NULL) + return rv; + + myCert = CERT_DupCertificate(cert); + if (myCert == NULL) + goto loser; + + /* + * We need to create a list of one. + */ + certs = CERT_NewCertList(); + if (certs == NULL) + goto loser; + + if (CERT_AddCertToListTail(certs, myCert) != SECSuccess) + goto loser; + + /* + * Now that cert is included in the list, we need to be careful + * that we do not try to destroy it twice. This will prevent that. + */ + myCert = NULL; + + request = CERT_CreateOCSPRequest(certs, now, add_service_locator, NULL); + if (request == NULL) + goto loser; + + if (add_acceptable_responses) { + rv = CERT_AddOCSPAcceptableResponses(request, + SEC_OID_PKIX_OCSP_BASIC_RESPONSE); + if (rv != SECSuccess) + goto loser; + } + + encoding = CERT_EncodeOCSPRequest(NULL, request, NULL); + if (encoding == NULL) + goto loser; + + MAKE_FILE_BINARY(out_file); + if (fwrite(encoding->data, encoding->len, 1, out_file) != 1) + goto loser; + + rv = SECSuccess; + +loser: + if (encoding != NULL) + SECITEM_FreeItem(encoding, PR_TRUE); + if (request != NULL) + CERT_DestroyOCSPRequest(request); + if (certs != NULL) + CERT_DestroyCertList(certs); + if (myCert != NULL) + CERT_DestroyCertificate(myCert); + + return rv; +} + +/* + * Create a DER-encoded OCSP request (for the certificate whose nickname is + * "cert_name"), then get and dump a corresponding response. The responder + * location is either specified explicitly (as "responder_url") or found + * via the AuthorityInfoAccess URL in the cert. + */ +static SECStatus +dump_response(FILE *out_file, CERTCertDBHandle *handle, CERTCertificate *cert, + const char *responder_url) +{ + CERTCertList *certs = NULL; + CERTCertificate *myCert = NULL; + char *loc = NULL; + PRTime now = PR_Now(); + SECItem *response = NULL; + SECStatus rv = SECFailure; + PRBool includeServiceLocator; + + if (handle == NULL || cert == NULL) + return rv; + + myCert = CERT_DupCertificate(cert); + if (myCert == NULL) + goto loser; + + if (responder_url != NULL) { + loc = (char *)responder_url; + includeServiceLocator = PR_TRUE; + } else { + loc = CERT_GetOCSPAuthorityInfoAccessLocation(cert); + if (loc == NULL) + goto loser; + includeServiceLocator = PR_FALSE; + } + + /* + * We need to create a list of one. + */ + certs = CERT_NewCertList(); + if (certs == NULL) + goto loser; + + if (CERT_AddCertToListTail(certs, myCert) != SECSuccess) + goto loser; + + /* + * Now that cert is included in the list, we need to be careful + * that we do not try to destroy it twice. This will prevent that. + */ + myCert = NULL; + + response = CERT_GetEncodedOCSPResponse(NULL, certs, loc, now, + includeServiceLocator, + NULL, NULL, NULL); + if (response == NULL) + goto loser; + + MAKE_FILE_BINARY(out_file); + if (fwrite(response->data, response->len, 1, out_file) != 1) + goto loser; + + rv = SECSuccess; + +loser: + if (response != NULL) + SECITEM_FreeItem(response, PR_TRUE); + if (certs != NULL) + CERT_DestroyCertList(certs); + if (myCert != NULL) + CERT_DestroyCertificate(myCert); + if (loc != NULL && loc != responder_url) + PORT_Free(loc); + + return rv; +} + +/* + * Get the status for the specified certificate (whose nickname is "cert_name"). + * Directly use the OCSP function rather than doing a full verification. + */ +static SECStatus +get_cert_status(FILE *out_file, CERTCertDBHandle *handle, + CERTCertificate *cert, const char *cert_name, + PRTime verify_time) +{ + SECStatus rv = SECFailure; + + if (handle == NULL || cert == NULL) + goto loser; + + rv = CERT_CheckOCSPStatus(handle, cert, verify_time, NULL); + + fprintf(out_file, "Check of certificate \"%s\" ", cert_name); + if (rv == SECSuccess) { + fprintf(out_file, "succeeded.\n"); + } else { + const char *error_string = SECU_Strerror(PORT_GetError()); + fprintf(out_file, "failed. Reason:\n"); + if (error_string != NULL && PORT_Strlen(error_string) > 0) + fprintf(out_file, "%s\n", error_string); + else + fprintf(out_file, "Unknown\n"); + } + + rv = SECSuccess; + +loser: + + return rv; +} + +/* + * Verify the specified certificate (whose nickname is "cert_name"). + * OCSP is already turned on, so we just need to call the standard + * certificate verification API and let it do all the work. + */ +static SECStatus +verify_cert(FILE *out_file, CERTCertDBHandle *handle, CERTCertificate *cert, + const char *cert_name, SECCertUsage cert_usage, PRTime verify_time) +{ + SECStatus rv = SECFailure; + + if (handle == NULL || cert == NULL) + return rv; + + rv = CERT_VerifyCert(handle, cert, PR_TRUE, cert_usage, verify_time, + NULL, NULL); + + fprintf(out_file, "Verification of certificate \"%s\" ", cert_name); + if (rv == SECSuccess) { + fprintf(out_file, "succeeded.\n"); + } else { + const char *error_string = SECU_Strerror(PORT_GetError()); + fprintf(out_file, "failed. Reason:\n"); + if (error_string != NULL && PORT_Strlen(error_string) > 0) + fprintf(out_file, "%s\n", error_string); + else + fprintf(out_file, "Unknown\n"); + } + + rv = SECSuccess; + + return rv; +} + +CERTCertificate * +find_certificate(CERTCertDBHandle *handle, const char *name, PRBool ascii) +{ + CERTCertificate *cert = NULL; + SECItem der; + PRFileDesc *certFile; + + if (handle == NULL || name == NULL) + return NULL; + + if (ascii == PR_FALSE) { + /* by default need to check if there is cert nick is given */ + cert = CERT_FindCertByNicknameOrEmailAddr(handle, (char *)name); + if (cert != NULL) + return cert; + } + + certFile = PR_Open(name, PR_RDONLY, 0); + if (certFile == NULL) { + return NULL; + } + + if (SECU_ReadDERFromFile(&der, certFile, ascii, PR_FALSE) == SECSuccess) { + cert = CERT_DecodeCertFromPackage((char *)der.data, der.len); + SECITEM_FreeItem(&der, PR_FALSE); + } + PR_Close(certFile); + + return cert; +} + +#ifdef NO_PP + +static SECStatus +print_request(FILE *out_file, SECItem *data) +{ + fprintf(out_file, "Cannot pretty-print request compiled with NO_PP.\n"); + return SECSuccess; +} + +static SECStatus +print_response(FILE *out_file, SECItem *data, CERTCertDBHandle *handle) +{ + fprintf(out_file, "Cannot pretty-print response compiled with NO_PP.\n"); + return SECSuccess; +} + +#else /* NO_PP */ + +static void +print_ocsp_version(FILE *out_file, SECItem *version, int level) +{ + if (version->len > 0) { + SECU_PrintInteger(out_file, version, "Version", level); + } else { + SECU_Indent(out_file, level); + fprintf(out_file, "Version: DEFAULT\n"); + } +} + +static void +print_ocsp_cert_id(FILE *out_file, CERTOCSPCertID *cert_id, int level) +{ + SECU_Indent(out_file, level); + fprintf(out_file, "Cert ID:\n"); + level++; + + SECU_PrintAlgorithmID(out_file, &(cert_id->hashAlgorithm), + "Hash Algorithm", level); + SECU_PrintAsHex(out_file, &(cert_id->issuerNameHash), + "Issuer Name Hash", level); + SECU_PrintAsHex(out_file, &(cert_id->issuerKeyHash), + "Issuer Key Hash", level); + SECU_PrintInteger(out_file, &(cert_id->serialNumber), + "Serial Number", level); + /* XXX lookup the cert; if found, print something nice (nickname?) */ +} + +static void +print_raw_certificates(FILE *out_file, SECItem **raw_certs, int level) +{ + SECItem *raw_cert; + int i = 0; + char cert_label[50]; + + SECU_Indent(out_file, level); + + if (raw_certs == NULL) { + fprintf(out_file, "No Certificates.\n"); + return; + } + + fprintf(out_file, "Certificate List:\n"); + while ((raw_cert = raw_certs[i++]) != NULL) { + sprintf(cert_label, "Certificate (%d)", i); + (void)SECU_PrintSignedData(out_file, raw_cert, cert_label, level + 1, + (SECU_PPFunc)SECU_PrintCertificate); + } +} + +static void +print_ocsp_extensions(FILE *out_file, CERTCertExtension **extensions, + char *msg, int level) +{ + if (extensions) { + SECU_PrintExtensions(out_file, extensions, msg, level); + } else { + SECU_Indent(out_file, level); + fprintf(out_file, "No %s\n", msg); + } +} + +static void +print_single_request(FILE *out_file, ocspSingleRequest *single, int level) +{ + print_ocsp_cert_id(out_file, single->reqCert, level); + print_ocsp_extensions(out_file, single->singleRequestExtensions, + "Single Request Extensions", level); +} + +/* + * Decode the DER/BER-encoded item "data" as an OCSP request + * and pretty-print the subfields. + */ +static SECStatus +print_request(FILE *out_file, SECItem *data) +{ + CERTOCSPRequest *request; + ocspTBSRequest *tbsRequest; + int level = 0; + + PORT_Assert(out_file != NULL); + PORT_Assert(data != NULL); + if (out_file == NULL || data == NULL) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + request = CERT_DecodeOCSPRequest(data); + if (request == NULL || request->tbsRequest == NULL) + return SECFailure; + + tbsRequest = request->tbsRequest; + + fprintf(out_file, "TBS Request:\n"); + level++; + + print_ocsp_version(out_file, &(tbsRequest->version), level); + + /* + * XXX Probably should be an interface to get the signer name + * without looking inside the tbsRequest at all. + */ + if (tbsRequest->requestorName != NULL) { + SECU_Indent(out_file, level); + fprintf(out_file, "XXX print the requestorName\n"); + } else { + SECU_Indent(out_file, level); + fprintf(out_file, "No Requestor Name.\n"); + } + + if (tbsRequest->requestList != NULL) { + int i; + + for (i = 0; tbsRequest->requestList[i] != NULL; i++) { + SECU_Indent(out_file, level); + fprintf(out_file, "Request %d:\n", i); + print_single_request(out_file, tbsRequest->requestList[i], + level + 1); + } + } else { + fprintf(out_file, "Request list is empty.\n"); + } + + print_ocsp_extensions(out_file, tbsRequest->requestExtensions, + "Request Extensions", level); + + if (request->optionalSignature != NULL) { + ocspSignature *whole_sig; + SECItem rawsig; + + fprintf(out_file, "Signature:\n"); + + whole_sig = request->optionalSignature; + SECU_PrintAlgorithmID(out_file, &(whole_sig->signatureAlgorithm), + "Signature Algorithm", level); + + rawsig = whole_sig->signature; + DER_ConvertBitString(&rawsig); + SECU_PrintAsHex(out_file, &rawsig, "Signature", level); + + print_raw_certificates(out_file, whole_sig->derCerts, level); + + fprintf(out_file, "XXX verify the sig and print result\n"); + } else { + fprintf(out_file, "No Signature\n"); + } + + CERT_DestroyOCSPRequest(request); + return SECSuccess; +} + +static void +print_revoked_info(FILE *out_file, ocspRevokedInfo *revoked_info, int level) +{ + SECU_PrintGeneralizedTime(out_file, &(revoked_info->revocationTime), + "Revocation Time", level); + + if (revoked_info->revocationReason != NULL) { + SECU_PrintAsHex(out_file, revoked_info->revocationReason, + "Revocation Reason", level); + } else { + SECU_Indent(out_file, level); + fprintf(out_file, "No Revocation Reason.\n"); + } +} + +static void +print_cert_status(FILE *out_file, ocspCertStatus *status, int level) +{ + SECU_Indent(out_file, level); + fprintf(out_file, "Status: "); + + switch (status->certStatusType) { + case ocspCertStatus_good: + fprintf(out_file, "Cert is good.\n"); + break; + case ocspCertStatus_revoked: + fprintf(out_file, "Cert has been revoked.\n"); + print_revoked_info(out_file, status->certStatusInfo.revokedInfo, + level + 1); + break; + case ocspCertStatus_unknown: + fprintf(out_file, "Cert is unknown to responder.\n"); + break; + default: + fprintf(out_file, "Unrecognized status.\n"); + break; + } +} + +static void +print_single_response(FILE *out_file, CERTOCSPSingleResponse *single, + int level) +{ + print_ocsp_cert_id(out_file, single->certID, level); + + print_cert_status(out_file, single->certStatus, level); + + SECU_PrintGeneralizedTime(out_file, &(single->thisUpdate), + "This Update", level); + + if (single->nextUpdate != NULL) { + SECU_PrintGeneralizedTime(out_file, single->nextUpdate, + "Next Update", level); + } else { + SECU_Indent(out_file, level); + fprintf(out_file, "No Next Update\n"); + } + + print_ocsp_extensions(out_file, single->singleExtensions, + "Single Response Extensions", level); +} + +static void +print_responder_id(FILE *out_file, ocspResponderID *responderID, int level) +{ + SECU_Indent(out_file, level); + fprintf(out_file, "Responder ID "); + + switch (responderID->responderIDType) { + case ocspResponderID_byName: + fprintf(out_file, "(byName):\n"); + SECU_PrintName(out_file, &(responderID->responderIDValue.name), + "Name", level + 1); + break; + case ocspResponderID_byKey: + fprintf(out_file, "(byKey):\n"); + SECU_PrintAsHex(out_file, &(responderID->responderIDValue.keyHash), + "Key Hash", level + 1); + break; + default: + fprintf(out_file, "Unrecognized Responder ID Type\n"); + break; + } +} + +static void +print_response_data(FILE *out_file, ocspResponseData *responseData, int level) +{ + SECU_Indent(out_file, level); + fprintf(out_file, "Response Data:\n"); + level++; + + print_ocsp_version(out_file, &(responseData->version), level); + + print_responder_id(out_file, responseData->responderID, level); + + SECU_PrintGeneralizedTime(out_file, &(responseData->producedAt), + "Produced At", level); + + if (responseData->responses != NULL) { + int i; + + for (i = 0; responseData->responses[i] != NULL; i++) { + SECU_Indent(out_file, level); + fprintf(out_file, "Response %d:\n", i); + print_single_response(out_file, responseData->responses[i], + level + 1); + } + } else { + fprintf(out_file, "Response list is empty.\n"); + } + + print_ocsp_extensions(out_file, responseData->responseExtensions, + "Response Extensions", level); +} + +static void +print_basic_response(FILE *out_file, ocspBasicOCSPResponse *basic, int level) +{ + SECItem rawsig; + + SECU_Indent(out_file, level); + fprintf(out_file, "Basic OCSP Response:\n"); + level++; + + print_response_data(out_file, basic->tbsResponseData, level); + + SECU_PrintAlgorithmID(out_file, + &(basic->responseSignature.signatureAlgorithm), + "Signature Algorithm", level); + + rawsig = basic->responseSignature.signature; + DER_ConvertBitString(&rawsig); + SECU_PrintAsHex(out_file, &rawsig, "Signature", level); + + print_raw_certificates(out_file, basic->responseSignature.derCerts, level); +} + +/* + * Note this must match (exactly) the enumeration ocspResponseStatus. + */ +static char *responseStatusNames[] = { + "successful (Response has valid confirmations)", + "malformedRequest (Illegal confirmation request)", + "internalError (Internal error in issuer)", + "tryLater (Try again later)", + "unused ((4) is not used)", + "sigRequired (Must sign the request)", + "unauthorized (Request unauthorized)" +}; + +/* + * Decode the DER/BER-encoded item "data" as an OCSP response + * and pretty-print the subfields. + */ +static SECStatus +print_response(FILE *out_file, SECItem *data, CERTCertDBHandle *handle) +{ + CERTOCSPResponse *response; + int level = 0; + + PORT_Assert(out_file != NULL); + PORT_Assert(data != NULL); + if (out_file == NULL || data == NULL) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + response = CERT_DecodeOCSPResponse(data); + if (response == NULL) + return SECFailure; + + if (response->statusValue >= ocspResponse_min && + response->statusValue <= ocspResponse_max) { + fprintf(out_file, "Response Status: %s\n", + responseStatusNames[response->statusValue]); + } else { + fprintf(out_file, + "Response Status: other (Status value %d out of defined range)\n", + (int)response->statusValue); + } + + if (response->statusValue == ocspResponse_successful) { + ocspResponseBytes *responseBytes = response->responseBytes; + SECStatus sigStatus; + CERTCertificate *signerCert = NULL; + + PORT_Assert(responseBytes != NULL); + + level++; + fprintf(out_file, "Response Bytes:\n"); + SECU_PrintObjectID(out_file, &(responseBytes->responseType), + "Response Type", level); + switch (response->responseBytes->responseTypeTag) { + case SEC_OID_PKIX_OCSP_BASIC_RESPONSE: + print_basic_response(out_file, + responseBytes->decodedResponse.basic, + level); + break; + default: + SECU_Indent(out_file, level); + fprintf(out_file, "Unknown response syntax\n"); + break; + } + + sigStatus = CERT_VerifyOCSPResponseSignature(response, handle, + NULL, &signerCert, NULL); + SECU_Indent(out_file, level); + fprintf(out_file, "Signature verification "); + if (sigStatus != SECSuccess) { + fprintf(out_file, "failed: %s\n", SECU_Strerror(PORT_GetError())); + } else { + fprintf(out_file, "succeeded.\n"); + if (signerCert != NULL) { + SECU_PrintName(out_file, &signerCert->subject, "Signer", + level); + CERT_DestroyCertificate(signerCert); + } else { + SECU_Indent(out_file, level); + fprintf(out_file, "No signer cert returned?\n"); + } + } + } else { + SECU_Indent(out_file, level); + fprintf(out_file, "Unsuccessful response, no more information.\n"); + } + + CERT_DestroyOCSPResponse(response); + return SECSuccess; +} + +#endif /* NO_PP */ + +static SECStatus +cert_usage_from_char(const char *cert_usage_str, SECCertUsage *cert_usage) +{ + PORT_Assert(cert_usage_str != NULL); + PORT_Assert(cert_usage != NULL); + + if (PORT_Strlen(cert_usage_str) != 1) + return SECFailure; + + switch (*cert_usage_str) { + case 'c': + *cert_usage = certUsageSSLClient; + break; + case 's': + *cert_usage = certUsageSSLServer; + break; + case 'e': + *cert_usage = certUsageEmailRecipient; + break; + case 'E': + *cert_usage = certUsageEmailSigner; + break; + case 'S': + *cert_usage = certUsageObjectSigner; + break; + case 'C': + *cert_usage = certUsageVerifyCA; + break; + default: + return SECFailure; + } + + return SECSuccess; +} + +int +main(int argc, char **argv) +{ + int retval; + PRFileDesc *in_file; + FILE *out_file; /* not PRFileDesc until SECU accepts it */ + int crequest, dresponse; + int prequest, presponse; + int ccert, vcert; + const char *db_dir, *date_str, *cert_usage_str, *name; + const char *responder_name, *responder_url, *signer_name; + PRBool add_acceptable_responses, add_service_locator; + SECItem *data = NULL; + PLOptState *optstate; + SECStatus rv; + CERTCertDBHandle *handle = NULL; + SECCertUsage cert_usage = certUsageSSLClient; + PRTime verify_time; + CERTCertificate *cert = NULL; + PRBool ascii = PR_FALSE; + + retval = -1; /* what we return/exit with on error */ + + program_name = PL_strrchr(argv[0], '/'); + program_name = program_name ? (program_name + 1) : argv[0]; + + in_file = PR_STDIN; + out_file = stdout; + + crequest = 0; + dresponse = 0; + prequest = 0; + presponse = 0; + ccert = 0; + vcert = 0; + + db_dir = NULL; + date_str = NULL; + cert_usage_str = NULL; + name = NULL; + responder_name = NULL; + responder_url = NULL; + signer_name = NULL; + + add_acceptable_responses = PR_FALSE; + add_service_locator = PR_FALSE; + + optstate = PL_CreateOptState(argc, argv, "AHLPR:S:V:d:l:pr:s:t:u:w:"); + if (optstate == NULL) { + SECU_PrintError(program_name, "PL_CreateOptState failed"); + return retval; + } + + while (PL_GetNextOpt(optstate) == PL_OPT_OK) { + switch (optstate->option) { + case '?': + short_usage(program_name); + return retval; + + case 'A': + add_acceptable_responses = PR_TRUE; + break; + + case 'H': + long_usage(program_name); + return retval; + + case 'L': + add_service_locator = PR_TRUE; + break; + + case 'P': + presponse = 1; + break; + + case 'R': + dresponse = 1; + name = optstate->value; + break; + + case 'S': + ccert = 1; + name = optstate->value; + break; + + case 'V': + vcert = 1; + name = optstate->value; + break; + + case 'a': + ascii = PR_TRUE; + break; + + case 'd': + db_dir = optstate->value; + break; + + case 'l': + responder_url = optstate->value; + break; + + case 'p': + prequest = 1; + break; + + case 'r': + crequest = 1; + name = optstate->value; + break; + + case 's': + signer_name = optstate->value; + break; + + case 't': + responder_name = optstate->value; + break; + + case 'u': + cert_usage_str = optstate->value; + break; + + case 'w': + date_str = optstate->value; + break; + } + } + + PL_DestroyOptState(optstate); + + if ((crequest + dresponse + prequest + presponse + ccert + vcert) != 1) { + PR_fprintf(PR_STDERR, "%s: must specify exactly one command\n\n", + program_name); + short_usage(program_name); + return retval; + } + + if (vcert) { + if (cert_usage_str == NULL) { + PR_fprintf(PR_STDERR, "%s: verification requires cert usage\n\n", + program_name); + short_usage(program_name); + return retval; + } + + rv = cert_usage_from_char(cert_usage_str, &cert_usage); + if (rv != SECSuccess) { + PR_fprintf(PR_STDERR, "%s: invalid cert usage (\"%s\")\n\n", + program_name, cert_usage_str); + long_usage(program_name); + return retval; + } + } + + if (ccert + vcert) { + if (responder_url != NULL || responder_name != NULL) { + /* + * To do a full status check, both the URL and the cert name + * of the responder must be specified if either one is. + */ + if (responder_url == NULL || responder_name == NULL) { + if (responder_url == NULL) + PR_fprintf(PR_STDERR, + "%s: must also specify responder location\n\n", + program_name); + else + PR_fprintf(PR_STDERR, + "%s: must also specify responder name\n\n", + program_name); + short_usage(program_name); + return retval; + } + } + + if (date_str != NULL) { + rv = DER_AsciiToTime(&verify_time, (char *)date_str); + if (rv != SECSuccess) { + SECU_PrintError(program_name, "error converting time string"); + PR_fprintf(PR_STDERR, "\n"); + long_usage(program_name); + return retval; + } + } else { + verify_time = PR_Now(); + } + } + + retval = -2; /* errors change from usage to runtime */ + + /* + * Initialize the NSPR and Security libraries. + */ + PR_Init(PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 1); + db_dir = SECU_ConfigDirectory(db_dir); + rv = NSS_Init(db_dir); + if (rv != SECSuccess) { + SECU_PrintError(program_name, "NSS_Init failed"); + goto prdone; + } + SECU_RegisterDynamicOids(); + + if (prequest + presponse) { + MAKE_FILE_BINARY(stdin); + data = read_file_into_item(in_file, siBuffer); + if (data == NULL) { + SECU_PrintError(program_name, "problem reading input"); + goto nssdone; + } + } + + if (crequest + dresponse + presponse + ccert + vcert) { + handle = CERT_GetDefaultCertDB(); + if (handle == NULL) { + SECU_PrintError(program_name, "problem getting certdb handle"); + goto nssdone; + } + + /* + * It would be fine to do the enable for all of these commands, + * but this way we check that everything but an overall verify + * can be done without it. That is, that the individual pieces + * work on their own. + */ + if (vcert) { + rv = CERT_EnableOCSPChecking(handle); + if (rv != SECSuccess) { + SECU_PrintError(program_name, "error enabling OCSP checking"); + goto nssdone; + } + } + + if ((ccert + vcert) && (responder_name != NULL)) { + rv = CERT_SetOCSPDefaultResponder(handle, responder_url, + responder_name); + if (rv != SECSuccess) { + SECU_PrintError(program_name, + "error setting default responder"); + goto nssdone; + } + + rv = CERT_EnableOCSPDefaultResponder(handle); + if (rv != SECSuccess) { + SECU_PrintError(program_name, + "error enabling default responder"); + goto nssdone; + } + } + } + +#define NOTYET(opt) \ + { \ + PR_fprintf(PR_STDERR, "%s not yet working\n", opt); \ + exit(-1); \ + } + + if (name) { + cert = find_certificate(handle, name, ascii); + } + + if (crequest) { + if (signer_name != NULL) { + NOTYET("-s"); + } + rv = create_request(out_file, handle, cert, add_service_locator, + add_acceptable_responses); + } else if (dresponse) { + if (signer_name != NULL) { + NOTYET("-s"); + } + rv = dump_response(out_file, handle, cert, responder_url); + } else if (prequest) { + rv = print_request(out_file, data); + } else if (presponse) { + rv = print_response(out_file, data, handle); + } else if (ccert) { + if (signer_name != NULL) { + NOTYET("-s"); + } + rv = get_cert_status(out_file, handle, cert, name, verify_time); + } else if (vcert) { + if (signer_name != NULL) { + NOTYET("-s"); + } + rv = verify_cert(out_file, handle, cert, name, cert_usage, verify_time); + } + + if (rv != SECSuccess) + SECU_PrintError(program_name, "error performing requested operation"); + else + retval = 0; + +nssdone: + if (cert) { + CERT_DestroyCertificate(cert); + } + + if (data != NULL) { + SECITEM_FreeItem(data, PR_TRUE); + } + + if (handle != NULL) { + CERT_DisableOCSPDefaultResponder(handle); + CERT_DisableOCSPChecking(handle); + } + + if (NSS_Shutdown() != SECSuccess) { + retval = 1; + } + +prdone: + PR_Cleanup(); + return retval; +} diff --git a/security/nss/cmd/ocspclnt/ocspclnt.gyp b/security/nss/cmd/ocspclnt/ocspclnt.gyp new file mode 100644 index 000000000..4ab7c5e36 --- /dev/null +++ b/security/nss/cmd/ocspclnt/ocspclnt.gyp @@ -0,0 +1,25 @@ +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. +{ + 'includes': [ + '../../coreconf/config.gypi', + '../../cmd/platlibs.gypi' + ], + 'targets': [ + { + 'target_name': 'ocspclnt', + 'type': 'executable', + 'sources': [ + 'ocspclnt.c' + ], + 'dependencies': [ + '<(DEPTH)/exports.gyp:dbm_exports', + '<(DEPTH)/exports.gyp:nss_exports' + ] + } + ], + 'variables': { + 'module': 'nss' + } +}
\ No newline at end of file |