bin/openssl/ocsp.c

   1 /* $OpenBSD: ocsp.c,v 1.15 2018/02/07 05:49:36 jsing Exp $ */
   2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
   3  * project 2000.
   4  */
   5 /* ====================================================================
   6  * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * 3. All advertising materials mentioning features or use of this
  21  *    software must display the following acknowledgment:
  22  *    "This product includes software developed by the OpenSSL Project
  23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24  *
  25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26  *    endorse or promote products derived from this software without
  27  *    prior written permission. For written permission, please contact
  28  *    licensing@OpenSSL.org.
  29  *
  30  * 5. Products derived from this software may not be called "OpenSSL"
  31  *    nor may "OpenSSL" appear in their names without prior written
  32  *    permission of the OpenSSL Project.
  33  *
  34  * 6. Redistributions of any form whatsoever must retain the following
  35  *    acknowledgment:
  36  *    "This product includes software developed by the OpenSSL Project
  37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38  *
  39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50  * OF THE POSSIBILITY OF SUCH DAMAGE.
  51  * ====================================================================
  52  *
  53  * This product includes cryptographic software written by Eric Young
  54  * (eay@cryptsoft.com).  This product includes software written by Tim
  55  * Hudson (tjh@cryptsoft.com).
  56  *
  57  */
  58 #ifndef OPENSSL_NO_OCSP
  59
  60 #include <sys/types.h>
  61
  62 #include <stdio.h>
  63 #include <stdlib.h>
  64 #include <limits.h>
  65 #include <string.h>
  66 #include <poll.h>
  67 #include <time.h>
  68
  69 /* Needs to be included before the openssl headers! */
  70 #include "apps.h"
  71
  72 #include <openssl/bn.h>
  73 #include <openssl/crypto.h>
  74 #include <openssl/err.h>
  75 #include <openssl/evp.h>
  76 #include <openssl/ssl.h>
  77 #include <openssl/x509v3.h>
  78
  79 /* Maximum leeway in validity period: default 5 minutes */
  80 #define MAX_VALIDITY_PERIOD     (5 * 60)
  81
  82 static int
  83 add_ocsp_cert(OCSP_REQUEST ** req, X509 * cert, const EVP_MD * cert_id_md, X509 * issuer,
  84     STACK_OF(OCSP_CERTID) * ids);
  85 static int add_ocsp_serial(OCSP_REQUEST ** req, char *serial, const EVP_MD * cert_id_md, X509 * issuer,
  86     STACK_OF(OCSP_CERTID) * ids);
  87 static int print_ocsp_summary(BIO * out, OCSP_BASICRESP * bs, OCSP_REQUEST * req,
  88     STACK_OF(OPENSSL_STRING) * names,
  89     STACK_OF(OCSP_CERTID) * ids, long nsec,
  90     long maxage);
  91
  92 static int make_ocsp_response(OCSP_RESPONSE ** resp, OCSP_REQUEST * req, CA_DB * db,
  93     X509 * ca, X509 * rcert, EVP_PKEY * rkey,
  94     STACK_OF(X509) * rother, unsigned long flags,
  95     int nmin, int ndays);
  96
  97 static char **lookup_serial(CA_DB * db, ASN1_INTEGER * ser);
  98 static BIO *init_responder(char *port);
  99 static int do_responder(OCSP_REQUEST ** preq, BIO ** pcbio, BIO * acbio, char *port);
 100 static int send_ocsp_response(BIO * cbio, OCSP_RESPONSE * resp);
 101 static OCSP_RESPONSE *query_responder(BIO * err, BIO * cbio, char *path,
 102     STACK_OF(CONF_VALUE) * headers,
 103     OCSP_REQUEST * req, int req_timeout);
 104
 105 int
 106 ocsp_main(int argc, char **argv)
 107 {
 108         char **args;
 109         char *host = NULL, *port = NULL, *path = NULL;
 110         char *reqin = NULL, *respin = NULL;
 111         char *reqout = NULL, *respout = NULL;
 112         char *signfile = NULL, *keyfile = NULL;
 113         char *rsignfile = NULL, *rkeyfile = NULL;
 114         char *outfile = NULL;
 115         int add_nonce = 1, noverify = 0, use_ssl = -1;
 116         STACK_OF(CONF_VALUE) * headers = NULL;
 117         OCSP_REQUEST *req = NULL;
 118         OCSP_RESPONSE *resp = NULL;
 119         OCSP_BASICRESP *bs = NULL;
 120         X509 *issuer = NULL, *cert = NULL;
 121         X509 *signer = NULL, *rsigner = NULL;
 122         EVP_PKEY *key = NULL, *rkey = NULL;
 123         BIO *acbio = NULL, *cbio = NULL;
 124         BIO *derbio = NULL;
 125         BIO *out = NULL;
 126         int req_timeout = -1;
 127         int req_text = 0, resp_text = 0;
 128         long nsec = MAX_VALIDITY_PERIOD, maxage = -1;
 129         char *CAfile = NULL, *CApath = NULL;
 130         X509_STORE *store = NULL;
 131         STACK_OF(X509) * sign_other = NULL, *verify_other = NULL, *rother = NULL;
 132         char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
 133         unsigned long sign_flags = 0, verify_flags = 0, rflags = 0;
 134         int ret = 1;
 135         int accept_count = -1;
 136         int badarg = 0;
 137         int i;
 138         int ignore_err = 0;
 139         STACK_OF(OPENSSL_STRING) * reqnames = NULL;
 140         STACK_OF(OCSP_CERTID) * ids = NULL;
 141         X509 *rca_cert = NULL;
 142         char *ridx_filename = NULL;
 143         char *rca_filename = NULL;
 144         CA_DB *rdb = NULL;
 145         int nmin = 0, ndays = -1;
 146         const EVP_MD *cert_id_md = NULL;
 147         const char *errstr = NULL;
 148
 149         if (single_execution) {
 150                 if (pledge("stdio cpath wpath rpath inet dns tty", NULL) == -1) {
 151                         perror("pledge");
 152                         exit(1);
 153                 }
 154         }
 155
 156         args = argv + 1;
 157         reqnames = sk_OPENSSL_STRING_new_null();
 158         ids = sk_OCSP_CERTID_new_null();
 159         while (!badarg && *args && *args[0] == '-') {
 160                 if (!strcmp(*args, "-out")) {
 161                         if (args[1]) {
 162                                 args++;
 163                                 outfile = *args;
 164                         } else
 165                                 badarg = 1;
 166                 } else if (!strcmp(*args, "-timeout")) {
 167                         if (args[1]) {
 168                                 args++;
 169                                 req_timeout = strtonum(*args, 0,
 170                                     INT_MAX, &errstr);
 171                                 if (errstr) {
 172                                         BIO_printf(bio_err,
 173                                             "Illegal timeout value %s: %s\n",
 174                                             *args, errstr);
 175                                         badarg = 1;
 176                                 }
 177                         } else
 178                                 badarg = 1;
 179                 } else if (!strcmp(*args, "-url")) {
 180                         if (args[1] && host == NULL && port == NULL &&
 181                             path == NULL) {
 182                                 args++;
 183                                 if (!OCSP_parse_url(*args, &host, &port, &path, &use_ssl)) {
 184                                         BIO_printf(bio_err, "Error parsing URL\n");
 185                                         badarg = 1;
 186                                 }
 187                         } else
 188                                 badarg = 1;
 189                 } else if (!strcmp(*args, "-host")) {
 190                         if (args[1] && use_ssl == -1) {
 191                                 args++;
 192                                 host = *args;
 193                         } else
 194                                 badarg = 1;
 195                 } else if (!strcmp(*args, "-port")) {
 196                         if (args[1] && use_ssl == -1) {
 197                                 args++;
 198                                 port = *args;
 199                         } else
 200                                 badarg = 1;
 201                 } else if (!strcmp(*args, "-header")) {
 202                         if (args[1] && args[2]) {
 203                                 if (!X509V3_add_value(args[1], args[2], &headers))
 204                                         goto end;
 205                                 args += 2;
 206                         } else
 207                                 badarg = 1;
 208                 } else if (!strcmp(*args, "-ignore_err"))
 209                         ignore_err = 1;
 210                 else if (!strcmp(*args, "-noverify"))
 211                         noverify = 1;
 212                 else if (!strcmp(*args, "-nonce"))
 213                         add_nonce = 2;
 214                 else if (!strcmp(*args, "-no_nonce"))
 215                         add_nonce = 0;
 216                 else if (!strcmp(*args, "-resp_no_certs"))
 217                         rflags |= OCSP_NOCERTS;
 218                 else if (!strcmp(*args, "-resp_key_id"))
 219                         rflags |= OCSP_RESPID_KEY;
 220                 else if (!strcmp(*args, "-no_certs"))
 221                         sign_flags |= OCSP_NOCERTS;
 222                 else if (!strcmp(*args, "-no_signature_verify"))
 223                         verify_flags |= OCSP_NOSIGS;
 224                 else if (!strcmp(*args, "-no_cert_verify"))
 225                         verify_flags |= OCSP_NOVERIFY;
 226                 else if (!strcmp(*args, "-no_chain"))
 227                         verify_flags |= OCSP_NOCHAIN;
 228                 else if (!strcmp(*args, "-no_cert_checks"))
 229                         verify_flags |= OCSP_NOCHECKS;
 230                 else if (!strcmp(*args, "-no_explicit"))
 231                         verify_flags |= OCSP_NOEXPLICIT;
 232                 else if (!strcmp(*args, "-trust_other"))
 233                         verify_flags |= OCSP_TRUSTOTHER;
 234                 else if (!strcmp(*args, "-no_intern"))
 235                         verify_flags |= OCSP_NOINTERN;
 236                 else if (!strcmp(*args, "-text")) {
 237                         req_text = 1;
 238                         resp_text = 1;
 239                 } else if (!strcmp(*args, "-req_text"))
 240                         req_text = 1;
 241                 else if (!strcmp(*args, "-resp_text"))
 242                         resp_text = 1;
 243                 else if (!strcmp(*args, "-reqin")) {
 244                         if (args[1]) {
 245                                 args++;
 246                                 reqin = *args;
 247                         } else
 248                                 badarg = 1;
 249                 } else if (!strcmp(*args, "-respin")) {
 250                         if (args[1]) {
 251                                 args++;
 252                                 respin = *args;
 253                         } else
 254                                 badarg = 1;
 255                 } else if (!strcmp(*args, "-signer")) {
 256                         if (args[1]) {
 257                                 args++;
 258                                 signfile = *args;
 259                         } else
 260                                 badarg = 1;
 261                 } else if (!strcmp(*args, "-VAfile")) {
 262                         if (args[1]) {
 263                                 args++;
 264                                 verify_certfile = *args;
 265                                 verify_flags |= OCSP_TRUSTOTHER;
 266                         } else
 267                                 badarg = 1;
 268                 } else if (!strcmp(*args, "-sign_other")) {
 269                         if (args[1]) {
 270                                 args++;
 271                                 sign_certfile = *args;
 272                         } else
 273                                 badarg = 1;
 274                 } else if (!strcmp(*args, "-verify_other")) {
 275                         if (args[1]) {
 276                                 args++;
 277                                 verify_certfile = *args;
 278                         } else
 279                                 badarg = 1;
 280                 } else if (!strcmp(*args, "-CAfile")) {
 281                         if (args[1]) {
 282                                 args++;
 283                                 CAfile = *args;
 284                         } else
 285                                 badarg = 1;
 286                 } else if (!strcmp(*args, "-CApath")) {
 287                         if (args[1]) {
 288                                 args++;
 289                                 CApath = *args;
 290                         } else
 291                                 badarg = 1;
 292                 } else if (!strcmp(*args, "-validity_period")) {
 293                         if (args[1]) {
 294                                 args++;
 295                                 nsec = strtonum(*args, 0, LONG_MAX, &errstr);
 296                                 if (errstr) {
 297                                         BIO_printf(bio_err,
 298                                             "Illegal validity period %s: %s\n",
 299                                             *args, errstr);
 300                                         badarg = 1;
 301                                 }
 302                         } else
 303                                 badarg = 1;
 304                 } else if (!strcmp(*args, "-status_age")) {
 305                         if (args[1]) {
 306                                 args++;
 307                                 maxage = strtonum(*args, 0, LONG_MAX, &errstr);
 308                                 if (errstr) {
 309                                         BIO_printf(bio_err,
 310                                             "Illegal validity age %s: %s\n",
 311                                             *args, errstr);
 312                                         badarg = 1;
 313                                 }
 314                         } else
 315                                 badarg = 1;
 316                 } else if (!strcmp(*args, "-signkey")) {
 317                         if (args[1]) {
 318                                 args++;
 319                                 keyfile = *args;
 320                         } else
 321                                 badarg = 1;
 322                 } else if (!strcmp(*args, "-reqout")) {
 323                         if (args[1]) {
 324                                 args++;
 325                                 reqout = *args;
 326                         } else
 327                                 badarg = 1;
 328                 } else if (!strcmp(*args, "-respout")) {
 329                         if (args[1]) {
 330                                 args++;
 331                                 respout = *args;
 332                         } else
 333                                 badarg = 1;
 334                 } else if (!strcmp(*args, "-path")) {
 335                         if (args[1] && use_ssl == -1) {
 336                                 args++;
 337                                 path = *args;
 338                         } else
 339                                 badarg = 1;
 340                 } else if (!strcmp(*args, "-issuer")) {
 341                         if (args[1]) {
 342                                 args++;
 343                                 X509_free(issuer);
 344                                 issuer = load_cert(bio_err, *args, FORMAT_PEM,
 345                                     NULL, "issuer certificate");
 346                                 if (!issuer)
 347                                         goto end;
 348                         } else
 349                                 badarg = 1;
 350                 } else if (!strcmp(*args, "-cert")) {
 351                         if (args[1]) {
 352                                 args++;
 353                                 X509_free(cert);
 354                                 cert = load_cert(bio_err, *args, FORMAT_PEM,
 355                                     NULL, "certificate");
 356                                 if (!cert)
 357                                         goto end;
 358                                 if (!cert_id_md)
 359                                         cert_id_md = EVP_sha1();
 360                                 if (!add_ocsp_cert(&req, cert, cert_id_md, issuer, ids))
 361                                         goto end;
 362                                 if (!sk_OPENSSL_STRING_push(reqnames, *args))
 363                                         goto end;
 364                         } else
 365                                 badarg = 1;
 366                 } else if (!strcmp(*args, "-serial")) {
 367                         if (args[1]) {
 368                                 args++;
 369                                 if (!cert_id_md)
 370                                         cert_id_md = EVP_sha1();
 371                                 if (!add_ocsp_serial(&req, *args, cert_id_md, issuer, ids))
 372                                         goto end;
 373                                 if (!sk_OPENSSL_STRING_push(reqnames, *args))
 374                                         goto end;
 375                         } else
 376                                 badarg = 1;
 377                 } else if (!strcmp(*args, "-index")) {
 378                         if (args[1]) {
 379                                 args++;
 380                                 ridx_filename = *args;
 381                         } else
 382                                 badarg = 1;
 383                 } else if (!strcmp(*args, "-CA")) {
 384                         if (args[1]) {
 385                                 args++;
 386                                 rca_filename = *args;
 387                         } else
 388                                 badarg = 1;
 389                 } else if (!strcmp(*args, "-nmin")) {
 390                         if (args[1]) {
 391                                 args++;
 392                                 nmin = strtonum(*args, 0, INT_MAX, &errstr);
 393                                 if (errstr) {
 394                                         BIO_printf(bio_err,
 395                                             "Illegal update period %s: %s\n",
 396                                             *args, errstr);
 397                                         badarg = 1;
 398                                 }
 399                         }
 400                         if (ndays == -1)
 401                                 ndays = 0;
 402                         else
 403                                 badarg = 1;
 404                 } else if (!strcmp(*args, "-nrequest")) {
 405                         if (args[1]) {
 406                                 args++;
 407                                 accept_count = strtonum(*args, 0, INT_MAX, &errstr);
 408                                 if (errstr) {
 409                                         BIO_printf(bio_err,
 410                                             "Illegal accept count %s: %s\n",
 411                                             *args, errstr);
 412                                         badarg = 1;
 413                                 }
 414                         } else
 415                                 badarg = 1;
 416                 } else if (!strcmp(*args, "-ndays")) {
 417                         if (args[1]) {
 418                                 args++;
 419                                 ndays = strtonum(*args, 0, INT_MAX, &errstr);
 420                                 if (errstr) {
 421                                         BIO_printf(bio_err,
 422                                             "Illegal update period %s: %s\n",
 423                                             *args, errstr);
 424                                         badarg = 1;
 425                                 }
 426                         } else
 427                                 badarg = 1;
 428                 } else if (!strcmp(*args, "-rsigner")) {
 429                         if (args[1]) {
 430                                 args++;
 431                                 rsignfile = *args;
 432                         } else
 433                                 badarg = 1;
 434                 } else if (!strcmp(*args, "-rkey")) {
 435                         if (args[1]) {
 436                                 args++;
 437                                 rkeyfile = *args;
 438                         } else
 439                                 badarg = 1;
 440                 } else if (!strcmp(*args, "-rother")) {
 441                         if (args[1]) {
 442                                 args++;
 443                                 rcertfile = *args;
 444                         } else
 445                                 badarg = 1;
 446                 } else if ((cert_id_md = EVP_get_digestbyname((*args) + 1)) == NULL) {
 447                         badarg = 1;
 448                 }
 449                 args++;
 450         }
 451
 452         /* Have we anything to do? */
 453         if (!req && !reqin && !respin && !(port && ridx_filename))
 454                 badarg = 1;
 455
 456         if (badarg) {
 457                 BIO_printf(bio_err, "OCSP utility\n");
 458                 BIO_printf(bio_err, "Usage ocsp [options]\n");
 459                 BIO_printf(bio_err, "where options are\n");
 460                 BIO_printf(bio_err, "-out file          output filename\n");
 461                 BIO_printf(bio_err, "-issuer file       issuer certificate\n");
 462                 BIO_printf(bio_err, "-cert file         certificate to check\n");
 463                 BIO_printf(bio_err, "-serial n          serial number to check\n");
 464                 BIO_printf(bio_err, "-signer file       certificate to sign OCSP request with\n");
 465                 BIO_printf(bio_err, "-signkey file      private key to sign OCSP request with\n");
 466                 BIO_printf(bio_err, "-sign_other file   additional certificates to include in signed request\n");
 467                 BIO_printf(bio_err, "-no_certs          don't include any certificates in signed request\n");
 468                 BIO_printf(bio_err, "-req_text          print text form of request\n");
 469                 BIO_printf(bio_err, "-resp_text         print text form of response\n");
 470                 BIO_printf(bio_err, "-text              print text form of request and response\n");
 471                 BIO_printf(bio_err, "-reqout file       write DER encoded OCSP request to \"file\"\n");
 472                 BIO_printf(bio_err, "-respout file      write DER encoded OCSP reponse to \"file\"\n");
 473                 BIO_printf(bio_err, "-reqin file        read DER encoded OCSP request from \"file\"\n");
 474                 BIO_printf(bio_err, "-respin file       read DER encoded OCSP reponse from \"file\"\n");
 475                 BIO_printf(bio_err, "-nonce             add OCSP nonce to request\n");
 476                 BIO_printf(bio_err, "-no_nonce          don't add OCSP nonce to request\n");
 477                 BIO_printf(bio_err, "-url URL           OCSP responder URL\n");
 478                 BIO_printf(bio_err, "-host host:n       send OCSP request to host on port n\n");
 479                 BIO_printf(bio_err, "-path              path to use in OCSP request\n");
 480                 BIO_printf(bio_err, "-CApath dir        trusted certificates directory\n");
 481                 BIO_printf(bio_err, "-CAfile file       trusted certificates file\n");
 482                 BIO_printf(bio_err, "-VAfile file       validator certificates file\n");
 483                 BIO_printf(bio_err, "-validity_period n maximum validity discrepancy in seconds\n");
 484                 BIO_printf(bio_err, "-status_age n      maximum status age in seconds\n");
 485                 BIO_printf(bio_err, "-noverify          don't verify response at all\n");
 486                 BIO_printf(bio_err, "-verify_other file additional certificates to search for signer\n");
 487                 BIO_printf(bio_err, "-trust_other       don't verify additional certificates\n");
 488                 BIO_printf(bio_err, "-no_intern         don't search certificates contained in response for signer\n");
 489                 BIO_printf(bio_err, "-no_signature_verify don't check signature on response\n");
 490                 BIO_printf(bio_err, "-no_cert_verify    don't check signing certificate\n");
 491                 BIO_printf(bio_err, "-no_chain          don't chain verify response\n");
 492                 BIO_printf(bio_err, "-no_cert_checks    don't do additional checks on signing certificate\n");
 493                 BIO_printf(bio_err, "-port num           port to run responder on\n");
 494                 BIO_printf(bio_err, "-index file         certificate status index file\n");
 495                 BIO_printf(bio_err, "-CA file            CA certificate\n");
 496                 BIO_printf(bio_err, "-rsigner file       responder certificate to sign responses with\n");
 497                 BIO_printf(bio_err, "-rkey file  responder key to sign responses with\n");
 498                 BIO_printf(bio_err, "-rother file        other certificates to include in response\n");
 499                 BIO_printf(bio_err, "-resp_no_certs     don't include any certificates in response\n");
 500                 BIO_printf(bio_err, "-nmin n             number of minutes before next update\n");
 501                 BIO_printf(bio_err, "-ndays n            number of days before next update\n");
 502                 BIO_printf(bio_err, "-resp_key_id       identify reponse by signing certificate key ID\n");
 503                 BIO_printf(bio_err, "-nrequest n        number of requests to accept (default unlimited)\n");
 504                 BIO_printf(bio_err, "-<dgst alg>     use specified digest in the request\n");
 505                 goto end;
 506         }
 507         if (outfile)
 508                 out = BIO_new_file(outfile, "w");
 509         else
 510                 out = BIO_new_fp(stdout, BIO_NOCLOSE);
 511
 512         if (!out) {
 513                 BIO_printf(bio_err, "Error opening output file\n");
 514                 goto end;
 515         }
 516         if (!req && (add_nonce != 2))
 517                 add_nonce = 0;
 518
 519         if (!req && reqin) {
 520                 derbio = BIO_new_file(reqin, "rb");
 521                 if (!derbio) {
 522                         BIO_printf(bio_err, "Error Opening OCSP request file\n");
 523                         goto end;
 524                 }
 525                 req = d2i_OCSP_REQUEST_bio(derbio, NULL);
 526                 BIO_free(derbio);
 527                 if (!req) {
 528                         BIO_printf(bio_err, "Error reading OCSP request\n");
 529                         goto end;
 530                 }
 531         }
 532         if (!req && port) {
 533                 acbio = init_responder(port);
 534                 if (!acbio)
 535                         goto end;
 536         }
 537         if (rsignfile && !rdb) {
 538                 if (!rkeyfile)
 539                         rkeyfile = rsignfile;
 540                 rsigner = load_cert(bio_err, rsignfile, FORMAT_PEM,
 541                     NULL, "responder certificate");
 542                 if (!rsigner) {
 543                         BIO_printf(bio_err, "Error loading responder certificate\n");
 544                         goto end;
 545                 }
 546                 rca_cert = load_cert(bio_err, rca_filename, FORMAT_PEM,
 547                     NULL, "CA certificate");
 548                 if (rcertfile) {
 549                         rother = load_certs(bio_err, rcertfile, FORMAT_PEM,
 550                             NULL, "responder other certificates");
 551                         if (!rother)
 552                                 goto end;
 553                 }
 554                 rkey = load_key(bio_err, rkeyfile, FORMAT_PEM, 0, NULL,
 555                     "responder private key");
 556                 if (!rkey)
 557                         goto end;
 558         }
 559         if (acbio)
 560                 BIO_printf(bio_err, "Waiting for OCSP client connections...\n");
 561
 562 redo_accept:
 563
 564         if (acbio) {
 565                 if (!do_responder(&req, &cbio, acbio, port))
 566                         goto end;
 567                 if (!req) {
 568                         resp = OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL);
 569                         send_ocsp_response(cbio, resp);
 570                         goto done_resp;
 571                 }
 572         }
 573         if (!req && (signfile || reqout || host || add_nonce || ridx_filename)) {
 574                 BIO_printf(bio_err, "Need an OCSP request for this operation!\n");
 575                 goto end;
 576         }
 577         if (req && add_nonce)
 578                 OCSP_request_add1_nonce(req, NULL, -1);
 579
 580         if (signfile) {
 581                 if (!keyfile)
 582                         keyfile = signfile;
 583                 signer = load_cert(bio_err, signfile, FORMAT_PEM,
 584                     NULL, "signer certificate");
 585                 if (!signer) {
 586                         BIO_printf(bio_err, "Error loading signer certificate\n");
 587                         goto end;
 588                 }
 589                 if (sign_certfile) {
 590                         sign_other = load_certs(bio_err, sign_certfile, FORMAT_PEM,
 591                             NULL, "signer certificates");
 592                         if (!sign_other)
 593                                 goto end;
 594                 }
 595                 key = load_key(bio_err, keyfile, FORMAT_PEM, 0, NULL,
 596                     "signer private key");
 597                 if (!key)
 598                         goto end;
 599
 600                 if (!OCSP_request_sign(req, signer, key, NULL, sign_other, sign_flags)) {
 601                         BIO_printf(bio_err, "Error signing OCSP request\n");
 602                         goto end;
 603                 }
 604         }
 605         if (req_text && req)
 606                 OCSP_REQUEST_print(out, req, 0);
 607
 608         if (reqout) {
 609                 derbio = BIO_new_file(reqout, "wb");
 610                 if (!derbio) {
 611                         BIO_printf(bio_err, "Error opening file %s\n", reqout);
 612                         goto end;
 613                 }
 614                 i2d_OCSP_REQUEST_bio(derbio, req);
 615                 BIO_free(derbio);
 616         }
 617         if (ridx_filename && (!rkey || !rsigner || !rca_cert)) {
 618                 BIO_printf(bio_err, "Need a responder certificate, key and CA for this operation!\n");
 619                 goto end;
 620         }
 621         if (ridx_filename && !rdb) {
 622                 rdb = load_index(ridx_filename, NULL);
 623                 if (!rdb)
 624                         goto end;
 625                 if (!index_index(rdb))
 626                         goto end;
 627         }
 628         if (rdb) {
 629                 i = make_ocsp_response(&resp, req, rdb, rca_cert, rsigner, rkey, rother, rflags, nmin, ndays);
 630                 if (cbio)
 631                         send_ocsp_response(cbio, resp);
 632         } else if (host) {
 633                 resp = process_responder(bio_err, req, host, path ? path : "/",
 634                     port, use_ssl, headers, req_timeout);
 635                 if (!resp)
 636                         goto end;
 637         } else if (respin) {
 638                 derbio = BIO_new_file(respin, "rb");
 639                 if (!derbio) {
 640                         BIO_printf(bio_err, "Error Opening OCSP response file\n");
 641                         goto end;
 642                 }
 643                 resp = d2i_OCSP_RESPONSE_bio(derbio, NULL);
 644                 BIO_free(derbio);
 645                 if (!resp) {
 646                         BIO_printf(bio_err, "Error reading OCSP response\n");
 647                         goto end;
 648                 }
 649         } else {
 650                 ret = 0;
 651                 goto end;
 652         }
 653
 654 done_resp:
 655
 656         if (respout) {
 657                 derbio = BIO_new_file(respout, "wb");
 658                 if (!derbio) {
 659                         BIO_printf(bio_err, "Error opening file %s\n", respout);
 660                         goto end;
 661                 }
 662                 i2d_OCSP_RESPONSE_bio(derbio, resp);
 663                 BIO_free(derbio);
 664         }
 665         i = OCSP_response_status(resp);
 666
 667         if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
 668                 BIO_printf(bio_err, "Responder Error: %s (%d)\n",
 669                     OCSP_response_status_str(i), i);
 670                 if (ignore_err)
 671                         goto redo_accept;
 672                 ret = 1;
 673                 goto end;
 674         }
 675         if (resp_text)
 676                 OCSP_RESPONSE_print(out, resp, 0);
 677
 678         /* If running as responder don't verify our own response */
 679         if (cbio) {
 680                 if (accept_count > 0)
 681                         accept_count--;
 682                 /* Redo if more connections needed */
 683                 if (accept_count) {
 684                         BIO_free_all(cbio);
 685                         cbio = NULL;
 686                         OCSP_REQUEST_free(req);
 687                         req = NULL;
 688                         OCSP_RESPONSE_free(resp);
 689                         resp = NULL;
 690                         goto redo_accept;
 691                 }
 692                 goto end;
 693         }
 694         if (!store)
 695                 store = setup_verify(bio_err, CAfile, CApath);
 696         if (!store)
 697                 goto end;
 698         if (verify_certfile) {
 699                 verify_other = load_certs(bio_err, verify_certfile, FORMAT_PEM,
 700                     NULL, "validator certificate");
 701                 if (!verify_other)
 702                         goto end;
 703         }
 704         bs = OCSP_response_get1_basic(resp);
 705
 706         if (!bs) {
 707                 BIO_printf(bio_err, "Error parsing response\n");
 708                 goto end;
 709         }
 710         if (!noverify) {
 711                 if (req && ((i = OCSP_check_nonce(req, bs)) <= 0)) {
 712                         if (i == -1)
 713                                 BIO_printf(bio_err, "WARNING: no nonce in response\n");
 714                         else {
 715                                 BIO_printf(bio_err, "Nonce Verify error\n");
 716                                 goto end;
 717                         }
 718                 }
 719                 i = OCSP_basic_verify(bs, verify_other, store, verify_flags);
 720                 if (i < 0)
 721                         i = OCSP_basic_verify(bs, NULL, store, 0);
 722
 723                 if (i <= 0) {
 724                         BIO_printf(bio_err, "Response Verify Failure\n");
 725                         ERR_print_errors(bio_err);
 726                 } else
 727                         BIO_printf(bio_err, "Response verify OK\n");
 728
 729         }
 730         if (!print_ocsp_summary(out, bs, req, reqnames, ids, nsec, maxage))
 731                 goto end;
 732
 733         ret = 0;
 734
 735  end:
 736         ERR_print_errors(bio_err);
 737         X509_free(signer);
 738         X509_STORE_free(store);
 739         EVP_PKEY_free(key);
 740         EVP_PKEY_free(rkey);
 741         X509_free(issuer);
 742         X509_free(cert);
 743         X509_free(rsigner);
 744         X509_free(rca_cert);
 745         free_index(rdb);
 746         BIO_free_all(cbio);
 747         BIO_free_all(acbio);
 748         BIO_free(out);
 749         OCSP_REQUEST_free(req);
 750         OCSP_RESPONSE_free(resp);
 751         OCSP_BASICRESP_free(bs);
 752         sk_OPENSSL_STRING_free(reqnames);
 753         sk_OCSP_CERTID_free(ids);
 754         sk_X509_pop_free(sign_other, X509_free);
 755         sk_X509_pop_free(verify_other, X509_free);
 756         sk_CONF_VALUE_pop_free(headers, X509V3_conf_free);
 757
 758         if (use_ssl != -1) {
 759                 free(host);
 760                 free(port);
 761                 free(path);
 762         }
 763         return (ret);
 764 }
 765
 766 static int
 767 add_ocsp_cert(OCSP_REQUEST ** req, X509 * cert, const EVP_MD * cert_id_md, X509 * issuer,
 768     STACK_OF(OCSP_CERTID) * ids)
 769 {
 770         OCSP_CERTID *id;
 771         if (!issuer) {
 772                 BIO_printf(bio_err, "No issuer certificate specified\n");
 773                 return 0;
 774         }
 775         if (!*req)
 776                 *req = OCSP_REQUEST_new();
 777         if (!*req)
 778                 goto err;
 779         id = OCSP_cert_to_id(cert_id_md, cert, issuer);
 780         if (!id || !sk_OCSP_CERTID_push(ids, id))
 781                 goto err;
 782         if (!OCSP_request_add0_id(*req, id))
 783                 goto err;
 784         return 1;
 785
 786  err:
 787         BIO_printf(bio_err, "Error Creating OCSP request\n");
 788         return 0;
 789 }
 790
 791 static int
 792 add_ocsp_serial(OCSP_REQUEST ** req, char *serial, const EVP_MD * cert_id_md, X509 * issuer,
 793     STACK_OF(OCSP_CERTID) * ids)
 794 {
 795         OCSP_CERTID *id;
 796         X509_NAME *iname;
 797         ASN1_BIT_STRING *ikey;
 798         ASN1_INTEGER *sno;
 799         if (!issuer) {
 800                 BIO_printf(bio_err, "No issuer certificate specified\n");
 801                 return 0;
 802         }
 803         if (!*req)
 804                 *req = OCSP_REQUEST_new();
 805         if (!*req)
 806                 goto err;
 807         iname = X509_get_subject_name(issuer);
 808         ikey = X509_get0_pubkey_bitstr(issuer);
 809         sno = s2i_ASN1_INTEGER(NULL, serial);
 810         if (!sno) {
 811                 BIO_printf(bio_err, "Error converting serial number %s\n", serial);
 812                 return 0;
 813         }
 814         id = OCSP_cert_id_new(cert_id_md, iname, ikey, sno);
 815         ASN1_INTEGER_free(sno);
 816         if (!id || !sk_OCSP_CERTID_push(ids, id))
 817                 goto err;
 818         if (!OCSP_request_add0_id(*req, id))
 819                 goto err;
 820         return 1;
 821
 822  err:
 823         BIO_printf(bio_err, "Error Creating OCSP request\n");
 824         return 0;
 825 }
 826
 827 static int
 828 print_ocsp_summary(BIO * out, OCSP_BASICRESP * bs, OCSP_REQUEST * req,
 829     STACK_OF(OPENSSL_STRING) * names,
 830     STACK_OF(OCSP_CERTID) * ids, long nsec,
 831     long maxage)
 832 {
 833         OCSP_CERTID *id;
 834         char *name;
 835         int i;
 836
 837         int status, reason;
 838
 839         ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
 840
 841         if (!bs || !req || !sk_OPENSSL_STRING_num(names) || !sk_OCSP_CERTID_num(ids))
 842                 return 1;
 843
 844         for (i = 0; i < sk_OCSP_CERTID_num(ids); i++) {
 845                 id = sk_OCSP_CERTID_value(ids, i);
 846                 name = sk_OPENSSL_STRING_value(names, i);
 847                 BIO_printf(out, "%s: ", name);
 848
 849                 if (!OCSP_resp_find_status(bs, id, &status, &reason,
 850                         &rev, &thisupd, &nextupd)) {
 851                         BIO_puts(out, "ERROR: No Status found.\n");
 852                         continue;
 853                 }
 854                 /*
 855                  * Check validity: if invalid write to output BIO so we know
 856                  * which response this refers to.
 857                  */
 858                 if (!OCSP_check_validity(thisupd, nextupd, nsec, maxage)) {
 859                         BIO_puts(out, "WARNING: Status times invalid.\n");
 860                         ERR_print_errors(out);
 861                 }
 862                 BIO_printf(out, "%s\n", OCSP_cert_status_str(status));
 863
 864                 BIO_puts(out, "\tThis Update: ");
 865                 ASN1_GENERALIZEDTIME_print(out, thisupd);
 866                 BIO_puts(out, "\n");
 867
 868                 if (nextupd) {
 869                         BIO_puts(out, "\tNext Update: ");
 870                         ASN1_GENERALIZEDTIME_print(out, nextupd);
 871                         BIO_puts(out, "\n");
 872                 }
 873                 if (status != V_OCSP_CERTSTATUS_REVOKED)
 874                         continue;
 875
 876                 if (reason != -1)
 877                         BIO_printf(out, "\tReason: %s\n",
 878                             OCSP_crl_reason_str(reason));
 879
 880                 BIO_puts(out, "\tRevocation Time: ");
 881                 ASN1_GENERALIZEDTIME_print(out, rev);
 882                 BIO_puts(out, "\n");
 883         }
 884
 885         return 1;
 886 }
 887
 888
 889 static int
 890 make_ocsp_response(OCSP_RESPONSE ** resp, OCSP_REQUEST * req, CA_DB * db,
 891     X509 * ca, X509 * rcert, EVP_PKEY * rkey,
 892     STACK_OF(X509) * rother, unsigned long flags,
 893     int nmin, int ndays)
 894 {
 895         ASN1_TIME *thisupd = NULL, *nextupd = NULL;
 896         OCSP_CERTID *cid, *ca_id = NULL;
 897         OCSP_BASICRESP *bs = NULL;
 898         int i, id_count, ret = 1;
 899
 900         id_count = OCSP_request_onereq_count(req);
 901
 902         if (id_count <= 0) {
 903                 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL);
 904                 goto end;
 905         }
 906         bs = OCSP_BASICRESP_new();
 907         thisupd = X509_gmtime_adj(NULL, 0);
 908         if (ndays != -1)
 909                 nextupd = X509_gmtime_adj(NULL, nmin * 60 + ndays * 3600 * 24);
 910
 911         /* Examine each certificate id in the request */
 912         for (i = 0; i < id_count; i++) {
 913                 OCSP_ONEREQ *one;
 914                 ASN1_INTEGER *serial;
 915                 char **inf;
 916                 ASN1_OBJECT *cert_id_md_oid;
 917                 const EVP_MD *cert_id_md;
 918                 one = OCSP_request_onereq_get0(req, i);
 919                 cid = OCSP_onereq_get0_id(one);
 920
 921                 OCSP_id_get0_info(NULL, &cert_id_md_oid, NULL, NULL, cid);
 922
 923                 cert_id_md = EVP_get_digestbyobj(cert_id_md_oid);
 924                 if (!cert_id_md) {
 925                         *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR,
 926                             NULL);
 927                         goto end;
 928                 }
 929                 OCSP_CERTID_free(ca_id);
 930                 ca_id = OCSP_cert_to_id(cert_id_md, NULL, ca);
 931
 932                 /* Is this request about our CA? */
 933                 if (OCSP_id_issuer_cmp(ca_id, cid)) {
 934                         OCSP_basic_add1_status(bs, cid,
 935                             V_OCSP_CERTSTATUS_UNKNOWN,
 936                             0, NULL,
 937                             thisupd, nextupd);
 938                         continue;
 939                 }
 940                 OCSP_id_get0_info(NULL, NULL, NULL, &serial, cid);
 941                 inf = lookup_serial(db, serial);
 942                 if (!inf)
 943                         OCSP_basic_add1_status(bs, cid,
 944                             V_OCSP_CERTSTATUS_UNKNOWN,
 945                             0, NULL,
 946                             thisupd, nextupd);
 947                 else if (inf[DB_type][0] == DB_TYPE_VAL)
 948                         OCSP_basic_add1_status(bs, cid,
 949                             V_OCSP_CERTSTATUS_GOOD,
 950                             0, NULL,
 951                             thisupd, nextupd);
 952                 else if (inf[DB_type][0] == DB_TYPE_REV) {
 953                         ASN1_OBJECT *inst = NULL;
 954                         ASN1_TIME *revtm = NULL;
 955                         ASN1_GENERALIZEDTIME *invtm = NULL;
 956                         OCSP_SINGLERESP *single;
 957                         int reason = -1;
 958                         unpack_revinfo(&revtm, &reason, &inst, &invtm, inf[DB_rev_date]);
 959                         single = OCSP_basic_add1_status(bs, cid,
 960                             V_OCSP_CERTSTATUS_REVOKED,
 961                             reason, revtm,
 962                             thisupd, nextupd);
 963                         if (invtm)
 964                                 OCSP_SINGLERESP_add1_ext_i2d(single, NID_invalidity_date, invtm, 0, 0);
 965                         else if (inst)
 966                                 OCSP_SINGLERESP_add1_ext_i2d(single, NID_hold_instruction_code, inst, 0, 0);
 967                         ASN1_OBJECT_free(inst);
 968                         ASN1_TIME_free(revtm);
 969                         ASN1_GENERALIZEDTIME_free(invtm);
 970                 }
 971         }
 972
 973         OCSP_copy_nonce(bs, req);
 974
 975         OCSP_basic_sign(bs, rcert, rkey, NULL, rother, flags);
 976
 977         *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_SUCCESSFUL, bs);
 978
 979  end:
 980         ASN1_TIME_free(thisupd);
 981         ASN1_TIME_free(nextupd);
 982         OCSP_CERTID_free(ca_id);
 983         OCSP_BASICRESP_free(bs);
 984         return ret;
 985
 986 }
 987
 988 static char **
 989 lookup_serial(CA_DB * db, ASN1_INTEGER * ser)
 990 {
 991         int i;
 992         BIGNUM *bn = NULL;
 993         char *itmp, *row[DB_NUMBER], **rrow;
 994         for (i = 0; i < DB_NUMBER; i++)
 995                 row[i] = NULL;
 996         bn = ASN1_INTEGER_to_BN(ser, NULL);
 997         OPENSSL_assert(bn);     /* FIXME: should report an error at this
 998                                  * point and abort */
 999         if (BN_is_zero(bn))
1000                 itmp = strdup("00");
1001         else
1002                 itmp = BN_bn2hex(bn);
1003         row[DB_serial] = itmp;
1004         BN_free(bn);
1005         rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
1006         free(itmp);
1007         return rrow;
1008 }
1009
1010 /* Quick and dirty OCSP server: read in and parse input request */
1011
1012 static BIO *
1013 init_responder(char *port)
1014 {
1015         BIO *acbio = NULL, *bufbio = NULL;
1016         bufbio = BIO_new(BIO_f_buffer());
1017         if (!bufbio)
1018                 goto err;
1019         acbio = BIO_new_accept(port);
1020         if (!acbio)
1021                 goto err;
1022         BIO_set_accept_bios(acbio, bufbio);
1023         bufbio = NULL;
1024
1025         if (BIO_do_accept(acbio) <= 0) {
1026                 BIO_printf(bio_err, "Error setting up accept BIO\n");
1027                 ERR_print_errors(bio_err);
1028                 goto err;
1029         }
1030         return acbio;
1031
1032  err:
1033         BIO_free_all(acbio);
1034         BIO_free(bufbio);
1035         return NULL;
1036 }
1037
1038 static int
1039 do_responder(OCSP_REQUEST ** preq, BIO ** pcbio, BIO * acbio, char *port)
1040 {
1041         int have_post = 0, len;
1042         OCSP_REQUEST *req = NULL;
1043         char inbuf[1024];
1044         BIO *cbio = NULL;
1045
1046         if (BIO_do_accept(acbio) <= 0) {
1047                 BIO_printf(bio_err, "Error accepting connection\n");
1048                 ERR_print_errors(bio_err);
1049                 return 0;
1050         }
1051         cbio = BIO_pop(acbio);
1052         *pcbio = cbio;
1053
1054         for (;;) {
1055                 len = BIO_gets(cbio, inbuf, sizeof inbuf);
1056                 if (len <= 0)
1057                         return 1;
1058                 /* Look for "POST" signalling start of query */
1059                 if (!have_post) {
1060                         if (strncmp(inbuf, "POST", 4)) {
1061                                 BIO_printf(bio_err, "Invalid request\n");
1062                                 return 1;
1063                         }
1064                         have_post = 1;
1065                 }
1066                 /* Look for end of headers */
1067                 if ((inbuf[0] == '\r') || (inbuf[0] == '\n'))
1068                         break;
1069         }
1070
1071         /* Try to read OCSP request */
1072
1073         req = d2i_OCSP_REQUEST_bio(cbio, NULL);
1074
1075         if (!req) {
1076                 BIO_printf(bio_err, "Error parsing OCSP request\n");
1077                 ERR_print_errors(bio_err);
1078         }
1079         *preq = req;
1080
1081         return 1;
1082
1083 }
1084
1085 static int
1086 send_ocsp_response(BIO * cbio, OCSP_RESPONSE * resp)
1087 {
1088         static const char http_resp[] =
1089         "HTTP/1.0 200 OK\r\nContent-type: application/ocsp-response\r\n"
1090         "Content-Length: %d\r\n\r\n";
1091         if (!cbio)
1092                 return 0;
1093         BIO_printf(cbio, http_resp, i2d_OCSP_RESPONSE(resp, NULL));
1094         i2d_OCSP_RESPONSE_bio(cbio, resp);
1095         (void) BIO_flush(cbio);
1096         return 1;
1097 }
1098
1099 static OCSP_RESPONSE *
1100 query_responder(BIO * err, BIO * cbio, char *path,
1101     STACK_OF(CONF_VALUE) * headers,
1102     OCSP_REQUEST * req, int req_timeout)
1103 {
1104         int fd;
1105         int rv;
1106         int i;
1107         OCSP_REQ_CTX *ctx = NULL;
1108         OCSP_RESPONSE *rsp = NULL;
1109         struct pollfd pfd[1];
1110
1111         if (req_timeout != -1)
1112                 BIO_set_nbio(cbio, 1);
1113
1114         rv = BIO_do_connect(cbio);
1115
1116         if ((rv <= 0) && ((req_timeout == -1) || !BIO_should_retry(cbio))) {
1117                 BIO_puts(err, "Error connecting BIO\n");
1118                 return NULL;
1119         }
1120         if (BIO_get_fd(cbio, &fd) < 0) {
1121                 BIO_puts(err, "Can't get connection fd\n");
1122                 goto err;
1123         }
1124         if (req_timeout != -1 && rv <= 0) {
1125                 pfd[0].fd = fd;
1126                 pfd[0].events = POLLOUT;
1127                 rv = poll(pfd, 1, req_timeout * 1000);
1128                 if (rv == 0) {
1129                         BIO_puts(err, "Timeout on connect\n");
1130                         return NULL;
1131                 }
1132                 if (rv == -1) {
1133                         BIO_puts(err, "Poll error\n");
1134                         return NULL;
1135                 }
1136         }
1137         ctx = OCSP_sendreq_new(cbio, path, NULL, -1);
1138         if (!ctx)
1139                 return NULL;
1140
1141         for (i = 0; i < sk_CONF_VALUE_num(headers); i++) {
1142                 CONF_VALUE *hdr = sk_CONF_VALUE_value(headers, i);
1143                 if (!OCSP_REQ_CTX_add1_header(ctx, hdr->name, hdr->value))
1144                         goto err;
1145         }
1146
1147         if (!OCSP_REQ_CTX_set1_req(ctx, req))
1148                 goto err;
1149
1150         for (;;) {
1151                 rv = OCSP_sendreq_nbio(&rsp, ctx);
1152                 if (rv != -1)
1153                         break;
1154                 if (req_timeout == -1)
1155                         continue;
1156                 pfd[0].fd = fd;
1157                 if (BIO_should_read(cbio))
1158                         pfd[0].events = POLLIN;
1159                 else if (BIO_should_write(cbio))
1160                         pfd[0].events = POLLOUT;
1161                 else {
1162                         BIO_puts(err, "Unexpected retry condition\n");
1163                         goto err;
1164                 }
1165                 rv = poll(pfd, 1, req_timeout * 1000);
1166                 if (rv == 0) {
1167                         BIO_puts(err, "Timeout on request\n");
1168                         break;
1169                 }
1170                 if (rv == -1 || (pfd[0].revents & (POLLERR|POLLNVAL))) {
1171                         BIO_puts(err, "Poll error\n");
1172                         break;
1173                 }
1174         }
1175  err:
1176         OCSP_REQ_CTX_free(ctx);
1177
1178         return rsp;
1179 }
1180
1181 OCSP_RESPONSE *
1182 process_responder(BIO * err, OCSP_REQUEST * req,
1183     char *host, char *path, char *port, int use_ssl,
1184     STACK_OF(CONF_VALUE) * headers,
1185     int req_timeout)
1186 {
1187         BIO *cbio = NULL;
1188         SSL_CTX *ctx = NULL;
1189         OCSP_RESPONSE *resp = NULL;
1190         cbio = BIO_new_connect(host);
1191         if (!cbio) {
1192                 BIO_printf(err, "Error creating connect BIO\n");
1193                 goto end;
1194         }
1195         if (port)
1196                 BIO_set_conn_port(cbio, port);
1197         if (use_ssl == 1) {
1198                 BIO *sbio;
1199                 ctx = SSL_CTX_new(SSLv23_client_method());
1200                 if (ctx == NULL) {
1201                         BIO_printf(err, "Error creating SSL context.\n");
1202                         goto end;
1203                 }
1204                 SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1205                 sbio = BIO_new_ssl(ctx, 1);
1206                 cbio = BIO_push(sbio, cbio);
1207         }
1208         resp = query_responder(err, cbio, path, headers, req, req_timeout);
1209         if (!resp)
1210                 BIO_printf(bio_err, "Error querying OCSP responder\n");
1211  end:
1212         BIO_free_all(cbio);
1213         SSL_CTX_free(ctx);
1214         return resp;
1215 }
1216
1217 #endif