diff --git a/src/ocsp.c b/src/ocsp.c index 96dd72651..d3b9e8a69 100644 --- a/src/ocsp.c +++ b/src/ocsp.c @@ -266,9 +266,9 @@ static int GetOcspStatus(WOLFSSL_OCSP* ocsp, OcspRequest* request, * entry The OCSP entry for this certificate. * returns OCSP_LOOKUP_FAIL when the response is bad and 0 otherwise. */ -static int CheckResponse(WOLFSSL_OCSP* ocsp, byte* response, int responseSz, - buffer* responseBuffer, CertStatus* status, - OcspEntry* entry, OcspRequest* ocspRequest) +WOLFSSL_LOCAL int CheckOcspResponse(WOLFSSL_OCSP *ocsp, byte *response, int responseSz, + WOLFSSL_BUFFER_INFO *responseBuffer, CertStatus *status, + OcspEntry *entry, OcspRequest *ocspRequest) { #ifdef WOLFSSL_SMALL_STACK CertStatus* newStatus; @@ -428,7 +428,7 @@ int CheckOcspRequest(WOLFSSL_OCSP* ocsp, OcspRequest* ocspRequest, ret = ocsp->statusCb(ssl, ioCtx); if (ret == 0) { ret = wolfSSL_get_ocsp_response(ssl, &response); - ret = CheckResponse(ocsp, response, ret, responseBuffer, status, + ret = CheckOcspResponse(ocsp, response, ret, responseBuffer, status, entry, NULL); if (response != NULL) XFREE(response, NULL, DYNAMIC_TYPE_OPENSSL); @@ -476,7 +476,7 @@ int CheckOcspRequest(WOLFSSL_OCSP* ocsp, OcspRequest* ocspRequest, XFREE(request, ocsp->cm->heap, DYNAMIC_TYPE_OCSP); if (responseSz >= 0 && response) { - ret = CheckResponse(ocsp, response, responseSz, responseBuffer, status, + ret = CheckOcspResponse(ocsp, response, responseSz, responseBuffer, status, entry, ocspRequest); } diff --git a/src/ssl.c b/src/ssl.c index ec92d84b4..57056978c 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -5716,6 +5716,23 @@ int wolfSSL_CertManagerCheckOCSP(WOLFSSL_CERT_MANAGER* cm, byte* der, int sz) return ret == 0 ? WOLFSSL_SUCCESS : ret; } +WOLFSSL_API int wolfSSL_CertManagerCheckOCSPResponse(WOLFSSL_CERT_MANAGER *cm, + byte *response, int responseSz, buffer *responseBuffer, + CertStatus *status, OcspEntry *entry, OcspRequest *ocspRequest) +{ + int ret; + + WOLFSSL_ENTER("wolfSSL_CertManagerCheckOCSP_Staple"); + if (cm == NULL || response == NULL) + return BAD_FUNC_ARG; + if (cm->ocspEnabled == 0) + return WOLFSSL_SUCCESS; + + ret = CheckOcspResponse(cm->ocsp, response, responseSz, responseBuffer, status, + entry, ocspRequest); + + return ret == 0 ? WOLFSSL_SUCCESS : ret; +} int wolfSSL_CertManagerSetOCSPOverrideURL(WOLFSSL_CERT_MANAGER* cm, const char* url) diff --git a/wolfssl/internal.h b/wolfssl/internal.h index b374a25c3..f5bb60dd3 100644 --- a/wolfssl/internal.h +++ b/wolfssl/internal.h @@ -1793,33 +1793,17 @@ struct WOLFSSL_CIPHER { }; -typedef struct OcspEntry OcspEntry; - -#ifdef NO_SHA - #define OCSP_DIGEST_SIZE WC_SHA256_DIGEST_SIZE -#else - #define OCSP_DIGEST_SIZE WC_SHA_DIGEST_SIZE -#endif - #ifdef NO_ASN /* no_asn won't have */ typedef struct CertStatus CertStatus; #endif -struct OcspEntry { - OcspEntry* next; /* next entry */ - byte issuerHash[OCSP_DIGEST_SIZE]; /* issuer hash */ - byte issuerKeyHash[OCSP_DIGEST_SIZE]; /* issuer public key hash */ - CertStatus* status; /* OCSP response list */ - int totalStatus; /* number on list */ -}; - - #ifndef HAVE_OCSP typedef struct WOLFSSL_OCSP WOLFSSL_OCSP; #endif /* wolfSSL OCSP controller */ +#ifdef HAVE_OCSP struct WOLFSSL_OCSP { WOLFSSL_CERT_MANAGER* cm; /* pointer back to cert manager */ OcspEntry* ocspList; /* OCSP response list */ @@ -1829,6 +1813,7 @@ struct WOLFSSL_OCSP { int(*statusCb)(WOLFSSL*, void*); #endif }; +#endif #ifndef MAX_DATE_SIZE #define MAX_DATE_SIZE 32 diff --git a/wolfssl/ocsp.h b/wolfssl/ocsp.h index be426865e..e49453633 100644 --- a/wolfssl/ocsp.h +++ b/wolfssl/ocsp.h @@ -54,14 +54,16 @@ WOLFSSL_LOCAL int CheckCertOCSP_ex(WOLFSSL_OCSP*, DecodedCert*, WOLFSSL_BUFFER_INFO* responseBuffer, WOLFSSL* ssl); WOLFSSL_LOCAL int CheckOcspRequest(WOLFSSL_OCSP* ocsp, OcspRequest* ocspRequest, WOLFSSL_BUFFER_INFO* responseBuffer); - +WOLFSSL_LOCAL int CheckOcspResponse(WOLFSSL_OCSP *ocsp, byte *response, int responseSz, + WOLFSSL_BUFFER_INFO *responseBuffer, CertStatus *status, + OcspEntry *entry, OcspRequest *ocspRequest); #if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) -WOLFSSL_API int wolfSSL_OCSP_resp_find_status(WOLFSSL_OCSP_BASICRESP *bs, - WOLFSSL_OCSP_CERTID* id, int* status, int* reason, - WOLFSSL_ASN1_TIME** revtime, WOLFSSL_ASN1_TIME** thisupd, - WOLFSSL_ASN1_TIME** nextupd); + WOLFSSL_API int wolfSSL_OCSP_resp_find_status(WOLFSSL_OCSP_BASICRESP *bs, + WOLFSSL_OCSP_CERTID *id, int *status, int *reason, + WOLFSSL_ASN1_TIME **revtime, WOLFSSL_ASN1_TIME **thisupd, + WOLFSSL_ASN1_TIME **nextupd); WOLFSSL_API const char *wolfSSL_OCSP_cert_status_str(long s); WOLFSSL_API int wolfSSL_OCSP_check_validity(WOLFSSL_ASN1_TIME* thisupd, WOLFSSL_ASN1_TIME* nextupd, long sec, long maxsec); diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h index f6cb5b568..ac9598a17 100644 --- a/wolfssl/ssl.h +++ b/wolfssl/ssl.h @@ -100,7 +100,6 @@ #endif #endif - #ifdef __cplusplus extern "C" { #endif @@ -772,6 +771,11 @@ WOLFSSL_API const char* wolfSSL_ERR_reason_error_string(unsigned long); #define DECLARE_STACK_OF(x) WOLF_STACK_OF(x); #endif +#if defined(HAVE_OCSP) +#include "wolfssl/ocsp.h" +#include "wolfssl/wolfcrypt/asn.h" +#endif + WOLFSSL_API int wolfSSL_sk_X509_push(WOLF_STACK_OF(WOLFSSL_X509_NAME)* sk, WOLFSSL_X509* x509); WOLFSSL_API WOLFSSL_X509* wolfSSL_sk_X509_pop(WOLF_STACK_OF(WOLFSSL_X509_NAME)* sk); @@ -2115,6 +2119,11 @@ WOLFSSL_API void* wolfSSL_GetRsaDecCtx(WOLFSSL* ssl); #ifdef HAVE_CRL_IO WOLFSSL_API int wolfSSL_CertManagerSetCRL_IOCb(WOLFSSL_CERT_MANAGER*, CbCrlIO); +#endif +#if defined(HAVE_OCSP) + WOLFSSL_API int wolfSSL_CertManagerCheckOCSPResponse(WOLFSSL_CERT_MANAGER *, + byte *response, int responseSz, WOLFSSL_BUFFER_INFO *responseBuffer, + CertStatus *status, OcspEntry *entry, OcspRequest *ocspRequest); #endif WOLFSSL_API int wolfSSL_CertManagerCheckOCSP(WOLFSSL_CERT_MANAGER*, unsigned char*, int sz); diff --git a/wolfssl/wolfcrypt/asn.h b/wolfssl/wolfcrypt/asn.h index bbb8911fc..ca4e7e148 100644 --- a/wolfssl/wolfcrypt/asn.h +++ b/wolfssl/wolfcrypt/asn.h @@ -1186,6 +1186,22 @@ struct OcspRequest { void* ssl; }; +typedef struct OcspEntry OcspEntry; + +#ifdef NO_SHA +#define OCSP_DIGEST_SIZE WC_SHA256_DIGEST_SIZE +#else +#define OCSP_DIGEST_SIZE WC_SHA_DIGEST_SIZE +#endif + +struct OcspEntry +{ + OcspEntry *next; /* next entry */ + byte issuerHash[OCSP_DIGEST_SIZE]; /* issuer hash */ + byte issuerKeyHash[OCSP_DIGEST_SIZE]; /* issuer public key hash */ + CertStatus *status; /* OCSP response list */ + int totalStatus; /* number on list */ +}; WOLFSSL_LOCAL void InitOcspResponse(OcspResponse*, CertStatus*, byte*, word32); WOLFSSL_LOCAL int OcspResponseDecode(OcspResponse*, void*, void* heap, int);