#include <ocsp.h>

Public Member Functions
const std::vector< X509_Certificate > &	certificates () const

Certificate_Status_Code	check_signature (const std::vector< Certificate_Store * > &trust_roots, const std::vector< std::shared_ptr< const X509_Certificate >> &cert_path={}) const

const X509_Time &	produced_at () const

const std::vector< uint8_t > &	raw_bits () const

	Response ()=default

	Response (Certificate_Status_Code status)

	Response (const std::vector< uint8_t > &response_bits)

	Response (const uint8_t response_bits[], size_t response_bits_len)

const std::vector< uint8_t > &	signer_key_hash () const

const X509_DN &	signer_name () const

Response_Status_Code	status () const

Certificate_Status_Code	status_for (const X509_Certificate &issuer, const X509_Certificate &subject, std::chrono::system_clock::time_point ref_time=std::chrono::system_clock::now(), std::chrono::seconds max_age=std::chrono::seconds::zero()) const

Certificate_Status_Code	verify_signature (const X509_Certificate &issuer) const

Detailed Description

OCSP response.

Note this class is only usable as an OCSP client

Definition at line 85 of file ocsp.h.

Constructor & Destructor Documentation

Botan::OCSP::Response::Response ( )

default

Creates an empty OCSP response.

Botan::OCSP::Response::Response ( Certificate_Status_Code status )

Create a fake OCSP response from a given status code.

Parameters

status the status code the check functions will return

Definition at line 93 of file ocsp.cpp.

References status(), and Botan::OCSP::Successful.

    {
    m_status = Response_Status_Code::Successful;
    m_dummy_response_status = status;
    }

Botan::OCSP::Response::Response ( const std::vector< uint8_t > & response_bits )

inline

Parses an OCSP response.

Parameters

response_bits response bits received

Definition at line 103 of file ocsp.h.

                                                         :
          Response(response_bits.data(), response_bits.size())
          {}

Botan::OCSP::Response::Response	(	const uint8_t	response_bits[],
		size_t	response_bits_len
	)

Parses an OCSP response.

Parameters

response_bits	response bits received
response_bits_len	length of response in bytes

Definition at line 99 of file ocsp.cpp.

                                                                           :
    m_response_bits(response_bits, response_bits + response_bits_len)
    {
    m_dummy_response_status = Certificate_Status_Code::OCSP_RESPONSE_INVALID;
 
    BER_Decoder response_outer = BER_Decoder(m_response_bits).start_cons(SEQUENCE);
 
    size_t resp_status = 0;
 
    response_outer.decode(resp_status, ENUMERATED, UNIVERSAL);
 
    m_status = static_cast<Response_Status_Code>(resp_status);
 
    if(m_status != Response_Status_Code::Successful)
       { return; }
 
    if(response_outer.more_items())
       {
       BER_Decoder response_bytes =
          response_outer.start_cons(ASN1_Tag(0), CONTEXT_SPECIFIC).start_cons(SEQUENCE);
 
       response_bytes.decode_and_check(OID("1.3.6.1.5.5.7.48.1.1"),
                                       "Unknown response type in OCSP response");
 
       BER_Decoder basicresponse =
          BER_Decoder(response_bytes.get_next_octet_string()).start_cons(SEQUENCE);
 
       basicresponse.start_cons(SEQUENCE)
            .raw_bytes(m_tbs_bits)
          .end_cons()
          .decode(m_sig_algo)
          .decode(m_signature, BIT_STRING);
       decode_optional_list(basicresponse, ASN1_Tag(0), m_certs);
 
       size_t responsedata_version = 0;
       Extensions extensions;
 
       BER_Decoder(m_tbs_bits)
          .decode_optional(responsedata_version, ASN1_Tag(0),
                           ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC))
 
          .decode_optional(m_signer_name, ASN1_Tag(1),
                           ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC))
 
          .decode_optional_string(m_key_hash, OCTET_STRING, 2,
                                  ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC))
 
          .decode(m_produced_at)
 
          .decode_list(m_responses)
 
          .decode_optional(extensions, ASN1_Tag(1),
                           ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC));
       }
 
    response_outer.end_cons();
    }

Member Function Documentation

const std::vector<X509_Certificate>& Botan::OCSP::Response::certificates ( ) const

inline

Returns: the certificate chain, if provided in response

Definition at line 180 of file ocsp.h.

180 { return m_certs; }

Certificate_Status_Code Botan::OCSP::Response::check_signature	(	const std::vector< Certificate_Store * > &	trust_roots,
		const std::vector< std::shared_ptr< const X509_Certificate >> &	cert_path = `{}`
	)		const

Check signature and return status The optional cert_path is the (already validated!) certificate path of the end entity which is being inquired about

Parameters

trust_roots	list of certstores containing trusted roots
cert_path	optionally, the (already verified!) certificate path for the certificate this is an OCSP response for. This is necessary to find the correct intermediate CA in some cases.

Definition at line 188 of file ocsp.cpp.

References Botan::CRL_SIGN, Botan::X509_DN::empty(), Botan::OCSP_ISSUER_NOT_FOUND, Botan::OCSP_RESPONSE_INVALID, Botan::OCSP_RESPONSE_MISSING_KEYUSAGE, and verify_signature().

    {
    if (m_responses.empty())
       return m_dummy_response_status;
 
    std::shared_ptr<const X509_Certificate> signing_cert;
 
    for(size_t i = 0; i != trusted_roots.size(); ++i)
       {
       if(m_signer_name.empty() && m_key_hash.empty())
          return Certificate_Status_Code::OCSP_RESPONSE_INVALID;
 
       if(!m_signer_name.empty())
          {
          signing_cert = trusted_roots[i]->find_cert(m_signer_name, std::vector<uint8_t>());
          if(signing_cert)
             {
             break;
             }
          }
 
       if(m_key_hash.size() > 0)
          {
          signing_cert = trusted_roots[i]->find_cert_by_pubkey_sha1(m_key_hash);
          if(signing_cert)
             {
             break;
             }
          }
       }
 
    if(!signing_cert && ee_cert_path.size() > 1)
       {
       // End entity cert is not allowed to sign their own OCSP request :)
       for(size_t i = 1; i < ee_cert_path.size(); ++i)
          {
          // Check all CA certificates in the (assumed validated) EE cert path
          if(!m_signer_name.empty() && ee_cert_path[i]->subject_dn() == m_signer_name)
             {
             signing_cert = ee_cert_path[i];
             break;
             }
 
          if(m_key_hash.size() > 0 && ee_cert_path[i]->subject_public_key_bitstring_sha1() == m_key_hash)
             {
             signing_cert = ee_cert_path[i];
             break;
             }
          }
       }
 
    if(!signing_cert && m_certs.size() > 0)
       {
       for(size_t i = 0; i < m_certs.size(); ++i)
          {
          // Check all CA certificates in the (assumed validated) EE cert path
          if(!m_signer_name.empty() && m_certs[i].subject_dn() == m_signer_name)
             {
             signing_cert = std::make_shared<const X509_Certificate>(m_certs[i]);
             break;
             }
 
          if(m_key_hash.size() > 0 && m_certs[i].subject_public_key_bitstring_sha1() == m_key_hash)
             {
             signing_cert = std::make_shared<const X509_Certificate>(m_certs[i]);
             break;
             }
          }
       }
 
    if(!signing_cert)
       return Certificate_Status_Code::OCSP_ISSUER_NOT_FOUND;
 
    if(!signing_cert->allowed_usage(CRL_SIGN) &&
       !signing_cert->allowed_extended_usage("PKIX.OCSPSigning"))
       {
       return Certificate_Status_Code::OCSP_RESPONSE_MISSING_KEYUSAGE;
       }
 
    return this->verify_signature(*signing_cert);
    }

const X509_Time& Botan::OCSP::Response::produced_at ( ) const

inline

Returns: the time this OCSP response was supposedly produced at

Definition at line 142 of file ocsp.h.

142 { return m_produced_at; }

const std::vector<uint8_t>& Botan::OCSP::Response::raw_bits ( ) const

inline

Definition at line 154 of file ocsp.h.

154 { return m_response_bits; }

const std::vector<uint8_t>& Botan::OCSP::Response::signer_key_hash ( ) const

inline

Returns: key hash, if provided in response (may be empty)

Definition at line 152 of file ocsp.h.

152 { return m_key_hash; }

const X509_DN& Botan::OCSP::Response::signer_name ( ) const

inline

Returns: DN of signer, if provided in response (may be empty)

Definition at line 147 of file ocsp.h.

147 { return m_signer_name; }

Response_Status_Code Botan::OCSP::Response::status ( ) const

inline

Returns: the status of the response

Definition at line 137 of file ocsp.h.

Referenced by Response().

137 { return m_status; }

Certificate_Status_Code Botan::OCSP::Response::status_for	(	const X509_Certificate &	issuer,
		const X509_Certificate &	subject,
		std::chrono::system_clock::time_point	ref_time = `std::chrono::system_clock::now()`,
		std::chrono::seconds	max_age = `std::chrono::seconds::zero()`
	)		const

Searches the OCSP response for issuer and subject certificate.

Parameters

issuer	issuer certificate
subject	subject certificate
ref_time	the reference time
max_age	the maximum age the response should be considered valid if next_update is not set

Returns: OCSP status code, possible values: CERT_IS_REVOKED, OCSP_NOT_YET_VALID, OCSP_HAS_EXPIRED, OCSP_IS_TOO_OLD, OCSP_RESPONSE_GOOD, OCSP_BAD_STATUS, OCSP_CERT_NOT_LISTED

Definition at line 271 of file ocsp.cpp.

References Botan::CERT_IS_REVOKED, Botan::OCSP_BAD_STATUS, Botan::OCSP_CERT_NOT_LISTED, Botan::OCSP_HAS_EXPIRED, Botan::OCSP_IS_TOO_OLD, Botan::OCSP_NOT_YET_VALID, and Botan::OCSP_RESPONSE_GOOD.

    {
    if(m_responses.empty())
       { return m_dummy_response_status; }
 
    for(const auto& response : m_responses)
       {
       if(response.certid().is_id_for(issuer, subject))
          {
          X509_Time x509_ref_time(ref_time);
 
          if(response.cert_status() == 1)
             { return Certificate_Status_Code::CERT_IS_REVOKED; }
 
          if(response.this_update() > x509_ref_time)
             { return Certificate_Status_Code::OCSP_NOT_YET_VALID; }
 
          if(response.next_update().time_is_set())
             {
             if(x509_ref_time > response.next_update())
                { return Certificate_Status_Code::OCSP_HAS_EXPIRED; }
             }
          else if(max_age > std::chrono::seconds::zero() && ref_time - response.this_update().to_std_timepoint() > max_age)
             { return Certificate_Status_Code::OCSP_IS_TOO_OLD; }
 
          if(response.cert_status() == 0)
             { return Certificate_Status_Code::OCSP_RESPONSE_GOOD; }
          else
             { return Certificate_Status_Code::OCSP_BAD_STATUS; }
          }
       }
 
    return Certificate_Status_Code::OCSP_CERT_NOT_LISTED;
    }

Certificate_Status_Code Botan::OCSP::Response::verify_signature ( const X509_Certificate & issuer ) const

Verify that issuer's key signed this response

Parameters

issuer certificate of issuer

Returns: if signature valid OCSP_SIGNATURE_OK else an error code

Definition at line 157 of file ocsp.cpp.

References Botan::AlgorithmIdentifier::get_oid(), Botan::OCSP_RESPONSE_INVALID, Botan::OCSP_SIGNATURE_ERROR, Botan::OCSP_SIGNATURE_OK, Botan::ASN1::put_in_sequence(), Botan::split_on(), Botan::X509_Certificate::subject_public_key(), Botan::OID::to_formatted_string(), and Botan::PK_Verifier::verify_message().

Referenced by check_signature().

    {
    if (m_responses.empty())
       return m_dummy_response_status;
 
    try
       {
       std::unique_ptr<Public_Key> pub_key(issuer.subject_public_key());
 
       const std::vector<std::string> sig_info =
          split_on(m_sig_algo.get_oid().to_formatted_string(), '/');
 
       if(sig_info.size() != 2 || sig_info[0] != pub_key->algo_name())
          return Certificate_Status_Code::OCSP_RESPONSE_INVALID;
 
       std::string padding = sig_info[1];
       const Signature_Format format = pub_key->default_x509_signature_format();
 
       PK_Verifier verifier(*pub_key, padding, format);
 
       if(verifier.verify_message(ASN1::put_in_sequence(m_tbs_bits), m_signature))
          return Certificate_Status_Code::OCSP_SIGNATURE_OK;
       else
          return Certificate_Status_Code::OCSP_SIGNATURE_ERROR;
       }
    catch(Exception&)
       {
       return Certificate_Status_Code::OCSP_SIGNATURE_ERROR;
       }
    }

The documentation for this class was generated from the following files:

src/lib/x509/ocsp.h
src/lib/x509/ocsp.cpp

Public Member Functions

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation