OCSP_CERTID *OCSP_cert_to_id (const EVP_MD * dgst, X509 * subject, X509 * issuer)
{
X509_NAME *iname;
ASN1_INTEGER *serial;
ASN1_BIT_STRING *ikey;
#ifndef OPENSSL_NO_SHA1
if (!dgst)
dgst = EVP_sha1 ();
#endif
if (subject)
{
iname = X509_get_issuer_name (subject);
serial = X509_get_serialNumber (subject);
}
else
{
iname = X509_get_subject_name (issuer);
serial = NULL;
}
ikey = X509_get0_pubkey_bitstr (issuer);
return OCSP_cert_id_new (dgst, iname, ikey, serial);
}
static OCSP_BASICRESP *make_dummy_resp(void)
{
const unsigned char namestr[] = "openssl.example.com";
unsigned char keybytes[128] = {7};
OCSP_BASICRESP *bs = OCSP_BASICRESP_new();
OCSP_BASICRESP *bs_out = NULL;
OCSP_CERTID *cid = NULL;
ASN1_TIME *thisupd = ASN1_TIME_set(NULL, time(NULL));
ASN1_TIME *nextupd = ASN1_TIME_set(NULL, time(NULL) + 200);
X509_NAME *name = X509_NAME_new();
ASN1_BIT_STRING *key = ASN1_BIT_STRING_new();
ASN1_INTEGER *serial = ASN1_INTEGER_new();
if (!X509_NAME_add_entry_by_NID(name, NID_commonName, MBSTRING_ASC,
namestr, -1, -1, 1)
|| !ASN1_BIT_STRING_set(key, keybytes, sizeof(keybytes))
|| !ASN1_INTEGER_set_uint64(serial, (uint64_t)1))
goto err;
cid = OCSP_cert_id_new(EVP_sha256(), name, key, serial);
if (!TEST_ptr(bs)
|| !TEST_ptr(thisupd)
|| !TEST_ptr(nextupd)
|| !TEST_ptr(cid)
|| !TEST_true(OCSP_basic_add1_status(bs, cid,
V_OCSP_CERTSTATUS_UNKNOWN,
0, NULL, thisupd, nextupd)))
goto err;
bs_out = bs;
bs = NULL;
err:
ASN1_TIME_free(thisupd);
ASN1_TIME_free(nextupd);
ASN1_BIT_STRING_free(key);
ASN1_INTEGER_free(serial);
OCSP_CERTID_free(cid);
OCSP_BASICRESP_free(bs);
X509_NAME_free(name);
return bs_out;
}
static int openssl_ocsp_request_new(lua_State*L)
{
OCSP_REQUEST *req = NULL;
if (lua_isstring(L, 1))
{
BIO* bio = load_bio_object(L, 1);
req = d2i_OCSP_REQUEST_bio(bio, NULL);
/*
if (!req)
{
BIO_reset(bio);
req = PEM_read_bio_OCSP_REQUEST(bio, NULL, NULL);
}
*/
BIO_free(bio);
}
else
{
X509 *issuer = CHECK_OBJECT(1, X509, "openssl.x509");
X509_NAME *iname = X509_get_subject_name(issuer);
ASN1_BIT_STRING *ikey = X509_get0_pubkey_bitstr(issuer);
OCSP_CERTID *id = NULL;
OCSP_ONEREQ *one;
char buf[1024];
int nonce = lua_gettop(L) > 2 ? auxiliar_checkboolean(L, 3) : 0;
req = OCSP_REQUEST_new();
if (lua_istable(L, 2))
{
int len = lua_rawlen(L, 2);
int i;
for (i = 1; i <= len; i++)
{
lua_rawgeti(L, 2, i);
if (auxiliar_isclass(L, "openssl.x509", -1))
{
X509 *cert = CHECK_OBJECT(2, X509, "openssl.x509");
id = OCSP_cert_to_id(NULL, cert, issuer);
one = OCSP_request_add0_id(req, id);
}
else
{
size_t len;
char *serial = (char *)luaL_checklstring(L, -1, &len);
ASN1_INTEGER *sno = ASN1_INTEGER_new();
BIO* bio = BIO_new(BIO_s_mem());
BIO_write(bio, serial, len);
if (a2i_ASN1_INTEGER(bio, sno, buf, 1024) == 1)
{
id = OCSP_cert_id_new(EVP_sha1(), iname, ikey, sno);
one = OCSP_request_add0_id(req, id);
};
ASN1_INTEGER_free(sno);
BIO_free(bio);
}
lua_pop(L, 1);
}
}
else if (auxiliar_isclass(L, "openssl.x509", 2))
{
X509 *cert = CHECK_OBJECT(2, X509, "openssl.x509");
id = OCSP_cert_to_id(NULL, cert, issuer);
one = OCSP_request_add0_id(req, id);
}
else
{
ASN1_INTEGER *sno = ASN1_INTEGER_new();
BIO* bio = load_bio_object(L, 2);
if (a2i_ASN1_INTEGER(bio, sno, buf, 1024) == 1)
{
id = OCSP_cert_id_new(EVP_sha1(), iname, ikey, sno);
one = OCSP_request_add0_id(req, id);
};
ASN1_INTEGER_free(sno);
BIO_free(bio);
}
if (nonce)
OCSP_request_add1_nonce(req, NULL, -1);
}
if(req) {
PUSH_OBJECT(req, "openssl.ocsp_request");
}else
lua_pushnil(L);
return 1;
}
