BIO_printf (bio_err, "-out file     output filename\n"); BIO_printf (bio_err, "-issuer file  issuer certificate\n"); BIO_printf (bio_err, "-cert file    certificate to check\n"); BIO_printf (bio_err, "-serial n     serial number to check\n"); BIO_printf (bio_err, "-signer file  certificate to sign OCSP request with\n"); BIO_printf (bio_err, "-signkey file private key to sign OCSP request with\n"); BIO_printf (bio_err, "-req_text     print text form of request\n"); BIO_printf (bio_err, "-resp_text    print text form of response\n"); BIO_printf (bio_err, "-text         print text form of request and response\n"); BIO_printf (bio_err, "-reqout file  write DER encoded OCSP request to \"file\"\n"); BIO_printf (bio_err, "-respout file write DER encoded OCSP reponse to \"file\"\n"); BIO_printf (bio_err, "-reqin file   read DER encoded OCSP request from \"file\"\n"); BIO_printf (bio_err, "-respin file  read DER encoded OCSP reponse from \"file\"\n"); BIO_printf (bio_err, "-nonce        add OCSP nonce to request\n"); BIO_printf (bio_err, "-no_nonce     don't add OCSP nonce to request\n"); BIO_printf (bio_err, "-host host:n  send OCSP request to host on port n\n"); BIO_printf (bio_err, "-path         path to use in OCSP request\n"); BIO_printf (bio_err, "-CApath dir   trusted certificates directory\n"); BIO_printf (bio_err, "-CAfile file  trusted certificates file\n"); BIO_printf (bio_err, "-VAfile file  validator certificates file\n"); BIO_printf (bio_err, "-noverify     don't verify response\n");
BIO_printf (bio_err, "-out file          output filename\n"); BIO_printf (bio_err, "-issuer file       issuer certificate\n"); BIO_printf (bio_err, "-cert file         certificate to check\n"); BIO_printf (bio_err, "-serial n          serial number to check\n"); BIO_printf (bio_err, "-signer file       certificate to sign OCSP request with\n"); BIO_printf (bio_err, "-signkey file      private key to sign OCSP request with\n"); BIO_printf (bio_err, "-sign_certs file   additional certificates to include in signed request"); BIO_printf (bio_err, "-no_certs          don't include any certificates in signed request"); BIO_printf (bio_err, "-req_text          print text form of request\n"); BIO_printf (bio_err, "-resp_text         print text form of response\n"); BIO_printf (bio_err, "-text              print text form of request and response\n"); BIO_printf (bio_err, "-reqout file       write DER encoded OCSP request to \"file\"\n"); BIO_printf (bio_err, "-respout file      write DER encoded OCSP reponse to \"file\"\n"); BIO_printf (bio_err, "-reqin file        read DER encoded OCSP request from \"file\"\n"); BIO_printf (bio_err, "-respin file       read DER encoded OCSP reponse from \"file\"\n"); BIO_printf (bio_err, "-nonce             add OCSP nonce to request\n"); BIO_printf (bio_err, "-no_nonce          don't add OCSP nonce to request\n"); BIO_printf (bio_err, "-host host:n       send OCSP request to host on port n\n"); BIO_printf (bio_err, "-path              path to use in OCSP request\n"); BIO_printf (bio_err, "-CApath dir        trusted certificates directory\n"); BIO_printf (bio_err, "-CAfile file       trusted certificates file\n"); BIO_printf (bio_err, "-VAfile file       validator certificates file\n"); BIO_printf (bio_err, "-noverify          don't verify response at all\n"); BIO_printf (bio_err, "-verify_certs file additional certificates to search for signer"); BIO_printf (bio_err, "-trust_other       don't verify additional certificates"); BIO_printf (bio_err, "-no_intern         don't search certificates contained in response for signer"); BIO_printf (bio_err, "-no_sig_verify     don't check signature on response"); BIO_printf (bio_err, "-no_cert_verify    don't check signing certificate"); BIO_printf (bio_err, "-no_chain          don't chain verify response"); BIO_printf (bio_err, "-no_cert_checks    don't do additional checks on signing certificate");
int MAIN(int argc, char **argv)	{	char **args;	char *host = NULL, *path = "/";	char *reqin = NULL, *respin = NULL;	char *reqout = NULL, *respout = NULL;	char *signfile = NULL, *keyfile = NULL;	char *outfile = NULL;	int add_nonce = 1, noverify = 0;	OCSP_REQUEST *req = NULL;	OCSP_RESPONSE *resp = NULL;	OCSP_BASICRESP *bs = NULL;	X509 *issuer = NULL, *cert = NULL;	X509 *signer = NULL;	EVP_PKEY *key = NULL;	BIO *cbio = NULL, *derbio = NULL;	BIO *out = NULL;	int req_text = 0, resp_text = 0;	char *CAfile = NULL, *CApath = NULL;        char *VAfile = NULL;	X509_STORE *store = NULL;        STACK_OF(X509) *VAstore = NULL;	int ret = 1;	int badarg = 0;	int i;	STACK *reqnames = NULL;	STACK_OF(OCSP_CERTID) *ids = NULL;	if (bio_err == NULL) bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);	ERR_load_crypto_strings();	args = argv + 1;	reqnames = sk_new_null();	ids = sk_OCSP_CERTID_new_null();	while (!badarg && *args && *args[0] == '-')		{		if (!strcmp(*args, "-out"))			{			if (args[1])				{				args++;				outfile = *args;				}			else badarg = 1;			}		else if (!strcmp(*args, "-host"))			{			if (args[1])				{				args++;				host = *args;				}			else badarg = 1;			}		else if (!strcmp(*args, "-noverify"))			noverify = 1;		else if (!strcmp(*args, "-nonce"))			add_nonce = 2;		else if (!strcmp(*args, "-no_nonce"))			add_nonce = 0;		else if (!strcmp(*args, "-text"))			{			req_text = 1;			resp_text = 1;			}		else if (!strcmp(*args, "-req_text"))			req_text = 1;		else if (!strcmp(*args, "-resp_text"))			resp_text = 1;		else if (!strcmp(*args, "-reqin"))			{			if (args[1])				{				args++;				reqin = *args;				}			else badarg = 1;			}		else if (!strcmp(*args, "-respin"))			{			if (args[1])				{				args++;				respin = *args;				}			else badarg = 1;			}		else if (!strcmp(*args, "-signer"))			{			if (args[1])				{				args++;				signfile = *args;				}			else badarg = 1;			}		else if (!strcmp (*args, "-VAfile"))			{			if (args[1])				{				args++;				VAfile = *args;				}			else badarg = 1;			}		else if (!strcmp (*args, "-CAfile"))			{			if (args[1])				{				args++;				CAfile = *args;				}			else badarg = 1;			}		else if (!strcmp (*args, "-CApath"))			{			if (args[1])				{				args++;				CApath = *args;				}			else badarg = 1;			}		 else if (!strcmp(*args, "-signkey"))			{			if (args[1])				{				args++;				keyfile = *args;				}			else badarg = 1;			}		else if (!strcmp(*args, "-reqout"))			{			if (args[1])				{				args++;				reqout = *args;				}			else badarg = 1;			}		else if (!strcmp(*args, "-respout"))			{			if (args[1])				{				args++;				respout = *args;				}			else badarg = 1;			}		 else if (!strcmp(*args, "-path"))			{			if (args[1])				{				args++;				path = *args;				}			else badarg = 1;			}		else if (!strcmp(*args, "-issuer"))			{			if (args[1])				{				args++;				X509_free(issuer);				issuer = load_cert(bio_err, *args, FORMAT_PEM);				if(!issuer) goto end;				}			else badarg = 1;			}		else if (!strcmp (*args, "-cert"))			{			if (args[1])				{				args++;				X509_free(cert);				cert = load_cert(bio_err, *args, FORMAT_PEM);				if(!cert) goto end;				if(!add_ocsp_cert(&req, cert, issuer, ids))					goto end;				if(!sk_push(reqnames, *args))					goto end;				}			else badarg = 1;			}		else if (!strcmp(*args, "-serial"))			{			if (args[1])				{				args++;				if(!add_ocsp_serial(&req, *args, issuer, ids))					goto end;				if(!sk_push(reqnames, *args))					goto end;				}			else badarg = 1;			}		else badarg = 1;		args++;		}	/* Have we anything to do? */	if (!req && !reqin && !respin) badarg = 1;	if (badarg)		{		BIO_printf (bio_err, "OCSP utility\n");		BIO_printf (bio_err, "Usage ocsp [options]\n");		BIO_printf (bio_err, "where options are\n");		BIO_printf (bio_err, "-out file     output filename\n");		BIO_printf (bio_err, "-issuer file  issuer certificate\n");		BIO_printf (bio_err, "-cert file    certificate to check\n");		BIO_printf (bio_err, "-serial n     serial number to check\n");		BIO_printf (bio_err, "-signer file  certificate to sign OCSP request with\n");		BIO_printf (bio_err, "-signkey file private key to sign OCSP request with\n");		BIO_printf (bio_err, "-req_text     print text form of request\n");		BIO_printf (bio_err, "-resp_text    print text form of response\n");		BIO_printf (bio_err, "-text         print text form of request and response\n");		BIO_printf (bio_err, "-reqout file  write DER encoded OCSP request to \"file\"\n");		BIO_printf (bio_err, "-respout file write DER encoded OCSP reponse to \"file\"\n");		BIO_printf (bio_err, "-reqin file   read DER encoded OCSP request from \"file\"\n");		BIO_printf (bio_err, "-respin file  read DER encoded OCSP reponse from \"file\"\n");		BIO_printf (bio_err, "-nonce        add OCSP nonce to request\n");		BIO_printf (bio_err, "-no_nonce     don't add OCSP nonce to request\n");		BIO_printf (bio_err, "-host host:n  send OCSP request to host on port n\n");		BIO_printf (bio_err, "-path         path to use in OCSP request\n");		BIO_printf (bio_err, "-CApath dir   trusted certificates directory\n");		BIO_printf (bio_err, "-CAfile file  trusted certificates file\n");		BIO_printf (bio_err, "-VAfile file  validator certificates file\n");		BIO_printf (bio_err, "-noverify     don't verify response\n");		goto end;		}	if(outfile) out = BIO_new_file(outfile, "w");	else out = BIO_new_fp(stdout, BIO_NOCLOSE);	if(!out)		{		BIO_printf(bio_err, "Error opening output file\n");		goto end;		}	if (!req && (add_nonce != 2)) add_nonce = 0;	if (!req && reqin)		{		derbio = BIO_new_file(reqin, "rb");		if (!derbio)			{			BIO_printf(bio_err, "Error Opening OCSP request file\n");			goto end;			}		req = d2i_OCSP_REQUEST_bio(derbio, NULL);		BIO_free(derbio);		if(!req)			{			BIO_printf(bio_err, "Error reading OCSP request\n");			goto end;			}		}	if (!req && (signfile || reqout || host || add_nonce))		{		BIO_printf(bio_err, "Need an OCSP request for this operation!\n");		goto end;		}	if (req && add_nonce) OCSP_request_add1_nonce(req, NULL, -1);	if (signfile)		{		if (!keyfile) keyfile = signfile;		signer = load_cert(bio_err, signfile, FORMAT_PEM);		if (!signer)			{			BIO_printf(bio_err, "Error loading signer certificate\n");			goto end;			}		key = load_key(bio_err, keyfile, FORMAT_PEM, NULL, NULL);		if (!key)			{			BIO_printf(bio_err, "Error loading signer private key\n");			goto end;			}		if (!OCSP_request_sign(req, signer, key, EVP_sha1(), NULL, 0))			{			BIO_printf(bio_err, "Error signing OCSP request\n");			goto end;			}		}	if (reqout)		{		derbio = BIO_new_file(reqout, "wb");		if (!derbio)			{			BIO_printf(bio_err, "Error opening file %s\n", reqout);			goto end;			}		i2d_OCSP_REQUEST_bio(derbio, req);		BIO_free(derbio);		}	if (req_text && req) OCSP_REQUEST_print(out, req, 0);	if (host)		{		cbio = BIO_new_connect(host);		if (!cbio)			{			BIO_printf(bio_err, "Error creating connect BIO\n");			goto end;			}		if (BIO_do_connect(cbio) <= 0)			{			BIO_printf(bio_err, "Error connecting BIO\n");			goto end;			}		resp = OCSP_sendreq_bio(cbio, path, req);		BIO_free(cbio);		cbio = NULL;		if (!resp)			{			BIO_printf(bio_err, "Error querying OCSP responsder\n");			goto end;			}		}	else if (respin)		{		derbio = BIO_new_file(respin, "rb");		if (!derbio)			{			BIO_printf(bio_err, "Error Opening OCSP response file\n");			goto end;			}		resp = d2i_OCSP_RESPONSE_bio(derbio, NULL);		BIO_free(derbio);		if(!resp)			{			BIO_printf(bio_err, "Error reading OCSP response\n");			goto end;			}			}	else		{		ret = 0;		goto end;		}	if (respout)		{		derbio = BIO_new_file(respout, "wb");		if(!derbio)			{			BIO_printf(bio_err, "Error opening file %s\n", respout);			goto end;			}		i2d_OCSP_RESPONSE_bio(derbio, resp);		BIO_free(derbio);		}	i = OCSP_response_status(resp);	if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL)		{		BIO_printf(out, "Responder Error: %s (%ld)\n",				OCSP_response_status_str(i), i);		ret = 0;		goto end;		}	if (resp_text) OCSP_RESPONSE_print(out, resp, 0);	store = setup_verify(bio_err, CAfile, CApath);	if(!store) goto end;        if (VAfile) VAstore = load_certs(bio_err, VAfile, FORMAT_PEM);	bs = OCSP_response_get1_basic(resp);	if (!bs)		{		BIO_printf(bio_err, "Error parsing response\n");		goto end;		}	if (!noverify)		{		if (req && (OCSP_check_nonce(req, bs) <= 0))			{			BIO_printf(bio_err, "Nonce Verify error\n");			goto end;			}		i = OCSP_basic_verify(bs, VAstore, store, OCSP_TRUSTOTHER);                if (i < 0) i = OCSP_basic_verify(bs, NULL, store, 0);		if(i <= 0)			{			BIO_printf(bio_err, "Response Verify Failure\n", i);			ERR_print_errors(bio_err);			}		else			BIO_printf(bio_err, "Response verify OK\n");		}	if (!print_ocsp_summary(out, bs, req, reqnames, ids))		goto end;	ret = 0;end:	ERR_print_errors(bio_err);	X509_free(signer);	X509_STORE_free(store);        sk_X509_free(VAstore);	EVP_PKEY_free(key);	X509_free(issuer);	X509_free(cert);	BIO_free(cbio);	BIO_free(out);	OCSP_REQUEST_free(req);	OCSP_RESPONSE_free(resp);	OCSP_BASICRESP_free(bs);	sk_free(reqnames);	sk_OCSP_CERTID_free(ids);	EXIT(ret);}