Replace the old style OCSP ASN1 module.

CHANGES

@@ -3,6 +3,9 @@
 
  Changes between 0.9.6 and 0.9.7  [xx XXX 2000]
 
+  *) Reimplement the OCSP ASN1 module using the new code.
+     [Steve Henson]
+
   *) Update the X509V3 code to permit the use of an ASN1_ITEM structure
      for its ASN1 operations. The old style function pointers still exist
      for now but they will eventually go away.

STATUS

 
   OpenSSL STATUS                           Last modified at
-  ______________                           $Date: 2000/11/19 14:11:03 $
+  ______________                           $Date: 2000/12/13 18:21:47 $
 
   DEVELOPMENT STATE
 
@@ -24,8 +24,9 @@
 
     o Steve is currently working on (in no particular order):
         ASN1 code redesign, butchery, replacement.
+        OCSP
         EVP cipher enhancement.
-     /* Proper (or at least usable) certificate chain verification. */
+        Enhanced certificate chain verification.
 	Private key, certificate and CRL API and implementation.
 	Developing and bugfixing PKCS#7 (S/MIME code).
         Various X509 issues: character sets, certificate request extensions.

crypto/ocsp/Makefile.ssl

@@ -22,10 +22,10 @@ TEST=
 APPS=
 
 LIB=$(TOP)/libcrypto.a
-LIBSRC= ocsp_req.c ocsp_res.c ocsp_sig.c ocsp_cid.c ocsp_ext.c \
+LIBSRC= ocsp_asn.c ocsp_req.c ocsp_res.c ocsp_sig.c ocsp_cid.c ocsp_ext.c \
 	ocsp_lib.c ocsp_err.c 
 #ocsp_v3.c
-LIBOBJ= ocsp_req.o ocsp_res.o ocsp_sig.o ocsp_cid.o ocsp_ext.o \
+LIBOBJ= ocsp_asn.o ocsp_req.o ocsp_res.o ocsp_sig.o ocsp_cid.o ocsp_ext.o \
 	ocsp_lib.o ocsp_err.o 
 #ocsp_v3.o
 

crypto/ocsp/ocsp.h

@@ -177,11 +177,11 @@ typedef struct ocsp_response_st
  *      byName   [1] Name,
  *      byKey    [2] KeyHash }
  */
-#define V_OCSP_RESPID_NAME 1
-#define V_OCSP_RESPID_KEY  2
+#define V_OCSP_RESPID_NAME 0
+#define V_OCSP_RESPID_KEY  1
 typedef struct ocsp_responder_id_st
 	{
-	int tag;
+	int type;
 	union   {
 		X509_NAME* byName;
         	ASN1_OCTET_STRING *byKey;
@@ -211,10 +211,12 @@ typedef struct ocsp_revoked_info_st
 #define V_OCSP_CERTSTATUS_UNKNOWN 2
 typedef struct ocsp_cert_status_st
 	{
-	int tag;
-	/* good [0] IMPLICIT NULL */
-	OCSP_REVOKEDINFO *revoked;
-	/* unknown [2] OCSP_UNKNOWNINFO *unknown, which is NULL */
+	int type;
+	union	{
+		ASN1_NULL *good;
+		OCSP_REVOKEDINFO *revoked;
+		ASN1_NULL *unknown;
+		} value;
 	} OCSP_CERTSTATUS;
 
 /*   SingleResponse ::= SEQUENCE {

crypto/ocsp/ocsp_asn.c

+/* ocsp.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
+#include <openssl/ocsp.h>
+
+ASN1_SEQUENCE(OCSP_SIGNATURE) = {
+	ASN1_SIMPLE(OCSP_SIGNATURE, signatureAlgorithm, X509_ALGOR),
+	ASN1_SIMPLE(OCSP_SIGNATURE, signature, ASN1_BIT_STRING),
+	ASN1_SEQUENCE_OF(OCSP_SIGNATURE, certs, X509)
+} ASN1_SEQUENCE_END(OCSP_SIGNATURE);
+
+ASN1_SEQUENCE(OCSP_CERTID) = {
+	ASN1_SIMPLE(OCSP_CERTID, hashAlgorithm, X509_ALGOR),
+	ASN1_SIMPLE(OCSP_CERTID, issuerNameHash, ASN1_OCTET_STRING),
+	ASN1_SIMPLE(OCSP_CERTID, issuerKeyHash, ASN1_OCTET_STRING),
+	ASN1_SIMPLE(OCSP_CERTID, serialNumber, ASN1_INTEGER)
+} ASN1_SEQUENCE_END(OCSP_CERTID);
+
+ASN1_SEQUENCE(OCSP_ONEREQ) = {
+	ASN1_SIMPLE(OCSP_ONEREQ, reqCert, OCSP_CERTID),
+	ASN1_EXP_SEQUENCE_OF_OPT(OCSP_ONEREQ, singleRequestExtensions, X509_EXTENSION, 0)
+} ASN1_SEQUENCE_END(OCSP_ONEREQ);
+
+ASN1_SEQUENCE(OCSP_REQINFO) = {
+	ASN1_EXP_OPT(OCSP_REQINFO, version, ASN1_INTEGER, 0),
+	ASN1_EXP_OPT(OCSP_REQINFO, requestorName, GENERAL_NAME, 1),
+	ASN1_SEQUENCE_OF(OCSP_REQINFO, requestList, OCSP_ONEREQ),
+	ASN1_EXP_SEQUENCE_OF_OPT(OCSP_REQINFO, requestExtensions, X509_EXTENSION, 2)
+} ASN1_SEQUENCE_END(OCSP_REQINFO);
+
+ASN1_SEQUENCE(OCSP_REQUEST) = {
+	ASN1_SIMPLE(OCSP_REQUEST, tbsRequest, OCSP_REQINFO),
+	ASN1_EXP_OPT(OCSP_REQUEST, optionalSignature, OCSP_SIGNATURE, 0)
+} ASN1_SEQUENCE_END(OCSP_REQUEST);
+
+
+/* OCSP_RESPONSE templates */
+
+ASN1_SEQUENCE(OCSP_RESPBYTES) = {
+	    ASN1_SIMPLE(OCSP_RESPBYTES, responseType, ASN1_OBJECT),
+	    ASN1_SIMPLE(OCSP_RESPBYTES, response, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END(OCSP_RESPBYTES);
+
+ASN1_SEQUENCE(OCSP_RESPONSE) = {
+	ASN1_SIMPLE(OCSP_RESPONSE, responseStatus, ASN1_ENUMERATED),
+	ASN1_EXP_OPT(OCSP_RESPONSE, responseBytes, OCSP_RESPBYTES, 0)
+} ASN1_SEQUENCE_END(OCSP_RESPONSE);
+
+ASN1_CHOICE(OCSP_RESPID) = {
+	   ASN1_EXP(OCSP_RESPID, value.byName, X509_NAME, 1),
+	   ASN1_IMP(OCSP_RESPID, value.byKey, ASN1_OCTET_STRING, 2)
+} ASN1_CHOICE_END(OCSP_RESPID);
+
+ASN1_SEQUENCE(OCSP_REVOKEDINFO) = {
+	ASN1_SIMPLE(OCSP_REVOKEDINFO, revocationTime, ASN1_GENERALIZEDTIME),
+  	ASN1_EXP_OPT(OCSP_REVOKEDINFO, revocationReason, ASN1_ENUMERATED, 0)
+} ASN1_SEQUENCE_END(OCSP_REVOKEDINFO);
+
+ASN1_CHOICE(OCSP_CERTSTATUS) = {
+	ASN1_IMP(OCSP_CERTSTATUS, value.good, ASN1_NULL, 0),
+	ASN1_IMP(OCSP_CERTSTATUS, value.revoked, OCSP_REVOKEDINFO, 1),
+	ASN1_IMP(OCSP_CERTSTATUS, value.unknown, ASN1_NULL, 2)
+} ASN1_CHOICE_END(OCSP_CERTSTATUS);
+
+ASN1_SEQUENCE(OCSP_SINGLERESP) = {
+	   ASN1_SIMPLE(OCSP_SINGLERESP, certId, OCSP_CERTID),
+	   ASN1_SIMPLE(OCSP_SINGLERESP, certStatus, OCSP_CERTSTATUS),
+	   ASN1_SIMPLE(OCSP_SINGLERESP, thisUpdate, ASN1_GENERALIZEDTIME),
+	   ASN1_EXP_OPT(OCSP_SINGLERESP, nextUpdate, ASN1_GENERALIZEDTIME, 0),
+	   ASN1_EXP_SEQUENCE_OF_OPT(OCSP_SINGLERESP, singleExtensions, X509_EXTENSION, 1)
+} ASN1_SEQUENCE_END(OCSP_SINGLERESP);
+
+ASN1_SEQUENCE(OCSP_RESPDATA) = {
+	   ASN1_EXP_OPT(OCSP_RESPDATA, version, ASN1_INTEGER, 0),
+	   ASN1_SIMPLE(OCSP_RESPDATA, responderId, OCSP_RESPID),
+	   ASN1_SIMPLE(OCSP_RESPDATA, producedAt, ASN1_GENERALIZEDTIME),
+	   ASN1_SEQUENCE_OF(OCSP_RESPDATA, responses, OCSP_SINGLERESP),
+	   ASN1_EXP_SEQUENCE_OF_OPT(OCSP_RESPDATA, responseExtensions, X509_EXTENSION, 1)
+} ASN1_SEQUENCE_END(OCSP_RESPDATA);
+
+ASN1_SEQUENCE(OCSP_BASICRESP) = {
+	   ASN1_SIMPLE(OCSP_BASICRESP, tbsResponseData, OCSP_RESPDATA),
+	   ASN1_SIMPLE(OCSP_BASICRESP, signatureAlgorithm, X509_ALGOR),
+	   ASN1_SIMPLE(OCSP_BASICRESP, signature, ASN1_BIT_STRING),
+	   ASN1_EXP_SEQUENCE_OF_OPT(OCSP_BASICRESP, certs, X509, 0)
+} ASN1_SEQUENCE_END(OCSP_BASICRESP);
+

crypto/ocsp/ocsp_cid.c

@@ -62,85 +62,10 @@
  */
 
 #include <openssl/bio.h>
-#include <openssl/asn1_mac.h>
 #include <openssl/err.h>
 #include <openssl/ocsp.h>
 #include <openssl/x509.h>
 
-/* Make sure we work well with older variants of OpenSSL */
-#ifndef OPENSSL_malloc
-#define OPENSSL_malloc Malloc
-#endif
-#ifndef OPENSSL_realloc
-#define OPENSSL_realloc Realloc
-#endif
-#ifndef OPENSSL_free
-#define OPENSSL_free Free
-#endif
-
-OCSP_CERTID *OCSP_CERTID_new(void)
-	{
-	ASN1_CTX c;
-	OCSP_CERTID *ret=NULL;
-
-	M_ASN1_New_Malloc(ret, OCSP_CERTID);
-	M_ASN1_New(ret->hashAlgorithm, X509_ALGOR_new);
-	M_ASN1_New(ret->issuerNameHash, ASN1_OCTET_STRING_new);
-	M_ASN1_New(ret->issuerKeyHash, ASN1_OCTET_STRING_new);
-	M_ASN1_New(ret->serialNumber, ASN1_INTEGER_new);
-	return(ret);
-	M_ASN1_New_Error(ASN1_F_OCSP_CERTID_NEW);
-	}
-	
-void OCSP_CERTID_free(OCSP_CERTID *a)
-	{
-	if (a == NULL) return;
-	X509_ALGOR_free(a->hashAlgorithm);
-	ASN1_OCTET_STRING_free(a->issuerNameHash);
-	ASN1_OCTET_STRING_free(a->issuerKeyHash);
-	ASN1_INTEGER_free(a->serialNumber);
-	OPENSSL_free((char *)a);
-	}
-
-int i2d_OCSP_CERTID(OCSP_CERTID *a,
-		    unsigned char **pp)
-	{
-	M_ASN1_I2D_vars(a);
-
-	M_ASN1_I2D_len(a->hashAlgorithm, i2d_X509_ALGOR);
-	M_ASN1_I2D_len(a->issuerNameHash, i2d_ASN1_OCTET_STRING);
-	M_ASN1_I2D_len(a->issuerKeyHash, i2d_ASN1_OCTET_STRING);
-	M_ASN1_I2D_len(a->serialNumber, i2d_ASN1_INTEGER);
-	M_ASN1_I2D_seq_total();
-	M_ASN1_I2D_put(a->hashAlgorithm, i2d_X509_ALGOR);
-	M_ASN1_I2D_put(a->issuerNameHash, i2d_ASN1_OCTET_STRING);
-	M_ASN1_I2D_put(a->issuerKeyHash, i2d_ASN1_OCTET_STRING);
-	M_ASN1_I2D_put(a->serialNumber, i2d_ASN1_INTEGER);
-	M_ASN1_I2D_finish();
-	}
-
-OCSP_CERTID *d2i_OCSP_CERTID(OCSP_CERTID **a,
-			     unsigned char **pp,
-			     long length)
-	{
-	M_ASN1_D2I_vars(a,OCSP_CERTID *,OCSP_CERTID_new);
-
-	M_ASN1_D2I_Init();
-	M_ASN1_D2I_start_sequence();
-	M_ASN1_D2I_get(ret->hashAlgorithm, d2i_X509_ALGOR);
-	M_ASN1_D2I_get(ret->issuerNameHash, d2i_ASN1_OCTET_STRING);
-	M_ASN1_D2I_get(ret->issuerKeyHash, d2i_ASN1_OCTET_STRING);
-	M_ASN1_D2I_get(ret->serialNumber, d2i_ASN1_INTEGER);
-
-	/* protect against malformed CERTID's */
-	if (ASN1_STRING_length(ret->issuerNameHash) == 0 ||
-		ASN1_STRING_length(ret->issuerKeyHash) == 0 ||
-		ASN1_STRING_length(ret->serialNumber) == 0)
-		goto err;
-
-	M_ASN1_D2I_Finish(a,OCSP_CERTID_free,ASN1_F_D2I_OCSP_CERTID);
-	}
-
 int i2a_OCSP_CERTID(BIO *bp,
 		    OCSP_CERTID* a)
         {

crypto/ocsp/ocsp_lib.c

@@ -64,7 +64,6 @@
 #include <stdio.h>
 #include <cryptlib.h>
 #include <openssl/objects.h>
-#include <openssl/asn1_mac.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
 #include <openssl/x509v3.h>
@@ -142,14 +141,14 @@ OCSP_CERTSTATUS *OCSP_cert_status_new(int status, int reason, char *tim)
 	OCSP_CERTSTATUS *cs = NULL;
 
 	if (!(cs = OCSP_CERTSTATUS_new())) goto err;
-	if ((cs->tag = status) == V_OCSP_CERTSTATUS_REVOKED)
+	if ((cs->type = status) == V_OCSP_CERTSTATUS_REVOKED)
 	        {
 		if (!time)
 		        {
 		        OCSPerr(OCSP_F_CERT_STATUS_NEW,OCSP_R_REVOKED_NO_TIME);
 			goto err;
 		        }
-		if (!(cs->revoked = ri = OCSP_REVOKEDINFO_new())) goto err;
+		if (!(cs->value.revoked = ri = OCSP_REVOKEDINFO_new())) goto err;
 		if (!ASN1_GENERALIZEDTIME_set_string(ri->revocationTime,tim))
 			goto err;	
 		if (reason != OCSP_REVOKED_STATUS_NOSTATUS)
@@ -239,7 +238,7 @@ err:
 	return 0;
 	}
 
-OCSP_BASICRESP *OCSP_basic_response_new(int tag,
+OCSP_BASICRESP *OCSP_basic_response_new(int type,
 					X509* cert,
 					STACK_OF(X509_EXTENSION) *extensions)
         {
@@ -251,7 +250,7 @@ OCSP_BASICRESP *OCSP_basic_response_new(int tag,
 	
 	if (!(rsp = OCSP_BASICRESP_new())) goto err;
 	rid = rsp->tbsResponseData->responderId;
-	switch (rid->tag = tag)
+	switch (rid->type = type)
 	        {
 		case V_OCSP_RESPID_NAME:
 		        /* cert is user cert */
@@ -601,11 +600,11 @@ int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o)
 		        goto err;
 		cst = single->certStatus;
 		if (BIO_printf(bp,"\n    Cert Status: %s (0x%x)",
-			       ocspCertStatus2string(cst->tag), cst->tag) <= 0)
+			       ocspCertStatus2string(cst->type), cst->type) <= 0)
 		        goto err;
-		if (cst->tag == V_OCSP_CERTSTATUS_REVOKED)
+		if (cst->type == V_OCSP_CERTSTATUS_REVOKED)
 		        {
-		        rev = cst->revoked;
+		        rev = cst->value.revoked;
 			if (BIO_printf(bp, "\n    Revocation Time: ") <= 0) 
 			        goto err;
 			if (!ASN1_GENERALIZEDTIME_print(bp, 

crypto/ocsp/ocsp_req.c

@@ -62,101 +62,11 @@
  */
 
 #include <openssl/bio.h>
-#include <openssl/asn1_mac.h>
+#include <openssl/asn1.h>
 #include <openssl/err.h>
 #include <openssl/ocsp.h>
 #include <openssl/x509v3.h>
 
-/* Make sure we work well with older variants of OpenSSL */
-#ifndef OPENSSL_malloc
-#define OPENSSL_malloc Malloc
-#endif
-#ifndef OPENSSL_realloc
-#define OPENSSL_realloc Realloc
-#endif
-#ifndef OPENSSL_free
-#define OPENSSL_free Free
-#endif
-
-IMPLEMENT_STACK_OF(OCSP_ONEREQ)
-IMPLEMENT_ASN1_SET_OF(OCSP_ONEREQ)
-
-OCSP_REQINFO *OCSP_REQINFO_new(void)
-	{
-	OCSP_REQINFO *ret=NULL;
-	ASN1_CTX c;
-
-	M_ASN1_New_Malloc(ret, OCSP_REQINFO);
-	ret->version = NULL;
-	ret->requestorName = NULL;
-	ret->requestList = NULL;
-	ret->requestExtensions = NULL;
-	return(ret);
-	M_ASN1_New_Error(ASN1_F_OCSP_REQINFO_NEW);
-	}
-
-void OCSP_REQINFO_free(OCSP_REQINFO *a)
-	{
-	if (a == NULL) return;
-	ASN1_INTEGER_free(a->version);
-	GENERAL_NAME_free(a->requestorName);
-	sk_OCSP_ONEREQ_pop_free(a->requestList, OCSP_ONEREQ_free);
-	sk_X509_EXTENSION_pop_free(a->requestExtensions, X509_EXTENSION_free);
-	OPENSSL_free((char *)a);
-	}
-
-int i2d_OCSP_REQINFO(OCSP_REQINFO *a,
-		     unsigned char **pp)
-	{
-	int v1=0,v2=0,v3=0;
-	M_ASN1_I2D_vars(a);
-
-	M_ASN1_I2D_len_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);
-	M_ASN1_I2D_len_EXP_opt(a->requestorName,i2d_GENERAL_NAME,1,v2);
-	M_ASN1_I2D_len_SEQUENCE_type(OCSP_ONEREQ,
-		     a->requestList, i2d_OCSP_ONEREQ);
-	M_ASN1_I2D_len_EXP_SEQUENCE_opt_type(X509_EXTENSION,
-	     a->requestExtensions, i2d_X509_EXTENSION,2,V_ASN1_SEQUENCE,v3);
-
-	M_ASN1_I2D_seq_total();
-	M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);
-	M_ASN1_I2D_put_EXP_opt(a->requestorName,i2d_GENERAL_NAME,1,v2);
-	M_ASN1_I2D_put_SEQUENCE_type(OCSP_ONEREQ,a->requestList,i2d_OCSP_ONEREQ);
-	M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(X509_EXTENSION,a->requestExtensions,i2d_X509_EXTENSION,2,V_ASN1_SEQUENCE,v3);
-
-	M_ASN1_I2D_finish();
-	}
-
-OCSP_REQINFO *d2i_OCSP_REQINFO(OCSP_REQINFO **a,
-			       unsigned char **pp,
-			       long length)
-	{
-	M_ASN1_D2I_vars(a,OCSP_REQINFO *,OCSP_REQINFO_new);
-
-	M_ASN1_D2I_Init();
-	M_ASN1_D2I_start_sequence();
-	/* we have the optional version field */
-	if (M_ASN1_next == (V_ASN1_CONTEXT_SPECIFIC | V_ASN1_CONSTRUCTED | 0))
-		{ M_ASN1_D2I_get_EXP_opt(ret->version,d2i_ASN1_INTEGER,0);}
-	else
-		{
-		if (ret->version != NULL)
-			{
-			ASN1_INTEGER_free(ret->version);
-			ret->version=NULL;
-			}
-		}
-	M_ASN1_D2I_get_EXP_opt(ret->requestorName,d2i_GENERAL_NAME,1);
-	M_ASN1_D2I_get_seq_type(OCSP_ONEREQ, ret->requestList,
-				d2i_OCSP_ONEREQ,OCSP_ONEREQ_free);
-	/* there is no M_ASN1_D2I_get_EXP_seq* code, so
-	   we're using the set version */
-	M_ASN1_D2I_get_EXP_set_opt_type(X509_EXTENSION,
-		ret->requestExtensions,d2i_X509_EXTENSION,
-		X509_EXTENSION_free,2,V_ASN1_SEQUENCE);
-	M_ASN1_D2I_Finish(a,OCSP_REQINFO_free,ASN1_F_D2I_OCSP_REQINFO);
-	}
-
 int i2a_OCSP_REQINFO(BIO *bp,
 		     OCSP_REQINFO* a)
         {
@@ -183,53 +93,6 @@ int i2a_OCSP_REQINFO(BIO *bp,
 	return j;
 	}
 
-OCSP_REQUEST *OCSP_REQUEST_new(void)
-	{
-	ASN1_CTX c;
-	OCSP_REQUEST *ret=NULL;
-
-	M_ASN1_New_Malloc(ret, OCSP_REQUEST);
-	M_ASN1_New(ret->tbsRequest, OCSP_REQINFO_new);
-	ret->optionalSignature = NULL;
-	return(ret);
-	M_ASN1_New_Error(ASN1_F_OCSP_REQUEST_NEW);
-	}
-	
-void OCSP_REQUEST_free(OCSP_REQUEST *a)
-	{
-	if (a == NULL) return;
-	OCSP_REQINFO_free(a->tbsRequest);
-	OCSP_SIGNATURE_free(a->optionalSignature);
-	OPENSSL_free((char *)a);
-	}
-
-int i2d_OCSP_REQUEST(OCSP_REQUEST *a,
-		     unsigned char **pp)
-	{
-	int v=0;
-	M_ASN1_I2D_vars(a);
-
-	M_ASN1_I2D_len(a->tbsRequest, i2d_OCSP_REQINFO);
-	M_ASN1_I2D_len_EXP_opt(a->optionalSignature, i2d_OCSP_SIGNATURE, 0, v);
-	M_ASN1_I2D_seq_total();
-	M_ASN1_I2D_put(a->tbsRequest, i2d_OCSP_REQINFO); 
-	M_ASN1_I2D_put_EXP_opt(a->optionalSignature, i2d_OCSP_SIGNATURE, 0, v);
-	M_ASN1_I2D_finish();
-	}
-
-OCSP_REQUEST *d2i_OCSP_REQUEST(OCSP_REQUEST **a,
-			       unsigned char **pp,
-			       long length)
-	{
-	M_ASN1_D2I_vars(a,OCSP_REQUEST *,OCSP_REQUEST_new);
-
-	M_ASN1_D2I_Init();
-	M_ASN1_D2I_start_sequence();
-	M_ASN1_D2I_get(ret->tbsRequest, d2i_OCSP_REQINFO);
-	M_ASN1_D2I_get_EXP_opt(ret->optionalSignature, d2i_OCSP_SIGNATURE, 0);
-	M_ASN1_D2I_Finish(a,OCSP_REQUEST_free,ASN1_F_D2I_OCSP_REQUEST);
-	}
-
 int i2a_OCSP_REQUEST(BIO *bp,
 		     OCSP_REQUEST* a)
         {
@@ -238,61 +101,6 @@ int i2a_OCSP_REQUEST(BIO *bp,
 	return a->optionalSignature ? 2 : 1;
 	}
 
-OCSP_ONEREQ *OCSP_ONEREQ_new(void)
-	{
-	ASN1_CTX c;
-	OCSP_ONEREQ *ret=NULL;
-
-	M_ASN1_New_Malloc(ret, OCSP_ONEREQ);
-	M_ASN1_New(ret->reqCert, OCSP_CERTID_new);
-	ret->singleRequestExtensions = NULL;
-	return(ret);
-	M_ASN1_New_Error(ASN1_F_OCSP_ONEREQ_NEW);
-	}
-	
-void OCSP_ONEREQ_free(OCSP_ONEREQ *a)
-	{
-	if (a == NULL) return;
-	OCSP_CERTID_free(a->reqCert);
-	sk_X509_EXTENSION_pop_free(a->singleRequestExtensions, X509_EXTENSION_free);
-	OPENSSL_free((char *)a);
-	}
-
-int i2d_OCSP_ONEREQ(OCSP_ONEREQ *a,
-		    unsigned char **pp)
-	{
-	int v=0;
-	M_ASN1_I2D_vars(a);
-
-	M_ASN1_I2D_len(a->reqCert, i2d_OCSP_CERTID);
-	M_ASN1_I2D_len_EXP_SEQUENCE_opt_type(X509_EXTENSION,
-	     a->singleRequestExtensions, i2d_X509_EXTENSION, 0,
-	     V_ASN1_SEQUENCE, v);
-	M_ASN1_I2D_seq_total();
-	M_ASN1_I2D_put(a->reqCert, i2d_OCSP_CERTID);
-	M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(X509_EXTENSION,
-	     a->singleRequestExtensions, i2d_X509_EXTENSION, 0,
-	     V_ASN1_SEQUENCE, v);
-	M_ASN1_I2D_finish();
-	}
-
-OCSP_ONEREQ *d2i_OCSP_ONEREQ(OCSP_ONEREQ **a,
-			     unsigned char **pp,
-			     long length)
-	{
-	M_ASN1_D2I_vars(a,OCSP_ONEREQ *,OCSP_ONEREQ_new);
-
-	M_ASN1_D2I_Init();
-	M_ASN1_D2I_start_sequence();
-	M_ASN1_D2I_get(ret->reqCert, d2i_OCSP_CERTID);
-	/* there is no M_ASN1_D2I_get_EXP_seq* code, so
-	   we're using the set version */
-	M_ASN1_D2I_get_EXP_set_opt_type(X509_EXTENSION,
-		ret->singleRequestExtensions, d2i_X509_EXTENSION,
-		X509_EXTENSION_free, 0, V_ASN1_SEQUENCE);
-	M_ASN1_D2I_Finish(a,OCSP_ONEREQ_free,ASN1_F_D2I_OCSP_ONEREQ);
-	}
-
 int i2a_OCSP_ONEREQ(BIO *bp,
 		    OCSP_ONEREQ* a)
         {

crypto/ocsp/ocsp_sig.c

@@ -62,79 +62,11 @@
  */
 
 #include <openssl/bio.h>
-#include <openssl/asn1_mac.h>
+#include <openssl/asn1.h>
 #include <openssl/err.h>
 #include <openssl/ocsp.h>
 #include <openssl/x509.h>
 
-/* Make sure we work well with older variants of OpenSSL */
-#ifndef OPENSSL_malloc
-#define OPENSSL_malloc Malloc
-#endif
-#ifndef OPENSSL_realloc
-#define OPENSSL_realloc Realloc
-#endif
-#ifndef OPENSSL_free
-#define OPENSSL_free Free
-#endif
-
-OCSP_SIGNATURE *OCSP_SIGNATURE_new(void)
-	{
-	ASN1_CTX c;
-	OCSP_SIGNATURE *ret=NULL;
-
-	M_ASN1_New_Malloc(ret, OCSP_SIGNATURE);
-	M_ASN1_New(ret->signatureAlgorithm, X509_ALGOR_new);
-	M_ASN1_New(ret->signature, ASN1_BIT_STRING_new);
-	ret->certs = NULL;
-	return(ret);
-	M_ASN1_New_Error(ASN1_F_OCSP_SIGNATURE_NEW);
-	}
-	
-void OCSP_SIGNATURE_free(OCSP_SIGNATURE *a)
-	{
-	if (a == NULL) return;
-	X509_ALGOR_free(a->signatureAlgorithm);
-	ASN1_BIT_STRING_free(a->signature);
-	if (a->certs) sk_X509_pop_free(a->certs, X509_free);
-	OPENSSL_free((char *)a);
-	}
-
-int i2d_OCSP_SIGNATURE(OCSP_SIGNATURE *a,
-		       unsigned char **pp)
-	{
-	int v=0;
-	M_ASN1_I2D_vars(a);
-
-	M_ASN1_I2D_len(a->signatureAlgorithm, i2d_X509_ALGOR);
-	M_ASN1_I2D_len(a->signature, i2d_ASN1_BIT_STRING);
-	M_ASN1_I2D_len_EXP_SEQUENCE_opt_type(X509, a->certs, i2d_X509,
-			     0,	V_ASN1_SEQUENCE, v);
-	M_ASN1_I2D_seq_total();
-	M_ASN1_I2D_put(a->signatureAlgorithm, i2d_X509_ALGOR);
-	M_ASN1_I2D_put(a->signature, i2d_ASN1_BIT_STRING);
-	M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(X509, a->certs, i2d_X509, 0,
-					V_ASN1_SEQUENCE, v);
-	M_ASN1_I2D_finish();
-	}
-
-OCSP_SIGNATURE *d2i_OCSP_SIGNATURE(OCSP_SIGNATURE **a,
-				   unsigned char **pp,
-				   long length)
-	{
-	M_ASN1_D2I_vars(a,OCSP_SIGNATURE *,OCSP_SIGNATURE_new);
-
-	M_ASN1_D2I_Init();
-	M_ASN1_D2I_start_sequence();
-	M_ASN1_D2I_get(ret->signatureAlgorithm, d2i_X509_ALGOR);
-	M_ASN1_D2I_get(ret->signature, d2i_ASN1_BIT_STRING);
-	/* there is no M_ASN1_D2I_get_EXP_seq* code, so
-	   we're using the set version */
-	M_ASN1_D2I_get_EXP_set_opt_type(X509, ret->certs, d2i_X509,
-				   X509_free, 0, V_ASN1_SEQUENCE);
-	M_ASN1_D2I_Finish(a,OCSP_SIGNATURE_free,ASN1_F_D2I_OCSP_SIGNATURE);
-	}
-
 int i2a_OCSP_SIGNATURE(BIO *bp,
 		       OCSP_SIGNATURE* a)
         {