path: root/security/nss/cmd/ocspclnt/ocspclnt.c

/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

/*
 * Test program for client-side OCSP.
 */

#include "secutil.h"
#include "nspr.h"
#include "plgetopt.h"
#include "nss.h"
#include "cert.h"
#include "ocsp.h"
#include "xconst.h" /*
                      * XXX internal header file; needed to get at
                      * cert_DecodeAuthInfoAccessExtension -- would be
                      * nice to not need this, but that would require
                      * better/different APIs.
                      */

#ifndef NO_PP       /*                                               \
                     * Compile with this every once in a while to be \
                     * sure that no dependencies on it get added     \
                     * outside of the pretty-printing routines.      \
                     */
#include "ocspti.h" /* internals for pretty-printing routines *only* */
#endif              /* NO_PP */

#if defined(_WIN32)
#include "fcntl.h"
#include "io.h"
#endif

#define DEFAULT_DB_DIR "~/.netscape"

/* global */
char *program_name;

static void
synopsis(char *progname)
{
    PRFileDesc *pr_stderr;

    pr_stderr = PR_STDERR;
    PR_fprintf(pr_stderr, "Usage:");
    PR_fprintf(pr_stderr,
               "\t%s -p [-d <dir>]\n",
               progname);
    PR_fprintf(pr_stderr,
               "\t%s -P [-d <dir>]\n",
               progname);
    PR_fprintf(pr_stderr,
               "\t%s -r <name> [-a] [-L] [-s <name>] [-d <dir>]\n",
               progname);
    PR_fprintf(pr_stderr,
               "\t%s -R <name> [-a] [-l <location>] [-s <name>] [-d <dir>]\n",
               progname);
    PR_fprintf(pr_stderr,
               "\t%s -S <name> [-a] [-l <location> -t <name>]\n",
               progname);
    PR_fprintf(pr_stderr,
               "\t\t [-s <name>] [-w <time>] [-d <dir>]\n");
    PR_fprintf(pr_stderr,
               "\t%s -V <name> [-a] -u <usage> [-l <location> -t <name>]\n",
               progname);
    PR_fprintf(pr_stderr,
               "\t\t [-s <name>] [-w <time>] [-d <dir>]\n");
}

static void
short_usage(char *progname)
{
    PR_fprintf(PR_STDERR,
               "Type %s -H for more detailed descriptions\n",
               progname);
    synopsis(progname);
}

static void
long_usage(char *progname)
{
    PRFileDesc *pr_stderr;

    pr_stderr = PR_STDERR;
    synopsis(progname);
    PR_fprintf(pr_stderr, "\nCommands (must specify exactly one):\n");
    PR_fprintf(pr_stderr,
               "  %-13s Pretty-print a binary request read from stdin\n",
               "-p");
    PR_fprintf(pr_stderr,
               "  %-13s Pretty-print a binary response read from stdin\n",
               "-P");
    PR_fprintf(pr_stderr,
               "  %-13s Create a request for cert \"nickname\" on stdout\n",
               "-r nickname");
    PR_fprintf(pr_stderr,
               "  %-13s Get response for cert \"nickname\", dump to stdout\n",
               "-R nickname");
    PR_fprintf(pr_stderr,
               "  %-13s Get status for cert \"nickname\"\n",
               "-S nickname");
    PR_fprintf(pr_stderr,
               "  %-13s Fully verify cert \"nickname\", w/ status check\n",
               "-V nickname");
    PR_fprintf(pr_stderr,
               "\n     %-10s also can be the name of the file with DER or\n"
               "  %-13s PEM(use -a option) cert encoding\n",
               "nickname", "");
    PR_fprintf(pr_stderr, "Options:\n");
    PR_fprintf(pr_stderr,
               "  %-13s Decode input cert from PEM format. DER is default\n",
               "-a");
    PR_fprintf(pr_stderr,
               "  %-13s Add the service locator extension to the request\n",
               "-L");
    PR_fprintf(pr_stderr,
               "  %-13s Find security databases in \"dbdir\" (default %s)\n",
               "-d dbdir", DEFAULT_DB_DIR);
    PR_fprintf(pr_stderr,
               "  %-13s Use \"location\" as URL of responder\n",
               "-l location");
    PR_fprintf(pr_stderr,
               "  %-13s Trust cert \"nickname\" as response signer\n",
               "-t nickname");
    PR_fprintf(pr_stderr,
               "  %-13s Sign requests with cert \"nickname\"\n",
               "-s nickname");
    PR_fprintf(pr_stderr,
               "  %-13s Type of certificate usage for verification:\n",
               "-u usage");
    PR_fprintf(pr_stderr,
               "%-17s c   SSL Client\n", "");
    PR_fprintf(pr_stderr,
               "%-17s s   SSL Server\n", "");
    PR_fprintf(pr_stderr,
               "%-17s e   Email Recipient\n", "");
    PR_fprintf(pr_stderr,
               "%-17s E   Email Signer\n", "");
    PR_fprintf(pr_stderr,
               "%-17s S   Object Signer\n", "");
    PR_fprintf(pr_stderr,
               "%-17s C   CA\n", "");
    PR_fprintf(pr_stderr,
               "  %-13s Validity time (default current time), one of:\n",
               "-w time");
    PR_fprintf(pr_stderr,
               "%-17s %-25s (GMT)\n", "", "YYMMDDhhmm[ss]Z");
    PR_fprintf(pr_stderr,
               "%-17s %-25s (later than GMT)\n", "", "YYMMDDhhmm[ss]+hhmm");
    PR_fprintf(pr_stderr,
               "%-17s %-25s (earlier than GMT)\n", "", "YYMMDDhhmm[ss]-hhmm");
}

#if defined(WIN32)
/* We're going to write binary data to stdout, or read binary from stdin.
 * We must put stdout or stdin into O_BINARY mode or else
   outgoing \n's will become \r\n's, and incoming \r\n's will become \n's.
*/
static SECStatus
make_file_binary(FILE *binfile)
{
    int smrv = _setmode(_fileno(binfile), _O_BINARY);
    if (smrv == -1) {
        fprintf(stderr, "%s: Cannot change stdout to binary mode.\n",
                program_name);
    }
    return smrv;
}
#define MAKE_FILE_BINARY make_file_binary
#else
#define MAKE_FILE_BINARY(file)
#endif

/*
 * XXX This is a generic function that would probably make a good
 * replacement for SECU_DER_Read (which is not at all specific to DER,
 * despite its name), but that requires fixing all of the tools...
 * Still, it should be done, whenenver I/somebody has the time.
 * (Also, consider whether this actually belongs in the security
 * library itself, not just in the command library.)
 *
 * This function takes an open file (a PRFileDesc *) and reads the
 * entire file into a SECItem.  (Obviously, the file is intended to
 * be small enough that such a thing is advisable.)  Both the SECItem
 * and the buffer it points to are allocated from the heap; the caller
 * is expected to free them.  ("SECITEM_FreeItem(item, PR_TRUE)")
 */
static SECItem *
read_file_into_item(PRFileDesc *in_file, SECItemType si_type)
{
    PRStatus prv;
    SECItem *item;
    PRFileInfo file_info;
    PRInt32 bytes_read;

    prv = PR_GetOpenFileInfo(in_file, &file_info);
    if (prv != PR_SUCCESS)
        return NULL;

    if (file_info.size == 0) {
        /* XXX Need a better error; just grabbed this one for expediency. */
        PORT_SetError(SEC_ERROR_INPUT_LEN);
        return NULL;
    }

    if (file_info.size > 0xffff) { /* I think this is too big. */
        PORT_SetError(SEC_ERROR_NO_MEMORY);
        return NULL;
    }

    item = PORT_Alloc(sizeof(SECItem));
    if (item == NULL)
        return NULL;

    item->type = si_type;
    item->len = (unsigned int)file_info.size;
    item->data = PORT_Alloc((size_t)item->len);
    if (item->data == NULL)
        goto loser;

    bytes_read = PR_Read(in_file, item->data, (PRInt32)item->len);
    if (bytes_read < 0) {
        /* Something went wrong; error is already set for us. */
        goto loser;
    } else if (bytes_read == 0) {
        /* Something went wrong; we read nothing.  But no system/nspr error. */
        /* XXX Need to set an error here. */
        goto loser;
    } else if (item->len != (unsigned int)bytes_read) {
        /* Something went wrong; we read less (or more!?) than we expected. */
        /* XXX Need to set an error here. */
        goto loser;
    }

    return item;

loser:
    SECITEM_FreeItem(item, PR_TRUE);
    return NULL;
}

/*
 * Create a DER-encoded OCSP request (for the certificate whose nickname
 * is "name") and dump it out.
 */
static SECStatus
create_request(FILE *out_file, CERTCertDBHandle *handle, CERTCertificate *cert,
               PRBool add_service_locator, PRBool add_acceptable_responses)
{
    CERTCertList *certs = NULL;
    CERTCertificate *myCert = NULL;
    CERTOCSPRequest *request = NULL;
    PRTime now = PR_Now();
    SECItem *encoding = NULL;
    SECStatus rv = SECFailure;

    if (handle == NULL || cert == NULL)
        return rv;

    myCert = CERT_DupCertificate(cert);
    if (myCert == NULL)
        goto loser;

    /*
     * We need to create a list of one.
     */
    certs = CERT_NewCertList();
    if (certs == NULL)
        goto loser;

    if (CERT_AddCertToListTail(certs, myCert) != SECSuccess)
        goto loser;

    /*
     * Now that cert is included in the list, we need to be careful
     * that we do not try to destroy it twice.  This will prevent that.
     */
    myCert = NULL;

    request = CERT_CreateOCSPRequest(certs, now, add_service_locator, NULL);
    if (request == NULL)
        goto loser;

    if (add_acceptable_responses) {
        rv = CERT_AddOCSPAcceptableResponses(request,
                                             SEC_OID_PKIX_OCSP_BASIC_RESPONSE);
        if (rv != SECSuccess)
            goto loser;
    }

    encoding = CERT_EncodeOCSPRequest(NULL, request, NULL);
    if (encoding == NULL)
        goto loser;

    MAKE_FILE_BINARY(out_file);
    if (fwrite(encoding->data, encoding->len, 1, out_file) != 1)
        goto loser;

    rv = SECSuccess;

loser:
    if (encoding != NULL)
        SECITEM_FreeItem(encoding, PR_TRUE);
    if (request != NULL)
        CERT_DestroyOCSPRequest(request);
    if (certs != NULL)
        CERT_DestroyCertList(certs);
    if (myCert != NULL)
        CERT_DestroyCertificate(myCert);

    return rv;
}

/*
 * Create a DER-encoded OCSP request (for the certificate whose nickname is
 * "cert_name"), then get and dump a corresponding response.  The responder
 * location is either specified explicitly (as "responder_url") or found
 * via the AuthorityInfoAccess URL in the cert.
 */
static SECStatus
dump_response(FILE *out_file, CERTCertDBHandle *handle, CERTCertificate *cert,
              const char *responder_url)
{
    CERTCertList *certs = NULL;
    CERTCertificate *myCert = NULL;
    char *loc = NULL;
    PRTime now = PR_Now();
    SECItem *response = NULL;
    SECStatus rv = SECFailure;
    PRBool includeServiceLocator;

    if (handle == NULL || cert == NULL)
        return rv;

    myCert = CERT_DupCertificate(cert);
    if (myCert == NULL)
        goto loser;

    if (responder_url != NULL) {
        loc = (char *)responder_url;
        includeServiceLocator = PR_TRUE;
    } else {
        loc = CERT_GetOCSPAuthorityInfoAccessLocation(cert);
        if (loc == NULL)
            goto loser;
        includeServiceLocator = PR_FALSE;
    }

    /*
     * We need to create a list of one.
     */
    certs = CERT_NewCertList();
    if (certs == NULL)
        goto loser;

    if (CERT_AddCertToListTail(certs, myCert) != SECSuccess)
        goto loser;

    /*
     * Now that cert is included in the list, we need to be careful
     * that we do not try to destroy it twice.  This will prevent that.
     */
    myCert = NULL;

    response = CERT_GetEncodedOCSPResponse(NULL, certs, loc, now,
                                           includeServiceLocator,
                                           NULL, NULL, NULL);
    if (response == NULL)
        goto loser;

    MAKE_FILE_BINARY(out_file);
    if (fwrite(response->data, response->len, 1, out_file) != 1)
        goto loser;

    rv = SECSuccess;

loser:
    if (response != NULL)
        SECITEM_FreeItem(response, PR_TRUE);
    if (certs != NULL)
        CERT_DestroyCertList(certs);
    if (myCert != NULL)
        CERT_DestroyCertificate(myCert);
    if (loc != NULL && loc != responder_url)
        PORT_Free(loc);

    return rv;
}

/*
 * Get the status for the specified certificate (whose nickname is "cert_name").
 * Directly use the OCSP function rather than doing a full verification.
 */
static SECStatus
get_cert_status(FILE *out_file, CERTCertDBHandle *handle,
                CERTCertificate *cert, const char *cert_name,
                PRTime verify_time)
{
    SECStatus rv = SECFailure;

    if (handle == NULL || cert == NULL)
        goto loser;

    rv = CERT_CheckOCSPStatus(handle, cert, verify_time, NULL);

    fprintf(out_file, "Check of certificate \"%s\" ", cert_name);
    if (rv == SECSuccess) {
        fprintf(out_file, "succeeded.\n");
    } else {
        const char *error_string = SECU_Strerror(PORT_GetError());
        fprintf(out_file, "failed.  Reason:\n");
        if (error_string != NULL && PORT_Strlen(error_string) > 0)
            fprintf(out_file, "%s\n", error_string);
        else
            fprintf(out_file, "Unknown\n");
    }

    rv = SECSuccess;

loser:

    return rv;
}

/*
 * Verify the specified certificate (whose nickname is "cert_name").
 * OCSP is already turned on, so we just need to call the standard
 * certificate verification API and let it do all the work.
 */
static SECStatus
verify_cert(FILE *out_file, CERTCertDBHandle *handle, CERTCertificate *cert,
            const char *cert_name, SECCertUsage cert_usage, PRTime verify_time)
{
    SECStatus rv = SECFailure;

    if (handle == NULL || cert == NULL)
        return rv;

    rv = CERT_VerifyCert(handle, cert, PR_TRUE, cert_usage, verify_time,
                         NULL, NULL);

    fprintf(out_file, "Verification of certificate \"%s\" ", cert_name);
    if (rv == SECSuccess) {
        fprintf(out_file, "succeeded.\n");
    } else {
        const char *error_string = SECU_Strerror(PORT_GetError());
        fprintf(out_file, "failed.  Reason:\n");
        if (error_string != NULL && PORT_Strlen(error_string) > 0)
            fprintf(out_file, "%s\n", error_string);
        else
            fprintf(out_file, "Unknown\n");
    }

    rv = SECSuccess;

    return rv;
}

CERTCertificate *
find_certificate(CERTCertDBHandle *handle, const char *name, PRBool ascii)
{
    CERTCertificate *cert = NULL;
    SECItem der;
    PRFileDesc *certFile;

    if (handle == NULL || name == NULL)
        return NULL;

    if (ascii == PR_FALSE) {
        /* by default need to check if there is cert nick is given */
        cert = CERT_FindCertByNicknameOrEmailAddr(handle, (char *)name);
        if (cert != NULL)
            return cert;
    }

    certFile = PR_Open(name, PR_RDONLY, 0);
    if (certFile == NULL) {
        return NULL;
    }

    if (SECU_ReadDERFromFile(&der, certFile, ascii, PR_FALSE) == SECSuccess) {
        cert = CERT_DecodeCertFromPackage((char *)der.data, der.len);
        SECITEM_FreeItem(&der, PR_FALSE);
    }
    PR_Close(certFile);

    return cert;
}

#ifdef NO_PP

static SECStatus
print_request(FILE *out_file, SECItem *data)
{
    fprintf(out_file, "Cannot pretty-print request compiled with NO_PP.\n");
    return SECSuccess;
}

static SECStatus
print_response(FILE *out_file, SECItem *data, CERTCertDBHandle *handle)
{
    fprintf(out_file, "Cannot pretty-print response compiled with NO_PP.\n");
    return SECSuccess;
}

#else /* NO_PP */

static void
print_ocsp_version(FILE *out_file, SECItem *version, int level)
{
    if (version->len > 0) {
        SECU_PrintInteger(out_file, version, "Version", level);
    } else {
        SECU_Indent(out_file, level);
        fprintf(out_file, "Version: DEFAULT\n");
    }
}

static void
print_ocsp_cert_id(FILE *out_file, CERTOCSPCertID *cert_id, int level)
{
    SECU_Indent(out_file, level);
    fprintf(out_file, "Cert ID:\n");
    level++;

    SECU_PrintAlgorithmID(out_file, &(cert_id->hashAlgorithm),
                          "Hash Algorithm", level);
    SECU_PrintAsHex(out_file, &(cert_id->issuerNameHash),
                    "Issuer Name Hash", level);
    SECU_PrintAsHex(out_file, &(cert_id->issuerKeyHash),
                    "Issuer Key Hash", level);
    SECU_PrintInteger(out_file, &(cert_id->serialNumber),
                      "Serial Number", level);
    /* XXX lookup the cert; if found, print something nice (nickname?) */
}

static void
print_raw_certificates(FILE *out_file, SECItem **raw_certs, int level)
{
    SECItem *raw_cert;
    int i = 0;
    char cert_label[50];

    SECU_Indent(out_file, level);

    if (raw_certs == NULL) {
        fprintf(out_file, "No Certificates.\n");
        return;
    }

    fprintf(out_file, "Certificate List:\n");
    while ((raw_cert = raw_certs[i++]) != NULL) {
        sprintf(cert_label, "Certificate (%d)", i);
        (void)SECU_PrintSignedData(out_file, raw_cert, cert_label, level + 1,
                                   (SECU_PPFunc)SECU_PrintCertificate);
    }
}

static void
print_ocsp_extensions(FILE *out_file, CERTCertExtension **extensions,
                      char *msg, int level)
{
    if (extensions) {
        SECU_PrintExtensions(out_file, extensions, msg, level);
    } else {
        SECU_Indent(out_file, level);
        fprintf(out_file, "No %s\n", msg);
    }
}

static void
print_single_request(FILE *out_file, ocspSingleRequest *single, int level)
{
    print_ocsp_cert_id(out_file, single->reqCert, level);
    print_ocsp_extensions(out_file, single->singleRequestExtensions,
                          "Single Request Extensions", level);
}

/*
 * Decode the DER/BER-encoded item "data" as an OCSP request
 * and pretty-print the subfields.
 */
static SECStatus
print_request(FILE *out_file, SECItem *data)
{
    CERTOCSPRequest *request;
    ocspTBSRequest *tbsRequest;
    int level = 0;

    PORT_Assert(out_file != NULL);
    PORT_Assert(data != NULL);
    if (out_file == NULL || data == NULL) {
        PORT_SetError(SEC_ERROR_INVALID_ARGS);
        return SECFailure;
    }

    request = CERT_DecodeOCSPRequest(data);
    if (request == NULL || request->tbsRequest == NULL)
        return SECFailure;

    tbsRequest = request->tbsRequest;

    fprintf(out_file, "TBS Request:\n");
    level++;

    print_ocsp_version(out_file, &(tbsRequest->version), level);

    /*
     * XXX Probably should be an interface to get the signer name
     * without looking inside the tbsRequest at all.
     */
    if (tbsRequest->requestorName != NULL) {
        SECU_Indent(out_file, level);
        fprintf(out_file, "XXX print the requestorName\n");
    } else {
        SECU_Indent(out_file, level);
        fprintf(out_file, "No Requestor Name.\n");
    }

    if (tbsRequest->requestList != NULL) {
        int i;

        for (i = 0; tbsRequest->requestList[i] != NULL; i++) {
            SECU_Indent(out_file, level);
            fprintf(out_file, "Request %d:\n", i);
            print_single_request(out_file, tbsRequest->requestList[i],
                                 level + 1);
        }
    } else {
        fprintf(out_file, "Request list is empty.\n");
    }

    print_ocsp_extensions(out_file, tbsRequest->requestExtensions,
                          "Request Extensions", level);

    if (request->optionalSignature != NULL) {
        ocspSignature *whole_sig;
        SECItem rawsig;

        fprintf(out_file, "Signature:\n");

        whole_sig = request->optionalSignature;
        SECU_PrintAlgorithmID(out_file, &(whole_sig->signatureAlgorithm),
                              "Signature Algorithm", level);

        rawsig = whole_sig->signature;
        DER_ConvertBitString(&rawsig);
        SECU_PrintAsHex(out_file, &rawsig, "Signature", level);

        print_raw_certificates(out_file, whole_sig->derCerts, level);

        fprintf(out_file, "XXX verify the sig and print result\n");
    } else {
        fprintf(out_file, "No Signature\n");
    }

    CERT_DestroyOCSPRequest(request);
    return SECSuccess;
}

static void
print_revoked_info(FILE *out_file, ocspRevokedInfo *revoked_info, int level)
{
    SECU_PrintGeneralizedTime(out_file, &(revoked_info->revocationTime),
                              "Revocation Time", level);

    if (revoked_info->revocationReason != NULL) {
        SECU_PrintAsHex(out_file, revoked_info->revocationReason,
                        "Revocation Reason", level);
    } else {
        SECU_Indent(out_file, level);
        fprintf(out_file, "No Revocation Reason.\n");
    }
}

static void
print_cert_status(FILE *out_file, ocspCertStatus *status, int level)
{
    SECU_Indent(out_file, level);
    fprintf(out_file, "Status: ");

    switch (status->certStatusType) {
        case ocspCertStatus_good:
            fprintf(out_file, "Cert is good.\n");
            break;
        case ocspCertStatus_revoked:
            fprintf(out_file, "Cert has been revoked.\n");
            print_revoked_info(out_file, status->certStatusInfo.revokedInfo,
                               level + 1);
            break;
        case ocspCertStatus_unknown:
            fprintf(out_file, "Cert is unknown to responder.\n");
            break;
        default:
            fprintf(out_file, "Unrecognized status.\n");
            break;
    }
}

static void
print_single_response(FILE *out_file, CERTOCSPSingleResponse *single,
                      int level)
{
    print_ocsp_cert_id(out_file, single->certID, level);

    print_cert_status(out_file, single->certStatus, level);

    SECU_PrintGeneralizedTime(out_file, &(single->thisUpdate),
                              "This Update", level);

    if (single->nextUpdate != NULL) {
        SECU_PrintGeneralizedTime(out_file, single->nextUpdate,
                                  "Next Update", level);
    } else {
        SECU_Indent(out_file, level);
        fprintf(out_file, "No Next Update\n");
    }

    print_ocsp_extensions(out_file, single->singleExtensions,
                          "Single Response Extensions", level);
}

static void
print_responder_id(FILE *out_file, ocspResponderID *responderID, int level)
{
    SECU_Indent(out_file, level);
    fprintf(out_file, "Responder ID ");

    switch (responderID->responderIDType) {
        case ocspResponderID_byName:
            fprintf(out_file, "(byName):\n");
            SECU_PrintName(out_file, &(responderID->responderIDValue.name),
                           "Name", level + 1);
            break;
        case ocspResponderID_byKey:
            fprintf(out_file, "(byKey):\n");
            SECU_PrintAsHex(out_file, &(responderID->responderIDValue.keyHash),
                            "Key Hash", level + 1);
            break;
        default:
            fprintf(out_file, "Unrecognized Responder ID Type\n");
            break;
    }
}

static void
print_response_data(FILE *out_file, ocspResponseData *responseData, int level)
{
    SECU_Indent(out_file, level);
    fprintf(out_file, "Response Data:\n");
    level++;

    print_ocsp_version(out_file, &(responseData->version), level);

    print_responder_id(out_file, responseData->responderID, level);

    SECU_PrintGeneralizedTime(out_file, &(responseData->producedAt),
                              "Produced At", level);

    if (responseData->responses != NULL) {
        int i;

        for (i = 0; responseData->responses[i] != NULL; i++) {
            SECU_Indent(out_file, level);
            fprintf(out_file, "Response %d:\n", i);
            print_single_response(out_file, responseData->responses[i],
                                  level + 1);
        }
    } else {
        fprintf(out_file, "Response list is empty.\n");
    }

    print_ocsp_extensions(out_file, responseData->responseExtensions,
                          "Response Extensions", level);
}

static void
print_basic_response(FILE *out_file, ocspBasicOCSPResponse *basic, int level)
{
    SECItem rawsig;

    SECU_Indent(out_file, level);
    fprintf(out_file, "Basic OCSP Response:\n");
    level++;

    print_response_data(out_file, basic->tbsResponseData, level);

    SECU_PrintAlgorithmID(out_file,
                          &(basic->responseSignature.signatureAlgorithm),
                          "Signature Algorithm", level);

    rawsig = basic->responseSignature.signature;
    DER_ConvertBitString(&rawsig);
    SECU_PrintAsHex(out_file, &rawsig, "Signature", level);

    print_raw_certificates(out_file, basic->responseSignature.derCerts, level);
}

/*
 * Note this must match (exactly) the enumeration ocspResponseStatus.
 */
static char *responseStatusNames[] = {
    "successful (Response has valid confirmations)",
    "malformedRequest (Illegal confirmation request)",
    "internalError (Internal error in issuer)",
    "tryLater (Try again later)",
    "unused ((4) is not used)",
    "sigRequired (Must sign the request)",
    "unauthorized (Request unauthorized)"
};

/*
 * Decode the DER/BER-encoded item "data" as an OCSP response
 * and pretty-print the subfields.
 */
static SECStatus
print_response(FILE *out_file, SECItem *data, CERTCertDBHandle *handle)
{
    CERTOCSPResponse *response;
    int level = 0;

    PORT_Assert(out_file != NULL);
    PORT_Assert(data != NULL);
    if (out_file == NULL || data == NULL) {
        PORT_SetError(SEC_ERROR_INVALID_ARGS);
        return SECFailure;
    }

    response = CERT_DecodeOCSPResponse(data);
    if (response == NULL)
        return SECFailure;

    if (response->statusValue >= ocspResponse_min &&
        response->statusValue <= ocspResponse_max) {
        fprintf(out_file, "Response Status: %s\n",
                responseStatusNames[response->statusValue]);
    } else {
        fprintf(out_file,
                "Response Status: other (Status value %d out of defined range)\n",
                (int)response->statusValue);
    }

    if (response->statusValue == ocspResponse_successful) {
        ocspResponseBytes *responseBytes = response->responseBytes;
        SECStatus sigStatus;
        CERTCertificate *signerCert = NULL;

        PORT_Assert(responseBytes != NULL);

        level++;
        fprintf(out_file, "Response Bytes:\n");
        SECU_PrintObjectID(out_file, &(responseBytes->responseType),
                           "Response Type", level);
        switch (response->responseBytes->responseTypeTag) {
            case SEC_OID_PKIX_OCSP_BASIC_RESPONSE:
                print_basic_response(out_file,
                                     responseBytes->decodedResponse.basic,
                                     level);
                break;
            default:
                SECU_Indent(out_file, level);
                fprintf(out_file, "Unknown response syntax\n");
                break;
        }

        sigStatus = CERT_VerifyOCSPResponseSignature(response, handle,
                                                     NULL, &signerCert, NULL);
        SECU_Indent(out_file, level);
        fprintf(out_file, "Signature verification ");
        if (sigStatus != SECSuccess) {
            fprintf(out_file, "failed: %s\n", SECU_Strerror(PORT_GetError()));
        } else {
            fprintf(out_file, "succeeded.\n");
            if (signerCert != NULL) {
                SECU_PrintName(out_file, &signerCert->subject, "Signer",
                               level);
                CERT_DestroyCertificate(signerCert);
            } else {
                SECU_Indent(out_file, level);
                fprintf(out_file, "No signer cert returned?\n");
            }
        }
    } else {
        SECU_Indent(out_file, level);
        fprintf(out_file, "Unsuccessful response, no more information.\n");
    }

    CERT_DestroyOCSPResponse(response);
    return SECSuccess;
}

#endif /* NO_PP */

static SECStatus
cert_usage_from_char(const char *cert_usage_str, SECCertUsage *cert_usage)
{
    PORT_Assert(cert_usage_str != NULL);
    PORT_Assert(cert_usage != NULL);

    if (PORT_Strlen(cert_usage_str) != 1)
        return SECFailure;

    switch (*cert_usage_str) {
        case 'c':
            *cert_usage = certUsageSSLClient;
            break;
        case 's':
            *cert_usage = certUsageSSLServer;
            break;
        case 'e':
            *cert_usage = certUsageEmailRecipient;
            break;
        case 'E':
            *cert_usage = certUsageEmailSigner;
            break;
        case 'S':
            *cert_usage = certUsageObjectSigner;
            break;
        case 'C':
            *cert_usage = certUsageVerifyCA;
            break;
        default:
            return SECFailure;
    }

    return SECSuccess;
}

int
main(int argc, char **argv)
{
    int retval;
    PRFileDesc *in_file;
    FILE *out_file; /* not PRFileDesc until SECU accepts it */
    int crequest, dresponse;
    int prequest, presponse;
    int ccert, vcert;
    const char *db_dir, *date_str, *cert_usage_str, *name;
    const char *responder_name, *responder_url, *signer_name;
    PRBool add_acceptable_responses, add_service_locator;
    SECItem *data = NULL;
    PLOptState *optstate;
    SECStatus rv;
    CERTCertDBHandle *handle = NULL;
    SECCertUsage cert_usage = certUsageSSLClient;
    PRTime verify_time;
    CERTCertificate *cert = NULL;
    PRBool ascii = PR_FALSE;

    retval = -1; /* what we return/exit with on error */

    program_name = PL_strrchr(argv[0], '/');
    program_name = program_name ? (program_name + 1) : argv[0];

    in_file = PR_STDIN;
    out_file = stdout;

    crequest = 0;
    dresponse = 0;
    prequest = 0;
    presponse = 0;
    ccert = 0;
    vcert = 0;

    db_dir = NULL;
    date_str = NULL;
    cert_usage_str = NULL;
    name = NULL;
    responder_name = NULL;
    responder_url = NULL;
    signer_name = NULL;

    add_acceptable_responses = PR_FALSE;
    add_service_locator = PR_FALSE;

    optstate = PL_CreateOptState(argc, argv, "AHLPR:S:V:d:l:pr:s:t:u:w:");
    if (optstate == NULL) {
        SECU_PrintError(program_name, "PL_CreateOptState failed");
        return retval;
    }

    while (PL_GetNextOpt(optstate) == PL_OPT_OK) {
        switch (optstate->option) {
            case '?':
                short_usage(program_name);
                return retval;

            case 'A':
                add_acceptable_responses = PR_TRUE;
                break;

            case 'H':
                long_usage(program_name);
                return retval;

            case 'L':
                add_service_locator = PR_TRUE;
                break;

            case 'P':
                presponse = 1;
                break;

            case 'R':
                dresponse = 1;
                name = optstate->value;
                break;

            case 'S':
                ccert = 1;
                name = optstate->value;
                break;

            case 'V':
                vcert = 1;
                name = optstate->value;
                break;

            case 'a':
                ascii = PR_TRUE;
                break;

            case 'd':
                db_dir = optstate->value;
                break;

            case 'l':
                responder_url = optstate->value;
                break;

            case 'p':
                prequest = 1;
                break;

            case 'r':
                crequest = 1;
                name = optstate->value;
                break;

            case 's':
                signer_name = optstate->value;
                break;

            case 't':
                responder_name = optstate->value;
                break;

            case 'u':
                cert_usage_str = optstate->value;
                break;

            case 'w':
                date_str = optstate->value;
                break;
        }
    }

    PL_DestroyOptState(optstate);

    if ((crequest + dresponse + prequest + presponse + ccert + vcert) != 1) {
        PR_fprintf(PR_STDERR, "%s: must specify exactly one command\n\n",
                   program_name);
        short_usage(program_name);
        return retval;
    }

    if (vcert) {
        if (cert_usage_str == NULL) {
            PR_fprintf(PR_STDERR, "%s: verification requires cert usage\n\n",
                       program_name);
            short_usage(program_name);
            return retval;
        }

        rv = cert_usage_from_char(cert_usage_str, &cert_usage);
        if (rv != SECSuccess) {
            PR_fprintf(PR_STDERR, "%s: invalid cert usage (\"%s\")\n\n",
                       program_name, cert_usage_str);
            long_usage(program_name);
            return retval;
        }
    }

    if (ccert + vcert) {
        if (responder_url != NULL || responder_name != NULL) {
            /*
            * To do a full status check, both the URL and the cert name
            * of the responder must be specified if either one is.
            */
            if (responder_url == NULL || responder_name == NULL) {
                if (responder_url == NULL)
                    PR_fprintf(PR_STDERR,
                               "%s: must also specify responder location\n\n",
                               program_name);
                else
                    PR_fprintf(PR_STDERR,
                               "%s: must also specify responder name\n\n",
                               program_name);
                short_usage(program_name);
                return retval;
            }
        }

        if (date_str != NULL) {
            rv = DER_AsciiToTime(&verify_time, (char *)date_str);
            if (rv != SECSuccess) {
                SECU_PrintError(program_name, "error converting time string");
                PR_fprintf(PR_STDERR, "\n");
                long_usage(program_name);
                return retval;
            }
        } else {
            verify_time = PR_Now();
        }
    }

    retval = -2; /* errors change from usage to runtime */

    /*
     * Initialize the NSPR and Security libraries.
     */
    PR_Init(PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 1);
    db_dir = SECU_ConfigDirectory(db_dir);
    rv = NSS_Init(db_dir);
    if (rv != SECSuccess) {
        SECU_PrintError(program_name, "NSS_Init failed");
        goto prdone;
    }
    SECU_RegisterDynamicOids();

    if (prequest + presponse) {
        MAKE_FILE_BINARY(stdin);
        data = read_file_into_item(in_file, siBuffer);
        if (data == NULL) {
            SECU_PrintError(program_name, "problem reading input");
            goto nssdone;
        }
    }

    if (crequest + dresponse + presponse + ccert + vcert) {
        handle = CERT_GetDefaultCertDB();
        if (handle == NULL) {
            SECU_PrintError(program_name, "problem getting certdb handle");
            goto nssdone;
        }

        /*
        * It would be fine to do the enable for all of these commands,
        * but this way we check that everything but an overall verify
        * can be done without it.  That is, that the individual pieces
        * work on their own.
        */
        if (vcert) {
            rv = CERT_EnableOCSPChecking(handle);
            if (rv != SECSuccess) {
                SECU_PrintError(program_name, "error enabling OCSP checking");
                goto nssdone;
            }
        }

        if ((ccert + vcert) && (responder_name != NULL)) {
            rv = CERT_SetOCSPDefaultResponder(handle, responder_url,
                                              responder_name);
            if (rv != SECSuccess) {
                SECU_PrintError(program_name,
                                "error setting default responder");
                goto nssdone;
            }

            rv = CERT_EnableOCSPDefaultResponder(handle);
            if (rv != SECSuccess) {
                SECU_PrintError(program_name,
                                "error enabling default responder");
                goto nssdone;
            }
        }
    }

#define NOTYET(opt)                                         \
    {                                                       \
        PR_fprintf(PR_STDERR, "%s not yet working\n", opt); \
        exit(-1);                                           \
    }

    if (name) {
        cert = find_certificate(handle, name, ascii);
    }

    if (crequest) {
        if (signer_name != NULL) {
            NOTYET("-s");
        }
        rv = create_request(out_file, handle, cert, add_service_locator,
                            add_acceptable_responses);
    } else if (dresponse) {
        if (signer_name != NULL) {
            NOTYET("-s");
        }
        rv = dump_response(out_file, handle, cert, responder_url);
    } else if (prequest) {
        rv = print_request(out_file, data);
    } else if (presponse) {
        rv = print_response(out_file, data, handle);
    } else if (ccert) {
        if (signer_name != NULL) {
            NOTYET("-s");
        }
        rv = get_cert_status(out_file, handle, cert, name, verify_time);
    } else if (vcert) {
        if (signer_name != NULL) {
            NOTYET("-s");
        }
        rv = verify_cert(out_file, handle, cert, name, cert_usage, verify_time);
    }

    if (rv != SECSuccess)
        SECU_PrintError(program_name, "error performing requested operation");
    else
        retval = 0;

nssdone:
    if (cert) {
        CERT_DestroyCertificate(cert);
    }

    if (data != NULL) {
        SECITEM_FreeItem(data, PR_TRUE);
    }

    if (handle != NULL) {
        CERT_DisableOCSPDefaultResponder(handle);
        CERT_DisableOCSPChecking(handle);
    }

    if (NSS_Shutdown() != SECSuccess) {
        retval = 1;
    }

prdone:
    PR_Cleanup();
    return retval;
}