Botan::OCSP::SingleResponse Class Reference

#include <ocsp.h>

Inheritance diagram for Botan::OCSP::SingleResponse:

Public Member Functions
std::vector< uint8_t >	BER_encode () const
size_t	cert_status () const
const CertID &	certid () const
void	decode_from (BER_Decoder &from) override
void	encode_into (DER_Encoder &to) const override
bool	has_unknown_critical_extension () const
const X509_Time &	next_update () const
const std::optional< CRL_Code > &	revocation_reason () const
	The revocationReason, when cert_status() is 1 and one was provided.
const std::optional< X509_Time > &	revocation_time () const
	The revocationTime; set only when cert_status() is 1 (revoked).
	SingleResponse ()=default
const X509_Time &	this_update () const

Static Public Member Functions
static SingleResponse	good (CertID certid, X509_Time this_update, X509_Time next_update)
static SingleResponse	revoked (CertID certid, X509_Time revocation_time, std::optional< CRL_Code > reason, X509_Time this_update, X509_Time next_update)
	As good(), but asserting a revoked status with the given RevokedInfo.
static SingleResponse	unknown (CertID certid, X509_Time this_update, X509_Time next_update)
	As good(), but asserting an unknown status.

Detailed Description

Definition at line 51 of file ocsp.h.

Constructor & Destructor Documentation

SingleResponse()

Botan::OCSP::SingleResponse::SingleResponse ( )

default

References certid(), good(), next_update(), revocation_time(), revoked(), SingleResponse(), this_update(), and unknown().

Referenced by good(), revoked(), SingleResponse(), and unknown().

Member Function Documentation

BER_encode()

std::vector< uint8_t > Botan::ASN1_Object::BER_encode ( ) const

inherited

Return the encoding of this object. This is a convenience method when just one object needs to be serialized. Use DER_Encoder for complicated encodings.

Definition at line 21 of file asn1_obj.cpp.

                                                 {
   std::vector<uint8_t> output;
   DER_Encoder der(output);
   this->encode_into(der);
   return output;
}

References encode_into().

Referenced by decode_from(), Botan::PKCS12::export_to(), Botan::Certificate_Store_In_SQL::find_all_certs(), Botan::Certificate_Store_In_SQL::find_cert(), Botan::X509_Certificate::fingerprint(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::X509_Object::PEM_encode(), and Botan::PSS_Params::PSS_Params().

cert_status()

size_t Botan::OCSP::SingleResponse::cert_status ( ) const

inline

Definition at line 74 of file ocsp.h.

{ return m_cert_status; }

Referenced by decode_from().

certid()

const CertID & Botan::OCSP::SingleResponse::certid ( ) const

inline

Definition at line 72 of file ocsp.h.

{ return m_certid; }

Referenced by good(), revoked(), SingleResponse(), and unknown().

decode_from()

void Botan::OCSP::SingleResponse::decode_from ( BER_Decoder & from )

overridevirtual

Decode whatever this object is from from

Parameters

from	the BER_Decoder that will be read from

Implements Botan::ASN1_Object.

Definition at line 214 of file ocsp.cpp.

                                                  {
   /*
   * RFC 6960 Section 4.2.1
   *
   * SingleResponse ::= SEQUENCE {
   *    certID                       CertID,
   *    certStatus                   CertStatus,
   *    thisUpdate                   GeneralizedTime,
   *    nextUpdate         [0]       EXPLICIT GeneralizedTime OPTIONAL,
   *    singleExtensions   [1]       EXPLICIT Extensions OPTIONAL }
   *
   * CertStatus ::= CHOICE {
   *    good        [0]     IMPLICIT NULL,
   *    revoked     [1]     IMPLICIT RevokedInfo,
   *    unknown     [2]     IMPLICIT UnknownInfo }
   *
   * RevokedInfo ::= SEQUENCE {
   *    revocationTime              GeneralizedTime,
   *    revocationReason    [0]     EXPLICIT CRLReason OPTIONAL }
   */
   BER_Object cert_status;
   Extensions extensions;
 
   auto seq = from.start_sequence();
   seq.decode(m_certid)
      .get_next(cert_status)
      .decode(m_thisupdate)
      .decode_optional(m_nextupdate, ASN1_Type(0), ASN1_Class::ContextSpecific | ASN1_Class::Constructed);
 
   check_generalized_time(m_thisupdate, "thisUpdate");
   if(m_nextupdate.time_is_set()) {
      check_generalized_time(m_nextupdate, "nextUpdate");
   }
 
   if(seq.more_items()) {
      const BER_Object next = seq.get_next_object();
      if(next.is_a(1, ASN1_Class::ContextSpecific | ASN1_Class::Constructed)) {
         BER_Decoder ext_decoder(next, BER_Decoder::Limits::DER());
         extensions.decode_from(ext_decoder, Extension_Context::OCSP_Response);
         ext_decoder.verify_end();
      } else {
         throw Decoding_Error("Unexpected tag in OCSP SingleResponse");
      }
   }
   seq.end_cons();
 
   const auto cert_status_class = cert_status.get_class();
   if(cert_status_class != ASN1_Class::ContextSpecific &&
      cert_status_class != (ASN1_Class::ContextSpecific | ASN1_Class::Constructed)) {
      throw Decoding_Error("OCSP::SingleResponse: certStatus has unexpected class tag");
   }
 
   m_cert_status = static_cast<uint32_t>(cert_status.type());
   if(m_cert_status > 2) {
      throw Decoding_Error("Unknown OCSP CertStatus tag");
   }
 
   m_revocation_time.reset();
   m_revocation_reason.reset();
 
   if(m_cert_status == 1) {
      BER_Decoder revoked_info(cert_status, BER_Decoder::Limits::DER());
      X509_Time revocation_time;
      revoked_info.decode(revocation_time);
      check_generalized_time(revocation_time, "revocationTime");
      m_revocation_time = std::move(revocation_time);
 
      if(revoked_info.peek_next_object().is_a(0, ASN1_Class::ContextSpecific | ASN1_Class::Constructed)) {
         size_t reason = 0;
         revoked_info.start_context_specific(0).decode(reason, ASN1_Type::Enumerated, ASN1_Class::Universal).end_cons();
         if(reason == 7 || reason > 10) {
            throw Decoding_Error(fmt("CRLReason has unknown enumeration value {}", reason));
         }
         m_revocation_reason = static_cast<CRL_Code>(reason);
      }
      revoked_info.verify_end();
   } else if(cert_status.length() != 0) {
      // good [0] / unknown [2] are both IMPLICIT NULL
      throw Decoding_Error("OCSP CertStatus has unexpected content");
   }
 
   // We don't currently recognize any extensions here so if any are critical we should reject
   m_has_unknown_critical_ext = !extensions.critical_extensions().empty();
}

References cert_status(), Botan::Constructed, Botan::ContextSpecific, Botan::Extensions::critical_extensions(), Botan::BER_Decoder::decode(), Botan::Extensions::decode_from(), Botan::BER_Decoder::decode_optional(), Botan::BER_Decoder::Limits::DER(), Botan::BER_Decoder::end_cons(), Botan::Enumerated, Botan::fmt(), Botan::BER_Decoder::get_next(), Botan::BER_Object::is_a(), Botan::OCSP_Response, Botan::BER_Decoder::peek_next_object(), revocation_time(), Botan::BER_Decoder::start_context_specific(), Botan::BER_Decoder::start_sequence(), Botan::Universal, and Botan::BER_Decoder::verify_end().

encode_into()

void Botan::OCSP::SingleResponse::encode_into ( DER_Encoder & to ) const

overridevirtual

Encode whatever this object is into to

Parameters

to	the DER_Encoder that will be written to

Implements Botan::ASN1_Object.

Definition at line 187 of file ocsp.cpp.

                                                      {
   // The SingleResponse / CertStatus / RevokedInfo ASN.1 is quoted in
   // decode_from below
   to.start_sequence();
   to.encode(m_certid);
   if(m_cert_status == 1) {
      // NOLINTNEXTLINE(clang-analyzer-optin.core.EnumCastOutOfRange)
      to.start_cons(ASN1_Type(1), ASN1_Class::ContextSpecific).encode(m_revocation_time.value());
      if(m_revocation_reason.has_value() && *m_revocation_reason != CRL_Code::Unspecified) {
         to.start_explicit(0)
            .encode(static_cast<size_t>(*m_revocation_reason), ASN1_Type::Enumerated, ASN1_Class::Universal)
            .end_explicit();
      }
      to.end_cons();
   } else {
      // good [0] / unknown [2], both IMPLICIT NULL
      const std::span<const uint8_t> empty;
      // NOLINTNEXTLINE(clang-analyzer-optin.core.EnumCastOutOfRange)
      to.add_object(ASN1_Type(m_cert_status), ASN1_Class::ContextSpecific, empty);
   }
   to.encode(m_thisupdate);
   if(m_nextupdate.time_is_set()) {
      to.start_explicit(0).encode(m_nextupdate).end_explicit();
   }
   to.end_cons();
}

References Botan::DER_Encoder::add_object(), Botan::ContextSpecific, Botan::DER_Encoder::encode(), Botan::DER_Encoder::end_cons(), Botan::DER_Encoder::end_explicit(), Botan::Enumerated, Botan::DER_Encoder::start_cons(), Botan::DER_Encoder::start_explicit(), Botan::DER_Encoder::start_sequence(), Botan::Universal, and Botan::Unspecified.

good()

SingleResponse Botan::OCSP::SingleResponse::good ( CertID certid, X509_Time this_update, X509_Time next_update )

static

Create a SingleResponse asserting a good status, as emitted by an OCSP responder. All times must be tagged as GeneralizedTime; an unset next_update omits the optional nextUpdate field.

Definition at line 136 of file ocsp.cpp.

                                                                                               {
   return SingleResponse(
      std::move(certid), 0, std::nullopt, std::nullopt, std::move(this_update), std::move(next_update));
}

References certid(), next_update(), SingleResponse(), and this_update().

Referenced by SingleResponse().

has_unknown_critical_extension()

bool Botan::OCSP::SingleResponse::has_unknown_critical_extension ( ) const

inline

Definition at line 90 of file ocsp.h.

{ return m_has_unknown_critical_ext; }

next_update()

const X509_Time & Botan::OCSP::SingleResponse::next_update ( ) const

inline

Definition at line 78 of file ocsp.h.

{ return m_nextupdate; }

Referenced by good(), revoked(), SingleResponse(), and unknown().

revocation_reason()

const std::optional< CRL_Code > & Botan::OCSP::SingleResponse::revocation_reason ( ) const

inline

The revocationReason, when cert_status() is 1 and one was provided.

Definition at line 84 of file ocsp.h.

{ return m_revocation_reason; }

revocation_time()

const std::optional< X509_Time > & Botan::OCSP::SingleResponse::revocation_time ( ) const

inline

The revocationTime; set only when cert_status() is 1 (revoked).

Definition at line 81 of file ocsp.h.

{ return m_revocation_time; }

Referenced by decode_from(), revoked(), and SingleResponse().

revoked()

SingleResponse Botan::OCSP::SingleResponse::revoked ( CertID certid, X509_Time revocation_time, std::optional< CRL_Code > reason, X509_Time this_update, X509_Time next_update )

static

As good(), but asserting a revoked status with the given RevokedInfo.

Definition at line 148 of file ocsp.cpp.

                                                              {
   return SingleResponse(
      std::move(certid), 1, std::move(revocation_time), reason, std::move(this_update), std::move(next_update));
}

References certid(), next_update(), revocation_time(), SingleResponse(), and this_update().

Referenced by SingleResponse().

this_update()

const X509_Time & Botan::OCSP::SingleResponse::this_update ( ) const

inline

Definition at line 76 of file ocsp.h.

{ return m_thisupdate; }

Referenced by good(), revoked(), SingleResponse(), and unknown().

unknown()

SingleResponse Botan::OCSP::SingleResponse::unknown ( CertID certid, X509_Time this_update, X509_Time next_update )

static

As good(), but asserting an unknown status.

Definition at line 142 of file ocsp.cpp.

                                                                                                  {
   return SingleResponse(
      std::move(certid), 2, std::nullopt, std::nullopt, std::move(this_update), std::move(next_update));
}

References certid(), next_update(), SingleResponse(), and this_update().

Referenced by SingleResponse().

---

The documentation for this class was generated from the following files:

• src/lib/x509/ocsp.h
• src/lib/x509/ocsp.cpp