Add ocspreq command

CMakeLists.txt

@@ -146,6 +146,7 @@ set(tools
 	tools/certparse.c
 	tools/certverify.c
 	tools/certrevoke.c
+	tools/ocspreq.c
 	tools/reqgen.c
 	tools/reqparse.c
 	tools/reqsign.c

include/gmssl/ocsp.h

@@ -199,6 +199,47 @@ KeyHash ::= OCTET STRING
 
 
 
+int ocsp_response_data_to_der(
+	int responder_id_type, const uint8_t *responder_id, size_t responder_id_len,
+	time_t produced_at,
+	const uint8_t *single_response, size_t single_response_len,
+	const uint8_t *response_exts, size_t response_exts_len,
+	uint8_t **out, size_t *outlen);
+int ocsp_response_data_from_der(
+	int *responder_id_type, const uint8_t **responder_id, size_t *responder_id_len,
+	time_t *produced_at,
+	const uint8_t **single_response_first, size_t *single_response_first_len,
+	const uint8_t **single_response_others, size_t *single_response_others_len,
+	const uint8_t **response_exts, size_t *response_exts_len,
+	const uint8_t **in, size_t *inlen);
+int ocsp_response_data_print(FILE *fp, int fmt, int ind, const char *label,
+	const uint8_t *d, size_t dlen);
+
+
+int ocsp_basic_response_to_der(
+	const uint8_t *response_data, size_t response_data_len,
+	int signature_algor,
+	const uint8_t *signature, size_t signature_len,
+	const uint8_t *certs, size_t certs_len,
+	uint8_t **out, size_t *outlen);
+int ocsp_basic_response_from_der(
+	const uint8_t **response_data, size_t *response_data_len,
+	int *signature_algor,
+	const uint8_t **signature, size_t *signature_len,
+	const uint8_t **certs, size_t *certs_len,
+	const uint8_t **in, size_t *inlen);
+int ocsp_basic_response_print(FILE *fp, int fmt, int ind, const char *label,
+	const uint8_t *d, size_t dlen);
+
+
+int ocsp_response_to_der(int response_status,
+	const uint8_t *basic_response, size_t basic_response_len,
+	uint8_t **out, size_t *outlen);
+int ocsp_response_from_der(int *response_status,
+	const uint8_t **basic_response, size_t *basic_response_len,
+	const uint8_t **in, size_t *inlen);
+int ocsp_response_print(FILE *fp, int fmt, int ind, const char *label,
+	const uint8_t *d, size_t dlen);
 
 
 
@@ -238,6 +279,12 @@ PreferredSignatureAlgorithm ::= SEQUENCE {
 
 
 
+
+
+
+
+
+
 #ifdef __cplusplus
 }
 #endif

src/ocsp.c

@@ -108,8 +108,6 @@ int ocsp_request_item_from_der(int *hash_algor,
 int ocsp_request_item_print(FILE *fp, int fmt, int ind, const char *label,
 	const uint8_t *d, size_t dlen)
 {
-	const uint8_t *seq;
-	size_t seq_len;
 	const uint8_t *p;
 	size_t len;
 	const uint8_t *cert_id;
@@ -125,12 +123,8 @@ int ocsp_request_item_print(FILE *fp, int fmt, int ind, const char *label,
 	format_print(fp, fmt, ind, "%s\n", label);
 	ind += 4;
 
-	if (asn1_sequence_from_der(&seq, &seq_len, &d, &dlen) != 1) {
-		error_print();
-		return -1;
-	}
 	format_print(fp, fmt, ind, "reqCert\n");
-	if (asn1_sequence_from_der(&cert_id, &cert_id_len, &seq, &seq_len) != 1
+	if (asn1_sequence_from_der(&cert_id, &cert_id_len, &d, &dlen) != 1
 		|| x509_digest_algor_from_der(&hash_algor, &cert_id, &cert_id_len) != 1
 		|| asn1_octet_string_from_der(&issuer_name_hash, &issuer_name_hash_len, &cert_id, &cert_id_len) != 1
 		|| asn1_octet_string_from_der(&issuer_key_hash, &issuer_key_hash_len, &cert_id, &cert_id_len) != 1
@@ -143,7 +137,7 @@ int ocsp_request_item_print(FILE *fp, int fmt, int ind, const char *label,
 	format_bytes(fp, fmt, ind + 4, "issuerKeyHash", issuer_key_hash, issuer_key_hash_len);
 	format_bytes(fp, fmt, ind + 4, "serialNumber", serial, serial_len);
 	if (asn1_length_is_zero(cert_id_len) != 1
-		|| x509_explicit_exts_from_der(0, &p, &len, &seq, &seq_len) < 0) {
+		|| x509_explicit_exts_from_der(0, &p, &len, &d, &dlen) < 0) {
 		error_print();
 		return -1;
 	}
@@ -151,8 +145,7 @@ int ocsp_request_item_print(FILE *fp, int fmt, int ind, const char *label,
 		error_print();
 		return -1;
 	}
-	if (asn1_length_is_zero(seq_len) != 1
-		|| asn1_length_is_zero(dlen) != 1) {
+	if (asn1_length_is_zero(dlen) != 1) {
 		error_print();
 		return -1;
 	}
@@ -238,8 +231,6 @@ int ocsp_request_from_der(int *version,
 int ocsp_request_print(FILE *fp, int fmt, int ind, const char *label,
 	const uint8_t *d, size_t dlen)
 {
-	const uint8_t *seq;
-	size_t seq_len;
 	const uint8_t *p;
 	size_t len;
 	const uint8_t *tbs_request;
@@ -252,8 +243,7 @@ int ocsp_request_print(FILE *fp, int fmt, int ind, const char *label,
 	format_print(fp, fmt, ind, "%s\n", label);
 	ind += 4;
 
-	if (asn1_sequence_from_der(&seq, &seq_len, &d, &dlen) != 1
-		|| asn1_sequence_from_der(&tbs_request, &tbs_request_len, &seq, &seq_len) != 1) {
+	if (asn1_sequence_from_der(&tbs_request, &tbs_request_len, &d, &dlen) != 1) {
 		error_print();
 		return -1;
 	}
@@ -282,7 +272,7 @@ int ocsp_request_print(FILE *fp, int fmt, int ind, const char *label,
 	while (request_list_len) {
 		const uint8_t *request;
 		size_t request_len;
-		if (asn1_any_from_der(&request, &request_len, &request_list, &request_list_len) != 1
+		if (asn1_sequence_from_der(&request, &request_len, &request_list, &request_list_len) != 1
 			|| ocsp_request_item_print(fp, fmt, ind + 4, "Request", request, request_len) != 1) {
 			error_print();
 			return -1;
@@ -301,13 +291,12 @@ int ocsp_request_print(FILE *fp, int fmt, int ind, const char *label,
 		return -1;
 	}
 	ind -= 4;
-	if (asn1_explicit_from_der(0, &p, &len, &seq, &seq_len) < 0) {
+	if (asn1_explicit_from_der(0, &p, &len, &d, &dlen) < 0) {
 		error_print();
 		return -1;
 	}
 	if (p) format_bytes(fp, fmt, ind, "optionalSignature", p, len);
-	if (asn1_length_is_zero(seq_len) != 1
-		|| asn1_length_is_zero(dlen) != 1) {
+	if (asn1_length_is_zero(dlen) != 1) {
 		error_print();
 		return -1;
 	}
@@ -882,8 +871,6 @@ static int ocsp_single_response_ext_print(FILE *fp, int fmt, int ind, const char
 int ocsp_single_response_print(FILE *fp, int fmt, int ind, const char *label,
 	const uint8_t *d, size_t dlen)
 {
-	const uint8_t *seq;
-	size_t seq_len;
 	const uint8_t *cert_id;
 	size_t cert_id_len;
 	const uint8_t *p;
@@ -902,14 +889,9 @@ int ocsp_single_response_print(FILE *fp, int fmt, int ind, const char *label,
 	format_print(fp, fmt, ind, "%s\n", label);
 	ind += 4;
 
-	if (asn1_sequence_from_der(&seq, &seq_len, &d, &dlen) != 1) {
-		error_print();
-		return -1;
-	}
-
 	// certID
 	format_print(fp, fmt, ind, "certID\n");
-	if (asn1_sequence_from_der(&cert_id, &cert_id_len, &seq, &seq_len) != 1
+	if (asn1_sequence_from_der(&cert_id, &cert_id_len, &d, &dlen) != 1
 		|| x509_digest_algor_from_der(&hash_algor, &cert_id, &cert_id_len) != 1
 		|| asn1_octet_string_from_der(&issuer_name_hash, &issuer_name_hash_len, &cert_id, &cert_id_len) != 1
 		|| asn1_octet_string_from_der(&issuer_key_hash, &issuer_key_hash_len, &cert_id, &cert_id_len) != 1
@@ -927,13 +909,13 @@ int ocsp_single_response_print(FILE *fp, int fmt, int ind, const char *label,
 	}
 
 	// certStatus
-	if (asn1_tag_from_der_readonly(&tag, &seq, &seq_len) != 1) {
+	if (asn1_tag_from_der_readonly(&tag, &d, &dlen) != 1) {
 		error_print();
 		return -1;
 	}
 	switch (tag) {
 	case ASN1_TAG_IMPLICIT(0):
-		if (asn1_implicit_from_der(0, &p, &len, &seq, &seq_len) != 1 || len != 0) {
+		if (asn1_implicit_from_der(0, &p, &len, &d, &dlen) != 1 || len != 0) {
 			error_print();
 			return -1;
 		}
@@ -941,7 +923,7 @@ int ocsp_single_response_print(FILE *fp, int fmt, int ind, const char *label,
 		format_print(fp, fmt, ind, "certStatus: %s\n", ocsp_cert_status_name(cert_status));
 		break;
 	case ASN1_TAG_EXPLICIT(1):
-		if (asn1_type_from_der(ASN1_TAG_EXPLICIT(1), &p, &len, &seq, &seq_len) != 1) {
+		if (asn1_type_from_der(ASN1_TAG_EXPLICIT(1), &p, &len, &d, &dlen) != 1) {
 			error_print();
 			return -1;
 		}
@@ -953,7 +935,7 @@ int ocsp_single_response_print(FILE *fp, int fmt, int ind, const char *label,
 		}
 		break;
 	case ASN1_TAG_IMPLICIT(2):
-		if (asn1_implicit_from_der(2, &p, &len, &seq, &seq_len) != 1 || len != 0) {
+		if (asn1_implicit_from_der(2, &p, &len, &d, &dlen) != 1 || len != 0) {
 			error_print();
 			return -1;
 		}
@@ -966,14 +948,14 @@ int ocsp_single_response_print(FILE *fp, int fmt, int ind, const char *label,
 	}
 
 	// thisUpdate
-	if (asn1_generalized_time_from_der(&tv, &seq, &seq_len) != 1) {
+	if (asn1_generalized_time_from_der(&tv, &d, &dlen) != 1) {
 		error_print();
 		return -1;
 	}
 	format_print(fp, fmt, ind, "thisUpdate: %s", ctime(&tv));
 
 	// nextUpdate [0]
-	if (asn1_explicit_from_der(0, &p, &len, &seq, &seq_len) < 0) {
+	if (asn1_explicit_from_der(0, &p, &len, &d, &dlen) < 0) {
 		error_print();
 		return -1;
 	}
@@ -987,7 +969,7 @@ int ocsp_single_response_print(FILE *fp, int fmt, int ind, const char *label,
 	}
 
 	// singleExtensions [1]
-	if (x509_explicit_exts_from_der(1, &p, &len, &seq, &seq_len) < 0) {
+	if (x509_explicit_exts_from_der(1, &p, &len, &d, &dlen) < 0) {
 		error_print();
 		return -1;
 	}
@@ -1005,10 +987,634 @@ int ocsp_single_response_print(FILE *fp, int fmt, int ind, const char *label,
 		}
 	}
 
-	if (asn1_length_is_zero(seq_len) != 1
+	if (asn1_length_is_zero(dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	return 1;
+}
+
+
+int ocsp_response_data_to_der(
+	int responder_id_type, const uint8_t *responder_id, size_t responder_id_len,
+	time_t produced_at,
+	const uint8_t *single_response, size_t single_response_len,
+	const uint8_t *response_exts, size_t response_exts_len,
+	uint8_t **out, size_t *outlen)
+{
+	size_t responses_len = 0;
+	size_t len = 0;
+
+
+	// 准备一个responder_id的buf，这样不用充分计算了
+
+	if (!responder_id || !responder_id_len
+		|| !single_response || !single_response_len) {
+		error_print();
+		return -1;
+	}
+	switch (responder_id_type) {
+	case OCSP_responder_id_by_name:
+		if (asn1_explicit_to_der(1, responder_id, responder_id_len, NULL, &len) != 1) {
+			error_print();
+			return -1;
+		}
+		break;
+	case OCSP_responder_id_by_key:
+		if (asn1_implicit_octet_string_to_der(2, responder_id, responder_id_len, NULL, &len) != 1) {
+			error_print();
+			return -1;
+		}
+		break;
+	default:
+		error_print();
+		return -1;
+	}
+	if (asn1_generalized_time_to_der(produced_at, NULL, &len) != 1
+		|| asn1_any_to_der(single_response, single_response_len, NULL, &responses_len) != 1) {
+		error_print();
+		return -1;
+	}
+
+	if (asn1_sequence_header_to_der(responses_len, NULL, &len) != 1
+		|| x509_explicit_exts_to_der(1, response_exts, response_exts_len, NULL, &len) < 0
+		|| asn1_sequence_header_to_der(len, out, outlen) != 1) {
+		error_print();
+		return -1;
+	}
+	switch (responder_id_type) {
+	case OCSP_responder_id_by_name:
+		if (asn1_explicit_to_der(1, responder_id, responder_id_len, out, outlen) != 1) {
+			error_print();
+			return -1;
+		}
+		break;
+	case OCSP_responder_id_by_key:
+		if (asn1_implicit_octet_string_to_der(2, responder_id, responder_id_len, out, outlen) != 1) {
+			error_print();
+			return -1;
+		}
+		break;
+	}
+	if (asn1_generalized_time_to_der(produced_at, out, outlen) != 1
+		|| asn1_sequence_header_to_der(responses_len, out, outlen) != 1
+		|| asn1_any_to_der(single_response, single_response_len, out, outlen) != 1
+		|| x509_explicit_exts_to_der(1, response_exts, response_exts_len, out, outlen) < 0) {
+		error_print();
+		return -1;
+	}
+	return 1;
+}
+
+int ocsp_response_data_from_der(
+	int *responder_id_type, const uint8_t **responder_id, size_t *responder_id_len,
+	time_t *produced_at,
+	const uint8_t **single_response_first, size_t *single_response_first_len,
+	const uint8_t **single_response_others, size_t *single_response_others_len,
+	const uint8_t **response_exts, size_t *response_exts_len,
+	const uint8_t **in, size_t *inlen)
+{
+	int ret;
+	int version = X509_version_v1;
+	int tag;
+	const uint8_t *d;
+	size_t dlen;
+	const uint8_t *responses;
+	size_t responses_len;
+	const uint8_t *p;
+	size_t len;
+
+	if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
+		if (ret < 0) error_print();
+		return ret;
+	}
+	if (x509_explicit_version_from_der(0, &version, &d, &dlen) < 0) {
+		error_print();
+		return -1;
+	}
+	if (version == -1) {
+		version = X509_version_v1;
+	}
+	if (version != X509_version_v1) {
+		error_print();
+		return -1;
+	}
+
+
+	if (asn1_tag_from_der_readonly(&tag, &d, &dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	switch (tag) {
+	case ASN1_TAG_EXPLICIT(1):
+		if (asn1_explicit_from_der(1, responder_id, responder_id_len, &d, &dlen) != 1) {
+			error_print();
+			return -1;
+		}
+		*responder_id_type = OCSP_responder_id_by_name;
+		break;
+	case ASN1_TAG_IMPLICIT(2):
+		if (asn1_implicit_octet_string_from_der(2, responder_id, responder_id_len, &d, &dlen) != 1) {
+			error_print();
+			return -1;
+		}
+		*responder_id_type = OCSP_responder_id_by_key;
+		break;
+	default:
+		error_print();
+		return -1;
+	}
+
+	if (asn1_generalized_time_from_der(produced_at, &d, &dlen) != 1) {
+		error_print();
+		return -1;
+	}
+
+
+	if (asn1_sequence_from_der(&responses, &responses_len, &d, &dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	if (!responses) {
+		error_print();
+		return -1;
+	}
+	if (asn1_any_from_der(single_response_first, single_response_first_len, &responses, &responses_len) != 1) {
+		error_print();
+		return -1;
+	}
+	*single_response_others = responses;
+	*single_response_others_len = responses_len;
+	while (responses_len) {
+		if (asn1_sequence_from_der(&p, &len, &responses, &responses_len) != 1) {
+			error_print();
+			return -1;
+		}
+	}
+
+	if (x509_explicit_exts_from_der(1, response_exts, response_exts_len, &d, &dlen) < 0) {
+		error_print();
+		return -1;
+	}
+
+
+	if (dlen) {
+		error_print();
+		return -1;
+	}
+	return 1;
+}
+
+int ocsp_response_data_print(FILE *fp, int fmt, int ind, const char *label,
+	const uint8_t *d, size_t dlen)
+{
+	int ret;
+	int version = X509_version_v1;
+	int tag;
+	const uint8_t *p;
+	size_t len;
+	const uint8_t *responses;
+	size_t responses_len;
+	time_t produced_at;
+
+	format_print(fp, fmt, ind, "%s\n", label);
+	ind += 4;
+
+	if ((ret = x509_explicit_version_from_der(0, &version, &d, &dlen)) < 0) {
+		error_print();
+		return -1;
+	}
+	if (version == -1) {
+		version = X509_version_v1;
+	}
+	if (ret) {
+		format_print(fp, fmt, ind, "version: v1 (%d)\n", version);
+	}
+	if (version != X509_version_v1
+		|| asn1_tag_from_der_readonly(&tag, &d, &dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	switch (tag) {
+	case ASN1_TAG_EXPLICIT(1):
+		if (asn1_explicit_from_der(1, &p, &len, &d, &dlen) != 1) {
+			error_print();
+			return -1;
+		}
+		{
+			const uint8_t *name = p;
+			size_t name_len = len;
+
+			if (asn1_sequence_from_der(&p, &len, &name, &name_len) != 1
+				|| x509_name_print(fp, fmt, ind, "responderID.byName", p, len) != 1
+				|| asn1_length_is_zero(name_len) != 1) {
+				error_print();
+				return -1;
+			}
+		}
+		break;
+	case ASN1_TAG_IMPLICIT(2):
+		if (asn1_implicit_octet_string_from_der(2, &p, &len, &d, &dlen) != 1) {
+			error_print();
+			return -1;
+		}
+		format_bytes(fp, fmt, ind, "responderID.byKey", p, len);
+		break;
+	default:
+		error_print();
+		return -1;
+	}
+	if (asn1_generalized_time_from_der(&produced_at, &d, &dlen) != 1
+		|| asn1_sequence_from_der(&responses, &responses_len, &d, &dlen) != 1
+		|| !responses_len) {
+		error_print();
+		return -1;
+	}
+	format_print(fp, fmt, ind, "producedAt: %s", ctime(&produced_at));
+	format_print(fp, fmt, ind, "responses\n");
+	while (responses_len) {
+		if (asn1_sequence_from_der(&p, &len, &responses, &responses_len) != 1
+			|| ocsp_single_response_print(fp, fmt, ind + 4, "SingleResponse", p, len) != 1) {
+			error_print();
+			return -1;
+		}
+	}
+	if (x509_explicit_exts_from_der(1, &p, &len, &d, &dlen) < 0) {
+		error_print();
+		return -1;
+	}
+	if (p && x509_exts_print(fp, fmt, ind, "responseExtensions", p, len) != 1) {
+		error_print();
+		return -1;
+	}
+	if (asn1_length_is_zero(dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	return 1;
+}
+
+int ocsp_basic_response_to_der(
+	const uint8_t *response_data, size_t response_data_len,
+	int signature_algor,
+	const uint8_t *signature, size_t signature_len,
+	const uint8_t *certs, size_t certs_len,
+	uint8_t **out, size_t *outlen)
+{
+	size_t certs_seq_len = 0;
+	size_t len = 0;
+
+	if (!response_data || !response_data_len
+		|| !signature || !signature_len) {
+		error_print();
+		return -1;
+	}
+	if (!certs && certs_len) {
+		error_print();
+		return -1;
+	}
+	if (certs_len) {
+		if (asn1_sequence_to_der(certs, certs_len, NULL, &certs_seq_len) != 1) {
+			error_print();
+			return -1;
+		}
+	}
+	if (asn1_any_to_der(response_data, response_data_len, NULL, &len) != 1
+		|| x509_signature_algor_to_der(signature_algor, NULL, &len) != 1
+		|| asn1_bit_octets_to_der(signature, signature_len, NULL, &len) != 1
+		|| (certs_len && asn1_explicit_header_to_der(0, certs_seq_len, NULL, &len) != 1)
+		|| asn1_sequence_header_to_der(len, out, outlen) != 1
+		|| asn1_any_to_der(response_data, response_data_len, out, outlen) != 1
+		|| x509_signature_algor_to_der(signature_algor, out, outlen) != 1
+		|| asn1_bit_octets_to_der(signature, signature_len, out, outlen) != 1) {
+		error_print();
+		return -1;
+	}
+	if (certs_len) {
+		if (asn1_explicit_header_to_der(0, certs_seq_len, out, outlen) != 1
+			|| asn1_sequence_to_der(certs, certs_len, out, outlen) != 1) {
+			error_print();
+			return -1;
+		}
+	}
+	return 1;
+}
+
+int ocsp_basic_response_from_der(
+	const uint8_t **response_data, size_t *response_data_len,
+	int *signature_algor,
+	const uint8_t **signature, size_t *signature_len,
+	const uint8_t **certs, size_t *certs_len,
+	const uint8_t **in, size_t *inlen)
+{
+	int ret;
+	const uint8_t *d;
+	size_t dlen;
+	const uint8_t *p;
+	size_t len;
+
+	if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
+		if (ret < 0) error_print();
+		return ret;
+	}
+	if (asn1_any_from_der(response_data, response_data_len, &d, &dlen) != 1
+		|| x509_signature_algor_from_der(signature_algor, &d, &dlen) != 1
+		|| asn1_bit_octets_from_der(signature, signature_len, &d, &dlen) != 1
+		|| asn1_explicit_from_der(0, &p, &len, &d, &dlen) < 0
+		|| asn1_length_is_zero(dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	if (p) {
+		if (asn1_sequence_from_der(certs, certs_len, &p, &len) != 1
+			|| asn1_length_is_zero(len) != 1) {
+			error_print();
+			return -1;
+		}
+	} else {
+		*certs = NULL;
+		*certs_len = 0;
+	}
+	return 1;
+}
+
+int ocsp_basic_response_print(FILE *fp, int fmt, int ind, const char *label,
+	const uint8_t *d, size_t dlen)
+{
+	const uint8_t *p;
+	size_t len;
+
+	format_print(fp, fmt, ind, "%s\n", label);
+	ind += 4;
+
+	if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1
+		|| ocsp_response_data_print(fp, fmt, ind, "tbsResponseData", p, len) != 1
+		|| asn1_sequence_from_der(&p, &len, &d, &dlen) != 1
+		|| x509_signature_algor_print(fp, fmt, ind, "signatureAlgorithm", p, len) != 1
+		|| asn1_bit_octets_from_der(&p, &len, &d, &dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	format_bytes(fp, fmt, ind, "signature", p, len);
+	if (asn1_explicit_from_der(0, &p, &len, &d, &dlen) < 0) {
+		error_print();
+		return -1;
+	}
+	if (p) {
+		const uint8_t *certs_seq = p;
+		size_t certs_seq_len = len;
+
+		if (asn1_sequence_from_der(&p, &len, &certs_seq, &certs_seq_len) != 1
+			|| x509_certs_print(fp, fmt, ind, "certs", p, len) != 1
+			|| asn1_length_is_zero(certs_seq_len) != 1) {
+			error_print();
+			return -1;
+		}
+	}
+	if (asn1_length_is_zero(dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	return 1;
+}
+
+
+
+
+
+static const uint32_t oid_pkix_ocsp_basic[] = { 1,3,6,1,5,5,7,48,1,1 };
+
+static int ocsp_response_bytes_to_der(const uint8_t *basic_response,
+	size_t basic_response_len, uint8_t **out, size_t *outlen)
+{
+	size_t len = 0;
+
+	if (!basic_response || !basic_response_len) {
+		error_print();
+		return -1;
+	}
+	if (asn1_object_identifier_to_der(oid_pkix_ocsp_basic, oid_cnt(oid_pkix_ocsp_basic), NULL, &len) != 1
+		|| asn1_octet_string_to_der(basic_response, basic_response_len, NULL, &len) != 1
+		|| asn1_sequence_header_to_der(len, out, outlen) != 1
+		|| asn1_object_identifier_to_der(oid_pkix_ocsp_basic, oid_cnt(oid_pkix_ocsp_basic), out, outlen) != 1
+		|| asn1_octet_string_to_der(basic_response, basic_response_len, out, outlen) != 1) {
+		error_print();
+		return -1;
+	}
+	return 1;
+}
+
+static int ocsp_response_bytes_from_der(const uint8_t **basic_response,
+	size_t *basic_response_len, const uint8_t **in, size_t *inlen)
+{
+	int ret;
+	const uint8_t *d;
+	size_t dlen;
+	uint32_t nodes[32];
+	size_t nodes_cnt;
+
+	if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
+		if (ret < 0) error_print();
+		return ret;
+	}
+	if (asn1_object_identifier_from_der(nodes, &nodes_cnt, &d, &dlen) != 1
+		|| asn1_object_identifier_equ(nodes, nodes_cnt, oid_pkix_ocsp_basic, oid_cnt(oid_pkix_ocsp_basic)) != 1
+		|| asn1_octet_string_from_der(basic_response, basic_response_len, &d, &dlen) != 1
 		|| asn1_length_is_zero(dlen) != 1) {
 		error_print();
 		return -1;
 	}
 	return 1;
 }
+
+static int ocsp_response_bytes_print(FILE *fp, int fmt, int ind,
+	const uint8_t *d, size_t dlen)
+{
+	uint32_t nodes[32];
+	size_t nodes_cnt;
+	const uint8_t *basic_response;
+	size_t basic_response_len;
+	const char *name = NULL;
+
+	format_print(fp, fmt, ind, "responseBytes\n");
+	ind += 4;
+
+	if (asn1_object_identifier_from_der(nodes, &nodes_cnt, &d, &dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	if (asn1_object_identifier_equ(nodes, nodes_cnt, oid_pkix_ocsp_basic, oid_cnt(oid_pkix_ocsp_basic))) {
+		name = "id-pkix-ocsp-basic";
+	}
+	asn1_object_identifier_print(fp, fmt, ind, "responseType", name, nodes, nodes_cnt);
+	if (!name) {
+		error_print();
+		return -1;
+	}
+	if (asn1_octet_string_from_der(&basic_response, &basic_response_len, &d, &dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	{
+		const uint8_t *basic_response_seq;
+		size_t basic_response_seq_len;
+
+		if (asn1_sequence_from_der(&basic_response_seq, &basic_response_seq_len,
+				&basic_response, &basic_response_len) != 1
+			|| ocsp_basic_response_print(fp, fmt, ind, "response",
+				basic_response_seq, basic_response_seq_len) != 1
+			|| asn1_length_is_zero(basic_response_len) != 1) {
+			error_print();
+			return -1;
+		}
+	}
+	if (asn1_length_is_zero(dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	return 1;
+}
+
+
+static const char *ocsp_response_status_name(int status)
+{
+	switch (status) {
+	case OCSP_response_status_successful:
+		return "successful";
+	case OCSP_response_status_malformed_request:
+		return "malformedRequest";
+	case OCSP_response_status_internal_error:
+		return "internalError";
+	case OCSP_response_status_try_later:
+		return "tryLater";
+	case OCSP_response_status_sig_required:
+		return "sigRequired";
+	case OCSP_response_status_unauthorized:
+		return "unauthorized";
+	default:
+		return NULL;
+	}
+}
+
+int ocsp_response_to_der(int response_status,
+	const uint8_t *basic_response, size_t basic_response_len,
+	uint8_t **out, size_t *outlen)
+{
+	size_t response_bytes_len = 0;
+	size_t len = 0;
+
+	if (!ocsp_response_status_name(response_status)) {
+		error_print();
+		return -1;
+	}
+	if (response_status == OCSP_response_status_successful) {
+		if (ocsp_response_bytes_to_der(basic_response, basic_response_len, NULL, &response_bytes_len) != 1) {
+			error_print();
+			return -1;
+		}
+
+
+
+	} else if (basic_response || basic_response_len) {
+		error_print();
+		return -1;
+	}
+	if (asn1_enumerated_to_der(response_status, NULL, &len) != 1
+		|| (response_status == OCSP_response_status_successful
+			&& asn1_explicit_header_to_der(0, response_bytes_len, NULL, &len) != 1)
+		|| asn1_sequence_header_to_der(len, out, outlen) != 1
+		|| asn1_enumerated_to_der(response_status, out, outlen) != 1) {
+		error_print();
+		return -1;
+	}
+	if (response_status == OCSP_response_status_successful) {
+		if (asn1_explicit_header_to_der(0, response_bytes_len, out, outlen) != 1
+			|| ocsp_response_bytes_to_der(basic_response, basic_response_len, out, outlen) != 1) {
+			error_print();
+			return -1;
+		}
+	}
+	return 1;
+}
+
+int ocsp_response_from_der(int *response_status,
+	const uint8_t **basic_response, size_t *basic_response_len,
+	const uint8_t **in, size_t *inlen)
+{
+	int ret;
+	const uint8_t *d;
+	size_t dlen;
+	const uint8_t *p;
+	size_t len;
+
+	if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
+		if (ret < 0) error_print();
+		return ret;
+	}
+	if (asn1_enumerated_from_der(response_status, &d, &dlen) != 1
+		|| !ocsp_response_status_name(*response_status)
+		|| asn1_explicit_from_der(0, &p, &len, &d, &dlen) < 0
+		|| asn1_length_is_zero(dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	if (*response_status == OCSP_response_status_successful) {
+		if (!p
+			|| ocsp_response_bytes_from_der(basic_response, basic_response_len, &p, &len) != 1
+			|| asn1_length_is_zero(len) != 1) {
+			error_print();
+			return -1;
+		}
+	} else {
+		if (p) {
+			error_print();
+			return -1;
+		}
+		*basic_response = NULL;
+		*basic_response_len = 0;
+	}
+	return 1;
+}
+
+int ocsp_response_print(FILE *fp, int fmt, int ind, const char *label,
+	const uint8_t *d, size_t dlen)
+{
+	const uint8_t *p;
+	size_t len;
+	int response_status;
+
+	format_print(fp, fmt, ind, "%s\n", label);
+	ind += 4;
+
+	if (asn1_enumerated_from_der(&response_status, &d, &dlen) != 1
+		|| !ocsp_response_status_name(response_status)) {
+		error_print();
+		return -1;
+	}
+	format_print(fp, fmt, ind, "responseStatus: %s (%d)\n",
+		ocsp_response_status_name(response_status), response_status);
+	if (asn1_explicit_from_der(0, &p, &len, &d, &dlen) < 0) {
+		error_print();
+		return -1;
+	}
+	if (response_status == OCSP_response_status_successful) {
+		const uint8_t *response_bytes;
+		size_t response_bytes_len;
+
+		if (!p
+			|| asn1_sequence_from_der(&response_bytes, &response_bytes_len, &p, &len) != 1
+			|| ocsp_response_bytes_print(fp, fmt, ind, response_bytes, response_bytes_len) != 1
+			|| asn1_length_is_zero(len) != 1) {
+			error_print();
+			return -1;
+		}
+	} else if (p) {
+		error_print();
+		return -1;
+	}
+	if (asn1_length_is_zero(dlen) != 1) {
+		error_print();
+		return -1;
+	}
+	return 1;
+}

tests/ocsptest.c

@@ -39,7 +39,11 @@ static int test_ocsp_request_item(void)
 	uint8_t buf[128];
 	uint8_t *p = buf;
 	const uint8_t *cp = buf;
+	const uint8_t *print = buf;
+	const uint8_t *print_in = buf;
 	size_t len = 0;
+	size_t print_len;
+	size_t left;
 	int hash_algor;
 	const uint8_t *name_hash;
 	size_t name_hash_len;
@@ -57,7 +61,13 @@ static int test_ocsp_request_item(void)
 		error_print();
 		return -1;
 	}
-	ocsp_request_item_print(stderr, 0, 0, "Request", buf, len);
+	left = len;
+	if (asn1_sequence_from_der(&print, &print_len, &print_in, &left) != 1
+		|| asn1_length_is_zero(left) != 1
+		|| ocsp_request_item_print(stderr, 0, 0, "Request", print, print_len) != 1) {
+		error_print();
+		return -1;
+	}
 
 	if (ocsp_request_item_from_der(&hash_algor,
 			&name_hash, &name_hash_len,
@@ -89,7 +99,11 @@ static int test_ocsp_request(void)
 	size_t request_item_len = 0;
 	uint8_t req[256];
 	const uint8_t *cp = req;
+	const uint8_t *print = req;
+	const uint8_t *print_in = req;
 	size_t reqlen = 0;
+	size_t print_len;
+	size_t left;
 	int version;
 	const uint8_t *requestor_name;
 	size_t requestor_name_len;
@@ -125,7 +139,13 @@ static int test_ocsp_request(void)
 		error_print();
 		return -1;
 	}
-	ocsp_request_print(stderr, 0, 0, "OCSPRequest", req, reqlen);
+	left = reqlen;
+	if (asn1_sequence_from_der(&print, &print_len, &print_in, &left) != 1
+		|| asn1_length_is_zero(left) != 1
+		|| ocsp_request_print(stderr, 0, 0, "OCSPRequest", print, print_len) != 1) {
+		error_print();
+		return -1;
+	}
 
 	if (ocsp_request_from_der(&version,
 			&requestor_name, &requestor_name_len,
@@ -196,7 +216,11 @@ static uint8_t ocsp_request_der[] = {
 static int test_ocsp_request_vector(void)
 {
 	const uint8_t *cp = ocsp_request_der;
+	const uint8_t *print = ocsp_request_der;
+	const uint8_t *print_in = ocsp_request_der;
 	size_t len = sizeof(ocsp_request_der);
+	size_t print_len;
+	size_t left = sizeof(ocsp_request_der);
 	int version;
 	const uint8_t *requestor_name;
 	size_t requestor_name_len;
@@ -207,7 +231,12 @@ static int test_ocsp_request_vector(void)
 	const uint8_t *optional_signature;
 	size_t optional_signature_len;
 
-	ocsp_request_print(stderr, 0, 0, "OCSPRequest", ocsp_request_der, sizeof(ocsp_request_der));
+	if (asn1_sequence_from_der(&print, &print_len, &print_in, &left) != 1
+		|| asn1_length_is_zero(left) != 1
+		|| ocsp_request_print(stderr, 0, 0, "OCSPRequest", print, print_len) != 1) {
+		error_print();
+		return -1;
+	}
 
 	if (ocsp_request_from_der(&version,
 			&requestor_name, &requestor_name_len,
@@ -241,7 +270,11 @@ static int test_ocsp_single_response(void)
 	size_t extslen = 0;
 	uint8_t buf[256];
 	const uint8_t *cp;
+	const uint8_t *print;
+	const uint8_t *print_in;
 	size_t len;
+	size_t print_len;
+	size_t left;
 	int hash_algor;
 	const uint8_t *name_hash;
 	size_t name_hash_len;
@@ -296,7 +329,15 @@ static int test_ocsp_single_response(void)
 		error_print();
 		return -1;
 	}
-	ocsp_single_response_print(stderr, 0, 0, "SingleResponse", buf, len);
+	print = buf;
+	print_in = buf;
+	left = len;
+	if (asn1_sequence_from_der(&print, &print_len, &print_in, &left) != 1
+		|| asn1_length_is_zero(left) != 1
+		|| ocsp_single_response_print(stderr, 0, 0, "SingleResponse", print, print_len) != 1) {
+		error_print();
+		return -1;
+	}
 
 	cp = buf;
 	if (ocsp_single_response_from_der(&hash_algor,
@@ -336,7 +377,15 @@ static int test_ocsp_single_response(void)
 		error_print();
 		return -1;
 	}
-	ocsp_single_response_print(stderr, 0, 0, "SingleResponse", buf, len);
+	print = buf;
+	print_in = buf;
+	left = len;
+	if (asn1_sequence_from_der(&print, &print_len, &print_in, &left) != 1
+		|| asn1_length_is_zero(left) != 1
+		|| ocsp_single_response_print(stderr, 0, 0, "SingleResponse", print, print_len) != 1) {
+		error_print();
+		return -1;
+	}
 
 	cp = buf;
 	if (ocsp_single_response_from_der(&hash_algor,

tools/gmssl.c

@@ -19,6 +19,7 @@ extern int certgen_main(int argc, char **argv);
 extern int certparse_main(int argc, char **argv);
 extern int certverify_main(int argc, char **argv);
 extern int certrevoke_main(int argc, char **argv);
+extern int ocspreq_main(int argc, char **argv);
 extern int crlget_main(int argc, char **argv);
 extern int crlgen_main(int argc, char **argv);
 extern int crlparse_main(int argc, char **argv);
@@ -192,6 +193,7 @@ static const char *options =
 	"  certparse         Parse and print certificates\n"
 	"  certverify        Verify certificate chain\n"
 	"  certrevoke        Revoke certificate and output RevokedCertificate record\n"
+	"  ocspreq           Generate OCSPRequest\n"
 #ifdef ENABLE_CMS
 	"  cmsparse          Parse CMS (cryptographic message syntax) file\n"
 	"  cmsencrypt        Generate CMS EnvelopedData\n"
@@ -282,6 +284,8 @@ int main(int argc, char **argv)
 			return certverify_main(argc, argv);
 		} else if (!strcmp(*argv, "certrevoke")) {
 			return certrevoke_main(argc, argv);
+		} else if (!strcmp(*argv, "ocspreq")) {
+			return ocspreq_main(argc, argv);
 		} else if (!strcmp(*argv, "crlget")) {
 			return crlget_main(argc, argv);
 		} else if (!strcmp(*argv, "crlgen")) {

tools/ocspreq.c

@@ -0,0 +1,125 @@
+/*
+ *  Copyright 2014-2026 The GmSSL Project. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the License); you may
+ *  not use this file except in compliance with the License.
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ */
+
+
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+#include <gmssl/digest.h>
+#include <gmssl/x509.h>
+#include <gmssl/ocsp.h>
+#include <gmssl/error.h>
+
+
+static const char *options = "-in pem [-digest name] [-out der]";
+
+static const char *help =
+"Options\n"
+"\n"
+"    -in pem             Input certificate chain file in PEM format\n"
+"                        The first certificate is the certificate to be checked\n"
+"                        The second certificate is its issuer certificate\n"
+"    -digest name        Digest algorithm for CertID, default sm3\n"
+"    -out der | stdout   Output OCSPRequest in DER format\n"
+"\n"
+"Examples\n"
+"\n"
+"    gmssl ocspreq -in chain.pem -out req.der\n"
+"\n";
+
+
+int ocspreq_main(int argc, char **argv)
+{
+	int ret = 1;
+	char *prog = argv[0];
+	char *infile = NULL;
+	char *outfile = NULL;
+	char *digest_name_str = "sm3";
+	FILE *infp = stdin;
+	FILE *outfp = stdout;
+	const DIGEST *digest;
+	uint8_t cert[18192];
+	size_t certlen;
+	uint8_t issuer_cert[18192];
+	size_t issuer_certlen;
+	uint8_t req[1024];
+	size_t reqlen;
+
+	argc--;
+	argv++;
+
+	while (argc > 0) {
+		if (!strcmp(*argv, "-help")) {
+			printf("usage: %s %s\n", prog, options);
+			printf("%s\n", help);
+			ret = 0;
+			goto end;
+		} else if (!strcmp(*argv, "-in")) {
+			if (--argc < 1) goto bad;
+			infile = *(++argv);
+			if (!(infp = fopen(infile, "rb"))) {
+				fprintf(stderr, "%s: open '%s' failure : %s\n", prog, infile, strerror(errno));
+				goto end;
+			}
+		} else if (!strcmp(*argv, "-digest")) {
+			if (--argc < 1) goto bad;
+			digest_name_str = *(++argv);
+		} else if (!strcmp(*argv, "-out")) {
+			if (--argc < 1) goto bad;
+			outfile = *(++argv);
+			if (!(outfp = fopen(outfile, "wb"))) {
+				fprintf(stderr, "%s: open '%s' failure : %s\n", prog, outfile, strerror(errno));
+				goto end;
+			}
+		} else {
+			fprintf(stderr, "%s: illegal option `%s`\n", prog, *argv);
+			goto end;
+bad:
+			fprintf(stderr, "%s: `%s` option value missing\n", prog, *argv);
+			goto end;
+		}
+
+		argc--;
+		argv++;
+	}
+
+	if (!infile) {
+		fprintf(stderr, "%s: `-in` option required\n", prog);
+		goto end;
+	}
+	if (!(digest = digest_from_name(digest_name_str))) {
+		fprintf(stderr, "%s: invalid `-digest` value\n", prog);
+		goto end;
+	}
+	if (x509_cert_from_pem(cert, &certlen, sizeof(cert), infp) != 1) {
+		fprintf(stderr, "%s: read certificate failure\n", prog);
+		goto end;
+	}
+	if (x509_cert_from_pem(issuer_cert, &issuer_certlen, sizeof(issuer_cert), infp) != 1) {
+		fprintf(stderr, "%s: read issuer certificate failure\n", prog);
+		goto end;
+	}
+	if (ocsp_request_generate(req, &reqlen, sizeof(req),
+			cert, certlen, issuer_cert, issuer_certlen, digest) != 1) {
+		fprintf(stderr, "%s: generate OCSPRequest failure\n", prog);
+		goto end;
+	}
+	if (fwrite(req, 1, reqlen, outfp) != reqlen) {
+		fprintf(stderr, "%s: output failure : %s\n", prog, strerror(errno));
+		goto end;
+	}
+
+	ret = 0;
+
+end:
+	if (infile && infp) fclose(infp);
+	if (outfile && outfp) fclose(outfp);
+	return ret;
+}