wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add OCSP_RESPID_match()

Browse source 
Add a function for testing whether a given OCSP_RESPID matches with a
certificate.

Reviewed-by: Rich Salz <rsalz@openssl.org>
This commit is contained in:
Matt Caswell 2016-09-13 23:26:53 +01:00
parent e12c0beb5a
commit a671b3e64a
4 changed files with 39 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
crypto/ocsp/ocsp_srv.c
View file

@ -239,7 +239,7 @@ int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert)
if (byKey == NULL)
return 0;
if (!(ASN1_OCTET_STRING_set(respid->value.byKey, md, SHA_DIGEST_LENGTH))) {
if (!(ASN1_OCTET_STRING_set(byKey, md, SHA_DIGEST_LENGTH))) {
ASN1_OCTET_STRING_free(byKey);
return 0;
}
@ -249,3 +249,29 @@ int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert)
return 1;
}
int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert)
{
if (respid->type == V_OCSP_RESPID_KEY) {
unsigned char md[SHA_DIGEST_LENGTH];
if (respid->value.byKey == NULL)
return 0;
/* RFC2560 requires SHA1 */
if (!X509_pubkey_digest(cert, EVP_sha1(), md, NULL))
return 0;
return (ASN1_STRING_length(respid->value.byKey) == SHA_DIGEST_LENGTH)
&& (memcmp(ASN1_STRING_get0_data(respid->value.byKey), md,
SHA_DIGEST_LENGTH) == 0);
} else if(respid->type == V_OCSP_RESPID_NAME) {
if (respid->value.byName == NULL)
return 0;
return X509_NAME_cmp(respid->value.byName,
X509_get_subject_name(cert)) == 0;
}
return 0;
}

13
doc/crypto/OCSP_response_status.pod
View file

@ -4,7 +4,7 @@
OCSP_response_status, OCSP_response_get1_basic, OCSP_response_create,
OCSP_RESPONSE_free, OCSP_RESPID_set_by_name,
OCSP_RESPID_set_by_key - OCSP response functions
OCSP_RESPID_set_by_key, OCSP_RESPID_match - OCSP response functions
=head1 SYNOPSIS
@ -17,6 +17,7 @@ OCSP_RESPID_set_by_key - OCSP response functions
int OCSP_RESPID_set_by_name(OCSP_RESPID *respid, X509 *cert);
int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert);
int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert);
=head1 DESCRIPTION
@ -45,6 +46,9 @@ Note that an OCSP_RESPID can only have one of the name, or the key set. Calling
OCSP_RESPID_set_by_name() or OCSP_RESPID_set_by_key() will clear any existing
setting.
OCSP_RESPID_match() tests whether the OCSP_RESPID given in B<respid> matches
with the X509 certificate B<cert>.
=head1 RETURN VALUES
OCSP_RESPONSE_status() returns a status value.
@ -60,6 +64,9 @@ OCSP_RESPONSE_free() does not return a value.
OCSP_RESPID_set_by_name() and OCSP_RESPID_set_by_key() return 1 on success or 0
on failure.
OCSP_RESPID_match() returns 1 if the OCSP_RESPID and the X509 certificate match
or 0 otherwise.
=head1 NOTES
OCSP_response_get1_basic() is only called if the status of a response is
@ -78,8 +85,8 @@ L<OCSP_RESPID_free(3)>
=head1 HISTORY
The OCSP_RESPID_set_by_name() and OCSP_RESPID_set_by_key() functions were added
in OpenSSL version 1.1.0a.
The OCSP_RESPID_set_by_name(), OCSP_RESPID_set_by_key() and OCSP_RESPID_match()
functions were added in OpenSSL version 1.1.0a.
=head1 COPYRIGHT

1
include/openssl/ocsp.h
View file

@ -261,6 +261,7 @@ int OCSP_basic_sign(OCSP_BASICRESP *brsp,
STACK_OF(X509) *certs, unsigned long flags);
int OCSP_RESPID_set_by_name(OCSP_RESPID *respid, X509 *cert);
int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert);
int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert);
X509_EXTENSION *OCSP_crlID_new(const char *url, long *n, char *tim);

1
util/libcrypto.num
View file

@ -4205,3 +4205,4 @@ ECPKPARAMETERS_new 4155 1_1_0 EXIST::FUNCTION:EC
ECPARAMETERS_new 4156 1_1_0 EXIST::FUNCTION:EC
OCSP_RESPID_set_by_name 4157 1_1_0a EXIST::FUNCTION:OCSP
OCSP_RESPID_set_by_key 4158 1_1_0a EXIST::FUNCTION:OCSP
OCSP_RESPID_match 4159 1_1_0a EXIST::FUNCTION:OCSP