Commit a671b3e6 authored by Matt Caswell's avatar Matt Caswell
Browse files

Add OCSP_RESPID_match() 



Add a function for testing whether a given OCSP_RESPID matches with a
certificate.

Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
parent e12c0beb

crypto/ocsp/ocsp_srv.c

+27 −1
Original line number Diff line number Diff line
@@ -239,7 +239,7 @@ int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert) 
    if (byKey == NULL)

        return 0;



    if (!(ASN1_OCTET_STRING_set(respid->value.byKey, md, SHA_DIGEST_LENGTH))) {

    if (!(ASN1_OCTET_STRING_set(byKey, md, SHA_DIGEST_LENGTH))) {

        ASN1_OCTET_STRING_free(byKey);

        return 0;

    }
@@ -249,3 +249,29 @@ int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert) 


    return 1;

}



int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert)

{

    if (respid->type == V_OCSP_RESPID_KEY) {

        unsigned char md[SHA_DIGEST_LENGTH];



        if (respid->value.byKey == NULL)

            return 0;



        /* RFC2560 requires SHA1 */

        if (!X509_pubkey_digest(cert, EVP_sha1(), md, NULL))

            return 0;



        return (ASN1_STRING_length(respid->value.byKey) == SHA_DIGEST_LENGTH)

            && (memcmp(ASN1_STRING_get0_data(respid->value.byKey), md,

                       SHA_DIGEST_LENGTH) == 0);

    } else if(respid->type == V_OCSP_RESPID_NAME) {

        if (respid->value.byName == NULL)

            return 0;



        return X509_NAME_cmp(respid->value.byName,

                             X509_get_subject_name(cert)) == 0;

    }



    return 0;

}

doc/crypto/OCSP_response_status.pod

+10 −3
Original line number Diff line number Diff line
@@ -4,7 +4,7 @@ 


OCSP_response_status, OCSP_response_get1_basic, OCSP_response_create,

OCSP_RESPONSE_free, OCSP_RESPID_set_by_name,

OCSP_RESPID_set_by_key - OCSP response functions

OCSP_RESPID_set_by_key, OCSP_RESPID_match - OCSP response functions



=head1 SYNOPSIS
@@ -17,6 +17,7 @@ OCSP_RESPID_set_by_key - OCSP response functions 


 int OCSP_RESPID_set_by_name(OCSP_RESPID *respid, X509 *cert);

 int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert);

 int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert);



=head1 DESCRIPTION
@@ -45,6 +46,9 @@ Note that an OCSP_RESPID can only have one of the name, or the key set. Calling 
OCSP_RESPID_set_by_name() or OCSP_RESPID_set_by_key() will clear any existing

setting.



OCSP_RESPID_match() tests whether the OCSP_RESPID given in B<respid> matches

with the X509 certificate B<cert>.



=head1 RETURN VALUES



OCSP_RESPONSE_status() returns a status value.
@@ -60,6 +64,9 @@ OCSP_RESPONSE_free() does not return a value. 
OCSP_RESPID_set_by_name() and OCSP_RESPID_set_by_key() return 1 on success or 0

on failure.



OCSP_RESPID_match() returns 1 if the OCSP_RESPID and the X509 certificate match

or 0 otherwise.



=head1 NOTES



OCSP_response_get1_basic() is only called if the status of a response is
@@ -78,8 +85,8 @@ L<OCSP_RESPID_free(3)> 


=head1 HISTORY



The OCSP_RESPID_set_by_name() and OCSP_RESPID_set_by_key() functions were added

in OpenSSL version 1.1.0a.

The OCSP_RESPID_set_by_name(), OCSP_RESPID_set_by_key() and OCSP_RESPID_match()

functions were added in OpenSSL version 1.1.0a.



=head1 COPYRIGHT

include/openssl/ocsp.h

+1 −0
Original line number Diff line number Diff line
@@ -261,6 +261,7 @@ int OCSP_basic_sign(OCSP_BASICRESP *brsp, 
                    STACK_OF(X509) *certs, unsigned long flags);

int OCSP_RESPID_set_by_name(OCSP_RESPID *respid, X509 *cert);

int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert);

int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert);



X509_EXTENSION *OCSP_crlID_new(const char *url, long *n, char *tim);

util/libcrypto.num

+1 −0
Original line number Diff line number Diff line
@@ -4205,3 +4205,4 @@ ECPKPARAMETERS_new 4155 1_1_0 EXIST::FUNCTION:EC 
ECPARAMETERS_new                        4156	1_1_0	EXIST::FUNCTION:EC

OCSP_RESPID_set_by_name                 4157	1_1_0a	EXIST::FUNCTION:OCSP

OCSP_RESPID_set_by_key                  4158	1_1_0a	EXIST::FUNCTION:OCSP

OCSP_RESPID_match                       4159	1_1_0a	EXIST::FUNCTION:OCSP