Add OCSP_RESPID_match()

Add a function for testing whether a given OCSP_RESPID matches with a
certificate.

Reviewed-by: Rich Salz <rsalz@openssl.org>

diff --git a/crypto/ocsp/ocsp_srv.c b/crypto/ocsp/ocsp_srv.c
index 5d590bae85a81791f479e7b6180770a1b4f886b0..46a4bf7852a3b4b44ff1f82035b741994133b4a2 100644 (file)
--- a/crypto/ocsp/ocsp_srv.c
+++ b/crypto/ocsp/ocsp_srv.c
@@ -239,7 +239,7 @@ int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert)
     if (byKey == NULL)
         return 0;
 
-    if (!(ASN1_OCTET_STRING_set(respid->value.byKey, md, SHA_DIGEST_LENGTH))) {
+    if (!(ASN1_OCTET_STRING_set(byKey, md, SHA_DIGEST_LENGTH))) {
         ASN1_OCTET_STRING_free(byKey);
         return 0;
     }
@@ -249,3 +249,29 @@ int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert)
 
     return 1;
 }
+
+int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert)
+{
+    if (respid->type == V_OCSP_RESPID_KEY) {
+        unsigned char md[SHA_DIGEST_LENGTH];
+
+        if (respid->value.byKey == NULL)
+            return 0;
+
+        /* RFC2560 requires SHA1 */
+        if (!X509_pubkey_digest(cert, EVP_sha1(), md, NULL))
+            return 0;
+
+        return (ASN1_STRING_length(respid->value.byKey) == SHA_DIGEST_LENGTH)
+            && (memcmp(ASN1_STRING_get0_data(respid->value.byKey), md,
+                       SHA_DIGEST_LENGTH) == 0);
+    } else if(respid->type == V_OCSP_RESPID_NAME) {
+        if (respid->value.byName == NULL)
+            return 0;
+
+        return X509_NAME_cmp(respid->value.byName,
+                             X509_get_subject_name(cert)) == 0;
+    }
+
+    return 0;
+}

diff --git a/doc/crypto/OCSP_response_status.pod b/doc/crypto/OCSP_response_status.pod
index 993fce20c63c5aa3ff5b41b1128b278bf2f752ea..81946a639b8598a066eb2190a631f168ffebe1d5 100644 (file)
--- a/doc/crypto/OCSP_response_status.pod
+++ b/doc/crypto/OCSP_response_status.pod
@@ -4,7 +4,7 @@
 
 OCSP_response_status, OCSP_response_get1_basic, OCSP_response_create,
 OCSP_RESPONSE_free, OCSP_RESPID_set_by_name,
-OCSP_RESPID_set_by_key - OCSP response functions
+OCSP_RESPID_set_by_key, OCSP_RESPID_match - OCSP response functions
 
 =head1 SYNOPSIS
 
@@ -17,6 +17,7 @@ OCSP_RESPID_set_by_key - OCSP response functions
 
  int OCSP_RESPID_set_by_name(OCSP_RESPID *respid, X509 *cert);
  int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert);
+ int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert);
 
 =head1 DESCRIPTION
 
@@ -45,6 +46,9 @@ Note that an OCSP_RESPID can only have one of the name, or the key set. Calling
 OCSP_RESPID_set_by_name() or OCSP_RESPID_set_by_key() will clear any existing
 setting.
 
+OCSP_RESPID_match() tests whether the OCSP_RESPID given in B<respid> matches
+with the X509 certificate B<cert>.
+
 =head1 RETURN VALUES
 
 OCSP_RESPONSE_status() returns a status value.
@@ -60,6 +64,9 @@ OCSP_RESPONSE_free() does not return a value.
 OCSP_RESPID_set_by_name() and OCSP_RESPID_set_by_key() return 1 on success or 0
 on failure.
 
+OCSP_RESPID_match() returns 1 if the OCSP_RESPID and the X509 certificate match
+or 0 otherwise.
+
 =head1 NOTES
 
 OCSP_response_get1_basic() is only called if the status of a response is
@@ -78,8 +85,8 @@ L<OCSP_RESPID_free(3)>
 
 =head1 HISTORY
 
-The OCSP_RESPID_set_by_name() and OCSP_RESPID_set_by_key() functions were added
-in OpenSSL version 1.1.0a.
+The OCSP_RESPID_set_by_name(), OCSP_RESPID_set_by_key() and OCSP_RESPID_match()
+functions were added in OpenSSL version 1.1.0a.
 
 =head1 COPYRIGHT
 

diff --git a/include/openssl/ocsp.h b/include/openssl/ocsp.h
index b5fdcc8f75947d16a29a34c5875c2a7fc59e99b8..08debc5b78e9875be28743b4b90316846e7cebef 100644 (file)
--- a/include/openssl/ocsp.h
+++ b/include/openssl/ocsp.h
@@ -261,6 +261,7 @@ int OCSP_basic_sign(OCSP_BASICRESP *brsp,
                     STACK_OF(X509) *certs, unsigned long flags);
 int OCSP_RESPID_set_by_name(OCSP_RESPID *respid, X509 *cert);
 int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert);
+int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert);
 
 X509_EXTENSION *OCSP_crlID_new(const char *url, long *n, char *tim);
 

diff --git a/util/libcrypto.num b/util/libcrypto.num
index 7289f6b549de5eac56a0ebc172e54802b12cbcd0..db6732edbc64426e8c0cfa6e489f63738da6a0b5 100644 (file)
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -4205,3 +4205,4 @@ ECPKPARAMETERS_new                      4155      1_1_0   EXIST::FUNCTION:EC
 ECPARAMETERS_new                        4156   1_1_0   EXIST::FUNCTION:EC
 OCSP_RESPID_set_by_name                 4157   1_1_0a  EXIST::FUNCTION:OCSP
 OCSP_RESPID_set_by_key                  4158   1_1_0a  EXIST::FUNCTION:OCSP
+OCSP_RESPID_match                       4159   1_1_0a  EXIST::FUNCTION:OCSP