From a671b3e64abe782d37c705ae51e93f2013672f9d Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 13 Sep 2016 23:26:53 +0100 Subject: [PATCH] Add OCSP_RESPID_match() Add a function for testing whether a given OCSP_RESPID matches with a certificate. Reviewed-by: Rich Salz --- crypto/ocsp/ocsp_srv.c | 28 +++++++++++++++++++++++++++- doc/crypto/OCSP_response_status.pod | 13 ++++++++++--- include/openssl/ocsp.h | 1 + util/libcrypto.num | 1 + 4 files changed, 39 insertions(+), 4 deletions(-) diff --git a/crypto/ocsp/ocsp_srv.c b/crypto/ocsp/ocsp_srv.c index 5d590bae85..46a4bf7852 100644 --- a/crypto/ocsp/ocsp_srv.c +++ b/crypto/ocsp/ocsp_srv.c @@ -239,7 +239,7 @@ int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert) if (byKey == NULL) return 0; - if (!(ASN1_OCTET_STRING_set(respid->value.byKey, md, SHA_DIGEST_LENGTH))) { + if (!(ASN1_OCTET_STRING_set(byKey, md, SHA_DIGEST_LENGTH))) { ASN1_OCTET_STRING_free(byKey); return 0; } @@ -249,3 +249,29 @@ int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert) return 1; } + +int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert) +{ + if (respid->type == V_OCSP_RESPID_KEY) { + unsigned char md[SHA_DIGEST_LENGTH]; + + if (respid->value.byKey == NULL) + return 0; + + /* RFC2560 requires SHA1 */ + if (!X509_pubkey_digest(cert, EVP_sha1(), md, NULL)) + return 0; + + return (ASN1_STRING_length(respid->value.byKey) == SHA_DIGEST_LENGTH) + && (memcmp(ASN1_STRING_get0_data(respid->value.byKey), md, + SHA_DIGEST_LENGTH) == 0); + } else if(respid->type == V_OCSP_RESPID_NAME) { + if (respid->value.byName == NULL) + return 0; + + return X509_NAME_cmp(respid->value.byName, + X509_get_subject_name(cert)) == 0; + } + + return 0; +} diff --git a/doc/crypto/OCSP_response_status.pod b/doc/crypto/OCSP_response_status.pod index 993fce20c6..81946a639b 100644 --- a/doc/crypto/OCSP_response_status.pod +++ b/doc/crypto/OCSP_response_status.pod @@ -4,7 +4,7 @@ OCSP_response_status, OCSP_response_get1_basic, OCSP_response_create, OCSP_RESPONSE_free, OCSP_RESPID_set_by_name, -OCSP_RESPID_set_by_key - OCSP response functions +OCSP_RESPID_set_by_key, OCSP_RESPID_match - OCSP response functions =head1 SYNOPSIS @@ -17,6 +17,7 @@ OCSP_RESPID_set_by_key - OCSP response functions int OCSP_RESPID_set_by_name(OCSP_RESPID *respid, X509 *cert); int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert); + int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert); =head1 DESCRIPTION @@ -45,6 +46,9 @@ Note that an OCSP_RESPID can only have one of the name, or the key set. Calling OCSP_RESPID_set_by_name() or OCSP_RESPID_set_by_key() will clear any existing setting. +OCSP_RESPID_match() tests whether the OCSP_RESPID given in B matches +with the X509 certificate B. + =head1 RETURN VALUES OCSP_RESPONSE_status() returns a status value. @@ -60,6 +64,9 @@ OCSP_RESPONSE_free() does not return a value. OCSP_RESPID_set_by_name() and OCSP_RESPID_set_by_key() return 1 on success or 0 on failure. +OCSP_RESPID_match() returns 1 if the OCSP_RESPID and the X509 certificate match +or 0 otherwise. + =head1 NOTES OCSP_response_get1_basic() is only called if the status of a response is @@ -78,8 +85,8 @@ L =head1 HISTORY -The OCSP_RESPID_set_by_name() and OCSP_RESPID_set_by_key() functions were added -in OpenSSL version 1.1.0a. +The OCSP_RESPID_set_by_name(), OCSP_RESPID_set_by_key() and OCSP_RESPID_match() +functions were added in OpenSSL version 1.1.0a. =head1 COPYRIGHT diff --git a/include/openssl/ocsp.h b/include/openssl/ocsp.h index b5fdcc8f75..08debc5b78 100644 --- a/include/openssl/ocsp.h +++ b/include/openssl/ocsp.h @@ -261,6 +261,7 @@ int OCSP_basic_sign(OCSP_BASICRESP *brsp, STACK_OF(X509) *certs, unsigned long flags); int OCSP_RESPID_set_by_name(OCSP_RESPID *respid, X509 *cert); int OCSP_RESPID_set_by_key(OCSP_RESPID *respid, X509 *cert); +int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert); X509_EXTENSION *OCSP_crlID_new(const char *url, long *n, char *tim); diff --git a/util/libcrypto.num b/util/libcrypto.num index 7289f6b549..db6732edbc 100644 --- a/util/libcrypto.num +++ b/util/libcrypto.num @@ -4205,3 +4205,4 @@ ECPKPARAMETERS_new 4155 1_1_0 EXIST::FUNCTION:EC ECPARAMETERS_new 4156 1_1_0 EXIST::FUNCTION:EC OCSP_RESPID_set_by_name 4157 1_1_0a EXIST::FUNCTION:OCSP OCSP_RESPID_set_by_key 4158 1_1_0a EXIST::FUNCTION:OCSP +OCSP_RESPID_match 4159 1_1_0a EXIST::FUNCTION:OCSP -- 2.25.1