mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-04-06 20:20:50 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add an API to get the signer of an OCSP response

Browse Source 
Add a new function OCSP_resp_get0_signer() that looks in the
certs bundled with the response as well as in additional certificates
provided as a function argument, returning the certificate that signed
the given response (if present).

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4573)
This commit is contained in:
Benjamin Kaduk 2017-10-18 15:29:18 -05:00 committed by Ben Kaduk
parent 47c07020b7
commit ce5886dda8
3 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
crypto/ocsp/ocsp_vfy.c
View File

@ -138,6 +138,15 @@ int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
goto end;
}
int OCSP_resp_get0_signer(OCSP_BASICRESP *bs, X509 **signer,
STACK_OF(X509) *extra_certs)
{
int ret;
ret = ocsp_find_signer(signer, bs, extra_certs, 0);
return (ret > 0) ? 1 : 0;
}
static int ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs,
STACK_OF(X509) *certs, unsigned long flags)
{

15
doc/man3/OCSP_resp_find_status.pod
View File

@ -3,6 +3,7 @@
=head1 NAME
OCSP_resp_get0_certs,
OCSP_resp_get0_signer,
OCSP_resp_get0_id,
OCSP_resp_get1_id,
OCSP_resp_get0_produced_at,
@ -33,6 +34,9 @@ OCSP_single_get0_status, OCSP_check_validity
const STACK_OF(X509) *OCSP_resp_get0_certs(const OCSP_BASICRESP *bs);
int OCSP_resp get0_signer(OCSP_BASICRESP *bs, X509 **signer,
STACK_OF(X509) *extra_certs);
int OCSP_resp_get0_id(const OCSP_BASICRESP *bs,
const ASN1_OCTET_STRING **pid,
const X509_NAME **pname);
@ -76,7 +80,13 @@ single response B<bs>.
OCSP_resp_get0_certs() returns any certificates included in B<bs>.
OCSP_resp_get0_id() gets the responder id of <bs>. If the responder ID is
OCSP_resp_get0_signer() attempts to retrive the certificate that directly
signed B<bs>. The OCSP protocol does not require that this certificate
is included in the B<certs> field of the response, so additional certificates
can be supplied in B<extra_certs> if the certificates that may have
signed the response are known via some out-of-band mechanism.
OCSP_resp_get0_id() gets the responder id of B<bs>. If the responder ID is
a name then <*pname> is set to the name and B<*pid> is set to NULL. If the
responder ID is by key ID then B<*pid> is set to the key ID and B<*pname>
is set to NULL. OCSP_resp_get1_id() leaves ownership of B<*pid> and B<*pname>
@ -106,6 +116,9 @@ B<id> was not found.
OCSP_single_get0_status() returns the status of B<single> or -1 if an error
occurred.
OCSP_resp_get0_signer() returns 1 if the signing certificate was located,
or 0 on error.
=head1 NOTES
Applications will typically call OCSP_resp_find_status() using the certificate

2
include/openssl/ocsp.h
View File

@ -197,6 +197,8 @@ int OCSP_response_status(OCSP_RESPONSE *resp);
OCSP_BASICRESP *OCSP_response_get1_basic(OCSP_RESPONSE *resp);
const ASN1_OCTET_STRING *OCSP_resp_get0_signature(const OCSP_BASICRESP *bs);
int OCSP_resp_get0_signer(OCSP_BASICRESP *bs, X509 **signer,
STACK_OF(X509) *extra_certs);
int OCSP_resp_count(OCSP_BASICRESP *bs);
OCSP_SINGLERESP *OCSP_resp_get0(OCSP_BASICRESP *bs, int idx);