Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

OpenSSL 1.1.1-pre2

Browse Source
This commit is contained in:
Hakase
2018-04-07 17:29:40 +09:00
parent 82a44d2483
commit bbac8ca55d
17755 changed files with 221242 additions and 98415 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/ocsp/ocsp_cl.c
+22 -1
View File
@@ -10,6 +10,7 @@
#include <stdio.h>
#include <time.h>
#include "internal/cryptlib.h"
#include <openssl/asn1.h>
#include <openssl/objects.h>
#include <openssl/x509.h>
#include <openssl/pem.h>
@@ -199,9 +200,9 @@ const STACK_OF(X509) *OCSP_resp_get0_certs(const OCSP_BASICRESP *bs)
int OCSP_resp_get0_id(const OCSP_BASICRESP *bs,
const ASN1_OCTET_STRING **pid,
const X509_NAME **pname)
{
const OCSP_RESPID *rid = &bs->tbsResponseData.responderId;
if (rid->type == V_OCSP_RESPID_NAME) {
*pname = rid->value.byName;
*pid = NULL;
@@ -214,6 +215,26 @@ int OCSP_resp_get0_id(const OCSP_BASICRESP *bs,
return 1;
}
int OCSP_resp_get1_id(const OCSP_BASICRESP *bs,
ASN1_OCTET_STRING **pid,
X509_NAME **pname)
{
const OCSP_RESPID *rid = &bs->tbsResponseData.responderId;
if (rid->type == V_OCSP_RESPID_NAME) {
*pname = X509_NAME_dup(rid->value.byName);
*pid = NULL;
} else if (rid->type == V_OCSP_RESPID_KEY) {
*pid = ASN1_OCTET_STRING_dup(rid->value.byKey);
*pname = NULL;
} else {
return 0;
}
if (*pname == NULL && *pid == NULL)
return 0;
return 1;
}
/* Look single response matching a given certificate ID */
int OCSP_resp_find(OCSP_BASICRESP *bs, OCSP_CERTID *id, int last)
crypto/ocsp/ocsp_err.c
+72 -62
View File
@@ -1,6 +1,6 @@
/*
* Generated by util/mkerr.pl DO NOT EDIT
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -8,71 +8,82 @@
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include <openssl/err.h>
#include <openssl/ocsp.h>
#include <openssl/ocsperr.h>
/* BEGIN ERROR CODES */
#ifndef OPENSSL_NO_ERR
# define ERR_FUNC(func) ERR_PACK(ERR_LIB_OCSP,func,0)
# define ERR_REASON(reason) ERR_PACK(ERR_LIB_OCSP,0,reason)
static ERR_STRING_DATA OCSP_str_functs[] = {
{ERR_FUNC(OCSP_F_D2I_OCSP_NONCE), "d2i_ocsp_nonce"},
{ERR_FUNC(OCSP_F_OCSP_BASIC_ADD1_STATUS), "OCSP_basic_add1_status"},
{ERR_FUNC(OCSP_F_OCSP_BASIC_SIGN), "OCSP_basic_sign"},
{ERR_FUNC(OCSP_F_OCSP_BASIC_VERIFY), "OCSP_basic_verify"},
{ERR_FUNC(OCSP_F_OCSP_CERT_ID_NEW), "OCSP_cert_id_new"},
{ERR_FUNC(OCSP_F_OCSP_CHECK_DELEGATED), "ocsp_check_delegated"},
{ERR_FUNC(OCSP_F_OCSP_CHECK_IDS), "ocsp_check_ids"},
{ERR_FUNC(OCSP_F_OCSP_CHECK_ISSUER), "ocsp_check_issuer"},
{ERR_FUNC(OCSP_F_OCSP_CHECK_VALIDITY), "OCSP_check_validity"},
{ERR_FUNC(OCSP_F_OCSP_MATCH_ISSUERID), "ocsp_match_issuerid"},
{ERR_FUNC(OCSP_F_OCSP_PARSE_URL), "OCSP_parse_url"},
{ERR_FUNC(OCSP_F_OCSP_REQUEST_SIGN), "OCSP_request_sign"},
{ERR_FUNC(OCSP_F_OCSP_REQUEST_VERIFY), "OCSP_request_verify"},
{ERR_FUNC(OCSP_F_OCSP_RESPONSE_GET1_BASIC), "OCSP_response_get1_basic"},
{ERR_FUNC(OCSP_F_PARSE_HTTP_LINE1), "parse_http_line1"},
static const ERR_STRING_DATA OCSP_str_functs[] = {
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_D2I_OCSP_NONCE, 0), "d2i_ocsp_nonce"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_BASIC_ADD1_STATUS, 0),
"OCSP_basic_add1_status"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_BASIC_SIGN, 0), "OCSP_basic_sign"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_BASIC_SIGN_CTX, 0),
"OCSP_basic_sign_ctx"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_BASIC_VERIFY, 0), "OCSP_basic_verify"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_CERT_ID_NEW, 0), "OCSP_cert_id_new"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_CHECK_DELEGATED, 0),
"ocsp_check_delegated"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_CHECK_IDS, 0), "ocsp_check_ids"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_CHECK_ISSUER, 0), "ocsp_check_issuer"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_CHECK_VALIDITY, 0),
"OCSP_check_validity"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_MATCH_ISSUERID, 0),
"ocsp_match_issuerid"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_PARSE_URL, 0), "OCSP_parse_url"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_REQUEST_SIGN, 0), "OCSP_request_sign"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_REQUEST_VERIFY, 0),
"OCSP_request_verify"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_OCSP_RESPONSE_GET1_BASIC, 0),
"OCSP_response_get1_basic"},
{ERR_PACK(ERR_LIB_OCSP, OCSP_F_PARSE_HTTP_LINE1, 0), "parse_http_line1"},
{0, NULL}
};
static ERR_STRING_DATA OCSP_str_reasons[] = {
{ERR_REASON(OCSP_R_CERTIFICATE_VERIFY_ERROR), "certificate verify error"},
{ERR_REASON(OCSP_R_DIGEST_ERR), "digest err"},
{ERR_REASON(OCSP_R_ERROR_IN_NEXTUPDATE_FIELD),
"error in nextupdate field"},
{ERR_REASON(OCSP_R_ERROR_IN_THISUPDATE_FIELD),
"error in thisupdate field"},
{ERR_REASON(OCSP_R_ERROR_PARSING_URL), "error parsing url"},
{ERR_REASON(OCSP_R_MISSING_OCSPSIGNING_USAGE),
"missing ocspsigning usage"},
{ERR_REASON(OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE),
"nextupdate before thisupdate"},
{ERR_REASON(OCSP_R_NOT_BASIC_RESPONSE), "not basic response"},
{ERR_REASON(OCSP_R_NO_CERTIFICATES_IN_CHAIN), "no certificates in chain"},
{ERR_REASON(OCSP_R_NO_RESPONSE_DATA), "no response data"},
{ERR_REASON(OCSP_R_NO_REVOKED_TIME), "no revoked time"},
{ERR_REASON(OCSP_R_NO_SIGNER_KEY), "no signer key"},
{ERR_REASON(OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE),
"private key does not match certificate"},
{ERR_REASON(OCSP_R_REQUEST_NOT_SIGNED), "request not signed"},
{ERR_REASON(OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA),
"response contains no revocation data"},
{ERR_REASON(OCSP_R_ROOT_CA_NOT_TRUSTED), "root ca not trusted"},
{ERR_REASON(OCSP_R_SERVER_RESPONSE_ERROR), "server response error"},
{ERR_REASON(OCSP_R_SERVER_RESPONSE_PARSE_ERROR),
"server response parse error"},
{ERR_REASON(OCSP_R_SIGNATURE_FAILURE), "signature failure"},
{ERR_REASON(OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND),
"signer certificate not found"},
{ERR_REASON(OCSP_R_STATUS_EXPIRED), "status expired"},
{ERR_REASON(OCSP_R_STATUS_NOT_YET_VALID), "status not yet valid"},
{ERR_REASON(OCSP_R_STATUS_TOO_OLD), "status too old"},
{ERR_REASON(OCSP_R_UNKNOWN_MESSAGE_DIGEST), "unknown message digest"},
{ERR_REASON(OCSP_R_UNKNOWN_NID), "unknown nid"},
{ERR_REASON(OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE),
"unsupported requestorname type"},
static const ERR_STRING_DATA OCSP_str_reasons[] = {
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_CERTIFICATE_VERIFY_ERROR),
"certificate verify error"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_DIGEST_ERR), "digest err"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_ERROR_IN_NEXTUPDATE_FIELD),
"error in nextupdate field"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_ERROR_IN_THISUPDATE_FIELD),
"error in thisupdate field"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_ERROR_PARSING_URL), "error parsing url"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_MISSING_OCSPSIGNING_USAGE),
"missing ocspsigning usage"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE),
"nextupdate before thisupdate"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_NOT_BASIC_RESPONSE),
"not basic response"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_NO_CERTIFICATES_IN_CHAIN),
"no certificates in chain"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_NO_RESPONSE_DATA), "no response data"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_NO_REVOKED_TIME), "no revoked time"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_NO_SIGNER_KEY), "no signer key"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE),
"private key does not match certificate"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_REQUEST_NOT_SIGNED),
"request not signed"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA),
"response contains no revocation data"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_ROOT_CA_NOT_TRUSTED),
"root ca not trusted"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_SERVER_RESPONSE_ERROR),
"server response error"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_SERVER_RESPONSE_PARSE_ERROR),
"server response parse error"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_SIGNATURE_FAILURE), "signature failure"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND),
"signer certificate not found"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_STATUS_EXPIRED), "status expired"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_STATUS_NOT_YET_VALID),
"status not yet valid"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_STATUS_TOO_OLD), "status too old"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_UNKNOWN_MESSAGE_DIGEST),
"unknown message digest"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_UNKNOWN_NID), "unknown nid"},
{ERR_PACK(ERR_LIB_OCSP, 0, OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE),
"unsupported requestorname type"},
{0, NULL}
};
@@ -81,10 +92,9 @@ static ERR_STRING_DATA OCSP_str_reasons[] = {
int ERR_load_OCSP_strings(void)
{
#ifndef OPENSSL_NO_ERR
if (ERR_func_error_string(OCSP_str_functs[0].error) == NULL) {
ERR_load_strings(0, OCSP_str_functs);
ERR_load_strings(0, OCSP_str_reasons);
ERR_load_strings_const(OCSP_str_functs);
ERR_load_strings_const(OCSP_str_reasons);
}
#endif
return 1;
crypto/ocsp/ocsp_ext.c
+17 -17
View File
@@ -22,7 +22,7 @@
int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x)
{
return (X509v3_get_ext_count(x->tbsRequest.requestExtensions));
return X509v3_get_ext_count(x->tbsRequest.requestExtensions);
}
int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos)
@@ -46,12 +46,12 @@ int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos)
X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc)
{
return (X509v3_get_ext(x->tbsRequest.requestExtensions, loc));
return X509v3_get_ext(x->tbsRequest.requestExtensions, loc);
}
X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc)
{
return (X509v3_delete_ext(x->tbsRequest.requestExtensions, loc));
return X509v3_delete_ext(x->tbsRequest.requestExtensions, loc);
}
void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx)
@@ -76,18 +76,18 @@ int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc)
int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x)
{
return (X509v3_get_ext_count(x->singleRequestExtensions));
return X509v3_get_ext_count(x->singleRequestExtensions);
}
int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos)
{
return (X509v3_get_ext_by_NID(x->singleRequestExtensions, nid, lastpos));
return X509v3_get_ext_by_NID(x->singleRequestExtensions, nid, lastpos);
}
int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, const ASN1_OBJECT *obj,
int lastpos)
{
return (X509v3_get_ext_by_OBJ(x->singleRequestExtensions, obj, lastpos));
return X509v3_get_ext_by_OBJ(x->singleRequestExtensions, obj, lastpos);
}
int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos)
@@ -98,12 +98,12 @@ int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos)
X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc)
{
return (X509v3_get_ext(x->singleRequestExtensions, loc));
return X509v3_get_ext(x->singleRequestExtensions, loc);
}
X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc)
{
return (X509v3_delete_ext(x->singleRequestExtensions, loc));
return X509v3_delete_ext(x->singleRequestExtensions, loc);
}
void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx)
@@ -127,7 +127,7 @@ int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc)
int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x)
{
return (X509v3_get_ext_count(x->tbsResponseData.responseExtensions));
return X509v3_get_ext_count(x->tbsResponseData.responseExtensions);
}
int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos)
@@ -152,12 +152,12 @@ int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit,
X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc)
{
return (X509v3_get_ext(x->tbsResponseData.responseExtensions, loc));
return X509v3_get_ext(x->tbsResponseData.responseExtensions, loc);
}
X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc)
{
return (X509v3_delete_ext(x->tbsResponseData.responseExtensions, loc));
return X509v3_delete_ext(x->tbsResponseData.responseExtensions, loc);
}
void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit,
@@ -184,34 +184,34 @@ int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc)
int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x)
{
return (X509v3_get_ext_count(x->singleExtensions));
return X509v3_get_ext_count(x->singleExtensions);
}
int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos)
{
return (X509v3_get_ext_by_NID(x->singleExtensions, nid, lastpos));
return X509v3_get_ext_by_NID(x->singleExtensions, nid, lastpos);
}
int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, const ASN1_OBJECT *obj,
int lastpos)
{
return (X509v3_get_ext_by_OBJ(x->singleExtensions, obj, lastpos));
return X509v3_get_ext_by_OBJ(x->singleExtensions, obj, lastpos);
}
int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit,
int lastpos)
{
return (X509v3_get_ext_by_critical(x->singleExtensions, crit, lastpos));
return X509v3_get_ext_by_critical(x->singleExtensions, crit, lastpos);
}
X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc)
{
return (X509v3_get_ext(x->singleExtensions, loc));
return X509v3_get_ext(x->singleExtensions, loc);
}
X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc)
{
return (X509v3_delete_ext(x->singleExtensions, loc));
return X509v3_delete_ext(x->singleExtensions, loc);
}
void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit,
crypto/ocsp/ocsp_ht.c
+8 -8
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2001-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2001-2017 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -7,11 +7,11 @@
* https://www.openssl.org/source/license.html
*/
#include "e_os.h"
#include <stdio.h>
#include <stdlib.h>
#include <ctype.h>
#include "internal/ctype.h"
#include <string.h>
#include "e_os.h"
#include <openssl/asn1.h>
#include <openssl/ocsp.h>
#include <openssl/err.h>
@@ -209,7 +209,7 @@ static int parse_http_line1(char *line)
char *p, *q, *r;
/* Skip to first white space (passed protocol info) */
for (p = line; *p && !isspace((unsigned char)*p); p++)
for (p = line; *p && !ossl_isspace(*p); p++)
continue;
if (!*p) {
OCSPerr(OCSP_F_PARSE_HTTP_LINE1, OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
@@ -217,7 +217,7 @@ static int parse_http_line1(char *line)
}
/* Skip past white space to start of response code */
while (*p && isspace((unsigned char)*p))
while (*p && ossl_isspace(*p))
p++;
if (!*p) {
@@ -226,7 +226,7 @@ static int parse_http_line1(char *line)
}
/* Find end of response code: first whitespace after start of code */
for (q = p; *q && !isspace((unsigned char)*q); q++)
for (q = p; *q && !ossl_isspace(*q); q++)
continue;
if (!*q) {
@@ -244,7 +244,7 @@ static int parse_http_line1(char *line)
return 0;
/* Skip over any leading white space in message */
while (*q && isspace((unsigned char)*q))
while (*q && ossl_isspace(*q))
q++;
if (*q) {
@@ -253,7 +253,7 @@ static int parse_http_line1(char *line)
*/
/* We know q has a non white space character so this is OK */
for (r = q + strlen(q) - 1; isspace((unsigned char)*r); r--)
for (r = q + strlen(q) - 1; ossl_isspace(*r); r--)
*r = 0;
}
if (retcode != 200) {
crypto/ocsp/ocsp_lcl.h
+5 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -224,6 +224,10 @@ struct ocsp_service_locator_st {
ASN1_item_sign(ASN1_ITEM_rptr(OCSP_RESPDATA),&(o)->signatureAlgorithm,\
NULL,(o)->signature,&(o)->tbsResponseData,pkey,md)
# define OCSP_BASICRESP_sign_ctx(o,ctx,d) \
ASN1_item_sign_ctx(ASN1_ITEM_rptr(OCSP_RESPDATA),&(o)->signatureAlgorithm,\
NULL,(o)->signature,&(o)->tbsResponseData,ctx)
# define OCSP_REQUEST_verify(a,r) ASN1_item_verify(ASN1_ITEM_rptr(OCSP_REQINFO),\
&(a)->optionalSignature->signatureAlgorithm,\
(a)->optionalSignature->signature,&(a)->tbsRequest,r)
crypto/ocsp/ocsp_srv.c
+37 -7
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2001-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -168,15 +168,28 @@ int OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert)
return 1;
}
int OCSP_basic_sign(OCSP_BASICRESP *brsp,
X509 *signer, EVP_PKEY *key, const EVP_MD *dgst,
/*
* Sign an OCSP response using the parameters contained in the digest context,
* set the responderID to the subject name in the signer's certificate, and
* include one or more optional certificates in the response.
*/
int OCSP_basic_sign_ctx(OCSP_BASICRESP *brsp,
X509 *signer, EVP_MD_CTX *ctx,
STACK_OF(X509) *certs, unsigned long flags)
{
int i;
OCSP_RESPID *rid;
EVP_PKEY *pkey;
if (!X509_check_private_key(signer, key)) {
OCSPerr(OCSP_F_OCSP_BASIC_SIGN,
if (ctx == NULL || EVP_MD_CTX_pkey_ctx(ctx) == NULL) {
OCSPerr(OCSP_F_OCSP_BASIC_SIGN_CTX, OCSP_R_NO_SIGNER_KEY);
goto err;
}
pkey = EVP_PKEY_CTX_get0_pkey(EVP_MD_CTX_pkey_ctx(ctx));
if (pkey == NULL || !X509_check_private_key(signer, pkey)) {
OCSPerr(OCSP_F_OCSP_BASIC_SIGN_CTX,
OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
goto err;
}
@@ -208,7 +221,7 @@ int OCSP_basic_sign(OCSP_BASICRESP *brsp,
* -- Richard Levitte
*/
if (!OCSP_BASICRESP_sign(brsp, key, dgst, 0))
if (!OCSP_BASICRESP_sign_ctx(brsp, ctx, 0))
goto err;
return 1;
@@ -216,6 +229,23 @@ int OCSP_basic_sign(OCSP_BASICRESP *brsp,
return 0;
}
int OCSP_basic_sign(OCSP_BASICRESP *brsp,
X509 *signer, EVP_PKEY *key, const EVP_MD *dgst,
STACK_OF(X509) *certs, unsigned long flags)
{
EVP_MD_CTX *ctx = EVP_MD_CTX_new();
EVP_PKEY_CTX *pkctx = NULL;
int i;
if (!EVP_DigestSignInit(ctx, &pkctx, dgst, NULL, key)) {
EVP_MD_CTX_free(ctx);
return 0;
}
i = OCSP_basic_sign_ctx(brsp, signer, ctx, certs, flags);
EVP_MD_CTX_free(ctx);
return i;
}
int OCSP_RESPID_set_by_name(OCSP_RESPID *respid, X509 *cert)
{
if (!X509_NAME_set(&respid->value.byName, X509_get_subject_name(cert)))
@@ -265,7 +295,7 @@ int OCSP_RESPID_match(OCSP_RESPID *respid, X509 *cert)
return (ASN1_STRING_length(respid->value.byKey) == SHA_DIGEST_LENGTH)
&& (memcmp(ASN1_STRING_get0_data(respid->value.byKey), md,
SHA_DIGEST_LENGTH) == 0);
} else if(respid->type == V_OCSP_RESPID_NAME) {
} else if (respid->type == V_OCSP_RESPID_NAME) {
if (respid->value.byName == NULL)
return 0;