2
0

ocsp_lib.c 3.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113
  1. /*
  2. * Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "internal/cryptlib.h"
  11. #include <openssl/objects.h>
  12. #include <openssl/x509.h>
  13. #include <openssl/pem.h>
  14. #include <openssl/x509v3.h>
  15. #include <openssl/ocsp.h>
  16. #include "ocsp_local.h"
  17. #include <openssl/asn1t.h>
  18. /* Convert a certificate and its issuer to an OCSP_CERTID */
  19. OCSP_CERTID *OCSP_cert_to_id(const EVP_MD *dgst, const X509 *subject,
  20. const X509 *issuer)
  21. {
  22. const X509_NAME *iname;
  23. const ASN1_INTEGER *serial;
  24. ASN1_BIT_STRING *ikey;
  25. if (!dgst)
  26. dgst = EVP_sha1();
  27. if (subject) {
  28. iname = X509_get_issuer_name(subject);
  29. serial = X509_get0_serialNumber(subject);
  30. } else {
  31. iname = X509_get_subject_name(issuer);
  32. serial = NULL;
  33. }
  34. ikey = X509_get0_pubkey_bitstr(issuer);
  35. return OCSP_cert_id_new(dgst, iname, ikey, serial);
  36. }
  37. OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst,
  38. const X509_NAME *issuerName,
  39. const ASN1_BIT_STRING *issuerKey,
  40. const ASN1_INTEGER *serialNumber)
  41. {
  42. int nid;
  43. unsigned int i;
  44. X509_ALGOR *alg;
  45. OCSP_CERTID *cid = NULL;
  46. unsigned char md[EVP_MAX_MD_SIZE];
  47. if ((cid = OCSP_CERTID_new()) == NULL)
  48. goto err;
  49. alg = &cid->hashAlgorithm;
  50. ASN1_OBJECT_free(alg->algorithm);
  51. if ((nid = EVP_MD_get_type(dgst)) == NID_undef) {
  52. ERR_raise(ERR_LIB_OCSP, OCSP_R_UNKNOWN_NID);
  53. goto err;
  54. }
  55. if ((alg->algorithm = OBJ_nid2obj(nid)) == NULL)
  56. goto err;
  57. if ((alg->parameter = ASN1_TYPE_new()) == NULL)
  58. goto err;
  59. alg->parameter->type = V_ASN1_NULL;
  60. if (!X509_NAME_digest(issuerName, dgst, md, &i))
  61. goto digerr;
  62. if (!(ASN1_OCTET_STRING_set(&cid->issuerNameHash, md, i)))
  63. goto err;
  64. /* Calculate the issuerKey hash, excluding tag and length */
  65. if (!EVP_Digest(issuerKey->data, issuerKey->length, md, &i, dgst, NULL))
  66. goto err;
  67. if (!(ASN1_OCTET_STRING_set(&cid->issuerKeyHash, md, i)))
  68. goto err;
  69. if (serialNumber) {
  70. if (ASN1_STRING_copy(&cid->serialNumber, serialNumber) == 0)
  71. goto err;
  72. }
  73. return cid;
  74. digerr:
  75. ERR_raise(ERR_LIB_OCSP, OCSP_R_DIGEST_ERR);
  76. err:
  77. OCSP_CERTID_free(cid);
  78. return NULL;
  79. }
  80. int OCSP_id_issuer_cmp(const OCSP_CERTID *a, const OCSP_CERTID *b)
  81. {
  82. int ret;
  83. ret = OBJ_cmp(a->hashAlgorithm.algorithm, b->hashAlgorithm.algorithm);
  84. if (ret)
  85. return ret;
  86. ret = ASN1_OCTET_STRING_cmp(&a->issuerNameHash, &b->issuerNameHash);
  87. if (ret)
  88. return ret;
  89. return ASN1_OCTET_STRING_cmp(&a->issuerKeyHash, &b->issuerKeyHash);
  90. }
  91. int OCSP_id_cmp(const OCSP_CERTID *a, const OCSP_CERTID *b)
  92. {
  93. int ret;
  94. ret = OCSP_id_issuer_cmp(a, b);
  95. if (ret)
  96. return ret;
  97. return ASN1_INTEGER_cmp(&a->serialNumber, &b->serialNumber);
  98. }
  99. IMPLEMENT_ASN1_DUP_FUNCTION(OCSP_CERTID)