Include string.h so mem* functions get properly declared.

[openssl.git] / crypto / ocsp / ocsp_vfy.c

diff --git a/crypto/ocsp/ocsp_vfy.c b/crypto/ocsp/ocsp_vfy.c
index 8868c980cbaadf9d3ed7b117bc7d2e262e92ab64..c4f513a3b61a6b3756477a5b2d63a6f73102bd0a 100644 (file)
--- a/crypto/ocsp/ocsp_vfy.c
+++ b/crypto/ocsp/ocsp_vfy.c
@@ -58,8 +58,9 @@
 
 #include <openssl/ocsp.h>
 #include <openssl/err.h>
+#include <string.h>
 
-static X509 *ocsp_find_signer(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
+static int ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
                                X509_STORE *st, unsigned long flags);
 static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id);
 static int ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain, unsigned long flags);
@@ -76,12 +77,14 @@ int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
        STACK_OF(X509) *chain = NULL;
        X509_STORE_CTX ctx;
        int i, ret = 0;
-       signer = ocsp_find_signer(bs, certs, st, flags);
-       if (!signer)
+       ret = ocsp_find_signer(&signer, bs, certs, st, flags);
+       if (!ret)
                {
                OCSPerr(OCSP_F_OCSP_BASIC_VERIFY, OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND);
                goto end;
                }
+       if ((ret == 2) && (flags & OCSP_TRUSTOTHER))
+               flags |= OCSP_NOVERIFY;
        if (!(flags & OCSP_NOSIGS))
                {
                EVP_PKEY *skey;
@@ -148,19 +151,26 @@ int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
        }
 
 
-static X509 *ocsp_find_signer(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
+static int ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
                                X509_STORE *st, unsigned long flags)
        {
        X509 *signer;
        OCSP_RESPID *rid = bs->tbsResponseData->responderId;
        if ((signer = ocsp_find_signer_sk(certs, rid)))
-               return signer;
+               {
+               *psigner = signer;
+               return 2;
+               }
        if(!(flags & OCSP_NOINTERN) &&
            (signer = ocsp_find_signer_sk(bs->certs, rid)))
-               return signer;
+               {
+               *psigner = signer;
+               return 1;
+               }
        /* Maybe lookup from store if by subject name */
 
-       return NULL;
+       *psigner = NULL;
+       return 0;
        }
 
 
@@ -168,8 +178,6 @@ static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id)
        {
        int i;
        unsigned char tmphash[SHA_DIGEST_LENGTH], *keyhash;
-       ASN1_BIT_STRING *key;
-       EVP_MD_CTX ctx;
        X509 *x;
 
        /* Easy if lookup by name */
@@ -185,10 +193,7 @@ static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id)
        for (i = 0; i < sk_X509_num(certs); i++)
                {
                x = sk_X509_value(certs, i);
-               key = x->cert_info->key->public_key;
-               EVP_DigestInit(&ctx,EVP_sha1());
-               EVP_DigestUpdate(&ctx,key->data, key->length);
-               EVP_DigestFinal(&ctx,tmphash,NULL);
+               X509_pubkey_digest(x, EVP_sha1(), tmphash, NULL);
                if(!memcmp(keyhash, tmphash, SHA_DIGEST_LENGTH))
                        return x;
                }
@@ -285,9 +290,7 @@ static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,
        if(cid)
                {
                const EVP_MD *dgst;
-               EVP_MD_CTX ctx;
                X509_NAME *iname;
-               ASN1_BIT_STRING *ikey;
                int mdlen;
                unsigned char md[EVP_MAX_MD_SIZE];
                if (!(dgst = EVP_get_digestbyobj(cid->hashAlgorithm->algorithm)))
@@ -305,11 +308,7 @@ static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,
                        return -1;
                if (memcmp(md, cid->issuerNameHash->data, mdlen))
                        return 0;
-               ikey = cert->cert_info->key->public_key;
-
-               EVP_DigestInit(&ctx,dgst);
-               EVP_DigestUpdate(&ctx,ikey->data, ikey->length);
-               EVP_DigestFinal(&ctx,md,NULL);
+               X509_pubkey_digest(cert, EVP_sha1(), md, NULL);
                if (memcmp(md, cid->issuerKeyHash->data, mdlen))
                        return 0;