From ce5886dda80b6f60fb30762381506d5c6f2d995c Mon Sep 17 00:00:00 2001
From: Benjamin Kaduk <bkaduk@akamai.com>
Date: Wed, 18 Oct 2017 15:29:18 -0500
Subject: [PATCH] Add an API to get the signer of an OCSP response

Add a new function OCSP_resp_get0_signer() that looks in the
certs bundled with the response as well as in additional certificates
provided as a function argument, returning the certificate that signed
the given response (if present).

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4573)
---
 crypto/ocsp/ocsp_vfy.c             |  9 +++++++++
 doc/man3/OCSP_resp_find_status.pod | 15 ++++++++++++++-
 include/openssl/ocsp.h             |  2 ++
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/crypto/ocsp/ocsp_vfy.c b/crypto/ocsp/ocsp_vfy.c
index 809f7f41e1..89147d93ae 100644
--- a/crypto/ocsp/ocsp_vfy.c
+++ b/crypto/ocsp/ocsp_vfy.c
@@ -138,6 +138,15 @@ int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
     goto end;
 }
 
+int OCSP_resp_get0_signer(OCSP_BASICRESP *bs, X509 **signer,
+                     STACK_OF(X509) *extra_certs)
+{
+    int ret;
+
+    ret = ocsp_find_signer(signer, bs, extra_certs, 0);
+    return (ret > 0) ? 1 : 0;
+}
+
 static int ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs,
                             STACK_OF(X509) *certs, unsigned long flags)
 {
diff --git a/doc/man3/OCSP_resp_find_status.pod b/doc/man3/OCSP_resp_find_status.pod
index e1442eb97e..a3695090dc 100644
--- a/doc/man3/OCSP_resp_find_status.pod
+++ b/doc/man3/OCSP_resp_find_status.pod
@@ -3,6 +3,7 @@
 =head1 NAME
 
 OCSP_resp_get0_certs,
+OCSP_resp_get0_signer,
 OCSP_resp_get0_id,
 OCSP_resp_get1_id,
 OCSP_resp_get0_produced_at,
@@ -33,6 +34,9 @@ OCSP_single_get0_status, OCSP_check_validity
 
  const STACK_OF(X509) *OCSP_resp_get0_certs(const OCSP_BASICRESP *bs);
 
+ int OCSP_resp get0_signer(OCSP_BASICRESP *bs, X509 **signer,
+                           STACK_OF(X509) *extra_certs);
+
  int OCSP_resp_get0_id(const OCSP_BASICRESP *bs,
                        const ASN1_OCTET_STRING **pid,
                        const X509_NAME **pname);
@@ -76,7 +80,13 @@ single response B<bs>.
 
 OCSP_resp_get0_certs() returns any certificates included in B<bs>.
 
-OCSP_resp_get0_id() gets the responder id of <bs>. If the responder ID is
+OCSP_resp_get0_signer() attempts to retrive the certificate that directly
+signed B<bs>.  The OCSP protocol does not require that this certificate
+is included in the B<certs> field of the response, so additional certificates
+can be supplied in B<extra_certs> if the certificates that may have
+signed the response are known via some out-of-band mechanism.
+
+OCSP_resp_get0_id() gets the responder id of B<bs>. If the responder ID is
 a name then <*pname> is set to the name and B<*pid> is set to NULL. If the
 responder ID is by key ID then B<*pid> is set to the key ID and B<*pname>
 is set to NULL. OCSP_resp_get1_id() leaves ownership of B<*pid> and B<*pname>
@@ -106,6 +116,9 @@ B<id> was not found.
 OCSP_single_get0_status() returns the status of B<single> or -1 if an error
 occurred.
 
+OCSP_resp_get0_signer() returns 1 if the signing certificate was located,
+or 0 on error.
+
 =head1 NOTES
 
 Applications will typically call OCSP_resp_find_status() using the certificate
diff --git a/include/openssl/ocsp.h b/include/openssl/ocsp.h
index b609e9af45..3ca2a92630 100644
--- a/include/openssl/ocsp.h
+++ b/include/openssl/ocsp.h
@@ -197,6 +197,8 @@ int OCSP_response_status(OCSP_RESPONSE *resp);
 OCSP_BASICRESP *OCSP_response_get1_basic(OCSP_RESPONSE *resp);
 
 const ASN1_OCTET_STRING *OCSP_resp_get0_signature(const OCSP_BASICRESP *bs);
+int OCSP_resp_get0_signer(OCSP_BASICRESP *bs, X509 **signer,
+                          STACK_OF(X509) *extra_certs);
 
 int OCSP_resp_count(OCSP_BASICRESP *bs);
 OCSP_SINGLERESP *OCSP_resp_get0(OCSP_BASICRESP *bs, int idx);
-- 
2.34.1