fixed 4.3.6 ocsp regression

src/pluto/certs.c

@@ -247,6 +247,29 @@ void cert_release(cert_t *cert)
 	}
 }
 
+/**
+ * Get a X.509 certificate with a given issuer found at a certain position
+ */
+cert_t* get_x509cert(identification_t *issuer, chunk_t keyid, cert_t *chain)
+{
+	cert_t *cert = chain ? chain->next : certs;
+
+	while (cert)
+	{
+		certificate_t *certificate = cert->cert;
+		x509_t *x509 = (x509_t*)certificate;
+		chunk_t authKeyID = x509->get_authKeyIdentifier(x509);
+
+		if (keyid.ptr ? same_keyid(keyid, authKeyID) :
+			certificate->has_issuer(certificate, issuer))
+		{
+			return cert;
+		}
+		cert = cert->next;
+	}
+	return NULL;
+}
+
 /**
  *  List all PGP end certificates in a chained list
  */

src/pluto/certs.h

@@ -75,6 +75,7 @@ extern void cert_free(cert_t *cert);
 extern void cert_share(cert_t *cert);
 extern void cert_release(cert_t *cert);
 extern void cert_list(bool utc);
+extern cert_t* get_x509cert(identification_t *issuer, chunk_t keyid, cert_t* chain);
 
 #endif /* _CERTS_H */
 

src/pluto/x509.c

@@ -54,29 +54,6 @@ bool same_keyid(chunk_t a, chunk_t b)
 	return chunk_equals(a, b);
 }
 
-/**
- * Get a X.509 certificate with a given issuer found at a certain position
- */
-cert_t* get_x509cert(identification_t *issuer, chunk_t keyid, cert_t *chain)
-{
-	cert_t *cert = chain->next;
-
-	while (cert)
-	{
-		certificate_t *certificate = cert->cert;
-		x509_t *x509 = (x509_t*)certificate;
-		chunk_t authKeyID = x509->get_authKeyIdentifier(x509);
-
-		if (keyid.ptr ? same_keyid(keyid, authKeyID) :
-			certificate->has_issuer(certificate, issuer))
-		{
-			return cert;
-		}
-		cert = cert->next;
-	}
-	return NULL;
-}
-
 /**
  * Stores a chained list of end certs and CA certs
  */

src/pluto/x509.h

@@ -32,7 +32,6 @@ extern bool x509_check_signature(chunk_t tbs, chunk_t sig, int algorithm,
 extern chunk_t x509_build_signature(chunk_t tbs, int algorithm,
 									private_key_t *key, bool bit_string);
 extern bool verify_x509cert(cert_t *cert, bool strict, time_t *until);
-extern cert_t* get_x509cert(identification_t *issuer, chunk_t keyid, cert_t* chain);
 extern void store_x509certs(linked_list_t *certs, bool strict);
 extern void list_x509cert_chain(const char *caption, cert_t* cert,
 								x509_flag_t flags, bool utc);