denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

updated x509 plugin to public key/x509 API changes

Browse Source
This commit is contained in:
Martin Willi
2009-08-26 11:23:52 +02:00
parent a5e3153a36
commit 6b6ece636c
5 changed files with 137 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_ac.c
+40 -52
View File
@@ -31,8 +31,8 @@
#include <credentials/certificates/x509.h> #include <credentials/certificates/x509.h>
#include <credentials/keys/private_key.h> #include <credentials/keys/private_key.h>
extern identification_t* x509_parse_authorityKeyIdentifier(chunk_t blob, extern chunk_t x509_parse_authorityKeyIdentifier(chunk_t blob,
int level0, chunk_t *authKeySerialNumber); int level0, chunk_t *authKeySerialNumber);
typedef struct private_x509_ac_t private_x509_ac_t; typedef struct private_x509_ac_t private_x509_ac_t;
@@ -109,7 +109,7 @@ struct private_x509_ac_t {
/** /**
* Authority Key Identifier * Authority Key Identifier
*/ */
identification_t *authKeyIdentifier; chunk_t authKeyIdentifier;
/** /**
* Authority Key Serial Number * Authority Key Serial Number
@@ -131,19 +131,19 @@ struct private_x509_ac_t {
*/ */
chunk_t signature; chunk_t signature;
/** /**
* Holder certificate * Holder certificate
*/ */
certificate_t *holderCert; certificate_t *holderCert;
/** /**
* Signer certificate * Signer certificate
*/ */
certificate_t *signerCert; certificate_t *signerCert;
/** /**
* Signer private key; * Signer private key;
*/ */
private_key_t *signerKey; private_key_t *signerKey;
/** /**
@@ -458,7 +458,7 @@ static bool parse_certificate(private_x509_ac_t *this)
break; break;
case OID_AUTHORITY_KEY_ID: case OID_AUTHORITY_KEY_ID:
this->authKeyIdentifier = x509_parse_authorityKeyIdentifier(object, this->authKeyIdentifier = x509_parse_authorityKeyIdentifier(object,
level, &this->authKeySerialNumber); level, &this->authKeySerialNumber);
break; break;
case OID_TARGET_INFORMATION: case OID_TARGET_INFORMATION:
DBG2(" need to parse targetInformation"); DBG2(" need to parse targetInformation");
@@ -567,29 +567,28 @@ static chunk_t build_attributes(private_x509_ac_t *this)
*/ */
static chunk_t build_authorityKeyIdentifier(private_x509_ac_t *this) static chunk_t build_authorityKeyIdentifier(private_x509_ac_t *this)
{ {
chunk_t keyIdentifier; chunk_t keyIdentifier = chunk_empty;
chunk_t authorityCertIssuer; chunk_t authorityCertIssuer;
chunk_t authorityCertSerialNumber; chunk_t authorityCertSerialNumber;
x509_t *x509 = (x509_t*)this->signerCert; identification_t *issuer;
identification_t *issuer = this->signerCert->get_issuer(this->signerCert); public_key_t *public;
public_key_t *public = this->signerCert->get_public_key(this->signerCert); x509_t *x509;
x509 = (x509_t*)this->signerCert;
issuer = this->signerCert->get_issuer(this->signerCert);
public = this->signerCert->get_public_key(this->signerCert);
if (public) if (public)
{ {
identification_t *keyid = public->get_id(public, ID_PUBKEY_SHA1); if (public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &keyIdentifier))
{
this->authKeyIdentifier = keyid = keyid->clone(keyid); this->authKeyIdentifier = chunk_clone(keyIdentifier);
keyIdentifier = keyid->get_encoding(keyid); }
public->destroy(public); public->destroy(public);
} }
else
{
keyIdentifier = chunk_empty;
}
authorityCertIssuer = build_directoryName(ASN1_CONTEXT_C_1, authorityCertIssuer = build_directoryName(ASN1_CONTEXT_C_1,
issuer->get_encoding(issuer)); issuer->get_encoding(issuer));
authorityCertSerialNumber = asn1_simple_object(ASN1_CONTEXT_S_2, authorityCertSerialNumber = asn1_simple_object(ASN1_CONTEXT_S_2,
x509->get_serial(x509)); x509->get_serial(x509));
return asn1_wrap(ASN1_SEQUENCE, "cm", return asn1_wrap(ASN1_SEQUENCE, "cm",
ASN1_authorityKeyIdentifier_oid, ASN1_authorityKeyIdentifier_oid,
asn1_wrap(ASN1_OCTET_STRING, "m", asn1_wrap(ASN1_OCTET_STRING, "m",
@@ -675,7 +674,7 @@ static identification_t* get_holderIssuer(private_x509_ac_t *this)
/** /**
* Implementation of ac_t.get_authKeyIdentifier. * Implementation of ac_t.get_authKeyIdentifier.
*/ */
static identification_t* get_authKeyIdentifier(private_x509_ac_t *this) static chunk_t get_authKeyIdentifier(private_x509_ac_t *this)
{ {
return this->authKeyIdentifier; return this->authKeyIdentifier;
} }
@@ -717,24 +716,12 @@ static id_match_t has_subject(private_x509_ac_t *this, identification_t *subject
*/ */
static id_match_t has_issuer(private_x509_ac_t *this, identification_t *issuer) static id_match_t has_issuer(private_x509_ac_t *this, identification_t *issuer)
{ {
id_match_t match; if (issuer->get_type(issuer) == ID_KEY_ID && this->authKeyIdentifier.ptr &&
chunk_equals(this->authKeyIdentifier, issuer->get_encoding(issuer)))
if (issuer->get_type(issuer) == ID_PUBKEY_SHA1)
{ {
if (this->authKeyIdentifier) return ID_MATCH_PERFECT;
{
match = issuer->matches(issuer, this->authKeyIdentifier);
}
else
{
match = ID_MATCH_NONE;
}
} }
else return this->issuerName->matches(this->issuerName, issuer);
{
match = this->issuerName->matches(this->issuerName, issuer);
}
return match;
} }
/** /**
@@ -761,19 +748,20 @@ static bool issued_by(private_x509_ac_t *this, certificate_t *issuer)
key = issuer->get_public_key(issuer); key = issuer->get_public_key(issuer);
/* compare keyIdentifiers if available, otherwise use DNs */ /* compare keyIdentifiers if available, otherwise use DNs */
if (this->authKeyIdentifier && key) if (this->authKeyIdentifier.ptr && key)
{ {
identification_t *subjectKeyIdentifier = key->get_id(key, ID_PUBKEY_SHA1); chunk_t fingerprint;
if (!subjectKeyIdentifier->equals(subjectKeyIdentifier, if (!key->get_fingerprint(key, KEY_ID_PUBKEY_SHA1, &fingerprint) ||
this->authKeyIdentifier)) !chunk_equals(fingerprint, this->authKeyIdentifier))
{ {
return FALSE; return FALSE;
} }
} }
else else
{ {
if (!this->issuerName->equals(this->issuerName, issuer->get_subject(issuer))) if (!this->issuerName->equals(this->issuerName,
issuer->get_subject(issuer)))
{ {
return FALSE; return FALSE;
} }
@@ -894,7 +882,6 @@ static void destroy(private_x509_ac_t *this)
DESTROY_IF(this->holderIssuer); DESTROY_IF(this->holderIssuer);
DESTROY_IF(this->entityName); DESTROY_IF(this->entityName);
DESTROY_IF(this->issuerName); DESTROY_IF(this->issuerName);
DESTROY_IF(this->authKeyIdentifier);
DESTROY_IF(this->holderCert); DESTROY_IF(this->holderCert);
DESTROY_IF(this->signerCert); DESTROY_IF(this->signerCert);
DESTROY_IF(this->signerKey); DESTROY_IF(this->signerKey);
@@ -902,6 +889,7 @@ static void destroy(private_x509_ac_t *this)
ietfAttr_list_destroy(this->charging); ietfAttr_list_destroy(this->charging);
ietfAttr_list_destroy(this->groups); ietfAttr_list_destroy(this->groups);
free(this->serialNumber.ptr); free(this->serialNumber.ptr);
free(this->authKeyIdentifier.ptr);
free(this->encoding.ptr); free(this->encoding.ptr);
free(this); free(this);
} }
@@ -918,7 +906,7 @@ static private_x509_ac_t *create_empty(void)
this->public.interface.get_serial = (chunk_t (*)(ac_t*))get_serial; this->public.interface.get_serial = (chunk_t (*)(ac_t*))get_serial;
this->public.interface.get_holderSerial = (chunk_t (*)(ac_t*))get_holderSerial; this->public.interface.get_holderSerial = (chunk_t (*)(ac_t*))get_holderSerial;
this->public.interface.get_holderIssuer = (identification_t* (*)(ac_t*))get_holderIssuer; this->public.interface.get_holderIssuer = (identification_t* (*)(ac_t*))get_holderIssuer;
this->public.interface.get_authKeyIdentifier = (identification_t* (*)(ac_t*))get_authKeyIdentifier; this->public.interface.get_authKeyIdentifier = (chunk_t(*)(ac_t*))get_authKeyIdentifier;
this->public.interface.certificate.get_type = (certificate_type_t (*)(certificate_t *this))get_type; this->public.interface.certificate.get_type = (certificate_type_t (*)(certificate_t *this))get_type;
this->public.interface.certificate.get_subject = (identification_t* (*)(certificate_t *this))get_subject; this->public.interface.certificate.get_subject = (identification_t* (*)(certificate_t *this))get_subject;
this->public.interface.certificate.get_issuer = (identification_t* (*)(certificate_t *this))get_issuer; this->public.interface.certificate.get_issuer = (identification_t* (*)(certificate_t *this))get_issuer;
@@ -937,10 +925,10 @@ static private_x509_ac_t *create_empty(void)
this->encoding = chunk_empty; this->encoding = chunk_empty;
this->serialNumber = chunk_empty; this->serialNumber = chunk_empty;
this->holderSerial = chunk_empty; this->holderSerial = chunk_empty;
this->authKeyIdentifier = chunk_empty;
this->holderIssuer = NULL; this->holderIssuer = NULL;
this->entityName = NULL; this->entityName = NULL;
this->issuerName = NULL; this->issuerName = NULL;
this->authKeyIdentifier = NULL;
this->holderCert = NULL; this->holderCert = NULL;
this->signerCert = NULL; this->signerCert = NULL;
this->signerKey = NULL; this->signerKey = NULL;
src/libstrongswan/plugins/x509/x509_cert.c
+18 -13
View File
@@ -138,7 +138,7 @@ struct private_x509_cert_t {
/** /**
* Authority Key Identifier * Authority Key Identifier
*/ */
identification_t *authKeyIdentifier; chunk_t authKeyIdentifier;
/** /**
* Authority Key Serial Number * Authority Key Serial Number
@@ -421,13 +421,13 @@ static const asn1Object_t authKeyIdentifierObjects[] = {
/** /**
* Extracts an authoritykeyIdentifier * Extracts an authoritykeyIdentifier
*/ */
identification_t* x509_parse_authorityKeyIdentifier(chunk_t blob, int level0, chunk_t x509_parse_authorityKeyIdentifier(chunk_t blob, int level0,
chunk_t *authKeySerialNumber) chunk_t *authKeySerialNumber)
{ {
asn1_parser_t *parser; asn1_parser_t *parser;
chunk_t object; chunk_t object;
int objectID; int objectID;
identification_t *authKeyIdentifier = NULL; chunk_t authKeyIdentifier = chunk_empty;
*authKeySerialNumber = chunk_empty; *authKeySerialNumber = chunk_empty;
@@ -439,8 +439,7 @@ identification_t* x509_parse_authorityKeyIdentifier(chunk_t blob, int level0,
switch (objectID) switch (objectID)
{ {
case AUTH_KEY_ID_KEY_ID: case AUTH_KEY_ID_KEY_ID:
authKeyIdentifier = identification_create_from_encoding( authKeyIdentifier = chunk_clone(object);
ID_PUBKEY_SHA1, object);
break; break;
case AUTH_KEY_ID_CERT_ISSUER: case AUTH_KEY_ID_CERT_ISSUER:
/* TODO: x509_parse_generalNames(object, level+1, TRUE); */ /* TODO: x509_parse_generalNames(object, level+1, TRUE); */
@@ -847,10 +846,12 @@ static id_match_t has_subject(private_x509_cert_t *this, identification_t *subje
enumerator_t *enumerator; enumerator_t *enumerator;
id_match_t match, best; id_match_t match, best;
if (this->encoding_hash.ptr && subject->get_type(subject) == ID_CERT_DER_SHA1 && if (this->encoding_hash.ptr && subject->get_type(subject) == ID_KEY_ID)
chunk_equals(this->encoding_hash, subject->get_encoding(subject)))
{ {
return ID_MATCH_PERFECT; if (chunk_equals(this->encoding_hash, subject->get_encoding(subject)))
{
return ID_MATCH_PERFECT;
}
} }
best = this->subject->matches(this->subject, subject); best = this->subject->matches(this->subject, subject);
@@ -1040,7 +1041,7 @@ static chunk_t get_serial(private_x509_cert_t *this)
/** /**
* Implementation of x509_t.get_authKeyIdentifier. * Implementation of x509_t.get_authKeyIdentifier.
*/ */
static identification_t *get_authKeyIdentifier(private_x509_cert_t *this) static chunk_t get_authKeyIdentifier(private_x509_cert_t *this)
{ {
return this->authKeyIdentifier; return this->authKeyIdentifier;
} }
@@ -1083,7 +1084,7 @@ static void destroy(private_x509_cert_t *this)
DESTROY_IF(this->issuer); DESTROY_IF(this->issuer);
DESTROY_IF(this->subject); DESTROY_IF(this->subject);
DESTROY_IF(this->public_key); DESTROY_IF(this->public_key);
DESTROY_IF(this->authKeyIdentifier); chunk_free(&this->authKeyIdentifier);
chunk_free(&this->encoding); chunk_free(&this->encoding);
chunk_free(&this->encoding_hash); chunk_free(&this->encoding_hash);
if (!this->parsed) if (!this->parsed)
@@ -1118,7 +1119,7 @@ static private_x509_cert_t* create_empty(void)
this->public.interface.interface.destroy = (void (*)(certificate_t*))destroy; this->public.interface.interface.destroy = (void (*)(certificate_t*))destroy;
this->public.interface.get_flags = (x509_flag_t (*)(x509_t*))get_flags; this->public.interface.get_flags = (x509_flag_t (*)(x509_t*))get_flags;
this->public.interface.get_serial = (chunk_t (*)(x509_t*))get_serial; this->public.interface.get_serial = (chunk_t (*)(x509_t*))get_serial;
this->public.interface.get_authKeyIdentifier = (identification_t* (*)(x509_t*))get_authKeyIdentifier; this->public.interface.get_authKeyIdentifier = (chunk_t (*)(x509_t*))get_authKeyIdentifier;
this->public.interface.create_subjectAltName_enumerator = (enumerator_t* (*)(x509_t*))create_subjectAltName_enumerator; this->public.interface.create_subjectAltName_enumerator = (enumerator_t* (*)(x509_t*))create_subjectAltName_enumerator;
this->public.interface.create_crl_uri_enumerator = (enumerator_t* (*)(x509_t*))create_crl_uri_enumerator; this->public.interface.create_crl_uri_enumerator = (enumerator_t* (*)(x509_t*))create_crl_uri_enumerator;
this->public.interface.create_ocsp_uri_enumerator = (enumerator_t* (*)(x509_t*))create_ocsp_uri_enumerator; this->public.interface.create_ocsp_uri_enumerator = (enumerator_t* (*)(x509_t*))create_ocsp_uri_enumerator;
@@ -1137,7 +1138,7 @@ static private_x509_cert_t* create_empty(void)
this->crl_uris = linked_list_create(); this->crl_uris = linked_list_create();
this->ocsp_uris = linked_list_create(); this->ocsp_uris = linked_list_create();
this->subjectKeyID = chunk_empty; this->subjectKeyID = chunk_empty;
this->authKeyIdentifier = NULL; this->authKeyIdentifier = chunk_empty;
this->authKeySerialNumber = chunk_empty; this->authKeySerialNumber = chunk_empty;
this->algorithm = 0; this->algorithm = 0;
this->signature = chunk_empty; this->signature = chunk_empty;
@@ -1253,7 +1254,11 @@ static bool generate(private_builder_t *this)
switch (this->cert->public_key->get_type(this->cert->public_key)) switch (this->cert->public_key->get_type(this->cert->public_key))
{ {
case KEY_RSA: case KEY_RSA:
key = this->cert->public_key->get_encoding(this->cert->public_key); if (!this->cert->public_key->get_encoding(this->cert->public_key,
KEY_PUB_ASN1_DER, &key))
{
return FALSE;
}
key_info = asn1_wrap(ASN1_SEQUENCE, "cm", key_info = asn1_wrap(ASN1_SEQUENCE, "cm",
asn1_algorithmIdentifier(OID_RSA_ENCRYPTION), asn1_algorithmIdentifier(OID_RSA_ENCRYPTION),
asn1_bitstring("m", key)); asn1_bitstring("m", key));
src/libstrongswan/plugins/x509/x509_crl.c
+15 -26
View File
@@ -101,7 +101,7 @@ struct private_x509_crl_t {
/** /**
* Authority Key Identifier * Authority Key Identifier
*/ */
identification_t *authKeyIdentifier; chunk_t authKeyIdentifier;
/** /**
* Authority Key Serial Number * Authority Key Serial Number
@@ -127,7 +127,7 @@ struct private_x509_crl_t {
/** /**
* from x509_cert * from x509_cert
*/ */
extern identification_t* x509_parse_authorityKeyIdentifier( extern chunk_t x509_parse_authorityKeyIdentifier(
chunk_t blob, int level0, chunk_t blob, int level0,
chunk_t *authKeySerialNumber); chunk_t *authKeySerialNumber);
@@ -337,10 +337,11 @@ static chunk_t get_serial(private_x509_crl_t *this)
/** /**
* Implementation of crl_t.get_authKeyIdentifier. * Implementation of crl_t.get_authKeyIdentifier.
*/ */
static identification_t* get_authKeyIdentifier(private_x509_crl_t *this) static chunk_t get_authKeyIdentifier(private_x509_crl_t *this)
{ {
return this->authKeyIdentifier; return this->authKeyIdentifier;
} }
/** /**
* Implementation of crl_t.create_enumerator. * Implementation of crl_t.create_enumerator.
*/ */
@@ -372,24 +373,12 @@ static identification_t* get_issuer(private_x509_crl_t *this)
*/ */
static id_match_t has_issuer(private_x509_crl_t *this, identification_t *issuer) static id_match_t has_issuer(private_x509_crl_t *this, identification_t *issuer)
{ {
id_match_t match; if (issuer->get_type(issuer) == ID_KEY_ID && this->authKeyIdentifier.ptr &&
chunk_equals(this->authKeyIdentifier, issuer->get_encoding(issuer)))
if (issuer->get_type(issuer) == ID_PUBKEY_SHA1)
{ {
if (this->authKeyIdentifier) return ID_MATCH_PERFECT;
{
match = issuer->matches(issuer, this->authKeyIdentifier);
}
else
{
match = ID_MATCH_NONE;
}
} }
else return this->issuer->matches(this->issuer, issuer);
{
match = this->issuer->matches(this->issuer, issuer);
}
return match;
} }
/** /**
@@ -416,12 +405,12 @@ static bool issued_by(private_x509_crl_t *this, certificate_t *issuer)
key = issuer->get_public_key(issuer); key = issuer->get_public_key(issuer);
/* compare keyIdentifiers if available, otherwise use DNs */ /* compare keyIdentifiers if available, otherwise use DNs */
if (this->authKeyIdentifier && key) if (this->authKeyIdentifier.ptr && key)
{ {
identification_t *subjectKeyIdentifier = key->get_id(key, ID_PUBKEY_SHA1); chunk_t fingerprint;
if (!subjectKeyIdentifier->equals(subjectKeyIdentifier, if (!key->get_fingerprint(key, KEY_ID_PUBKEY_SHA1, &fingerprint) ||
this->authKeyIdentifier)) !chunk_equals(fingerprint, this->authKeyIdentifier))
{ {
return FALSE; return FALSE;
} }
@@ -562,7 +551,7 @@ static void destroy(private_x509_crl_t *this)
{ {
this->revoked->destroy_function(this->revoked, free); this->revoked->destroy_function(this->revoked, free);
DESTROY_IF(this->issuer); DESTROY_IF(this->issuer);
DESTROY_IF(this->authKeyIdentifier); free(this->authKeyIdentifier.ptr);
free(this->encoding.ptr); free(this->encoding.ptr);
free(this); free(this);
} }
@@ -576,7 +565,7 @@ static private_x509_crl_t* create_empty(void)
private_x509_crl_t *this = malloc_thing(private_x509_crl_t); private_x509_crl_t *this = malloc_thing(private_x509_crl_t);
this->public.crl.get_serial = (chunk_t (*)(crl_t*))get_serial; this->public.crl.get_serial = (chunk_t (*)(crl_t*))get_serial;
this->public.crl.get_authKeyIdentifier = (identification_t* (*)(crl_t*))get_authKeyIdentifier; this->public.crl.get_authKeyIdentifier = (chunk_t (*)(crl_t*))get_authKeyIdentifier;
this->public.crl.create_enumerator = (enumerator_t* (*)(crl_t*))create_enumerator; this->public.crl.create_enumerator = (enumerator_t* (*)(crl_t*))create_enumerator;
this->public.crl.certificate.get_type = (certificate_type_t (*)(certificate_t *this))get_type; this->public.crl.certificate.get_type = (certificate_type_t (*)(certificate_t *this))get_type;
this->public.crl.certificate.get_subject = (identification_t* (*)(certificate_t *this))get_issuer; this->public.crl.certificate.get_subject = (identification_t* (*)(certificate_t *this))get_issuer;
@@ -597,7 +586,7 @@ static private_x509_crl_t* create_empty(void)
this->issuer = NULL; this->issuer = NULL;
this->crlNumber = chunk_empty; this->crlNumber = chunk_empty;
this->revoked = linked_list_create(); this->revoked = linked_list_create();
this->authKeyIdentifier = NULL; this->authKeyIdentifier = chunk_empty;
this->authKeySerialNumber = chunk_empty; this->authKeySerialNumber = chunk_empty;
this->ref = 1; this->ref = 1;
src/libstrongswan/plugins/x509/x509_ocsp_request.c
+2 -4
View File
@@ -159,13 +159,11 @@ static chunk_t build_requestList(private_x509_ocsp_request_t *this)
hasher_t *hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1); hasher_t *hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (hasher) if (hasher)
{ {
identification_t *keyid = public->get_id(public, ID_PUBKEY_SHA1); if (public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1,
if (keyid) &issuerKeyHash))
{ {
enumerator_t *enumerator; enumerator_t *enumerator;
issuerKeyHash = keyid->get_encoding(keyid);
issuer = cert->get_subject(cert); issuer = cert->get_subject(cert);
hasher->allocate_hash(hasher, issuer->get_encoding(issuer), hasher->allocate_hash(hasher, issuer->get_encoding(issuer),
&issuerNameHash); &issuerNameHash);
src/libstrongswan/plugins/x509/x509_ocsp_response.c
+23 -23
View File
@@ -173,7 +173,8 @@ static cert_validation_t get_status(private_x509_ocsp_response_t *this,
{ {
hasher_t *hasher; hasher_t *hasher;
identification_t *id; identification_t *id;
chunk_t hash; key_encoding_type_t type;
chunk_t hash, fingerprint;
/* check serial first, is cheaper */ /* check serial first, is cheaper */
if (!chunk_equals(subject->get_serial(subject), response->serialNumber)) if (!chunk_equals(subject->get_serial(subject), response->serialNumber))
@@ -191,15 +192,16 @@ static cert_validation_t get_status(private_x509_ocsp_response_t *this,
continue; continue;
} }
switch (response->hashAlgorithm) switch (response->hashAlgorithm)
{ /* TODO: generic mapper function */ {
case OID_SHA1: case OID_SHA1:
id = public->get_id(public, ID_PUBKEY_SHA1); type = KEY_ID_PUBKEY_SHA1;
break; break;
default: default:
public->destroy(public); public->destroy(public);
continue; continue;
} }
if (!chunk_equals(response->issuerKeyHash, id->get_encoding(id))) if (!public->get_fingerprint(public, type, &fingerprint) ||
!chunk_equals(response->issuerKeyHash, fingerprint))
{ {
public->destroy(public); public->destroy(public);
continue; continue;
@@ -525,7 +527,7 @@ static bool parse_basicOCSPResponse(private_x509_ocsp_response_t *this,
break; break;
case BASIC_RESPONSE_ID_BY_KEY: case BASIC_RESPONSE_ID_BY_KEY:
this->responderId = identification_create_from_encoding( this->responderId = identification_create_from_encoding(
ID_PUBKEY_INFO_SHA1, object); ID_KEY_ID, object);
DBG2(" '%Y'", this->responderId); DBG2(" '%Y'", this->responderId);
break; break;
case BASIC_RESPONSE_PRODUCED_AT: case BASIC_RESPONSE_PRODUCED_AT:
@@ -694,7 +696,22 @@ static bool issued_by(private_x509_ocsp_response_t *this, certificate_t *issuer)
{ {
return FALSE; return FALSE;
} }
if (this->responderId->get_type(this->responderId) == ID_DER_ASN1_DN) if (this->responderId->get_type(this->responderId) == ID_KEY_ID)
{
chunk_t fingerprint;
key = issuer->get_public_key(issuer);
if (!key ||
!key->get_fingerprint(key, KEY_ID_PUBKEY_SHA1, &fingerprint) ||
!chunk_equals(fingerprint,
this->responderId->get_encoding(this->responderId)))
{
DESTROY_IF(key);
return FALSE;
}
key->destroy(key);
}
else
{ {
if (!this->responderId->equals(this->responderId, if (!this->responderId->equals(this->responderId,
issuer->get_subject(issuer))) issuer->get_subject(issuer)))
@@ -702,23 +719,6 @@ static bool issued_by(private_x509_ocsp_response_t *this, certificate_t *issuer)
return FALSE; return FALSE;
} }
} }
else
{
bool equal;
public_key_t *public = issuer->get_public_key(issuer);
if (public == NULL)
{
return FALSE;
}
equal = this->responderId->equals(this->responderId,
public->get_id(public, ID_PUBKEY_SHA1));
public->destroy(public);
if (!equal)
{
return FALSE;
}
}
if (!(x509->get_flags(x509) & X509_OCSP_SIGNER) && if (!(x509->get_flags(x509) & X509_OCSP_SIGNER) &&
!(x509->get_flags(x509) & X509_CA)) !(x509->get_flags(x509) & X509_CA))
{ {