- {
- /*
- * Since we are only interested in the presence or absence of
- * the nonce and comparing its value there is no need to use
- * the X509V3 routines: this way we can avoid them allocating an
- * ASN1_OCTET_STRING structure for the value which would be
- * freed immediately anyway.
- */
-
- int ret = 0, req_idx, resp_idx;
- X509_EXTENSION *req_ext, *resp_ext;
- req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1);
- resp_idx = OCSP_BASICRESP_get_ext_by_NID(bs, NID_id_pkix_OCSP_Nonce, -1);
- /* If both absent its OK */
- if((req_idx < 0) && (resp_idx < 0)) return 1;
- if((req_idx >= 0) && (resp_idx < 0))
- {
- OCSPerr(OCSP_F_OCSP_CHECK_NONCE, OCSP_R_NONCE_MISSING_IN_RESPONSE);
- goto err;
- }
- if((req_idx < 0) && (resp_idx >= 0))
- {
- OCSPerr(OCSP_F_OCSP_CHECK_NONCE, OCSP_R_UNEXPECTED_NONCE_IN_RESPONSE);
- goto err;
- }
- req_ext = OCSP_REQUEST_get_ext(req, req_idx);
- resp_ext = OCSP_BASICRESP_get_ext(bs, resp_idx);
- if(ASN1_OCTET_STRING_cmp(req_ext->value, resp_ext->value))
- {
- OCSPerr(OCSP_F_OCSP_CHECK_NONCE, OCSP_R_NONCE_VALUE_MISMATCH);
- goto err;
- }
- ret = 1;
- err:
- return ret;
- }
-
-/* Copy the nonce value (if any) from an OCSP request to
- * a response.
+{
+ /*
+ * Since we are only interested in the presence or absence of
+ * the nonce and comparing its value there is no need to use
+ * the X509V3 routines: this way we can avoid them allocating an
+ * ASN1_OCTET_STRING structure for the value which would be
+ * freed immediately anyway.
+ */
+
+ int req_idx, resp_idx;
+ X509_EXTENSION *req_ext, *resp_ext;
+ req_idx = OCSP_REQUEST_get_ext_by_NID(req, NID_id_pkix_OCSP_Nonce, -1);
+ resp_idx = OCSP_BASICRESP_get_ext_by_NID(bs, NID_id_pkix_OCSP_Nonce, -1);
+ /* Check both absent */
+ if ((req_idx < 0) && (resp_idx < 0))
+ return 2;
+ /* Check in request only */
+ if ((req_idx >= 0) && (resp_idx < 0))
+ return -1;
+ /* Check in response but not request */
+ if ((req_idx < 0) && (resp_idx >= 0))
+ return 3;
+ /*
+ * Otherwise nonce in request and response so retrieve the extensions
+ */
+ req_ext = OCSP_REQUEST_get_ext(req, req_idx);
+ resp_ext = OCSP_BASICRESP_get_ext(bs, resp_idx);
+ if (ASN1_OCTET_STRING_cmp(X509_EXTENSION_get_data(req_ext),
+ X509_EXTENSION_get_data(resp_ext)))
+ return 0;
+ return 1;
+}
+
+/*
+ * Copy the nonce value (if any) from an OCSP request to a response.