Added gnutls_ocsp_resp_get_responder_by_key()

diff --git a/lib/includes/gnutls/ocsp.h b/lib/includes/gnutls/ocsp.h
index a0c4d7bfb75ff7e1d27757b5615b9742de09922d..1a9679c08bacbfa9735a5c830ad6e36ec6a3f386 100644 (file)
--- a/lib/includes/gnutls/ocsp.h
+++ b/lib/includes/gnutls/ocsp.h
@@ -211,6 +211,10 @@ int gnutls_ocsp_resp_get_response(gnutls_ocsp_resp_t resp,
 int gnutls_ocsp_resp_get_version(gnutls_ocsp_resp_t resp);
 int gnutls_ocsp_resp_get_responder(gnutls_ocsp_resp_t resp,
                                   gnutls_datum_t * dn);
+int
+gnutls_ocsp_resp_get_responder_by_key(gnutls_ocsp_resp_t resp,
+                                     gnutls_datum_t * id);
+
 time_t gnutls_ocsp_resp_get_produced(gnutls_ocsp_resp_t resp);
 int gnutls_ocsp_resp_get_single(gnutls_ocsp_resp_t resp,
                                unsigned indx,

diff --git a/lib/libgnutls.map b/lib/libgnutls.map
index 9a880c2a1d644f2e821faa08e4417a556203830e..340832c32a5b62bf28edb44af43f613096729da2 100644 (file)
--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
@@ -1062,6 +1062,7 @@ GNUTLS_3_1_0 {
        gnutls_memcmp;
        gnutls_pkcs12_bag_set_privkey;
        gnutls_x509_privkey_set_pin_function;
+       gnutls_ocsp_resp_get_responder_by_key;
 } GNUTLS_3_0_0;
 
 GNUTLS_FIPS140 {

diff --git a/lib/x509/ocsp.c b/lib/x509/ocsp.c
index 5c3cae82f2bf87ac1b1d2e1100e43f37d123e2b0..e45c2539022030284fdea117cc403fc0299979cd 100644 (file)
--- a/lib/x509/ocsp.c
+++ b/lib/x509/ocsp.c
@@ -1114,6 +1114,9 @@ int gnutls_ocsp_resp_get_version(gnutls_ocsp_resp_t resp)
  * "C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output string
  * will be ASCII or UTF-8 encoded, depending on the certificate data.
  *
+ * If the responder ID is not a name but a hash, this function
+ * will return a @dn that has %NULL data.
+ *
  * The caller needs to deallocate memory by calling gnutls_free() on
  * @dn->data.
  *
@@ -1159,6 +1162,38 @@ gnutls_ocsp_resp_get_responder(gnutls_ocsp_resp_t resp,
        return GNUTLS_E_SUCCESS;
 }
 
+/**
+ * gnutls_ocsp_resp_get_responder_by_key:
+ * @resp: should contain a #gnutls_ocsp_resp_t structure
+ * @id: newly allocated buffer with ID
+ *
+ * This function will extract the key ID of the Basic OCSP Response in
+ * the provided buffer. If the responder ID is not a key ID then
+ * this function will return %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE.
+ *
+ * The caller needs to deallocate memory by calling gnutls_free() on
+ * @dn->data.
+ *
+ * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
+ *   negative error code is returned.
+ **/
+int
+gnutls_ocsp_resp_get_responder_by_key(gnutls_ocsp_resp_t resp,
+                                     gnutls_datum_t * id)
+{
+       int ret;
+
+       if (resp == NULL || id == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
+       ret = _gnutls_x509_read_value(resp->basicresp, "tbsResponseData.responderID.byKey", id);
+       if (ret == GNUTLS_E_ASN1_ELEMENT_NOT_FOUND)
+               return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+       return ret;
+}
+
 /**
  * gnutls_ocsp_resp_get_produced:
  * @resp: should contain a #gnutls_ocsp_resp_t structure

diff --git a/lib/x509/ocsp_output.c b/lib/x509/ocsp_output.c
index 6ec726b1933e75879a706adb90a494492a9b0c5e..ed96e8e777109cecde17666590aa53582224d197 100644 (file)
--- a/lib/x509/ocsp_output.c
+++ b/lib/x509/ocsp_output.c
@@ -284,16 +284,27 @@ print_resp(gnutls_buffer_st * str, gnutls_ocsp_resp_t resp,
        {
                gnutls_datum_t dn;
 
-               /* XXX byKey */
-
                ret = gnutls_ocsp_resp_get_responder(resp, &dn);
-               if (ret < 0)
-                       addf(str, "error: get_dn: %s\n",
-                            gnutls_strerror(ret));
-               else {
-                       addf(str, _("\tResponder ID: %.*s\n"), dn.size,
-                            dn.data);
-                       gnutls_free(dn.data);
+               if (ret < 0) {
+                       if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
+                               ret = gnutls_ocsp_resp_get_responder_by_key(resp, &dn);
+
+                               if (ret >= 0) {
+                                       addf(str, _("\tResponder Key ID: "));
+                                       _gnutls_buffer_hexprint(str, dn.data, dn.size);
+                                       adds(str, "\n");
+                               }
+                               gnutls_free(dn.data);
+                       } else {
+                               addf(str, "error: get_dn: %s\n",
+                                    gnutls_strerror(ret));
+                       }
+               } else {
+                       if (dn.data != NULL) {
+                               addf(str, _("\tResponder ID: %.*s\n"), dn.size,
+                                    dn.data);
+                               gnutls_free(dn.data);
+                       }
                }
        }