[svn] ksba - r253 - in trunk: . src tests
svn author wk
cvs at cvs.gnupg.org
Wed Aug 30 22:39:53 CEST 2006
Author: wk
Date: 2006-08-30 22:39:53 +0200 (Wed, 30 Aug 2006)
New Revision: 253
Modified:
trunk/NEWS
trunk/TODO
trunk/src/ChangeLog
trunk/src/ksba.h
trunk/src/libksba.vers
trunk/src/ocsp.c
trunk/tests/t-ocsp.c
Log:
More OCSP fixes and one new API
Modified: trunk/NEWS
===================================================================
--- trunk/NEWS 2006-08-30 10:19:14 UTC (rev 252)
+++ trunk/NEWS 2006-08-30 20:39:53 UTC (rev 253)
@@ -1,9 +1,15 @@
Noteworthy changes in version 0.9.17
-------------------------------------------------
- * OCSP nonces are now checked to detact replay attacks.
+ * OCSP nonces are now checked to detect replay attacks.
+ * OCSP extensions may no be retrieved.
+ * Interface changes relative to the 0.9.16 release:
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ ksba_ocsp_get_extension NEW
+
+
Noteworthy changes in version 0.9.16 (2006-08-01)
-------------------------------------------------
Modified: trunk/TODO
===================================================================
--- trunk/TODO 2006-08-30 10:19:14 UTC (rev 252)
+++ trunk/TODO 2006-08-30 20:39:53 UTC (rev 253)
@@ -51,3 +51,4 @@
** The ASN.1 parse tree is not released in all places
** Some memory is not released in case of errors.
+* Implement ksba_ocsp_get_extension!!!!
Modified: trunk/src/ChangeLog
===================================================================
--- trunk/src/ChangeLog 2006-08-30 10:19:14 UTC (rev 252)
+++ trunk/src/ChangeLog 2006-08-30 20:39:53 UTC (rev 253)
@@ -2,6 +2,8 @@
* ocsp.c (extract_nonce): New.
(ksba_ocsp_parse_response): Set status to replay on bad nonce.
+ (ksba_ocsp_get_extension): New.
+ (parse_response): Fixed storing of received_certs.
* util.c (ksba_calloc): Protect against integer overflow.
Modified: trunk/src/ksba.h
===================================================================
--- trunk/src/ksba.h 2006-08-30 10:19:14 UTC (rev 252)
+++ trunk/src/ksba.h 2006-08-30 20:39:53 UTC (rev 253)
@@ -399,9 +399,12 @@
ksba_isotime_t r_next_update,
ksba_isotime_t r_revocation_time,
ksba_crl_reason_t *r_reason);
+gpg_error_t ksba_ocsp_get_extension (ksba_ocsp_t ocsp, ksba_cert_t cert,
+ int idx,
+ char const **r_oid, int *r_crit,
+ size_t *r_deroff, size_t *r_derlen);
-
/*-- certreq.c --*/
gpg_error_t ksba_certreq_new (ksba_certreq_t *r_cr);
void ksba_certreq_release (ksba_certreq_t cr);
Modified: trunk/src/libksba.vers
===================================================================
--- trunk/src/libksba.vers 2006-08-30 10:19:14 UTC (rev 252)
+++ trunk/src/libksba.vers 2006-08-30 20:39:53 UTC (rev 253)
@@ -77,7 +77,7 @@
ksba_ocsp_get_status; ksba_ocsp_hash_request; ksba_ocsp_hash_response;
ksba_ocsp_new; ksba_ocsp_parse_response; ksba_ocsp_prepare_request;
ksba_ocsp_release; ksba_ocsp_set_digest_algo; ksba_ocsp_set_nonce;
- ksba_ocsp_set_requestor; ksba_ocsp_set_sig_val;
+ ksba_ocsp_set_requestor; ksba_ocsp_set_sig_val; ksba_ocsp_get_extension;
ksba_oid_from_str; ksba_oid_to_str;
Modified: trunk/src/ocsp.c
===================================================================
--- trunk/src/ocsp.c 2006-08-30 10:19:14 UTC (rev 252)
+++ trunk/src/ocsp.c 2006-08-30 20:39:53 UTC (rev 253)
@@ -1412,7 +1412,7 @@
cl->cert = cert;
*cl_tail = cl;
- cl_tail = &ocsp->received_certs;
+ cl_tail = &cl->next;
}
}
@@ -1607,7 +1607,7 @@
/* Find the certificate. We don't care about the issuer certificate
and stop at the first match. The implementation may be optimized
by keeping track of the last certificate found to start with the
- next one the. Given that a usual request consiost only of a few
+ next one then. Given that a usual request consists only of a few
certificates, this does not make much sense in reality. */
for (ri=ocsp->requestlist; ri; ri = ri->next)
if (ri->cert == cert)
@@ -1626,3 +1626,42 @@
*r_reason = ri->revocation_reason;
return 0;
}
+
+
+gpg_error_t
+ksba_ocsp_get_extension (ksba_ocsp_t ocsp, ksba_cert_t cert, int idx,
+ char const **r_oid, int *r_crit,
+ size_t *r_deroff, size_t *r_derlen)
+{
+ gpg_error_t err;
+
+ if (!ocsp)
+ return gpg_error (GPG_ERR_INV_VALUE);
+ if (!ocsp->requestlist)
+ return gpg_error (GPG_ERR_MISSING_ACTION);
+
+ if (cert)
+ {
+ /* Return extensions for the certificate (singleExtensions). */
+/* for (ri=ocsp->requestlist; ri; ri = ri->next) */
+/* if (ri->cert == cert) */
+/* break; */
+/* if (!ri) */
+/* return gpg_error (GPG_ERR_NOT_FOUND); */
+
+
+ }
+ else
+ {
+ /* Return extensions for the response (responseExtensions). */
+
+
+
+ }
+
+ return gpg_error (GPG_ERR_EOF);
+
+/* if (idx < 0 || idx >= cert->cache.n_extns) */
+/* return gpg_error (GPG_ERR_INV_INDEX); */
+}
+
Modified: trunk/tests/t-ocsp.c
===================================================================
--- trunk/tests/t-ocsp.c 2006-08-30 10:19:14 UTC (rev 252)
+++ trunk/tests/t-ocsp.c 2006-08-30 20:39:53 UTC (rev 253)
@@ -203,7 +203,8 @@
}
printf ("response status ..: %s\n", t);
- if (response_status == KSBA_OCSP_RSPSTATUS_SUCCESS)
+ if (response_status == KSBA_OCSP_RSPSTATUS_SUCCESS
+ || response_status == KSBA_OCSP_RSPSTATUS_REPLAYED)
{
ksba_status_t status;
ksba_crl_reason_t reason;
@@ -216,7 +217,9 @@
printf ("\nproduced at ......: ");
print_time (produced_at);
putchar ('\n');
+
+
err = ksba_ocsp_get_status (ocsp, cert,
&status, this_update, next_update,
revocation_time, &reason);
@@ -252,6 +255,15 @@
printf ("\nnext update ......: ");
print_time (next_update);
putchar ('\n');
+ {
+ int cert_idx;
+ ksba_cert_t acert;
+
+ for (cert_idx=0; (acert = ksba_ocsp_get_cert (ocsp, cert_idx));
+ cert_idx++)
+ ksba_cert_release (acert);
+ printf ("extra certificates: %d\n", cert_idx );
+ }
}
More information about the Gnupg-commits
mailing list