Parcourir la source

[ocsp] Allow OCSP checks to be disabled

Some CAs provide non-functional OCSP servers, and some clients are
forced to operate on networks without access to the OCSP servers.
Allow the user to explicitly disable the use of OCSP checks by
undefining OCSP_CHECK in config/crypto.h.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown il y a 6 ans
Parent
révision
9759860ec0
2 fichiers modifiés avec 20 ajouts et 0 suppressions
  1. 8
    0
      src/config/crypto.h
  2. 12
    0
      src/include/ipxe/ocsp.h

+ 8
- 0
src/config/crypto.h Voir le fichier

@@ -58,6 +58,14 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
58 58
  */
59 59
 #define CROSSCERT "http://ca.ipxe.org/auto"
60 60
 
61
+/** Perform OCSP checks when applicable
62
+ *
63
+ * Some CAs provide non-functional OCSP servers, and some clients are
64
+ * forced to operate on networks without access to the OCSP servers.
65
+ * Allow the user to explicitly disable the use of OCSP checks.
66
+ */
67
+#define OCSP_CHECK
68
+
61 69
 #include <config/named.h>
62 70
 #include NAMED_CONFIG(crypto.h)
63 71
 #include <config/local/crypto.h>

+ 12
- 0
src/include/ipxe/ocsp.h Voir le fichier

@@ -14,6 +14,14 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
14 14
 #include <ipxe/asn1.h>
15 15
 #include <ipxe/x509.h>
16 16
 #include <ipxe/refcnt.h>
17
+#include <config/crypto.h>
18
+
19
+/* Allow OCSP to be disabled completely */
20
+#ifdef OCSP_CHECK
21
+#define OCSP_ENABLED 1
22
+#else
23
+#define OCSP_ENABLED 0
24
+#endif
17 25
 
18 26
 /** OCSP algorithm identifier */
19 27
 #define OCSP_ALGORITHM_IDENTIFIER( ... )				\
@@ -119,6 +127,10 @@ ocsp_put ( struct ocsp_check *ocsp ) {
119 127
  */
120 128
 static inline int ocsp_required ( struct x509_certificate *cert ) {
121 129
 
130
+	/* An OCSP check is never required if OCSP checks are disabled */
131
+	if ( ! OCSP_ENABLED )
132
+		return 0;
133
+
122 134
 	/* An OCSP check is required if an OCSP URI exists but the
123 135
 	 * OCSP status is not (yet) good.
124 136
 	 */

Chargement…
Annuler
Enregistrer