Kaynağa Gözat

[ocsp] Allow OCSP checks to be disabled

Some CAs provide non-functional OCSP servers, and some clients are
forced to operate on networks without access to the OCSP servers.
Allow the user to explicitly disable the use of OCSP checks by
undefining OCSP_CHECK in config/crypto.h.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown 6 yıl önce
ebeveyn
işleme
9759860ec0
2 değiştirilmiş dosya ile 20 ekleme ve 0 silme
  1. 8
    0
      src/config/crypto.h
  2. 12
    0
      src/include/ipxe/ocsp.h

+ 8
- 0
src/config/crypto.h Dosyayı Görüntüle

@@ -58,6 +58,14 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
58 58
  */
59 59
 #define CROSSCERT "http://ca.ipxe.org/auto"
60 60
 
61
+/** Perform OCSP checks when applicable
62
+ *
63
+ * Some CAs provide non-functional OCSP servers, and some clients are
64
+ * forced to operate on networks without access to the OCSP servers.
65
+ * Allow the user to explicitly disable the use of OCSP checks.
66
+ */
67
+#define OCSP_CHECK
68
+
61 69
 #include <config/named.h>
62 70
 #include NAMED_CONFIG(crypto.h)
63 71
 #include <config/local/crypto.h>

+ 12
- 0
src/include/ipxe/ocsp.h Dosyayı Görüntüle

@@ -14,6 +14,14 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
14 14
 #include <ipxe/asn1.h>
15 15
 #include <ipxe/x509.h>
16 16
 #include <ipxe/refcnt.h>
17
+#include <config/crypto.h>
18
+
19
+/* Allow OCSP to be disabled completely */
20
+#ifdef OCSP_CHECK
21
+#define OCSP_ENABLED 1
22
+#else
23
+#define OCSP_ENABLED 0
24
+#endif
17 25
 
18 26
 /** OCSP algorithm identifier */
19 27
 #define OCSP_ALGORITHM_IDENTIFIER( ... )				\
@@ -119,6 +127,10 @@ ocsp_put ( struct ocsp_check *ocsp ) {
119 127
  */
120 128
 static inline int ocsp_required ( struct x509_certificate *cert ) {
121 129
 
130
+	/* An OCSP check is never required if OCSP checks are disabled */
131
+	if ( ! OCSP_ENABLED )
132
+		return 0;
133
+
122 134
 	/* An OCSP check is required if an OCSP URI exists but the
123 135
 	 * OCSP status is not (yet) good.
124 136
 	 */

Loading…
İptal
Kaydet