summaryrefslogtreecommitdiffstats
path: root/src/include/ipxe
diff options
context:
space:
mode:
authorMichael Brown2018-03-18 21:27:49 +0100
committerMichael Brown2018-03-18 21:30:21 +0100
commit9759860ec0c30685b53568b10caa5a91428bc7bf (patch)
tree21eeee70897d800f3291ce614658a75e3284aa8b /src/include/ipxe
parent[ocsp] Centralise test for whether or not an OCSP check is required (diff)
downloadipxe-9759860ec0c30685b53568b10caa5a91428bc7bf.tar.gz
ipxe-9759860ec0c30685b53568b10caa5a91428bc7bf.tar.xz
ipxe-9759860ec0c30685b53568b10caa5a91428bc7bf.zip
[ocsp] Allow OCSP checks to be disabled
Some CAs provide non-functional OCSP servers, and some clients are forced to operate on networks without access to the OCSP servers. Allow the user to explicitly disable the use of OCSP checks by undefining OCSP_CHECK in config/crypto.h. Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/include/ipxe')
-rw-r--r--src/include/ipxe/ocsp.h12
1 files changed, 12 insertions, 0 deletions
diff --git a/src/include/ipxe/ocsp.h b/src/include/ipxe/ocsp.h
index 9a6b3fe6..be0bddc5 100644
--- a/src/include/ipxe/ocsp.h
+++ b/src/include/ipxe/ocsp.h
@@ -14,6 +14,14 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
#include <ipxe/asn1.h>
#include <ipxe/x509.h>
#include <ipxe/refcnt.h>
+#include <config/crypto.h>
+
+/* Allow OCSP to be disabled completely */
+#ifdef OCSP_CHECK
+#define OCSP_ENABLED 1
+#else
+#define OCSP_ENABLED 0
+#endif
/** OCSP algorithm identifier */
#define OCSP_ALGORITHM_IDENTIFIER( ... ) \
@@ -119,6 +127,10 @@ ocsp_put ( struct ocsp_check *ocsp ) {
*/
static inline int ocsp_required ( struct x509_certificate *cert ) {
+ /* An OCSP check is never required if OCSP checks are disabled */
+ if ( ! OCSP_ENABLED )
+ return 0;
+
/* An OCSP check is required if an OCSP URI exists but the
* OCSP status is not (yet) good.
*/