From a0021a30dd8db832714e327bbbc65d3589f528ab Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Sun, 18 Mar 2018 22:21:49 +0200 Subject: [ocsp] Centralise test for whether or not an OCSP check is required Signed-off-by: Michael Brown --- src/include/ipxe/ocsp.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'src/include') diff --git a/src/include/ipxe/ocsp.h b/src/include/ipxe/ocsp.h index 71fa41dc..9a6b3fe6 100644 --- a/src/include/ipxe/ocsp.h +++ b/src/include/ipxe/ocsp.h @@ -111,6 +111,21 @@ ocsp_put ( struct ocsp_check *ocsp ) { ref_put ( &ocsp->refcnt ); } +/** + * Check if X.509 certificate requires an OCSP check + * + * @v cert X.509 certificate + * @ret ocsp_required An OCSP check is required + */ +static inline int ocsp_required ( struct x509_certificate *cert ) { + + /* An OCSP check is required if an OCSP URI exists but the + * OCSP status is not (yet) good. + */ + return ( cert->extensions.auth_info.ocsp.uri.len && + ( ! cert->extensions.auth_info.ocsp.good ) ); +} + extern int ocsp_check ( struct x509_certificate *cert, struct x509_certificate *issuer, struct ocsp_check **ocsp ); -- cgit v1.2.3-55-g7522