kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Implement SSL_get_tlsext_status_type

Browse Source 
It's used by Node.js[1], and is simple to implement.

[1]: e2f58c71dd/src/node_crypto.cc (L2390)

Change-Id: Ie5c76b848623d00f7478aeae0214c25472de523c
Reviewed-on: https://boringssl-review.googlesource.com/c/32525
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
This commit is contained in:
Jeremy Apthorp 2018-10-18 14:18:05 -07:00 committed by CQ bot account: commit-bot@chromium.org
parent 6f579c0e9e
commit c0c9001440
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
include/openssl/ssl.h
View File

@ -4268,6 +4268,14 @@ OPENSSL_EXPORT int OPENSSL_init_ssl(uint64_t opts,
// Use |SSL_enable_ocsp_stapling| instead.
OPENSSL_EXPORT int SSL_set_tlsext_status_type(SSL *ssl, int type);
// SSL_get_tlsext_status_type returns |TLSEXT_STATUSTYPE_ocsp| if the client
// requested OCSP stapling and |TLSEXT_STATUSTYPE_nothing| otherwise. On the
// client, this reflects whether OCSP stapling was enabled via, e.g.,
// |SSL_set_tlsext_status_type|. On the server, this is determined during the
// handshake. It may be queried in callbacks set by |SSL_CTX_set_cert_cb|. The
// result is undefined after the handshake completes.
OPENSSL_EXPORT int SSL_get_tlsext_status_type(const SSL *ssl);
// SSL_set_tlsext_status_ocsp_resp sets the OCSP response. It returns one on
// success and zero on error. On success, |ssl| takes ownership of |resp|, which
// must have been allocated by |OPENSSL_malloc|.

13
ssl/ssl_lib.cc
View File

@ -2751,6 +2751,19 @@ int SSL_set_tlsext_status_type(SSL *ssl, int type) {
return 1;
}
int SSL_get_tlsext_status_type(const SSL *ssl) {
if (ssl->server) {
SSL_HANDSHAKE *hs = ssl->s3->hs.get();
return hs != nullptr && hs->ocsp_stapling_requested
? TLSEXT_STATUSTYPE_ocsp
: TLSEXT_STATUSTYPE_nothing;
}
return ssl->config != nullptr && ssl->config->ocsp_stapling_enabled
? TLSEXT_STATUSTYPE_ocsp
: TLSEXT_STATUSTYPE_nothing;
}
int SSL_set_tlsext_status_ocsp_resp(SSL *ssl, uint8_t *resp, size_t resp_len) {
if (SSL_set_ocsp_response(ssl, resp, resp_len)) {
OPENSSL_free(resp);