Mirrors/openssl
0
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2026-01-18 17:11:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Support OSCP responses for DTLS 1.3

Browse Source 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28455)
This commit is contained in:
Frederik Wedel-Heinen
2025-09-08 19:30:29 +02:00
committed by Tomas Mraz
parent c48fa552a5
commit b29c176415
4 changed files with 9 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
apps/s_client.c
View File

@@ -3695,7 +3695,8 @@ static int ocsp_resp_cb(SSL *s, void *arg)
STACK_OF(OCSP_RESPONSE) *sk_resp = NULL;
OCSP_RESPONSE *rsp;
if (SSL_version(s) >= TLS1_3_VERSION) {
if ((!SSL_is_dtls(s) && SSL_version(s) >= TLS1_3_VERSION)
|| (SSL_is_dtls(s) && SSL_version(s) <= DTLS1_3_VERSION)) {
(void)SSL_get0_tlsext_status_ocsp_resp_ex(s, &sk_resp);
BIO_puts(arg, "OCSP responses: ");

11
apps/s_server.c
View File

@@ -617,10 +617,8 @@ static int bring_ocsp_resp_in_correct_order(SSL *s, tlsextstatusctx *srctx,
sk_OCSP_RESPONSE_pop_free(*sk_resp, OCSP_RESPONSE_free);
SSL_get0_chain_certs(s, &server_chain);
/*
* TODO(DTLS-1.3): in future DTLS should also be considered
*/
if (server_chain != NULL && srctx->status_all && !SSL_is_dtls(s) && SSL_version(s) >= TLS1_3_VERSION) {
if (server_chain != NULL && srctx->status_all && ((!SSL_is_dtls(s) && SSL_version(s) >= TLS1_3_VERSION) || (SSL_is_dtls(s) && SSL_version(s) <= DTLS1_3_VERSION))) {
/* certificate chain is available */
num = sk_X509_num(server_chain) + 1;
}
@@ -775,10 +773,7 @@ static int get_ocsp_resp_from_responder(SSL *s, tlsextstatusctx *srctx,
SSL_get0_chain_certs(s, &server_chain);
/*
* TODO(DTLS-1.3): in future DTLS should also be considered
*/
if (server_chain != NULL && srctx->status_all && !SSL_is_dtls(s) && SSL_version(s) >= TLS1_3_VERSION) {
if (server_chain != NULL && srctx->status_all && ((!SSL_is_dtls(s) && SSL_version(s) >= TLS1_3_VERSION) || (SSL_is_dtls(s) && SSL_version(s) <= DTLS1_3_VERSION))) {
/* certificate chain is available */
num = sk_X509_num(server_chain) + 1;
} else {

7
ssl/ssl_cert.c
View File

@@ -434,6 +434,7 @@ static int ssl_verify_internal(SSL_CONNECTION *s, STACK_OF(X509) *sk, EVP_PKEY *
SSL_CTX *sctx;
#ifndef OPENSSL_NO_OCSP
SSL *ssl;
const int version1_3 = SSL_CONNECTION_IS_DTLS(s) ? DTLS1_3_VERSION : TLS1_3_VERSION;
#endif
/* Something must be passed in */
@@ -496,10 +497,8 @@ static int ssl_verify_internal(SSL_CONNECTION *s, STACK_OF(X509) *sk, EVP_PKEY *
*/
#ifndef OPENSSL_NO_OCSP
ssl = SSL_CONNECTION_GET_SSL(s);
/*
* TODO(DTLS-1.3): in future DTLS should also be considered
*/
if (!SSL_is_dtls(ssl) && SSL_version(ssl) >= TLS1_3_VERSION) {
if (ssl_version_cmp(s, SSL_version(ssl), version1_3) >= 0) {
/* ignore status_request_v2 if TLS version < 1.3 */
int status = SSL_get_tlsext_status_type(ssl);

5
ssl/statem/statem_clnt.c
View File

@@ -3035,10 +3035,7 @@ int tls_process_cert_status_body(SSL_CONNECTION *s, size_t chainidx, PACKET *pkt
if (s->ext.ocsp.resp_ex == NULL)
s->ext.ocsp.resp_ex = sk_OCSP_RESPONSE_new_null();
/*
* TODO(DTLS-1.3): in future DTLS should also be considered
*/
if (!SSL_CONNECTION_IS_TLS13(s) && type == TLSEXT_STATUSTYPE_ocsp) {
if (!SSL_CONNECTION_IS_VERSION13(s) && type == TLSEXT_STATUSTYPE_ocsp) {
sk_OCSP_RESPONSE_pop_free(s->ext.ocsp.resp_ex, OCSP_RESPONSE_free);
s->ext.ocsp.resp_ex = sk_OCSP_RESPONSE_new_null();
}