Added "skip verify if OCSP succeeds". Fixes #1426

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 2ef6f0080267d81748df1e019aa1b3f3714ba5bd..92c4c40765f1dd26b7de0833c5cc1dfde34d0937 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -197,6 +197,8 @@ eap {
                #
                ca_file = ${cadir}/ca.pem
 
+               ca_file = foo
+
                #  OpenSSL will automatically create certificate chains,
                #  unless we tell it to not do that.  The problem is that
                #  it sometimes gets the chains right from a certificate
@@ -424,7 +426,18 @@ eap {
                #  default configuration.  Uncomment it, and configure
                #  the correct paths below to enable it.
                #
+               #  If OCSP checking is enabled, and the OCSP checks fail,
+               #  the verify section is skipped.
+               #
                verify {
+                       #  If the OCSP checks succeed, the verify section
+                       #  is run to allow additional checks.
+                       #
+                       #  If you want to skip verify on OCSP success,
+                       #  uncomment this configuration item, and set it
+                       #  to "yes".
+       #               skip_if_ocsp_ok = no
+
                        #  A temporary directory where the client
                        #  certificates are stored.  This directory
                        #  MUST be owned by the UID of the server,

diff --git a/src/include/tls-h b/src/include/tls-h
index 1f46e633d6b4357fa2e7f49c7fb902cccb8e9c71..db2c543314c0bec2d7cccbf624bf5faa7a453bf2 100644 (file)
--- a/src/include/tls-h
+++ b/src/include/tls-h
@@ -369,6 +369,7 @@ struct fr_tls_server_conf_t {
        char            session_context_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
        time_t          session_last_flushed;
 
+       bool            verify_skip_if_ocsp_ok;
        char const      *verify_tmp_dir;
        char const      *verify_client_cert_cmd;
        bool            require_client_cert;

diff --git a/src/main/tls.c b/src/main/tls.c
index 62066b5de0ee83a8a76cdcbc5e07a57346a847e0..af2e7f679f0b8574c2fd8fc19e514ca5435763b4 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -991,6 +991,7 @@ static CONF_PARSER cache_config[] = {
 };
 
 static CONF_PARSER verify_config[] = {
+       { "skip_if_ocsp_ok", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, verify_skip_if_ocsp_ok), "no" },
        { "tmpdir", FR_CONF_OFFSET(PW_TYPE_STRING, fr_tls_server_conf_t, verify_tmp_dir), NULL },
        { "client", FR_CONF_OFFSET(PW_TYPE_STRING, fr_tls_server_conf_t, verify_client_cert_cmd), NULL },
        CONF_PARSER_TERMINATOR
@@ -2074,8 +2075,14 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
                 *      If OCSP checks fail, don't run the verify
                 *      command.  The user will be rejected no matter
                 *      what, so we might as well do less work.
+                *
+                *      If OCSP checks succeed, we may want to skip the verify section.
                 */
-               if (my_ok) while (conf->verify_client_cert_cmd) {
+               if (my_ok
+#ifdef HAVE_OPENSSL_OCSP_H
+                   && conf->ocsp_enable && (conf->verify_skip_if_ocsp_ok) && (my_ok == 1)
+#endif
+                       ) while (conf->verify_client_cert_cmd) {
                        char filename[256];
                        int fd;
                        FILE *fp;