[crypto] Require OCSP check if certificate provides an OCSP URI

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/crypto/x509.c b/src/crypto/x509.c
index 2180173b0ecfb2bacbdd34b63d28c37a2efa97b6..1a27eb24ca0621c12d7d962e5c656a952932d566 100644 (file)
--- a/src/crypto/x509.c
+++ b/src/crypto/x509.c
@@ -98,6 +98,10 @@ FILE_LICENCE ( GPL2_OR_LATER );
        __einfo_error ( EINFO_EACCES_EMPTY )
 #define EINFO_EACCES_EMPTY \
        __einfo_uniqify ( EINFO_EACCES, 0x08, "Empty certificate chain" )
+#define EACCES_OCSP_REQUIRED \
+       __einfo_error ( EINFO_EACCES_OCSP_REQUIRED )
+#define EINFO_EACCES_OCSP_REQUIRED \
+       __einfo_uniqify ( EINFO_EACCES, 0x09, "OCSP check required" )
 
 /** Certificate cache */
 static LIST_HEAD ( x509_cache );
@@ -1343,6 +1347,14 @@ int x509_validate ( struct x509_certificate *cert,
                return -EACCES_PATH_LEN;
        }
 
+       /* Fail if OCSP is required */
+       if ( cert->extensions.auth_info.ocsp.uri &&
+            ( ! cert->extensions.auth_info.ocsp.good ) ) {
+               DBGC ( cert, "X509 %p \"%s\" requires an OCSP check\n",
+                      cert, cert->subject.name );
+               return -EACCES_OCSP_REQUIRED;
+       }
+
        /* Calculate effective path length */
        cert->path_remaining = ( issuer->path_remaining - 1 );
        max_path_remaining = ( cert->extensions.basic.path_len + 1 );