Backport certificate status request TLS extension support to 0.9.8.

[openssl.git] / ssl / s3_srvr.c

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 6dba5c1977147ab9004667dd67ca935c65bd9dcf..fadb83ae611f9edb316c6785b3fc2dae6587477a 100644 (file)
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -306,10 +306,23 @@ int ssl3_accept(SSL *s)
                                {
                                ret=ssl3_send_server_certificate(s);
                                if (ret <= 0) goto end;
+#ifndef OPENSSL_NO_TLSEXT
+                               if (s->tlsext_status_expected)
+                                       s->state=SSL3_ST_SW_CERT_STATUS_A;
+                               else
+                                       s->state=SSL3_ST_SW_KEY_EXCH_A;
                                }
+                       else
+                               {
+                               skip = 1;
+                               s->state=SSL3_ST_SW_KEY_EXCH_A;
+                               }
+#else
                        else
                                skip=1;
+
                        s->state=SSL3_ST_SW_KEY_EXCH_A;
+#endif
                        s->init_num=0;
                        break;
 
@@ -512,6 +525,14 @@ int ssl3_accept(SSL *s)
                        s->init_num=0;
                        break;
 
+               case SSL3_ST_SW_CERT_STATUS_A:
+               case SSL3_ST_SW_CERT_STATUS_B:
+                       ret=ssl3_send_cert_status(s);
+                       if (ret <= 0) goto end;
+                       s->state=SSL3_ST_SW_KEY_EXCH_A;
+                       s->init_num=0;
+                       break;
+
 #endif
 
                case SSL3_ST_SW_CHANGE_A:
@@ -2740,4 +2761,39 @@ int ssl3_send_newsession_ticket(SSL *s)
        /* SSL3_ST_SW_SESSION_TICKET_B */
        return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
        }
+
+int ssl3_send_cert_status(SSL *s)
+       {
+       if (s->state == SSL3_ST_SW_CERT_STATUS_A)
+               {
+               unsigned char *p;
+               /* Grow buffer if need be: the length calculation is as
+                * follows 1 (message type) + 3 (message length) +
+                * 1 (ocsp response type) + 3 (ocsp response length)
+                * + (ocsp response)
+                */
+               if (!BUF_MEM_grow(s->init_buf, 8 + s->tlsext_ocsp_resplen))
+                       return -1;
+
+               p=(unsigned char *)s->init_buf->data;
+
+               /* do the header */
+               *(p++)=SSL3_MT_CERTIFICATE_STATUS;
+               /* message length */
+               l2n3(s->tlsext_ocsp_resplen + 4, p);
+               /* status type */
+               *(p++)= s->tlsext_status_type;
+               /* length of OCSP response */
+               l2n3(s->tlsext_ocsp_resplen, p);
+               /* actual response */
+               memcpy(p, s->tlsext_ocsp_resp, s->tlsext_ocsp_resplen);
+               /* number of bytes to write */
+               s->init_num = 8 + s->tlsext_ocsp_resplen;
+               s->state=SSL3_ST_SW_CERT_STATUS_B;
+               s->init_off = 0;
+               }
+
+       /* SSL3_ST_SW_CERT_STATUS_B */
+       return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
+       }
 #endif