qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-24 23:47:55 -07:00
Code Releases Activity

crypto/tls: add server-side OCSP stapling support.

Browse Source 
We already had support on the client side. I also changed the name of
the flag in the ServerHello structure to match the name of the same
flag in the ClientHello (ocspStapling).

R=bradfitzgo
CC=golang-dev
https://golang.org/cl/4408044
This commit is contained in:
Adam Langley 2011-04-14 14:47:28 -04:00
parent e27702545a
commit 6f921f22ae
4 changed files with 20 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/pkg/crypto/tls/common.go
View File

@ -178,6 +178,9 @@ func (c *Config) cipherSuites() []uint16 {
type Certificate struct { type Certificate struct {
Certificate [][]byte Certificate [][]byte
PrivateKey *rsa.PrivateKey PrivateKey *rsa.PrivateKey
// OCSPStaple contains an optional OCSP response which will be served
// to clients that request it.
OCSPStaple []byte
} }
// A TLS record. // A TLS record.

2
src/pkg/crypto/tls/handshake_client.go
View File

@ -145,7 +145,7 @@ func (c *Conn) clientHandshake() os.Error {
c.peerCertificates = certs c.peerCertificates = certs
if serverHello.certStatus { if serverHello.ocspStapling {
msg, err = c.readHandshake() msg, err = c.readHandshake()
if err != nil { if err != nil {
return err return err

10
src/pkg/crypto/tls/handshake_messages.go
View File

@ -306,7 +306,7 @@ type serverHelloMsg struct {
compressionMethod uint8 compressionMethod uint8
nextProtoNeg bool nextProtoNeg bool
nextProtos []string nextProtos []string
certStatus bool ocspStapling bool
} }
func (m *serverHelloMsg) marshal() []byte { func (m *serverHelloMsg) marshal() []byte {
@ -327,7 +327,7 @@ func (m *serverHelloMsg) marshal() []byte {
nextProtoLen += len(m.nextProtos) nextProtoLen += len(m.nextProtos)
extensionsLength += nextProtoLen extensionsLength += nextProtoLen
} }
if m.certStatus { if m.ocspStapling {
numExtensions++ numExtensions++
} }
if numExtensions > 0 { if numExtensions > 0 {
@ -373,7 +373,7 @@ func (m *serverHelloMsg) marshal() []byte {
z = z[1+l:] z = z[1+l:]
} }
} }
if m.certStatus { if m.ocspStapling {
z[0] = byte(extensionStatusRequest >> 8) z[0] = byte(extensionStatusRequest >> 8)
z[1] = byte(extensionStatusRequest) z[1] = byte(extensionStatusRequest)
z = z[4:] z = z[4:]
@ -406,7 +406,7 @@ func (m *serverHelloMsg) unmarshal(data []byte) bool {
m.nextProtoNeg = false m.nextProtoNeg = false
m.nextProtos = nil m.nextProtos = nil
m.certStatus = false m.ocspStapling = false
if len(data) == 0 { if len(data) == 0 {
// ServerHello is optionally followed by extension data // ServerHello is optionally followed by extension data
@ -450,7 +450,7 @@ func (m *serverHelloMsg) unmarshal(data []byte) bool {
if length > 0 { if length > 0 {
return false return false
} }
m.certStatus = true m.ocspStapling = true
} }
data = data[length:] data = data[length:]
} }

11
src/pkg/crypto/tls/handshake_server.go
View File

@ -103,6 +103,9 @@ FindCipherSuite:
hello.nextProtoNeg = true hello.nextProtoNeg = true
hello.nextProtos = config.NextProtos hello.nextProtos = config.NextProtos
} }
if clientHello.ocspStapling && len(config.Certificates[0].OCSPStaple) > 0 {
hello.ocspStapling = true
}
finishedHash.Write(hello.marshal()) finishedHash.Write(hello.marshal())
c.writeRecord(recordTypeHandshake, hello.marshal()) c.writeRecord(recordTypeHandshake, hello.marshal())
@ -116,6 +119,14 @@ FindCipherSuite:
finishedHash.Write(certMsg.marshal()) finishedHash.Write(certMsg.marshal())
c.writeRecord(recordTypeHandshake, certMsg.marshal()) c.writeRecord(recordTypeHandshake, certMsg.marshal())
if hello.ocspStapling {
certStatus := new(certificateStatusMsg)
certStatus.statusType = statusTypeOCSP
certStatus.response = config.Certificates[0].OCSPStaple
finishedHash.Write(certStatus.marshal())
c.writeRecord(recordTypeHandshake, certStatus.marshal())
}
keyAgreement := suite.ka() keyAgreement := suite.ka()
skx, err := keyAgreement.generateServerKeyExchange(config, clientHello, hello) skx, err := keyAgreement.generateServerKeyExchange(config, clientHello, hello)