rlm_ocsp.c File Reference

Check a certificate against an OCSP responder. More...

#include <freeradius-devel/server/base.h>
#include <freeradius-devel/curl/base.h>
#include <freeradius-devel/server/module_rlm.h>
#include <freeradius-devel/tls/bio.h>
#include <freeradius-devel/tls/log.h>
#include <freeradius-devel/tls/strerror.h>
#include <freeradius-devel/tls/utils.h>
#include <freeradius-devel/util/slab.h>

Include dependency graph for rlm_ocsp.c:

Go to the source code of this file.

Data Structures
struct	rlm_ocsp_curl_context_t
struct	rlm_ocsp_env_t
struct	rlm_ocsp_response_t
struct	rlm_ocsp_t

Macros
#define	REST_BODY_ALLOC_CHUNK   1024

Enumerations
enum	ocsp_status_t {   OCSP_STATUS_FAILED = 0 ,   OCSP_STATUS_OK = 1 ,   OCSP_STATUS_SKIPPED = 2 }
enum	write_state_t {   WRITE_STATE_INIT = 0 ,   WRITE_STATE_PARSE_HEADERS ,   WRITE_STATE_PARSE_CONTENT ,   WRITE_STATE_DISCARD }

Functions
static int	mod_instantiate (module_inst_ctx_t const *mctx)
	Instantiate the module.

Variables
static fr_dict_attr_t const *	attr_tls_ocsp_cert_valid
static fr_dict_attr_t const *	attr_tls_ocsp_next_update
static fr_dict_t const *	dict_freeradius
static conf_parser_t	module_config []
module_rlm_t	rlm_ocsp
fr_dict_autoload_t	rlm_ocsp_dict []
fr_dict_attr_autoload_t	rlm_ocsp_dict_attr []

Detailed Description

Check a certificate against an OCSP responder.

Id

dba85ac6d27cc1f54e3983cb048fa743461907ee

Copyright

2026 Network RADIUS SAS (legal.nosp@m.@net.nosp@m.workr.nosp@m.adiu.nosp@m.s.com)

Definition in file rlm_ocsp.c.

---

Data Structure Documentation

rlm_ocsp_curl_context_t

struct rlm_ocsp_curl_context_t

Definition at line 93 of file rlm_ocsp.c.

Collaboration diagram for rlm_ocsp_curl_context_t:

Data Fields
char *	body	Pointer to the buffer which contains body data.
struct curl_slist *	headers	Any HTTP headers which will be sent with the request.
rlm_ocsp_response_t	response	Response context data.

rlm_ocsp_env_t

struct rlm_ocsp_env_t

Definition at line 118 of file rlm_ocsp.c.

Collaboration diagram for rlm_ocsp_env_t:

Data Fields
fr_value_box_t	certid	The certificate ID being checked.
fr_value_box_t	certuri	Certificate provided OCSP endpoint.

rlm_ocsp_response_t

struct rlm_ocsp_response_t

Definition at line 80 of file rlm_ocsp.c.

Collaboration diagram for rlm_ocsp_response_t:

Data Fields
size_t	alloc	Space allocated for buffer.
char *	buffer	Raw incoming HTTP data.
int	code	HTTP Status Code.
rlm_ocsp_t const *	inst	Module instance.
request_t *	request	Current request.
write_state_t	state	Decoder state.
size_t	used	Space used in buffer.

rlm_ocsp_t

struct rlm_ocsp_t

Definition at line 40 of file rlm_ocsp.c.

Collaboration diagram for rlm_ocsp_t:

Data Fields
char const *	ca_file	File containing certs for verifying OCSP responses.
char const *	ca_path	Directory containing certs for verifying OCSP responses.
fr_curl_conn_config_t	conn_config	Reusable CURL handle config.
int	leeway	Seconds of leeway allowed in checking response thisUpdate
int	max_age	Maximum age of thisUpdate allowed in response checks.
uint64_t	max_body_in	Largest response we accept.
bool	override_url	Always use the configured OCSP URL even if the certificate contains one.
bool	softfail	Should the module soft fail if the responder is not available.
char const *	url	Override / fallback OCSP URL.
bool	use_nonce	Include a nonce in OCSP requests/.
bool	verifycert	Should the certificate in responses be verified.

Macro Definition Documentation

REST_BODY_ALLOC_CHUNK

#define REST_BODY_ALLOC_CHUNK   1024

Definition at line 61 of file rlm_ocsp.c.

Enumeration Type Documentation

ocsp_status_t

enum ocsp_status_t

Enumerator
OCSP_STATUS_FAILED
OCSP_STATUS_OK
OCSP_STATUS_SKIPPED

Definition at line 70 of file rlm_ocsp.c.

write_state_t

enum write_state_t

Enumerator
WRITE_STATE_INIT
WRITE_STATE_PARSE_HEADERS
WRITE_STATE_PARSE_CONTENT
WRITE_STATE_DISCARD

Definition at line 63 of file rlm_ocsp.c.

Function Documentation

mod_instantiate()

static int mod_instantiate ( module_inst_ctx_t const *  mctx )

static

Instantiate the module.

Definition at line 803 of file rlm_ocsp.c.

Variable Documentation

attr_tls_ocsp_cert_valid

fr_dict_attr_t const* attr_tls_ocsp_cert_valid

static

Definition at line 131 of file rlm_ocsp.c.

attr_tls_ocsp_next_update

fr_dict_attr_t const* attr_tls_ocsp_next_update

static

Definition at line 132 of file rlm_ocsp.c.

dict_freeradius

fr_dict_t const* dict_freeradius

static

Definition at line 123 of file rlm_ocsp.c.

module_config

conf_parser_t module_config[]

static

Initial value:

= {
        { FR_CONF_OFFSET("override_cert_url", rlm_ocsp_t, override_url), .dflt = "no" },
        { FR_CONF_OFFSET("url", rlm_ocsp_t, url) },
        { FR_CONF_OFFSET("use_nonce", rlm_ocsp_t, use_nonce), .dflt = "yes" },
        { FR_CONF_OFFSET("softfail", rlm_ocsp_t, softfail), .dflt = "no" },
        { FR_CONF_OFFSET("leeway", rlm_ocsp_t, leeway), .dflt = "300" },
        { FR_CONF_OFFSET("max_age", rlm_ocsp_t, max_age), .dflt = "-1" },
        { FR_CONF_OFFSET("verifycert", rlm_ocsp_t, verifycert), .dflt = "yes" },
        { FR_CONF_OFFSET_FLAGS("ca_path", CONF_FLAG_FILE_READABLE, rlm_ocsp_t, ca_path) },
        { FR_CONF_OFFSET_FLAGS("ca_file", CONF_FLAG_FILE_READABLE, rlm_ocsp_t, ca_file) },
        { FR_CONF_OFFSET("max_body_in", rlm_ocsp_t, max_body_in) },
        { FR_CONF_OFFSET_SUBSECTION("connection", 0, rlm_ocsp_t, conn_config, fr_curl_conn_config) },
 
        CONF_PARSER_TERMINATOR
}

Definition at line 102 of file rlm_ocsp.c.

rlm_ocsp

module_rlm_t rlm_ocsp

Initial value:

= {
        .common = {
                .magic                  = MODULE_MAGIC_INIT,
                .inst_size              = sizeof(rlm_ocsp_t),
                .name                   = "ocsp",
                .config                 = module_config,
                .instantiate            = mod_instantiate,
 
 
 
 
 
        },
 
 
 
 
 
 
 
 
}

Definition at line 823 of file rlm_ocsp.c.

rlm_ocsp_dict

fr_dict_autoload_t rlm_ocsp_dict

Initial value:

= {
        { .out = &dict_freeradius, .proto = "freeradius" },
        DICT_AUTOLOAD_TERMINATOR
}

Definition at line 126 of file rlm_ocsp.c.

rlm_ocsp_dict_attr

fr_dict_attr_autoload_t rlm_ocsp_dict_attr

Initial value:

= {
        { .out = &attr_tls_ocsp_cert_valid, .name = "TLS-OCSP-Cert-Valid", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
        { .out = &attr_tls_ocsp_next_update, .name = "TLS-OCSP-Next-Update", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
        DICT_AUTOLOAD_TERMINATOR
}

Definition at line 135 of file rlm_ocsp.c.