Update openssl bindings to allow client side OCSP stapling

[adiroiban]

I am looking at implementing OCSP stapling for Twisted (https://twistedmatrix.com/trac/ticket/6802) so I am documenting the work items I have identified so far

Docs:

• https://www.openssl.org/docs/ssl/SSL_CTX_set_client_cert_cb.html
• I could not find the public docs for SSL_set_tlsext_status_type

OpenSSL client sample code: https://github.com/openssl/openssl/blob/master/apps/s_client.c#L1530

# Set extension and set callback 
SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp);
SSL_CTX_set_tlsext_status_cb(ctx, ocsp_resp_cb);
SSL_CTX_set_tlsext_status_arg(ctx, bio_c_out);

static int ocsp_resp_cb(SSL *s, void *arg)
{
    const unsigned char *p;
    int len;
    OCSP_RESPONSE *rsp;
    len = SSL_get_tlsext_status_ocsp_resp(s, &p);
    BIO_puts(arg, "OCSP response: ");
    if (!p) {
        BIO_puts(arg, "no response sent\n");
        return 1;
    }
    rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
    if (!rsp) {
        BIO_puts(arg, "response parse error\n");
        BIO_dump_indent(arg, (char *)p, len, 4);
        return 0;
    }
    BIO_puts(arg, "\n======================================\n");
    OCSP_RESPONSE_print(arg, rsp, 0);
    BIO_puts(arg, "======================================\n");
    OCSP_RESPONSE_free(rsp);
    return 1;
}

[alex]

Missing things:

• SSL_set_tlsext_status_type
• SSL_CTX_set_tlsext_status_cb
• SSL_CTX_set_tlsext_status_arg
• OCSP_RESPONSE
• SSL_get_tlsext_status_ocsp_resp
• d2i_OCSP_RESPONSE
• OCSP_RESPONSE_print
• OCSP_RESPONSE_free

[adiroiban]

I am not sure if we need OCSP_RESPONSE_print ... I think that we will need to decode the DER content and construct from in an OCSP response object.

I could only find the source code for it ... but come with no docstring :( https://github.com/openssl/openssl/blob/6ef869d7d0a9d2e7ea7908c0b5aab1cb451e00fa/crypto/ocsp/ocsp_prn.c#L186 ... good to see that the source file comes with a 60 lines long header

---

I think that we need a separate ticket for OCSP specific method and dedicate this ticket for OCSP TLS extension

[adiroiban]

Also, I am not sure if we want to use OpenSSL implementation for making an OCSP request.

We can have an initial implementation in pure python and then extend with low level support from various libraries.

[eeshangarg]

I already submitted a PR for SSL_get_tlsext_status_ocsp_resp; and I am working on the other bindings as well. :-)

Here's an updated checklist of methods that need/needed to be bound,

• SSL_CTX_set_tlsext_status_cb
• i2d_OCSP_RESPONSE
• SSL_set_tlsext_status_ocsp_resp
• SSL_set_tlsext_status_type
• SSL_CTX_set_tlsext_status_arg
• OCSP_RESPONSE
• SSL_get_tlsext_status_ocsp_resp
• d2i_OCSP_RESPONSE
• OCSP_RESPONSE_print
• OCSP_RESPONSE_free

Thanks,
Eeshan

[reaperhulk]

with the merge of #1945 I think we can close this (as no one seems to want the OCSP bindings right now). We can open a new issue if required.