source: mod_gnutls/src/gnutls_ocsp.h @ 4ae5b82

debian/masterdebian/stretch-backportsupstream
Last change on this file since 4ae5b82 was 104e881, checked in by Thomas Klute <thomas2.klute@…>, 3 years ago

General comment updates for Doxygen compatibility

Mostly /* */ vs. / */ changes so Doxygen does catch the correct
descriptions instead of e.g. license headers, plus some minor comment
updates.

  • Property mode set to 100644
File size: 3.7 KB
Line 
1/*
2 *  Copyright 2016 Thomas Klute
3 *
4 *  Licensed under the Apache License, Version 2.0 (the "License");
5 *  you may not use this file except in compliance with the License.
6 *  You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 *  Unless required by applicable law or agreed to in writing, software
11 *  distributed under the License is distributed on an "AS IS" BASIS,
12 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 *  See the License for the specific language governing permissions and
14 *  limitations under the License.
15 */
16
17#ifndef __MOD_GNUTLS_OCSP_H__
18#define __MOD_GNUTLS_OCSP_H__
19
20#include "gnutls/gnutls.h"
21#include "gnutls/x509.h"
22#include "httpd.h"
23#include "http_config.h"
24
25#define MGS_OCSP_MUTEX_NAME "gnutls-ocsp"
26
27/** Default OCSP response cache timeout in seconds */
28#define MGS_OCSP_CACHE_TIMEOUT 3600
29/** Default OCSP failure timeout in seconds */
30#define MGS_OCSP_FAILURE_TIMEOUT 300
31/** Default socket timeout for OCSP responder connections, in
32 * seconds. Note that the timeout applies to "absolutely no data sent
33 * or received", not the whole connection. 10 seconds in mod_ssl. */
34#define MGS_OCSP_SOCKET_TIMEOUT 6
35
36/**
37 * Vhost specific OCSP data structure
38 */
39struct mgs_ocsp_data {
40    /** OCSP URI extracted from the server certificate. NULL if
41     * unset. */
42    apr_uri_t *uri;
43    /** Trust list to verify OCSP responses for stapling. Should
44     * usually only contain the CA that signed the server
45     * certificate. */
46    gnutls_x509_trust_list_t *trust;
47    /** Server certificate fingerprint, used as cache key for the OCSP
48     * response */
49    gnutls_datum_t fingerprint;
50};
51
52const char *mgs_ocsp_stapling_enable(cmd_parms *parms,
53                                     void *dummy __attribute__((unused)),
54                                     const int arg);
55
56const char *mgs_set_ocsp_check_nonce(cmd_parms *parms,
57                                     void *dummy __attribute__((unused)),
58                                     const int arg);
59
60const char *mgs_store_ocsp_response_path(cmd_parms * parms,
61                                         void *dummy __attribute__((unused)),
62                                         const char *arg);
63
64/**
65 * Create a trust list from a certificate chain (one or more
66 * certificates).
67 *
68 * @param tl This trust list will be initialized and filled with the
69 * specified certificate(s)
70 *
71 * @param chain certificate chain, must contain at least `num`
72 * certifictes
73 *
74 * @param num number of certificates to load from chain
75 *
76 * Chain is supposed to be static (the trust chain of the server
77 * certificate), so when `gnutls_x509_trust_list_deinit()` is called on
78 * tl later, the "all" parameter should be zero.
79 *
80 * @return `GNUTLS_E_SUCCESS` or a GnuTLS error code. In case of error
81 * tl will be uninitialized.
82 */
83int mgs_create_ocsp_trust_list(gnutls_x509_trust_list_t *tl,
84                               const gnutls_x509_crt_t *chain,
85                               const int num);
86
87/**
88 * Pool cleanup function that deinits the trust list without
89 * deinitializing certificates.
90 */
91apr_status_t mgs_cleanup_trust_list(void *data);
92
93/**
94 * Initialize server config for OCSP, supposed to be called in the
95 * post_config hook for each server where OCSP stapling is enabled,
96 * after certificates have been loaded.
97 *
98 * @return OK or DECLINED on success, any other value on error (like
99 * the post_config hook itself)
100 */
101int mgs_ocsp_post_config_server(apr_pool_t *pconf, apr_pool_t *ptemp,
102                                server_rec *server);
103
104int mgs_get_ocsp_response(gnutls_session_t session, void *ptr,
105                          gnutls_datum_t *ocsp_response);
106
107#endif /* __MOD_GNUTLS_OCSP_H__ */
Note: See TracBrowser for help on using the repository browser.