Changeset 1c3853a in mod_gnutls for src/gnutls_ocsp.c

Timestamp:

Jan 11, 2020, 3:30:40 PM (8 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

master, proxy-ticket

Children:

1aad1d7

Parents:

08ba205

Message:

Minimal multi-staple implementation

Works, but has limitations:

• Async OCSP updates are only done for the server (end entity) certificate.

• The configuration requires there to be an OCSP URI in every certificate but the last one in the configured chain. If configuration for any certificate fails vhost configuration fails.

File:

• src/gnutls_ocsp.c (modified) (1 diff)

src/gnutls_ocsp.c

@@ -1150 +1150 @@
 
     /* array for ocsp data, currently size 1 */
-    sc->ocsp = apr_palloc(pconf, sizeof(mgs_ocsp_data_t));
-
-    mgs_ocsp_data_t ocsp = apr_palloc(pconf, sizeof(struct mgs_ocsp_data));
-
-    ocsp->cert = sc->certs_x509_crt_chain[0];
-
-    ocsp->uri = mgs_cert_get_ocsp_uri(pconf, ocsp->cert);
-    if (ocsp->uri == NULL && sc->ocsp_response_file == NULL)
-        return "No OCSP URI in the certificate nor a GnuTLSOCSPResponseFile "
-            "setting, cannot configure OCSP stapling.";
-
-    ocsp->fingerprint =
-        mgs_get_cert_fingerprint(pconf, sc->certs_x509_crt_chain[0]);
-    if (ocsp->fingerprint.data == NULL)
-        return "Could not read fingerprint from certificate!";
-
-    ocsp->trust = apr_palloc(pconf,
-                             sizeof(gnutls_x509_trust_list_t));
-    /* Only the direct issuer may sign the OCSP response or an OCSP
-     * signer. */
-    int ret = mgs_create_ocsp_trust_list(ocsp->trust,
-                                         &(sc->certs_x509_crt_chain[1]),
-                                         1);
-    if (ret != GNUTLS_E_SUCCESS)
-    {
-        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, server,
-                     "Could not create OCSP trust list: %s (%d)",
-                     gnutls_strerror(ret), ret);
-        return "Could not build trust list for OCSP stapling!";
-    }
-    /* deinit trust list when the config pool is destroyed */
-    apr_pool_cleanup_register(pconf, ocsp->trust,
-                              mgs_cleanup_trust_list,
-                              apr_pool_cleanup_null);
-
-    sc->ocsp[0] = ocsp;
+    sc->ocsp = apr_palloc(pconf, sizeof(mgs_ocsp_data_t) * (sc->certs_x509_chain_num - 1));
+
+    for (unsigned int i = 0; i < (sc->certs_x509_chain_num - 1); i++)
+    {
+        mgs_ocsp_data_t ocsp = apr_palloc(pconf, sizeof(struct mgs_ocsp_data));
+
+        ocsp->cert = sc->certs_x509_crt_chain[i];
+
+        ocsp->uri = mgs_cert_get_ocsp_uri(pconf, ocsp->cert);
+        if (ocsp->uri == NULL && sc->ocsp_response_file == NULL)
+            return "No OCSP URI in the certificate nor a "
+                "GnuTLSOCSPResponseFile setting, cannot configure "
+                "OCSP stapling.";
+
+        ocsp->fingerprint =
+            mgs_get_cert_fingerprint(pconf, sc->certs_x509_crt_chain[i]);
+        if (ocsp->fingerprint.data == NULL)
+            return "Could not read fingerprint from certificate!";
+
+        ocsp->trust = apr_palloc(pconf,
+                                 sizeof(gnutls_x509_trust_list_t));
+        /* Only the direct issuer may sign the OCSP response or an
+         * OCSP signer. */
+        int ret = mgs_create_ocsp_trust_list(ocsp->trust,
+                                             &(sc->certs_x509_crt_chain[i+1]),
+                                             1);
+        if (ret != GNUTLS_E_SUCCESS)
+        {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, server,
+                         "Could not create OCSP trust list: %s (%d)",
+                         gnutls_strerror(ret), ret);
+            return "Could not build trust list for OCSP stapling!";
+        }
+        /* deinit trust list when the config pool is destroyed */
+        apr_pool_cleanup_register(pconf, ocsp->trust,
+                                  mgs_cleanup_trust_list,
+                                  apr_pool_cleanup_null);
+
+        sc->ocsp[i] = ocsp;
+        sc->ocsp_num = i + 1;
+    }
     return NULL;
 }