Changeset 2246a84 in mod_gnutls for src/gnutls_ocsp.c

Timestamp:

Apr 21, 2018, 3:51:51 PM (2 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

debian/master, master, proxy-ticket

Children:

7921dc7

Parents:

fa6d0bb

Message:

Make automatic OCSP cache updates and fuzz time configurable

File:

• src/gnutls_ocsp.c (modified) (7 diffs)

src/gnutls_ocsp.c

@@ -86 +86 @@
     else
         sc->ocsp_staple = GNUTLS_ENABLED_FALSE;
+
+    return NULL;
+}
+
+
+
+const char *mgs_set_ocsp_auto_refresh(cmd_parms *parms,
+                                      void *dummy __attribute__((unused)),
+                                      const int arg)
+{
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+        ap_get_module_config(parms->server->module_config, &gnutls_module);
+
+    if (arg)
+        sc->ocsp_auto_refresh = GNUTLS_ENABLED_TRUE;
+    else
+        sc->ocsp_auto_refresh = GNUTLS_ENABLED_FALSE;
 
     return NULL;
@@ -929 +946 @@
 
 
-/** The maximum random fuzz interval that will not overflow. The
- * permitted values are limited to whatever will not make an
- * `apr_interval_time_t` variable overflow when multiplied with
- * `APR_UINT16_MAX`. With apr_interval_time_t being a 64 bit signed
- * integer the maximum fuzz interval is about 4.5 years, which should
- * be more than plenty. */
-#define MAX_FUZZ_TIME (APR_INT64_MAX / APR_UINT16_MAX)
+/** The maximum random fuzz base (half the maximum fuzz) that will not
+ * overflow. The permitted values are limited to whatever will not
+ * make an `apr_interval_time_t` variable overflow when multiplied
+ * with `APR_UINT16_MAX`. With apr_interval_time_t being a 64 bit
+ * signed integer the maximum fuzz interval is about 4.5 years, which
+ * should be more than plenty. */
+#define MAX_FUZZ_BASE (APR_INT64_MAX / APR_UINT16_MAX)
 
 /**
@@ -972 +989 @@
     apr_status_t rv = mgs_cache_ocsp_response(server, &expiry);
 
-    /* TODO: Make maximum fuzz time configurable and compare to
-     * allowed maximum during config */
-    ap_log_error(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, server,
-                 "%s: Maximum fuzz time without overflow: %" APR_INT64_T_FMT
-                 " seconds",
-                 __func__, apr_time_sec(MAX_FUZZ_TIME));
-
     apr_interval_time_t next_interval;
     if (rv != APR_SUCCESS)
@@ -998 +1008 @@
         }
 
-        /* Base fuzz is half the maximum (sc->ocsp_cache_time / 8 at
-         * the moment). The actual fuzz is between the maximum and
-         * half that. */
-        apr_interval_time_t base_fuzz = sc->ocsp_cache_time / 16;
-        apr_interval_time_t fuzz =
-            base_fuzz + base_fuzz * random_bytes / APR_UINT16_MAX;
+        /* Choose the fuzz interval for the next update between
+         * `sc->ocsp_fuzz_time` and twice that. */
+        apr_interval_time_t fuzz = sc->ocsp_fuzz_time
+            + (sc->ocsp_fuzz_time * random_bytes / APR_UINT16_MAX);
 
         /* With an extremly short timeout or weird nextUpdate value
@@ -1096 +1104 @@
 
     /* set default values for unset parameters */
+    if (sc->ocsp_auto_refresh == GNUTLS_ENABLED_UNSET)
+        sc->ocsp_auto_refresh = GNUTLS_ENABLED_TRUE;
     if (sc->ocsp_check_nonce == GNUTLS_ENABLED_UNSET)
         sc->ocsp_check_nonce = GNUTLS_ENABLED_TRUE;
@@ -1104 +1114 @@
     if (sc->ocsp_socket_timeout == MGS_TIMEOUT_UNSET)
         sc->ocsp_socket_timeout = apr_time_from_sec(MGS_OCSP_SOCKET_TIMEOUT);
+    /* Base fuzz is half the configured maximum, the actual fuzz is
+     * between the maximum and half that. The default maximum is
+     * sc->ocsp_cache_time / 8, or twice the failure timeout,
+     * whichever is larger (so the default guarantees at least one
+     * retry before the cache entry expires).*/
+    if (sc->ocsp_fuzz_time == MGS_TIMEOUT_UNSET)
+    {
+        sc->ocsp_fuzz_time = sc->ocsp_cache_time / 16;
+        if (sc->ocsp_fuzz_time < sc->ocsp_failure_timeout)
+            sc->ocsp_fuzz_time = sc->ocsp_failure_timeout;
+    }
+    else
+        sc->ocsp_fuzz_time = sc->ocsp_fuzz_time / 2;
+
+    /* This really shouldn't happen considering MAX_FUZZ_BASE is about
+     * 4.5 years, but better safe than sorry. */
+    if (sc->ocsp_fuzz_time > MAX_FUZZ_BASE)
+    {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, APR_EINVAL, server,
+                     "%s: Maximum fuzz time is too large, maximum "
+                     "supported value is %" APR_INT64_T_FMT " seconds",
+                     __func__, apr_time_sec(MAX_FUZZ_BASE) * 2);
+        return HTTP_INTERNAL_SERVER_ERROR;
+    }
 
     sc->ocsp = apr_palloc(pconf, sizeof(struct mgs_ocsp_data));
@@ -1150 +1184 @@
     /* The watchdog structure may be NULL if mod_watchdog is
      * unavailable. */
-    if (sc->singleton_wd != NULL)
+    if (sc->singleton_wd != NULL
+        && sc->ocsp_auto_refresh == GNUTLS_ENABLED_TRUE)
     {
         apr_status_t rv =