Changeset 2a1ffd6 in mod_gnutls for src/gnutls_ocsp.c

Timestamp:

May 31, 2016, 1:12:53 PM (4 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

64856fd

Parents:

d35b98e

Message:

Move trust list generation for OCSP to a separate function

The new function is supposed be used during server configuration
later, instead of recreating the trust list every time an OCSP
response is checked.

File:

• src/gnutls_ocsp.c (modified) (4 diffs)

src/gnutls_ocsp.c

@@ -86 +86 @@
         return GNUTLS_E_NO_CERTIFICATE_FOUND;
     }
-    gnutls_x509_trust_list_t issuer;
-    int ret = gnutls_x509_trust_list_init(&issuer, 1);
-    if (ret != GNUTLS_E_SUCCESS)
-    {
-        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
-                      "Could not create issuer trust list: %s (%d)",
-                      gnutls_strerror(ret), ret);
-        goto trust_cleanup;
-    }
+
     /* Only the direct issuer may sign the OCSP response or an OCSP
      * signer. Assuming the certificate file is properly ordered, it
      * should be the one directly after the server's. */
-    ret = gnutls_x509_trust_list_add_cas(issuer,
+    gnutls_x509_trust_list_t issuer;
+    int ret = mgs_create_ocsp_trust_list(&issuer,
                                          &(ctxt->sc->certs_x509_crt_chain[1]),
-                                         1, 0);
-    if (ret != 1)
-    {
-        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
-                      "Could not populate issuer trust list.");
-        ret = GNUTLS_E_CERTIFICATE_ERROR;
-        goto trust_cleanup;
+                                         1);
+    if (ret != GNUTLS_E_SUCCESS)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
+                      "Could not create issuer trust list: %s (%d)",
+                      gnutls_strerror(ret), ret);
+        return ret;
     }
 
@@ -205 +198 @@
             ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
                           "OCSP response has expired at %s!", date_str);
+            /* Do not send a stale response */
             ret = GNUTLS_E_OCSP_RESPONSE_ERROR;
             goto resp_cleanup;
@@ -229 +223 @@
  resp_cleanup:
     gnutls_ocsp_resp_deinit(resp);
- trust_cleanup:
     /* deinit trust list, but not the certificates */
     gnutls_x509_trust_list_deinit(issuer, 0);
@@ -265 +258 @@
     return GNUTLS_E_NO_CERTIFICATE_STATUS;
 }
+
+
+
+int mgs_create_ocsp_trust_list(gnutls_x509_trust_list_t *tl,
+                               const gnutls_x509_crt_t *chain,
+                               const int num)
+{
+    int added = 0;
+    int ret = gnutls_x509_trust_list_init(tl, num);
+
+    if (ret == GNUTLS_E_SUCCESS)
+        added = gnutls_x509_trust_list_add_cas(*tl, chain, num, 0);
+
+    if (added != num)
+        ret = GNUTLS_E_CERTIFICATE_ERROR;
+
+    /* Clean up trust list in case of error */
+    if (ret != GNUTLS_E_SUCCESS)
+        gnutls_x509_trust_list_deinit(*tl, 0);
+
+    return ret;
+}