Changeset 368e581 in mod_gnutls

Timestamp:

Jun 5, 2016, 3:42:32 PM (3 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

08817d0

Parents:

4bf4ce2

git-author:

Thomas Klute <thomas2.klute@…> (06/05/16 09:53:50)

git-committer:

Thomas Klute <thomas2.klute@…> (06/05/16 15:42:32)

Message:

Update OCSP response cache only if response is missing or invalid

"Invalid" includes expiration, so responses that contain a nextUpdate
field will be updated after that time has passed even if their cache
lifetime has not yet expired, or cache objects haven't been expired
since.

File:

• src/gnutls_ocsp.c (modified) (3 diffs)

src/gnutls_ocsp.c

@@ -295 +295 @@
     }
 
-    /* TODO: make cache lifetime configurable */
+    /* TODO: make cache lifetime configurable, make sure expiration
+     * happens without storing new data */
     int r = dbm_cache_store(s, fingerprint,
                             resp, apr_time_now() + apr_time_from_sec(120));
@@ -317 +318 @@
     mgs_handle_t *ctxt = (mgs_handle_t *) ptr;
 
-    apr_status_t rv = mgs_cache_ocsp_response(ctxt->c->base_server);
-    if (rv != APR_SUCCESS)
-    {
-        ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, ctxt->c,
-                      "Updating OCSP response cache failed");
-        return GNUTLS_E_NO_CERTIFICATE_STATUS;
-    }
-
     gnutls_datum_t fingerprint =
         mgs_get_cert_fingerprint(ctxt->c->pool,
@@ -343 +336 @@
             return GNUTLS_E_SUCCESS;
     }
+    /* get rid of invalid response (if any) */
+    gnutls_free(ocsp_response->data);
+
+    /* If the cache had no response or an invalid one, try to update. */
+    ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, ctxt->c,
+                  "No valid OCSP response in cache, trying to update.");
+    apr_status_t rv = mgs_cache_ocsp_response(ctxt->c->base_server);
+    if (rv != APR_SUCCESS)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, ctxt->c,
+                      "Updating OCSP response cache failed");
+        goto fail_cleanup;
+    }
+
+    /* retry reading from cache */
+    *ocsp_response = dbm_cache_fetch(ctxt, fingerprint);
+    if (ocsp_response->size == 0)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
+                      "Fetching OCSP response from cache failed on retry.");
+    }
+    else
+    {
+        /* Succeed if response is present and valid. */
+        if (check_ocsp_response(ctxt, ocsp_response) == GNUTLS_E_SUCCESS)
+            return GNUTLS_E_SUCCESS;
+    }
 
     /* failure, clean up response data */
+ fail_cleanup:
     gnutls_free(ocsp_response->data);
     ocsp_response->size = 0;