Changeset 4e60dd8 in mod_gnutls for src

Timestamp:

Jan 11, 2020, 12:05:52 PM (3 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, master, proxy-ticket

Children:

08ba205

Parents:

de9b100

Message:

Handle initialization of the OCSP data structure in one place

This will make it easier to loop over the certificate chain for OCSP
multi staple.

File:

• src/gnutls_ocsp.c (modified) (3 diffs)

src/gnutls_ocsp.c

@@ -1152 +1152 @@
 
     ocsp->cert = sc->certs_x509_crt_chain[0];
+
     ocsp->uri = mgs_cert_get_ocsp_uri(pconf, ocsp->cert);
     if (ocsp->uri == NULL && sc->ocsp_response_file == NULL)
         return "No OCSP URI in the certificate nor a GnuTLSOCSPResponseFile "
             "setting, cannot configure OCSP stapling.";
+
+    ocsp->fingerprint =
+        mgs_get_cert_fingerprint(pconf, sc->certs_x509_crt_chain[0]);
+    if (ocsp->fingerprint.data == NULL)
+        return "Could not read fingerprint from certificate!";
+
+    ocsp->trust = apr_palloc(pconf,
+                             sizeof(gnutls_x509_trust_list_t));
+    /* Only the direct issuer may sign the OCSP response or an OCSP
+     * signer. */
+    int ret = mgs_create_ocsp_trust_list(ocsp->trust,
+                                         &(sc->certs_x509_crt_chain[1]),
+                                         1);
+    if (ret != GNUTLS_E_SUCCESS)
+    {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, server,
+                     "Could not create OCSP trust list: %s (%d)",
+                     gnutls_strerror(ret), ret);
+        return "Could not build trust list for OCSP stapling!";
+    }
+    /* deinit trust list when the config pool is destroyed */
+    apr_pool_cleanup_register(pconf, ocsp->trust,
+                              mgs_cleanup_trust_list,
+                              apr_pool_cleanup_null);
 
     sc->ocsp = ocsp;
@@ -1168 +1193 @@
  * to denote an error.
  */
-int mgs_ocsp_enable_stapling(apr_pool_t *pconf,
+int mgs_ocsp_enable_stapling(apr_pool_t *pconf __attribute__((unused)),
                              apr_pool_t *ptemp __attribute__((unused)),
                              server_rec *server)
@@ -1219 +1244 @@
     }
 
-    sc->ocsp->fingerprint =
-        mgs_get_cert_fingerprint(pconf, sc->certs_x509_crt_chain[0]);
-    if (sc->ocsp->fingerprint.data == NULL)
-        return HTTP_INTERNAL_SERVER_ERROR;
-
-    sc->ocsp->trust = apr_palloc(pconf,
-                                 sizeof(gnutls_x509_trust_list_t));
-    /* Only the direct issuer may sign the OCSP response or an OCSP
-     * signer. */
-    int ret = mgs_create_ocsp_trust_list(sc->ocsp->trust,
-                                         &(sc->certs_x509_crt_chain[1]),
-                                         1);
-    if (ret != GNUTLS_E_SUCCESS)
-    {
-        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, server,
-                     "Could not create OCSP trust list: %s (%d)",
-                     gnutls_strerror(ret), ret);
-        return HTTP_INTERNAL_SERVER_ERROR;
-    }
-    /* deinit trust list when the config pool is destroyed */
-    apr_pool_cleanup_register(pconf, sc->ocsp->trust,
-                              mgs_cleanup_trust_list,
-                              apr_pool_cleanup_null);
-
     /* The watchdog structure may be NULL if mod_watchdog is
      * unavailable. */