Changeset 5559aa6 in mod_gnutls for src

Timestamp:

Jun 10, 2016, 7:39:34 PM (6 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, master, proxy-ticket, upstream

Children:

6b89353

Parents:

11e6205

Message:

Rely on cache for OCSP response expiration

With fixed DBM cache expiry, memcache support, and OCSP grace time we
should be able to rely on cache expiration instead of parsing the DER
response on every session start just to get the expiration time.

File:

• src/gnutls_ocsp.c (modified) (6 diffs)

src/gnutls_ocsp.c

@@ -76 +76 @@
 
 /**
- * Check if the time specified in the nextUpdate field (if any) of the
- * given OCSP response has passed. Returns GNUTLS_E_SUCCESS if it has
- * not (so the response is still valid), or there is no such field.
- *
- * Note that this function does not do a signature check, it is meant
- * to operate on cached responses that have been verified before.
- */
-static int check_ocsp_response_expiry(mgs_handle_t *ctxt,
-                                      const gnutls_datum_t *ocsp_response)
-{
-    gnutls_ocsp_resp_t resp;
-    int ret = gnutls_ocsp_resp_init(&resp);
-    if (ret != GNUTLS_E_SUCCESS)
-    {
-        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
-                      "Could not initialize OCSP response structure: "
-                      "%s (%d)", gnutls_strerror(ret), ret);
-        goto resp_cleanup;
-    }
-    ret = gnutls_ocsp_resp_import(resp, ocsp_response);
-    if (ret != GNUTLS_E_SUCCESS)
-    {
-        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
-                      "Importing OCSP response failed: %s (%d)",
-                      gnutls_strerror(ret), ret);
-        goto resp_cleanup;
-    }
-    time_t next_update;
-    ret = gnutls_ocsp_resp_get_single(resp, 0, NULL, NULL, NULL, NULL, NULL,
-                                      NULL, &next_update, NULL, NULL);
-    if (ret != GNUTLS_E_SUCCESS)
-    {
-        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
-                      "Could not get OCSP response data: %s (%d)",
-                      gnutls_strerror(ret), ret);
-        goto resp_cleanup;
-    }
-
-    if (next_update == (time_t) -1)
-    {
-        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, ctxt->c,
-                      "OSCP response does not contain nextUpdate info.");
-    }
-    else
-    {
-        apr_time_t now = apr_time_now();
-        apr_time_t valid_to;
-        apr_time_ansi_put(&valid_to, next_update);
-        if (now > valid_to)
-        {
-            char date_str[APR_RFC822_DATE_LEN];
-            apr_rfc822_date(date_str, valid_to);
-            ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, ctxt->c,
-                          "OCSP response has expired at %s.", date_str);
-            ret = GNUTLS_E_OCSP_RESPONSE_ERROR;
-            goto resp_cleanup;
-        }
-    }
- resp_cleanup:
-    gnutls_ocsp_resp_deinit(resp);
-    return ret;
-}
-
-
-
-/**
  * Check if the provided OCSP response is usable for stapling in
  * connections to this server. Returns GNUTLS_E_SUCCESS if yes.
@@ -148 +82 @@
  *
  * If expiry is not NULL, it will be set to the nextUpdate time
- * contained in the response, or zero the response does not contain a
- * nextUpdate field.
+ * contained in the response, or zero if the response does not contain
+ * a nextUpdate field.
  */
 int check_ocsp_response(server_rec *s, const gnutls_datum_t *ocsp_response,
@@ -319 +253 @@
 
 
-/* TODO: response should be fetched from sc->ocsp_uri */
+/* TODO: fetch response from sc->ocsp_uri */
 apr_status_t mgs_cache_ocsp_response(server_rec *s)
 {
@@ -439 +373 @@
     else
     {
-        if (check_ocsp_response_expiry(ctxt, ocsp_response)
-            == GNUTLS_E_SUCCESS)
-            return GNUTLS_E_SUCCESS;
+        return GNUTLS_E_SUCCESS;
     }
     /* get rid of invalid response (if any) */
@@ -461 +393 @@
          * Apache Mutex directive. */
         *ocsp_response = ctxt->sc->cache->fetch(ctxt, fingerprint);
-        if (ocsp_response->size > 0
-            && check_ocsp_response_expiry(ctxt, ocsp_response)
-            == GNUTLS_E_SUCCESS)
+        if (ocsp_response->size > 0)
         {
             /* Got a valid response now, unlock mutex and return. */
@@ -495 +425 @@
     else
     {
-        /* Succeed if response is present and valid. */
-        if (check_ocsp_response_expiry(ctxt, ocsp_response)
-            == GNUTLS_E_SUCCESS)
-            return GNUTLS_E_SUCCESS;
+        return GNUTLS_E_SUCCESS;
     }