Changeset 70a1e5a in mod_gnutls for src

Timestamp:

Jun 9, 2016, 5:08:30 PM (5 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, master, proxy-ticket, upstream

Children:

3e22b82

Parents:

f450ac9

Message:

Introduce OCSP caching grace time

A cached OCSP response must be updated before it expires, or time skew
might cause a client to receive a response it considers expired. In
some corner cases even network transmission delay might have the same
effect. To prevent this problem let the response cache entry expire a
configurable grace time before the response does, so a fresh response
will be fetched.

Location:

src

Files:

• gnutls_config.c (modified) (4 diffs)
• gnutls_ocsp.c (modified) (1 diff)
• mod_gnutls.c (modified) (2 diffs)

src/gnutls_config.c

@@ -24 +24 @@
 
 #define INIT_CA_SIZE 128
+/* Default OCSP response grace time in seconds */
+#define MGS_GRACE_TIME 60
 
 #ifdef APLOG_USE_MODULE
@@ -727 +729 @@
 }
 
-const char *mgs_set_cache_timeout(cmd_parms * parms, void *dummy __attribute__((unused)),
-        const char *arg) {
-    int argint;
+const char *mgs_set_timeout(cmd_parms * parms,
+                            void *dummy __attribute__((unused)),
+                            const char *arg)
+{
     const char *err;
-    mgs_srvconf_rec *sc =
-        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
-                                                 module_config,
-                                                 &gnutls_module);
-
-    if ((err = ap_check_cmd_context(parms, GLOBAL_ONLY))) {
-        return err;
-    }
-
-    argint = atoi(arg);
-
-    if (argint < 0) {
-        return "GnuTLSCacheTimeout: Invalid argument";
-    } else if (argint == 0) {
-        sc->cache_timeout = 0;
-    } else {
-        sc->cache_timeout = apr_time_from_sec(argint);
-    }
+    if ((err = ap_check_cmd_context(parms, GLOBAL_ONLY)))
+        return err;
+
+    apr_int64_t argint = apr_atoi64(arg);
+    if (argint < 0)
+        return apr_psprintf(parms->pool, "%s: Invalid argument",
+                            parms->directive->directive);
+
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+        ap_get_module_config(parms->server->module_config, &gnutls_module);
+
+    if (!apr_strnatcasecmp(parms->directive->directive, "GnuTLSCacheTimeout"))
+        sc->cache_timeout = apr_time_from_sec(argint);
+    else if (!apr_strnatcasecmp(parms->directive->directive,
+                                "GnuTLSOCSPGraceTime"))
+        sc->ocsp_grace_time = apr_time_from_sec(argint);
+    else
+        /* Can't happen unless there's a serious bug in mod_gnutls or Apache */
+        return apr_psprintf(parms->pool,
+                            "mod_gnutls: %s called for invalid option '%s'",
+                            __func__, parms->directive->directive);
 
     return NULL;
@@ -976 +982 @@
     sc->ocsp_uri = NULL;
     sc->ocsp_trust = NULL;
+    sc->ocsp_grace_time = apr_time_from_sec(MGS_GRACE_TIME);
 
 /* this relies on GnuTLS never changing the gnutls_certificate_request_t enum to define -1 */
@@ -1036 +1043 @@
     gnutls_srvconf_assign(ocsp_uri);
     gnutls_srvconf_assign(ocsp_trust);
+    gnutls_srvconf_merge(ocsp_grace_time, apr_time_from_sec(MGS_GRACE_TIME));
 
     /* FIXME: the following items are pre-allocated, and should be

src/gnutls_ocsp.c

@@ -396 +396 @@
     if (expiry == 0)
         expiry = apr_time_now() + sc->cache_timeout;
-
-    /* TODO: configurable refresh independent of expiration */
+    /* Apply grace time otherwise. */
+    else
+        expiry -= sc->ocsp_grace_time;
+
     int r = dbm_cache_store(s, fingerprint, resp, expiry);
     /* destroy pool, and original copy of the OCSP response with it */

src/mod_gnutls.c

@@ -226 +226 @@
     "TLS Server SRP Parameters file"),
 #endif
-    AP_INIT_TAKE1("GnuTLSCacheTimeout", mgs_set_cache_timeout,
+    AP_INIT_TAKE1("GnuTLSCacheTimeout", mgs_set_timeout,
     NULL,
     RSRC_CONF,
@@ -276 +276 @@
     RSRC_CONF,
     "EXPERIMENTAL: OCSP response for stapling (must be updated externally)"),
+    AP_INIT_TAKE1("GnuTLSOCSPGraceTime", mgs_set_timeout,
+    NULL,
+    RSRC_CONF,
+    "EXPERIMENTAL: Replace cached OCSP responses this many seconds before "
+    "they expire"),
     { NULL },
 };