Changeset 75f2d96 in mod_gnutls

Timestamp:

Jan 11, 2020, 10:45:00 AM (7 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

master, proxy-ticket

Children:

06dcf89

Parents:

e798149

Message:

check_ocsp_response: Require explicit struct mgs_ocsp_data

The response is verified based on the passed request data, making it
possible to check responses for more than one certificate per virtual
host.

File:

• src/gnutls_ocsp.c (modified) (5 diffs)

src/gnutls_ocsp.c

@@ -266 +266 @@
  * If nonce is not NULL, the response must contain a matching nonce.
  */
-int check_ocsp_response(server_rec *s, const gnutls_datum_t *ocsp_response,
+int check_ocsp_response(server_rec *s, struct mgs_ocsp_data *req_data,
+                        const gnutls_datum_t *ocsp_response,
                         apr_time_t* expiry, const gnutls_datum_t *nonce)
-    __attribute__((nonnull(1, 2)));
-int check_ocsp_response(server_rec *s, const gnutls_datum_t *ocsp_response,
+    __attribute__((nonnull(1, 3)));
+int check_ocsp_response(server_rec *s, struct mgs_ocsp_data *req_data,
+                        const gnutls_datum_t *ocsp_response,
                         apr_time_t* expiry, const gnutls_datum_t *nonce)
 {
@@ -275 +277 @@
         ap_get_module_config(s->module_config, &gnutls_module);
 
-    if (sc->ocsp->trust == NULL)
+    if (req_data->trust == NULL)
     {
         ap_log_error(APLOG_MARK, APLOG_ERR, APR_EGENERAL, s,
@@ -301 +303 @@
     }
 
-    ret = gnutls_ocsp_resp_check_crt(resp, 0, sc->certs_x509_crt_chain[0]);
+    ret = gnutls_ocsp_resp_check_crt(resp, 0, req_data->cert);
     if (ret != GNUTLS_E_SUCCESS)
     {
@@ -311 +313 @@
 
     unsigned int verify;
-    ret = gnutls_ocsp_resp_verify(resp, *(sc->ocsp->trust), &verify, 0);
+    ret = gnutls_ocsp_resp_verify(resp, *(req_data->trust), &verify, 0);
     if (ret != GNUTLS_E_SUCCESS)
     {
@@ -718 +720 @@
 
     apr_time_t next_update;
-    if (check_ocsp_response(s, &resp, &next_update, nonce.size ? &nonce : NULL)
+    if (check_ocsp_response(s, sc->ocsp, &resp, &next_update,
+                            nonce.size ? &nonce : NULL)
         != GNUTLS_E_SUCCESS)
     {