Changeset 87d7f89 in mod_gnutls for src

Timestamp:

Apr 4, 2020, 1:07:28 PM (10 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, master, proxy-ticket

Children:

ee35a9f

Parents:

e932ba5

Message:

Send OCSP nonce only if GnuTLSOCSPCheckNonce is enabled

File:

• src/gnutls_ocsp.c (modified) (2 diffs)

src/gnutls_ocsp.c

@@ -213 +213 @@
     }
 
-    ret = gnutls_ocsp_req_randomize_nonce(r);
-    if (ret != GNUTLS_E_SUCCESS)
-    {
-        ap_log_error(APLOG_MARK, APLOG_ERR, APR_EGENERAL, s,
-                     "OCSP nonce creation failed: %s (%d)",
-                     gnutls_strerror(ret), ret);
-        gnutls_ocsp_req_deinit(r);
-        return ret;
-    }
-
     if (nonce != NULL)
     {
+        ret = gnutls_ocsp_req_randomize_nonce(r);
+        if (ret != GNUTLS_E_SUCCESS)
+        {
+            ap_log_error(APLOG_MARK, APLOG_ERR, APR_EGENERAL, s,
+                         "OCSP nonce creation failed: %s (%d)",
+                         gnutls_strerror(ret), ret);
+            gnutls_ocsp_req_deinit(r);
+            return ret;
+        }
+
         ret = gnutls_ocsp_req_get_nonce(r, NULL, nonce);
         if (ret != GNUTLS_E_SUCCESS)
@@ -706 +706 @@
     {
         gnutls_datum_t req;
-        int ret = mgs_create_ocsp_request(s, req_data, &req, &nonce);
+        int ret = mgs_create_ocsp_request(s, req_data, &req,
+                                          sc->ocsp_check_nonce ? &nonce : NULL);
         if (ret == GNUTLS_E_SUCCESS)
         {