Changeset 94cb972 in mod_gnutls for src

Timestamp:

May 29, 2016, 6:06:59 PM (5 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, master, proxy-ticket, upstream

Children:

20f8e99

Parents:

b674e95

Message:

Minimal OCSP stapling implementation using externally provided response

Works if the configured file contains a valid and current OCSP
response. Note that the module does not yet check those conditions,
the file is just read and forwarded to GnuTLS.

Location:

src

Files:

• Makefile.am (modified) (1 diff)
• gnutls_config.c (modified) (2 diffs)
• gnutls_hooks.c (modified) (2 diffs)
• gnutls_ocsp.c (added)
• gnutls_ocsp.h (added)
• mod_gnutls.c (modified) (2 diffs)

src/Makefile.am

@@ -6 +6 @@
 endif
 
-mod_gnutls_la_SOURCES = mod_gnutls.c gnutls_io.c gnutls_cache.c gnutls_config.c gnutls_hooks.c
+mod_gnutls_la_SOURCES = mod_gnutls.c gnutls_io.c gnutls_cache.c \
+        gnutls_config.c gnutls_hooks.c gnutls_ocsp.c
 mod_gnutls_la_CFLAGS = -Wall ${MODULE_CFLAGS}
 mod_gnutls_la_LDFLAGS = -module -avoid-version ${MODULE_LIBS}
+noinst_HEADERS = gnutls_ocsp.h
 
 apmodpkglib_LTLIBRARIES = mod_gnutls.la

src/gnutls_config.c

@@ -972 +972 @@
     sc->proxy_priorities = NULL;
 
+    sc->ocsp_response_file = NULL;
+
 /* this relies on GnuTLS never changing the gnutls_certificate_request_t enum to define -1 */
     sc->client_verify_mode = -1;
@@ -1027 +1029 @@
     gnutls_srvconf_merge(proxy_priorities_str, NULL);
     gnutls_srvconf_merge(proxy_priorities, NULL);
+
+    gnutls_srvconf_merge(ocsp_response_file, NULL);
 
     /* FIXME: the following items are pre-allocated, and should be

src/gnutls_hooks.c

@@ -21 +21 @@
 
 #include "mod_gnutls.h"
+#include "gnutls_ocsp.h"
 #include "http_vhost.h"
 #include "ap_mpm.h"
@@ -156 +157 @@
     /* Set Anon credentials */
     gnutls_credentials_set(session, GNUTLS_CRD_ANON, ctxt->sc->anon_creds);
+
+    if (ctxt->sc->ocsp_response_file != NULL)
+    {
+        gnutls_certificate_set_ocsp_status_request_function(ctxt->sc->certs,
+                                                            mgs_get_ocsp_response,
+                                                            ctxt);
+    }
 
 #ifdef ENABLE_SRP

src/mod_gnutls.c

@@ -20 +20 @@
 
 #include "mod_gnutls.h"
+#include "gnutls_ocsp.h"
 
 #ifdef APLOG_USE_MODULE
@@ -275 +276 @@
     "The priorities to enable for proxy connections (ciphers, key exchange, "
     "MACs, compression)."),
+    AP_INIT_TAKE1("GnuTLSOCSPResponseFile", mgs_store_ocsp_response_path,
+    NULL,
+    RSRC_CONF,
+    "EXPERIMENTAL: OCSP response for stapling (must be updated externally)"),
     { NULL },
 };