Changeset a372379 in mod_gnutls

Timestamp:

Jun 10, 2016, 8:26:50 PM (6 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, master, proxy-ticket, upstream

Children:

6c44ed2

Parents:

cc74801e

Message:

Store server certificate fingerprint in OCSP config

It's not like it's going to change without a server reload, so just
calculate the fingerprint once instead of for every connection that
uses OCSP stapling.

Location:

src

Files:

• gnutls_ocsp.c (modified) (6 diffs)
• gnutls_ocsp.h (modified) (1 diff)

src/gnutls_ocsp.c

@@ -275 +275 @@
     }
 
-    /* the fingerprint will be used as cache key */
-    gnutls_datum_t fingerprint =
-        mgs_get_cert_fingerprint(tmp, sc->certs_x509_crt_chain[0]);
-    if (fingerprint.data == NULL)
-        return APR_EINVAL;
-
     ap_log_error(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, s,
                  "Loading OCSP response from %s",
@@ -334 +328 @@
         expiry -= sc->ocsp_grace_time;
 
-    int r = sc->cache->store(s, fingerprint, resp, expiry);
+    int r = sc->cache->store(s, sc->ocsp->fingerprint, resp, expiry);
     /* destroy pool, and original copy of the OCSP response with it */
     apr_pool_destroy(tmp);
@@ -359 +353 @@
     }
 
-    gnutls_datum_t fingerprint =
-        mgs_get_cert_fingerprint(ctxt->c->pool,
-                                 ctxt->sc->certs_x509_crt_chain[0]);
-    if (fingerprint.data == NULL)
-        return GNUTLS_E_NO_CERTIFICATE_STATUS;
-
-    *ocsp_response = ctxt->sc->cache->fetch(ctxt, fingerprint);
+    *ocsp_response = ctxt->sc->cache->fetch(ctxt,
+                                            ctxt->sc->ocsp->fingerprint);
     if (ocsp_response->size == 0)
     {
@@ -392 +381 @@
          * moment there's no good way to integrate that with the
          * Apache Mutex directive. */
-        *ocsp_response = ctxt->sc->cache->fetch(ctxt, fingerprint);
+        *ocsp_response = ctxt->sc->cache->fetch(ctxt,
+                                                ctxt->sc->ocsp->fingerprint);
         if (ocsp_response->size > 0)
         {
@@ -417 +407 @@
 
     /* retry reading from cache */
-    *ocsp_response = ctxt->sc->cache->fetch(ctxt, fingerprint);
+    *ocsp_response = ctxt->sc->cache->fetch(ctxt,
+                                            ctxt->sc->ocsp->fingerprint);
     if (ocsp_response->size == 0)
     {
@@ -534 +525 @@
     sc->ocsp = apr_palloc(pconf, sizeof(struct mgs_ocsp_data));
 
+    sc->ocsp->fingerprint =
+        mgs_get_cert_fingerprint(pconf, sc->certs_x509_crt_chain[0]);
+    if (sc->ocsp->fingerprint.data == NULL)
+        return HTTP_INTERNAL_SERVER_ERROR;
+
     sc->ocsp->uri = mgs_cert_get_ocsp_uri(pconf,
                                           sc->certs_x509_crt_chain[0]);

src/gnutls_ocsp.h

@@ -36 +36 @@
      * certificate. */
     gnutls_x509_trust_list_t *trust;
+    /* Server certificate fingerprint, used as cache key for the OCSP
+     * response */
+    gnutls_datum_t fingerprint;
 };