Changeset b888e8b in mod_gnutls for src/gnutls_config.c

Timestamp:

Nov 1, 2016, 7:20:42 AM (4 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, proxy-ticket, upstream

Children:

b26a792

Parents:

b34a67e

git-author:

Thomas Klute <thomas2.klute@…> (10/31/16 19:42:11)

git-committer:

Thomas Klute <thomas2.klute@…> (11/01/16 07:20:42)

Message:

New directive GnuTLSOCSPCheckNonce

Some CAs refuse to send nonces in their OCSP responses, probably
because that way they can cache responses. This makes nonce
verification fail, so give the user an option disable it.

File:

• src/gnutls_config.c (modified) (2 diffs)

src/gnutls_config.c

@@ -1127 +1127 @@
 
     sc->ocsp_staple = GNUTLS_ENABLED_UNSET;
+    sc->ocsp_check_nonce = GNUTLS_ENABLED_UNSET;
     sc->ocsp_response_file = NULL;
     sc->ocsp_mutex = NULL;
@@ -1190 +1191 @@
 
     gnutls_srvconf_merge(ocsp_staple, GNUTLS_ENABLED_UNSET);
+    gnutls_srvconf_merge(ocsp_check_nonce, GNUTLS_ENABLED_UNSET);
     gnutls_srvconf_assign(ocsp_response_file);
     gnutls_srvconf_merge(ocsp_grace_time, MGS_TIMEOUT_UNSET);