Changeset bdd10be in mod_gnutls

Timestamp:

Jan 11, 2020, 10:40:01 AM (3 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, main, master, proxy-ticket

Children:

e798149

Parents:

a8374f7

git-author:

Fiona Klute <fiona.klute@…> (01/11/20 10:24:59)

git-committer:

Fiona Klute <fiona.klute@…> (01/11/20 10:40:01)

Message:

mgs_create_ocsp_request: Require explicit struct mgs_ocsp_data

This means the OCSP request gets built from the passed data, instead
of assuming the request will be for the server certificate.

File:

• src/gnutls_ocsp.c (modified) (3 diffs)

src/gnutls_ocsp.c

@@ -150 +150 @@
  * if not NULL).
  *
- * Returns GNUTLS_E_SUCCESS, or a GnuTLS error code.
+ * @param s server reference for logging
+ *
+ * @return GNUTLS_E_SUCCESS, or a GnuTLS error code.
  */
-static int mgs_create_ocsp_request(server_rec *s, gnutls_datum_t *req,
-                            gnutls_datum_t *nonce)
-    __attribute__((nonnull(1, 2)));
-static int mgs_create_ocsp_request(server_rec *s, gnutls_datum_t *req,
-                            gnutls_datum_t *nonce)
-{
-    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
-        ap_get_module_config(s->module_config, &gnutls_module);
-
+static int mgs_create_ocsp_request(server_rec *s,
+                                   struct mgs_ocsp_data *req_data,
+                                   gnutls_datum_t *req,
+                                   gnutls_datum_t *nonce)
+    __attribute__((nonnull(1, 3)));
+static int mgs_create_ocsp_request(server_rec *s,
+                                   struct mgs_ocsp_data *req_data,
+                                   gnutls_datum_t *req,
+                                   gnutls_datum_t *nonce)
+{
     gnutls_ocsp_req_t r;
     int ret = gnutls_ocsp_req_init(&r);
@@ -171 +174 @@
     }
 
+    /* issuer is set to a reference, so musn't be cleaned up */
+    gnutls_x509_crt_t issuer;
+    ret = gnutls_x509_trust_list_get_issuer(*req_data->trust, req_data->cert,
+                                            &issuer, 0);
+    if (ret != GNUTLS_E_SUCCESS)
+    {
+        ap_log_error(APLOG_MARK, APLOG_ERR, APR_EGENERAL, s,
+                     "Could not get issuer from trust list: %s (%d)",
+                     gnutls_strerror(ret), ret);
+        gnutls_ocsp_req_deinit(r);
+        return ret;
+    }
+
     /* GnuTLS doc says that the digest is "normally"
      * GNUTLS_DIG_SHA1. */
     ret = gnutls_ocsp_req_add_cert(r, GNUTLS_DIG_SHA256,
-                                   sc->certs_x509_crt_chain[1],
-                                   sc->certs_x509_crt_chain[0]);
+                                   issuer, req_data->cert);
 
     if (ret != GNUTLS_E_SUCCESS)
@@ -673 +688 @@
     {
         gnutls_datum_t req;
-        int ret = mgs_create_ocsp_request(s, &req, &nonce);
+        int ret = mgs_create_ocsp_request(s, sc->ocsp, &req, &nonce);
         if (ret == GNUTLS_E_SUCCESS)
         {