Changeset e1c094c in mod_gnutls for src/gnutls_ocsp.c

Timestamp:

Nov 14, 2016, 2:12:53 PM (4 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, proxy-ticket, upstream

Children:

9a18e30

Parents:

b26a792

Message:

Replace GnuTLSOCSPGraceTime with GnuTLSOCSPCacheTimeout

Configuring a timeout instead a time relative to the nextUpdate field
of the OCSP response has two main advantages:

• The maximum cache lifetime is independent of any external data. The OCSP response is signed and the CA generally a trusted entity, but its policy is almost always outside the server admin's control and might change.

• The principle is a lot simpler and thus less likely to lead to implementation or configuration errors.

Additionally a static timeout policy should make it easier to
implement asynchronous cache updates for MPMs that support it.

File:

• src/gnutls_ocsp.c (modified) (3 diffs)

src/gnutls_ocsp.c

@@ -663 +663 @@
     }
 
-    apr_time_t expiry;
-    if (check_ocsp_response(s, &resp, &expiry, nonce.size ? &nonce : NULL)
+    apr_time_t next_update;
+    if (check_ocsp_response(s, &resp, &next_update, nonce.size ? &nonce : NULL)
         != GNUTLS_E_SUCCESS)
     {
@@ -676 +676 @@
     gnutls_free(nonce.data);
 
-    /* If expiry is zero, the response does not contain a nextUpdate
-     * field. Use the default cache timeout. */
-    if (expiry == 0)
-        expiry = apr_time_now() + sc->cache_timeout;
-    /* Apply grace time otherwise. */
-    else
-        expiry -= sc->ocsp_grace_time;
+    apr_time_t expiry = apr_time_now() + sc->ocsp_cache_time;
+    /* Make sure that a response is not cached beyond its nextUpdate
+     * time. If the variable next_update is zero, the response does
+     * not contain a nextUpdate field. */
+    if (next_update != 0 && next_update < expiry)
+    {
+        char date_str[APR_RFC822_DATE_LEN];
+        apr_rfc822_date(date_str, next_update);
+        ap_log_error(APLOG_MARK, APLOG_WARNING, APR_EGENERAL, s,
+                     "OCSP response timeout restricted to nextUpdate time %s. "
+                     "Check if GnuTLSOCSPCacheTimeout is appropriate.",
+                     date_str);
+        expiry = next_update;
+    }
 
     int r = sc->cache->store(s, sc->ocsp->fingerprint, resp, expiry);
@@ -924 +931 @@
     if (sc->ocsp_check_nonce == GNUTLS_ENABLED_UNSET)
         sc->ocsp_check_nonce = GNUTLS_ENABLED_TRUE;
-    if (sc->ocsp_grace_time == MGS_TIMEOUT_UNSET)
-        sc->ocsp_grace_time = apr_time_from_sec(MGS_OCSP_GRACE_TIME);
+    if (sc->ocsp_cache_time == MGS_TIMEOUT_UNSET)
+        sc->ocsp_cache_time = apr_time_from_sec(MGS_OCSP_CACHE_TIMEOUT);
     if (sc->ocsp_failure_timeout == MGS_TIMEOUT_UNSET)
         sc->ocsp_failure_timeout = apr_time_from_sec(MGS_OCSP_FAILURE_TIMEOUT);