Changeset e376ed8 in mod_gnutls

Timestamp:

Nov 29, 2019, 4:30:08 PM (3 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, main, master, proxy-ticket

Children:

618ee14

Parents:

d4c9331 (diff), 556783e (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

Message:

Merge branch 'subca'

Files:

• README (modified) (1 diff)
• configure.ac (modified) (2 diffs)
• src/gnutls_cache.c (modified) (7 diffs)
• src/gnutls_cache.h (modified) (1 diff)
• src/gnutls_hooks.c (modified) (9 diffs)
• src/gnutls_ocsp.c (modified) (10 diffs)
• test/Makefile.am (modified) (3 diffs)
• test/authority/subca/ocsp-responder/template (added)
• test/authority/subca/server/template.in (added)
• test/authority/subca/template.in (added)
• test/ocsp_server.conf.in (modified) (2 diffs)
• test/test_ca.mk (modified) (2 diffs)
• test/tests/00_basic/apache.conf (modified) (1 diff)
• test/tests/27_OCSP_server/apache.conf (modified) (1 diff)

README

@@ -22 +22 @@
 -------------
 
- * GnuTLS          >= 3.3 <https://www.gnutls.org/> (3.4 or newer recommended)
+ * GnuTLS          >= 3.6.3 <https://www.gnutls.org/>
  * Apache HTTPD    >= 2.4.17 <https://httpd.apache.org/>
  * autotools, GNU make, & GCC

configure.ac

@@ -46 +46 @@
         ], [])
 
-PKG_CHECK_MODULES([LIBGNUTLS], [gnutls >= 3.3.0])
+PKG_CHECK_MODULES([LIBGNUTLS], [gnutls >= 3.6.3])
 
 LIBGNUTLS_VERSION=`pkg-config --modversion gnutls`
@@ -133 +133 @@
 # openssl is needed as the responder for OCSP tests
 AC_PATH_PROG([OPENSSL], [openssl], [no])
-# OCSP checks with gnutls-cli from GnuTLS versions before 3.3.23,
-# 3.4.12, or 3.5.1 (on the respective 3.x branch) fail if intermediate
-# CAs cannot be status checked, even if there are no intermediate CAs
-# like in the mod_gnutls test suite where end entity certificates are
-# directly issued by a root CA.
-AC_MSG_CHECKING([for gnutls-cli version supporting OCSP for EE under root CA])
-AC_PREPROC_IFELSE(
-        [AC_LANG_SOURCE([[#include "gnutls/gnutls.h"
-                        #if GNUTLS_VERSION_NUMBER < 0x030317
-                        #error
-                        #elif GNUTLS_VERSION_NUMBER >= 0x030400 && GNUTLS_VERSION_NUMBER < 0x03040c
-                        #error
-                        #elif GNUTLS_VERSION_NUMBER == 0x030500
-                        #error
-                        #endif
-                        ]])],
-        [gnutls_ocsp_ok="yes"],
-        [gnutls_ocsp_ok="no"],
-)
-AC_MSG_RESULT([$gnutls_ocsp_ok])
-AM_CONDITIONAL([ENABLE_OCSP_TEST], [test "${OPENSSL}" != "no" && test "${gnutls_ocsp_ok}" = "yes"])
+AM_CONDITIONAL([ENABLE_OCSP_TEST], [test "${OPENSSL}" != "no"])
 
 dnl Enable test namespaces? Default is "yes".

src/gnutls_cache.c

@@ -52 +52 @@
 /** Maximum length of the hex string representation of a GnuTLS
  * session ID: two characters per byte, plus one more for `\0` */
-#if GNUTLS_VERSION_NUMBER >= 0x030400
 #define GNUTLS_SESSION_ID_STRING_LEN ((GNUTLS_MAX_SESSION_ID_SIZE * 2) + 1)
-#else
-#define GNUTLS_SESSION_ID_STRING_LEN ((GNUTLS_MAX_SESSION_ID * 2) + 1)
-#endif
 
 #ifdef APLOG_USE_MODULE
@@ -179 +175 @@
 #define SOCACHE_FETCH_BUF_SIZE (8 * 1024)
 
-gnutls_datum_t mgs_cache_fetch(mgs_cache_t cache, server_rec *server,
-                               gnutls_datum_t key, apr_pool_t *pool)
-{
-    gnutls_datum_t data = {NULL, 0};
-    data.data = gnutls_malloc(SOCACHE_FETCH_BUF_SIZE);
-    if (data.data == NULL)
-        return data;
-    data.size = SOCACHE_FETCH_BUF_SIZE;
-
+apr_status_t mgs_cache_fetch(mgs_cache_t cache, server_rec *server,
+                             gnutls_datum_t key, gnutls_datum_t *output,
+                             apr_pool_t *pool)
+{
     apr_pool_t *spool;
     apr_pool_create(&spool, pool);
@@ -195 +186 @@
     apr_status_t rv = cache->prov->retrieve(cache->socache, server,
                                             key.data, key.size,
-                                            data.data, &data.size,
+                                            output->data, &output->size,
                                             spool);
     if (cache->prov->flags & AP_SOCACHE_FLAG_NOTMPSAFE)
@@ -211 +202 @@
                          "error fetching from cache '%s:%s'",
                          cache->prov->name, cache->config);
+    }
+    else
+    {
+        ap_log_error(APLOG_MARK, APLOG_TRACE1, rv, server,
+                     "fetched %u bytes from cache '%s:%s'",
+                     output->size, cache->prov->name, cache->config);
+    }
+    apr_pool_destroy(spool);
+
+    return rv;
+}
+
+
+
+/**
+ * Fetch function for the GnuTLS session cache, see
+ * gnutls_db_set_retrieve_function().
+ *
+ * *Warning*: The `data` element of the returned `gnutls_datum_t` is
+ * allocated using `gnutls_malloc()` for compatibility with the GnuTLS
+ * session caching API, and must be released using `gnutls_free()`.
+ *
+ * @param baton mgs_handle_t for the connection, as set via
+ * gnutls_db_set_ptr()
+ *
+ * @param key object key to fetch
+ *
+ * @return the requested cache entry, or `{NULL, 0}`
+ */
+static gnutls_datum_t socache_fetch_session(void *baton, gnutls_datum_t key)
+{
+    gnutls_datum_t data = {NULL, 0};
+    gnutls_datum_t dbmkey;
+    mgs_handle_t *ctxt = baton;
+
+    if (mgs_session_id2dbm(ctxt->c, key.data, key.size, &dbmkey) < 0)
+        return data;
+
+    data.data = gnutls_malloc(SOCACHE_FETCH_BUF_SIZE);
+    if (data.data == NULL)
+        return data;
+    data.size = SOCACHE_FETCH_BUF_SIZE;
+
+    apr_status_t rv = mgs_cache_fetch(ctxt->sc->cache, ctxt->c->base_server,
+                                      dbmkey, &data, ctxt->c->pool);
+
+    if (rv != APR_SUCCESS)
+    {
         /* free unused buffer */
         gnutls_free(data.data);
@@ -218 +257 @@
     else
     {
-        ap_log_error(APLOG_MARK, APLOG_TRACE1, rv, server,
-                     "fetched %u bytes from cache '%s:%s'",
-                     data.size, cache->prov->name, cache->config);
-
         /* Realloc buffer to data.size. Data size must be less than or
          * equal to the initial buffer size, so this REALLY should not
@@ -228 +263 @@
         if (__builtin_expect(data.data == NULL, 0))
         {
-            ap_log_error(APLOG_MARK, APLOG_CRIT, APR_ENOMEM, server,
+            ap_log_cerror(APLOG_MARK, APLOG_CRIT, APR_ENOMEM, ctxt->c,
                          "%s: Could not realloc fetch buffer to data size!",
                          __func__);
@@ -234 +269 @@
         }
     }
-    apr_pool_destroy(spool);
 
     return data;
-}
-
-
-
-/**
- * Fetch function for the GnuTLS session cache, see
- * gnutls_db_set_retrieve_function().
- *
- * *Warning*: The `data` element of the returned `gnutls_datum_t` is
- * allocated using `gnutls_malloc()` for compatibility with the GnuTLS
- * session caching API, and must be released using `gnutls_free()`.
- *
- * @param baton mgs_handle_t for the connection, as set via
- * gnutls_db_set_ptr()
- *
- * @param key object key to fetch
- *
- * @return the requested cache entry, or `{NULL, 0}`
- */
-static gnutls_datum_t socache_fetch_session(void *baton, gnutls_datum_t key)
-{
-    gnutls_datum_t data = {NULL, 0};
-    gnutls_datum_t dbmkey;
-    mgs_handle_t *ctxt = baton;
-
-    if (mgs_session_id2dbm(ctxt->c, key.data, key.size, &dbmkey) < 0)
-        return data;
-
-    return mgs_cache_fetch(ctxt->sc->cache, ctxt->c->base_server,
-                           dbmkey, ctxt->c->pool);
 }
 

src/gnutls_cache.h

@@ -139 +139 @@
  * @param key key for the cache entry to be fetched
  *
- * @param pool pool to allocate the response and other temporary
- * memory from
+ * @param output pre-allocated buffer to write to and its size
  *
- * @return the requested cache entry, or `{NULL, 0}`
+ * @param pool pool to allocate temporary memory from
+ *
+ * @return APR status or error value
  */
-gnutls_datum_t mgs_cache_fetch(mgs_cache_t cache, server_rec *server,
-                               gnutls_datum_t key, apr_pool_t *pool);
+apr_status_t mgs_cache_fetch(mgs_cache_t cache, server_rec *server,
+                             gnutls_datum_t key, gnutls_datum_t *output,
+                             apr_pool_t *pool);
 
 /**

src/gnutls_hooks.c

@@ -73 +73 @@
 {
     /* Free session ticket master key */
-#if GNUTLS_VERSION_NUMBER >= 0x030400
     gnutls_memset(session_ticket_key.data, 0, session_ticket_key.size);
-#endif
     gnutls_free(session_ticket_key.data);
     session_ticket_key.data = NULL;
@@ -384 +382 @@
 
 static int cert_retrieve_fn(gnutls_session_t session,
-                            const gnutls_datum_t * req_ca_rdn __attribute__((unused)),
-                            int nreqs __attribute__((unused)),
-                            const gnutls_pk_algorithm_t * pk_algos __attribute__((unused)),
-                            int pk_algos_length __attribute__((unused)),
+                            const struct gnutls_cert_retr_st *info __attribute__((unused)),
                             gnutls_pcert_st **pcerts,
                             unsigned int *pcert_length,
-                            gnutls_privkey_t *privkey)
+                            gnutls_ocsp_data_st **ocsp,
+                            unsigned int *ocsp_length,
+                            gnutls_privkey_t *privkey,
+                            unsigned int *flags)
 {
     _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
@@ -407 +405 @@
         *pcerts = ctxt->sc->certs_x509_chain;
         *pcert_length = ctxt->sc->certs_x509_chain_num;
+        *ocsp = NULL;
+        *ocsp_length = 0;
         *privkey = ctxt->sc->privkey_x509;
+        *flags = 0;
+
+        if (ctxt->sc->ocsp_staple == GNUTLS_ENABLED_TRUE)
+        {
+            gnutls_ocsp_data_st *resp =
+                apr_palloc(ctxt->c->pool, sizeof(gnutls_ocsp_data_st));
+            resp->version = 0;
+            resp->exptime = 0;
+
+            int ret = mgs_get_ocsp_response(session, NULL, &resp->response);
+            if (ret == GNUTLS_E_SUCCESS)
+            {
+                *ocsp = resp;
+                *ocsp_length = 1;
+            }
+        }
+
         return 0;
     } else {
@@ -417 +434 @@
 
 
-#if GNUTLS_VERSION_NUMBER >= 0x030506
-#define HAVE_KNOWN_DH_GROUPS 1
-#endif
-#ifdef HAVE_KNOWN_DH_GROUPS
 /**
  * Try to estimate a GnuTLS security parameter based on the given
@@ -447 +460 @@
     return gnutls_pk_bits_to_sec_param(pk_algo, bits);
 }
-#else
-/** ffdhe2048 DH group as defined in RFC 7919, Appendix A.1. This is
- * the default DH group if mod_gnutls is compiled agains a GnuTLS
- * version that does not provide known DH groups based on security
- * parameters (before 3.5.6). */
-static const char FFDHE2048_PKCS3[] =
-    "-----BEGIN DH PARAMETERS-----\n"
-    "MIIBDAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz\n"
-    "+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a\n"
-    "87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7\n"
-    "YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi\n"
-    "7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD\n"
-    "ssbzSibBsu/6iGtCOGEoXJf//////////wIBAgICAQA=\n"
-    "-----END DH PARAMETERS-----\n";
-const gnutls_datum_t default_dh_params = {
-    (void *) FFDHE2048_PKCS3,
-    sizeof(FFDHE2048_PKCS3)
-};
-#endif
 
 
@@ -485 +479 @@
         ap_get_module_config(server->module_config, &gnutls_module);
 
-#ifdef HAVE_KNOWN_DH_GROUPS
     gnutls_sec_param_t seclevel = GNUTLS_SEC_PARAM_UNKNOWN;
     if (sc->privkey_x509)
@@ -519 +512 @@
         return HTTP_UNAUTHORIZED;
     }
-#else
-    int ret = gnutls_dh_params_init(&sc->dh_params);
-    if (ret < 0)
-    {
-        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, server,
-                     "%s: Failed to initialize DH params structure: "
-                     "%s (%d)", __func__, gnutls_strerror(ret), ret);
-        return HTTP_UNAUTHORIZED;
-    }
-    ret = gnutls_dh_params_import_pkcs3(sc->dh_params, &default_dh_params,
-                                        GNUTLS_X509_FMT_PEM);
-    if (ret < 0)
-    {
-        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, server,
-                     "%s: Failed to import default DH params: %s (%d)",
-                     __func__, gnutls_strerror(ret), ret);
-        return HTTP_UNAUTHORIZED;
-    }
-
-    gnutls_certificate_set_dh_params(sc->certs, sc->dh_params);
-    gnutls_anon_set_server_dh_params(sc->anon_creds, sc->dh_params);
-#endif
 
     return OK;
@@ -731 +702 @@
         }
 
-        /* The call after this comment is a workaround for bug in
-         * gnutls_certificate_set_retrieve_function2 that ignores
-         * supported certificate types. Should be fixed in GnuTLS
-         * 3.3.12.
-         *
-         * Details:
-         * https://lists.gnupg.org/pipermail/gnutls-devel/2015-January/007377.html
-         * Workaround from:
-         * https://github.com/vanrein/tlspool/commit/4938102d3d1b086491d147e6c8e4e2a02825fc12 */
-#if GNUTLS_VERSION_NUMBER < 0x030312
-        gnutls_certificate_set_retrieve_function(sc->certs, (void *) exit);
-#endif
-
-        gnutls_certificate_set_retrieve_function2(sc->certs, cert_retrieve_fn);
+        gnutls_certificate_set_retrieve_function3(sc->certs, cert_retrieve_fn);
 
         if ((sc->certs_x509_chain == NULL || sc->certs_x509_chain_num < 1) &&
@@ -1372 +1330 @@
                                          gnutls_mac_get(ctxt->session)));
 
-#if GNUTLS_VERSION_NUMBER >= 0x030600
     /* Compression support has been removed since GnuTLS 3.6.0 */
     apr_table_setn(env, "SSL_COMPRESS_METHOD", "NULL");
-#else
-    apr_table_setn(env, "SSL_COMPRESS_METHOD",
-            gnutls_compression_get_name(gnutls_compression_get(ctxt->session)));
-#endif
 
 #ifdef ENABLE_SRP

src/gnutls_ocsp.c

@@ -41 +41 @@
 /** Dummy data for failure cache entries (one byte). */
 #define OCSP_FAILURE_CACHE_DATA 0x0f
+/** Macro to check if an OCSP reponse pointer contains a cached
+ * failure */
+#define IS_FAILURE_RESPONSE(resp) \
+    (((resp)->size == sizeof(unsigned char)) &&                     \
+     (*((unsigned char *) (resp)->data) == OCSP_FAILURE_CACHE_DATA))
 
 
@@ -786 +791 @@
     }
 
-    *ocsp_response = mgs_cache_fetch(ctxt->sc->ocsp_cache,
-                                     ctxt->c->base_server,
-                                     ctxt->sc->ocsp->fingerprint,
-                                     ctxt->c->pool);
-    if (ocsp_response->size == 0)
+    // TODO: Large allocation, and the pool system doesn't offer realloc
+    ocsp_response->data = apr_palloc(ctxt->c->pool, OCSP_RESP_SIZE_MAX);
+    ocsp_response->size = OCSP_RESP_SIZE_MAX;
+
+    apr_status_t rv = mgs_cache_fetch(ctxt->sc->ocsp_cache,
+                                      ctxt->c->base_server,
+                                      ctxt->sc->ocsp->fingerprint,
+                                      ocsp_response,
+                                      ctxt->c->pool);
+    if (rv != APR_SUCCESS)
     {
         ap_log_cerror(APLOG_MARK, APLOG_TRACE1, APR_EGENERAL, ctxt->c,
                       "Fetching OCSP response from cache failed.");
     }
-    else if ((ocsp_response->size == sizeof(unsigned char)) &&
-             (*((unsigned char *) ocsp_response->data) == OCSP_FAILURE_CACHE_DATA))
+    else if (IS_FAILURE_RESPONSE(ocsp_response))
     {
         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_EGENERAL, ctxt->c,
@@ -807 +816 @@
         return GNUTLS_E_SUCCESS;
     }
-    /* get rid of invalid response (if any) */
-    gnutls_free(ocsp_response->data);
-    ocsp_response->data = NULL;
+    /* keep response buffer, reset size for reuse */
+    ocsp_response->size = OCSP_RESP_SIZE_MAX;
 
     /* If the cache had no response or an invalid one, try to update. */
@@ -815 +823 @@
                   "No valid OCSP response in cache, trying to update.");
 
-    apr_status_t rv = apr_global_mutex_trylock(sc->ocsp_mutex);
+    rv = apr_global_mutex_trylock(sc->ocsp_mutex);
     if (APR_STATUS_IS_EBUSY(rv))
     {
@@ -824 +832 @@
          * moment there's no good way to integrate that with the
          * Apache Mutex directive. */
-        *ocsp_response = mgs_cache_fetch(ctxt->sc->ocsp_cache,
-                                         ctxt->c->base_server,
-                                         ctxt->sc->ocsp->fingerprint,
-                                         ctxt->c->pool);
-        if (ocsp_response->size > 0)
-        {
-            /* Got a valid response now, unlock mutex and return. */
+        rv = mgs_cache_fetch(ctxt->sc->ocsp_cache,
+                             ctxt->c->base_server,
+                             ctxt->sc->ocsp->fingerprint,
+                             ocsp_response,
+                             ctxt->c->pool);
+        if (rv == APR_SUCCESS)
+        {
             apr_global_mutex_unlock(sc->ocsp_mutex);
-            return GNUTLS_E_SUCCESS;
+            /* Check if the response is valid. */
+            if (IS_FAILURE_RESPONSE(ocsp_response))
+            {
+                ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_EGENERAL, ctxt->c,
+                              "Cached OCSP failure found for %s.",
+                              ctxt->c->base_server->server_hostname);
+                goto fail_cleanup;
+            }
+            else
+                return GNUTLS_E_SUCCESS;
         }
         else
         {
-            gnutls_free(ocsp_response->data);
-            ocsp_response->data = NULL;
+            /* keep response buffer, reset size for reuse */
+            ocsp_response->size = OCSP_RESP_SIZE_MAX;
         }
     }
@@ -855 +872 @@
 
     /* retry reading from cache */
-    *ocsp_response = mgs_cache_fetch(ctxt->sc->ocsp_cache,
-                                     ctxt->c->base_server,
-                                     ctxt->sc->ocsp->fingerprint,
-                                     ctxt->c->pool);
-    if (ocsp_response->size == 0)
+    rv = mgs_cache_fetch(ctxt->sc->ocsp_cache,
+                         ctxt->c->base_server,
+                         ctxt->sc->ocsp->fingerprint,
+                         ocsp_response,
+                         ctxt->c->pool);
+    if (rv != APR_SUCCESS)
     {
         ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
@@ -869 +887 @@
     }
 
-    /* failure, clean up response data */
+    /* failure, reset struct, buffer will be released with the
+     * connection pool */
  fail_cleanup:
-    gnutls_free(ocsp_response->data);
     ocsp_response->size = 0;
     ocsp_response->data = NULL;
@@ -1061 +1079 @@
     if (rv != APR_SUCCESS)
     {
-        const gnutls_datum_t ocsp_response =
-            mgs_cache_fetch(sc->ocsp_cache, server,
-                            sc->ocsp->fingerprint, pool);
-
-        if (ocsp_response.size == 0 ||
-            ((ocsp_response.size == sizeof(unsigned char)) &&
-             (*((unsigned char *) ocsp_response.data) ==
-              OCSP_FAILURE_CACHE_DATA)))
+        gnutls_datum_t ocsp_response;
+        ocsp_response.data = apr_palloc(pool, OCSP_RESP_SIZE_MAX);
+        ocsp_response.size = OCSP_RESP_SIZE_MAX;
+
+        apr_status_t rv = mgs_cache_fetch(sc->ocsp_cache, server,
+                                          sc->ocsp->fingerprint,
+                                          &ocsp_response,
+                                          pool);
+
+        if (rv != APR_SUCCESS || (IS_FAILURE_RESPONSE(&ocsp_response)))
         {
             ap_log_error(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, server,
@@ -1075 +1095 @@
             mgs_cache_ocsp_failure(server, sc->ocsp_failure_timeout * 2);
         }
-
-        /* Get rid of the response, if any */
-        if (ocsp_response.size != 0)
-            gnutls_free(ocsp_response.data);
     }
     apr_global_mutex_unlock(sc->ocsp_mutex);
@@ -1196 +1212 @@
                               apr_pool_cleanup_null);
 
-    /* enable status request callback */
-    gnutls_certificate_set_ocsp_status_request_function(sc->certs,
-                                                        mgs_get_ocsp_response,
-                                                        sc);
-
     /* The watchdog structure may be NULL if mod_watchdog is
      * unavailable. */

test/Makefile.am

@@ -58 +58 @@
 shared_identities = authority authority/client
 pgp_identities = $(shared_identities)
-x509_only_identities = authority/server authority/imposter rogueca \
-        rogueca/rogueclient
-if ENABLE_OCSP_TEST
-x509_only_identities += authority/ocsp-responder
+x509_only_identities = authority/server authority/imposter \
+        authority/subca authority/subca/server \
+        rogueca rogueca/rogueclient
+if ENABLE_OCSP_TEST
+x509_only_identities += authority/ocsp-responder authority/subca/ocsp-responder
 endif
 x509_identities = $(shared_identities) $(x509_only_identities)
@@ -101 +102 @@
         authority/imposter/template.in authority/ocsp-responder/template \
         authority/server/template.in \
+        authority/subca/template.in authority/subca/server/template.in \
+        authority/subca/ocsp-responder/template \
         rogueca/template rogueca/rogueclient/template.in
 generated_templates = authority/template authority/client/template \
@@ -161 +164 @@
 if ENABLE_OCSP_TEST
 # rules to build OCSP database
-check_DATA += authority/ocsp_index.txt
-MOSTLYCLEANFILES += authority/ocsp_index.txt authority/ocsp_index.txt.attr
-authority/ocsp_index.txt: $(x509_tokens) gen_ocsp_index authority/ocsp_index.txt.attr
-        ./gen_ocsp_index authority/server/x509.pem authority/client/x509.pem > $@
-
-authority/ocsp_index.txt.attr: authority/secret.key
+ocsp_index_data = authority/ocsp_index.txt authority/ocsp_index.txt.attr \
+        authority/subca/ocsp_index.txt authority/subca/ocsp_index.txt.attr
+check_DATA += $(ocsp_index_data)
+MOSTLYCLEANFILES += $(ocsp_index_data)
+
+# The "find" command builds a list of all certificates directly below
+# the CA that aren't for the ocsp-responder.
+%/ocsp_index.txt: $(x509_tokens) gen_ocsp_index
+        ./gen_ocsp_index $$(find $(*) -mindepth 2 -maxdepth 2 ! -path '*/ocsp-responder/*' -name x509.pem) > $@
+
+%/ocsp_index.txt.attr:
+        @mkdir -m 0700 -p $(dir $@)
         echo "unique_subject = no" > $@
 
-# build certificate chain file for server
-check_DATA += authority/server/x509-chain.pem
-MOSTLYCLEANFILES += authority/server/x509-chain.pem
-%/x509-chain.pem: %/x509.pem authority/x509.pem
-        cat $< authority/x509.pem > $@
+# Build certificate chain files. Note that intermediate tokens must be
+# listed explicitly, or the dependency chain will be broken because
+# the higher level pattern matches, too.
+chain_tokens = authority/server/x509-chain.pem \
+        authority/subca/x509-chain.pem \
+        authority/subca/server/x509-chain.pem
+check_DATA += $(chain_tokens)
+MOSTLYCLEANFILES += $(chain_tokens) authority/x509-chain.pem
 endif
 

test/ocsp_server.conf.in

@@ -22 +22 @@
         RewriteEngine   On
         RewriteRule     ^/ocsp(.*)      /ocsp.cgi$1     [L]
+        # General rules for all OCSP handling
         <Location /ocsp/>
                 # Some clients seem to have trouble with chunked
                 # encoding, so force HTTP/1.0 for now.
                 SetEnv  downgrade-1.0
+                <If "-n osenv('OPENSSL')">
+                        # Pass OPENSSL variable to CGI script if set
+                        SetEnv  OPENSSL         ${OPENSSL}
+                </If>
+        </Location>
+        <Location /ocsp/authority/>
                 # certificates and key for ocsp.cgi
                 SetEnv  CA_CERT         ${PWD}/authority/x509.pem
@@ -31 +38 @@
                 SetEnv  OCSP_CERT       ${PWD}/authority/ocsp-responder/x509.pem
                 SetEnv  OCSP_KEY        ${PWD}/authority/ocsp-responder/secret.key
-                <If "-n osenv('OPENSSL')">
-                        # Pass OPENSSL variable to CGI script if set
-                        SetEnv  OPENSSL         ${OPENSSL}
-                </If>
+        </Location>
+        <Location /ocsp/authority/subca/>
+                # certificates and key for ocsp.cgi
+                SetEnv  CA_CERT         ${PWD}/authority/subca/x509.pem
+                SetEnv  OCSP_INDEX      ${PWD}/authority/subca/ocsp_index.txt
+                SetEnv  OCSP_CERT       ${PWD}/authority/subca/ocsp-responder/x509.pem
+                SetEnv  OCSP_KEY        ${PWD}/authority/subca/ocsp-responder/secret.key
         </Location>
         <Directory ${srcdir}/data>

test/test_ca.mk

@@ -10 +10 @@
         @mkdir -m 0700 -p $(@D)
         sed s/__HOSTNAME__/$(TEST_HOST)/ < $< > $@
-        sed -i -e "s,__OCSP_URI__,$(OCSP_URI_TEMPLATE)," $@
+        sed -i -e "s,__OCSP_URI__,$(OCSP_URI_TEMPLATE)$(dir $(*))," $@
         for i in $(patsubst [%],%,$(TEST_IP)); do \
                 IP_ADDRS="$${IP_ADDRS}\nip_address = $${i}"; \
@@ -58 +58 @@
 # special rule for root CAs
 root_cert_rule = certtool --outfile $@ --generate-self-signed --load-privkey $(dir $@)secret.key --template $<
+root_chain_rule = cp $< $@
 authority/x509.pem rogueca/x509.pem: %/x509.pem: %/template %/secret.key
         $(root_cert_rule)
+authority/x509-chain.pem rogueca/x509-chain.pem: %/x509-chain.pem: %/x509.pem
+        $(root_chain_rule)
 
 # generic rule for building non-root certificates, with the CA in the
 # parent directory
 cert_rule = certtool --outfile $@ --generate-certificate --load-ca-certificate $(dir $@)../x509.pem --load-ca-privkey $(dir $@)../secret.key --load-privkey $(dir $@)secret.key --template $<
+chain_rule = cat $< $(dir $@)../x509-chain.pem > $@
 
 # certificates signed by the test root CA
 %/x509.pem: %/template %/secret.key authority/secret.key authority/x509.pem
         $(cert_rule)
+%/x509-chain.pem: %/x509.pem authority/x509-chain.pem
+        $(chain_rule)
+
+# certificates signed by the test sub CA
+authority/subca/%/x509.pem: authority/subca/%/template authority/subca/%/secret.key authority/subca/x509.pem
+        $(cert_rule)
+authority/subca/%/x509-chain.pem: authority/subca/%/x509.pem authority/subca/x509-chain.pem
+        $(chain_rule)
 
 # certificates signed by rogue CA (for error cases)

test/tests/00_basic/apache.conf

@@ -6 +6 @@
  ServerName ${TEST_HOST}
  GnuTLSEnable On
- GnuTLSCertificateFile  authority/server/x509.pem
- GnuTLSKeyFile          authority/server/secret.key
+ GnuTLSCertificateFile  authority/subca/server/x509-chain.pem
+ GnuTLSKeyFile          authority/subca/server/secret.key
 </VirtualHost>

test/tests/27_OCSP_server/apache.conf

@@ -12 +12 @@
         #GnuTLSOCSPStapling     On
         GnuTLSOCSPCacheTimeout  60
-        GnuTLSCertificateFile   authority/server/x509-chain.pem
-        GnuTLSKeyFile           authority/server/secret.key
+        GnuTLSCertificateFile   authority/subca/server/x509-chain.pem
+        GnuTLSKeyFile           authority/subca/server/secret.key
         GnuTLSPriorities        NORMAL
 </VirtualHost>