Changeset eb21e89 in mod_gnutls for src/gnutls_ocsp.c

Timestamp:

Jul 29, 2021, 2:52:48 PM (11 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

master

Children:

e809a17a

Parents:

b762e4e

Message:

Fix server_rec references in mgs_get_ocsp_response()

During the handshake the base_server of the relevant conn_rec is
always the first vhost matching the host/port combination of the
incoming connection. By the time an OCSP response is requested
mod_gnutls may already have selected another server based on SNI, but
Apache hasn't updated the conn_rec yet. In that case c->base_server
does not refer to the right server, and if that server reference is
used to get the mod_gnutls configuration it'll be the wrong one.

That behavior caused a bug where caching a fresh OCSP response during
handshake failed if the initial vhost had OCSP stapling disabled,
because with stapling disabled the cache lifetime is set to -1. In
other cases a wrong cache lifetime might have been used.

The bug is fixed by using the mod_gnutls server configuration
referenced by the mod_gnutls connection structure, which has already
been updated by the SNI parsing code. It contains a reference to the
correct server_rec.

This commit also contains a regression test.

File:

• src/gnutls_ocsp.c (modified) (7 diffs)

src/gnutls_ocsp.c

@@ -816 +816 @@
 
     apr_status_t rv = mgs_cache_fetch(sc->ocsp_cache,
-                                      ctxt->c->base_server,
+                                      sc->s,
                                       req_data->fingerprint,
                                       ocsp_response,
@@ -829 +829 @@
         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_EGENERAL, ctxt->c,
                       "Cached OCSP failure found for %s.",
-                      ctxt->c->base_server->server_hostname);
+                      sc->s->server_hostname);
         goto fail_cleanup;
     }
@@ -853 +853 @@
          * Apache Mutex directive. */
         rv = mgs_cache_fetch(sc->ocsp_cache,
-                             ctxt->c->base_server,
+                             sc->s,
                              req_data->fingerprint,
                              ocsp_response,
@@ -865 +865 @@
                 ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_EGENERAL, ctxt->c,
                               "Cached OCSP failure found for %s.",
-                              ctxt->c->base_server->server_hostname);
+                              sc->s->server_hostname);
                 goto fail_cleanup;
             }
@@ -878 +878 @@
     }
 
-    rv = mgs_cache_ocsp_response(ctxt->c->base_server, req_data, NULL);
+    rv = mgs_cache_ocsp_response(sc->s, req_data, NULL);
     if (rv != APR_SUCCESS)
     {
@@ -884 +884 @@
                       "Caching a fresh OCSP response failed");
         /* cache failure to rate limit retries */
-        mgs_cache_ocsp_failure(ctxt->c->base_server,
+        mgs_cache_ocsp_failure(sc->s,
                                req_data,
                                sc->ocsp_failure_timeout);
@@ -894 +894 @@
     /* retry reading from cache */
     rv = mgs_cache_fetch(sc->ocsp_cache,
-                         ctxt->c->base_server,
+                         sc->s,
                          req_data->fingerprint,
                          ocsp_response,