Changeset ef107fd in mod_gnutls

Timestamp:

Oct 29, 2016, 1:40:03 PM (6 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, main, master, proxy-ticket, upstream

Children:

444e6ed

Parents:

0a02378

Message:

Remove TODO for OCSP requests without nonces

Ideally all OCSP responders should support nonces. A new comment
describes how to implement disabling nonce verification if someone
needs to (could become an option similar to the one in mod_ssl).

File:

• src/gnutls_ocsp.c (modified) (2 diffs)

src/gnutls_ocsp.c

@@ -616 +616 @@
     {
         gnutls_datum_t req;
+        /* mod_ssl offers an option to enable/disable nonces for
+         * broken responders. If needed at some point, we could do the
+         * same by passing NULL instead of &nonce. */
         int ret = mgs_create_ocsp_request(s, &req, &nonce);
         if (ret == GNUTLS_E_SUCCESS)
@@ -642 +645 @@
         }
     }
-
-    /* TODO: separate option to enable/disable nonce */
 
     apr_time_t expiry;