Changeset efc43b4 in mod_gnutls for src

Timestamp:

Sep 25, 2018, 3:46:26 PM (2 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, debian/master, master, proxy-ticket

Children:

cb6476c

Parents:

994200a

Message:

Split per-vhost post config for OCSP stapling into configuring and enabling

This is preparation for enabling stapling by default: Configuration
failure may be ignored if stapling is not explicitly enabled by the
user (at the cost of not stapling).

Location:

src

Files:

• gnutls_hooks.c (modified) (2 diffs)
• gnutls_ocsp.c (modified) (3 diffs)
• gnutls_ocsp.h (modified) (1 diff)

src/gnutls_hooks.c

@@ -659 +659 @@
             sc->client_verify_method = mgs_cvm_cartel;
         if (sc->ocsp_staple == GNUTLS_ENABLED_UNSET)
+            // TODO: Check result of mgs_ocsp_configure_stapling()
+            // below instead, staple if possible.
             sc->ocsp_staple = GNUTLS_ENABLED_FALSE;
 
@@ -665 +667 @@
         if (sc->enabled && sc->ocsp_staple)
         {
-            rv = mgs_ocsp_post_config_server(pconf, ptemp, s);
+            const char *err = mgs_ocsp_configure_stapling(pconf, ptemp, s);
+            if (err != NULL)
+            {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, APR_EINVAL, s,
+                             "OCSP stapling configuration failed for "
+                             "host '%s:%d': %s",
+                             s->server_hostname, s->addrs->host_port, err);
+                return HTTP_INTERNAL_SERVER_ERROR;
+            }
+            rv = mgs_ocsp_enable_stapling(pconf, ptemp, s);
             if (rv != OK && rv != DECLINED)
                 return rv;

src/gnutls_ocsp.c

@@ -1087 +1087 @@
 
 
+const char* mgs_ocsp_configure_stapling(apr_pool_t *pconf,
+                                        apr_pool_t *ptemp __attribute__((unused)),
+                                        server_rec *server)
+{
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+        ap_get_module_config(server->module_config, &gnutls_module);
+
+    if (sc->certs_x509_chain_num < 2)
+        return "No issuer (CA) certificate available, cannot enable "
+            "stapling. Please add it to the GnuTLSCertificateFile.";
+
+    mgs_ocsp_data_t ocsp = apr_palloc(pconf, sizeof(struct mgs_ocsp_data));
+
+    ocsp->uri = mgs_cert_get_ocsp_uri(pconf,
+                                      sc->certs_x509_crt_chain[0]);
+    if (ocsp->uri == NULL && sc->ocsp_response_file == NULL)
+        return "No OCSP URI in the certificate nor a GnuTLSOCSPResponseFile "
+            "setting, cannot configure OCSP stapling.";
+
+    if (sc->ocsp_cache == NULL)
+        return "No OCSP response cache available, please check "
+            "the GnuTLSOCSPCache setting.";
+
+    sc->ocsp = ocsp;
+    return NULL;
+}
+
+
+
 /*
  * Like in the general post_config hook the HTTP status codes for
@@ -1092 +1121 @@
  * to denote an error.
  */
-int mgs_ocsp_post_config_server(apr_pool_t *pconf,
-                                apr_pool_t *ptemp __attribute__((unused)),
-                                server_rec *server)
+int mgs_ocsp_enable_stapling(apr_pool_t *pconf,
+                             apr_pool_t *ptemp __attribute__((unused)),
+                             server_rec *server)
 {
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
         ap_get_module_config(server->module_config, &gnutls_module);
-
-    if (sc->certs_x509_chain_num < 2)
-    {
-        ap_log_error(APLOG_MARK, APLOG_STARTUP, APR_EINVAL, server,
-                     "OCSP stapling is enabled but no CA certificate "
-                     "available for %s:%d, make sure it is included in "
-                     "GnuTLSCertificateFile!",
-                     server->server_hostname, server->addrs->host_port);
-        return HTTP_NOT_FOUND;
-    }
-
-    if (sc->ocsp_cache == NULL)
-    {
-        ap_log_error(APLOG_MARK, APLOG_STARTUP, APR_EINVAL, server,
-                     "OCSP stapling is enabled but no cache configured!");
-        return HTTP_NOT_FOUND;
+    if (sc->ocsp == NULL)
+    {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, APR_EGENERAL, server,
+                     "CRITICAL ERROR: %s called with uninitialized OCSP "
+                     "data structure. This indicates a bug in mod_gnutls.",
+                     __func__);
+        return HTTP_INTERNAL_SERVER_ERROR;
     }
 
@@ -1152 +1172 @@
     }
 
-    sc->ocsp = apr_palloc(pconf, sizeof(struct mgs_ocsp_data));
-
     sc->ocsp->fingerprint =
         mgs_get_cert_fingerprint(pconf, sc->certs_x509_crt_chain[0]);
     if (sc->ocsp->fingerprint.data == NULL)
         return HTTP_INTERNAL_SERVER_ERROR;
-
-    sc->ocsp->uri = mgs_cert_get_ocsp_uri(pconf,
-                                          sc->certs_x509_crt_chain[0]);
-    if (sc->ocsp->uri == NULL && sc->ocsp_response_file == NULL)
-    {
-        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, server,
-                     "OCSP stapling is enabled for for %s:%d, but there is "
-                     "neither an OCSP URI in the certificate nor a "
-                     "GnuTLSOCSPResponseFile setting for this host!",
-                     server->server_hostname, server->addrs->host_port);
-        return HTTP_NOT_FOUND;
-    }
 
     sc->ocsp->trust = apr_palloc(pconf,

src/gnutls_ocsp.h

@@ -98 +98 @@
 
 /**
- * Initialize server config for OCSP, supposed to be called in the
- * post_config hook for each server where OCSP stapling is enabled,
- * after certificates have been loaded.
+ * Try to generate the OCSP stapling configuration for a (virtual)
+ * host. This function must be called in the post_config hook after
+ * certificates have been loaded. This method does not actually enable
+ * stapling, it only prepares the configuration. The reason for
+ * splitting these tasks is that configuration failure may be ignored
+ * if stapling is not explicitly enabled but only opportunistically.
+ *
+ * @return `NULL` on success, a string describing why configuration
+ * failed otherwise (static or allocated from ptemp)
+ */
+const char* mgs_ocsp_configure_stapling(apr_pool_t *pconf, apr_pool_t *ptemp,
+                                        server_rec *server);
+
+/**
+ * Enable OCSP stapling for a (virtual) host. Must be called in the
+ * post_config hook after mgs_ocsp_configure_stapling has returned
+ * successfully for that host.
  *
  * @return OK or DECLINED on success, any other value on error (like
- * the post_config hook itself)
+ * the post_config hook)
  */
-int mgs_ocsp_post_config_server(apr_pool_t *pconf, apr_pool_t *ptemp,
-                                server_rec *server);
+int mgs_ocsp_enable_stapling(apr_pool_t *pconf, apr_pool_t *ptemp,
+                             server_rec *server);
 
 int mgs_get_ocsp_response(gnutls_session_t session, void *ptr,