Changeset efc43b4 in mod_gnutls for src/gnutls_ocsp.c

Timestamp:

Sep 25, 2018, 3:46:26 PM (23 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

debian/master, master, proxy-ticket

Children:

cb6476c

Parents:

994200a

Message:

Split per-vhost post config for OCSP stapling into configuring and enabling

This is preparation for enabling stapling by default: Configuration
failure may be ignored if stapling is not explicitly enabled by the
user (at the cost of not stapling).

File:

• src/gnutls_ocsp.c (modified) (3 diffs)

src/gnutls_ocsp.c

@@ -1087 +1087 @@
 
 
+const char* mgs_ocsp_configure_stapling(apr_pool_t *pconf,
+                                        apr_pool_t *ptemp __attribute__((unused)),
+                                        server_rec *server)
+{
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+        ap_get_module_config(server->module_config, &gnutls_module);
+
+    if (sc->certs_x509_chain_num < 2)
+        return "No issuer (CA) certificate available, cannot enable "
+            "stapling. Please add it to the GnuTLSCertificateFile.";
+
+    mgs_ocsp_data_t ocsp = apr_palloc(pconf, sizeof(struct mgs_ocsp_data));
+
+    ocsp->uri = mgs_cert_get_ocsp_uri(pconf,
+                                      sc->certs_x509_crt_chain[0]);
+    if (ocsp->uri == NULL && sc->ocsp_response_file == NULL)
+        return "No OCSP URI in the certificate nor a GnuTLSOCSPResponseFile "
+            "setting, cannot configure OCSP stapling.";
+
+    if (sc->ocsp_cache == NULL)
+        return "No OCSP response cache available, please check "
+            "the GnuTLSOCSPCache setting.";
+
+    sc->ocsp = ocsp;
+    return NULL;
+}
+
+
+
 /*
  * Like in the general post_config hook the HTTP status codes for
@@ -1092 +1121 @@
  * to denote an error.
  */
-int mgs_ocsp_post_config_server(apr_pool_t *pconf,
-                                apr_pool_t *ptemp __attribute__((unused)),
-                                server_rec *server)
+int mgs_ocsp_enable_stapling(apr_pool_t *pconf,
+                             apr_pool_t *ptemp __attribute__((unused)),
+                             server_rec *server)
 {
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
         ap_get_module_config(server->module_config, &gnutls_module);
-
-    if (sc->certs_x509_chain_num < 2)
-    {
-        ap_log_error(APLOG_MARK, APLOG_STARTUP, APR_EINVAL, server,
-                     "OCSP stapling is enabled but no CA certificate "
-                     "available for %s:%d, make sure it is included in "
-                     "GnuTLSCertificateFile!",
-                     server->server_hostname, server->addrs->host_port);
-        return HTTP_NOT_FOUND;
-    }
-
-    if (sc->ocsp_cache == NULL)
-    {
-        ap_log_error(APLOG_MARK, APLOG_STARTUP, APR_EINVAL, server,
-                     "OCSP stapling is enabled but no cache configured!");
-        return HTTP_NOT_FOUND;
+    if (sc->ocsp == NULL)
+    {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, APR_EGENERAL, server,
+                     "CRITICAL ERROR: %s called with uninitialized OCSP "
+                     "data structure. This indicates a bug in mod_gnutls.",
+                     __func__);
+        return HTTP_INTERNAL_SERVER_ERROR;
     }
 
@@ -1152 +1172 @@
     }
 
-    sc->ocsp = apr_palloc(pconf, sizeof(struct mgs_ocsp_data));
-
     sc->ocsp->fingerprint =
         mgs_get_cert_fingerprint(pconf, sc->certs_x509_crt_chain[0]);
     if (sc->ocsp->fingerprint.data == NULL)
         return HTTP_INTERNAL_SERVER_ERROR;
-
-    sc->ocsp->uri = mgs_cert_get_ocsp_uri(pconf,
-                                          sc->certs_x509_crt_chain[0]);
-    if (sc->ocsp->uri == NULL && sc->ocsp_response_file == NULL)
-    {
-        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, server,
-                     "OCSP stapling is enabled for for %s:%d, but there is "
-                     "neither an OCSP URI in the certificate nor a "
-                     "GnuTLSOCSPResponseFile setting for this host!",
-                     server->server_hostname, server->addrs->host_port);
-        return HTTP_NOT_FOUND;
-    }
 
     sc->ocsp->trust = apr_palloc(pconf,