Changeset fad7695 in mod_gnutls

Timestamp:

Jun 1, 2016, 12:20:12 PM (3 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

68ce93c

Parents:

64856fd

Message:

Store OCSP trust list in server config

This avoids recreating the trust list whenever an OCSP response has to
be verified.

Files:

• include/mod_gnutls.h.in (modified) (1 diff)
• src/gnutls_config.c (modified) (2 diffs)
• src/gnutls_hooks.c (modified) (1 diff)
• src/gnutls_ocsp.c (modified) (4 diffs)
• src/gnutls_ocsp.h (modified) (1 diff)

include/mod_gnutls.h.in

@@ -220 +220 @@
      * once sending OCSP requests is implemented */
     char *ocsp_response_file;
+    /* Trust list to verify OCSP responses for stapling. Should
+     * usually only contain the CA that signed the server
+     * certificate. */
+    gnutls_x509_trust_list_t *ocsp_trust;
 } mgs_srvconf_rec;
 

src/gnutls_config.c

@@ -973 +973 @@
 
     sc->ocsp_response_file = NULL;
+    sc->ocsp_trust = NULL;
 
 /* this relies on GnuTLS never changing the gnutls_certificate_request_t enum to define -1 */
@@ -1030 +1031 @@
     gnutls_srvconf_merge(proxy_priorities, NULL);
 
-    gnutls_srvconf_merge(ocsp_response_file, NULL);
+    gnutls_srvconf_assign(ocsp_response_file);
+    gnutls_srvconf_assign(ocsp_trust);
 
     /* FIXME: the following items are pre-allocated, and should be

src/gnutls_hooks.c

@@ -381 +381 @@
                 " Shutting Down.");
             return HTTP_NOT_FOUND;
+        }
+
+        /* init OCSP trust list if OCSP is enabled */
+        if (sc->ocsp_response_file != NULL)
+        {
+            rv = mgs_ocsp_post_config_server(pconf, s);
+            if (rv != OK && rv != DECLINED)
+                return rv;
         }
 

src/gnutls_ocsp.c

@@ -80 +80 @@
 int check_ocsp_response(mgs_handle_t *ctxt, const gnutls_datum_t *ocsp_response)
 {
-    if (ctxt->sc->certs_x509_chain_num < 2)
-    {
-        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
-                      "No CA certificates in store, cannot verify response.");
+    if (ctxt->sc->ocsp_trust == NULL)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
+                      "No OCSP trust list available for server \"%s\"!",
+                      ctxt->c->base_server->server_hostname);
         return GNUTLS_E_NO_CERTIFICATE_FOUND;
     }
 
-    /* Only the direct issuer may sign the OCSP response or an OCSP
-     * signer. Assuming the certificate file is properly ordered, it
-     * should be the one directly after the server's. */
-    gnutls_x509_trust_list_t issuer;
-    int ret = mgs_create_ocsp_trust_list(&issuer,
-                                         &(ctxt->sc->certs_x509_crt_chain[1]),
-                                         1);
-    if (ret != GNUTLS_E_SUCCESS)
-    {
-        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_EGENERAL, ctxt->c,
-                      "Could not create issuer trust list: %s (%d)",
-                      gnutls_strerror(ret), ret);
-        return ret;
-    }
-
     gnutls_ocsp_resp_t resp;
-    ret = gnutls_ocsp_resp_init(&resp);
+    int ret = gnutls_ocsp_resp_init(&resp);
     if (ret != GNUTLS_E_SUCCESS)
     {
@@ -131 +117 @@
 
     unsigned int verify;
-    ret = gnutls_ocsp_resp_verify(resp, issuer, &verify, 0);
+    ret = gnutls_ocsp_resp_verify(resp, *(ctxt->sc->ocsp_trust), &verify, 0);
     if (ret != GNUTLS_E_SUCCESS)
     {
@@ -223 +209 @@
  resp_cleanup:
     gnutls_ocsp_resp_deinit(resp);
-    /* deinit trust list, but not the certificates */
-    gnutls_x509_trust_list_deinit(issuer, 0);
     return ret;
 }
@@ -280 +264 @@
     return ret;
 }
+
+
+
+apr_status_t mgs_cleanup_trust_list(void *data)
+{
+    gnutls_x509_trust_list_t *tl = (gnutls_x509_trust_list_t *) data;
+    gnutls_x509_trust_list_deinit(*tl, 0);
+    return APR_SUCCESS;
+}
+
+
+
+/*
+ * Like in the general post_config hook the HTTP status codes for
+ * errors are just for fun. What matters is "neither OK nor DECLINED"
+ * to denote an error.
+ */
+int mgs_ocsp_post_config_server(apr_pool_t *pconf, server_rec *server)
+{
+    mgs_srvconf_rec *sc =
+        (mgs_srvconf_rec *) ap_get_module_config(server->module_config,
+                                                 &gnutls_module);
+
+    if (sc->certs_x509_chain_num < 2)
+    {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, server,
+                     "OCSP stapling is enabled but no CA certificate "
+                     "available, make sure it is included in "
+                     "GnuTLSCertificateFile!");
+        return HTTP_NOT_FOUND;
+    }
+    sc->ocsp_trust = apr_palloc(pconf,
+                                sizeof(gnutls_x509_trust_list_t));
+     /* Only the direct issuer may sign the OCSP response or an OCSP
+      * signer. */
+    int ret = mgs_create_ocsp_trust_list(sc->ocsp_trust,
+                                         &(sc->certs_x509_crt_chain[1]),
+                                         1);
+    if (ret != GNUTLS_E_SUCCESS)
+    {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, server,
+                     "Could not create OCSP trust list: %s (%d)",
+                     gnutls_strerror(ret), ret);
+        return HTTP_INTERNAL_SERVER_ERROR;
+    }
+    /* deinit trust list when the config pool is destroyed */
+    apr_pool_cleanup_register(pconf, sc->ocsp_trust,
+                              mgs_cleanup_trust_list,
+                              apr_pool_cleanup_null);
+
+    return OK;
+}

src/gnutls_ocsp.h

@@ -49 +49 @@
                                const int num);
 
+/**
+ * Pool cleanup function that deinits the trust list without
+ * deinitializing certificates.
+ */
+apr_status_t mgs_cleanup_trust_list(void *data);
+
+/**
+ * Initialize server config for OCSP, supposed to be called in the
+ * post_config hook for each server where OCSP stapling is enabled,
+ * after certificates have been loaded.
+ *
+ * @return OK or DECLINED on success, any other value on error (like
+ * the post_config hook itself)
+ */
+int mgs_ocsp_post_config_server(apr_pool_t *pconf, server_rec *server);
+
 int mgs_get_ocsp_response(gnutls_session_t session, void *ptr,
                           gnutls_datum_t *ocsp_response);