Changeset fd6bb19 in mod_gnutls

Timestamp:

Jun 3, 2016, 10:08:29 AM (3 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

c3ad933

Parents:

4ae7810

Message:

Extract OCSP access URI from the server certificate

Files:

• include/mod_gnutls.h.in (modified) (1 diff)
• src/gnutls_config.c (modified) (2 diffs)
• src/gnutls_hooks.c (modified) (1 diff)
• src/gnutls_ocsp.c (modified) (4 diffs)
• src/gnutls_ocsp.h (modified) (1 diff)

include/mod_gnutls.h.in

@@ -220 +220 @@
      * once sending OCSP requests is implemented */
     char *ocsp_response_file;
+    /* OCSP URI extracted from the server certificate. NULL if
+     * unset. */
+    apr_uri_t *ocsp_uri;
     /* Trust list to verify OCSP responses for stapling. Should
      * usually only contain the CA that signed the server

src/gnutls_config.c

@@ -973 +973 @@
 
     sc->ocsp_response_file = NULL;
+    sc->ocsp_uri = NULL;
     sc->ocsp_trust = NULL;
 
@@ -1032 +1033 @@
 
     gnutls_srvconf_assign(ocsp_response_file);
+    gnutls_srvconf_assign(ocsp_uri);
     gnutls_srvconf_assign(ocsp_trust);
 

src/gnutls_hooks.c

@@ -386 +386 @@
         if (sc->ocsp_response_file != NULL)
         {
-            rv = mgs_ocsp_post_config_server(pconf, s);
+            rv = mgs_ocsp_post_config_server(pconf, ptemp, s);
             if (rv != OK && rv != DECLINED)
                 return rv;

src/gnutls_ocsp.c

@@ -223 +223 @@
                   ctxt->sc->ocsp_response_file);
 
+    /* TODO: response should come from cache, which must be filled
+     * from sc->ocsp_uri */
     int ret = gnutls_load_file(ctxt->sc->ocsp_response_file, ocsp_response);
     if (ret != GNUTLS_E_SUCCESS)
@@ -277 +279 @@
 
 
+apr_uri_t * mgs_cert_get_ocsp_uri(apr_pool_t *p, gnutls_x509_crt_t cert)
+{
+    apr_pool_t *tmp;
+    apr_status_t rv = apr_pool_create(&tmp, p);
+    if (rv != APR_SUCCESS)
+        return NULL;
+
+    apr_uri_t *ocsp_uri = NULL;
+
+    int ret = GNUTLS_E_SUCCESS;
+    /* search authority info access for OCSP URI */
+    for (int seq = 0; ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; seq++)
+    {
+        gnutls_datum_t ocsp_access_data;
+        ret = gnutls_x509_crt_get_authority_info_access(cert, seq,
+                                                        GNUTLS_IA_OCSP_URI,
+                                                        &ocsp_access_data,
+                                                        NULL);
+        if (ret == GNUTLS_E_SUCCESS)
+        {
+            /* create NULL terminated string */
+            char *ocsp_str =
+                apr_pstrndup(tmp, (const char*) ocsp_access_data.data,
+                             ocsp_access_data.size);
+            gnutls_free(ocsp_access_data.data);
+
+            ocsp_uri = apr_palloc(p, sizeof(apr_uri_t));
+            rv = apr_uri_parse(p, ocsp_str, ocsp_uri);
+            if (rv == APR_SUCCESS)
+                break;
+            else
+                ocsp_uri = NULL;
+        }
+    }
+
+    apr_pool_destroy(tmp);
+    return ocsp_uri;
+}
+
+
+
 /*
  * Like in the general post_config hook the HTTP status codes for
@@ -282 +325 @@
  * to denote an error.
  */
-int mgs_ocsp_post_config_server(apr_pool_t *pconf, server_rec *server)
-{
-    mgs_srvconf_rec *sc =
-        (mgs_srvconf_rec *) ap_get_module_config(server->module_config,
-                                                 &gnutls_module);
+int mgs_ocsp_post_config_server(apr_pool_t *pconf,
+                                apr_pool_t *ptemp __attribute__((unused)),
+                                server_rec *server)
+{
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+        ap_get_module_config(server->module_config, &gnutls_module);
 
     if (sc->certs_x509_chain_num < 2)
@@ -297 +341 @@
         return HTTP_NOT_FOUND;
     }
+
+    sc->ocsp_uri = mgs_cert_get_ocsp_uri(pconf, sc->certs_x509_crt_chain[0]);
+
     sc->ocsp_trust = apr_palloc(pconf,
                                 sizeof(gnutls_x509_trust_list_t));

src/gnutls_ocsp.h

@@ -63 +63 @@
  * the post_config hook itself)
  */
-int mgs_ocsp_post_config_server(apr_pool_t *pconf, server_rec *server);
+int mgs_ocsp_post_config_server(apr_pool_t *pconf, apr_pool_t *ptemp,
+                                server_rec *server);
 
 int mgs_get_ocsp_response(gnutls_session_t session, void *ptr,