Return the responder URI object which should be used in the given * configuration for the given certificate, or NULL if none can be * determined. */
| 52 | * configuration for the given certificate, or NULL if none can be |
| 53 | * determined. */ |
| 54 | static apr_uri_t *determine_responder_uri(SSLSrvConfigRec *sc, X509 *cert, |
| 55 | conn_rec *c, apr_pool_t *p) |
| 56 | { |
| 57 | apr_uri_t *u = apr_palloc(p, sizeof *u); |
| 58 | const char *s; |
| 59 | apr_status_t rv; |
| 60 | |
| 61 | /* Use default responder URL if forced by configuration, else use |
| 62 | * certificate-specified responder, falling back to default if |
| 63 | * necessary and possible. */ |
| 64 | if (sc->server->ocsp_force_default == TRUE) { |
| 65 | s = sc->server->ocsp_responder; |
| 66 | } |
| 67 | else { |
| 68 | s = extract_responder_uri(cert, p); |
| 69 | |
| 70 | if (s == NULL && sc->server->ocsp_responder) { |
| 71 | s = sc->server->ocsp_responder; |
| 72 | } |
| 73 | } |
| 74 | |
| 75 | if (s == NULL) { |
| 76 | ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(01918) |
| 77 | "no OCSP responder specified in certificate and " |
| 78 | "no default configured"); |
| 79 | return NULL; |
| 80 | } |
| 81 | |
| 82 | rv = apr_uri_parse(p, s, u); |
| 83 | if (rv || !u->hostname) { |
| 84 | ap_log_cerror(APLOG_MARK, APLOG_DEBUG, rv, c, APLOGNO(01919) |
| 85 | "failed to parse OCSP responder URI '%s'", s); |
| 86 | return NULL; |
| 87 | } |
| 88 | |
| 89 | if (ap_cstr_casecmp(u->scheme, "http") != 0) { |
| 90 | ap_log_cerror(APLOG_MARK, APLOG_DEBUG, rv, c, APLOGNO(01920) |
| 91 | "cannot handle OCSP responder URI '%s'", s); |
| 92 | return NULL; |
| 93 | } |
| 94 | |
| 95 | if (!u->port) { |
| 96 | u->port = apr_uri_port_of_scheme(u->scheme); |
| 97 | } |
| 98 | |
| 99 | return u; |
| 100 | } |
| 101 | |
| 102 | /* Create an OCSP request for the given certificate; returning the |
| 103 | * certificate ID in *certid and *issuer on success. Returns the |
no test coverage detected