Verify the OCSP status of given certificate. Returns * V_OCSP_CERTSTATUS_* result code. */
| 127 | /* Verify the OCSP status of given certificate. Returns |
| 128 | * V_OCSP_CERTSTATUS_* result code. */ |
| 129 | static int verify_ocsp_status(X509 *cert, X509_STORE_CTX *ctx, conn_rec *c, |
| 130 | SSLSrvConfigRec *sc, server_rec *s, |
| 131 | apr_pool_t *pool) |
| 132 | { |
| 133 | int rc = V_OCSP_CERTSTATUS_GOOD; |
| 134 | OCSP_RESPONSE *response = NULL; |
| 135 | OCSP_BASICRESP *basicResponse = NULL; |
| 136 | OCSP_REQUEST *request = NULL; |
| 137 | OCSP_CERTID *certID = NULL; |
| 138 | apr_uri_t *ruri; |
| 139 | |
| 140 | ruri = determine_responder_uri(sc, cert, c, pool); |
| 141 | if (!ruri) { |
| 142 | if (sc->server->ocsp_mask & SSL_OCSPCHECK_NO_OCSP_FOR_CERT_OK) { |
| 143 | ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c, |
| 144 | "Skipping OCSP check for certificate cos no OCSP URL" |
| 145 | " found and no_ocsp_for_cert_ok is set"); |
| 146 | return V_OCSP_CERTSTATUS_GOOD; |
| 147 | } else { |
| 148 | return V_OCSP_CERTSTATUS_UNKNOWN; |
| 149 | } |
| 150 | } |
| 151 | |
| 152 | request = create_request(ctx, cert, &certID, s, pool, sc); |
| 153 | if (request) { |
| 154 | apr_interval_time_t to = sc->server->ocsp_responder_timeout == UNSET ? |
| 155 | apr_time_from_sec(DEFAULT_OCSP_TIMEOUT) : |
| 156 | sc->server->ocsp_responder_timeout; |
| 157 | response = modssl_dispatch_ocsp_request(ruri, to, request, c, pool); |
| 158 | } |
| 159 | |
| 160 | if (!request || !response) { |
| 161 | rc = V_OCSP_CERTSTATUS_UNKNOWN; |
| 162 | } |
| 163 | |
| 164 | if (rc == V_OCSP_CERTSTATUS_GOOD) { |
| 165 | int r = OCSP_response_status(response); |
| 166 | |
| 167 | if (r != OCSP_RESPONSE_STATUS_SUCCESSFUL) { |
| 168 | ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01922) |
| 169 | "OCSP response not successful: %d", r); |
| 170 | rc = V_OCSP_CERTSTATUS_UNKNOWN; |
| 171 | } |
| 172 | } |
| 173 | |
| 174 | if (rc == V_OCSP_CERTSTATUS_GOOD) { |
| 175 | basicResponse = OCSP_response_get1_basic(response); |
| 176 | if (!basicResponse) { |
| 177 | ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01923) |
| 178 | "could not retrieve OCSP basic response"); |
| 179 | ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, s); |
| 180 | rc = V_OCSP_CERTSTATUS_UNKNOWN; |
| 181 | } |
| 182 | } |
| 183 | |
| 184 | if (rc == V_OCSP_CERTSTATUS_GOOD && |
| 185 | sc->server->ocsp_use_request_nonce != FALSE && |
| 186 | OCSP_check_nonce(request, basicResponse) != 1) { |
no test coverage detected