| 732 | } |
| 733 | |
| 734 | static int get_and_check_cached_response(server_rec *s, modssl_ctx_t *mctx, |
| 735 | OCSP_RESPONSE **rsp, BOOL *pok, |
| 736 | certinfo *cinf, apr_pool_t *p) |
| 737 | { |
| 738 | BOOL ok = FALSE; |
| 739 | int rv; |
| 740 | |
| 741 | AP_DEBUG_ASSERT(*rsp == NULL); |
| 742 | |
| 743 | /* Check to see if we already have a response for this certificate */ |
| 744 | stapling_get_cached_response(s, rsp, &ok, cinf, p); |
| 745 | |
| 746 | if (*rsp) { |
| 747 | /* see if response is acceptable */ |
| 748 | ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01953) |
| 749 | "stapling_cb: retrieved cached response"); |
| 750 | rv = stapling_check_response(s, mctx, cinf, *rsp, NULL); |
| 751 | if (rv == SSL_TLSEXT_ERR_ALERT_FATAL) { |
| 752 | OCSP_RESPONSE_free(*rsp); |
| 753 | *rsp = NULL; |
| 754 | return SSL_TLSEXT_ERR_ALERT_FATAL; |
| 755 | } |
| 756 | else if (rv == SSL_TLSEXT_ERR_NOACK) { |
| 757 | /* Error in response. If this error was not present when it was |
| 758 | * stored (i.e. response no longer valid) then it can be |
| 759 | * renewed straight away. |
| 760 | * |
| 761 | * If the error *was* present at the time it was stored then we |
| 762 | * don't renew the response straight away; we just wait for the |
| 763 | * cached response to expire. |
| 764 | */ |
| 765 | if (ok) { |
| 766 | OCSP_RESPONSE_free(*rsp); |
| 767 | *rsp = NULL; |
| 768 | } |
| 769 | else if (!mctx->stapling_return_errors) { |
| 770 | OCSP_RESPONSE_free(*rsp); |
| 771 | *rsp = NULL; |
| 772 | *pok = FALSE; |
| 773 | return SSL_TLSEXT_ERR_NOACK; |
| 774 | } |
| 775 | } |
| 776 | } |
| 777 | return 0; |
| 778 | } |
| 779 | |
| 780 | typedef struct { |
| 781 | unsigned char *data; |
no test coverage detected