* OCSP response caching code. The response is preceded by a flag value * which indicates whether the response was invalid when it was stored. * the purpose of this flag is to avoid repeated queries to a server * which has given an invalid response while allowing a response which * has subsequently become invalid to be retried immediately. * * The key for the cache is the hash of the certific
| 264 | * is for. |
| 265 | */ |
| 266 | static BOOL stapling_cache_response(server_rec *s, modssl_ctx_t *mctx, |
| 267 | OCSP_RESPONSE *rsp, certinfo *cinf, |
| 268 | BOOL ok, apr_pool_t *pool) |
| 269 | { |
| 270 | SSLModConfigRec *mc = myModConfig(s); |
| 271 | unsigned char resp_der[MAX_STAPLING_DER]; /* includes one-byte flag + response */ |
| 272 | unsigned char *p; |
| 273 | int resp_derlen, stored_len; |
| 274 | BOOL rv; |
| 275 | apr_time_t expiry; |
| 276 | |
| 277 | resp_derlen = i2d_OCSP_RESPONSE(rsp, NULL); |
| 278 | |
| 279 | if (resp_derlen <= 0) { |
| 280 | ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01927) |
| 281 | "OCSP stapling response encode error??"); |
| 282 | return FALSE; |
| 283 | } |
| 284 | |
| 285 | stored_len = resp_derlen + 1; /* response + ok flag */ |
| 286 | if (stored_len > sizeof resp_der) { |
| 287 | ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01928) |
| 288 | "OCSP stapling response too big (%u bytes)", resp_derlen); |
| 289 | return FALSE; |
| 290 | } |
| 291 | |
| 292 | p = resp_der; |
| 293 | |
| 294 | /* TODO: potential optimization; _timeout members as apr_interval_time_t */ |
| 295 | if (ok == TRUE) { |
| 296 | *p++ = 1; |
| 297 | expiry = apr_time_from_sec(mctx->stapling_cache_timeout); |
| 298 | } |
| 299 | else { |
| 300 | *p++ = 0; |
| 301 | expiry = apr_time_from_sec(mctx->stapling_errcache_timeout); |
| 302 | } |
| 303 | |
| 304 | expiry += apr_time_now(); |
| 305 | |
| 306 | i2d_OCSP_RESPONSE(rsp, &p); |
| 307 | |
| 308 | if (mc->stapling_cache->flags & AP_SOCACHE_FLAG_NOTMPSAFE) |
| 309 | stapling_cache_mutex_on(s); |
| 310 | rv = mc->stapling_cache->store(mc->stapling_cache_context, s, |
| 311 | cinf->idx, sizeof(cinf->idx), |
| 312 | expiry, resp_der, stored_len, pool); |
| 313 | if (mc->stapling_cache->flags & AP_SOCACHE_FLAG_NOTMPSAFE) |
| 314 | stapling_cache_mutex_off(s); |
| 315 | if (rv != APR_SUCCESS) { |
| 316 | ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01929) |
| 317 | "stapling_cache_response: OCSP response session store error!"); |
| 318 | return FALSE; |
| 319 | } |
| 320 | |
| 321 | return TRUE; |
| 322 | } |
| 323 |
no test coverage detected