Function stapling_cb

modules/ssl/ssl_util_stapling.c:804–927

Certificate Status callback. This is called when a client includes a * certificate status request extension. * * Check for cached responses in session cache. If valid send back to * client. If absent or no longer valid, query responder and update * cache. */

 * cache.
 */
static int stapling_cb(SSL *ssl, void *arg)
{
    conn_rec *conn      = (conn_rec *)SSL_get_app_data(ssl);
    server_rec *s       = mySrvFromConn(conn);
    SSLSrvConfigRec *sc = mySrvConfig(s);
    modssl_ctx_t *mctx  = myConnCtxConfig(conn, sc);
    UCHAR idx[SHA_DIGEST_LENGTH];
    ocsp_resp resp;
    certinfo *cinf = NULL;
    OCSP_RESPONSE *rsp = NULL;
    int rv;
    BOOL ok = TRUE;
    X509 *x;
    int rspderlen, provided = 0;

    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01951)
                 "stapling_cb: OCSP Stapling callback called");

    x = SSL_get_certificate(ssl);
    if (x == NULL) {
        return SSL_TLSEXT_ERR_NOACK;
    }

    if (X509_digest(x, EVP_sha1(), idx, NULL) != 1) {
        return SSL_TLSEXT_ERR_NOACK;
    }

    if (ap_ssl_ocsp_get_resp(s, conn, (const char*)idx, sizeof(idx),
                             copy_ocsp_resp, &resp) == APR_SUCCESS) {
        provided = 1;
    }
    else if (ssl_run_get_stapling_status(&resp.data, &rspderlen, conn, s, x) == APR_SUCCESS) {
        resp.len = (apr_size_t)rspderlen;
        provided = 1;
    }

    if (provided) {
        /* a hook handles stapling for this certificate and determines the response */
        if (resp.data == NULL || resp.len == 0) {
            return SSL_TLSEXT_ERR_NOACK;
        }
        SSL_set_tlsext_status_ocsp_resp(ssl, resp.data, (int)resp.len);
        return SSL_TLSEXT_ERR_OK;
    }
    
    if (sc->server->stapling_enabled != TRUE) {
        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01950)
                     "stapling_cb: OCSP Stapling disabled");
        return SSL_TLSEXT_ERR_NOACK;
    }

    if ((cinf = stapling_get_certinfo(s, idx, sizeof(idx), mctx, ssl)) == NULL) {
        return SSL_TLSEXT_ERR_NOACK;
    }

    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01952)
                 "stapling_cb: retrieved cached certificate data");