| 384 | } |
| 385 | |
| 386 | static int stapling_check_response(server_rec *s, modssl_ctx_t *mctx, |
| 387 | certinfo *cinf, OCSP_RESPONSE *rsp, |
| 388 | BOOL *pok) |
| 389 | { |
| 390 | int status = V_OCSP_CERTSTATUS_UNKNOWN; |
| 391 | int reason = OCSP_REVOKED_STATUS_NOSTATUS; |
| 392 | OCSP_BASICRESP *bs = NULL; |
| 393 | ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd; |
| 394 | int response_status = OCSP_response_status(rsp); |
| 395 | int rv = SSL_TLSEXT_ERR_OK; |
| 396 | |
| 397 | if (pok) |
| 398 | *pok = FALSE; |
| 399 | /* Check to see if response is an error. If so we automatically accept |
| 400 | * it because it would have expired from the cache if it was time to |
| 401 | * retry. |
| 402 | */ |
| 403 | if (response_status != OCSP_RESPONSE_STATUS_SUCCESSFUL) { |
| 404 | if (mctx->stapling_return_errors) |
| 405 | return SSL_TLSEXT_ERR_OK; |
| 406 | else |
| 407 | return SSL_TLSEXT_ERR_NOACK; |
| 408 | } |
| 409 | |
| 410 | bs = OCSP_response_get1_basic(rsp); |
| 411 | if (bs == NULL) { |
| 412 | /* If we can't parse response just pass it to client */ |
| 413 | ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01934) |
| 414 | "stapling_check_response: Error Parsing Response!"); |
| 415 | return SSL_TLSEXT_ERR_OK; |
| 416 | } |
| 417 | |
| 418 | if (!OCSP_resp_find_status(bs, cinf->cid, &status, &reason, &rev, |
| 419 | &thisupd, &nextupd)) { |
| 420 | /* If ID not present pass back to client (if configured so) */ |
| 421 | ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01935) |
| 422 | "stapling_check_response: certificate ID not present in response!"); |
| 423 | if (mctx->stapling_return_errors == FALSE) |
| 424 | rv = SSL_TLSEXT_ERR_NOACK; |
| 425 | } |
| 426 | else { |
| 427 | if (OCSP_check_validity(thisupd, nextupd, |
| 428 | mctx->stapling_resptime_skew, |
| 429 | mctx->stapling_resp_maxage)) { |
| 430 | if (pok) |
| 431 | *pok = TRUE; |
| 432 | } |
| 433 | else { |
| 434 | /* If pok is not NULL response was direct from a responder and |
| 435 | * the times should be valide. If pok is NULL the response was |
| 436 | * retrieved from cache and it is expected to subsequently expire |
| 437 | */ |
| 438 | if (pok) { |
| 439 | ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01936) |
| 440 | "stapling_check_response: response times invalid"); |
| 441 | } |
| 442 | else { |
| 443 | ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01937) |
no test coverage detected