| 477 | } |
| 478 | |
| 479 | static BOOL stapling_renew_response(server_rec *s, modssl_ctx_t *mctx, SSL *ssl, |
| 480 | certinfo *cinf, OCSP_RESPONSE **prsp, |
| 481 | BOOL *pok, apr_pool_t *pool) |
| 482 | { |
| 483 | conn_rec *conn = (conn_rec *)SSL_get_app_data(ssl); |
| 484 | apr_pool_t *vpool; |
| 485 | OCSP_REQUEST *req = NULL; |
| 486 | OCSP_CERTID *id = NULL; |
| 487 | STACK_OF(X509_EXTENSION) *exts; |
| 488 | int i; |
| 489 | BOOL rv = TRUE; |
| 490 | const char *ocspuri; |
| 491 | apr_uri_t uri; |
| 492 | |
| 493 | *prsp = NULL; |
| 494 | /* Build up OCSP query from server certificate info */ |
| 495 | ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01938) |
| 496 | "stapling_renew_response: querying responder"); |
| 497 | |
| 498 | req = OCSP_REQUEST_new(); |
| 499 | if (!req) |
| 500 | goto err; |
| 501 | id = OCSP_CERTID_dup(cinf->cid); |
| 502 | if (!id) |
| 503 | goto err; |
| 504 | if (!OCSP_request_add0_id(req, id)) |
| 505 | goto err; |
| 506 | id = NULL; |
| 507 | /* Add any extensions to the request */ |
| 508 | SSL_get_tlsext_status_exts(ssl, &exts); |
| 509 | for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) { |
| 510 | X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i); |
| 511 | if (!OCSP_REQUEST_add_ext(req, ext, -1)) |
| 512 | goto err; |
| 513 | } |
| 514 | |
| 515 | if (mctx->stapling_force_url) |
| 516 | ocspuri = mctx->stapling_force_url; |
| 517 | else |
| 518 | ocspuri = cinf->uri; |
| 519 | |
| 520 | if (!ocspuri) { |
| 521 | ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02621) |
| 522 | "stapling_renew_response: no uri for responder"); |
| 523 | rv = FALSE; |
| 524 | goto done; |
| 525 | } |
| 526 | |
| 527 | /* Create a temporary pool to constrain memory use */ |
| 528 | apr_pool_create(&vpool, conn->pool); |
| 529 | apr_pool_tag(vpool, "modssl_stapling_renew"); |
| 530 | |
| 531 | if (apr_uri_parse(vpool, ocspuri, &uri) != APR_SUCCESS) { |
| 532 | ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01939) |
| 533 | "stapling_renew_response: Error parsing uri %s", |
| 534 | ocspuri); |
| 535 | rv = FALSE; |
| 536 | goto done; |
no test coverage detected