| 833 | } |
| 834 | |
| 835 | bool |
| 836 | ssl_stapling_init_cert(SSL_CTX *ctx, X509 *cert, const char *certname, const char *rsp_file) |
| 837 | { |
| 838 | scoped_X509 issuer; |
| 839 | STACK_OF(OPENSSL_STRING) *aia = nullptr; |
| 840 | TS_OCSP_RESPONSE *rsp = nullptr; |
| 841 | |
| 842 | if (!cert) { |
| 843 | Error("null cert passed in for %s", certname); |
| 844 | return false; |
| 845 | } |
| 846 | |
| 847 | certinfo_map *map = static_cast<certinfo_map *>(SSL_CTX_get_ex_data(ctx, ssl_stapling_index)); |
| 848 | if (map && map->find(cert) != map->end()) { |
| 849 | Note("certificate already initialized for %s", certname); |
| 850 | return false; |
| 851 | } |
| 852 | |
| 853 | if (!map) { |
| 854 | map = new certinfo_map; |
| 855 | } |
| 856 | certinfo *cinf = static_cast<certinfo *>(OPENSSL_malloc(sizeof(certinfo))); |
| 857 | if (!cinf) { |
| 858 | Error("error allocating memory for %s", certname); |
| 859 | delete map; |
| 860 | return false; |
| 861 | } |
| 862 | |
| 863 | // Initialize certinfo |
| 864 | cinf->cid = nullptr; |
| 865 | cinf->uri = nullptr; |
| 866 | cinf->certname = ats_strdup(certname); |
| 867 | if (SSLConfigParams::ssl_ocsp_user_agent != nullptr) { |
| 868 | cinf->user_agent = ats_strdup(SSLConfigParams::ssl_ocsp_user_agent); |
| 869 | } |
| 870 | cinf->resp_derlen = 0; |
| 871 | ink_mutex_init(&cinf->stapling_mutex); |
| 872 | cinf->is_prefetched = rsp_file ? true : false; |
| 873 | cinf->is_expire = true; |
| 874 | cinf->expire_time = 0; |
| 875 | |
| 876 | if (cinf->is_prefetched) { |
| 877 | Dbg(dbg_ctl_ssl_ocsp, "using OCSP prefetched response file %s", rsp_file); |
| 878 | FILE *fp = fopen(rsp_file, "r"); |
| 879 | if (fp) { |
| 880 | fseek(fp, 0, SEEK_END); |
| 881 | long rsp_buf_len = ftell(fp); |
| 882 | if (rsp_buf_len >= 0) { |
| 883 | rewind(fp); |
| 884 | unsigned char *rsp_buf = static_cast<unsigned char *>(malloc(rsp_buf_len)); |
| 885 | auto read_len = fread(rsp_buf, 1, rsp_buf_len, fp); |
| 886 | if (read_len == static_cast<size_t>(rsp_buf_len)) { |
| 887 | const unsigned char *p = rsp_buf; |
| 888 | rsp = d2i_TS_OCSP_RESPONSE(nullptr, &p, rsp_buf_len); |
| 889 | } else { |
| 890 | Error("stapling_refresh_response: failed to read prefetched response file: %s", rsp_file); |
| 891 | } |
| 892 | free(rsp_buf); |
no test coverage detected