Function stapling_check_response

src/iocore/net/OCSPStapling.cc:984–1030

}

static int
stapling_check_response(certinfo *cinf, TS_OCSP_RESPONSE *rsp)
{
  int                   status = TS_OCSP_CERTSTATUS_UNKNOWN, reason;
  TS_OCSP_BASICRESP    *bs     = nullptr;
  ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
  int                   response_status = ASN1_ENUMERATED_get(rsp->responseStatus);

  // Check to see if response is an error.
  // If so we automatically accept it because it would have expired from the cache if it was time to retry.
  if (response_status != TS_OCSP_RESPONSE_STATUS_SUCCESSFUL) {
    return SSL_TLSEXT_ERR_NOACK;
  }

  bs = TS_OCSP_response_get1_basic(rsp);
  if (bs == nullptr) {
    // If we can't parse response just pass it back to client
    Error("stapling_check_response: cannot parse response for %s", cinf->certname);
    return SSL_TLSEXT_ERR_OK;
  }
  if (!TS_OCSP_resp_find_status(bs, cinf->cid, &status, &reason, &rev, &thisupd, &nextupd)) {
    // If ID not present just pass it back to client
    Error("stapling_check_response: certificate ID not present in response for %s", cinf->certname);
  } else {
    if (!TS_OCSP_check_validity(thisupd, nextupd, 300, -1)) {
      // The check is just for logging and pass the response back to client anyway
      Error("stapling_check_response: status in response for %s is not valid already/yet", cinf->certname);
    }
  }

  switch (status) {
  case TS_OCSP_CERTSTATUS_GOOD:
    break;
  case TS_OCSP_CERTSTATUS_REVOKED:
    Metrics::Counter::increment(ssl_rsb.ocsp_revoked_cert);
    break;
  case TS_OCSP_CERTSTATUS_UNKNOWN:
    Metrics::Counter::increment(ssl_rsb.ocsp_unknown_cert);
    break;
  default:
    break;
  }

  TS_OCSP_BASICRESP_free(bs);

  return SSL_TLSEXT_ERR_OK;
}

static TS_OCSP_RESPONSE *
query_responder(const char *uri, const char *user_agent, TS_OCSP_REQUEST *req, int req_timeout, bool use_get)