| 1208 | } |
| 1209 | |
| 1210 | static bool |
| 1211 | stapling_refresh_response(certinfo *cinf, TS_OCSP_RESPONSE **prsp) |
| 1212 | { |
| 1213 | bool rv = true; |
| 1214 | TS_OCSP_REQUEST *req = nullptr; |
| 1215 | TS_OCSP_CERTID *id = nullptr; |
| 1216 | int response_status = 0; |
| 1217 | IOBufferBlock *url_for_get = nullptr; |
| 1218 | const char *url = nullptr; // Final URL to use |
| 1219 | bool use_get = false; |
| 1220 | |
| 1221 | *prsp = nullptr; |
| 1222 | |
| 1223 | req = TS_OCSP_REQUEST_new(); |
| 1224 | if (!req) { |
| 1225 | goto err; |
| 1226 | } |
| 1227 | id = TS_OCSP_CERTID_dup(cinf->cid); |
| 1228 | if (!id) { |
| 1229 | goto err; |
| 1230 | } |
| 1231 | if (!TS_OCSP_request_add0_id(req, id)) { |
| 1232 | goto err; |
| 1233 | } |
| 1234 | |
| 1235 | if (SSLConfigParams::ssl_ocsp_request_mode) { // True: GET, False: POST |
| 1236 | url_for_get = make_url_for_get(req, cinf->uri); |
| 1237 | if (url_for_get != nullptr) { |
| 1238 | url = url_for_get->buf(); |
| 1239 | use_get = true; |
| 1240 | } |
| 1241 | } |
| 1242 | if (url == nullptr) { |
| 1243 | // GET request is disabled or the request is too large for GET request |
| 1244 | url = cinf->uri; |
| 1245 | } |
| 1246 | |
| 1247 | Dbg(dbg_ctl_ssl_ocsp, "stapling_refresh_response: querying responder; method=%s uri=%s", use_get ? "GET" : "POST", cinf->uri); |
| 1248 | |
| 1249 | *prsp = query_responder(url, cinf->user_agent, req, SSLConfigParams::ssl_ocsp_request_timeout, use_get); |
| 1250 | if (*prsp == nullptr) { |
| 1251 | goto err; |
| 1252 | } |
| 1253 | |
| 1254 | response_status = ASN1_ENUMERATED_get((*prsp)->responseStatus); |
| 1255 | if (response_status == TS_OCSP_RESPONSE_STATUS_SUCCESSFUL) { |
| 1256 | Dbg(dbg_ctl_ssl_ocsp, "stapling_refresh_response: query response received"); |
| 1257 | stapling_check_response(cinf, *prsp); |
| 1258 | } else { |
| 1259 | Error("stapling_refresh_response: responder response error; uri=%s method=%s response_status=%d", cinf->uri, |
| 1260 | use_get ? "GET" : "POST", response_status); |
| 1261 | } |
| 1262 | |
| 1263 | if (!stapling_cache_response(*prsp, cinf)) { |
| 1264 | Error("stapling_refresh_response: can not cache response"); |
| 1265 | } else { |
| 1266 | Dbg(dbg_ctl_ssl_ocsp, "stapling_refresh_response: successfully refreshed OCSP response"); |
| 1267 | } |
no test coverage detected