Attachment #32010 for bug #54357

View | Details | Raw Unified | Return to bug 54357
Collapse All | Expand All




    if (!ssl_mutex_init(base_server, p)) {
        return HTTP_INTERNAL_SERVER_ERROR;
    }
#ifdef HAVE_OCSP_STAPLING
    ssl_stapling_ex_init();
#endif

    /*
     * initialize session caching

static int ssl_server_import_cert(server_rec *s,
                                  modssl_ctx_t *mctx,
                                  const char *id,
                                  int idx,
                                  apr_pool_t *p)
{
    SSLModConfigRec *mc = myModConfig(s);
    ssl_asn1_t *asn1;


#ifdef HAVE_OCSP_STAPLING
    if ((mctx->pkp == FALSE) && (mctx->stapling_enabled == TRUE)) {
        if (!ssl_stapling_init_cert(s, mctx, cert, p)) {
            ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02235)
                         "Unable to configure server certificate for stapling");
        }

    ecc_id = ssl_asn1_table_keyfmt(ptemp, vhost_id, SSL_AIDX_ECC);
#endif

    have_rsa = ssl_server_import_cert(s, mctx, rsa_id, SSL_AIDX_RSA, p);
    have_dsa = ssl_server_import_cert(s, mctx, dsa_id, SSL_AIDX_DSA, p);
#ifdef HAVE_ECC
    have_ecc = ssl_server_import_cert(s, mctx, ecc_id, SSL_AIDX_ECC, p);
#endif

    if (!(have_rsa || have_dsa

Lines 522-527 typedef struct { Link Here

(-)a/modules/ssl/ssl_private.h (-1 / +18 lines)
522	} rCtx;	522	} rCtx;
523	} SSLModConfigRec;	523	} SSLModConfigRec;
524		524
		525	#ifdef HAVE_OCSP_STAPLING
		526	/* Cached OCSP stapling info stored in modssl_pk_server_t */
		527	typedef struct {
		528	/* Index in session cache SHA1 hash of certificate */
		529	UCHAR idx[20];
		530	/* Certificate ID for OCSP requests or NULL if ID cannot be determined */
		531	OCSP_CERTID *cid;
		532	/* Responder details */
		533	char *uri;
		534	} certinfo;
		535	#endif
		536
525	/** Structure representing configured filenames for certs and keys for	537	/** Structure representing configured filenames for certs and keys for
526	* a given vhost, and the corresponding in-memory structures once the	538	* a given vhost, and the corresponding in-memory structures once the
527	* files are parsed. */	539	* files are parsed. */
Lines 538-543 typedef struct { Link Here
538	X509 *certs[SSL_AIDX_MAX];	550	X509 *certs[SSL_AIDX_MAX];
539	EVP_PKEY *keys[SSL_AIDX_MAX];	551	EVP_PKEY *keys[SSL_AIDX_MAX];
540		552
		553	#ifdef HAVE_OCSP_STAPLING
		554	/* OCSP stapling information */
		555	certinfo *stapling_cert_info;
		556	#endif
		557
541	/** Certificates which specify the set of CA names which should be	558	/** Certificates which specify the set of CA names which should be
542	* sent in the CertificateRequest message: */	559	* sent in the CertificateRequest message: */
543	const char *ca_name_path;	560	const char *ca_name_path;
Lines 829-835 const char ssl_cmd_SSLStaplingResponderTimeout(cmd_parms , void *, const char Link Here
829	const char ssl_cmd_SSLStaplingForceURL(cmd_parms , void , const char );	846	const char ssl_cmd_SSLStaplingForceURL(cmd_parms , void , const char );
830	void modssl_init_stapling(server_rec , apr_pool_t , apr_pool_t , modssl_ctx_t );	847	void modssl_init_stapling(server_rec , apr_pool_t , apr_pool_t , modssl_ctx_t );
831	void ssl_stapling_ex_init(void);	848	void ssl_stapling_ex_init(void);
832	int ssl_stapling_init_cert(server_rec s, modssl_ctx_t mctx, X509 *x);	849	int ssl_stapling_init_cert(server_rec s, modssl_ctx_t mctx, X509 x, apr_pool_t p);
833	#endif	850	#endif
834	#ifdef HAVE_SRP	851	#ifdef HAVE_SRP
835	int ssl_callback_SRPServerParams(SSL , int , void *);	852	int ssl_callback_SRPServerParams(SSL , int , void *);





#define MAX_STAPLING_DER 10240

/* Cached info stored in certificate ex_info. */
typedef struct {
    /* Index in session cache SHA1 hash of certificate */
    UCHAR idx[20];
    /* Certificate ID for OCSP requests or NULL if ID cannot be determined */
    OCSP_CERTID *cid;
    /* Responder details */
    char *uri;
} certinfo;

static void certinfo_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
                                        int idx, long argl, void *argp)
{
    certinfo *cinf = ptr;

    if (!cinf)
        return;
    if (cinf->uri)
        OPENSSL_free(cinf->uri);
    OPENSSL_free(cinf);
}

static int stapling_ex_idx = -1;

void ssl_stapling_ex_init(void)
{
    if (stapling_ex_idx != -1)
        return;
    stapling_ex_idx = X509_get_ex_new_index(0, "X509 cached OCSP info", 0, 0,
                                            certinfo_free);
}

static X509 *stapling_get_issuer(modssl_ctx_t *mctx, X509 *x)
{
    X509 *issuer = NULL;


}

int ssl_stapling_init_cert(server_rec *s, modssl_ctx_t *mctx, X509 *x, apr_pool_t *p)
{
    certinfo *cinf;
    X509 *issuer = NULL;


    if (x == NULL)
        return 0;

    if (mctx->pks->stapling_cert_info) {
        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02215)
                     "ssl_stapling_init_cert: certificate already initialized!");
        return 0;
    }
    cinf = apr_pcalloc(p, sizeof(certinfo));
    if (!cinf) {
        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02216)
                     "ssl_stapling_init_cert: error allocating memory!");
        return 0;
    }
    mctx->pks->stapling_cert_info = cinf;
    cinf->uri = NULL;
    X509_set_ex_data(x, stapling_ex_idx, cinf);

    issuer = stapling_get_issuer(mctx, x);


    X509_digest(x, EVP_sha1(), cinf->idx, NULL);

    aia = X509_get1_ocsp(x);
    if (aia) {
        /* Ugly: ensure memory managed by apr */
        char *uri;
        uri = sk_OPENSSL_STRING_pop(aia);
        cinf->uri = apr_pstrdup(p, uri);
        OPENSSL_free(uri);
    }
    if (!cinf->uri && !mctx->stapling_force_url) {
        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02218)
                     "ssl_stapling_init_cert: no responder URL");

                                        SSL *ssl)
{
    certinfo *cinf;
    cinf = mctx->pks->stapling_cert_info;
    x = SSL_get_certificate(ssl);
    if (x == NULL)
        return NULL;
    cinf = X509_get_ex_data(x, stapling_ex_idx);
    if (cinf && cinf->cid)
        return cinf;
    ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(01926)
- 

Return to bug 54357

Lines 199-207 int ssl_init_Module(apr_pool_t p, apr_pool_t plog, Link Here

(-)a/modules/ssl/ssl_engine_init.c (-8 / +6 lines)
199	if (!ssl_mutex_init(base_server, p)) {	199	if (!ssl_mutex_init(base_server, p)) {
200	return HTTP_INTERNAL_SERVER_ERROR;	200	return HTTP_INTERNAL_SERVER_ERROR;
201	}	201	}
202	#ifdef HAVE_OCSP_STAPLING
203	ssl_stapling_ex_init();
204	#endif
205		202
206	/*	203	/*
207	* initialize session caching	204	* initialize session caching
Lines 820-826 static void ssl_init_ctx(server_rec *s, Link Here
820	static int ssl_server_import_cert(server_rec *s,	817	static int ssl_server_import_cert(server_rec *s,
821	modssl_ctx_t *mctx,	818	modssl_ctx_t *mctx,
822	const char *id,	819	const char *id,
823	int idx)	820	int idx,
		821	apr_pool_t *p)
824	{	822	{
825	SSLModConfigRec *mc = myModConfig(s);	823	SSLModConfigRec *mc = myModConfig(s);
826	ssl_asn1_t *asn1;	824	ssl_asn1_t *asn1;
Lines 852-858 static int ssl_server_import_cert(server_rec *s, Link Here
852		850
853	#ifdef HAVE_OCSP_STAPLING	851	#ifdef HAVE_OCSP_STAPLING
854	if ((mctx->pkp == FALSE) && (mctx->stapling_enabled == TRUE)) {	852	if ((mctx->pkp == FALSE) && (mctx->stapling_enabled == TRUE)) {
855	if (!ssl_stapling_init_cert(s, mctx, cert)) {	853	if (!ssl_stapling_init_cert(s, mctx, cert, p)) {
856	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02235)	854	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02235)
857	"Unable to configure server certificate for stapling");	855	"Unable to configure server certificate for stapling");
858	}	856	}
Lines 1000-1009 static void ssl_init_server_certs(server_rec *s, Link Here
1000	ecc_id = ssl_asn1_table_keyfmt(ptemp, vhost_id, SSL_AIDX_ECC);	998	ecc_id = ssl_asn1_table_keyfmt(ptemp, vhost_id, SSL_AIDX_ECC);
1001	#endif	999	#endif
1002		1000
1003	have_rsa = ssl_server_import_cert(s, mctx, rsa_id, SSL_AIDX_RSA);	1001	have_rsa = ssl_server_import_cert(s, mctx, rsa_id, SSL_AIDX_RSA, p);
1004	have_dsa = ssl_server_import_cert(s, mctx, dsa_id, SSL_AIDX_DSA);	1002	have_dsa = ssl_server_import_cert(s, mctx, dsa_id, SSL_AIDX_DSA, p);
1005	#ifdef HAVE_ECC	1003	#ifdef HAVE_ECC
1006	have_ecc = ssl_server_import_cert(s, mctx, ecc_id, SSL_AIDX_ECC);	1004	have_ecc = ssl_server_import_cert(s, mctx, ecc_id, SSL_AIDX_ECC, p);
1007	#endif	1005	#endif
1008		1006
1009	if (!(have_rsa \|\| have_dsa	1007	if (!(have_rsa \|\| have_dsa

Lines 43-80 Link Here

(-)a/modules/ssl/ssl_util_stapling.c (-47 / +13 lines)
43		43
44	#define MAX_STAPLING_DER 10240	44	#define MAX_STAPLING_DER 10240
45		45
46	/* Cached info stored in certificate ex_info. */
47	typedef struct {
48	/* Index in session cache SHA1 hash of certificate */
49	UCHAR idx[20];
50	/* Certificate ID for OCSP requests or NULL if ID cannot be determined */
51	OCSP_CERTID *cid;
52	/* Responder details */
53	char *uri;
54	} certinfo;
55
56	static void certinfo_free(void parent, void ptr, CRYPTO_EX_DATA *ad,
57	int idx, long argl, void *argp)
58	{
59	certinfo *cinf = ptr;
60
61	if (!cinf)
62	return;
63	if (cinf->uri)
64	OPENSSL_free(cinf->uri);
65	OPENSSL_free(cinf);
66	}
67
68	static int stapling_ex_idx = -1;
69
70	void ssl_stapling_ex_init(void)
71	{
72	if (stapling_ex_idx != -1)
73	return;
74	stapling_ex_idx = X509_get_ex_new_index(0, "X509 cached OCSP info", 0, 0,
75	certinfo_free);
76	}
77
78	static X509 stapling_get_issuer(modssl_ctx_t mctx, X509 *x)	46	static X509 stapling_get_issuer(modssl_ctx_t mctx, X509 *x)
79	{	47	{
80	X509 *issuer = NULL;	48	X509 *issuer = NULL;
Lines 106-112 static X509 stapling_get_issuer(modssl_ctx_t mctx, X509 *x) Link Here
106		74
107	}	75	}
108		76
109	int ssl_stapling_init_cert(server_rec s, modssl_ctx_t mctx, X509 *x)	77	int ssl_stapling_init_cert(server_rec s, modssl_ctx_t mctx, X509 x, apr_pool_t p)
110	{	78	{
111	certinfo *cinf;	79	certinfo *cinf;
112	X509 *issuer = NULL;	80	X509 *issuer = NULL;
Lines 114-134 int ssl_stapling_init_cert(server_rec s, modssl_ctx_t mctx, X509 *x) Link Here
114		82
115	if (x == NULL)	83	if (x == NULL)
116	return 0;	84	return 0;
117	cinf = X509_get_ex_data(x, stapling_ex_idx);	85
118	if (cinf) {	86	if (mctx->pks->stapling_cert_info) {
119	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02215)	87	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02215)
120	"ssl_stapling_init_cert: certificate already initialized!");	88	"ssl_stapling_init_cert: certificate already initialized!");
121	return 0;	89	return 0;
122	}	90	}
123	cinf = OPENSSL_malloc(sizeof(certinfo));	91	cinf = apr_pcalloc(p, sizeof(certinfo));
124	if (!cinf) {	92	if (!cinf) {
125	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02216)	93	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02216)
126	"ssl_stapling_init_cert: error allocating memory!");	94	"ssl_stapling_init_cert: error allocating memory!");
127	return 0;	95	return 0;
128	}	96	}
129	cinf->cid = NULL;	97	mctx->pks->stapling_cert_info = cinf;
130	cinf->uri = NULL;
131	X509_set_ex_data(x, stapling_ex_idx, cinf);
132		98
133	issuer = stapling_get_issuer(mctx, x);	99	issuer = stapling_get_issuer(mctx, x);
134		100
Lines 145-152 int ssl_stapling_init_cert(server_rec s, modssl_ctx_t mctx, X509 *x) Link Here
145	X509_digest(x, EVP_sha1(), cinf->idx, NULL);	111	X509_digest(x, EVP_sha1(), cinf->idx, NULL);
146		112
147	aia = X509_get1_ocsp(x);	113	aia = X509_get1_ocsp(x);
148	if (aia)	114	if (aia) {
149	cinf->uri = sk_OPENSSL_STRING_pop(aia);	115	/* Ugly: ensure memory managed by apr */
		116	char *uri;
		117	uri = sk_OPENSSL_STRING_pop(aia);
		118	cinf->uri = apr_pstrdup(p, uri);
		119	OPENSSL_free(uri);
		120	}
150	if (!cinf->uri && !mctx->stapling_force_url) {	121	if (!cinf->uri && !mctx->stapling_force_url) {
151	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02218)	122	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02218)
152	"ssl_stapling_init_cert: no responder URL");	123	"ssl_stapling_init_cert: no responder URL");
Lines 160-170 static certinfo stapling_get_cert_info(server_rec s, modssl_ctx_t *mctx, Link Here
160	SSL *ssl)	131	SSL *ssl)
161	{	132	{
162	certinfo *cinf;	133	certinfo *cinf;
163	X509 *x;	134	cinf = mctx->pks->stapling_cert_info;
164	x = SSL_get_certificate(ssl);
165	if (x == NULL)
166	return NULL;
167	cinf = X509_get_ex_data(x, stapling_ex_idx);
168	if (cinf && cinf->cid)	135	if (cinf && cinf->cid)
169	return cinf;	136	return cinf;
170	ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(01926)	137	ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(01926)
171	-