Attachment #34248 for bug #46037

View | Details | Raw Unified | Return to bug 46037
Collapse All | Expand All

Lines 227-232 Link Here

(-)modules/ssl/mod_ssl.c (+6 lines)
227	"URL of the default OCSP Responder")	227	"URL of the default OCSP Responder")
228	SSL_CMD_SRV(OCSPOverrideResponder, FLAG,	228	SSL_CMD_SRV(OCSPOverrideResponder, FLAG,
229	"Force use of the default responder URL ('on', 'off')")	229	"Force use of the default responder URL ('on', 'off')")
		230
		231	/* Define OCSP Responder File Configuration Directive */
		232	SSL_CMD_SRV(OCSPResponderCertificateFile, TAKE1,
		233	"Trusted OCSP responder certificates"
		234	"(`/path/to/file' - PEM encoded certificates)")
		235
230	SSL_CMD_SRV(OCSPResponseTimeSkew, TAKE1,	236	SSL_CMD_SRV(OCSPResponseTimeSkew, TAKE1,
231	"Maximum time difference in OCSP responses")	237	"Maximum time difference in OCSP responses")
232	SSL_CMD_SRV(OCSPResponseMaxAge, TAKE1,	238	SSL_CMD_SRV(OCSPResponseMaxAge, TAKE1,

Lines 130-135 Link Here

(-)modules/ssl/ssl_engine_config.c (+29 lines)
130	mctx->ocsp_enabled = FALSE;	130	mctx->ocsp_enabled = FALSE;
131	mctx->ocsp_force_default = FALSE;	131	mctx->ocsp_force_default = FALSE;
132	mctx->ocsp_responder = NULL;	132	mctx->ocsp_responder = NULL;
		133
		134	/* Set OCSP Responder File variables */
		135	mctx->ocsp_verify_flags = 0;
		136	mctx->ocsp_certs_file = NULL;
		137	mctx->ocsp_certs = NULL;
		138
		139
133	mctx->ocsp_resptime_skew = UNSET;	140	mctx->ocsp_resptime_skew = UNSET;
134	mctx->ocsp_resp_maxage = UNSET;	141	mctx->ocsp_resp_maxage = UNSET;
135	mctx->ocsp_responder_timeout = UNSET;	142	mctx->ocsp_responder_timeout = UNSET;
Lines 273-278 Link Here
273	cfgMergeBool(ocsp_enabled);	280	cfgMergeBool(ocsp_enabled);
274	cfgMergeBool(ocsp_force_default);	281	cfgMergeBool(ocsp_force_default);
275	cfgMerge(ocsp_responder, NULL);	282	cfgMerge(ocsp_responder, NULL);
		283
		284	/* Set OCSP Responder File directive for importing */
		285	cfgMerge(ocsp_certs_file, NULL);
		286
276	cfgMergeInt(ocsp_resptime_skew);	287	cfgMergeInt(ocsp_resptime_skew);
277	cfgMergeInt(ocsp_resp_maxage);	288	cfgMergeInt(ocsp_resp_maxage);
278	cfgMergeInt(ocsp_responder_timeout);	289	cfgMergeInt(ocsp_responder_timeout);
Lines 1882-1887 Link Here
1882		1893
1883	#endif /* HAVE_SRP */	1894	#endif /* HAVE_SRP */
1884		1895
		1896	/* OCSP Responder File Function to read in value */
		1897	const char ssl_cmd_SSLOCSPResponderCertificateFile(cmd_parms cmd,
		1898	void *dcfg,
		1899	const char *arg)
		1900	{
		1901	SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
		1902	const char *err;
		1903
		1904	if ((err = ssl_cmd_check_file(cmd, &arg))) {
		1905	return err;
		1906	}
		1907
		1908	sc->server->ocsp_certs_file = arg;
		1909
		1910	return NULL;
		1911	}
		1912
		1913
1885	void ssl_hook_ConfigTest(apr_pool_t pconf, server_rec s)	1914	void ssl_hook_ConfigTest(apr_pool_t pconf, server_rec s)
1886	{	1915	{
1887	apr_file_t *out = NULL;	1916	apr_file_t *out = NULL;

Lines 1470-1475 Link Here

(-)modules/ssl/ssl_engine_init.c (+12 lines)
1470	!= APR_SUCCESS) {	1470	!= APR_SUCCESS) {
1471	return rv;	1471	return rv;
1472	}	1472	}
		1473
		1474	/* Initialize OCSP Responder certificate if OCSP enabled */
		1475	#ifndef OPENSSL_NO_OCSP
		1476	ssl_init_ocsp_certificates(s, sc->server);
		1477	#endif
		1478
1473	}	1479	}
1474		1480
1475	if (sc->proxy_enabled) {	1481	if (sc->proxy_enabled) {
Lines 1758-1763 Link Here
1758	ssl_init_ctx_cleanup_proxy(sc->proxy);	1764	ssl_init_ctx_cleanup_proxy(sc->proxy);
1759		1765
1760	ssl_init_ctx_cleanup(sc->server);	1766	ssl_init_ctx_cleanup(sc->server);
		1767
		1768	/* Not Sure but possibly clear X509 trusted cert file */
		1769	#ifndef OPENSSL_NO_OCSP
		1770	sk_X509_pop_free(sc->server->ocsp_certs, X509_free);
		1771	#endif
		1772
1761	}	1773	}
1762		1774
1763	free_dh_params();	1775	free_dh_params();

Lines 184-192 Link Here

(-)modules/ssl/ssl_engine_ocsp.c (-3 / +7 lines)
184		184
185	if (rc == V_OCSP_CERTSTATUS_GOOD) {	185	if (rc == V_OCSP_CERTSTATUS_GOOD) {
186	/* TODO: allow flags configuration. */	186	/* TODO: allow flags configuration. */
187	if (OCSP_basic_verify(basicResponse, NULL, ctx->ctx, 0) != 1) {	187
188	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01925)	188	/* Modify OCSP response verification to include OCSP Responder cert */
189	"failed to verify the OCSP response");	189	if (OCSP_basic_verify(basicResponse, sc->server->ocsp_certs, ctx->ctx,
		190	sc->server->ocsp_verify_flags) != 1) {
		191
		192	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01925)
		193	"failed to verify the OCSP response");
190	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, s);	194	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, s);
191	rc = V_OCSP_CERTSTATUS_UNKNOWN;	195	rc = V_OCSP_CERTSTATUS_UNKNOWN;
192	}	196	}

Lines 606-611 Link Here

(-)modules/ssl/ssl_private.h (+13 lines)
606	BOOL ocsp_force_default; /* true if the default responder URL is	606	BOOL ocsp_force_default; /* true if the default responder URL is
607	* used regardless of per-cert URL */	607	* used regardless of per-cert URL */
608	const char ocsp_responder; / default responder URL */	608	const char ocsp_responder; / default responder URL */
		609
		610	/* Declare variables for using OCSP Responder Certs for OCSP verification */
		611	int ocsp_verify_flags; /* Flags to use when verifying OCSP response */
		612	const char ocsp_certs_file; / OCSP other certificates filename */
		613	STACK_OF(X509) ocsp_certs; / OCSP other certificates */
		614
609	long ocsp_resptime_skew;	615	long ocsp_resptime_skew;
610	long ocsp_resp_maxage;	616	long ocsp_resp_maxage;
611	apr_interval_time_t ocsp_responder_timeout;	617	apr_interval_time_t ocsp_responder_timeout;
Lines 735-740 Link Here
735	const char ssl_cmd_SSLOCSPUseRequestNonce(cmd_parms cmd, void *dcfg, int flag);	741	const char ssl_cmd_SSLOCSPUseRequestNonce(cmd_parms cmd, void *dcfg, int flag);
736	const char ssl_cmd_SSLOCSPEnable(cmd_parms cmd, void *dcfg, int flag);	742	const char ssl_cmd_SSLOCSPEnable(cmd_parms cmd, void *dcfg, int flag);
737		743
		744	/* Declare OCSP Responder Certificate File Directive */
		745	const char ssl_cmd_SSLOCSPResponderCertificateFile(cmd_parms cmd, void dcfg, const char arg);
		746
738	#ifdef HAVE_SSL_CONF_CMD	747	#ifdef HAVE_SSL_CONF_CMD
739	const char ssl_cmd_SSLOpenSSLConfCmd(cmd_parms cmd, void dcfg, const char arg1, const char *arg2);	748	const char ssl_cmd_SSLOpenSSLConfCmd(cmd_parms cmd, void dcfg, const char arg1, const char *arg2);
740	#endif	749	#endif
Lines 931-936 Link Here
931	apr_interval_time_t timeout,	940	apr_interval_time_t timeout,
932	OCSP_REQUEST *request,	941	OCSP_REQUEST *request,
933	conn_rec c, apr_pool_t p);	942	conn_rec c, apr_pool_t p);
		943
		944	/* Initialize OCSP trusted certificate list */
		945	void ssl_init_ocsp_certificates(server_rec s, modssl_ctx_t mctx);
		946
934	#endif	947	#endif
935		948
936	/* Retrieve DH parameters for given key length. Return value should	949	/* Retrieve DH parameters for given key length. Return value should




    return response;
}

/*  _________________________________________________________________
**
**  OCSP other certificate support
**  _________________________________________________________________
*/

/*
 * Read a file that contains certificates in PEM format and
 * return as a STACK.
 */
static STACK_OF(X509) *modssl_read_ocsp_certificates(const char *file)
{
    BIO *bio;
    X509 *x509;
    unsigned long err;
    int n;
    STACK_OF(X509) *other_certs = NULL;

    if ((bio = BIO_new(BIO_s_file_internal())) == NULL)
        return NULL;
    if (BIO_read_filename(bio, file) <= 0) {
        BIO_free(bio);
        return NULL;
    }
    /* create new extra chain by loading the certs */
    while ((x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL)) != NULL) {
	if (!other_certs) {
		other_certs = sk_X509_new_null();
		if (!other_certs)
			return NULL;
	}
		
        if (!sk_X509_push(other_certs, x509)) {
            X509_free(x509);
            sk_X509_pop_free(other_certs, X509_free);
            BIO_free(bio);
            return NULL;
        }
    }
    /* Make sure that only the error is just an EOF */
    if ((err = ERR_peek_error()) > 0) {
        if (!(   ERR_GET_LIB(err) == ERR_LIB_PEM
              && ERR_GET_REASON(err) == PEM_R_NO_START_LINE)) {
            BIO_free(bio);
            sk_X509_pop_free(other_certs, X509_free);
            return NULL;
        }
        while (ERR_get_error() > 0) ;
    }
    BIO_free(bio);
    return other_certs;
}

void ssl_init_ocsp_certificates(server_rec *s, modssl_ctx_t *mctx)
{
    /*
     * Configure Trusted OCSP certificates.
     */

    if (!mctx->ocsp_certs_file) {
        return;
    }

    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
                 "Configuring Trusted OCSP certificates");

    mctx->ocsp_certs = modssl_read_ocsp_certificates(mctx->ocsp_certs_file);

    if (!mctx->ocsp_certs) {
        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
                "Unable to configure OCSP Trusted Certificates");
        ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, s);
        ssl_die(s);
    }
    mctx->ocsp_verify_flags |= OCSP_TRUSTOTHER;
}


#endif /* HAVE_OCSP */

Return to bug 46037

Lines 316-319 Link Here

(-)modules/ssl/ssl_util_ocsp.c (+78 lines)
316	return response;	316	return response;
317	}	317	}
318		318
		319	/* _________________________________________________________________
		320	**
		321	** OCSP other certificate support
		322	** _________________________________________________________________
		323	*/
		324
		325	/*
		326	* Read a file that contains certificates in PEM format and
		327	* return as a STACK.
		328	*/
		329	static STACK_OF(X509) modssl_read_ocsp_certificates(const char file)
		330	{
		331	BIO *bio;
		332	X509 *x509;
		333	unsigned long err;
		334	int n;
		335	STACK_OF(X509) *other_certs = NULL;
		336
		337	if ((bio = BIO_new(BIO_s_file_internal())) == NULL)
		338	return NULL;
		339	if (BIO_read_filename(bio, file) <= 0) {
		340	BIO_free(bio);
		341	return NULL;
		342	}
		343	/* create new extra chain by loading the certs */
		344	while ((x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL)) != NULL) {
		345	if (!other_certs) {
		346	other_certs = sk_X509_new_null();
		347	if (!other_certs)
		348	return NULL;
		349	}
		350
		351	if (!sk_X509_push(other_certs, x509)) {
		352	X509_free(x509);
		353	sk_X509_pop_free(other_certs, X509_free);
		354	BIO_free(bio);
		355	return NULL;
		356	}
		357	}
		358	/* Make sure that only the error is just an EOF */
		359	if ((err = ERR_peek_error()) > 0) {
		360	if (!( ERR_GET_LIB(err) == ERR_LIB_PEM
		361	&& ERR_GET_REASON(err) == PEM_R_NO_START_LINE)) {
		362	BIO_free(bio);
		363	sk_X509_pop_free(other_certs, X509_free);
		364	return NULL;
		365	}
		366	while (ERR_get_error() > 0) ;
		367	}
		368	BIO_free(bio);
		369	return other_certs;
		370	}
		371
		372	void ssl_init_ocsp_certificates(server_rec s, modssl_ctx_t mctx)
		373	{
		374	/*
		375	* Configure Trusted OCSP certificates.
		376	*/
		377
		378	if (!mctx->ocsp_certs_file) {
		379	return;
		380	}
		381
		382	ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
383	"Configuring Trusted OCSP certificates");
384
385	mctx->ocsp_certs = modssl_read_ocsp_certificates(mctx->ocsp_certs_file);
386
387	if (!mctx->ocsp_certs) {
388	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
389	"Unable to configure OCSP Trusted Certificates");
390	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, s);
391	ssl_die(s);
392	}
393	mctx->ocsp_verify_flags \|= OCSP_TRUSTOTHER;
394	}
395
396
319	#endif /* HAVE_OCSP */	397	#endif /* HAVE_OCSP */