Attachment 1477662 Details for Bug 1393690 – httpd - introduce SSLOCSPProxyURL

[patch] httpd - introduce SSLOCSPProxyURL

httpd-2.4.6-r1733066.patch (text/plain), 6.46 KB, created by Rob Rozestraten on 2018-08-21 18:23:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rob Rozestraten

Created: 2018-08-21 18:23:09 UTC

Size: 6.46 KB

patch

obsolete

>https://svn.apache.org/viewvc?view=revision&revision=1733066
>https://bugzilla.redhat.com/show_bug.cgi?id=1393690
>
>Index: modules/ssl/mod_ssl.c
>===================================================================
>--- a/modules/ssl/mod_ssl.c
>+++ b/modules/ssl/mod_ssl.c
>@@ -239,6 +239,8 @@
>                 "Maximum age of OCSP responses")
>     SSL_CMD_SRV(OCSPResponderTimeout, TAKE1,
>                 "OCSP responder query timeout")
>+    SSL_CMD_SRV(OCSPProxyURL, TAKE1,
>+                "Proxy URL to use for OCSP requests")
> 
> #ifdef HAVE_OCSP_STAPLING
>     /*
>Index: modules/ssl/ssl_engine_config.c
>===================================================================
>--- a/modules/ssl/ssl_engine_config.c
>+++ b/modules/ssl/ssl_engine_config.c
>@@ -136,6 +136,7 @@
>     mctx->ocsp_resptime_skew  = UNSET;
>     mctx->ocsp_resp_maxage    = UNSET;
>     mctx->ocsp_responder_timeout = UNSET;
>+    mctx->proxy_uri              = NULL;
> 
> #ifdef HAVE_OCSP_STAPLING
>     mctx->stapling_enabled           = UNSET;
>@@ -270,6 +271,7 @@
>     cfgMergeInt(ocsp_resptime_skew);
>     cfgMergeInt(ocsp_resp_maxage);
>     cfgMergeInt(ocsp_responder_timeout);
>+    cfgMerge(proxy_uri, NULL);
> #ifdef HAVE_OCSP_STAPLING
>     cfgMergeBool(stapling_enabled);
>     cfgMergeInt(stapling_resptime_skew);
>@@ -1639,6 +1641,18 @@
>     return NULL;
> }
> 
>+const char *ssl_cmd_SSLOCSPProxyURL(cmd_parms *cmd, void *dcfg,
>+                                    const char *arg)
>+{
>+    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
>+    sc->server->proxy_uri = apr_palloc(cmd->pool, sizeof(apr_uri_t));
>+    if (apr_uri_parse(cmd->pool, arg, sc->server->proxy_uri) != APR_SUCCESS) {
>+        return apr_psprintf(cmd->pool,
>+                            "SSLOCSPProxyURL: Cannot parse URL %s", arg);
>+    }
>+    return NULL;
>+}
>+
> const char *ssl_cmd_SSLProxyCheckPeerExpire(cmd_parms *cmd, void *dcfg, int flag)
> {
>     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
>Index: modules/ssl/ssl_private.h
>===================================================================
>--- a/modules/ssl/ssl_private.h
>+++ b/modules/ssl/ssl_private.h
>@@ -675,6 +675,7 @@
>     long ocsp_resptime_skew;
>     long ocsp_resp_maxage;
>     apr_interval_time_t ocsp_responder_timeout;
>+    apr_uri_t *proxy_uri;
> 
> } modssl_ctx_t;
> 
>@@ -797,6 +798,7 @@
> const char *ssl_cmd_SSLOCSPResponseMaxAge(cmd_parms *cmd, void *dcfg, const char *arg);
> const char *ssl_cmd_SSLOCSPResponderTimeout(cmd_parms *cmd, void *dcfg, const char *arg);
> const char *ssl_cmd_SSLOCSPEnable(cmd_parms *cmd, void *dcfg, int flag);
>+const char *ssl_cmd_SSLOCSPProxyURL(cmd_parms *cmd, void *dcfg, const char *arg);
> 
> #ifndef OPENSSL_NO_SRP
> const char *ssl_cmd_SSLSRPVerifierFile(cmd_parms *cmd, void *dcfg, const char *arg);
>Index: modules/ssl/ssl_util_ocsp.c
>===================================================================
>--- a/modules/ssl/ssl_util_ocsp.c
>+++ b/modules/ssl/ssl_util_ocsp.c
>@@ -27,7 +27,8 @@
> 
> /* Serialize an OCSP request which will be sent to the responder at
>  * given URI to a memory BIO object, which is returned. */
>-static BIO *serialize_request(OCSP_REQUEST *req, const apr_uri_t *uri)
>+static BIO *serialize_request(OCSP_REQUEST *req, const apr_uri_t *uri,
>+                              const apr_uri_t *proxy_uri)
> {
>     BIO *bio;
>     int len;
>@@ -36,7 +37,13 @@
> 
>     bio = BIO_new(BIO_s_mem());
> 
>-    BIO_printf(bio, "POST %s%s%s HTTP/1.0\r\n"
>+    BIO_printf(bio, "POST ");
>+    /* Use full URL instead of URI in case of a request through a proxy */
>+    if (proxy_uri) {
>+        BIO_printf(bio, "http://%s:%d",
>+                   uri->hostname, uri->port);
>+    }
>+    BIO_printf(bio, "%s%s%s HTTP/1.0\r\n"
>                "Host: %s:%d\r\n"
>                "Content-Type: application/ocsp-request\r\n"
>                "Content-Length: %d\r\n"
>@@ -58,25 +65,38 @@
>  * NULL on error. */
> static apr_socket_t *send_request(BIO *request, const apr_uri_t *uri,
>                                   apr_interval_time_t timeout,
>-                                  conn_rec *c, apr_pool_t *p)
>+                                  conn_rec *c, apr_pool_t *p,
>+                                  const apr_uri_t *proxy_uri)
> {
>     apr_status_t rv;
>     apr_sockaddr_t *sa;
>     apr_socket_t *sd;
>     char buf[HUGE_STRING_LEN];
>     int len;
>+    const apr_uri_t *next_hop_uri;
>+
>+    if (proxy_uri) {
>+        next_hop_uri = proxy_uri;
>+    }
>+    else {
>+        next_hop_uri = uri;
>+    }
> 
>-    rv = apr_sockaddr_info_get(&sa, uri->hostname, APR_UNSPEC, uri->port, 0, p);
>+    rv = apr_sockaddr_info_get(&sa, next_hop_uri->hostname, APR_UNSPEC,
>+                               next_hop_uri->port, 0, p);
>     if (rv) {
>         ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, c, APLOGNO(01972)
>-                      "could not resolve address of OCSP responder %s",
>-                      uri->hostinfo);
>+                      "could not resolve address of %s %s",
>+                      proxy_uri ? "proxy" : "OCSP responder",
>+                      next_hop_uri->hostinfo);
>         return NULL;
>     }
> 
>     /* establish a connection to the OCSP responder */
>     ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(01973)
>-                  "connecting to OCSP responder '%s'", uri->hostinfo);
>+                  "connecting to %s '%s'",
>+                  proxy_uri ? "proxy" : "OCSP responder",
>+                  uri->hostinfo);
> 
>     /* Cycle through address until a connect() succeeds. */
>     for (; sa; sa = sa->next) {
>@@ -94,8 +114,9 @@
> 
>     if (sa == NULL) {
>         ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, c, APLOGNO(01974)
>-                      "could not connect to OCSP responder '%s'",
>-                      uri->hostinfo);
>+                      "could not connect to %s '%s'",
>+                      proxy_uri ? "proxy" : "OCSP responder",
>+                      next_hop_uri->hostinfo);
>         apr_socket_close(sd);
>         return NULL;
>     }
>@@ -290,8 +311,10 @@
>     OCSP_RESPONSE *response = NULL;
>     apr_socket_t *sd;
>     BIO *bio;
>+    const apr_uri_t *proxy_uri;
> 
>-    bio = serialize_request(request, uri);
>+    proxy_uri = (mySrvConfigFromConn(c))->server->proxy_uri;
>+    bio = serialize_request(request, uri, proxy_uri);
>     if (bio == NULL) {
>         ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01989)
>                       "could not serialize OCSP request");
>@@ -299,7 +322,7 @@
>         return NULL;
>     }
> 
>-    sd = send_request(bio, uri, timeout, c, p);
>+    sd = send_request(bio, uri, timeout, c, p, proxy_uri);
>     if (sd == NULL) {
>         /* Errors already logged. */
>         BIO_free(bio);

Actions: View | Diff

Attachments on bug 1393690: 1477662