www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-08 15:02:10 +03:00
Code Activity

ssl_stapling_init_cert: do not return success when no responder URI is found

Browse Source 
stapling_renew_response: abort early (before apr_uri_parse) if ocspuri is empty


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1588853 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Kaspar Brand
2014-04-21 06:54:41 +00:00
parent 053a9e569a
commit afe9fee88c
2 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
modules/ssl/ssl_util_stapling.c
View File

@@ -145,14 +145,15 @@ int ssl_stapling_init_cert(server_rec *s, modssl_ctx_t *mctx, X509 *x)
X509_digest(x, EVP_sha1(), cinf->idx, NULL);
aia = X509_get1_ocsp(x);
if (aia)
if (aia) {
cinf->uri = sk_OPENSSL_STRING_pop(aia);
X509_email_free(aia);
}
if (!cinf->uri && !mctx->stapling_force_url) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02218)
"ssl_stapling_init_cert: no responder URL");
return 0;
}
if (aia)
X509_email_free(aia);
return 1;
}
@@ -403,6 +404,13 @@ static BOOL stapling_renew_response(server_rec *s, modssl_ctx_t *mctx, SSL *ssl,
else
ocspuri = cinf->uri;
if (!ocspuri) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02621)
"stapling_renew_response: no uri for responder");
rv = FALSE;
goto done;
}
/* Create a temporary pool to constrain memory use */
apr_pool_create(&vpool, conn->pool);