|
 |
356046f |
# ./pullrev.sh 1876548
|
|
|
356046f |
http://svn.apache.org/viewvc?view=revision&revision=1876548
|
|
|
356046f |
|
|
|
356046f |
--- httpd-2.4.43/modules/ssl/ssl_util_stapling.c
|
|
|
356046f |
+++ httpd-2.4.43/modules/ssl/ssl_util_stapling.c
|
|
|
356046f |
@@ -130,6 +130,7 @@
|
|
|
356046f |
X509 *issuer = NULL;
|
|
|
356046f |
OCSP_CERTID *cid = NULL;
|
|
|
356046f |
STACK_OF(OPENSSL_STRING) *aia = NULL;
|
|
|
356046f |
+ int rv = 1; /* until further notice */
|
|
|
356046f |
|
|
|
356046f |
if (x == NULL)
|
|
|
356046f |
return 0;
|
|
|
356046f |
@@ -154,16 +155,18 @@
|
|
|
356046f |
SSL_CTX_set_tlsext_status_cb(mctx->ssl_ctx, stapling_cb);
|
|
|
356046f |
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(10177) "OCSP stapling added via hook");
|
|
|
356046f |
}
|
|
|
356046f |
- return 1;
|
|
|
356046f |
+ goto cleanup;
|
|
|
356046f |
}
|
|
|
356046f |
|
|
|
356046f |
if (mctx->stapling_enabled != TRUE) {
|
|
|
356046f |
/* mod_ssl's own implementation is not enabled */
|
|
|
356046f |
- return 1;
|
|
|
356046f |
+ goto cleanup;
|
|
|
356046f |
}
|
|
|
356046f |
|
|
|
356046f |
- if (X509_digest(x, EVP_sha1(), idx, NULL) != 1)
|
|
|
356046f |
- return 0;
|
|
|
356046f |
+ if (X509_digest(x, EVP_sha1(), idx, NULL) != 1) {
|
|
|
356046f |
+ rv = 0;
|
|
|
356046f |
+ goto cleanup;
|
|
|
356046f |
+ }
|
|
|
356046f |
|
|
|
356046f |
cinf = apr_hash_get(stapling_certinfo, idx, sizeof(idx));
|
|
|
356046f |
if (cinf) {
|
|
|
356046f |
@@ -177,18 +180,18 @@
|
|
|
356046f |
APLOGNO(02814) "ssl_stapling_init_cert: no OCSP URI "
|
|
|
356046f |
"in certificate and no SSLStaplingForceURL "
|
|
|
356046f |
"configured for server %s", mctx->sc->vhost_id);
|
|
|
356046f |
- return 0;
|
|
|
356046f |
+ rv = 0;
|
|
|
356046f |
}
|
|
|
356046f |
- return 1;
|
|
|
356046f |
+ goto cleanup;
|
|
|
356046f |
}
|
|
|
356046f |
|
|
|
356046f |
cid = OCSP_cert_to_id(NULL, x, issuer);
|
|
|
356046f |
- X509_free(issuer);
|
|
|
356046f |
if (!cid) {
|
|
|
356046f |
ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x, APLOGNO(02815)
|
|
|
356046f |
"ssl_stapling_init_cert: can't create CertID "
|
|
|
356046f |
"for OCSP request");
|
|
|
356046f |
- return 0;
|
|
|
356046f |
+ rv = 0;
|
|
|
356046f |
+ goto cleanup;
|
|
|
356046f |
}
|
|
|
356046f |
|
|
|
356046f |
aia = X509_get1_ocsp(x);
|
|
|
356046f |
@@ -197,7 +200,8 @@
|
|
|
356046f |
ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x,
|
|
|
356046f |
APLOGNO(02218) "ssl_stapling_init_cert: no OCSP URI "
|
|
|
356046f |
"in certificate and no SSLStaplingForceURL set");
|
|
|
356046f |
- return 0;
|
|
|
356046f |
+ rv = 0;
|
|
|
356046f |
+ goto cleanup;
|
|
|
356046f |
}
|
|
|
356046f |
|
|
|
356046f |
/* At this point, we have determined that there's something to store */
|
|
|
356046f |
@@ -218,8 +222,10 @@
|
|
|
356046f |
mctx->sc->vhost_id);
|
|
|
356046f |
|
|
|
356046f |
apr_hash_set(stapling_certinfo, cinf->idx, sizeof(cinf->idx), cinf);
|
|
|
356046f |
-
|
|
|
356046f |
- return 1;
|
|
|
356046f |
+
|
|
|
356046f |
+cleanup:
|
|
|
356046f |
+ X509_free(issuer);
|
|
|
356046f |
+ return rv;
|
|
|
356046f |
}
|
|
|
356046f |
|
|
|
356046f |
static certinfo *stapling_get_certinfo(server_rec *s, X509 *x, modssl_ctx_t *mctx,
|