Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds user-agent to OCSP requests #8722

Merged
merged 1 commit into from
Mar 16, 2022
Merged

Adds user-agent to OCSP requests #8722

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 28 additions & 13 deletions iocore/net/OCSPStapling.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ struct certinfo {
OCSP_CERTID *cid; // Certificate ID for OCSP requests or nullptr if ID cannot be determined
char *uri; // Responder details
char *certname;
char *user_agent;
ink_mutex stapling_mutex;
unsigned char resp_der[MAX_STAPLING_DER];
unsigned int resp_derlen;
Expand All @@ -72,14 +73,18 @@ certinfo_map_free(void * /*parent*/, void *ptr, CRYPTO_EX_DATA * /*ad*/, int /*i
}

for (certinfo_map::iterator iter = map->begin(); iter != map->end(); ++iter) {
if (iter->second->uri) {
OPENSSL_free(iter->second->uri);
certinfo *cinf = iter->second;
if (cinf->uri) {
OPENSSL_free(cinf->uri);
}
if (iter->second->certname) {
ats_free(iter->second->certname);
if (cinf->certname) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ats_free() already checks for nullptr

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good to know. I'll make a follow up PR to clean all off those up!

ats_free(cinf->certname);
}
ink_mutex_destroy(&iter->second->stapling_mutex);
OPENSSL_free(iter->second);
if (cinf->user_agent) {
ats_free(cinf->user_agent);
}
ink_mutex_destroy(&cinf->stapling_mutex);
OPENSSL_free(cinf);
}
delete map;
}
Expand Down Expand Up @@ -211,9 +216,12 @@ ssl_stapling_init_cert(SSL_CTX *ctx, X509 *cert, const char *certname, const cha
}

// Initialize certinfo
cinf->cid = nullptr;
cinf->uri = nullptr;
cinf->certname = ats_strdup(certname);
cinf->cid = nullptr;
cinf->uri = nullptr;
cinf->certname = ats_strdup(certname);
if (SSLConfigParams::ssl_ocsp_user_agent != nullptr) {
cinf->user_agent = ats_strdup(SSLConfigParams::ssl_ocsp_user_agent);
}
cinf->resp_derlen = 0;
ink_mutex_init(&cinf->stapling_mutex);
cinf->is_prefetched = rsp_file ? true : false;
Expand Down Expand Up @@ -291,6 +299,10 @@ ssl_stapling_init_cert(SSL_CTX *ctx, X509 *cert, const char *certname, const cha
ats_free(cinf->certname);
}

if (cinf->user_agent) {
ats_free(cinf->user_agent);
}

if (cinf) {
OPENSSL_free(cinf);
}
Expand Down Expand Up @@ -368,7 +380,7 @@ stapling_check_response(certinfo *cinf, OCSP_RESPONSE *rsp)
}

static OCSP_RESPONSE *
query_responder(BIO *b, char *host, char *path, OCSP_REQUEST *req, int req_timeout)
query_responder(BIO *b, const char *host, const char *path, const char *user_agent, OCSP_REQUEST *req, int req_timeout)
{
ink_hrtime start, end;
OCSP_RESPONSE *resp = nullptr;
Expand All @@ -380,6 +392,9 @@ query_responder(BIO *b, char *host, char *path, OCSP_REQUEST *req, int req_timeo

ctx = OCSP_sendreq_new(b, path, nullptr, -1);
OCSP_REQ_CTX_add1_header(ctx, "Host", host);
if (user_agent != nullptr) {
OCSP_REQ_CTX_add1_header(ctx, "User-Agent", user_agent);
}
OCSP_REQ_CTX_set1_req(ctx, req);

do {
Expand All @@ -399,7 +414,7 @@ query_responder(BIO *b, char *host, char *path, OCSP_REQUEST *req, int req_timeo
}

static OCSP_RESPONSE *
process_responder(OCSP_REQUEST *req, char *host, char *path, char *port, int req_timeout)
process_responder(OCSP_REQUEST *req, const char *host, const char *path, const char *port, const char *user_agent, int req_timeout)
{
BIO *cbio = nullptr;
OCSP_RESPONSE *resp = nullptr;
Expand All @@ -416,7 +431,7 @@ process_responder(OCSP_REQUEST *req, char *host, char *path, char *port, int req
Debug("ssl_ocsp", "process_responder: failed to connect to OCSP server; host=%s port=%s path=%s", host, port, path);
goto end;
}
resp = query_responder(cbio, host, path, req, req_timeout);
resp = query_responder(cbio, host, path, user_agent, req, req_timeout);

end:
if (cbio) {
Expand Down Expand Up @@ -456,7 +471,7 @@ stapling_refresh_response(certinfo *cinf, OCSP_RESPONSE **prsp)
goto err;
}

*prsp = process_responder(req, host, path, port, SSLConfigParams::ssl_ocsp_request_timeout);
*prsp = process_responder(req, host, path, port, cinf->user_agent, SSLConfigParams::ssl_ocsp_request_timeout);
if (*prsp == nullptr) {
goto done;
}
Expand Down
1 change: 1 addition & 0 deletions iocore/net/P_SSLConfig.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,7 @@ struct SSLConfigParams : public ConfigInfo {
static int ssl_ocsp_update_period;
static int ssl_handshake_timeout_in;
char *ssl_ocsp_response_path_only;
static char *ssl_ocsp_user_agent;

static int origin_session_cache;
static size_t origin_session_cache_size;
Expand Down
2 changes: 2 additions & 0 deletions iocore/net/SSLConfig.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ bool SSLConfigParams::ssl_ocsp_enabled = false;
int SSLConfigParams::ssl_ocsp_cache_timeout = 3600;
int SSLConfigParams::ssl_ocsp_request_timeout = 10;
int SSLConfigParams::ssl_ocsp_update_period = 60;
char *SSLConfigParams::ssl_ocsp_user_agent = nullptr;
int SSLConfigParams::ssl_handshake_timeout_in = 0;
int SSLConfigParams::origin_session_cache = 1;
size_t SSLConfigParams::origin_session_cache_size = 10240;
Expand Down Expand Up @@ -363,6 +364,7 @@ SSLConfigParams::initialize()
REC_ReadConfigStringAlloc(ssl_ocsp_response_path, "proxy.config.ssl.ocsp.response.path");
set_paths_helper(ssl_ocsp_response_path, nullptr, &ssl_ocsp_response_path_only, nullptr);
ats_free(ssl_ocsp_response_path);
REC_ReadConfigStringAlloc(ssl_ocsp_user_agent, "proxy.config.http.request_via_str");

REC_ReadConfigInt32(ssl_handshake_timeout_in, "proxy.config.ssl.handshake_timeout_in");

Expand Down