This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
commit 6d27c201dc8c410458e18d453881825264a07dca Author: Mark Thomas <[email protected]> AuthorDate: Sun Nov 8 12:07:23 2026 +0000 Apply the OCSP timeout to the connection to the OCSP responder The timeout was only set once the connection had been established, so the connection attempt was not limited by the configured OCSP timeout. Co-Authored-By: Claude Opus 5.5 <[email protected]> --- native/src/sslutils.c | 12 +++++++----- xdocs/miscellaneous/changelog.xml | 7 +++++++ 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/native/src/sslutils.c b/native/src/sslutils.c index ce3433eb6..a81b82702 100644 --- a/native/src/sslutils.c +++ b/native/src/sslutils.c @@ -728,9 +728,10 @@ static int add_ocsp_cert(OCSP_REQUEST *req, X509 *cert, X509 *issuer) /* Creates the APR socket and connect to the hostname. Returns the - socket or NULL if there is an error. + socket or NULL if there is an error. The timeout (in microseconds) + applies to the connection attempt as well as subsequent I/O. */ -static apr_socket_t *make_socket(char *hostname, int port, apr_pool_t *mp) +static apr_socket_t *make_socket(char *hostname, int port, int timeout, apr_pool_t *mp) { apr_sockaddr_t *sa_in; apr_status_t status; @@ -741,6 +742,9 @@ static apr_socket_t *make_socket(char *hostname, int port, apr_pool_t *mp) if (status == APR_SUCCESS) status = apr_socket_create(&sock, sa_in->family, SOCK_STREAM, APR_PROTO_TCP, mp); + /* Set the timeout before connecting so it also limits the connection attempt */ + if (status == APR_SUCCESS) + status = apr_socket_timeout_set(sock, timeout); if (status == APR_SUCCESS) status = apr_socket_connect(sock, sa_in); @@ -989,13 +993,11 @@ static OCSP_RESPONSE *get_ocsp_response(apr_pool_t *p, char *url, OCSP_REQUEST * } apr_pool_create(&mp, p); - apr_sock = make_socket(hostname, port, mp); + apr_sock = make_socket(hostname, port, timeout, mp); if (apr_sock == NULL) { goto free_bio; } - apr_socket_timeout_set(apr_sock, timeout); - ok = ocsp_send_req(apr_sock, bio_req); if (ok) { ocsp_resp = ocsp_get_resp(mp, apr_sock); diff --git a/xdocs/miscellaneous/changelog.xml b/xdocs/miscellaneous/changelog.xml index a997a8430..ed4cc123d 100644 --- a/xdocs/miscellaneous/changelog.xml +++ b/xdocs/miscellaneous/changelog.xml @@ -32,6 +32,13 @@ </p> </section> <section name="2.0.18" rtext="development in progress"> + <changelog> + <fix> + Ensure that the configured OCSP timeout also applies when connecting to + the OCSP responder. Previously, the timeout was only applied once the + connection had been established. (markt) + </fix> + </changelog> </section> <section name="2.0.17" rtext="2026-10-29"> <changelog> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
