ywkaras commented on code in PR #9591:
URL: https://github.com/apache/trafficserver/pull/9591#discussion_r1166221704
##########
iocore/net/OCSPStapling.cc:
##########
@@ -373,84 +516,84 @@ stapling_check_response(certinfo *cinf, OCSP_RESPONSE
*rsp)
}
static OCSP_RESPONSE *
-query_responder(BIO *b, const char *host, const char *path, const char
*user_agent, OCSP_REQUEST *req, int req_timeout)
+query_responder(const char *uri, const char *user_agent, OCSP_REQUEST *req,
int req_timeout)
{
ink_hrtime start, end;
OCSP_RESPONSE *resp = nullptr;
- OCSP_REQ_CTX *ctx;
- int rv;
start = Thread::get_hrtime();
end = ink_hrtime_add(start, ink_hrtime_from_sec(req_timeout));
- ctx = OCSP_sendreq_new(b, path, nullptr, -1);
- OCSP_REQ_CTX_add1_header(ctx, "Host", host);
- if (user_agent != nullptr) {
- OCSP_REQ_CTX_add1_header(ctx, "User-Agent", user_agent);
- }
- OCSP_REQ_CTX_set1_req(ctx, req);
+ HTTPRequest httpreq;
+ bool use_post = true;
- do {
- rv = OCSP_sendreq_nbio(&resp, ctx);
- ink_hrtime_sleep(HRTIME_MSECONDS(1));
- } while ((rv == -1) && BIO_should_retry(b) && (Thread::get_hrtime() < end));
+ httpreq.set_request_line(use_post, uri);
- OCSP_REQ_CTX_free(ctx);
+ // Host header
+ const char *host = strstr(uri, "://") + 3;
+ const char *slash = strchr(host, '/');
+ if (slash == nullptr) {
+ slash = host + strlen(host);
+ }
+ int host_len = slash - host;
+ httpreq.add_header("Host", 4, host, host_len);
- if (rv == 1) {
- return resp;
+ // User-Agent header
+ if (user_agent != nullptr) {
+ httpreq.add_header("User-Agent", user_agent);
}
- Error("failed to connect to OCSP server; host=%s path=%s", host, path);
+ // Content-Type, Content-Length, Request Body
+ if (use_post) {
+ if (httpreq.set_body("application/ocsp-request",
ASN1_ITEM_rptr(OCSP_REQUEST), (const ASN1_VALUE *)req) != 1) {
+ Error("failed to make a request for OCSP server; uri=%s", uri);
+ return nullptr;
+ }
+ }
- return nullptr;
-}
+ // Send request
+ eventProcessor.schedule_imm(&httpreq, ET_NET);
-static OCSP_RESPONSE *
-process_responder(OCSP_REQUEST *req, const char *host, const char *path, const
char *port, const char *user_agent, int req_timeout)
-{
- BIO *cbio = nullptr;
- OCSP_RESPONSE *resp = nullptr;
- cbio = BIO_new_connect(host);
- if (!cbio) {
- goto end;
- }
- if (port) {
- BIO_set_conn_port(cbio, port);
- }
+ // Wait until the request completes
+ do {
+ ink_hrtime_sleep(HRTIME_MSECONDS(1));
+ } while (!httpreq.is_done() && (Thread::get_hrtime() < end));
- BIO_set_nbio(cbio, 1);
- if (BIO_do_connect(cbio) <= 0 && !BIO_should_retry(cbio)) {
- Debug("ssl_ocsp", "process_responder: failed to connect to OCSP server;
host=%s port=%s path=%s", host, port, path);
- goto end;
- }
- resp = query_responder(cbio, host, path, user_agent, req, req_timeout);
+ if (httpreq.is_success()) {
+ // Parse the response
+ int len;
+ const unsigned char *res = httpreq.get_response_body(&len);
+ const unsigned char *p = res;
+ resp = reinterpret_cast<OCSP_RESPONSE
*>(ASN1_item_d2i(nullptr, &p, len, ASN1_ITEM_rptr(OCSP_RESPONSE)));
-end:
- if (cbio) {
- BIO_free_all(cbio);
+ if (resp) {
+ return resp;
+ }
Review Comment:
To check for garbage at the end of the response.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
