Mercurial > hg > nginx

changeset 6206:595b179e429f

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
OCSP stapling: fixed segfault without nextUpdate. OCSP responses may contain no nextUpdate. As per RFC 6960, this means that nextUpdate checks should be bypassed. Handle this gracefully by using NGX_MAX_TIME_T_VALUE as "valid" in such a case. The problem was introduced by 6893a1007a7c (1.9.2). Reported by Matthew Baldwin.
author Maxim Dounin <mdounin@mdounin.ru>
date Tue, 14 Jul 2015 01:10:25 +0300
parents dcae651b2a0c
children 8bd97db72074
files src/event/ngx_event_openssl_stapling.c
diffstat 1 files changed, 10 insertions(+), 5 deletions(-) [+]
line wrap: on
line diff
--- a/src/event/ngx_event_openssl_stapling.c
+++ b/src/event/ngx_event_openssl_stapling.c
@@ -637,11 +637,16 @@ ngx_ssl_stapling_ocsp_handler(ngx_ssl_oc
         goto error;
     }
 
-    valid = ngx_ssl_stapling_time(nextupdate);
-    if (valid == (time_t) NGX_ERROR) {
-        ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
-                      "invalid nextUpdate time in certificate status");
-        goto error;
+    if (nextupdate) {
+        valid = ngx_ssl_stapling_time(nextupdate);
+        if (valid == (time_t) NGX_ERROR) {
+            ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
+                          "invalid nextUpdate time in certificate status");
+            goto error;
+        }
+
+    } else {
+        valid = NGX_MAX_TIME_T_VALUE;
     }
 
     OCSP_CERTID_free(id);