From 04e2ab2c02aebcfd3d6eab1ea6c0dbcaa9877cad Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Fri, 28 Sep 2007 17:45:11 +0000 Subject: [PATCH] Move no status notification to ssl_check_serverhello_tlsext() to ensure no status is notified even if no server extensions are present. --- ssl/t1_lib.c | 58 ++++++++++++++++++++++++++-------------------------- 1 file changed, 29 insertions(+), 29 deletions(-) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 476e4240e5..b0b5687c3b 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -992,35 +992,6 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in } } - /* If we've requested certificate status and we wont get one - * tell the callback - */ - if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected) - && s->ctx->tlsext_status_cb) - { - int r; - /* Set resp to NULL, resplen to -1 so callback knows - * there is no response. - */ - if (s->tlsext_ocsp_resp) - { - OPENSSL_free(s->tlsext_ocsp_resp); - s->tlsext_ocsp_resp = NULL; - } - s->tlsext_ocsp_resplen = -1; - r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg); - if (r == 0) - { - *al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE; - return 0; - } - if (r < 0) - { - *al = SSL_AD_INTERNAL_ERROR; - return 0; - } - } - *p = data; return 1; } @@ -1340,6 +1311,35 @@ int ssl_check_serverhello_tlsext(SSL *s) } #endif + /* If we've requested certificate status and we wont get one + * tell the callback + */ + if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected) + && s->ctx->tlsext_status_cb) + { + int r; + /* Set resp to NULL, resplen to -1 so callback knows + * there is no response. + */ + if (s->tlsext_ocsp_resp) + { + OPENSSL_free(s->tlsext_ocsp_resp); + s->tlsext_ocsp_resp = NULL; + } + s->tlsext_ocsp_resplen = -1; + r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg); + if (r == 0) + { + al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE; + ret = SSL_TLSEXT_ERR_ALERT_FATAL; + } + if (r < 0) + { + al = SSL_AD_INTERNAL_ERROR; + ret = SSL_TLSEXT_ERR_ALERT_FATAL; + } + } + switch (ret) { case SSL_TLSEXT_ERR_ALERT_FATAL: -- 2.25.1