From af2d06d245cd97de891213bb4c9e0f4b6dbe3bfb Mon Sep 17 00:00:00 2001
From: Matt Caswell <matt@openssl.org>
Date: Fri, 6 Apr 2018 14:33:07 +0100
Subject: [PATCH] Ignore the status_request extension in a resumption handshake
We cannot provide a certificate status on a resumption so we should
ignore this extension in that case.
Fixes #1662
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/5897)
---
ssl/t1_lib.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index dc4e6526d6..5ba7377fe3 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -2156,6 +2156,10 @@ static int ssl_scan_clienthello_tlsext(SSL *s, PACKET *pkt, int *al)
}
}
} else if (type == TLSEXT_TYPE_status_request) {
+ /* Ignore this if resuming */
+ if (s->hit)
+ continue;
+
if (!PACKET_get_1(&extension,
(unsigned int *)&s->tlsext_status_type)) {
return 0;
--
2.25.1