Commit b1931d43 authored by Matt Caswell's avatar Matt Caswell
Browse files

Simplify calling of the OCSP callback 

Move all calls of the OCSP callback into one place, rather than repeating it
in two different places.

Reviewed-by: default avatarViktor Dukhovni <viktor@openssl.org>
parent 43c34894

ssl/statem/statem_clnt.c

+1 −1
Changes for ssl/statem/statem_clnt.c: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -2211,7 +2211,7 @@ MSG_PROCESS_RETURN tls_process_server_done(SSL *s, PACKET *pkt) 
     * |tlsext_ocsp_resplen| values will be set if we actually received a status

     * message, or NULL and -1 otherwise

     */

    if (s->tlsext_status_expected && s->ctx->tlsext_status_cb != NULL) {

    if (s->tlsext_status_type != -1 && s->ctx->tlsext_status_cb != NULL) {

        int ret;

        ret = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);

        if (ret == 0) {

ssl/t1_lib.c

+4 −21
Changes for ssl/t1_lib.c: 4 added lines, 21 removed lines.
Original line number Diff line number Diff line
@@ -2847,30 +2847,13 @@ int ssl_check_serverhello_tlsext(SSL *s) 
                                                       s->

                                                       initial_ctx->tlsext_servername_arg);



    /*

     * Ensure we get sensible values passed to tlsext_status_cb in the event

     * that we don't receive a status message

     */

    OPENSSL_free(s->tlsext_ocsp_resp);

    s->tlsext_ocsp_resp = NULL;

    s->tlsext_ocsp_resplen = -1;

    /*

     * If we've requested certificate status and we wont get one tell the

     * callback

     */

    if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)

        && !(s->hit) && s->ctx && s->ctx->tlsext_status_cb) {

        int r;

        /*

         * Call callback with resp == NULL and resplen == -1 so callback

         * knows there is no response

         */

        r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);

        if (r == 0) {

            al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;

            ret = SSL_TLSEXT_ERR_ALERT_FATAL;

        }

        if (r < 0) {

            al = SSL_AD_INTERNAL_ERROR;

            ret = SSL_TLSEXT_ERR_ALERT_FATAL;

        }

    }



    switch (ret) {

    case SSL_TLSEXT_ERR_ALERT_FATAL: