romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 00:13:34 +03:00
Code Issues Projects Releases Packages Wiki Activity

openssl: when a session-ID is reused, skip OCSP stapling

Browse source 
Fixes #12399
Reported-by: Alexey Larikov
Closes #12418
This commit is contained in:
Daniel Stenberg 2023-11-27 23:50:45 +01:00
parent 07a3cd83e0
commit 395365ad2d
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/vtls/openssl.c
View file

@ -3796,6 +3796,7 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
SSL_set_app_data(backend->handle, cf);
connssl->reused_session = FALSE;
if(ssl_config->primary.sessionid) {
Curl_ssl_sessionid_lock(data);
if(!Curl_ssl_getsessionid(cf, data, &ssl_sessionid, NULL)) {
@ -3809,6 +3810,7 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
}
/* Informational message */
infof(data, "SSL reusing session ID");
connssl->reused_session = TRUE;
}
Curl_ssl_sessionid_unlock(data);
}
@ -4340,7 +4342,8 @@ static CURLcode servercert(struct Curl_cfilter *cf,
#if (OPENSSL_VERSION_NUMBER >= 0x0090808fL) && !defined(OPENSSL_NO_TLSEXT) && \
!defined(OPENSSL_NO_OCSP)
if(conn_config->verifystatus) {
if(conn_config->verifystatus && !connssl->reused_session) {
/* don't do this after Session ID reuse */
result = verifystatus(cf, data);
if(result) {
X509_free(backend->server_cert);

1
lib/vtls/vtls_int.h
View file

@ -75,6 +75,7 @@ struct ssl_connect_data {
struct curltime handshake_done; /* time when handshake finished */
int port; /* remote port at origin */
BIT(use_alpn); /* if ALPN shall be used in handshake */
BIT(reused_session); /* session-ID was reused for this */
};