From 395365ad2d9a6c3f1a35d5e268a6af2824129832 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 27 Nov 2023 23:50:45 +0100
Subject: [PATCH] openssl: when a session-ID is reused, skip OCSP stapling

Fixes #12399
Reported-by: Alexey Larikov
Closes #12418
---
 lib/vtls/openssl.c  | 5 ++++-
 lib/vtls/vtls_int.h | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index f788c50cf7..8c8f43e836 100644
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -3796,6 +3796,7 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
 
   SSL_set_app_data(backend->handle, cf);
 
+  connssl->reused_session = FALSE;
   if(ssl_config->primary.sessionid) {
     Curl_ssl_sessionid_lock(data);
     if(!Curl_ssl_getsessionid(cf, data, &ssl_sessionid, NULL)) {
@@ -3809,6 +3810,7 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
       }
       /* Informational message */
       infof(data, "SSL reusing session ID");
+      connssl->reused_session = TRUE;
     }
     Curl_ssl_sessionid_unlock(data);
   }
@@ -4340,7 +4342,8 @@ static CURLcode servercert(struct Curl_cfilter *cf,
 
 #if (OPENSSL_VERSION_NUMBER >= 0x0090808fL) && !defined(OPENSSL_NO_TLSEXT) && \
   !defined(OPENSSL_NO_OCSP)
-  if(conn_config->verifystatus) {
+  if(conn_config->verifystatus && !connssl->reused_session) {
+    /* don't do this after Session ID reuse */
     result = verifystatus(cf, data);
     if(result) {
       X509_free(backend->server_cert);
diff --git a/lib/vtls/vtls_int.h b/lib/vtls/vtls_int.h
index cc5a357180..af7ae552ed 100644
--- a/lib/vtls/vtls_int.h
+++ b/lib/vtls/vtls_int.h
@@ -75,6 +75,7 @@ struct ssl_connect_data {
   struct curltime handshake_done;   /* time when handshake finished */
   int port;                         /* remote port at origin */
   BIT(use_alpn);                    /* if ALPN shall be used in handshake */
+  BIT(reused_session);              /* session-ID was reused for this */
 };