romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-03 14:30:29 +03:00
Code Issues Projects Releases Packages Wiki Activity

sectrust: fail on missing OCSP stapling

Browse source 
When using Apple SecTrust, requiring the server to send
an OCSP response and does not, fail correctly.

Reported-by: Carlos Carrillo
Closes #21444
This commit is contained in:
Stefan Eissing 2026-04-25 10:34:06 +02:00 • committed by Daniel Stenberg
parent 024c73dfa1
commit 51905671e0
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
lib/vtls/openssl.c
View file

@ -4703,16 +4703,26 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf,
unsigned char *ocsp_data = NULL;
#endif
long ocsp_len = 0;
bool ocsp_missing = FALSE;
if(conn_config->verifystatus && !octx->reused_session)
ocsp_len = (long)SSL_get_tlsext_status_ocsp_resp(octx->ssl, &ocsp_data);
/* SSL_get_tlsext_status_ocsp_resp() returns the length of the OCSP
response data or -1 if there is no OCSP response data. */
if(ocsp_len < 0)
if(ocsp_len < 0) {
ocsp_len = 0; /* no data available */
ocsp_missing = TRUE;
}
result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs,
ossl_chain_get_der, &chain,
ocsp_data, ocsp_len);
if(!result && ocsp_missing && conn_config->verifystatus &&
!octx->reused_session) {
/* verified, but OCSP stapling is required and server sent none */
*pverified = TRUE;
failf(data, "No OCSP response received");
return CURLE_SSL_INVALIDCERTSTATUS;
}
}
*pverified = !result;
return result;