romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 01:33:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

gtls: fix OCSP stapling management

Browse source 
Reported-by: Hiroki Kurosawa
Closes #14642
This commit is contained in:
Daniel Stenberg 2024-08-20 16:14:39 +02:00
parent c730c8549b
commit aeb1a281ca
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 94 additions and 94 deletions
Download patch file Download diff file Expand all files Collapse all files

16
lib/vtls/gtls.c
View file

@ -850,6 +850,13 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
init_flags |= GNUTLS_NO_TICKETS; init_flags |= GNUTLS_NO_TICKETS;
#endif #endif
#if defined(GNUTLS_NO_STATUS_REQUEST)
if(!config->verifystatus)
/* Disable the "status_request" TLS extension, enabled by default since
GnuTLS 3.8.0. */
init_flags |= GNUTLS_NO_STATUS_REQUEST;
#endif
rc = gnutls_init(&gtls->session, init_flags); rc = gnutls_init(&gtls->session, init_flags);
if(rc != GNUTLS_E_SUCCESS) { if(rc != GNUTLS_E_SUCCESS) {
failf(data, "gnutls_init() failed: %d", rc); failf(data, "gnutls_init() failed: %d", rc);
@ -1321,17 +1328,13 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
infof(data, " server certificate verification SKIPPED"); infof(data, " server certificate verification SKIPPED");
if(config->verifystatus) { if(config->verifystatus) {
if(gnutls_ocsp_status_request_is_checked(session, 0) == 0) {
gnutls_datum_t status_request; gnutls_datum_t status_request;
gnutls_ocsp_resp_t ocsp_resp; gnutls_ocsp_resp_t ocsp_resp;
gnutls_ocsp_cert_status_t status; gnutls_ocsp_cert_status_t status;
gnutls_x509_crl_reason_t reason; gnutls_x509_crl_reason_t reason;
rc = gnutls_ocsp_status_request_get(session, &status_request); rc = gnutls_ocsp_status_request_get(session, &status_request);
infof(data, " server certificate status verification FAILED");
if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
failf(data, "No OCSP response received"); failf(data, "No OCSP response received");
return CURLE_SSL_INVALIDCERTSTATUS; return CURLE_SSL_INVALIDCERTSTATUS;
@ -1414,12 +1417,9 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
} }
gnutls_ocsp_resp_deinit(ocsp_resp); gnutls_ocsp_resp_deinit(ocsp_resp);
if(status != GNUTLS_OCSP_CERT_GOOD)
return CURLE_SSL_INVALIDCERTSTATUS; return CURLE_SSL_INVALIDCERTSTATUS;
} }
else
infof(data, " server certificate status verification OK");
}
else else
infof(data, " server certificate status verification SKIPPED"); infof(data, " server certificate status verification SKIPPED");