MINOR: ocsp: Send OCSP response status back to caller

The 'ssl_sock_load_ocsp_response' function parses an OCSP response,
checks its status and it expiration times but it did not provide the
status anywhere, which will come to use in upcoming OCSP-related devs.
Now it returns the OCSP status to the caller.

diff --git a/include/haproxy/ssl_ocsp.h b/include/haproxy/ssl_ocsp.h
index e97dfd86b9649b5e4f5c2c1ef3bf9abe4128076c..3208107fc0ccdf78ffa48030140a12b4ae9c521a 100644 (file)
--- a/include/haproxy/ssl_ocsp.h
+++ b/include/haproxy/ssl_ocsp.h
@@ -40,7 +40,7 @@ void ssl_sock_free_ocsp_instance(struct certificate_ocsp *ocsp);
 
 int ssl_sock_load_ocsp_response(struct buffer *ocsp_response,
                                 struct certificate_ocsp *ocsp,
-                                OCSP_CERTID *cid, char **err);
+                                OCSP_CERTID *cid, int *status, char **err);
 int ssl_sock_update_ocsp_response(struct buffer *ocsp_response, char **err);
 void ssl_sock_ocsp_free_func(void *parent, void *ptr, CRYPTO_EX_DATA *ad, int idx, long argl, void *argp);
 

diff --git a/src/ssl_ocsp.c b/src/ssl_ocsp.c
index 1ed6eaf99aa9cd94a2f953fd40a8c2bb667e2fb4..d2cda3c708ed1ef247eb27cd775345792ca69bbd 100644 (file)
--- a/src/ssl_ocsp.c
+++ b/src/ssl_ocsp.c
@@ -292,7 +292,7 @@ end:
  */
 int ssl_sock_load_ocsp_response(struct buffer *ocsp_response,
                                 struct certificate_ocsp *ocsp,
-                                OCSP_CERTID *cid, char **err)
+                                OCSP_CERTID *cid, int *status, char **err)
 {
        OCSP_RESPONSE *resp;
        OCSP_BASICRESP *bs = NULL;
@@ -309,6 +309,9 @@ int ssl_sock_load_ocsp_response(struct buffer *ocsp_response,
        long expire = 0;
 #endif
 
+       if (status)
+               *status = V_OCSP_CERTSTATUS_UNKNOWN;
+
        resp = d2i_OCSP_RESPONSE(NULL, (const unsigned char **)&p,
                                 ocsp_response->data);
        if (!resp) {
@@ -343,6 +346,8 @@ int ssl_sock_load_ocsp_response(struct buffer *ocsp_response,
        id = (OCSP_CERTID*)OCSP_SINGLERESP_get0_id(sr);
 
        rc = OCSP_single_get0_status(sr, &reason, &revtime, &thisupd, &nextupd);
+       if (status)
+               *status = rc;
        if (rc != V_OCSP_CERTSTATUS_GOOD && rc != V_OCSP_CERTSTATUS_REVOKED) {
                memprintf(err, "OCSP single response: certificate status is unknown");
                goto out;
@@ -450,7 +455,7 @@ out:
  */
 int ssl_sock_update_ocsp_response(struct buffer *ocsp_response, char **err)
 {
-       return ssl_sock_load_ocsp_response(ocsp_response, NULL, NULL, err);
+       return ssl_sock_load_ocsp_response(ocsp_response, NULL, NULL, NULL, err);
 }
 
 

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index dfa5cf0d5f0229e4bf6e75a4adc4e75682aae1e8..8be1bf04d62234948f1984d85d32beefc1496956 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -1567,7 +1567,7 @@ static int ssl_sock_load_ocsp(const char *path, SSL_CTX *ctx, struct ckch_store
        ret = 0;
 
        warn = NULL;
-       if (data->ocsp_response && ssl_sock_load_ocsp_response(data->ocsp_response, iocsp, data->ocsp_cid, &warn)) {
+       if (data->ocsp_response && ssl_sock_load_ocsp_response(data->ocsp_response, iocsp, data->ocsp_cid, NULL, &warn)) {
                memprintf(&warn, "Loading: %s. Content will be ignored", warn ? warn : "failure");
                ha_warning("%s.\n", warn);
        }