BUG/MINOR: ssl/ocsp: Report an error when an empty OCSP response is received

When the response of the OCSP update request has no payload, no OCSP
response is loaded but a successful update is reported anyway. The number of
successes is incremented, the last update date is refreshed and the entry is
reinserted in the update tree with the regular delay, as if everything was
fine.

The "Content-Type" header of the response is already checked to be
"application/ocsp-response". So an empty payload is an error. It is now
reported as an OCSP response check failure.

This patch depends on:

  * "MINOR: ssl/ocsp: Remove the useless res_payload callback of the http-client".

It may be backported with it if needed.

diff --git a/src/ssl_ocsp.c b/src/ssl_ocsp.c
index fb918bf679e5beaa2fa1e125b1c12ab933abba3d..9191d5bdfab3e8caf7fe29d050dadca5826f7e67 100644 (file)
--- a/src/ssl_ocsp.c
+++ b/src/ssl_ocsp.c
@@ -1287,17 +1287,22 @@ static struct task *ssl_ocsp_update_responses(struct task *task, void *context,
                if (ctx->flags & HC_OCSP_RES_END) {
 
                        /* Process the body that must be complete since
-                        * HC_OCSP_RES_END is set. */
-                       if (httpclient_data(hc)) {
-                               if (ssl_ocsp_check_response(ocsp->chain, ocsp->issuer, &hc->res.buf, &err)) {
-                                       ctx->update_status = OCSP_UPDT_ERR_CHECK;
-                                       goto http_error;
-                               }
+                        * HC_OCSP_RES_END is set. An empty payload is an
+                        * error, there is no OCSP response to load. */
+                       if (!httpclient_data(hc)) {
+                               memprintf(&err, "empty OCSP response");
+                               ctx->update_status = OCSP_UPDT_ERR_CHECK;
+                               goto http_error;
+                       }
 
-                               if (ssl_sock_update_ocsp_response(&hc->res.buf, &err) != 0) {
-                                       ctx->update_status = OCSP_UPDT_ERR_INSERT;
-                                       goto http_error;
-                               }
+                       if (ssl_ocsp_check_response(ocsp->chain, ocsp->issuer, &hc->res.buf, &err)) {
+                               ctx->update_status = OCSP_UPDT_ERR_CHECK;
+                               goto http_error;
+                       }
+
+                       if (ssl_sock_update_ocsp_response(&hc->res.buf, &err) != 0) {
+                               ctx->update_status = OCSP_UPDT_ERR_INSERT;
+                               goto http_error;
                        }
 
                        ctx->flags &= ~HC_OCSP_RES_END;