MINOR: ocsl: Add 'inapplicable' return code to client certificate ocsp check

When no client certificate is provided or no ocsp uri is present in the
certificate, the "status-var" content of the "wait-for-ocsp" action will
be set to "inapplicable" instead of the "unknown" value (which is an
actual OCSP status that could be sent by the OCSP responder).

diff --git a/src/ssl_ocsp.c b/src/ssl_ocsp.c
index 4b859245757dfddb287117ea6d75add2b57688bf..e7355835aa06b980e69ea783f00f78573b550fc2 100644 (file)
--- a/src/ssl_ocsp.c
+++ b/src/ssl_ocsp.c
@@ -2070,9 +2070,15 @@ static int ssl_ocsp_set_status_var(struct stream *s, struct session *sess, struc
        struct buffer *value = get_trash_chunk();
        struct ocsp_clt_check_ctx *ctx = s->ocsp_clt_check_ctx;
 
+       const char *cert_status = "unknown";
+
+       if (ctx)
+               cert_status = (ctx->state == OCSP_CLT_NO_OCSP) ? "inapplicable" :
+                       OCSP_cert_status_str(ctx->ocsp_status);
+
        smp_set_owner(&smp, sess->fe, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
 
-       if (chunk_printf(value, "%s", ctx ? OCSP_cert_status_str(ctx->ocsp_status) : "unknown") <= 0)
+       if (chunk_printf(value, "%s", cert_status) <= 0)
                return 1;
 
        smp.data.type = SMP_T_STR;