From: Remi Tricot-Le Breton <rlebreton@haproxy.com>
Date: Thu, 1 Oct 2026 14:59:24 +0000 (+0200)
Subject: MINOR: ocsp: Send OCSP response status back to caller
X-Git-Tag: v3.5-dev9~223
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=1b0c58ec08a5fb35dd7c9657c8b544bbfb0b415b;p=haproxy.git

MINOR: ocsp: Send OCSP response status back to caller

The 'ssl_sock_load_ocsp_response' function parses an OCSP response,
checks its status and it expiration times but it did not provide the
status anywhere, which will come to use in upcoming OCSP-related devs.
Now it returns the OCSP status to the caller.
---

diff --git a/include/haproxy/ssl_ocsp.h b/include/haproxy/ssl_ocsp.h
index e97dfd86b..3208107fc 100644
--- a/include/haproxy/ssl_ocsp.h
+++ b/include/haproxy/ssl_ocsp.h
@@ -40,7 +40,7 @@ void ssl_sock_free_ocsp_instance(struct certificate_ocsp *ocsp);
 
 int ssl_sock_load_ocsp_response(struct buffer *ocsp_response,
                                 struct certificate_ocsp *ocsp,
-                                OCSP_CERTID *cid, char **err);
+                                OCSP_CERTID *cid, int *status, char **err);
 int ssl_sock_update_ocsp_response(struct buffer *ocsp_response, char **err);
 void ssl_sock_ocsp_free_func(void *parent, void *ptr, CRYPTO_EX_DATA *ad, int idx, long argl, void *argp);
 
diff --git a/src/ssl_ocsp.c b/src/ssl_ocsp.c
index 1ed6eaf99..d2cda3c70 100644
--- a/src/ssl_ocsp.c
+++ b/src/ssl_ocsp.c
@@ -292,7 +292,7 @@ end:
  */
 int ssl_sock_load_ocsp_response(struct buffer *ocsp_response,
                                 struct certificate_ocsp *ocsp,
-                                OCSP_CERTID *cid, char **err)
+                                OCSP_CERTID *cid, int *status, char **err)
 {
 	OCSP_RESPONSE *resp;
 	OCSP_BASICRESP *bs = NULL;
@@ -309,6 +309,9 @@ int ssl_sock_load_ocsp_response(struct buffer *ocsp_response,
 	long expire = 0;
 #endif
 
+	if (status)
+		*status = V_OCSP_CERTSTATUS_UNKNOWN;
+
 	resp = d2i_OCSP_RESPONSE(NULL, (const unsigned char **)&p,
 				 ocsp_response->data);
 	if (!resp) {
@@ -343,6 +346,8 @@ int ssl_sock_load_ocsp_response(struct buffer *ocsp_response,
 	id = (OCSP_CERTID*)OCSP_SINGLERESP_get0_id(sr);
 
 	rc = OCSP_single_get0_status(sr, &reason, &revtime, &thisupd, &nextupd);
+	if (status)
+		*status = rc;
 	if (rc != V_OCSP_CERTSTATUS_GOOD && rc != V_OCSP_CERTSTATUS_REVOKED) {
 		memprintf(err, "OCSP single response: certificate status is unknown");
 		goto out;
@@ -450,7 +455,7 @@ out:
  */
 int ssl_sock_update_ocsp_response(struct buffer *ocsp_response, char **err)
 {
-	return ssl_sock_load_ocsp_response(ocsp_response, NULL, NULL, err);
+	return ssl_sock_load_ocsp_response(ocsp_response, NULL, NULL, NULL, err);
 }
 
 
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index dfa5cf0d5..8be1bf04d 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -1567,7 +1567,7 @@ static int ssl_sock_load_ocsp(const char *path, SSL_CTX *ctx, struct ckch_store
 	ret = 0;
 
 	warn = NULL;
-	if (data->ocsp_response && ssl_sock_load_ocsp_response(data->ocsp_response, iocsp, data->ocsp_cid, &warn)) {
+	if (data->ocsp_response && ssl_sock_load_ocsp_response(data->ocsp_response, iocsp, data->ocsp_cid, NULL, &warn)) {
 		memprintf(&warn, "Loading: %s. Content will be ignored", warn ? warn : "failure");
 		ha_warning("%s.\n", warn);
 	}