From: Remi Tricot-Le Breton <rlebreton@haproxy.com>
Date: Thu, 1 Oct 2026 14:59:28 +0000 (+0200)
Subject: MINOR: ocsl: Add 'inapplicable' return code to client certificate ocsp check
X-Git-Tag: v3.5-dev9~219
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=b994ea92580b29d5a7dd20497d361485b7569b64;p=haproxy.git

MINOR: ocsl: Add 'inapplicable' return code to client certificate ocsp check

When no client certificate is provided or no ocsp uri is present in the
certificate, the "status-var" content of the "wait-for-ocsp" action will
be set to "inapplicable" instead of the "unknown" value (which is an
actual OCSP status that could be sent by the OCSP responder).
---

diff --git a/src/ssl_ocsp.c b/src/ssl_ocsp.c
index 4b8592457..e7355835a 100644
--- a/src/ssl_ocsp.c
+++ b/src/ssl_ocsp.c
@@ -2070,9 +2070,15 @@ static int ssl_ocsp_set_status_var(struct stream *s, struct session *sess, struc
 	struct buffer *value = get_trash_chunk();
 	struct ocsp_clt_check_ctx *ctx = s->ocsp_clt_check_ctx;
 
+	const char *cert_status = "unknown";
+
+	if (ctx)
+		cert_status = (ctx->state == OCSP_CLT_NO_OCSP) ? "inapplicable" :
+			OCSP_cert_status_str(ctx->ocsp_status);
+
 	smp_set_owner(&smp, sess->fe, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
 
-	if (chunk_printf(value, "%s", ctx ? OCSP_cert_status_str(ctx->ocsp_status) : "unknown") <= 0)
+	if (chunk_printf(value, "%s", cert_status) <= 0)
 		return 1;
 
 	smp.data.type = SMP_T_STR;