From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 16 Sep 2026 07:42:35 +0000 (+0200)
Subject: BUG/MINOR: ssl/ocsp: Report an error when an empty OCSP response is received
X-Git-Tag: v3.5-dev8~180
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=f0284bea9b2688388926b54ad95e555a17977a3e;p=haproxy.git

BUG/MINOR: ssl/ocsp: Report an error when an empty OCSP response is received

When the response of the OCSP update request has no payload, no OCSP
response is loaded but a successful update is reported anyway. The number of
successes is incremented, the last update date is refreshed and the entry is
reinserted in the update tree with the regular delay, as if everything was
fine.

The "Content-Type" header of the response is already checked to be
"application/ocsp-response". So an empty payload is an error. It is now
reported as an OCSP response check failure.

This patch depends on:

  * "MINOR: ssl/ocsp: Remove the useless res_payload callback of the http-client".

It may be backported with it if needed.
---

diff --git a/src/ssl_ocsp.c b/src/ssl_ocsp.c
index fb918bf67..9191d5bdf 100644
--- a/src/ssl_ocsp.c
+++ b/src/ssl_ocsp.c
@@ -1287,17 +1287,22 @@ static struct task *ssl_ocsp_update_responses(struct task *task, void *context,
 		if (ctx->flags & HC_OCSP_RES_END) {
 
 			/* Process the body that must be complete since
-			 * HC_OCSP_RES_END is set. */
-			if (httpclient_data(hc)) {
-				if (ssl_ocsp_check_response(ocsp->chain, ocsp->issuer, &hc->res.buf, &err)) {
-					ctx->update_status = OCSP_UPDT_ERR_CHECK;
-					goto http_error;
-				}
+			 * HC_OCSP_RES_END is set. An empty payload is an
+			 * error, there is no OCSP response to load. */
+			if (!httpclient_data(hc)) {
+				memprintf(&err, "empty OCSP response");
+				ctx->update_status = OCSP_UPDT_ERR_CHECK;
+				goto http_error;
+			}
 
-				if (ssl_sock_update_ocsp_response(&hc->res.buf, &err) != 0) {
-					ctx->update_status = OCSP_UPDT_ERR_INSERT;
-					goto http_error;
-				}
+			if (ssl_ocsp_check_response(ocsp->chain, ocsp->issuer, &hc->res.buf, &err)) {
+				ctx->update_status = OCSP_UPDT_ERR_CHECK;
+				goto http_error;
+			}
+
+			if (ssl_sock_update_ocsp_response(&hc->res.buf, &err) != 0) {
+				ctx->update_status = OCSP_UPDT_ERR_INSERT;
+				goto http_error;
 			}
 
 			ctx->flags &= ~HC_OCSP_RES_END;