From: Matt Caswell <matt@openssl.org>
Date: Fri, 6 Apr 2018 13:33:07 +0000 (+0100)
Subject: Ignore the status_request extension in a resumption handshake
X-Git-Tag: OpenSSL_1_1_0i~185
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=af2d06d245cd97de891213bb4c9e0f4b6dbe3bfb;p=openssl

Ignore the status_request extension in a resumption handshake

We cannot provide a certificate status on a resumption so we should
ignore this extension in that case.

Fixes #1662

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/5897)
---

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index dc4e6526d6..5ba7377fe3 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -2156,6 +2156,10 @@ static int ssl_scan_clienthello_tlsext(SSL *s, PACKET *pkt, int *al)
                 }
             }
         } else if (type == TLSEXT_TYPE_status_request) {
+            /* Ignore this if resuming */
+            if (s->hit)
+                continue;
+
             if (!PACKET_get_1(&extension,
                               (unsigned int *)&s->tlsext_status_type)) {
                 return 0;