commit ded4a83d31f8271e5a74e6fbf357f9975d4878ec
author Matt Caswell <matt@openssl.org> Fri Apr 06 14:53:05 2018 +0100
committer Matt Caswell <matt@openssl.org> Tue Apr 17 16:41:01 2018 +0100
tree 0c216d386113fde26a2e57e8ad03325c5879a1e2
parent a12de2cba83273b2a553f988716c231af7c9ba68

Ignore the status_request extension in a resumption handshake

We cannot provide a certificate status on a resumption so we should
ignore this extension in that case.

Fixes #1662

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/5896)

ssl/statem/extensions_srvr.c

diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c
index 90142eb..adf63d8 100644
--- a/ssl/statem/extensions_srvr.c
+++ b/ssl/statem/extensions_srvr.c
@@ -324,6 +324,10 @@
 {
     PACKET responder_id_list, exts;
 
+    /* We ignore this in a resumption handshake */
+    if (s->hit)
+        return 1;
+
     /* Not defined if we get one of these in a client Certificate */
     if (x != NULL)
         return 1;