From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Fri, 30 Mar 2018 08:26:55 +0000 (+0100)
Subject: Minor fixes to OCSP code
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d51534c3dcd8c2a548c17ce0283ee50bf8e88d30;p=thirdparty%2Ffreeradius-server.git

Minor fixes to OCSP code
---

diff --git a/src/lib/tls/validate.c b/src/lib/tls/validate.c
index f73d5366bf4..665346724b9 100644
--- a/src/lib/tls/validate.c
+++ b/src/lib/tls/validate.c
@@ -75,9 +75,6 @@ int tls_validate_cert_cb(int ok, X509_STORE_CTX *x509_ctx)
 
 	char const	**identity_p;
 	char const	*identity = NULL;
-#ifdef HAVE_OPENSSL_OCSP_H
-	X509		*issuer_cert;
-#endif
 
 	char		subject[1024];
 	char		common_name[1024];
@@ -323,12 +320,17 @@ int tls_validate_cert_cb(int ok, X509_STORE_CTX *x509_ctx)
 	 *	Fixme: Do we want to store the matching TLS-Client-cert-Filename?
 	 */
 	if (my_ok && conf->ocsp.enable){
+		X509	*issuer_cert;
+
 		RDEBUG2("Starting OCSP Request");
-		issuer_cert = X509_STORE_CTX_get0_current_issuer(x509_ctx);
-		if (issuer_cert == NULL) {
-			RDEBUG("Couldn't get issuer_cert for %s", common_name);
-		}
 
+		/*
+		 *	If we don't have an issuer, then we can't send
+		 *	and OCSP request, but pass the NULL issuer in
+		 *	so tls_ocsp_check can decide on the correct
+		 *	return code.
+		 */
+		issuer_cert = X509_STORE_CTX_get0_current_issuer(x509_ctx);
 		my_ok = tls_ocsp_check(request, ssl, conf->ocsp.store, issuer_cert, cert, &(conf->ocsp), false);
 	}
 #endif