[openssl.org #3178] TLS status_request possibly not honored when SSL_set_SSL_CTX is called later on

[Kaspar Brand via RT]

In t1_lib.c:ssl_scan_clienthello_tlsext (or
t1_lib.c:ssl_parse_clienthello_tlsext for versions up to 1.0.1), a
status_request extension in the ClientHello is currently parsed after
this check:

  ...
  else if (type == TLSEXT_TYPE_status_request
           && s->ctx->tlsext_status_cb)
  ...

Checking for s->ctx->tlsext_status_cb at this place doesn't always have
the correct effect, however: if an application is changing the SSL_CTX
later on (with SSL_set_SSL_CTX), it's possible that the new SSL_CTX does
have a tlsext_status_cb callback set (i.e., is willing to process the
status_request).

The proper way to deal with this is to omit the check for
s->ctx->tlsext_status_cb at this point, IMO. I'm attaching a patch for
master/1.0.2 on the one hand and one for 1.0.1 and earlier on the other
hand.



diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -2277,8 +2277,7 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned 
char **p, unsigned char
                                return 0;
                                }
                        }
-               else if (type == TLSEXT_TYPE_status_request
-                        && s->ctx->tlsext_status_cb)
+               else if (type == TLSEXT_TYPE_status_request)
                        {
                
                        if (size < 5) 

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -1261,7 +1261,7 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char 
**p, unsigned char *d, in
                                }
                        }
                else if (type == TLSEXT_TYPE_status_request &&
-                        s->version != DTLS1_VERSION && 
s->ctx->tlsext_status_cb)
+                        s->version != DTLS1_VERSION)
                        {
                
                        if (size < 5)