From 3f8e7d01326e930f1851b532eaa2104ae38563b2 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Sun, 18 Oct 2020 09:11:50 +0500 Subject: [PATCH] BUG/MINOR: disable dynamic OCSP load with BoringSSL it was accidently enabled on BoringSSL while actually it is not supported wla: Fix part of the issue mentionned in #895. It fixes build of boringSSL versions prior to commit https://boringssl.googlesource.com/boringssl/+/49e9f67d8b7cbeb3953b5548ad1009d15947a523 Could be backported in 2.2, 2.1, 2.0, 1.8. Where the patch fcb69d7 ("BUILD: ssl: make BoringSSL use its own version numbers") is also relevant. Signed-off-by: William Lallemand (cherry picked from commit b3201a3e077198b3f75ebe8661aa45589b811552) Signed-off-by: William Lallemand --- src/ssl_sock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ssl_sock.c b/src/ssl_sock.c index a40e8b6..0f57517 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -1221,7 +1221,7 @@ int ssl_sock_ocsp_stapling_cbk(SSL *ssl, void *arg) #endif -#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL) +#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) && !defined OPENSSL_IS_BORINGSSL) /* @@ -3493,7 +3493,7 @@ static int ssl_sock_put_ckch_into_ctx(const char *path, const struct cert_key_an } #endif -#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL) +#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) && !defined OPENSSL_IS_BORINGSSL) /* Load OCSP Info into context */ if (ckch->ocsp_response) { if (ssl_sock_load_ocsp(ctx, ckch) < 0) { -- 1.7.10.4