Fail early if an ocep server returns a non-200 http response, there is no

point in trying to parse error pages as an ocsp response.

1 files changed, 4 insertions, 1 deletions

diff --git a/src/usr.sbin/ocspcheck/ocspcheck.c b/src/usr.sbin/ocspcheck/ocspcheck.c
index 5124d588b3..90a9143ee8 100644
--- a/src/usr.sbin/ocspcheck/ocspcheck.c
+++ b/src/usr.sbin/ocspcheck/ocspcheck.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ocspcheck.c,v 1.17 2017/02/25 23:48:08 beck Exp $ */
+/* $OpenBSD: ocspcheck.c,v 1.18 2017/03/27 18:14:20 beck Exp $ */
 /*
  * Copyright (c) 2017 Bob Beck <beck@openbsd.org>
  *
@@ -607,6 +607,9 @@ main(int argc, char **argv)
         if (hget->bodypartsz <= 0)
                 errx(1, "No body in reply from %s", host);
 
+        if (hget->code != 200)
+                errx(1, "http reply code %d from %s", hget->code, host);
+
         /*
          * Validate the OCSP response we got back
          */