Skip to content

Commit 6e953e4

Browse files
SparkiDevSparkiDev
authored
Merge pull request #7044 from julek-wolfssl/zd/17137
ocsp: don't error out if we can't verify our certificate
2 parents 1aed438 + 51ba745 commit 6e953e4

4 files changed

Lines changed: 135 additions & 23 deletions

File tree

‎scripts/ocsp-stapling.test‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -243,16 +243,18 @@ else
243243
OPENSSL_RESULT=$?
244244
echo "$OPENSSL_OUTPUT"
245245
fgrep -q 'self signed certificate in certificate chain' <<< "$OPENSSL_OUTPUT"
246-
FGREP_RESULT=$?
247-
if [ $OPENSSL_RESULT -eq 0 -a $FGREP_RESULT -ne 0 ]; then
246+
FGREP1_RESULT=$?
247+
fgrep -q 'self-signed certificate in certificate chain' <<< "$OPENSSL_OUTPUT"
248+
FGREP2_RESULT=$?
249+
if [ $OPENSSL_RESULT -eq 0 -a $FGREP1_RESULT -ne 0 -a $FGREP2_RESULT -ne 0 ]; then
248250
printf '%s\n' "Expected verification error from s_client is missing."
249251
remove_single_rF "$ready_file"
250252
exit 1
251253
fi
252254
remove_single_rF "$ready_file"
253255
wait $wolf_pid
254-
if [ $? -ne 1 ]; then
255-
printf '%s\n' "wolfSSL server unexpected fail value"
256+
if [ $? -ne 0 ]; then
257+
printf '%s\n' "wolfSSL server unexpected fail"
256258
exit 1
257259
fi
258260
fi

‎src/internal.c‎

Lines changed: 27 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -15972,43 +15972,44 @@ static int SanityCheckMsgReceived(WOLFSSL* ssl, byte type)
1597215972
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
1597315973
return OUT_OF_ORDER_E;
1597415974
}
15975+
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) || \
15976+
defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
1597515977
if (ssl->msgsReceived.got_certificate_status == 0) {
15978+
int csrRet = 0;
1597615979
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
15977-
if (ssl->status_request) {
15978-
int ret;
15979-
15980+
if (csrRet == 0 && ssl->status_request) {
1598015981
WOLFSSL_MSG("No CertificateStatus before ServerKeyExchange");
15981-
if ((ret = TLSX_CSR_ForceRequest(ssl)) != 0)
15982-
return ret;
15982+
csrRet = TLSX_CSR_ForceRequest(ssl);
1598315983
}
1598415984
#endif
1598515985
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
15986-
if (ssl->status_request_v2) {
15987-
int ret;
15988-
15986+
if (csrRet == 0 && ssl->status_request_v2) {
1598915987
WOLFSSL_MSG("No CertificateStatus before ServerKeyExchange");
15990-
if ((ret = TLSX_CSR2_ForceRequest(ssl)) != 0)
15991-
return ret;
15988+
csrRet = TLSX_CSR2_ForceRequest(ssl);
1599215989
}
1599315990
#endif
15994-
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) || \
15995-
defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
15991+
if (csrRet != 0) {
15992+
/* Error out if OCSP lookups are enabled and failed or if
15993+
* the user requires stapling. */
15994+
if (SSL_CM(ssl)->ocspEnabled || SSL_CM(ssl)->ocspMustStaple)
15995+
return csrRet;
15996+
}
1599615997
/* Check that a status request extension was seen as the
1599715998
* CertificateStatus wasn't when an OCSP staple is required.
1599815999
*/
1599916000
if (
16000-
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
16001+
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
1600116002
!ssl->status_request &&
16002-
#endif
16003-
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
16003+
#endif
16004+
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
1600416005
!ssl->status_request_v2 &&
16005-
#endif
16006+
#endif
1600616007
SSL_CM(ssl)->ocspMustStaple) {
1600716008
WOLFSSL_ERROR_VERBOSE(OCSP_CERT_UNKNOWN);
1600816009
return OCSP_CERT_UNKNOWN;
1600916010
}
16010-
#endif
1601116011
}
16012+
#endif
1601216013

1601316014
break;
1601416015
#endif
@@ -23298,8 +23299,12 @@ int SendCertificateStatus(WOLFSSL* ssl)
2329823299

2329923300
if (ret == 0 && response.buffer) {
2330023301
ret = BuildCertificateStatus(ssl, status_type, &response, 1);
23301-
2330223302
}
23303+
23304+
/* Let's not error out the connection if we can't verify our cert */
23305+
if (ret == ASN_SELF_SIGNED_E || ret == ASN_NO_SIGNER_E)
23306+
ret = 0;
23307+
2330323308
if (response.buffer) {
2330423309
XFREE(response.buffer, ssl->heap, DYNAMIC_TYPE_OCSP_REQUEST);
2330523310
response.buffer = NULL;
@@ -23428,6 +23433,10 @@ int SendCertificateStatus(WOLFSSL* ssl)
2342823433
}
2342923434
}
2343023435

23436+
/* Let's not error out the connection if we can't verify our cert */
23437+
if (ret == ASN_SELF_SIGNED_E || ret == ASN_NO_SIGNER_E)
23438+
ret = 0;
23439+
2343123440
break;
2343223441
}
2343323442
#endif /* HAVE_CERTIFICATE_STATUS_REQUEST_V2 */

‎src/tls.c‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3307,9 +3307,13 @@ static int TLSX_CSR_Parse(WOLFSSL* ssl, const byte* input, word16 length,
33073307
InitDecodedCert(cert, ssl->buffers.certificate->buffer,
33083308
ssl->buffers.certificate->length, ssl->heap);
33093309
ret = ParseCert(cert, CERT_TYPE, 1, SSL_CM(ssl));
3310-
if (ret != 0 ) {
3310+
if (ret != 0) {
33113311
FreeDecodedCert(cert);
33123312
XFREE(cert, ssl->heap, DYNAMIC_TYPE_DCERT);
3313+
/* Let's not error out the connection if we can't verify our
3314+
* cert */
3315+
if (ret == ASN_SELF_SIGNED_E || ret == ASN_NO_SIGNER_E)
3316+
ret = 0;
33133317
return ret;
33143318
}
33153319
ret = TLSX_CSR_InitRequest(ssl->extensions, cert, ssl->heap);

‎tests/api.c‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68693,6 +68693,102 @@ static int test_dtls13_early_data(void)
6869368693
return EXPECT_RESULT();
6869468694
}
6869568695

68696+
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
68697+
static int test_self_signed_stapling_client_v1_ctx_ready(WOLFSSL_CTX* ctx)
68698+
{
68699+
EXPECT_DECLS;
68700+
ExpectIntEQ(wolfSSL_CTX_EnableOCSPStapling(ctx), 1);
68701+
ExpectIntEQ(wolfSSL_CTX_UseOCSPStapling(ctx, WOLFSSL_CSR_OCSP,
68702+
WOLFSSL_CSR_OCSP_USE_NONCE), 1);
68703+
return EXPECT_RESULT();
68704+
}
68705+
#endif
68706+
68707+
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
68708+
static int test_self_signed_stapling_client_v2_ctx_ready(WOLFSSL_CTX* ctx)
68709+
{
68710+
EXPECT_DECLS;
68711+
ExpectIntEQ(wolfSSL_CTX_EnableOCSPStapling(ctx), 1);
68712+
ExpectIntEQ(wolfSSL_CTX_UseOCSPStaplingV2(ctx, WOLFSSL_CSR2_OCSP,
68713+
WOLFSSL_CSR2_OCSP_USE_NONCE), 1);
68714+
return EXPECT_RESULT();
68715+
}
68716+
68717+
static int test_self_signed_stapling_client_v2_multi_ctx_ready(WOLFSSL_CTX* ctx)
68718+
{
68719+
EXPECT_DECLS;
68720+
ExpectIntEQ(wolfSSL_CTX_EnableOCSPStapling(ctx), 1);
68721+
ExpectIntEQ(wolfSSL_CTX_UseOCSPStaplingV2(ctx, WOLFSSL_CSR2_OCSP_MULTI,
68722+
0), 1);
68723+
return EXPECT_RESULT();
68724+
}
68725+
#endif
68726+
68727+
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
68728+
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
68729+
static int test_self_signed_stapling_server_ctx_ready(WOLFSSL_CTX* ctx)
68730+
{
68731+
EXPECT_DECLS;
68732+
ExpectIntEQ(wolfSSL_CTX_EnableOCSPStapling(ctx), 1);
68733+
return EXPECT_RESULT();
68734+
}
68735+
#endif
68736+
68737+
static int test_self_signed_stapling(void)
68738+
{
68739+
EXPECT_DECLS;
68740+
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
68741+
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
68742+
test_ssl_cbf client_cbf;
68743+
test_ssl_cbf server_cbf;
68744+
size_t i;
68745+
struct {
68746+
method_provider client_meth;
68747+
method_provider server_meth;
68748+
ctx_cb client_ctx;
68749+
const char* tls_version;
68750+
} params[] = {
68751+
#if defined(WOLFSSL_TLS13) && defined(HAVE_CERTIFICATE_STATUS_REQUEST)
68752+
{ wolfTLSv1_3_client_method, wolfTLSv1_3_server_method,
68753+
test_self_signed_stapling_client_v1_ctx_ready, "TLSv1_3 v1" },
68754+
#endif
68755+
#ifndef WOLFSSL_NO_TLS12
68756+
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
68757+
{ wolfTLSv1_2_client_method, wolfTLSv1_2_server_method,
68758+
test_self_signed_stapling_client_v1_ctx_ready, "TLSv1_2 v1" },
68759+
#endif
68760+
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
68761+
{ wolfTLSv1_2_client_method, wolfTLSv1_2_server_method,
68762+
test_self_signed_stapling_client_v2_ctx_ready, "TLSv1_2 v2" },
68763+
{ wolfTLSv1_2_client_method, wolfTLSv1_2_server_method,
68764+
test_self_signed_stapling_client_v2_multi_ctx_ready,
68765+
"TLSv1_2 v2 multi" },
68766+
#endif
68767+
#endif
68768+
};
68769+
68770+
for (i = 0; i < sizeof(params)/sizeof(*params) && !EXPECT_FAIL(); i++) {
68771+
XMEMSET(&client_cbf, 0, sizeof(client_cbf));
68772+
XMEMSET(&server_cbf, 0, sizeof(server_cbf));
68773+
68774+
printf("\nTesting self-signed cert with status request: %s\n",
68775+
params[i].tls_version);
68776+
68777+
client_cbf.method = params[i].client_meth;
68778+
client_cbf.ctx_ready = params[i].client_ctx;
68779+
68780+
server_cbf.method = params[i].server_meth;
68781+
server_cbf.certPemFile = "certs/ca-cert.pem";
68782+
server_cbf.keyPemFile = "certs/ca-key.pem";
68783+
server_cbf.ctx_ready = test_self_signed_stapling_server_ctx_ready;
68784+
68785+
ExpectIntEQ(test_wolfSSL_client_server_nofail_memio(&client_cbf,
68786+
&server_cbf, NULL), TEST_SUCCESS);
68787+
}
68788+
#endif
68789+
return EXPECT_RESULT();
68790+
}
68791+
6869668792
/*----------------------------------------------------------------------------*
6869768793
| Main
6869868794
*----------------------------------------------------------------------------*/
@@ -69886,6 +69982,7 @@ TEST_CASE testCases[] = {
6988669982
/* OCSP Stapling */
6988769983
TEST_DECL(test_wolfSSL_UseOCSPStapling),
6988869984
TEST_DECL(test_wolfSSL_UseOCSPStaplingV2),
69985+
TEST_DECL(test_self_signed_stapling),
6988969986

6989069987
/* Multicast */
6989169988
TEST_DECL(test_wolfSSL_mcast),

0 commit comments

Comments
 (0)