Skip to content

Commit 877bade

Browse files
bigbrettrlm2002
bigbrett
authored and
rlm2002
committed
additional debugging
1 parent 7232b3a commit 877bade

3 files changed

Lines changed: 45 additions & 28 deletions

File tree

‎src/internal.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42849,7 +42849,7 @@ static int DisplaySecTrustError(CFErrorRef error, SecTrustRef trust)
4284942849

4285042850
info = CFErrorCopyUserInfo(error);
4285142851
if (info) {
42852-
printf("Trust error info dump:\n");
42852+
WOLFSSL_MSG("Trust error info dump:\n");
4285342853
CFShow(info);
4285442854
CFRelease(info);
4285542855
}
@@ -42935,6 +42935,7 @@ static int DoAppleNativeCertValidation(WOLFSSL* ssl,
4293542935
#if defined(WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION)
4293642936
/* TEST ONLY CODE:
4293742937
* Set accumulated list of trusted CA certificates as trust anchors */
42938+
WOLFSSL_MSG("Setting anchor certificates");
4293842939
if (ssl->ctx->testTrustedCAs != NULL) {
4293942940
status = SecTrustSetAnchorCertificates(trust, ssl->ctx->testTrustedCAs);
4294042941
if (status != errSecSuccess) {
@@ -42967,6 +42968,7 @@ static int DoAppleNativeCertValidation(WOLFSSL* ssl,
4296742968
if (code == errSecCertificateValidityPeriodTooLong) {
4296842969
WOLFSSL_MSG("Skipping certificate validity period error");
4296942970
ret = 1;
42971+
/* TODO: ensure other errors aren't masked by this error */
4297042972
}
4297142973
#endif
4297242974

‎src/ssl_load.c‎

Lines changed: 37 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -2159,9 +2159,14 @@ static int ProcessBufferCertHandleDer(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
21592159
/* CA certificate to verify with. */
21602160
if (type == CA_TYPE) {
21612161
#ifdef WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION
2162+
/* TEST ONLY CODE:
2163+
* Store the DER encoding of the CA certificate so we can append it to
2164+
* the list of trusted CA certificates if the subsequent call to AddCA
2165+
* is successful */
21622166
word32 derLen;
21632167
byte* derBuf;
21642168
if (ctx->doAppleNativeCertValidationFlag == 1) {
2169+
WOLFSSL_MSG("ANCV Test: copy DER CA cert");
21652170
derLen = der->length;
21662171
derBuf = (byte*)XMALLOC(derLen, NULL, DYNAMIC_TYPE_TMP_BUFFER);
21672172
if (derBuf == NULL) {
@@ -2176,12 +2181,16 @@ static int ProcessBufferCertHandleDer(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
21762181
#endif
21772182
/* verify CA unless user set to no verify */
21782183
ret = AddCA(ctx->cm, &der, WOLFSSL_USER_CA, verify);
2184+
21792185
#ifdef WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION
2186+
/* TEST ONLY CODE:
2187+
* Append the DER encoded CA certificate to the list of trusted CA
2188+
* certificates so we can inject them at verification time */
21802189
if (ret == 1 && ctx->doAppleNativeCertValidationFlag == 1) {
2181-
WOLFSSL_MSG("Appending CA to cert list for native cert validation test");
2190+
WOLFSSL_MSG("ANCV Test: Appending CA to cert list");
21822191
ret = wolfSSL_TestAppleNativeCertValidation_AppendCA(ctx, derBuf, (int)derLen);
21832192
if (ret == WOLFSSL_SUCCESS) {
2184-
WOLFSSL_MSG("Clearing CA table for native cert validation test");
2193+
WOLFSSL_MSG("ANCV Test: Clearing CA table");
21852194
/* Clear the CA table so we can ensure they won't be used for
21862195
* verification */
21872196
ret = wolfSSL_CertManagerUnloadCAs(ctx->cm);
@@ -2192,6 +2201,7 @@ static int ProcessBufferCertHandleDer(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
21922201
XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
21932202
}
21942203
#endif /* !WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION */
2204+
21952205
if (ret == 1) {
21962206
ret = 0;
21972207
}
@@ -2978,6 +2988,14 @@ int wolfSSL_CTX_load_verify_locations_ex(WOLFSSL_CTX* ctx, const char* file,
29782988
ret = 0;
29792989
}
29802990

2991+
#ifdef WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION
2992+
if (ret == 1) {
2993+
/* TEST ONLY CODE: force native cert validation on */
2994+
WOLFSSL_MSG("ANCV Test: Loading system CA certs");
2995+
wolfSSL_CTX_load_system_CA_certs(ctx);
2996+
}
2997+
#endif
2998+
29812999
if (ret == 1) {
29823000
/* Get setting on how to verify certificates. */
29833001
verify = GET_VERIFY_SETTING_CTX(ctx);
@@ -2990,19 +3008,19 @@ int wolfSSL_CTX_load_verify_locations_ex(WOLFSSL_CTX* ctx, const char* file,
29903008
/* Load the PEM formatted CA file */
29913009
ret = ProcessFile(ctx, file, WOLFSSL_FILETYPE_PEM, CA_TYPE, NULL, 0,
29923010
NULL, verify);
2993-
#ifndef NO_WOLFSSL_DIR
3011+
#ifndef NO_WOLFSSL_DIR
29943012
if (ret == 1) {
29953013
/* Include success in overall count. */
29963014
successCount++;
29973015
}
2998-
#endif
2999-
#if defined(WOLFSSL_TRUST_PEER_CERT) && defined(OPENSSL_COMPATIBLE_DEFAULTS)
3016+
#endif
3017+
#if defined(WOLFSSL_TRUST_PEER_CERT) && defined(OPENSSL_COMPATIBLE_DEFAULTS)
30003018
/* Load CA as a trusted peer certificate. */
30013019
ret = wolfSSL_CTX_trust_peer_cert(ctx, file, WOLFSSL_FILETYPE_PEM);
30023020
if (ret != 1) {
30033021
WOLFSSL_MSG("wolfSSL_CTX_trust_peer_cert error");
30043022
}
3005-
#endif
3023+
#endif
30063024
}
30073025
}
30083026

@@ -3015,12 +3033,6 @@ int wolfSSL_CTX_load_verify_locations_ex(WOLFSSL_CTX* ctx, const char* file,
30153033
ret = NOT_COMPILED_IN;
30163034
(void)flags;
30173035
#endif
3018-
3019-
#ifdef WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION
3020-
if (ret == 1) {
3021-
wolfSSL_CTX_load_system_CA_certs(ctx);
3022-
}
3023-
#endif
30243036
}
30253037

30263038
return ret;
@@ -3461,15 +3473,14 @@ int wolfSSL_CTX_der_load_verify_locations(WOLFSSL_CTX* ctx, const char* file,
34613473
ret = 0;
34623474
}
34633475
else {
3464-
ret = ProcessFile(ctx, file, format, CA_TYPE, NULL, 0, NULL,
3465-
GET_VERIFY_SETTING_CTX(ctx));
3466-
}
3467-
34683476
#ifdef WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION
3469-
if (ret == 1) {
3477+
/* TEST ONLY CODE: force native cert validation on */
3478+
WOLFSSL_MSG("ANCV Test: loading system CA certs");
34703479
wolfSSL_CTX_load_system_CA_certs(ctx);
3471-
}
34723480
#endif
3481+
ret = ProcessFile(ctx, file, format, CA_TYPE, NULL, 0, NULL,
3482+
GET_VERIFY_SETTING_CTX(ctx));
3483+
}
34733484

34743485
/* Return 1 on success or 0 on failure. */
34753486
return WS_RC(ret);
@@ -3975,6 +3986,14 @@ int wolfSSL_CTX_load_verify_buffer_ex(WOLFSSL_CTX* ctx, const unsigned char* in,
39753986

39763987
WOLFSSL_ENTER("wolfSSL_CTX_load_verify_buffer_ex");
39773988

3989+
#ifdef WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION
3990+
/* TEST ONLY CODE: force native cert validation on */
3991+
if (ctx != NULL) {
3992+
WOLFSSL_MSG("ANCV Test: loading system CA certs");
3993+
wolfSSL_CTX_load_system_CA_certs(ctx);
3994+
}
3995+
#endif
3996+
39783997
/* Get setting on how to verify certificates. */
39793998
verify = GET_VERIFY_SETTING_CTX(ctx);
39803999
/* Overwrite setting when flag set. */
@@ -3999,12 +4018,6 @@ int wolfSSL_CTX_load_verify_buffer_ex(WOLFSSL_CTX* ctx, const unsigned char* in,
39994018
}
40004019
#endif
40014020

4002-
#ifdef WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION
4003-
if (ret == 1) {
4004-
wolfSSL_CTX_load_system_CA_certs(ctx);
4005-
}
4006-
#endif
4007-
40084021
WOLFSSL_LEAVE("wolfSSL_CTX_load_verify_buffer_ex", ret);
40094022
return ret;
40104023
}

‎tests/api.c‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68151,7 +68151,7 @@ TEST_CASE testCases[] = {
6815168151
TEST_DECL(test_wolfSSL_CertManagerCRL),
6815268152
TEST_DECL(test_wolfSSL_CertManagerCheckOCSPResponse),
6815368153
TEST_DECL(test_wolfSSL_CheckOCSPResponse),
68154-
#ifdef HAVE_CERT_CHAIN_VALIDATION
68154+
#if defined(HAVE_CERT_CHAIN_VALIDATION) && !defined(WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION)
6815568155
TEST_DECL(test_various_pathlen_chains),
6815668156
#endif
6815768157

@@ -68201,7 +68201,8 @@ TEST_CASE testCases[] = {
6820168201
TEST_DECL(test_CONF_CTX_CMDLINE),
6820268202

6820368203
#if !defined(NO_CERTS) && (!defined(NO_WOLFSSL_CLIENT) || \
68204-
!defined(WOLFSSL_NO_CLIENT_AUTH)) && !defined(NO_FILESYSTEM)
68204+
!defined(WOLFSSL_NO_CLIENT_AUTH)) && !defined(NO_FILESYSTEM) && \
68205+
!defined(WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION)
6820568206
/* Use the Cert Manager(CM) API to generate the error ASN_SIG_CONFIRM_E */
6820668207
/* Bad certificate signature tests */
6820768208
TEST_DECL(test_EccSigFailure_cm),
@@ -68246,7 +68247,8 @@ TEST_CASE testCases[] = {
6824668247
/* Large number of memory allocations. */
6824768248
TEST_DECL(test_wolfSSL_CTX_load_system_CA_certs),
6824868249

68249-
#ifdef HAVE_CERT_CHAIN_VALIDATION
68250+
#if defined(HAVE_CERT_CHAIN_VALIDATION) && \
68251+
!defined(WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION)
6825068252
TEST_DECL(test_wolfSSL_CertRsaPss),
6825168253
#endif
6825268254
TEST_DECL(test_wolfSSL_CTX_load_verify_locations_ex),

0 commit comments

Comments
 (0)