wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-08-01 03:34:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2157 from kojo1/ocsp_staple

Browse Source 
Expose CheckResponse as wolfSSL_CertManagerCheckOCSP_Staple
This commit is contained in:
John Safranek
2019-03-25 13:48:29 -07:00
committed by GitHub
parent f493ff859c 6c9e64129d
commit 7aa159ca6d
6 changed files with 57 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/ocsp.c
View File

@@ -266,9 +266,9 @@ static int GetOcspStatus(WOLFSSL_OCSP* ocsp, OcspRequest* request,
* entry The OCSP entry for this certificate.
* returns OCSP_LOOKUP_FAIL when the response is bad and 0 otherwise.
*/
static int CheckResponse(WOLFSSL_OCSP* ocsp, byte* response, int responseSz,
buffer* responseBuffer, CertStatus* status,
OcspEntry* entry, OcspRequest* ocspRequest)
WOLFSSL_LOCAL int CheckOcspResponse(WOLFSSL_OCSP *ocsp, byte *response, int responseSz,
WOLFSSL_BUFFER_INFO *responseBuffer, CertStatus *status,
OcspEntry *entry, OcspRequest *ocspRequest)
{
#ifdef WOLFSSL_SMALL_STACK
CertStatus* newStatus;
@@ -428,7 +428,7 @@ int CheckOcspRequest(WOLFSSL_OCSP* ocsp, OcspRequest* ocspRequest,
ret = ocsp->statusCb(ssl, ioCtx);
if (ret == 0) {
ret = wolfSSL_get_ocsp_response(ssl, &response);
ret = CheckResponse(ocsp, response, ret, responseBuffer, status,
ret = CheckOcspResponse(ocsp, response, ret, responseBuffer, status,
entry, NULL);
if (response != NULL)
XFREE(response, NULL, DYNAMIC_TYPE_OPENSSL);
@@ -476,7 +476,7 @@ int CheckOcspRequest(WOLFSSL_OCSP* ocsp, OcspRequest* ocspRequest,
XFREE(request, ocsp->cm->heap, DYNAMIC_TYPE_OCSP);
if (responseSz >= 0 && response) {
ret = CheckResponse(ocsp, response, responseSz, responseBuffer, status,
ret = CheckOcspResponse(ocsp, response, responseSz, responseBuffer, status,
entry, ocspRequest);
}

17
src/ssl.c
View File

@@ -5716,6 +5716,23 @@ int wolfSSL_CertManagerCheckOCSP(WOLFSSL_CERT_MANAGER* cm, byte* der, int sz)
return ret == 0 ? WOLFSSL_SUCCESS : ret;
}
WOLFSSL_API int wolfSSL_CertManagerCheckOCSPResponse(WOLFSSL_CERT_MANAGER *cm,
byte *response, int responseSz, buffer *responseBuffer,
CertStatus *status, OcspEntry *entry, OcspRequest *ocspRequest)
{
int ret;
WOLFSSL_ENTER("wolfSSL_CertManagerCheckOCSP_Staple");
if (cm == NULL || response == NULL)
return BAD_FUNC_ARG;
if (cm->ocspEnabled == 0)
return WOLFSSL_SUCCESS;
ret = CheckOcspResponse(cm->ocsp, response, responseSz, responseBuffer, status,
entry, ocspRequest);
return ret == 0 ? WOLFSSL_SUCCESS : ret;
}
int wolfSSL_CertManagerSetOCSPOverrideURL(WOLFSSL_CERT_MANAGER* cm,
const char* url)

19
wolfssl/internal.h
View File

@@ -1793,33 +1793,17 @@ struct WOLFSSL_CIPHER {
};
typedef struct OcspEntry OcspEntry;
#ifdef NO_SHA
#define OCSP_DIGEST_SIZE WC_SHA256_DIGEST_SIZE
#else
#define OCSP_DIGEST_SIZE WC_SHA_DIGEST_SIZE
#endif
#ifdef NO_ASN
/* no_asn won't have */
typedef struct CertStatus CertStatus;
#endif
struct OcspEntry {
OcspEntry* next; /* next entry */
byte issuerHash[OCSP_DIGEST_SIZE]; /* issuer hash */
byte issuerKeyHash[OCSP_DIGEST_SIZE]; /* issuer public key hash */
CertStatus* status; /* OCSP response list */
int totalStatus; /* number on list */
};
#ifndef HAVE_OCSP
typedef struct WOLFSSL_OCSP WOLFSSL_OCSP;
#endif
/* wolfSSL OCSP controller */
#ifdef HAVE_OCSP
struct WOLFSSL_OCSP {
WOLFSSL_CERT_MANAGER* cm; /* pointer back to cert manager */
OcspEntry* ocspList; /* OCSP response list */
@@ -1829,6 +1813,7 @@ struct WOLFSSL_OCSP {
int(*statusCb)(WOLFSSL*, void*);
#endif
};
#endif
#ifndef MAX_DATE_SIZE
#define MAX_DATE_SIZE 32

12
wolfssl/ocsp.h
View File

@@ -54,14 +54,16 @@ WOLFSSL_LOCAL int CheckCertOCSP_ex(WOLFSSL_OCSP*, DecodedCert*,
WOLFSSL_BUFFER_INFO* responseBuffer, WOLFSSL* ssl);
WOLFSSL_LOCAL int CheckOcspRequest(WOLFSSL_OCSP* ocsp,
OcspRequest* ocspRequest, WOLFSSL_BUFFER_INFO* responseBuffer);
WOLFSSL_LOCAL int CheckOcspResponse(WOLFSSL_OCSP *ocsp, byte *response, int responseSz,
WOLFSSL_BUFFER_INFO *responseBuffer, CertStatus *status,
OcspEntry *entry, OcspRequest *ocspRequest);
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
WOLFSSL_API int wolfSSL_OCSP_resp_find_status(WOLFSSL_OCSP_BASICRESP *bs,
WOLFSSL_OCSP_CERTID* id, int* status, int* reason,
WOLFSSL_ASN1_TIME** revtime, WOLFSSL_ASN1_TIME** thisupd,
WOLFSSL_ASN1_TIME** nextupd);
WOLFSSL_API int wolfSSL_OCSP_resp_find_status(WOLFSSL_OCSP_BASICRESP *bs,
WOLFSSL_OCSP_CERTID *id, int *status, int *reason,
WOLFSSL_ASN1_TIME **revtime, WOLFSSL_ASN1_TIME **thisupd,
WOLFSSL_ASN1_TIME **nextupd);
WOLFSSL_API const char *wolfSSL_OCSP_cert_status_str(long s);
WOLFSSL_API int wolfSSL_OCSP_check_validity(WOLFSSL_ASN1_TIME* thisupd,
WOLFSSL_ASN1_TIME* nextupd, long sec, long maxsec);

11
wolfssl/ssl.h
View File

@@ -100,7 +100,6 @@
#endif
#endif
#ifdef __cplusplus
extern "C" {
#endif
@@ -772,6 +771,11 @@ WOLFSSL_API const char* wolfSSL_ERR_reason_error_string(unsigned long);
#define DECLARE_STACK_OF(x) WOLF_STACK_OF(x);
#endif
#if defined(HAVE_OCSP)
#include "wolfssl/ocsp.h"
#include "wolfssl/wolfcrypt/asn.h"
#endif
WOLFSSL_API int wolfSSL_sk_X509_push(WOLF_STACK_OF(WOLFSSL_X509_NAME)* sk,
WOLFSSL_X509* x509);
WOLFSSL_API WOLFSSL_X509* wolfSSL_sk_X509_pop(WOLF_STACK_OF(WOLFSSL_X509_NAME)* sk);
@@ -2115,6 +2119,11 @@ WOLFSSL_API void* wolfSSL_GetRsaDecCtx(WOLFSSL* ssl);
#ifdef HAVE_CRL_IO
WOLFSSL_API int wolfSSL_CertManagerSetCRL_IOCb(WOLFSSL_CERT_MANAGER*,
CbCrlIO);
#endif
#if defined(HAVE_OCSP)
WOLFSSL_API int wolfSSL_CertManagerCheckOCSPResponse(WOLFSSL_CERT_MANAGER *,
byte *response, int responseSz, WOLFSSL_BUFFER_INFO *responseBuffer,
CertStatus *status, OcspEntry *entry, OcspRequest *ocspRequest);
#endif
WOLFSSL_API int wolfSSL_CertManagerCheckOCSP(WOLFSSL_CERT_MANAGER*,
unsigned char*, int sz);

16
wolfssl/wolfcrypt/asn.h
View File

@@ -1186,6 +1186,22 @@ struct OcspRequest {
void* ssl;
};
typedef struct OcspEntry OcspEntry;
#ifdef NO_SHA
#define OCSP_DIGEST_SIZE WC_SHA256_DIGEST_SIZE
#else
#define OCSP_DIGEST_SIZE WC_SHA_DIGEST_SIZE
#endif
struct OcspEntry
{
OcspEntry *next; /* next entry */
byte issuerHash[OCSP_DIGEST_SIZE]; /* issuer hash */
byte issuerKeyHash[OCSP_DIGEST_SIZE]; /* issuer public key hash */
CertStatus *status; /* OCSP response list */
int totalStatus; /* number on list */
};
WOLFSSL_LOCAL void InitOcspResponse(OcspResponse*, CertStatus*, byte*, word32);
WOLFSSL_LOCAL int OcspResponseDecode(OcspResponse*, void*, void* heap, int);