wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 18:57:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

ocsp-resp-refactor: fix tests

Browse Source
This commit is contained in:
Marco Oliverio
2025-02-04 22:53:19 +00:00
parent 851d74fd69
commit ae3177c439
1 changed files with 42 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
tests/api/test_ocsp.c
View File

@ -64,7 +64,7 @@ static int ocsp_cb(void* ctx, const char* url, int urlSz, unsigned char* req,
return cb_ctx->responseSz; return cb_ctx->responseSz;
} }
static int test_ocsp_response_with_cm(struct test_conf* c) static int test_ocsp_response_with_cm(struct test_conf* c, int expectedRet)
{ {
EXPECT_DECLS; EXPECT_DECLS;
WOLFSSL_CERT_MANAGER* cm = NULL; WOLFSSL_CERT_MANAGER* cm = NULL;
@ -72,7 +72,7 @@ static int test_ocsp_response_with_cm(struct test_conf* c)
int ret; int ret;
cm = wolfSSL_CertManagerNew(); cm = wolfSSL_CertManagerNew();
ExpectPtrNE(cm, NULL); ExpectNotNull(cm);
ret = wolfSSL_CertManagerEnableOCSP(cm, ret = wolfSSL_CertManagerEnableOCSP(cm,
WOLFSSL_OCSP_URL_OVERRIDE | WOLFSSL_OCSP_NO_NONCE); WOLFSSL_OCSP_URL_OVERRIDE | WOLFSSL_OCSP_NO_NONCE);
ExpectIntEQ(ret, WOLFSSL_SUCCESS); ExpectIntEQ(ret, WOLFSSL_SUCCESS);
@ -95,14 +95,15 @@ static int test_ocsp_response_with_cm(struct test_conf* c)
} }
/* check cert */ /* check cert */
ret = wolfSSL_CertManagerCheckOCSP(cm, c->targetCert, c->targetCertSz); ret = wolfSSL_CertManagerCheckOCSP(cm, c->targetCert, c->targetCertSz);
ExpectIntEQ(ret, expectedRet);
wolfSSL_CertManagerFree(cm); wolfSSL_CertManagerFree(cm);
return ret; return EXPECT_RESULT();
} }
int test_ocsp_response_parsing(void) int test_ocsp_response_parsing(void)
{ {
struct test_conf conf; struct test_conf conf;
int ret; int ret, expectedRet;
EXPECT_DECLS; EXPECT_DECLS;
conf.resp = (unsigned char*)resp; conf.resp = (unsigned char*)resp;
conf.respSz = sizeof(resp); conf.respSz = sizeof(resp);
@ -112,8 +113,8 @@ int test_ocsp_response_parsing(void)
conf.ca1Sz = 0; conf.ca1Sz = 0;
conf.targetCert = intermediate1_ca_cert_pem; conf.targetCert = intermediate1_ca_cert_pem;
conf.targetCertSz = sizeof(intermediate1_ca_cert_pem); conf.targetCertSz = sizeof(intermediate1_ca_cert_pem);
ret = test_ocsp_response_with_cm(&conf); ret = test_ocsp_response_with_cm(&conf, WOLFSSL_SUCCESS);
ExpectIntEQ(ret, WOLFSSL_SUCCESS); ExpectIntEQ(ret, TEST_SUCCESS);
conf.resp = (unsigned char*)resp_multi; conf.resp = (unsigned char*)resp_multi;
conf.respSz = sizeof(resp_multi); conf.respSz = sizeof(resp_multi);
@ -123,8 +124,8 @@ int test_ocsp_response_parsing(void)
conf.ca1Sz = 0; conf.ca1Sz = 0;
conf.targetCert = intermediate1_ca_cert_pem; conf.targetCert = intermediate1_ca_cert_pem;
conf.targetCertSz = sizeof(intermediate1_ca_cert_pem); conf.targetCertSz = sizeof(intermediate1_ca_cert_pem);
ret = test_ocsp_response_with_cm(&conf); ret = test_ocsp_response_with_cm(&conf, WOLFSSL_SUCCESS);
ExpectIntEQ(ret, WOLFSSL_SUCCESS); ExpectIntEQ(ret, TEST_SUCCESS);
conf.resp = (unsigned char*)resp_bad_noauth; conf.resp = (unsigned char*)resp_bad_noauth;
conf.respSz = sizeof(resp_bad_noauth); conf.respSz = sizeof(resp_bad_noauth);
@ -134,16 +135,18 @@ int test_ocsp_response_parsing(void)
conf.ca1Sz = sizeof(ca_cert_pem); conf.ca1Sz = sizeof(ca_cert_pem);
conf.targetCert = server_cert_pem; conf.targetCert = server_cert_pem;
conf.targetCertSz = sizeof(server_cert_pem); conf.targetCertSz = sizeof(server_cert_pem);
ret = test_ocsp_response_with_cm(&conf); expectedRet = OCSP_LOOKUP_FAIL;
#ifndef WOLFSSL_NO_OCSP_ISSUER_CHECK #ifdef WOLFSSL_NO_OCSP_ISSUER_CHECK
ExpectIntNE(ret, WOLFSSL_SUCCESS); expectedRet = WOLFSSL_SUCCESS;
#else
ExpectIntEQ(ret, WOLFSSL_SUCCESS);
#endif #endif
ret = test_ocsp_response_with_cm(&conf, expectedRet);
ExpectIntEQ(ret, TEST_SUCCESS);
return EXPECT_SUCCESS(); return EXPECT_SUCCESS();
} }
#else /* HAVE_OCSP */ #else /* HAVE_OCSP */
int test_ocsp_response_parsing(void) { return TEST_SKIPPED; } int test_ocsp_response_parsing(void) {
return TEST_SKIPPED;
}
#endif /* HAVE_OCSP */ #endif /* HAVE_OCSP */
#if defined(HAVE_OCSP) && (defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA)) #if defined(HAVE_OCSP) && (defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA))
@ -155,9 +158,9 @@ static int test_ocsp_create_x509store(WOLFSSL_X509_STORE** store,
int ret; int ret;
*store = wolfSSL_X509_STORE_new(); *store = wolfSSL_X509_STORE_new();
ExpectPtrNE(*store, NULL); ExpectNotNull(*store);
cert = wolfSSL_X509_d2i(&cert, ca, caSz); cert = wolfSSL_X509_d2i(&cert, ca, caSz);
ExpectPtrNE(cert, NULL); ExpectNotNull(cert);
ret = wolfSSL_X509_STORE_add_cert(*store, cert); ret = wolfSSL_X509_STORE_add_cert(*store, cert);
wolfSSL_X509_free(cert); wolfSSL_X509_free(cert);
ExpectIntEQ(ret, WOLFSSL_SUCCESS); ExpectIntEQ(ret, WOLFSSL_SUCCESS);
@ -172,9 +175,9 @@ static int test_create_stack_of_x509(WOLF_STACK_OF(WOLFSSL_X509) * *certs,
int ret; int ret;
*certs = wolfSSL_sk_X509_new_null(); *certs = wolfSSL_sk_X509_new_null();
ExpectPtrNE(*certs, NULL); ExpectNotNull(*certs);
cert = wolfSSL_X509_d2i(&cert, der, derSz); cert = wolfSSL_X509_d2i(&cert, der, derSz);
ExpectPtrNE(cert, NULL); ExpectNotNull(cert);
ret = wolfSSL_sk_X509_push(*certs, cert); ret = wolfSSL_sk_X509_push(*certs, cert);
ExpectIntEQ(ret, 1); ExpectIntEQ(ret, 1);
return EXPECT_RESULT(); return EXPECT_RESULT();
@ -184,9 +187,9 @@ int test_ocsp_basic_verify(void)
{ {
EXPECT_DECLS; EXPECT_DECLS;
WOLF_STACK_OF(WOLFSSL_X509) * certs; WOLF_STACK_OF(WOLFSSL_X509) * certs;
WOLFSSL_X509_STORE* store = NULL;
const unsigned char* ptr = NULL;
OcspResponse* response = NULL; OcspResponse* response = NULL;
WOLFSSL_X509_STORE* store;
const unsigned char* ptr;
DecodedCert cert; DecodedCert cert;
int ret; int ret;
@ -198,7 +201,7 @@ int test_ocsp_basic_verify(void)
/* just decoding */ /* just decoding */
ptr = (const unsigned char*)resp; ptr = (const unsigned char*)resp;
response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp)); response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp));
ExpectPtrNE(response, NULL); ExpectNotNull(response);
ExpectIntEQ(response->responseStatus, 0); ExpectIntEQ(response->responseStatus, 0);
ExpectIntEQ(response->responderIdType, OCSP_RESPONDER_ID_NAME); ExpectIntEQ(response->responderIdType, OCSP_RESPONDER_ID_NAME);
ExpectBufEQ(response->responderId.nameHash, cert.subjectHash, ExpectBufEQ(response->responderId.nameHash, cert.subjectHash,
@ -208,29 +211,28 @@ int test_ocsp_basic_verify(void)
/* responder Id by key hash */ /* responder Id by key hash */
ptr = (const unsigned char*)resp_rid_bykey; ptr = (const unsigned char*)resp_rid_bykey;
response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_rid_bykey)); response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_rid_bykey));
ExpectPtrNE(response, NULL); ExpectNotNull(response);
ExpectIntEQ(response->responseStatus, 0); ExpectIntEQ(response->responseStatus, 0);
ExpectIntEQ(response->responderIdType, OCSP_RESPONDER_ID_KEY); ExpectIntEQ(response->responderIdType, OCSP_RESPONDER_ID_KEY);
ExpectBufEQ(response->responderId.keyHash, cert.subjectKeyHash, ExpectBufEQ(response->responderId.keyHash, cert.subjectKeyHash,
OCSP_DIGEST_SIZE); OCSP_DIGEST_SIZE);
wc_FreeDecodedCert(&cert);
wolfSSL_OCSP_RESPONSE_free(response); wolfSSL_OCSP_RESPONSE_free(response);
/* decoding with no embedded certificates */ /* decoding with no embedded certificates */
ptr = (const unsigned char*)resp_nocert; ptr = (const unsigned char*)resp_nocert;
response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_nocert)); response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_nocert));
ExpectPtrNE(response, NULL); ExpectNotNull(response);
ExpectIntEQ(response->responseStatus, 0); ExpectIntEQ(response->responseStatus, 0);
wolfSSL_OCSP_RESPONSE_free(response); wolfSSL_OCSP_RESPONSE_free(response);
/* decoding an invalid response */ /* decoding an invalid response */
ptr = (const unsigned char*)resp_bad; ptr = (const unsigned char*)resp_bad;
response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_bad)); response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_bad));
ExpectPtrEq(response, NULL); ExpectNull(response);
ptr = (const unsigned char*)resp; ptr = (const unsigned char*)resp;
response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp)); response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp));
ExpectPtrNE(response, NULL); ExpectNotNull(response);
/* no verify signer certificate */ /* no verify signer certificate */
ret = wolfSSL_OCSP_basic_verify(response, NULL, NULL, OCSP_NOVERIFY); ret = wolfSSL_OCSP_basic_verify(response, NULL, NULL, OCSP_NOVERIFY);
ExpectIntEQ(ret, WOLFSSL_SUCCESS); ExpectIntEQ(ret, WOLFSSL_SUCCESS);
@ -253,7 +255,7 @@ int test_ocsp_basic_verify(void)
/* cert not embedded, cert in certs, validated using store */ /* cert not embedded, cert in certs, validated using store */
ptr = (const unsigned char*)resp_nocert; ptr = (const unsigned char*)resp_nocert;
response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_nocert)); response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_nocert));
ExpectPtrNE(response, NULL); ExpectNotNull(response);
ret = wolfSSL_OCSP_basic_verify(response, certs, store, 0); ret = wolfSSL_OCSP_basic_verify(response, certs, store, 0);
ExpectIntEQ(ret, WOLFSSL_SUCCESS); ExpectIntEQ(ret, WOLFSSL_SUCCESS);
wolfSSL_OCSP_RESPONSE_free(response); wolfSSL_OCSP_RESPONSE_free(response);
@ -261,7 +263,7 @@ int test_ocsp_basic_verify(void)
/* cert embedded, verified using store */ /* cert embedded, verified using store */
ptr = (const unsigned char*)resp; ptr = (const unsigned char*)resp;
response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp)); response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp));
ExpectPtrNE(response, NULL); ExpectNotNull(response);
ret = wolfSSL_OCSP_basic_verify(response, NULL, store, 0); ret = wolfSSL_OCSP_basic_verify(response, NULL, store, 0);
ExpectIntEQ(ret, WOLFSSL_SUCCESS); ExpectIntEQ(ret, WOLFSSL_SUCCESS);
/* make invalid signature */ /* make invalid signature */
@ -275,18 +277,16 @@ int test_ocsp_basic_verify(void)
ExpectIntEQ(ret, WOLFSSL_SUCCESS); ExpectIntEQ(ret, WOLFSSL_SUCCESS);
/* this should also pass */ /* this should also pass */
ret = wolfSSL_OCSP_basic_verify(response, certs, store, OCSP_NOINTERN); ret = wolfSSL_OCSP_basic_verify(response, certs, store, OCSP_NOINTERN);
;
ExpectIntEQ(ret, WOLFSSL_SUCCESS); ExpectIntEQ(ret, WOLFSSL_SUCCESS);
/* this should not */ /* this should not */
ret = wolfSSL_OCSP_basic_verify(response, NULL, store, OCSP_NOINTERN); ret = wolfSSL_OCSP_basic_verify(response, NULL, store, OCSP_NOINTERN);
;
ExpectIntNE(ret, WOLFSSL_SUCCESS); ExpectIntNE(ret, WOLFSSL_SUCCESS);
wolfSSL_OCSP_RESPONSE_free(response); wolfSSL_OCSP_RESPONSE_free(response);
/* cert not embedded, not certs */ /* cert not embedded, not certs */
ptr = (const unsigned char*)resp_nocert; ptr = (const unsigned char*)resp_nocert;
response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_nocert)); response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_nocert));
ExpectPtrNE(response, NULL); ExpectNotNull(response);
ret = wolfSSL_OCSP_basic_verify(response, NULL, store, 0); ret = wolfSSL_OCSP_basic_verify(response, NULL, store, 0);
ExpectIntNE(ret, WOLFSSL_SUCCESS); ExpectIntNE(ret, WOLFSSL_SUCCESS);
wolfSSL_OCSP_RESPONSE_free(response); wolfSSL_OCSP_RESPONSE_free(response);
@ -304,7 +304,7 @@ int test_ocsp_basic_verify(void)
/* multiple responses in a ocsp response */ /* multiple responses in a ocsp response */
ptr = (const unsigned char*)resp_multi; ptr = (const unsigned char*)resp_multi;
response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_multi)); response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_multi));
ExpectPtrNE(response, NULL); ExpectNotNull(response);
ret = wolfSSL_OCSP_basic_verify(response, certs, store, 0); ret = wolfSSL_OCSP_basic_verify(response, certs, store, 0);
ExpectIntEQ(ret, WOLFSSL_SUCCESS); ExpectIntEQ(ret, WOLFSSL_SUCCESS);
wolfSSL_OCSP_RESPONSE_free(response); wolfSSL_OCSP_RESPONSE_free(response);
@ -313,7 +313,7 @@ int test_ocsp_basic_verify(void)
* responses */ * responses */
ptr = (const unsigned char*)resp_bad_noauth; ptr = (const unsigned char*)resp_bad_noauth;
response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_bad_noauth)); response = wolfSSL_d2i_OCSP_RESPONSE(NULL, &ptr, sizeof(resp_bad_noauth));
ExpectPtrNE(response, NULL); ExpectNotNull(response);
ret = wolfSSL_OCSP_basic_verify(response, certs, store, 0); ret = wolfSSL_OCSP_basic_verify(response, certs, store, 0);
#ifndef WOLFSSL_NO_OCSP_ISSUER_CHECK #ifndef WOLFSSL_NO_OCSP_ISSUER_CHECK
ExpectIntEQ(ret, WOLFSSL_FAILURE); ExpectIntEQ(ret, WOLFSSL_FAILURE);
@ -328,16 +328,19 @@ int test_ocsp_basic_verify(void)
ExpectIntEQ(ret, WOLFSSL_SUCCESS); ExpectIntEQ(ret, WOLFSSL_SUCCESS);
wolfSSL_OCSP_RESPONSE_free(response); wolfSSL_OCSP_RESPONSE_free(response);
wc_FreeDecodedCert(&cert);
wolfSSL_sk_X509_pop_free(certs, wolfSSL_X509_free); wolfSSL_sk_X509_pop_free(certs, wolfSSL_X509_free);
wolfSSL_X509_STORE_free(store); wolfSSL_X509_STORE_free(store);
return EXPECT_RESULT(); return EXPECT_RESULT();
} }
#else #else
int test_ocsp_basic_verify(void) { return TEST_SKIPPED; } int test_ocsp_basic_verify(void) {
return TEST_SKIPPED;
}
#endif /* HAVE_OCSP && (OPENSSL_ALL || OPENSSL_EXTRA) */ #endif /* HAVE_OCSP && (OPENSSL_ALL || OPENSSL_EXTRA) */
#if defined(HAVE_OCSP) && defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && \ #if defined(HAVE_OCSP) && defined(HAVE_SSL_MEMIO_TESTS_DEPENDENCIES) && \
defined(HAVE_CERTIFICATE_STATUS_REQUEST) && !defined(WOLFSSL_NO_TLS12) && \ defined(HAVE_CERTIFICATE_STATUS_REQUEST) && !defined(WOLFSSL_NO_TLS12) && \
(defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA)) (defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA))
@ -400,7 +403,7 @@ static int test_ocsp_status_callback_test_setup(
return ret; return ret;
} }
static int test_ocsp_status_callback(void) int test_ocsp_status_callback(void)
{ {
struct test_params { struct test_params {
method_provider c_method; method_provider c_method;
@ -562,7 +565,9 @@ static int test_ocsp_status_callback(void)
} }
#else #else
int test_ocsp_status_callback(void) { return TEST_SKIPPED; } int test_ocsp_status_callback(void) {
return TEST_SKIPPED;
}
#endif /* defined(HAVE_OCSP) && defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) \ #endif /* defined(HAVE_OCSP) && defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) \
&& defined(HAVE_CERTIFICATE_STATUS_REQUEST) && !defined(WOLFSSL_NO_TLS12) \ && defined(HAVE_CERTIFICATE_STATUS_REQUEST) && !defined(WOLFSSL_NO_TLS12) \
&& (defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA)) */ && (defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA)) */