wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 10:47:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

OCSP

Browse Source 
1. Modify the other OCSP Stapling scripts to better manage the OCSP responder.
2. Modify the client's W option to take:
 - 1 for Stapling v1
 - 2 for Stapling v2
 - 3 for Stapling v2 MULTI
3. Modify the client to disallow stapling v2 with TLSv1.3.
This commit is contained in:
John Safranek
2018-08-02 16:25:38 -07:00
parent 5ae45436f4
commit f45dbed8f9
3 changed files with 50 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
examples/client/client.c
View File

@ -50,6 +50,11 @@
#define DEFAULT_TIMEOUT_SEC 2 #define DEFAULT_TIMEOUT_SEC 2
#define OCSP_STAPLING 1
#define OCSP_STAPLINGV2 2
#define OCSP_STAPLINGV2_MULTI 3
#define OCSP_STAPLING_OPT_MAX OCSP_STAPLINGV2_MULTI
/* Note on using port 0: the client standalone example doesn't utilize the /* Note on using port 0: the client standalone example doesn't utilize the
* port 0 port sharing; that is used by (1) the server in external control * port 0 port sharing; that is used by (1) the server in external control
* test mode and (2) the testsuite which uses this code and sets up the correct * test mode and (2) the testsuite which uses this code and sets up the correct
@ -787,7 +792,7 @@ static void Usage(void)
#endif #endif
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \ #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) || defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
printf("-W Use OCSP Stapling\n"); printf("-W <num> Use OCSP Stapling (1 v1, 2 v2, 3 v2 multi)\n");
#endif #endif
#ifdef ATOMIC_USER #ifdef ATOMIC_USER
printf("-U Atomic User Record Layer Callbacks\n"); printf("-U Atomic User Record Layer Callbacks\n");
@ -1249,6 +1254,10 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \ #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) || defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
statusRequest = atoi(myoptarg); statusRequest = atoi(myoptarg);
if (statusRequest > OCSP_STAPLING_OPT_MAX) {
Usage();
XEXIT_T(MY_EX_USAGE);
}
#endif #endif
break; break;
@ -1986,33 +1995,32 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
wolfSSL_UseALPN(ssl, alpnList, (word32)XSTRLEN(alpnList), alpn_opt); wolfSSL_UseALPN(ssl, alpnList, (word32)XSTRLEN(alpnList), alpn_opt);
} }
#endif #endif
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) || \
defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
if (statusRequest) { if (statusRequest) {
if (version == 4 &&
(statusRequest == OCSP_STAPLINGV2 || \
statusRequest == OCSP_STAPLINGV2_MULTI)) {
err_sys("Cannot use OCSP Stapling V2 with TLSv1.3");
}
if (wolfSSL_CTX_EnableOCSPStapling(ctx) != WOLFSSL_SUCCESS) if (wolfSSL_CTX_EnableOCSPStapling(ctx) != WOLFSSL_SUCCESS)
err_sys("can't enable OCSP Stapling Certificate Manager"); err_sys("can't enable OCSP Stapling Certificate Manager");
switch (statusRequest) { switch (statusRequest) {
case WOLFSSL_CSR_OCSP: #ifdef HAVE_CERTIFICATE_STATUS_REQUEST
case OCSP_STAPLING:
if (wolfSSL_UseOCSPStapling(ssl, WOLFSSL_CSR_OCSP, if (wolfSSL_UseOCSPStapling(ssl, WOLFSSL_CSR_OCSP,
WOLFSSL_CSR_OCSP_USE_NONCE) != WOLFSSL_SUCCESS) { WOLFSSL_CSR_OCSP_USE_NONCE) != WOLFSSL_SUCCESS) {
wolfSSL_free(ssl); ssl = NULL; wolfSSL_free(ssl); ssl = NULL;
wolfSSL_CTX_free(ctx); ctx = NULL; wolfSSL_CTX_free(ctx); ctx = NULL;
err_sys("UseCertificateStatusRequest failed"); err_sys("UseCertificateStatusRequest failed");
} }
break; break;
} #endif
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
wolfSSL_CTX_EnableOCSP(ctx, 0); case OCSP_STAPLINGV2:
}
#endif
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
if (statusRequest) {
if (wolfSSL_CTX_EnableOCSPStapling(ctx) != WOLFSSL_SUCCESS)
err_sys("can't enable OCSP Stapling Certificate Manager");
switch (statusRequest) {
case WOLFSSL_CSR2_OCSP:
if (wolfSSL_UseOCSPStaplingV2(ssl, if (wolfSSL_UseOCSPStaplingV2(ssl,
WOLFSSL_CSR2_OCSP, WOLFSSL_CSR2_OCSP_USE_NONCE) WOLFSSL_CSR2_OCSP, WOLFSSL_CSR2_OCSP_USE_NONCE)
!= WOLFSSL_SUCCESS) { != WOLFSSL_SUCCESS) {
@ -2021,7 +2029,7 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
err_sys("UseCertificateStatusRequest failed"); err_sys("UseCertificateStatusRequest failed");
} }
break; break;
case WOLFSSL_CSR2_OCSP_MULTI: case OCSP_STAPLINGV2_MULTI:
if (wolfSSL_UseOCSPStaplingV2(ssl, if (wolfSSL_UseOCSPStaplingV2(ssl,
WOLFSSL_CSR2_OCSP_MULTI, 0) WOLFSSL_CSR2_OCSP_MULTI, 0)
!= WOLFSSL_SUCCESS) { != WOLFSSL_SUCCESS) {
@ -2030,7 +2038,9 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
err_sys("UseCertificateStatusRequest failed"); err_sys("UseCertificateStatusRequest failed");
} }
break; break;
#endif
default:
err_sys("Invalid OCSP Stapling option");
} }
wolfSSL_CTX_EnableOCSP(ctx, 0); wolfSSL_CTX_EnableOCSP(ctx, 0);

18
scripts/ocsp-stapling-with-ca-as-responder.test
View File

@ -1,15 +1,14 @@
#!/bin/bash #!/bin/bash
#set an invalid default PID so we don't cleanup a process unexpectedly
OSSL_INT1_PID="INVALID"
# ocsp-stapling.test # ocsp-stapling.test
cleanup(){
# "jobs" is not portable for posix. Must use bash interpreter! cleanup()
for i in `jobs -p`; do pkill -TERM -P $i; done {
kill $OSSL_INT1_PID for i in $(jobs -pr)
do
kill -s HUP "$i"
done
} }
trap cleanup INT TERM EXIT trap cleanup EXIT INT TERM HUP
server=login.live.com server=login.live.com
ca=certs/external/baltimore-cybertrust-root.pem ca=certs/external/baltimore-cybertrust-root.pem
@ -37,7 +36,6 @@ openssl ocsp -port 22221 -nmin 1 \
-CA certs/ocsp/intermediate1-ca-cert.pem \ -CA certs/ocsp/intermediate1-ca-cert.pem \
$@ \ $@ \
& &
OSSL_INT1_PID=$!
sleep 1 sleep 1
# "jobs" is not portable for posix. Must use bash interpreter! # "jobs" is not portable for posix. Must use bash interpreter!

36
scripts/ocsp-stapling2.test
View File

@ -1,19 +1,14 @@
#!/bin/bash #!/bin/bash
#set some invalid default PID(s) so we don't cleanup a process unexpectedly
OSSL_ROOT_PID="INVALID"
OSSL_INT2_PID="INVALID"
OSSL_INT3_PID="INVALID"
# ocsp-stapling.test # ocsp-stapling.test
cleanup(){
# "jobs" is not portable for posix. Must use bash interpreter! cleanup()
for i in `jobs -p`; do pkill -TERM -P $i; done {
kill $OSSL_ROOT_PID for i in $(jobs -pr)
kill $OSSL_INT2_PID do
kill $OSSL_INT3_PID kill -s HUP "$i"
done
} }
trap cleanup INT TERM EXIT trap cleanup EXIT INT TERM HUP
[ ! -x ./examples/client/client ] && echo -e "\n\nClient doesn't exist" && exit 1 [ ! -x ./examples/client/client ] && echo -e "\n\nClient doesn't exist" && exit 1
@ -28,7 +23,6 @@ openssl ocsp -port 22220 -nmin 1 \
-CA certs/ocsp/root-ca-cert.pem \ -CA certs/ocsp/root-ca-cert.pem \
$@ \ $@ \
& &
OSSL_ROOT_PID=$!
# OLD: ./certs/ocsp/ocspd-intermediate2-ca-issued-certs.sh & # OLD: ./certs/ocsp/ocspd-intermediate2-ca-issued-certs.sh &
# NEW: openssl isn't being cleaned up, invoke directly in script for cleanup # NEW: openssl isn't being cleaned up, invoke directly in script for cleanup
@ -40,7 +34,6 @@ openssl ocsp -port 22222 -nmin 1 \
-CA certs/ocsp/intermediate2-ca-cert.pem \ -CA certs/ocsp/intermediate2-ca-cert.pem \
$@ \ $@ \
& &
OSSL_INT2_PID=$!
# OLD: ./certs/ocsp/ocspd-intermediate3-ca-issued-certs.sh & # OLD: ./certs/ocsp/ocspd-intermediate3-ca-issued-certs.sh &
# NEW: openssl isn't being cleaned up, invoke directly in script for cleanup # NEW: openssl isn't being cleaned up, invoke directly in script for cleanup
@ -52,7 +45,6 @@ openssl ocsp -port 22223 -nmin 1 \
-CA certs/ocsp/intermediate3-ca-cert.pem \ -CA certs/ocsp/intermediate3-ca-cert.pem \
$@ \ $@ \
& &
OSSL_INT3_PID=$!
sleep 1 sleep 1
# "jobs" is not portable for posix. Must use bash interpreter! # "jobs" is not portable for posix. Must use bash interpreter!
@ -61,39 +53,39 @@ sleep 1
# client test against our own server - GOOD CERTS # client test against our own server - GOOD CERTS
./examples/server/server -c certs/ocsp/server3-cert.pem -k certs/ocsp/server3-key.pem & ./examples/server/server -c certs/ocsp/server3-cert.pem -k certs/ocsp/server3-key.pem &
sleep 1 sleep 1
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3
RESULT=$? RESULT=$?
[ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1 [ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1
./examples/server/server -c certs/ocsp/server3-cert.pem -k certs/ocsp/server3-key.pem & ./examples/server/server -c certs/ocsp/server3-cert.pem -k certs/ocsp/server3-key.pem &
sleep 1 sleep 1
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3
RESULT=$? RESULT=$?
[ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1 [ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1
# client test against our own server - REVOKED SERVER CERT # client test against our own server - REVOKED SERVER CERT
./examples/server/server -c certs/ocsp/server4-cert.pem -k certs/ocsp/server4-key.pem & ./examples/server/server -c certs/ocsp/server4-cert.pem -k certs/ocsp/server4-key.pem &
sleep 1 sleep 1
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3
RESULT=$? RESULT=$?
[ $RESULT -ne 1 ] && echo -e "\n\nClient connection suceeded $RESULT" && exit 1 [ $RESULT -ne 1 ] && echo -e "\n\nClient connection suceeded $RESULT" && exit 1
./examples/server/server -c certs/ocsp/server4-cert.pem -k certs/ocsp/server4-key.pem & ./examples/server/server -c certs/ocsp/server4-cert.pem -k certs/ocsp/server4-key.pem &
sleep 1 sleep 1
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3
RESULT=$? RESULT=$?
[ $RESULT -ne 1 ] && echo -e "\n\nClient connection suceeded $RESULT" && exit 1 [ $RESULT -ne 1 ] && echo -e "\n\nClient connection suceeded $RESULT" && exit 1
# client test against our own server - REVOKED INTERMEDIATE CERT # client test against our own server - REVOKED INTERMEDIATE CERT
./examples/server/server -c certs/ocsp/server5-cert.pem -k certs/ocsp/server5-key.pem & ./examples/server/server -c certs/ocsp/server5-cert.pem -k certs/ocsp/server5-key.pem &
sleep 1 sleep 1
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3
RESULT=$? RESULT=$?
[ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed $RESULT" && exit 1 [ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed $RESULT" && exit 1
./examples/server/server -c certs/ocsp/server5-cert.pem -k certs/ocsp/server5-key.pem & ./examples/server/server -c certs/ocsp/server5-cert.pem -k certs/ocsp/server5-key.pem &
sleep 1 sleep 1
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3
RESULT=$? RESULT=$?
[ $RESULT -ne 1 ] && echo -e "\n\nClient connection suceeded $RESULT" && exit 1 [ $RESULT -ne 1 ] && echo -e "\n\nClient connection suceeded $RESULT" && exit 1