Skip to content

Commit 30eb558

Browse files
miyazakhmiyazakh
committed
fix ocsp response when using DTLS
1 parent 385a097 commit 30eb558

4 files changed

Lines changed: 88 additions & 70 deletions

File tree

‎examples/client/client.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1162,13 +1162,15 @@ static const char* client_usage_msg[][78] = {
11621162
"-D Override Date Errors example\n", /* 18 */
11631163
"-e List Every cipher suite available, \n", /* 19 */
11641164
"-g Send server HTTP GET\n", /* 20 */
1165+
#ifdef WOLFSSL_DTLS
11651166
#ifndef WOLFSSL_DTLS13
11661167
"-u Use UDP DTLS, add -v 2 for DTLSv1, -v 3 for DTLSv1.2"
11671168
" (default)\n", /* 21 */
11681169
#else
11691170
"-u Use UDP DTLS, add -v 2 for DTLSv1, -v 3 for DTLSv1.2"
11701171
" (default), -v 4 for DTLSv1.3\n", /* 21 */
11711172
#endif /* !WOLFSSL_DTLS13 */
1173+
#endif
11721174
#ifdef WOLFSSL_SCTP
11731175
"-G Use SCTP DTLS,"
11741176
" add -v 2 for DTLSv1, -v 3 for DTLSv1.2 (default)\n", /* 22 */
@@ -1387,6 +1389,7 @@ static const char* client_usage_msg[][78] = {
13871389
"-D 日付エラー用コールバック例の上書きを行う\n", /* 18 */
13881390
"-e 利用可能な全ての暗号スイートをリスト, \n", /* 19 */
13891391
"-g サーバーへ HTTP GET を送信\n", /* 20 */
1392+
#ifdef WOLFSSL_DTLS
13901393
"-u UDP DTLSを使用する。\n"
13911394
#ifndef WOLFSSL_DTLS13
13921395
" -v 2 を追加指定するとDTLSv1, "
@@ -1396,6 +1399,7 @@ static const char* client_usage_msg[][78] = {
13961399
"-v 3 を追加指定すると DTLSv1.2 (既定値),\n"
13971400
" -v 4 を追加指定すると DTLSv1.3\n", /* 21 */
13981401
#endif /* !WOLFSSL_DTLS13 */
1402+
#endif /* WOLFSSL_DTLS */
13991403
#ifdef WOLFSSL_SCTP
14001404
"-G SCTP DTLSを使用する。-v 2 を追加指定すると"
14011405
" DTLSv1, -v 3 を追加指定すると DTLSv1.2 (既定値)\n", /* 22 */

‎scripts/ocsp-stapling.test‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -388,6 +388,49 @@ else
388388
echo 'skipping TLS1.3 stapling tests.' 1>&2
389389
fi
390390

391+
printf '%s\n\n' "------------- TEST CASE 1 SHOULD PASS ------------------------"
392+
# client test against our own server - GOOD CERT
393+
./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
394+
-k certs/ocsp/server1-key.pem -p $port3 &
395+
wolf_pid3=$!
396+
wait_for_readyFile "$ready_file2" $wolf_pid3 $port3
397+
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p $port3
398+
RESULT=$?
399+
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
400+
printf '%s\n\n' "Test PASSED!"
401+
402+
# DTLS 1.2 and 1.3 cases
403+
if ./examples/client/client -? 2>&1 | grep -q 'DTLS'; then
404+
printf '%s\n\n' "------------- TEST CASE DTLS-1 SHOULD PASS -------------------"
405+
# client test against our own server, must staple - GOOD CERT
406+
echo $ready_file2
407+
./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
408+
-k certs/ocsp/server1-key.pem -u -v 3 \
409+
-p $port3 &
410+
wolf_pid3=$!
411+
412+
sleep 0.2
413+
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 3 \
414+
-W 1 -p $port3
415+
RESULT=$?
416+
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 5 failed" && exit 1
417+
printf '%s\n\n' "Test PASSED!"
418+
419+
printf '%s\n\n' "------------- TEST CASE DTLS-2 SHOULD PASS -------------------"
420+
# client test against our own server, must staple - GOOD CERT
421+
./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
422+
-k certs/ocsp/server1-key.pem -u -v 4 \
423+
-p $port3 &
424+
wolf_pid3=$!
425+
sleep 0.2
426+
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 4 \
427+
-W 1 -p $port3
428+
RESULT=$?
429+
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 5 failed" && exit 1
430+
printf '%s\n\n' "Test PASSED!"
431+
432+
fi
433+
391434
# need a unique port since may run the same time as testsuite
392435
generate_port() {
393436
#-------------------------------------------------------------------------#

‎scripts/ocsp-stapling2.test‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -499,6 +499,22 @@ RESULT=$?
499499
&& exit 1
500500
printf '%s\n\n' "Test PASSED!"
501501

502+
503+
if ./examples/client/client -? 2>&1 | grep -q 'DTLS'; then
504+
printf '%s\n\n' "------------- TEST CASE DTLS-1 SHOULD PASS -------------------"
505+
# client test against our own server - GOOD CERTS
506+
./examples/server/server -c certs/ocsp/server3-cert.pem \
507+
-k certs/ocsp/server3-key.pem -R $ready_file5 \
508+
-p $port5 -u -v 3 &
509+
server_pid5=$!
510+
sleep 0.2
511+
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -u -v 3 \
512+
-p $port5
513+
RESULT=$?
514+
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
515+
printf '%s\n\n' "Test PASSED!"
516+
fi
517+
502518
printf '%s\n\n' "------------------- TESTS COMPLETE ---------------------------"
503519

504520
exit 0

‎src/internal.c‎

Lines changed: 25 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -23860,6 +23860,7 @@ static int BuildCertificateStatus(WOLFSSL* ssl, byte type, buffer* status,
2386023860
byte* output = NULL;
2386123861
word32 idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
2386223862
word32 length = ENUM_LEN;
23863+
word32 headerSz= idx;
2386323864
int sendSz = 0;
2386423865
int ret = 0;
2386523866
int i = 0;
@@ -23879,88 +23880,42 @@ static int BuildCertificateStatus(WOLFSSL* ssl, byte type, buffer* status,
2387923880
default:
2388023881
return 0;
2388123882
}
23883+
#ifdef WOLFSSL_DTLS
23884+
if (ssl->options.dtls) {
23885+
headerSz = idx = DTLS_RECORD_HEADER_SZ + DTLS_HANDSHAKE_HEADER_SZ;
23886+
sendSz = idx + length;
2388223887

23888+
} else
23889+
#endif
2388323890
sendSz = (int)(idx + length);
2388423891

2388523892
if (ssl->keys.encryptionOn)
2388623893
sendSz += MAX_MSG_EXTRA;
2388723894

23888-
/* Set this in case CheckAvailableSize returns a WANT_WRITE so that state
23889-
* is not advanced yet */
23890-
ssl->options.buildingMsg = 1;
23891-
23892-
if ((ret = CheckAvailableSize(ssl, sendSz)) == 0) {
23893-
output = GetOutputBuffer(ssl);
23894-
23895-
AddHeaders(output, length, certificate_status, ssl);
23896-
23897-
output[idx++] = type;
23898-
23899-
if (type == WOLFSSL_CSR2_OCSP_MULTI) {
23900-
c32to24(length - (ENUM_LEN + OPAQUE24_LEN), output + idx);
23901-
idx += OPAQUE24_LEN;
23902-
}
23903-
23904-
for (i = 0; i < count; i++) {
23905-
c32to24(status[i].length, output + idx);
23906-
idx += OPAQUE24_LEN;
23907-
23908-
XMEMCPY(output + idx, status[i].buffer, status[i].length);
23909-
idx += status[i].length;
23910-
}
23911-
23912-
if (IsEncryptionOn(ssl, 1)) {
23913-
byte* input;
23914-
int inputSz = (int)idx; /* build msg adds rec hdr */
23915-
int recordHeaderSz = RECORD_HEADER_SZ;
23895+
output =(byte*)XMALLOC(sendSz, ssl->heap, DYNAMIC_TYPE_OCSP);
23896+
if (output == NULL)
23897+
return MEMORY_E;
2391623898

23917-
if (ssl->options.dtls)
23918-
recordHeaderSz += DTLS_RECORD_EXTRA;
23919-
inputSz -= recordHeaderSz;
23920-
input = (byte*)XMALLOC(inputSz, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
23921-
if (input == NULL)
23922-
return MEMORY_E;
23899+
AddHeaders(output, length, certificate_status, ssl);
2392323900

23924-
XMEMCPY(input, output + recordHeaderSz, inputSz);
23925-
#ifdef WOLFSSL_DTLS
23926-
ret = DtlsMsgPoolSave(ssl, input, (word32)inputSz, certificate_status);
23927-
#endif
23928-
if (ret == 0)
23929-
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
23930-
handshake, 1, 0, 0, CUR_ORDER);
23931-
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
23901+
output[idx++] = type;
2393223902

23933-
if (sendSz < 0)
23934-
ret = sendSz;
23935-
}
23936-
else {
23937-
#ifdef WOLFSSL_DTLS
23938-
if (ret == 0 && IsDtlsNotSctpMode(ssl))
23939-
ret = DtlsMsgPoolSave(ssl, output, (word32)sendSz, certificate_status);
23940-
if (ret == 0 && ssl->options.dtls)
23941-
DtlsSEQIncrement(ssl, CUR_ORDER);
23942-
#endif
23943-
ret = HashOutput(ssl, output, sendSz, 0);
23944-
}
23903+
if (type == WOLFSSL_CSR2_OCSP_MULTI) {
23904+
c32to24(length - (ENUM_LEN + OPAQUE24_LEN), output + idx);
23905+
idx += OPAQUE24_LEN;
23906+
}
2394523907

23946-
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
23947-
if (ret == 0 && ssl->hsInfoOn)
23948-
AddPacketName(ssl, "CertificateStatus");
23949-
if (ret == 0 && ssl->toInfoOn) {
23950-
ret = AddPacketInfo(ssl, "CertificateStatus", handshake, output,
23951-
sendSz, WRITE_PROTO, 0, ssl->heap);
23952-
if (ret != 0)
23953-
return ret;
23954-
}
23955-
#endif
23908+
for (i = 0; i < count; i++) {
23909+
c32to24(status[i].length, output + idx);
23910+
idx += OPAQUE24_LEN;
2395623911

23957-
if (ret == 0) {
23958-
ssl->options.buildingMsg = 0;
23959-
ssl->buffers.outputBuffer.length += sendSz;
23960-
if (!ssl->options.groupMessages)
23961-
ret = SendBuffered(ssl);
23962-
}
23912+
XMEMCPY(output + idx, status[i].buffer, status[i].length);
23913+
idx += status[i].length;
2396323914
}
23915+
/* Send Message. Handled message fragmentation in the function if needed */
23916+
ret = SendHandshakeMsg(ssl, output, (sendSz - headerSz), certificate_status,
23917+
"Certificate Status");
23918+
XFREE(output, ssl->heap, DYNAMIC_TYPE_OCSP);
2396423919

2396523920
WOLFSSL_LEAVE("BuildCertificateStatus", ret);
2396623921
return ret;

0 commit comments

Comments
 (0)