Skip to content

Commit 7405ea8

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request #7671 from miyazakh/dtls_ocsp
Fix ocsp response message build for DTLS
2 parents c9d83ba + ac5b81e commit 7405ea8

4 files changed

Lines changed: 79 additions & 70 deletions

File tree

‎examples/client/client.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1162,13 +1162,15 @@ static const char* client_usage_msg[][78] = {
11621162
"-D Override Date Errors example\n", /* 18 */
11631163
"-e List Every cipher suite available, \n", /* 19 */
11641164
"-g Send server HTTP GET\n", /* 20 */
1165+
#ifdef WOLFSSL_DTLS
11651166
#ifndef WOLFSSL_DTLS13
11661167
"-u Use UDP DTLS, add -v 2 for DTLSv1, -v 3 for DTLSv1.2"
11671168
" (default)\n", /* 21 */
11681169
#else
11691170
"-u Use UDP DTLS, add -v 2 for DTLSv1, -v 3 for DTLSv1.2"
11701171
" (default), -v 4 for DTLSv1.3\n", /* 21 */
11711172
#endif /* !WOLFSSL_DTLS13 */
1173+
#endif
11721174
#ifdef WOLFSSL_SCTP
11731175
"-G Use SCTP DTLS,"
11741176
" add -v 2 for DTLSv1, -v 3 for DTLSv1.2 (default)\n", /* 22 */
@@ -1387,6 +1389,7 @@ static const char* client_usage_msg[][78] = {
13871389
"-D 日付エラー用コールバック例の上書きを行う\n", /* 18 */
13881390
"-e 利用可能な全ての暗号スイートをリスト, \n", /* 19 */
13891391
"-g サーバーへ HTTP GET を送信\n", /* 20 */
1392+
#ifdef WOLFSSL_DTLS
13901393
"-u UDP DTLSを使用する。\n"
13911394
#ifndef WOLFSSL_DTLS13
13921395
" -v 2 を追加指定するとDTLSv1, "
@@ -1396,6 +1399,7 @@ static const char* client_usage_msg[][78] = {
13961399
"-v 3 を追加指定すると DTLSv1.2 (既定値),\n"
13971400
" -v 4 を追加指定すると DTLSv1.3\n", /* 21 */
13981401
#endif /* !WOLFSSL_DTLS13 */
1402+
#endif /* WOLFSSL_DTLS */
13991403
#ifdef WOLFSSL_SCTP
14001404
"-G SCTP DTLSを使用する。-v 2 を追加指定すると"
14011405
" DTLSv1, -v 3 を追加指定すると DTLSv1.2 (既定値)\n", /* 22 */

‎scripts/ocsp-stapling.test‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -388,6 +388,40 @@ else
388388
echo 'skipping TLS1.3 stapling tests.' 1>&2
389389
fi
390390

391+
# DTLS 1.2 and 1.3 cases
392+
if ./examples/client/client -? 2>&1 | grep -q 'DTLSv1.2'; then
393+
printf '%s\n\n' "------------- TEST CASE DTLS-1 SHOULD PASS -------------------"
394+
# client test against our own server, must staple - GOOD CERT
395+
echo $ready_file2
396+
./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
397+
-k certs/ocsp/server1-key.pem -u -v 3 \
398+
-p $port3 &
399+
wolf_pid3=$!
400+
401+
sleep 0.2
402+
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 3 \
403+
-W 1 -p $port3
404+
RESULT=$?
405+
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 5 failed" && exit 1
406+
printf '%s\n\n' "Test PASSED!"
407+
fi
408+
409+
if ./examples/client/client -? 2>&1 | grep -q 'DTLSv1.3'; then
410+
printf '%s\n\n' "------------- TEST CASE DTLS-2 SHOULD PASS -------------------"
411+
# client test against our own server, must staple - GOOD CERT
412+
./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
413+
-k certs/ocsp/server1-key.pem -u -v 4 \
414+
-p $port3 &
415+
wolf_pid3=$!
416+
sleep 0.2
417+
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 4 \
418+
-W 1 -p $port3
419+
RESULT=$?
420+
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 5 failed" && exit 1
421+
printf '%s\n\n' "Test PASSED!"
422+
423+
fi
424+
391425
# need a unique port since may run the same time as testsuite
392426
generate_port() {
393427
#-------------------------------------------------------------------------#

‎scripts/ocsp-stapling2.test‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -499,6 +499,22 @@ RESULT=$?
499499
&& exit 1
500500
printf '%s\n\n' "Test PASSED!"
501501

502+
503+
if ./examples/client/client -? 2>&1 | grep -q 'DTLS'; then
504+
printf '%s\n\n' "------------- TEST CASE DTLS-1 SHOULD PASS -------------------"
505+
# client test against our own server - GOOD CERTS
506+
./examples/server/server -c certs/ocsp/server3-cert.pem \
507+
-k certs/ocsp/server3-key.pem -R $ready_file5 \
508+
-p $port5 -u -v 3 &
509+
server_pid5=$!
510+
sleep 0.2
511+
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -u -v 3 \
512+
-p $port5
513+
RESULT=$?
514+
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
515+
printf '%s\n\n' "Test PASSED!"
516+
fi
517+
502518
printf '%s\n\n' "------------------- TESTS COMPLETE ---------------------------"
503519

504520
exit 0

‎src/internal.c‎

Lines changed: 25 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -23844,6 +23844,7 @@ static int BuildCertificateStatus(WOLFSSL* ssl, byte type, buffer* status,
2384423844
byte* output = NULL;
2384523845
word32 idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
2384623846
word32 length = ENUM_LEN;
23847+
word32 headerSz= idx;
2384723848
int sendSz = 0;
2384823849
int ret = 0;
2384923850
int i = 0;
@@ -23863,88 +23864,42 @@ static int BuildCertificateStatus(WOLFSSL* ssl, byte type, buffer* status,
2386323864
default:
2386423865
return 0;
2386523866
}
23867+
#ifdef WOLFSSL_DTLS
23868+
if (ssl->options.dtls) {
23869+
headerSz = idx = DTLS_RECORD_HEADER_SZ + DTLS_HANDSHAKE_HEADER_SZ;
23870+
sendSz = idx + length;
2386623871

23872+
} else
23873+
#endif
2386723874
sendSz = (int)(idx + length);
2386823875

2386923876
if (ssl->keys.encryptionOn)
2387023877
sendSz += MAX_MSG_EXTRA;
2387123878

23872-
/* Set this in case CheckAvailableSize returns a WANT_WRITE so that state
23873-
* is not advanced yet */
23874-
ssl->options.buildingMsg = 1;
23875-
23876-
if ((ret = CheckAvailableSize(ssl, sendSz)) == 0) {
23877-
output = GetOutputBuffer(ssl);
23878-
23879-
AddHeaders(output, length, certificate_status, ssl);
23880-
23881-
output[idx++] = type;
23882-
23883-
if (type == WOLFSSL_CSR2_OCSP_MULTI) {
23884-
c32to24(length - (ENUM_LEN + OPAQUE24_LEN), output + idx);
23885-
idx += OPAQUE24_LEN;
23886-
}
23887-
23888-
for (i = 0; i < count; i++) {
23889-
c32to24(status[i].length, output + idx);
23890-
idx += OPAQUE24_LEN;
23891-
23892-
XMEMCPY(output + idx, status[i].buffer, status[i].length);
23893-
idx += status[i].length;
23894-
}
23895-
23896-
if (IsEncryptionOn(ssl, 1)) {
23897-
byte* input;
23898-
int inputSz = (int)idx; /* build msg adds rec hdr */
23899-
int recordHeaderSz = RECORD_HEADER_SZ;
23879+
output =(byte*)XMALLOC(sendSz, ssl->heap, DYNAMIC_TYPE_OCSP);
23880+
if (output == NULL)
23881+
return MEMORY_E;
2390023882

23901-
if (ssl->options.dtls)
23902-
recordHeaderSz += DTLS_RECORD_EXTRA;
23903-
inputSz -= recordHeaderSz;
23904-
input = (byte*)XMALLOC(inputSz, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
23905-
if (input == NULL)
23906-
return MEMORY_E;
23883+
AddHeaders(output, length, certificate_status, ssl);
2390723884

23908-
XMEMCPY(input, output + recordHeaderSz, inputSz);
23909-
#ifdef WOLFSSL_DTLS
23910-
ret = DtlsMsgPoolSave(ssl, input, (word32)inputSz, certificate_status);
23911-
#endif
23912-
if (ret == 0)
23913-
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
23914-
handshake, 1, 0, 0, CUR_ORDER);
23915-
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
23885+
output[idx++] = type;
2391623886

23917-
if (sendSz < 0)
23918-
ret = sendSz;
23919-
}
23920-
else {
23921-
#ifdef WOLFSSL_DTLS
23922-
if (ret == 0 && IsDtlsNotSctpMode(ssl))
23923-
ret = DtlsMsgPoolSave(ssl, output, (word32)sendSz, certificate_status);
23924-
if (ret == 0 && ssl->options.dtls)
23925-
DtlsSEQIncrement(ssl, CUR_ORDER);
23926-
#endif
23927-
ret = HashOutput(ssl, output, sendSz, 0);
23928-
}
23887+
if (type == WOLFSSL_CSR2_OCSP_MULTI) {
23888+
c32to24(length - (ENUM_LEN + OPAQUE24_LEN), output + idx);
23889+
idx += OPAQUE24_LEN;
23890+
}
2392923891

23930-
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
23931-
if (ret == 0 && ssl->hsInfoOn)
23932-
AddPacketName(ssl, "CertificateStatus");
23933-
if (ret == 0 && ssl->toInfoOn) {
23934-
ret = AddPacketInfo(ssl, "CertificateStatus", handshake, output,
23935-
sendSz, WRITE_PROTO, 0, ssl->heap);
23936-
if (ret != 0)
23937-
return ret;
23938-
}
23939-
#endif
23892+
for (i = 0; i < count; i++) {
23893+
c32to24(status[i].length, output + idx);
23894+
idx += OPAQUE24_LEN;
2394023895

23941-
if (ret == 0) {
23942-
ssl->options.buildingMsg = 0;
23943-
ssl->buffers.outputBuffer.length += sendSz;
23944-
if (!ssl->options.groupMessages)
23945-
ret = SendBuffered(ssl);
23946-
}
23896+
XMEMCPY(output + idx, status[i].buffer, status[i].length);
23897+
idx += status[i].length;
2394723898
}
23899+
/* Send Message. Handled message fragmentation in the function if needed */
23900+
ret = SendHandshakeMsg(ssl, output, (sendSz - headerSz), certificate_status,
23901+
"Certificate Status");
23902+
XFREE(output, ssl->heap, DYNAMIC_TYPE_OCSP);
2394823903

2394923904
WOLFSSL_LEAVE("BuildCertificateStatus", ret);
2395023905
return ret;

0 commit comments

Comments
 (0)