Skip to content

Commit f8da04d

Browse files
douzzerdouzzer
authored
Merge pull request #7766 from miyazakh/zd18141_tls13_ocsp
Add OCSP response for intermediate cert into Certificate extension on TLS1.3
2 parents 65742c4 + 5105082 commit f8da04d

14 files changed

Lines changed: 1114 additions & 169 deletions

File tree

‎SCRIPTS-LIST‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ scripts/
3535
google.test - example client test against google, part of tests
3636
resume.test - example sessoin resume test, part of tests
3737
ocsp-stapling.test - example client test against globalsign, part of tests
38+
ocsp-stapling1_tls13multi.text - example client test against example server, part of tests
3839
ocsp-stapling2.test - example client test against example server, part of tests
3940
sniffer-testsuite.test - runs snifftest on a pcap of testsuite, part of tests
4041
in sniffer mode

‎configure.ac‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6001,10 +6001,27 @@ fi
60016001
60026002
# Certificate Status Request : a.k.a. OCSP Stapling
60036003
AC_ARG_ENABLE([ocspstapling],
6004-
[AS_HELP_STRING([--enable-ocspstapling],[Enable OCSP Stapling (default: disabled)])],
6004+
[AS_HELP_STRING([--enable-ocspstapling],[Enable OCSP Stapling ((options: yes, no-multi, no, disabled default: disabled)])],
60056005
[ ENABLED_CERTIFICATE_STATUS_REQUEST=$enableval ],
60066006
[ ENABLED_CERTIFICATE_STATUS_REQUEST=no ]
60076007
)
6008+
AS_CASE([$ENABLED_CERTIFICATE_STATUS_REQUEST],
6009+
[no],[
6010+
ENABLED_CERTIFICATE_STATUS_REQUEST="no"
6011+
ENABLED_TLS_OCSP_MULTI="no"
6012+
],
6013+
[disabled],[
6014+
ENABLED_CERTIFICATE_STATUS_REQUEST="no"
6015+
ENABLED_TLS_OCSP_MULTI="no"
6016+
],
6017+
[yes],[
6018+
ENABLED_CERTIFICATE_STATUS_REQUEST="yes"
6019+
ENABLED_TLS_OCSP_MULTI="yes"
6020+
],
6021+
[no-multi],[
6022+
ENABLED_CERTIFICATE_STATUS_REQUEST="yes"
6023+
ENABLED_TLS_OCSP_MULTI="no"
6024+
])
60086025
60096026
if test "x$ENABLED_NGINX" = "xyes" || test "x$ENABLED_WPAS" = "xyes" || \
60106027
test "x$ENABLED_HAPROXY" = "xyes" || test "x$ENABLED_LIGHTY" = "xyes" || \
@@ -9586,7 +9603,17 @@ if test "$ENABLED_DH" != "no" && test "$ENABLED_DH" != "const"; then
95869603
LT_LIB_M
95879604
fi
95889605
9589-
9606+
# mulitple OCSP stapling for TLS 1.3 Certificate extension
9607+
if test "$ENABLED_CERTIFICATE_STATUS_REQUEST" = "yes"
9608+
then
9609+
if test "$ENABLED_TLS13" = "yes"
9610+
then
9611+
if test "$ENABLED_TLS_OCSP_MULTI" = "yes"
9612+
then
9613+
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TLS_OCSP_MULTI"
9614+
fi
9615+
fi
9616+
fi
95909617
################################################################################
95919618
95929619
# USER SETTINGS
@@ -9841,6 +9868,7 @@ AM_CONDITIONAL([BUILD_SM4],[test "x$ENABLED_SM4" != "xno" || test "x$ENABLED_USE
98419868
AM_CONDITIONAL([BUILD_INLINE],[test "x$ENABLED_INLINE" = "xyes"])
98429869
AM_CONDITIONAL([BUILD_OCSP],[test "x$ENABLED_OCSP" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
98439870
AM_CONDITIONAL([BUILD_OCSP_STAPLING],[test "x$ENABLED_CERTIFICATE_STATUS_REQUEST" = "xyes"])
9871+
AM_CONDITIONAL([BUILD_OCSP_STAPLING_MULTI],[test "x$ENABLED_CERTIFICATE_STATUS_REQUEST" = "xyes" && test "x$ENABLED_TLS13" = "xyes" && test "x$ENABLED_TLS_OCSP_MULTI" = "xyes"])
98449872
AM_CONDITIONAL([BUILD_OCSP_STAPLING_V2],[test "x$ENABLED_CERTIFICATE_STATUS_REQUEST_V2" = "xyes"])
98459873
AM_CONDITIONAL([BUILD_CRL],[test "x$ENABLED_CRL" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
98469874
AM_CONDITIONAL([BUILD_CRL_MONITOR],[test "x$ENABLED_CRL_MONITOR" = "xyes"])

‎examples/client/client.c‎

Lines changed: 53 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1242,66 +1242,70 @@ static const char* client_usage_msg[][78] = {
12421242
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
12431243
"-W <num> Use OCSP Stapling (1 v1, 2 v2, 3 v2 multi)\n", /* 41 */
12441244
" With 'm' at end indicates MUST staple\n", /* 42 */
1245+
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_TLS_OCSP_MULTI)
1246+
" -W 1 -v 4, Perform multi OCSP stapling for TLS13\n",
1247+
/* 43 */
1248+
#endif
12451249
#endif
12461250
#if defined(ATOMIC_USER) && !defined(WOLFSSL_AEAD_ONLY)
1247-
"-U Atomic User Record Layer Callbacks\n", /* 43 */
1251+
"-U Atomic User Record Layer Callbacks\n", /* 45 */
12481252
#endif
12491253
#ifdef HAVE_PK_CALLBACKS
1250-
"-P Public Key Callbacks\n", /* 44 */
1254+
"-P Public Key Callbacks\n", /* 45 */
12511255
#endif
12521256
#ifdef HAVE_ANON
1253-
"-a Anonymous client\n", /* 45 */
1257+
"-a Anonymous client\n", /* 46 */
12541258
#endif
12551259
#ifdef HAVE_CRL
1256-
"-C Disable CRL\n", /* 46 */
1260+
"-C Disable CRL\n", /* 47 */
12571261
#endif
12581262
#ifdef WOLFSSL_TRUST_PEER_CERT
1259-
"-E <file> Path to load trusted peer cert\n", /* 47 */
1263+
"-E <file> Path to load trusted peer cert\n", /* 48 */
12601264
#endif
12611265
#ifdef HAVE_WNR
1262-
"-q <file> Whitewood config file, defaults\n", /* 48 */
1266+
"-q <file> Whitewood config file, defaults\n", /* 49 */
12631267
#endif
12641268
"-H <arg> Internal tests"
1265-
" [defCipherList, exitWithRet, verifyFail, useSupCurve,\n", /* 49 */
1266-
" loadSSL, disallowETM]\n", /* 50 */
1269+
" [defCipherList, exitWithRet, verifyFail, useSupCurve,\n", /* 50 */
1270+
" loadSSL, disallowETM]\n", /* 51 */
12671271
#ifdef WOLFSSL_TLS13
1268-
"-J Use HelloRetryRequest to choose group for KE\n", /* 51 */
1269-
"-K Key Exchange for PSK not using (EC)DHE\n", /* 52 */
1270-
"-I Update keys and IVs before sending data\n", /* 53 */
1272+
"-J Use HelloRetryRequest to choose group for KE\n", /* 52 */
1273+
"-K Key Exchange for PSK not using (EC)DHE\n", /* 53 */
1274+
"-I Update keys and IVs before sending data\n", /* 54 */
12711275
#ifndef NO_DH
1272-
"-y Key Share with FFDHE named groups only\n", /* 54 */
1276+
"-y Key Share with FFDHE named groups only\n", /* 55 */
12731277
#endif
12741278
#ifdef HAVE_ECC
1275-
"-Y Key Share with ECC named groups only\n", /* 55 */
1279+
"-Y Key Share with ECC named groups only\n", /* 56 */
12761280
#endif
12771281
#endif /* WOLFSSL_TLS13 */
12781282
#ifdef HAVE_CURVE25519
1279-
"-t Use X25519 for key exchange\n", /* 56 */
1283+
"-t Use X25519 for key exchange\n", /* 57 */
12801284
#endif
12811285
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
1282-
"-Q Support requesting certificate post-handshake\n", /* 57 */
1286+
"-Q Support requesting certificate post-handshake\n", /* 58 */
12831287
#endif
12841288
#ifdef WOLFSSL_EARLY_DATA
1285-
"-0 Early data sent to server (0-RTT handshake)\n", /* 58 */
1289+
"-0 Early data sent to server (0-RTT handshake)\n", /* 59 */
12861290
#endif
12871291
#ifdef WOLFSSL_MULTICAST
1288-
"-3 <grpid> Multicast, grpid < 256\n", /* 59 */
1292+
"-3 <grpid> Multicast, grpid < 256\n", /* 60 */
12891293
#endif
12901294
"-1 <num> Display a result by specified language.\n"
1291-
" 0: English, 1: Japanese\n", /* 60 */
1295+
" 0: English, 1: Japanese\n", /* 61 */
12921296
#if !defined(NO_DH) && !defined(HAVE_FIPS) && \
12931297
!defined(HAVE_SELFTEST) && !defined(WOLFSSL_OLD_PRIME_CHECK)
1294-
"-2 Disable DH Prime check\n", /* 61 */
1298+
"-2 Disable DH Prime check\n", /* 62 */
12951299
#endif
12961300
#ifdef HAVE_SECURE_RENEGOTIATION
1297-
"-4 Use resumption for renegotiation\n", /* 62 */
1301+
"-4 Use resumption for renegotiation\n", /* 63 */
12981302
#endif
12991303
#ifdef HAVE_TRUSTED_CA
1300-
"-5 Use Trusted CA Key Indication\n", /* 63 */
1304+
"-5 Use Trusted CA Key Indication\n", /* 64 */
13011305
#endif
13021306
"-6 Simulate WANT_WRITE errors on every other IO send\n",
13031307
#ifdef HAVE_CURVE448
1304-
"-8 Use X448 for key exchange\n", /* 66 */
1308+
"-8 Use X448 for key exchange\n", /* 65 */
13051309
#endif
13061310
#if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \
13071311
(defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \
@@ -1469,69 +1473,73 @@ static const char* client_usage_msg[][78] = {
14691473
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
14701474
"-W <num> OCSP Staplingを使用する"
14711475
" (1 v1, 2 v2, 3 v2 multi)\n", /* 41 */
1472-
" 'm' を最後に指定すると必ず staple を使用する\n" /* 42 */
1476+
" 'm' を最後に指定すると必ず staple を使用する\n" /* 42 */
1477+
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_TLS_OCSP_MULTI)
1478+
" -W 1 -v 4, "
1479+
"TLS13 使用時に複数(Multi)の OCSP を実施します\n" /* 43 */
1480+
#endif
14731481
#endif
14741482
#if defined(ATOMIC_USER) && !defined(WOLFSSL_AEAD_ONLY)
14751483
"-U アトミック・ユーザー記録の"
1476-
"コールバックを利用する\n", /* 43 */
1484+
"コールバックを利用する\n", /* 44 */
14771485
#endif
14781486
#ifdef HAVE_PK_CALLBACKS
1479-
"-P 公開鍵コールバック\n", /* 44 */
1487+
"-P 公開鍵コールバック\n", /* 45 */
14801488
#endif
14811489
#ifdef HAVE_ANON
1482-
"-a 匿名クライアント\n", /* 45 */
1490+
"-a 匿名クライアント\n", /* 46 */
14831491
#endif
14841492
#ifdef HAVE_CRL
1485-
"-C CRLを無効\n", /* 46 */
1493+
"-C CRLを無効\n", /* 47 */
14861494
#endif
14871495
#ifdef WOLFSSL_TRUST_PEER_CERT
1488-
"-E <file> 信頼出来るピアの証明書ロードの為のパス\n", /* 47 */
1496+
"-E <file> 信頼出来るピアの証明書ロードの為のパス\n", /* 48 */
14891497
#endif
14901498
#ifdef HAVE_WNR
1491-
"-q <file> Whitewood コンフィグファイル, 既定値\n", /* 48 */
1499+
"-q <file> Whitewood コンフィグファイル, 既定値\n", /* 49 */
14921500
#endif
14931501
"-H <arg> 内部テスト"
1494-
" [defCipherList, exitWithRet, verifyFail, useSupCurve,\n", /* 49 */
1495-
" loadSSL, disallowETM]\n", /* 50 */
1502+
" [defCipherList, exitWithRet, verifyFail, useSupCurve,\n", /* 50 */
1503+
" loadSSL, disallowETM]\n", /* 51 */
14961504
#ifdef WOLFSSL_TLS13
1497-
"-J HelloRetryRequestをKEのグループ選択に使用する\n", /* 51 */
1498-
"-K 鍵交換にPSKを使用、(EC)DHEは使用しない\n", /* 52 */
1499-
"-I データ送信前に、鍵とIVを更新する\n", /* 53 */
1505+
"-J HelloRetryRequestをKEのグループ選択に使用する\n", /* 52 */
1506+
"-K 鍵交換にPSKを使用、(EC)DHEは使用しない\n", /* 53 */
1507+
"-I データ送信前に、鍵とIVを更新する\n", /* 54 */
15001508
#ifndef NO_DH
1501-
"-y FFDHE名前付きグループとの鍵共有のみ\n", /* 54 */
1509+
"-y FFDHE名前付きグループとの鍵共有のみ\n", /* 55 */
15021510
#endif
15031511
#ifdef HAVE_ECC
1504-
"-Y ECC名前付きグループとの鍵共有のみ\n", /* 55 */
1512+
"-Y ECC名前付きグループとの鍵共有のみ\n", /* 56 */
15051513
#endif
15061514
#endif /* WOLFSSL_TLS13 */
15071515
#ifdef HAVE_CURVE25519
1508-
"-t X25519を鍵交換に使用する\n", /* 56 */
1516+
"-t X25519を鍵交換に使用する\n", /* 57 */
15091517
#endif
15101518
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
1511-
"-Q ポストハンドシェークの証明要求をサポートする\n", /* 57 */
1519+
"-Q ポストハンドシェークの証明要求をサポートする\n", /* 58 */
15121520
#endif
15131521
#ifdef WOLFSSL_EARLY_DATA
15141522
"-0 Early data をサーバーへ送信する"
1515-
"（0-RTTハンドシェイク）\n", /* 58 */
1523+
"（0-RTTハンドシェイク）\n", /* 59 */
15161524
#endif
15171525
#ifdef WOLFSSL_MULTICAST
1518-
"-3 <grpid> マルチキャスト, grpid < 256\n", /* 59 */
1526+
"-3 <grpid> マルチキャスト, grpid < 256\n", /* 60 */
15191527
#endif
15201528
"-1 <num> 指定された言語で結果を表示します。\n"
1521-
" 0: 英語、 1: 日本語\n", /* 60 */
1529+
" 0: 英語、 1: 日本語\n", /* 61 */
15221530
#if !defined(NO_DH) && !defined(HAVE_FIPS) && \
15231531
!defined(HAVE_SELFTEST) && !defined(WOLFSSL_OLD_PRIME_CHECK)
1524-
"-2 DHプライム番号チェックを無効にする\n", /* 61 */
1532+
"-2 DHプライム番号チェックを無効にする\n", /* 62 */
15251533
#endif
15261534
#ifdef HAVE_SECURE_RENEGOTIATION
1527-
"-4 再交渉に再開を使用\n", /* 62 */
1535+
"-4 再交渉に再開を使用\n", /* 63 */
15281536
#endif
15291537
#ifdef HAVE_TRUSTED_CA
1530-
"-5 信頼できる認証局の鍵表示を使用する\n", /* 63 */
1538+
"-5 信頼できる認証局の鍵表示を使用する\n", /* 64 */
15311539
#endif
15321540
"-6 WANT_WRITE エラーを全てのIO 送信でシミュレートします\n",
15331541
#ifdef HAVE_CURVE448
1534-
"-8 鍵交換に X448 を使用する\n", /* 66 */
1542+
"-8 鍵交換に X448 を使用する\n", /* 65 */
15351543
#endif
15361544
#if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \
15371545
(defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \

‎scripts/include.am‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,19 @@ endif
2727

2828
if BUILD_OCSP_STAPLING
2929
dist_noinst_SCRIPTS+= scripts/ocsp-stapling.test
30+
if BUILD_OCSP_STAPLING_MULTI
31+
dist_noinst_SCRIPTS+= scripts/ocsp-stapling_tls13multi.test
32+
endif
3033
if !BUILD_OCSP_STAPLING_V2
3134
testsuite/testsuite.log: scripts/ocsp-stapling.log scripts/ocsp-stapling-with-ca-as-responder.log
3235
endif
3336
scripts/ocsp-stapling.log: scripts/ocsp.log
3437
dist_noinst_SCRIPTS+= scripts/ocsp-stapling-with-ca-as-responder.test
3538
scripts/ocsp-stapling-with-ca-as-responder.log: scripts/ocsp.log
3639
scripts/ocsp-stapling-with-ca-as-responder.log: scripts/ocsp-stapling.log
40+
if BUILD_OCSP_STAPLING_MULTI
41+
scripts/ocsp-stapling_tls13multi.log: scripts/ocsp-stapling-with-ca-as-responder.log
42+
endif
3743
endif
3844

3945
if BUILD_OCSP_STAPLING_V2

‎scripts/ocsp-stapling.test‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,20 @@ if ./examples/client/client '-#' | fgrep -q -e ' -DWOLFSSL_SNIFFER '; then
2727
exit 77
2828
fi
2929

30+
if ./examples/client/client -V | grep -q 4; then
31+
tls13=yes
32+
fi
33+
if ./examples/client/client -? 2>&1 | grep -q 'DTLSv1.3'; then
34+
dtls13=yes
35+
fi
36+
./examples/client/client '-?' 2>&1 | grep -- 'Perform multi OCSP stapling for TLS13'
37+
if [ $? -eq 0 ]; then
38+
tls13multi=yes
39+
else
40+
tls13multi=no
41+
fi
42+
43+
3044
if openssl s_server -help 2>&1 | fgrep -q -i ipv6 && nc -h 2>&1 | fgrep -q -i ipv6; then
3145
IPV6_SUPPORTED=yes
3246
else
@@ -346,7 +360,7 @@ RESULT=$?
346360
printf '%s\n\n' "Test successfully REVOKED!"
347361

348362

349-
if ./examples/client/client -V | grep -q 4; then
363+
if [[ ("$tls13" == "yes") && ("$tls13multi" == "no") ]]; then
350364
printf '%s\n\n' "------------- TEST CASE 3 SHOULD PASS --------------------"
351365
# client test against our own server - GOOD CERT
352366
remove_single_rF "$ready_file2"
@@ -412,7 +426,7 @@ if ./examples/client/client -? 2>&1 | grep -q 'DTLSv1.2'; then
412426
printf '%s\n\n' "Test PASSED!"
413427
fi
414428

415-
if ./examples/client/client -? 2>&1 | grep -q 'DTLSv1.3'; then
429+
if [[ ("$dtls13" == "yes") && ("$tls13multi" == "no") ]]; then
416430
printf '%s\n\n' "------------- TEST CASE DTLS-2 SHOULD PASS -------------------"
417431
# client test against our own server, must staple - GOOD CERT
418432
./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \

‎scripts/ocsp-stapling2.test‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ fi
4343
if ./examples/client/client '-#' | fgrep -q -e ' -DTEST_IPV6 '; then
4444
if [[ "$IPV6_SUPPORTED" == "no" ]]; then
4545
echo 'Skipping IPV6 test in environment lacking IPV6 support.'
46-
exit 0
46+
exit 77
4747
fi
4848
LOCALHOST='[::1]'
4949
LOCALHOST_FOR_NC='-6 ::1'

0 commit comments

Comments
 (0)