OCSP cb test

- Add tls 1.2 tests
- Add cert chain test

Author: julek-wolfssl

tests/api.c

@@ -51269,7 +51269,7 @@ TEST_DECL(test_wc_RsaPSS_DigitalSignVerify),
     TEST_DECL(test_ocsp_basic_verify),
     TEST_DECL(test_ocsp_response_parsing),
     TEST_DECL(test_ocsp_certid_enc_dec),
-    TEST_DECL(test_ocsp_tls13_cert_cb),
+    TEST_DECL(test_ocsp_tls_cert_cb),
     TEST_DECL(test_tls12_unexpected_ccs),
     TEST_DECL(test_tls13_unexpected_ccs),
     TEST_DECL(test_tls12_curve_intersection),

tests/api/create_ocsp_test_blobs.py

@@ -406,8 +406,8 @@ def create_bad_response(rd: dict) -> bytes:
             'responder_by_name': True,
             'responses': [
                 {
-                    'issuer_cert': WOLFSSL_OCSP_CERT_PATH + 'root-ca-cert.pem',
-                    'serial': 0x01,
+                    'issuer_cert': WOLFSSL_OCSP_CERT_PATH + 'intermediate1-ca-cert.pem',
+                    'serial': 0x05,
                     'status': CERT_GOOD
                 }
             ],

tests/api/test_ocsp.c

@@ -663,22 +663,31 @@ int test_ocsp_certid_enc_dec(void)
     defined(WOLFSSL_TLS13) && defined(WOLFSSL_CERT_SETUP_CB) && \
     defined(HAVE_SSL_MEMIO_TESTS_DEPENDENCIES) && !defined(NO_RSA)
 
+static byte test_ocsp_tls_cert_cb_chain;
 /* --- certificate-selection callback ----------------------------------- */
-static int test_ocsp_tls13_cert_cb_cert_cb(WOLFSSL* ssl, void* arg)
+static int test_ocsp_tls_cert_cb_cert_cb(WOLFSSL* ssl, void* arg)
 {
     (void)arg;
-    if (wolfSSL_use_certificate_file(ssl,
-            "./certs/ocsp/intermediate1-ca-cert.pem", WOLFSSL_FILETYPE_PEM)
-            != WOLFSSL_SUCCESS)
-        return 0;
+    if (test_ocsp_tls_cert_cb_chain) {
+        if (wolfSSL_use_certificate_chain_file(ssl,
+                "./certs/ocsp/server1-cert.pem")
+                != WOLFSSL_SUCCESS)
+            return 0;
+    }
+    else {
+        if (wolfSSL_use_certificate_file(ssl,
+                "./certs/ocsp/server1-cert.pem", WOLFSSL_FILETYPE_PEM)
+                != WOLFSSL_SUCCESS)
+            return 0;
+    }
     if (wolfSSL_use_PrivateKey_file(ssl,
-            "./certs/ocsp/intermediate1-ca-key.pem",  WOLFSSL_FILETYPE_PEM)
+            "./certs/ocsp/server1-key.pem",  WOLFSSL_FILETYPE_PEM)
             != WOLFSSL_SUCCESS)
         return 0;
     return 1;  /* success */
 }
 
-static int test_ocsp_tls13_cert_cb_status_cb(WOLFSSL* ssl, void* ioCtx)
+static int test_ocsp_tls_cert_cb_status_cb(WOLFSSL* ssl, void* ioCtx)
 {
     byte* ocsp_resp = NULL;
     (void)ioCtx;
@@ -694,18 +703,20 @@ static int test_ocsp_tls13_cert_cb_status_cb(WOLFSSL* ssl, void* ioCtx)
     return WOLFSSL_OCSP_STATUS_CB_OK;
 }
 
-static int test_ocsp_tls13_cert_cb_verify_cb(int preverify,
+static int test_ocsp_tls_cert_cb_verify_cb(int preverify,
         WOLFSSL_X509_STORE_CTX* store)
 {
     int ret = 0;
     int err = wolfSSL_X509_STORE_CTX_get_error(store);
 
     if (preverify == 1)
         return 1;
-    if (err == WC_NO_ERR_TRACE(ASN_NO_SIGNER_E)
+    if (err == WC_NO_ERR_TRACE(ASN_NO_SIGNER_E) ||
+            err == WC_NO_ERR_TRACE(ASN_SELF_SIGNED_E)
 #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
     defined(HAVE_WEBSERVER) || defined(HAVE_MEMCACHED)
             || err == WOLFSSL_X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY
+            || err == WOLFSSL_X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT
 #endif
             ) {
         int idx = wolfSSL_X509_STORE_CTX_get_error_depth(store);
@@ -726,6 +737,11 @@ static int test_ocsp_tls13_cert_cb_verify_cb(int preverify,
             wolfSSL_CertManagerLoadCA(cm, "./certs/ocsp/root-ca-cert.pem", NULL)
                 != WOLFSSL_SUCCESS)
             ret = 0;
+        /* If verifying leaf cert then we need to load the intermediate CA */
+        if (ret == 1 && idx == 0 &&
+            wolfSSL_CertManagerLoadCA(cm, "./certs/ocsp/intermediate1-ca-cert.pem", NULL)
+                != WOLFSSL_SUCCESS)
+            ret = 0;
 
         /* Verify cert with CA */
         if (ret == 1) {
@@ -735,18 +751,22 @@ static int test_ocsp_tls13_cert_cb_verify_cb(int preverify,
         if (ret == 1 && wc_ParseCert(&cert, CERT_TYPE, VERIFY, cm) != 0)
             ret = 0;
 
-        /* Verify OCSP with CA */
-        if (ret == 1 && (ocspStaple == NULL || ocspStaple->buffer == NULL ||
-                ocspStaple->length == 0))
-            ret = 0;
-        if (ret == 1 && wc_InitOCSP(&ocsp, cm) != 0)
-            ret = 0;
-        if (ret == 1)
-            ocspInit = 1;
-        if (ret == 1 &&
-                wc_CheckCertOcspResponse(&ocsp, &cert, ocspStaple->buffer,
-                        ocspStaple->length, NULL) != 0)
-            ret = 0;
+        /* In this test we only expect a staple on the leaf cert */
+        if (idx == 0 && (wolfSSL_version(ssl) == TLS1_3_VERSION ||
+                wolfSSL_version(ssl) == DTLS1_3_VERSION)) {
+            /* Verify OCSP with CA */
+            if (ret == 1 && (ocspStaple == NULL || ocspStaple->buffer == NULL ||
+                    ocspStaple->length == 0))
+                ret = 0;
+            if (ret == 1 && wc_InitOCSP(&ocsp, cm) != 0)
+                ret = 0;
+            if (ret == 1)
+                ocspInit = 1;
+            if (ret == 1 &&
+                    wc_CheckCertOcspResponse(&ocsp, &cert, ocspStaple->buffer,
+                            ocspStaple->length, NULL) != 0)
+                ret = 0;
+        }
 
         if (ocspInit)
             wc_FreeOCSP(&ocsp);
@@ -757,30 +777,42 @@ static int test_ocsp_tls13_cert_cb_verify_cb(int preverify,
     return ret;
 }
 
-static int test_ocsp_tls13_cert_cb_ctx_ready(WOLFSSL_CTX* ctx)
+static int test_ocsp_tls_cert_cb_ctx_ready(WOLFSSL_CTX* ctx)
 {
     /* server: dynamic cert */
-    wolfSSL_CTX_set_cert_cb(ctx, test_ocsp_tls13_cert_cb_cert_cb, NULL);
+    wolfSSL_CTX_set_cert_cb(ctx, test_ocsp_tls_cert_cb_cert_cb, NULL);
     return TEST_SUCCESS;
 }
 
 /* --- very small OCSP-status callback ---------------------------------- */
 /* no status callback path - context struct not needed */
 
 /* --- the actual test case --------------------------------------------- */
-int test_ocsp_tls13_cert_cb(void)
+int test_ocsp_tls_cert_cb(void)
 {
     EXPECT_DECLS;
     size_t i;
     struct {
         method_provider client_meth;
         method_provider server_meth;
         const char* tls_version;
+        byte chain:1;
     } params[] = {
+        /* TODO Remove WOLFSSL_ALT_CERT_CHAINS limitation */
+#ifndef WOLFSSL_ALT_CERT_CHAINS
+        { wolfTLSv1_2_client_method, wolfTLSv1_2_server_method, "TLSv1_2", 1 },
+        /* TODO
+         * Doesn't work currently because the CA is not loaded. When the server
+         * send the chain then the client loads the CA certs allowing the OCSP
+         * check to pass */
+//        { wolfTLSv1_2_client_method, wolfTLSv1_2_server_method, "TLSv1_2", 0 },
+#endif
 #if defined(WOLFSSL_TLS13)
-        { wolfTLSv1_3_client_method, wolfTLSv1_3_server_method, "TLSv1_3" },
+        { wolfTLSv1_3_client_method, wolfTLSv1_3_server_method, "TLSv1_3", 1 },
+        { wolfTLSv1_3_client_method, wolfTLSv1_3_server_method, "TLSv1_3", 0 },
 #ifdef WOLFSSL_DTLS13
-        { wolfDTLSv1_3_client_method, wolfDTLSv1_3_server_method, "DTLSv1_3" },
+        { wolfDTLSv1_3_client_method, wolfDTLSv1_3_server_method, "DTLSv1_3", 1 },
+        { wolfDTLSv1_3_client_method, wolfDTLSv1_3_server_method, "DTLSv1_3", 0 },
 #endif
 #endif
     };
@@ -801,7 +833,9 @@ int test_ocsp_tls13_cert_cb(void)
         test_ctx.c_cb.method = params[i].client_meth;
         test_ctx.s_cb.method = params[i].server_meth;
 
-        test_ctx.s_cb.ctx_ready = test_ocsp_tls13_cert_cb_ctx_ready;
+        test_ocsp_tls_cert_cb_chain = params[i].chain;
+
+        test_ctx.s_cb.ctx_ready = test_ocsp_tls_cert_cb_ctx_ready;
 
         ExpectIntEQ(test_ssl_memio_setup(&test_ctx), TEST_SUCCESS);
 
@@ -813,11 +847,11 @@ int test_ocsp_tls13_cert_cb(void)
         /* turn on OCSP stapling on the server side */
         ExpectIntEQ(wolfSSL_CTX_EnableOCSPStapling(test_ctx.s_ctx), WOLFSSL_SUCCESS);
         ExpectIntEQ(wolfSSL_CTX_set_tlsext_status_cb(test_ctx.s_ctx,
-                test_ocsp_tls13_cert_cb_status_cb), WOLFSSL_SUCCESS);
+                test_ocsp_tls_cert_cb_status_cb), WOLFSSL_SUCCESS);
 
         /* client: request stapling */
         wolfSSL_set_verify(test_ctx.c_ssl, WOLFSSL_VERIFY_DEFAULT,
-                test_ocsp_tls13_cert_cb_verify_cb);
+                test_ocsp_tls_cert_cb_verify_cb);
         /* No way to get ssl from the store without OPENSSL_EXTRA */
         wolfSSL_SetCertCbCtx(test_ctx.c_ssl, test_ctx.c_ssl);
         ExpectIntEQ(wolfSSL_CTX_EnableOCSPStapling(test_ctx.c_ctx), WOLFSSL_SUCCESS);
@@ -834,7 +868,7 @@ int test_ocsp_tls13_cert_cb(void)
 }
 
 #else  /* feature guards */
-int test_ocsp_tls13_cert_cb(void)
+int test_ocsp_tls_cert_cb(void)
 {
     return TEST_SKIPPED;
 }

tests/api/test_ocsp.h

@@ -26,6 +26,6 @@ int test_ocsp_certid_enc_dec(void);
 int test_ocsp_status_callback(void);
 int test_ocsp_basic_verify(void);
 int test_ocsp_response_parsing(void);
-int test_ocsp_tls13_cert_cb(void);
+int test_ocsp_tls_cert_cb(void);
 #endif /* WOLFSSL_TEST_OCSP_H */
 

tests/api/test_ocsp_test_blobs.h

@@ -659,37 +659,37 @@ unsigned char resp_server1_cert[] = {
     0x72, 0x31, 0x1f, 0x30, 0x1d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
     0x0d, 0x01, 0x09, 0x01, 0x16, 0x10, 0x69, 0x6e, 0x66, 0x6f, 0x40, 0x77,
     0x6f, 0x6c, 0x66, 0x73, 0x73, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x18, 0x0f,
-    0x32, 0x30, 0x32, 0x35, 0x30, 0x38, 0x31, 0x37, 0x31, 0x35, 0x35, 0x37,
-    0x35, 0x30, 0x5a, 0x30, 0x4f, 0x30, 0x4d, 0x30, 0x38, 0x30, 0x07, 0x06,
-    0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x04, 0x14, 0x44, 0xa8, 0xdb, 0xd1,
-    0xbc, 0x97, 0x0a, 0x83, 0x3b, 0x5b, 0x31, 0x9a, 0x4c, 0xb8, 0xd2, 0x52,
-    0x37, 0x15, 0x8a, 0x88, 0x04, 0x14, 0x73, 0xb0, 0x1c, 0xa4, 0x2f, 0x82,
-    0xcb, 0xcf, 0x47, 0xa5, 0x38, 0xd7, 0xb0, 0x04, 0x82, 0x3a, 0x7e, 0x72,
-    0x15, 0x21, 0x02, 0x01, 0x01, 0x80, 0x00, 0x18, 0x0f, 0x32, 0x30, 0x32,
-    0x35, 0x30, 0x38, 0x31, 0x37, 0x31, 0x35, 0x35, 0x37, 0x35, 0x30, 0x5a,
+    0x32, 0x30, 0x32, 0x35, 0x30, 0x38, 0x32, 0x38, 0x31, 0x37, 0x30, 0x34,
+    0x30, 0x34, 0x5a, 0x30, 0x4f, 0x30, 0x4d, 0x30, 0x38, 0x30, 0x07, 0x06,
+    0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x04, 0x14, 0x71, 0x4d, 0x82, 0x23,
+    0x40, 0x59, 0xc0, 0x96, 0xa1, 0x37, 0x43, 0xfa, 0x31, 0xdb, 0xba, 0xb1,
+    0x43, 0x18, 0xda, 0x04, 0x04, 0x14, 0x83, 0xc6, 0x3a, 0x89, 0x2c, 0x81,
+    0xf4, 0x02, 0xd7, 0x9d, 0x4c, 0xe2, 0x2a, 0xc0, 0x71, 0x82, 0x64, 0x44,
+    0xda, 0x0e, 0x02, 0x01, 0x05, 0x80, 0x00, 0x18, 0x0f, 0x32, 0x30, 0x32,
+    0x35, 0x30, 0x38, 0x32, 0x38, 0x31, 0x37, 0x30, 0x34, 0x30, 0x34, 0x5a,
     0x30, 0x0b, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
-    0x0b, 0x03, 0x82, 0x01, 0x01, 0x00, 0x0b, 0xc9, 0x6c, 0x40, 0xd9, 0xb2,
-    0xc7, 0xf3, 0xdc, 0xb5, 0x22, 0x56, 0xb3, 0x33, 0x45, 0x27, 0xfc, 0xb2,
-    0x0d, 0x68, 0x93, 0x05, 0x08, 0xa5, 0x66, 0x05, 0xe7, 0x65, 0xc2, 0x50,
-    0x2c, 0x7a, 0x0b, 0x61, 0xae, 0xab, 0x2c, 0x22, 0xf4, 0x79, 0xf6, 0xa5,
-    0x6f, 0xe9, 0x6b, 0x2c, 0x22, 0xb2, 0x91, 0x38, 0x89, 0x41, 0x32, 0x36,
-    0xd6, 0xd1, 0x16, 0x53, 0xec, 0xa0, 0xfd, 0xd8, 0xae, 0xf0, 0x3f, 0xdd,
-    0x49, 0x67, 0x69, 0xd3, 0xf6, 0xe4, 0xa3, 0x79, 0x99, 0xe3, 0x41, 0xc3,
-    0x0c, 0xd6, 0xa5, 0x60, 0x18, 0x94, 0x0a, 0x29, 0xcc, 0x44, 0x7a, 0x7d,
-    0xad, 0xd8, 0x65, 0x01, 0xff, 0x8e, 0x39, 0x4e, 0x73, 0xfb, 0x76, 0x3b,
-    0x6e, 0xe6, 0xf1, 0xf3, 0xf6, 0x2f, 0x8e, 0x1f, 0x4a, 0xc3, 0xce, 0x03,
-    0x0d, 0x15, 0xf7, 0xb9, 0x3c, 0xcc, 0xf8, 0xa5, 0x74, 0x10, 0xdb, 0x62,
-    0x1d, 0x26, 0xc9, 0xa7, 0xe8, 0x01, 0xd3, 0x26, 0x17, 0x4b, 0xe5, 0xbd,
-    0xb9, 0x4d, 0xe4, 0x73, 0x1d, 0xde, 0x30, 0x0b, 0x8d, 0xda, 0x58, 0x00,
-    0x8e, 0x4b, 0x2f, 0xeb, 0x44, 0x8d, 0x7c, 0xe7, 0x56, 0x25, 0x79, 0x10,
-    0xf4, 0xde, 0x65, 0x26, 0x6a, 0xbf, 0x3b, 0x41, 0x66, 0xae, 0x4e, 0xc2,
-    0xc1, 0x23, 0xea, 0x7c, 0x7b, 0x75, 0x79, 0x9f, 0x85, 0x69, 0x24, 0x74,
-    0x92, 0x4b, 0x52, 0x30, 0xa7, 0x85, 0x03, 0x04, 0x96, 0x5f, 0x71, 0xe3,
-    0xf2, 0xb7, 0x82, 0xf4, 0x57, 0x98, 0x32, 0xb5, 0x00, 0xfe, 0xdf, 0x98,
-    0xff, 0x70, 0x61, 0x74, 0x22, 0x0f, 0x38, 0x3b, 0x4a, 0xdc, 0x89, 0xaf,
-    0x2c, 0x72, 0x8c, 0x85, 0x77, 0xdb, 0x5d, 0x96, 0xa8, 0x80, 0x23, 0x7f,
-    0x6f, 0x91, 0x97, 0x76, 0xeb, 0xfd, 0x7f, 0x09, 0x48, 0xef, 0x3e, 0x1f,
-    0x4a, 0xb3, 0xdc, 0x03, 0xfa, 0x4b, 0xc5, 0x6e, 0xb0, 0x1b, 0xa0, 0x82,
+    0x0b, 0x03, 0x82, 0x01, 0x01, 0x00, 0x10, 0xc2, 0xd8, 0x97, 0x9b, 0x4c,
+    0x47, 0xcf, 0x54, 0x54, 0x7f, 0xcf, 0xc2, 0xd9, 0x0a, 0xe7, 0x99, 0x00,
+    0x72, 0xda, 0xb3, 0xc8, 0x3e, 0x0e, 0xe8, 0xf4, 0xe5, 0x7a, 0x77, 0x67,
+    0xc1, 0xcc, 0x8c, 0x44, 0x40, 0x84, 0x3d, 0xad, 0x39, 0x90, 0x21, 0xae,
+    0xd3, 0xb8, 0x46, 0x48, 0xe0, 0x99, 0xbc, 0xb2, 0xb4, 0xd6, 0x1a, 0xf7,
+    0x5a, 0x69, 0xd2, 0xc2, 0xf3, 0x5b, 0x1d, 0xdc, 0xc1, 0x96, 0x8d, 0x5c,
+    0x94, 0xfb, 0xff, 0x84, 0xe0, 0xd1, 0x6b, 0xd9, 0xeb, 0x08, 0xb3, 0xe4,
+    0xb8, 0xa5, 0x06, 0x52, 0xd6, 0x3c, 0xea, 0x0a, 0x2e, 0xb7, 0xb7, 0x24,
+    0x41, 0x3d, 0xb5, 0xea, 0x7f, 0x4a, 0xad, 0x35, 0x05, 0x56, 0xd1, 0xa2,
+    0xfc, 0x64, 0x2e, 0x2f, 0xc4, 0x81, 0x6e, 0x9c, 0x9a, 0x63, 0x67, 0x82,
+    0xde, 0x7e, 0x4a, 0x9e, 0x10, 0xb1, 0xe5, 0xc2, 0xfc, 0x00, 0xd5, 0x09,
+    0x85, 0x4e, 0x62, 0xf6, 0x18, 0xd5, 0x8e, 0x76, 0xcf, 0xbc, 0xc2, 0x2a,
+    0xb2, 0x68, 0x8a, 0x06, 0xcb, 0x52, 0x98, 0xc1, 0x5a, 0xf0, 0xca, 0xb2,
+    0x16, 0x65, 0x47, 0xf4, 0xe6, 0xe6, 0x0b, 0x02, 0x3e, 0x45, 0xb8, 0x72,
+    0x19, 0xe4, 0x57, 0xe6, 0xbb, 0x7c, 0xcc, 0x0f, 0xc0, 0xeb, 0xaa, 0x60,
+    0x97, 0x7f, 0x95, 0x6e, 0x80, 0xe2, 0x14, 0x4f, 0x22, 0xfc, 0x8d, 0xfa,
+    0xaa, 0x67, 0xcc, 0xe9, 0x4d, 0x82, 0xf4, 0x25, 0x8b, 0xd1, 0x1e, 0x80,
+    0x19, 0x4c, 0x81, 0xd9, 0x55, 0x21, 0x83, 0xbe, 0xb1, 0xca, 0x23, 0x2e,
+    0xcc, 0xcb, 0xf0, 0xf3, 0xb2, 0xb2, 0x5c, 0xe3, 0x05, 0x8d, 0xf2, 0x75,
+    0x4d, 0xb3, 0x6f, 0x6a, 0xc7, 0x9b, 0xb6, 0x22, 0x03, 0x6c, 0x5e, 0x0d,
+    0x78, 0x15, 0x5c, 0xe5, 0xaf, 0x25, 0xc8, 0xc5, 0x08, 0xec, 0x64, 0xf1,
+    0x0b, 0x60, 0x2e, 0xd0, 0x8d, 0x75, 0x70, 0xfd, 0x12, 0x28, 0xa0, 0x82,
     0x04, 0xc6, 0x30, 0x82, 0x04, 0xc2, 0x30, 0x82, 0x04, 0xbe, 0x30, 0x82,
     0x03, 0xa6, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x01, 0x04, 0x30, 0x0d,
     0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05,