Skip to content

Add OCSP response issuer certificate callback zd#20415 #9115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ptsiewie wants to merge 1 commit into from
Closed

Add OCSP response issuer certificate callback zd#20415 #9115

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions src/ssl_certman.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2484,6 +2484,25 @@ int wolfSSL_CertManagerSetOCSP_Cb(WOLFSSL_CERT_MANAGER* cm, CbOCSPIO ioCb,
return ret;
}

WOLFSSL_API int wolfSSL_CertManagerSetOCSPResponseIssuer_Cb(WOLFSSL_CERT_MANAGER* cm,
Copy link
Contributor

@dgarske dgarske Aug 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only the public API needs WOLFSSL_API.

CbOCSPRespCert respCertCb)
{
int ret = WOLFSSL_SUCCESS;

WOLFSSL_ENTER("wolfSSL_CertManagerSetOCSP_Cb");

/* Validate parameters. */
if (cm == NULL) {
ret = BAD_FUNC_ARG;
}
if (ret == WOLFSSL_SUCCESS) {
/* Set callback into certificate manager. */
cm->ocspRespCertCb = respCertCb;
}

return ret;
}

#endif /* HAVE_OCSP */

#endif /* NO_CERTS */
Expand Down
6 changes: 6 additions & 0 deletions wolfcrypt/src/asn.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39514,6 +39514,7 @@ static int DecodeBasicOcspResponse(byte* source, word32* ioIndex,
int ret = 0;
word32 idx = *ioIndex;
Signer* ca = NULL;
CbOCSPRespCert ocspRespCertCb = (NULL != cm) ? ((WOLFSSL_CERT_MANAGER*)cm)->ocspRespCertCb: NULL;
Copy link
Contributor

@dgarske dgarske Aug 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please fix to 80 characters max:

src/ssl_certman.c:2487 WOLFSSL_API int wolfSSL_CertManagerSetOCSPResponseIssuer_Cb(WOLFSSL_CERT_MANAGER* cm,
wolfcrypt/src/asn.c:39517     CbOCSPRespCert ocspRespCertCb = (NULL != cm) ? ((WOLFSSL_CERT_MANAGER*)cm)->ocspRespCertCb: NULL;
wolfcrypt/src/asn.c:39566     /* If no certificate was read from the response data, but an response issuer certificate callback is available. */
wolfssl/internal.h:2699     CbOCSPRespCert  ocspRespCertCb;        /* Callback for OCSP response issuer certificate */
wolfssl/ssl.h:4268     WOLFSSL_API int wolfSSL_CertManagerSetOCSPResponseIssuer_Cb(WOLFSSL_CERT_MANAGER* cm,

int sigValid = 0;

WOLFSSL_ENTER("DecodeBasicOcspResponse");
Expand Down Expand Up @@ -39562,6 +39563,11 @@ static int DecodeBasicOcspResponse(byte* source, word32* ioIndex,
GetASN_GetRef(&dataASN[OCSPBASICRESPASN_IDX_CERTS_SEQ], &resp->cert,
&resp->certSz);
}
/* If no certificate was read from the response data, but an response issuer certificate callback is available. */
Copy link
Contributor

@dgarske dgarske Aug 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add callback in the non ASN template case too... above. Test with --enable-asn=original.

if ((ret == 0) && (resp->certSz == 0) && (ocspRespCertCb != NULL)) {
/* Call callback to obtain issuing certificate data. */
resp->certSz = ocspRespCertCb(&resp->cert);
}

if ((ret == 0) && resp->certSz > 0) {
ret = OcspCheckCert(resp, noVerify, noVerifySignature,
Expand Down
1 change: 1 addition & 0 deletions wolfssl/internal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2696,6 +2696,7 @@ struct WOLFSSL_CERT_MANAGER {
crlErrorCb crlCb; /* Allow user to override error */
void* crlCbCtx;
CbOCSPIO ocspIOCb; /* I/O callback for OCSP lookup */
CbOCSPRespCert ocspRespCertCb; /* Callback for OCSP response issuer certificate */
CbOCSPRespFree ocspRespFreeCb; /* Frees OCSP Response from IO Cb */
wolfSSL_Mutex caLock; /* CA list lock */
byte crlEnabled:1; /* is CRL on ? */
Expand Down
3 changes: 3 additions & 0 deletions wolfssl/ssl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3749,6 +3749,7 @@ typedef int (*crlErrorCb)(int ret, WOLFSSL_CRL* crl, WOLFSSL_CERT_MANAGER* cm,
void* ctx);
typedef int (*CbOCSPIO)(void*, const char*, int,
unsigned char*, int, unsigned char**);
typedef int (*CbOCSPRespCert)(unsigned char**);
typedef void (*CbOCSPRespFree)(void*,unsigned char*);

#ifdef HAVE_CRL_IO
Expand Down Expand Up @@ -4264,6 +4265,8 @@ WOLFSSL_API void wolfSSL_CTX_SetPerformTlsRecordProcessingCb(WOLFSSL_CTX* ctx,
WOLFSSL_CERT_MANAGER* cm, const char* url);
WOLFSSL_API int wolfSSL_CertManagerSetOCSP_Cb(WOLFSSL_CERT_MANAGER* cm,
CbOCSPIO ioCb, CbOCSPRespFree respFreeCb, void* ioCbCtx);
WOLFSSL_API int wolfSSL_CertManagerSetOCSPResponseIssuer_Cb(WOLFSSL_CERT_MANAGER* cm,
Copy link
Contributor

@dgarske dgarske Aug 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add test case in tests/api.c for new functionality. Thank you

CbOCSPRespCert respCertCb);

WOLFSSL_API int wolfSSL_CertManagerEnableOCSPStapling(
WOLFSSL_CERT_MANAGER* cm);
Expand Down
Loading