OCSP openssl compat fixes #8498
Conversation
Check that responderID.ByKey is exactly WC_SHA_DIGEST_SIZE as per RFC 6960. KEYID_SIZE can change across build configuration.
tests blobs contains sha-1 hashes in certificate status
- Added validation for digest type in `wolfSSL_OCSP_cert_to_id` function. - Defined `OCSP_DIGEST` based on available hash types. - Set `hashAlgoOID` in `certId` based on `OCSP_DIGEST`. - Updated `asn.h` to define `OCSP_DIGEST` and `OCSP_DIGEST_SIZE` based on available hash types.
rizlik
force-pushed
the
ocsp_fixes
branch
5 times, most recently
from
ce26fea to
25891dd
Compare
It will be reused in d2i_CERT_ID
|
retest this please ( |
There was a problem hiding this comment.
This fixes all the PQ tests I ran, but it breaks with --enable-sm2. I don't see the failures either without --enable-sm2, or on master, just on the combination.
FAILURES:
750: test_wolfSSL_OCSP_id_get0_info
759: test_wolfSSL_OCSP_REQ_CTX
1090: test_ocsp_certid_enc_dec
Repro with --enable-all --enable-sm3 after moving SM3 sources into place from the wolfsm repo (needs wolfcrypt/src/sm2.c, wolfcrypt/src/sm2_asm.S, wolfcrypt/src/sp_sm2_x86_64.c, and wolfssl/wolfcrypt/sm2.h).
|
Retest this please: "PRB-generic-config-parser" no console. |
| #ifdef WOLFSSL_SMALL_STACK | ||
| DecodedCert *cert = NULL; | ||
| #else | ||
| DecodedCert cert[1]; | ||
| #endif | ||
|
|
||
| (void)dgst; | ||
| if (dgst == NULL) { | ||
| dgstType = WC_HASH_TYPE_SHA; |
| } | ||
|
|
||
| /* Encode CertID following RFC 6960 ASN.1 structure */ | ||
| static int OcspEncodeCertID(WOLFSSL_OCSP_CERTID* id, byte* output, word32 size) |
There was a problem hiding this comment.
Implementation can be combined with above.
Avoids two functions getting out of sync with each other.
| allocated = 1; | ||
| } | ||
|
|
||
| if (id->rawCertId != NULL) { |
There was a problem hiding this comment.
Swap the condition check to match the code above.
| return -1; | ||
| } | ||
|
|
||
| if (data == NULL) { |
There was a problem hiding this comment.
Don't do this here.
Return derSz when data is NULL after line 1427.
Code is similar enough that I can't see why not.
| cid = *cidOut; | ||
| FreeOcspEntry(cid, NULL); | ||
| } else { |
Description