Skip to content

Commit 4fbc819

Browse files
julek-wolfssljulek-wolfssl
committed
Address final comments from #9761
- Fix line length - Remove duplicate comment - Check return of `wc_HashGetDigestSize` - Use constant instead of magic number
1 parent 0de6e8f commit 4fbc819

3 files changed

Lines changed: 84 additions & 43 deletions

File tree

‎examples/ocsp_responder/ocsp_responder.c‎

Lines changed: 79 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
#include <examples/ocsp_responder/ocsp_responder.h>
4747

4848
/* Check if we have the required features */
49-
#if defined(HAVE_OCSP) && defined(HAVE_OCSP_RESPONDER) && !defined(NO_FILESYSTEM)
49+
#if defined(HAVE_OCSP) && defined(HAVE_OCSP_RESPONDER) && \
50+
!defined(NO_FILESYSTEM)
5051

5152
#include <stdio.h>
5253
#include <stdlib.h>
@@ -143,8 +144,6 @@ typedef struct {
143144
int sendCerts;
144145
} OcspResponderOptions;
145146

146-
/* Usage help */
147-
148147
/* Usage help */
149148
static void Usage(void)
150149
{
@@ -154,7 +153,8 @@ static void Usage(void)
154153
LOG_MSG(" -? Help\n");
155154
LOG_MSG(" -p <num> Port (default %d)\n", DEFAULT_PORT);
156155
LOG_MSG(" -c <file> CA certificate (issuer)\n");
157-
LOG_MSG(" -r <file> Responder certificate (for authorized responder)\n");
156+
LOG_MSG(" -r <file> Responder certificate"
157+
" (for authorized responder)\n");
158158
LOG_MSG(" -k <file> Signing private key\n");
159159
LOG_MSG(" -i <file> Index file for cert status\n");
160160
LOG_MSG(" -R <file> Ready file for external monitor\n");
@@ -185,7 +185,8 @@ static int LoadFile(const char* filename, byte** buf, word32* bufSz, int* isPem)
185185
}
186186

187187
/* Convert PEM to DER */
188-
static int ConvertPemToDer(const byte* pem, word32 pemSz, byte** der, word32* derSz, int type)
188+
static int ConvertPemToDer(const byte* pem, word32 pemSz,
189+
byte** der, word32* derSz, int type)
189190
{
190191
int ret;
191192
DerBuffer* derBuf = NULL;
@@ -301,7 +302,8 @@ static IndexEntry* ParseIndexFile(const char* filename)
301302
if (line[0] == '\n' || line[0] == '\r' || line[0] == '\0')
302303
continue;
303304

304-
entry = (IndexEntry*)XMALLOC(sizeof(IndexEntry), NULL, DYNAMIC_TYPE_TMP_BUFFER);
305+
entry = (IndexEntry*)XMALLOC(sizeof(IndexEntry), NULL,
306+
DYNAMIC_TYPE_TMP_BUFFER);
305307
if (entry == NULL) {
306308
LOG_ERROR("Memory allocation failed for index entry\n");
307309
goto cleanup;
@@ -324,7 +326,8 @@ static IndexEntry* ParseIndexFile(const char* filename)
324326
XMEMSET(&tm, 0, sizeof(tm));
325327
if (wc_GetDateAsCalendarTime((const byte*)field,
326328
(int)XSTRLEN(field), ASN_UTC_TIME, &tm) != 0) {
327-
LOG_ERROR("Invalid revocation time format: %s\n", field);
329+
LOG_ERROR("Invalid revocation time"
330+
" format: %s\n", field);
328331
entry->revocationTime = (time_t)-1;
329332
break;
330333
}
@@ -335,15 +338,18 @@ static IndexEntry* ParseIndexFile(const char* filename)
335338
XSTRNCPY(entry->serial, field, sizeof(entry->serial) - 1);
336339
break;
337340
case 4: /* Filename */
338-
XSTRNCPY(entry->filename, field, sizeof(entry->filename) - 1);
341+
XSTRNCPY(entry->filename, field,
342+
sizeof(entry->filename) - 1);
339343
break;
340344
case 5: /* Subject */
341345
/* Remove trailing newline */
342346
{
343347
size_t len = XSTRLEN(field);
344-
if (len > 0 && (field[len-1] == '\n' || field[len-1] == '\r'))
348+
if (len > 0 && (field[len-1] == '\n' ||
349+
field[len-1] == '\r'))
345350
field[len-1] = '\0';
346-
if (len > 1 && (field[len-2] == '\n' || field[len-2] == '\r'))
351+
if (len > 1 && (field[len-2] == '\n' ||
352+
field[len-2] == '\r'))
347353
field[len-2] = '\0';
348354
}
349355
XSTRNCPY(entry->subject, field, sizeof(entry->subject) - 1);
@@ -387,8 +393,9 @@ static IndexEntry* ParseIndexFile(const char* filename)
387393
}
388394

389395
/* Lookup certificate status by serial number */
390-
static int PopulateResponderFromIndex(OcspResponder* responder, IndexEntry* index,
391-
DecodedCert* caCert)
396+
static int PopulateResponderFromIndex(OcspResponder* responder,
397+
IndexEntry* index,
398+
DecodedCert* caCert)
392399
{
393400
IndexEntry* entry;
394401
char caSubjectBuf[WC_ASN_NAME_MAX];
@@ -444,12 +451,16 @@ static int PopulateResponderFromIndex(OcspResponder* responder, IndexEntry* inde
444451
}
445452

446453
for (i = 0; i < serialLen; i++) {
447-
int high = ('0' <= p[i*2] && p[i*2] <= '9') ? (p[i*2] - '0') :
448-
('A' <= p[i*2] && p[i*2] <= 'F') ? (p[i*2] - 'A' + 10) :
449-
(p[i*2] - 'a' + 10);
450-
int low = ('0' <= p[i*2+1] && p[i*2+1] <= '9') ? (p[i*2+1] - '0') :
451-
('A' <= p[i*2+1] && p[i*2+1] <= 'F') ? (p[i*2+1] - 'A' + 10) :
452-
(p[i*2+1] - 'a' + 10);
454+
int high = ('0' <= p[i*2] && p[i*2] <= '9') ?
455+
(p[i*2] - '0') :
456+
('A' <= p[i*2] && p[i*2] <= 'F') ?
457+
(p[i*2] - 'A' + 10) :
458+
(p[i*2] - 'a' + 10);
459+
int low = ('0' <= p[i*2+1] && p[i*2+1] <= '9') ?
460+
(p[i*2+1] - '0') :
461+
('A' <= p[i*2+1] && p[i*2+1] <= 'F') ?
462+
(p[i*2+1] - 'A' + 10) :
463+
(p[i*2+1] - 'a' + 10);
453464
serial[i] = (byte)((high << 4) | low);
454465
}
455466

@@ -471,7 +482,8 @@ static int PopulateResponderFromIndex(OcspResponder* responder, IndexEntry* inde
471482
ret = wc_OcspResponder_SetCertStatus(responder,
472483
caSubjectBuf, caSubjSz,
473484
serial, serialLen,
474-
status, revTime, revReason, validity);
485+
status, revTime,
486+
revReason, validity);
475487
if (ret == 0) {
476488
count++;
477489
}
@@ -601,7 +613,8 @@ static int ParseHttpRequest(const byte* httpReq, int httpReqSz,
601613
}
602614

603615
/* Send HTTP response with OCSP response body */
604-
static int SendHttpResponse(SOCKET_T clientfd, const byte* ocspResp, int ocspRespSz)
616+
static int SendHttpResponse(SOCKET_T clientfd, const byte* ocspResp,
617+
int ocspRespSz)
605618
{
606619
char header[MAX_HTTP_HEADER];
607620
int headerLen;
@@ -651,7 +664,8 @@ static int SendHttpResponse(SOCKET_T clientfd, const byte* ocspResp, int ocspRes
651664
}
652665

653666
/* Send HTTP error response */
654-
static int SendHttpError(SOCKET_T clientfd, int statusCode, const char* statusMsg)
667+
static int SendHttpError(SOCKET_T clientfd, int statusCode,
668+
const char* statusMsg)
655669
{
656670
char response[512];
657671
int len;
@@ -665,7 +679,8 @@ static int SendHttpError(SOCKET_T clientfd, int statusCode, const char* statusMs
665679
"\r\n"
666680
"%s", statusCode, statusMsg, (int)XSTRLEN(statusMsg), statusMsg);
667681

668-
/* Handle XSNPRINTF error or truncation to avoid sending out-of-bounds data. */
682+
/* Handle XSNPRINTF error or truncation to avoid sending
683+
* out-of-bounds data. */
669684
if (len < 0 || len >= (int)sizeof(response)) {
670685
LOG_ERROR("HTTP error response truncated\n");
671686
return -1;
@@ -735,7 +750,8 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
735750
opts.readyFile = NULL;
736751

737752
/* Parse command line arguments */
738-
while ((ch = mygetopt_long(argc, argv, "?p:c:r:k:i:R:n:vx", long_options, 0)) != -1) {
753+
while ((ch = mygetopt_long(argc, argv, "?p:c:r:k:i:R:n:vx",
754+
long_options, 0)) != -1) {
739755
switch (ch) {
740756
case '?':
741757
Usage();
@@ -799,14 +815,17 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
799815
goto cleanup;
800816
}
801817
if (opts.verbose) {
802-
LOG_MSG("Loaded CA certificate: %s (%d bytes)\n", opts.certFile, caCertDerSz);
818+
LOG_MSG("Loaded CA certificate: %s (%d bytes)\n",
819+
opts.certFile, caCertDerSz);
803820
}
804821

805822
/* Load responder certificate if provided */
806823
if (opts.responderCertFile != NULL) {
807-
ret = LoadCertDer(opts.responderCertFile, &responderCertDer, &responderCertDerSz);
824+
ret = LoadCertDer(opts.responderCertFile, &responderCertDer,
825+
&responderCertDerSz);
808826
if (ret != 0) {
809-
LOG_ERROR("Error loading responder certificate: %s\n", opts.responderCertFile);
827+
LOG_ERROR("Error loading responder certificate: %s\n",
828+
opts.responderCertFile);
810829
ret = -1;
811830
goto cleanup;
812831
}
@@ -824,7 +843,8 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
824843
goto cleanup;
825844
}
826845
if (opts.verbose) {
827-
LOG_MSG("Loaded signing key: %s (%d bytes)\n", opts.keyFile, caKeyDerSz);
846+
LOG_MSG("Loaded signing key: %s (%d bytes)\n",
847+
opts.keyFile, caKeyDerSz);
828848
}
829849

830850
/* Parse CA certificate to get subject */
@@ -843,7 +863,8 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
843863
if (opts.indexFile) {
844864
indexEntries = ParseIndexFile(opts.indexFile);
845865
if (indexEntries == NULL) {
846-
LOG_ERROR("Warning: Could not parse index file: %s\n", opts.indexFile);
866+
LOG_ERROR("Warning: Could not parse index file: %s\n",
867+
opts.indexFile);
847868
}
848869
else if (opts.verbose) {
849870
LOG_MSG("Loaded index file: %s\n", opts.indexFile);
@@ -860,11 +881,16 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
860881

861882
/* Add signer to responder */
862883
if (opts.responderCertFile != NULL) {
863-
/* Authorized responder: use responder cert as signer, CA cert as issuer */
864-
ret = wc_OcspResponder_AddSigner(responder, responderCertDer, responderCertDerSz,
865-
caKeyDer, caKeyDerSz, caCertDer, caCertDerSz);
884+
/* Authorized responder: use responder cert as signer,
885+
* CA cert as issuer */
886+
ret = wc_OcspResponder_AddSigner(responder,
887+
responderCertDer,
888+
responderCertDerSz,
889+
caKeyDer, caKeyDerSz,
890+
caCertDer, caCertDerSz);
866891
if (ret != 0) {
867-
LOG_ERROR("Error adding authorized responder to responder: %d\n", ret);
892+
LOG_ERROR("Error adding authorized responder to"
893+
" responder: %d\n", ret);
868894
goto cleanup;
869895
}
870896
if (opts.verbose) {
@@ -886,12 +912,16 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
886912

887913
/* Populate responder with certificate statuses from index */
888914
if (indexEntries != NULL) {
889-
int statusCount = PopulateResponderFromIndex(responder, indexEntries, &caCert);
915+
int statusCount = PopulateResponderFromIndex(responder,
916+
indexEntries,
917+
&caCert);
890918
if (statusCount < 0) {
891-
LOG_ERROR("Error populating responder from index: %d\n", statusCount);
919+
LOG_ERROR("Error populating responder from index:"
920+
" %d\n", statusCount);
892921
}
893922
else if (opts.verbose) {
894-
LOG_MSG("Populated responder with %d certificate statuses\n", statusCount);
923+
LOG_MSG("Populated responder with %d certificate"
924+
" statuses\n", statusCount);
895925
}
896926
}
897927

@@ -932,7 +962,8 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
932962
}
933963
}
934964
else {
935-
LOG_ERROR("Warning: Failed to create ready file: %s\n", opts.readyFile);
965+
LOG_ERROR("Warning: Failed to create ready file:"
966+
" %s\n", opts.readyFile);
936967
}
937968
}
938969

@@ -965,7 +996,8 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
965996
char path[MAX_PATH_LEN];
966997

967998
/* Accept connection */
968-
clientfd = accept(sockfd, (struct sockaddr*)&clientAddr, &clientAddrLen);
999+
clientfd = accept(sockfd, (struct sockaddr*)&clientAddr,
1000+
&clientAddrLen);
9691001
if (clientfd == INVALID_SOCKET) {
9701002
LOG_ERROR("accept() failed\n");
9711003
continue;
@@ -990,7 +1022,8 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
9901022
}
9911023

9921024
/* Parse HTTP request */
993-
ret = ParseHttpRequest(httpBuf, recvLen, &ocspReq, &ocspReqSz, path, sizeof(path));
1025+
ret = ParseHttpRequest(httpBuf, recvLen, &ocspReq, &ocspReqSz,
1026+
path, sizeof(path));
9941027
if (ret != 0 || ocspReq == NULL || ocspReqSz <= 0) {
9951028
LOG_ERROR("Invalid HTTP request\n");
9961029
SendHttpError(clientfd, 400, "Bad Request");
@@ -1004,7 +1037,8 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
10041037

10051038
/* Process OCSP request and generate response */
10061039
respSz = sizeof(respBuf);
1007-
ret = wc_OcspResponder_WriteResponse(responder, ocspReq, (word32)ocspReqSz,
1040+
ret = wc_OcspResponder_WriteResponse(responder, ocspReq,
1041+
(word32)ocspReqSz,
10081042
respBuf, &respSz);
10091043

10101044
if (ret != 0) {
@@ -1014,7 +1048,8 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
10141048
/* Generate appropriate OCSP error response */
10151049
errStatus = MapErrorToOcspStatus(ret);
10161050
respSz = sizeof(respBuf);
1017-
ret = wc_OcspResponder_WriteErrorResponse(errStatus, respBuf, &respSz);
1051+
ret = wc_OcspResponder_WriteErrorResponse(errStatus,
1052+
respBuf, &respSz);
10181053

10191054
if (ret != 0) {
10201055
/* If we can't even encode an error response, send HTTP error */
@@ -1125,15 +1160,17 @@ int main(int argc, char** argv)
11251160
{
11261161
(void)argc;
11271162
(void)argv;
1128-
printf("OCSP Responder requires HAVE_OCSP, HAVE_OCSP_RESPONDER, and filesystem support\n");
1163+
printf("OCSP Responder requires HAVE_OCSP, HAVE_OCSP_RESPONDER,"
1164+
" and filesystem support\n");
11291165
return 0;
11301166
}
11311167
#endif
11321168

11331169
THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
11341170
{
11351171
func_args* myargs = (func_args*)args;
1136-
printf("OCSP Responder requires HAVE_OCSP, HAVE_OCSP_RESPONDER, and filesystem support\n");
1172+
printf("OCSP Responder requires HAVE_OCSP, HAVE_OCSP_RESPONDER,"
1173+
" and filesystem support\n");
11371174
myargs->return_code = 0;
11381175
WOLFSSL_RETURN_FROM_THREAD(0);
11391176
}

‎src/tls13.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8807,7 +8807,7 @@ static int WriteCSRToBuffer(WOLFSSL* ssl, DerBuffer** certExts,
88078807
if (tmpSz > (OPAQUE8_LEN + OPAQUE24_LEN) &&
88088808
certExts[extIdx] == NULL) {
88098809
/* csr extension is not zero */
8810-
if (tmpSz > 0xFFFF)
8810+
if (tmpSz > WOLFSSL_MAX_16BIT)
88118811
return BUFFER_E;
88128812
extSz[extIdx] = (word16)tmpSz;
88138813

‎wolfcrypt/src/asn.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41837,6 +41837,10 @@ int CompareOcspReqResp(OcspRequest* req, OcspResponse* resp)
4183741837
for (single = resp->single; single; single = next) {
4183841838
ocspDigestSize = wc_HashGetDigestSize(
4183941839
wc_OidGetHash(single->hashAlgoOID));
41840+
if (ocspDigestSize <= 0) {
41841+
WOLFSSL_MSG("\tinvalid hash algorithm in response");
41842+
return -1;
41843+
}
4184041844
cmp = req->serialSz - single->status->serialSz;
4184141845
if (cmp == 0) {
4184241846
cmp = XMEMCMP(req->serial, single->status->serial,

0 commit comments

Comments
 (0)