Skip to content

Commit 6fc83e2

Browse files
julek-wolfssljulek-wolfssl
committed
Address code review
1 parent 0a1b4f9 commit 6fc83e2

5 files changed

Lines changed: 80 additions & 38 deletions

File tree

‎examples/ocsp_responder/ocsp_responder.c‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -391,17 +391,17 @@ static int PopulateResponderFromIndex(OcspResponder* responder, IndexEntry* inde
391391
DecodedCert* caCert)
392392
{
393393
IndexEntry* entry;
394-
const char* caSubject;
395-
word32 caSubjSz;
394+
char caSubjectBuf[WC_ASN_NAME_MAX];
395+
word32 caSubjSz = sizeof(caSubjectBuf);
396396
int count = 0;
397397
int ret;
398398

399399
if (responder == NULL || index == NULL || caCert == NULL) {
400400
return BAD_FUNC_ARG;
401401
}
402402

403-
caSubject = wc_GetDecodedCertSubject(caCert, &caSubjSz);
404-
if (caSubject == NULL || caSubjSz == 0) {
403+
ret = wc_GetDecodedCertSubject(caCert, caSubjectBuf, &caSubjSz);
404+
if (ret != 0 || caSubjSz == 0) {
405405
LOG_ERROR("Could not get CA subject\n");
406406
return BAD_FUNC_ARG;
407407
}
@@ -467,7 +467,7 @@ static int PopulateResponderFromIndex(OcspResponder* responder, IndexEntry* inde
467467
}
468468

469469
ret = wc_OcspResponder_SetCertStatus(responder,
470-
caSubject, caSubjSz,
470+
caSubjectBuf, caSubjSz,
471471
serial, serialLen,
472472
status, revTime, revReason, validity);
473473
if (ret == 0) {
@@ -832,7 +832,8 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
832832
ret = -1;
833833
goto cleanup;
834834
}
835-
(void)wc_GetDecodedCertSubject(&caCert, &caSubjectSz);
835+
(void)wc_GetDecodedCertSubject(&caCert, NULL, &caSubjectSz);
836+
(void)caSubjectSz; /* Not used in current implementation */
836837
(void)caSubjectSz; /* Not used in current implementation */
837838

838839
/* Load index file if provided */

‎src/ocsp.c‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -633,9 +633,12 @@ static int CheckOcspResponderChain(OcspEntry* single, byte* issuerHash,
633633

634634
/**
635635
* Enforce https://www.rfc-editor.org/rfc/rfc6960#section-4.2.2.2
636-
* @param bs The basic response to verify
637-
* @param cert The decoded bs->cert
638-
* @return
636+
* @param bs The basic OCSP response to verify
637+
* @param subjectHash The subject key hash of the OCSP responder certificate
638+
* @param extExtKeyUsage The extended key usage bits of the responder certificate
639+
* @param issuerHash The issuer key hash of the OCSP responder certificate
640+
* @param vp Unused (reserved for future use)
641+
* @return 1 if the responder is authorized to sign the response, 0 otherwise
639642
*/
640643
int CheckOcspResponder(OcspResponse *bs, byte* subjectHash,
641644
byte extExtKeyUsage, byte* issuerHash, void* vp)
@@ -2263,7 +2266,8 @@ int wc_OcspResponder_AddSigner(OcspResponder* responder,
22632266
WOLFSSL_ENTER("wc_OcspResponder_AddSigner");
22642267

22652268
if (responder == NULL || signerDer == NULL || signerDerSz == 0 ||
2266-
keyDer == NULL || keyDerSz == 0)
2269+
keyDer == NULL || keyDerSz == 0 ||
2270+
(issuerCertDerSz != 0 && issuerCertDer == NULL))
22672271
return BAD_FUNC_ARG;
22682272

22692273
/* Allocate CA structure */
@@ -2431,7 +2435,6 @@ int wc_OcspResponder_AddSigner(OcspResponder* responder,
24312435
return ret;
24322436
}
24332437

2434-
/* Find Auth CA by comparing cert DER */
24352438
/* Find Auth CA by issuer hashes from request */
24362439
static OcspResponderCa* FindCaByHashes(OcspResponder* responder,
24372440
const byte* issuerHash, const byte* issuerKeyHash, int hashAlg)

‎tests/api/test_ocsp.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1278,10 +1278,10 @@ static int ocspResponderTest_Run(OcspResponderTestConfig* config, int sendCerts)
12781278
word32 respSz = 0;
12791279
byte reqBuf[1024];
12801280
int reqSz = 0;
1281-
const char* caSubject = NULL;
1282-
word32 caSubjectSz = 0;
1283-
const byte* serial = NULL;
1284-
word32 serialSz = 0;
1281+
char caSubject[WC_ASN_NAME_MAX];
1282+
word32 caSubjectSz = sizeof(caSubject);
1283+
byte serial[EXTERNAL_SERIAL_SIZE];
1284+
word32 serialSz = sizeof(serial);
12851285
XFILE f = XBADFILE;
12861286
byte usingAuthCa = XSTRCMP(config->caCertPath, config->responderCertPath) != 0;
12871287

@@ -1362,9 +1362,9 @@ static int ocspResponderTest_Run(OcspResponderTestConfig* config, int sendCerts)
13621362
usingAuthCa ? caCertDer : NULL, usingAuthCa ? caCertSz : 0), 0);
13631363

13641364
/* Set certificate status */
1365-
ExpectNotNull(caSubject = wc_GetDecodedCertSubject(&decodedCaCert, &caSubjectSz));
1365+
ExpectIntEQ(wc_GetDecodedCertSubject(&decodedCaCert, caSubject, &caSubjectSz), 0);
13661366
ExpectIntGT(caSubjectSz, 0);
1367-
ExpectNotNull(serial = wc_GetDecodedCertSerial(&targetCert, &serialSz));
1367+
ExpectIntEQ(wc_GetDecodedCertSerial(&targetCert, serial, &serialSz), 0);
13681368
ExpectIntGT(serialSz, 0);
13691369

13701370
ExpectIntEQ(wc_OcspResponder_SetCertStatus(responder,

‎wolfcrypt/src/asn.c‎

Lines changed: 53 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -25002,31 +25002,69 @@ int wc_ParseCert(DecodedCert* cert, int type, int verify, void* cm)
2500225002
return ParseCert(cert, type, verify, cm);
2500325003
}
2500425004

25005-
const char* wc_GetDecodedCertSubject(struct DecodedCert* cert, word32* subjectSz)
25005+
int wc_GetDecodedCertSubject(const struct DecodedCert* cert, char* buf,
25006+
word32* bufSz)
2500625007
{
25007-
if (cert == NULL || subjectSz == NULL) {
25008-
return NULL;
25008+
word32 sz;
25009+
25010+
if (cert == NULL || bufSz == NULL)
25011+
return BAD_FUNC_ARG;
25012+
25013+
sz = (word32)XSTRLEN(cert->subject);
25014+
25015+
if (buf == NULL) {
25016+
*bufSz = sz;
25017+
return WC_NO_ERR_TRACE(LENGTH_ONLY_E);
2500925018
}
25010-
*subjectSz = (word32)XSTRLEN(cert->subject);
25011-
return cert->subject;
25019+
25020+
if (*bufSz < sz)
25021+
return BUFFER_E;
25022+
25023+
XMEMCPY(buf, cert->subject, sz);
25024+
*bufSz = sz;
25025+
return 0;
2501225026
}
2501325027

25014-
const char* wc_GetDecodedCertIssuer(struct DecodedCert* cert, word32* issuerSz)
25028+
int wc_GetDecodedCertIssuer(const struct DecodedCert* cert, char* buf,
25029+
word32* bufSz)
2501525030
{
25016-
if (cert == NULL || issuerSz == NULL) {
25017-
return NULL;
25031+
word32 sz;
25032+
25033+
if (cert == NULL || bufSz == NULL)
25034+
return BAD_FUNC_ARG;
25035+
25036+
sz = (word32)XSTRLEN(cert->issuer);
25037+
25038+
if (buf == NULL) {
25039+
*bufSz = sz;
25040+
return WC_NO_ERR_TRACE(LENGTH_ONLY_E);
2501825041
}
25019-
*issuerSz = (word32)XSTRLEN(cert->issuer);
25020-
return cert->issuer;
25042+
25043+
if (*bufSz < sz)
25044+
return BUFFER_E;
25045+
25046+
XMEMCPY(buf, cert->issuer, sz);
25047+
*bufSz = sz;
25048+
return 0;
2502125049
}
2502225050

25023-
const byte* wc_GetDecodedCertSerial(struct DecodedCert* cert, word32* serialSz)
25051+
int wc_GetDecodedCertSerial(const struct DecodedCert* cert, byte* buf,
25052+
word32* bufSz)
2502425053
{
25025-
if (cert == NULL || serialSz == NULL) {
25026-
return NULL;
25054+
if (cert == NULL || bufSz == NULL)
25055+
return BAD_FUNC_ARG;
25056+
25057+
if (buf == NULL) {
25058+
*bufSz = (word32)cert->serialSz;
25059+
return WC_NO_ERR_TRACE(LENGTH_ONLY_E);
2502725060
}
25028-
*serialSz = (word32)cert->serialSz;
25029-
return cert->serial;
25061+
25062+
if (*bufSz < (word32)cert->serialSz)
25063+
return BUFFER_E;
25064+
25065+
XMEMCPY(buf, cert->serial, (size_t)cert->serialSz);
25066+
*bufSz = (word32)cert->serialSz;
25067+
return 0;
2503025068
}
2503125069

2503225070
#ifdef WOLFCRYPT_ONLY

‎wolfssl/wolfcrypt/asn_public.h‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -930,12 +930,12 @@ WOLFSSL_API int wc_GetSubjectPubKeyInfoDerFromCert(const byte* certDer,
930930
word32 certDerSz,
931931
byte* pubKeyDer,
932932
word32* pubKeyDerSz);
933-
WOLFSSL_API const char* wc_GetDecodedCertSubject(struct DecodedCert* cert,
934-
word32* subjectSz);
935-
WOLFSSL_API const char* wc_GetDecodedCertIssuer(struct DecodedCert* cert,
936-
word32* issuerSz);
937-
WOLFSSL_API const byte* wc_GetDecodedCertSerial(struct DecodedCert* cert,
938-
word32* serialSz);
933+
WOLFSSL_API int wc_GetDecodedCertSubject(const struct DecodedCert* cert,
934+
char* buf, word32* bufSz);
935+
WOLFSSL_API int wc_GetDecodedCertIssuer(const struct DecodedCert* cert,
936+
char* buf, word32* bufSz);
937+
WOLFSSL_API int wc_GetDecodedCertSerial(const struct DecodedCert* cert,
938+
byte* buf, word32* bufSz);
939939

940940
#ifdef WOLFSSL_FPKI
941941
WOLFSSL_API int wc_GetUUIDFromCert(struct DecodedCert* cert,

0 commit comments

Comments
 (0)