Skip to content

Commit 24917b1

Browse files
julek-wolfssljulek-wolfssl
committed
ocsp stapling: use wolf helper funcs for HTTP/TCP
1 parent fcd4e02 commit 24917b1

1 file changed

Lines changed: 35 additions & 144 deletions

File tree

‎ocsp/stapling/ocsp-server.c‎

Lines changed: 35 additions & 144 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@
3636
#define SERVER_KEY "server-certs/server1-key.pem"
3737
#define SERVER_ISSUER_CERT "client-certs/intermediate1-ca-cert.pem"
3838
#define SERVER_PORT 11111
39+
#define HTTP_TMP_BUFFER_SIZE 512
40+
#define URL_SIZE 128
3941

4042
static unsigned char* ocsp_resp = NULL;
4143
static int ocsp_resp_sz = 0;
@@ -57,158 +59,47 @@ static int cert_cb(WOLFSSL* ssl, void* arg)
5759
int ocsp_cb(void* ctx, const char* url, int urlSz,
5860
byte* ocspReqBuf, int ocspReqSz, byte** ocspRespBuf)
5961
{
60-
(void)ctx;
61-
if (url == NULL || urlSz <= 0 ||ocspReqBuf == NULL || ocspReqSz <= 0 ||
62-
ocspRespBuf == NULL) {
63-
fprintf(stderr, "ocsp_cb: invalid input\n");
64-
return -1;
65-
}
66-
67-
// Only support http://
68-
const char* prefix = "http://";
69-
size_t prefix_len = strlen(prefix);
70-
if (urlSz <= (int)prefix_len || strncmp(url, prefix, prefix_len) != 0) {
71-
fprintf(stderr, "ocsp_cb: only http:// URLs are supported\n");
72-
return -1;
73-
}
74-
75-
// Find domain and port
76-
const char* host_start = url + prefix_len;
77-
const char* url_end = url + urlSz;
78-
const char* colon = memchr(host_start, ':', url_end - host_start);
79-
if (!colon) {
80-
fprintf(stderr, "ocsp_cb: URL missing port\n");
81-
return -1;
82-
}
83-
const char* slash = memchr(colon, '/', url_end - colon);
84-
size_t domain_len = colon - host_start;
85-
size_t port_len = (slash ? (size_t)(slash - colon - 1) : (size_t)(url_end - colon - 1));
86-
87-
if (domain_len == 0 || port_len == 0) {
88-
fprintf(stderr, "ocsp_cb: invalid domain or port in URL\n");
89-
return -1;
90-
}
91-
92-
char domain[256];
93-
char port[16];
94-
if (domain_len >= sizeof(domain) || port_len >= sizeof(port)) {
95-
fprintf(stderr, "ocsp_cb: domain or port too long\n");
96-
return -1;
97-
}
98-
memcpy(domain, host_start, domain_len);
99-
domain[domain_len] = '\0';
100-
memcpy(port, colon + 1, port_len);
101-
port[port_len] = '\0';
102-
103-
// Resolve domain and port to IP address
104-
struct addrinfo hints, *res = NULL;
105-
memset(&hints, 0, sizeof(hints));
106-
hints.ai_family = AF_INET; // IPv4
107-
hints.ai_socktype = SOCK_STREAM; // TCP
108-
109-
int gai_ret = getaddrinfo(domain, port, &hints, &res);
110-
if (gai_ret != 0) {
111-
fprintf(stderr, "ocsp_cb: getaddrinfo failed: %s\n", gai_strerror(gai_ret));
112-
return -1;
113-
}
114-
115-
// Create a socket
116-
int sock = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
117-
if (sock < 0) {
118-
perror("ocsp_cb: socket");
119-
freeaddrinfo(res);
120-
return -1;
121-
}
122-
123-
// Connect to the server
124-
if (connect(sock, res->ai_addr, res->ai_addrlen) < 0) {
125-
perror("ocsp_cb: connect");
126-
close(sock);
127-
freeaddrinfo(res);
128-
return -1;
62+
int httpBufSz = 0;
63+
byte httpBuf[HTTP_TMP_BUFFER_SIZE];
64+
char path[URL_SIZE];
65+
char domainName[URL_SIZE];
66+
word16 port = 0;
67+
SOCKET_T sfd = SOCKET_INVALID;
68+
int ret = -1;
69+
int respSz = 0;
70+
71+
if (wolfIO_DecodeUrl(url, urlSz, domainName, path, &port) != 0) {
72+
WOLFSSL_MSG("Unable to decode OCSP URL");
73+
goto cleanup;
12974
}
13075

131-
// Prepare HTTP POST header
132-
char http_header[512];
133-
int header_len = snprintf(
134-
http_header, sizeof(http_header),
135-
"POST / HTTP/1.0\r\n"
136-
"Host: %s\r\n"
137-
"Content-Type: application/ocsp-request\r\n"
138-
"Content-Length: %d\r\n"
139-
"\r\n",
140-
domain, ocspReqSz
141-
);
142-
if (header_len < 0 || (size_t)header_len >= sizeof(http_header)) {
143-
fprintf(stderr, "ocsp_cb: HTTP header too long\n");
144-
close(sock);
145-
freeaddrinfo(res);
146-
return -1;
76+
httpBufSz = wolfIO_HttpBuildRequestOcsp(domainName, path, ocspReqSz,
77+
httpBuf, HTTP_TMP_BUFFER_SIZE);
78+
if (wolfIO_TcpConnect(&sfd, domainName, port, 0) != 0) {
79+
WOLFSSL_MSG("OCSP Responder connection failed");
80+
goto cleanup;
14781
}
14882

149-
// Send HTTP header
150-
if (send(sock, http_header, header_len, 0) != header_len) {
151-
perror("ocsp_cb: send header");
152-
close(sock);
153-
freeaddrinfo(res);
154-
return -1;
155-
}
156-
// Send OCSP request body
157-
if (send(sock, ocspReqBuf, ocspReqSz, 0) != ocspReqSz) {
158-
perror("ocsp_cb: send body");
159-
close(sock);
160-
freeaddrinfo(res);
161-
return -1;
162-
}
163-
// Read HTTP response
164-
char resp_buf[4096];
165-
int resp_len = 0;
166-
int n;
167-
while ((n = recv(sock, resp_buf + resp_len, sizeof(resp_buf) - resp_len, 0)) > 0) {
168-
resp_len += n;
169-
if (resp_len >= (int)sizeof(resp_buf)) {
170-
fprintf(stderr, "ocsp_cb: response too large\n");
171-
close(sock);
172-
freeaddrinfo(res);
173-
return -1;
174-
}
175-
}
176-
if (n < 0) {
177-
perror("ocsp_cb: recv");
178-
close(sock);
179-
freeaddrinfo(res);
180-
return -1;
83+
if (wolfIO_Send(sfd, (char*)httpBuf, httpBufSz, 0) != httpBufSz) {
84+
WOLFSSL_MSG("OCSP http request failed");
85+
goto cleanup;
18186
}
182-
close(sock);
183-
freeaddrinfo(res);
18487

185-
// Find end of HTTP headers
186-
char* body = NULL;
187-
int body_len = 0;
188-
char* header_end = NULL;
189-
header_end = strstr(resp_buf, "\r\n\r\n");
190-
if (!header_end) {
191-
fprintf(stderr, "ocsp_cb: malformed HTTP response\n");
192-
return -1;
193-
}
194-
body = header_end + 4;
195-
body_len = resp_len - (body - resp_buf);
196-
if (body_len <= 0) {
197-
fprintf(stderr, "ocsp_cb: empty HTTP body\n");
198-
return -1;
88+
if (wolfIO_Send(sfd, (char*)ocspReqBuf, ocspReqSz, 0) != ocspReqSz) {
89+
WOLFSSL_MSG("OCSP ocsp request failed");
90+
goto cleanup;
19991
}
200-
201-
// Allocate and copy OCSP response body
202-
ocsp_resp = *ocspRespBuf = (byte*)malloc(body_len);
203-
ocsp_resp_sz = body_len;
204-
if (!*ocspRespBuf) {
205-
fprintf(stderr, "ocsp_cb: malloc failed\n");
206-
return -1;
92+
if ((respSz = wolfIO_HttpProcessResponseOcsp((int)sfd, ocspRespBuf, httpBuf,
93+
HTTP_TMP_BUFFER_SIZE, ctx)) <= 0) {
94+
WOLFSSL_MSG("OCSP http response failed");
95+
goto cleanup;
20796
}
208-
memcpy(*ocspRespBuf, body, body_len);
209-
210-
// Return the length of the OCSP response body
211-
return body_len;
97+
ocsp_resp = *ocspRespBuf;
98+
ocsp_resp_sz = ret = respSz;
99+
cleanup:
100+
if (sfd != SOCKET_INVALID)
101+
CloseSocket(sfd);
102+
return ret;
212103
}
213104

214105
static int fetch_ocsp_response(unsigned char** resp, int* respSz)

0 commit comments

Comments
 (0)