Skip to content

Commit 8aa7055

Browse files
author
jenkins[bot]
committed
1.18.0-1 (component version v-2.16.13)
1 parent d39431d commit 8aa7055

7 files changed

Lines changed: 80 additions & 20 deletions

File tree

‎src/mock/tsl/MockOcsp.cxx‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -23,19 +23,18 @@
2323

2424
namespace
2525
{
26-
std::unique_ptr<OCSP_CERTID, decltype(&OCSP_CERTID_free)>
26+
OcspCertidPtr
2727
createUnexpectedCertId()
2828
{
2929
const auto pkiPath = MockConfiguration::instance().getPathValue(MockConfigurationKey::MOCK_GENERATED_PKI_PATH);
3030
const Certificate certificate = Certificate::fromBase64Der(FileHelper::readFileAsString(
3131
pkiPath / "../tsl/X509Certificate/QES-noType.base64.der"));
3232
const Certificate certificateCA = Certificate::fromBase64Der(FileHelper::readFileAsString(
3333
pkiPath / "../tsl/X509Certificate/QES-noTypeCA.base64.der"));
34-
return std::unique_ptr<OCSP_CERTID, decltype(&OCSP_CERTID_free)>(
35-
OCSP_cert_to_id(nullptr, certificate.toX509(), certificateCA.toX509()), OCSP_CERTID_free);
34+
return OcspCertidPtr(OCSP_cert_to_id(nullptr, certificate.toX509(), certificateCA.toX509()));
3635
}
3736

38-
std::unique_ptr<OCSP_CERTID, decltype(&OCSP_CERTID_free)>
37+
OcspCertidPtr
3938
getCertificateIdFromOcspRequest(const std::string& ocspRequest)
4039
{
4140
const unsigned char* buffer = reinterpret_cast<const unsigned char*>(ocspRequest.data());
@@ -54,7 +53,7 @@ namespace
5453
OCSP_CERTID* ocspCertId = OCSP_onereq_get0_id(oneRequest);
5554
OpenSslExpect(ocspCertId != nullptr, "can not get certificate id from OCSP request");
5655

57-
return std::unique_ptr<OCSP_CERTID, decltype(&OCSP_CERTID_free)>(OCSP_CERTID_dup(ocspCertId), OCSP_CERTID_free);
56+
return OcspCertidPtr(OCSP_CERTID_dup(ocspCertId));
5857
}
5958

6059

@@ -163,9 +162,8 @@ namespace
163162

164163
for(const auto& certificatePair : ocspResponderKnownCertificateCaPairs)
165164
{
166-
std::unique_ptr<OCSP_CERTID, decltype(&OCSP_CERTID_free)> knownCertificateId(
167-
OCSP_cert_to_id(nullptr, certificatePair.certificate.toX509(), certificatePair.issuer.toX509()),
168-
OCSP_CERTID_free);
165+
OcspCertidPtr knownCertificateId(
166+
OCSP_cert_to_id(nullptr, certificatePair.certificate.toX509(), certificatePair.issuer.toX509()));
169167
OpenSslExpect(knownCertificateId != nullptr, "can not create certificate id");
170168
if (0 == OCSP_id_cmp(&certificateId, knownCertificateId.get()))
171169
{
@@ -195,7 +193,7 @@ MockOcsp MockOcsp::create (
195193
CertificateOcspTestMode testMode =
196194
certificateToSign.has_value() ? certificateToSign->testMode : CertificateOcspTestMode::SUCCESS;
197195

198-
std::unique_ptr<OCSP_CERTID, decltype(&OCSP_CERTID_free)> unexpectedCertId{nullptr, OCSP_CERTID_free};
196+
OcspCertidPtr unexpectedCertId(nullptr);
199197
if (testMode == CertificateOcspTestMode::WRONG_CERTID)
200198
{
201199
unexpectedCertId = createUnexpectedCertId();
@@ -263,7 +261,7 @@ MockOcsp MockOcsp::create (
263261
Certificate& certificate,
264262
shared_EVP_PKEY& privateKey)
265263
{
266-
std::unique_ptr<OCSP_CERTID, decltype(&OCSP_CERTID_free)> certificateId =
264+
OcspCertidPtr certificateId =
267265
getCertificateIdFromOcspRequest(ocspRequest);
268266
OpenSslExpect(certificateId != nullptr, "can not create certificate id");
269267
return create(certificateId.get(), ocspResponderKnownCertificateCaPairs, certificate, privateKey);

‎src/shared/tsl/OcspService.cxx‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -489,7 +489,8 @@ namespace
489489
TrustStore& trustStore,
490490
const std::optional<std::vector<X509Certificate>>& ocspSignerCertificates,
491491
const bool validateHashExtension,
492-
bool validateProducedAt)
492+
bool validateProducedAt,
493+
bool allowCaching)
493494
{
494495
auto response = parseResponse(
495496
certificate,
@@ -504,7 +505,7 @@ namespace
504505
TVLOG(2) << "Returning new OCSP status: " << response.status.to_string();
505506
response.response = (serializedOcspResponse.has_value() ? *serializedOcspResponse
506507
: OcspHelper::ocspResponseToString(*ocspResponse));
507-
if (response.status.certificateStatus != CertificateStatus::unknown)
508+
if (allowCaching && response.status.certificateStatus != CertificateStatus::unknown)
508509
{
509510
// the returned OCSP response is only cached if the status is not unknown
510511
trustStore.setCacheOcspData(certificate.getSha256FingerprintHex(), response);
@@ -538,7 +539,8 @@ namespace
538539
trustStore,
539540
ocspSignerCertificates,
540541
validateHashExtension,
541-
true // validateProducedAt
542+
true, // validateProducedAt
543+
true // allowCaching
542544
);
543545
}
544546

@@ -627,7 +629,9 @@ namespace
627629
trustStore,
628630
ocspSignerCertificates,
629631
validateHashExtension,
630-
validateProducedAt);
632+
validateProducedAt,
633+
false // allowCaching
634+
);
631635
// validate the producedAt afterwards to check if we can fall
632636
// back to cache
633637
auto now = std::chrono::system_clock::now();
@@ -690,7 +694,9 @@ namespace
690694
trustStore,
691695
ocspSignerCertificates,
692696
validateHashExtension,
693-
true);
697+
true,
698+
false // allowCaching
699+
);
694700
}
695701
Fail("Invalid value for OcspCheckMode: " + std::to_string(static_cast<uintmax_t>(ocspCheckDescriptor.mode)));
696702
}

‎src/shared/tsl/TrustStore.hxx‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,7 @@ private:
194194
FRIEND_TEST(TslServiceTest, verifyCertificateValidThenRevokedCASuccess);
195195
FRIEND_TEST(TslServiceTest, verifyCertificatePolicyNoRestrictionsSuccessful);
196196
FRIEND_TEST(TslServiceTest, verifyCertificatePolicySuccessful);
197+
FRIEND_TEST(TslServiceTest, doNotCacheProvidedOcspResponse);
197198

198199
friend class TslTestHelper;
199200

‎test/CMakeLists.txt‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ add_library(erp-test-util-lib OBJECT ${ERP_TEST_UTIL_SOURCES})
7373
target_link_libraries(erp-test-util-lib
7474
PUBLIC
7575
date::date
76+
erp-hsm-tpm-mock
7677
erp-test-resourcemanager
7778
glog::glog
7879
GTest::gtest
@@ -401,8 +402,6 @@ list(
401402
)
402403

403404

404-
target_compile_definitions(erp-test PUBLIC WITH_HSM_MOCK=1)
405-
406405
target_link_libraries ( erp-test
407406
PUBLIC
408407
erp-hsm-tpm-mock

‎test/erp/tsl/TslManagerTest.cxx‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1375,8 +1375,7 @@ TEST_F(TslManagerTest, permitOutdatedProducedAt)//NOLINT(readability-function-co
13751375
std::shared_ptr<TslManager> manager = TslTestHelper::createTslManager<TslManager>(
13761376
{}, {}, {{"http://ehca-testref.komp-ca.telematik-test:8080/status/qocsp", {certPairValid}}});
13771377

1378-
std::unique_ptr<OCSP_CERTID, decltype(&OCSP_CERTID_free)> certId(
1379-
OCSP_cert_to_id(nullptr, certificate.toX509(), certificateCA.toX509()), OCSP_CERTID_free);
1378+
OcspCertidPtr certId(OCSP_cert_to_id(nullptr, certificate.toX509(), certificateCA.toX509()));
13801379

13811380
auto checkDescriptor = TslTestHelper::getDefaultTestOcspCheckDescriptor();
13821381
checkDescriptor.mode = OcspCheckDescriptor::PROVIDED_OR_CACHE_REQUEST_IF_OUTDATED;

‎test/erp/tsl/TslServiceTests.cxx‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99

1010
#include "shared/crypto/Certificate.hxx"
1111
#include "shared/crypto/EllipticCurveUtils.hxx"
12+
#include "shared/tsl/OcspHelper.hxx"
1213
#include "shared/tsl/OcspService.hxx"
1314
#include "shared/tsl/TrustStore.hxx"
1415
#include "shared/tsl/TslService.hxx"
@@ -178,3 +179,59 @@ TEST_F(TslServiceTest, verifyCertificatePolicyFailing)//NOLINT(readability-funct
178179
{TslErrorCode::CERT_TYPE_MISMATCH},
179180
HttpStatus::BadRequest);
180181
}
182+
183+
184+
TEST_F(TslServiceTest, doNotCacheProvidedOcspResponse)
185+
{
186+
UrlRequestSenderMock requestSender({});
187+
X509Certificate x509Certificate = X509Certificate::createFromAsnBytes(
188+
{reinterpret_cast<const unsigned char*>(userCertificate.data()), userCertificate.size()});
189+
190+
auto iterator = mTrustStore->mServiceInformationMap.find(
191+
{x509Certificate.getIssuer(), x509Certificate.getAuthorityKeyIdentifier()});
192+
ASSERT_NE(mTrustStore->mServiceInformationMap.end(), iterator);
193+
194+
auto cert = Certificate::fromBinaryDer(userCertificate);
195+
auto certCa = Certificate::fromBase64Der(iterator->second.certificate.toBase64());
196+
197+
auto checkDescriptor = TslTestHelper::getDefaultTestOcspCheckDescriptor();
198+
OcspCertidPtr certId(OCSP_cert_to_id(nullptr, cert.toX509(), certCa.toX509()));
199+
200+
const auto certPairValid = MockOcsp::CertificatePair{.certificate = cert,
201+
.issuer = certCa,
202+
.testMode = MockOcsp::CertificateOcspTestMode::SUCCESS};
203+
204+
auto ocspCert = TslTestHelper::getDefaultOcspCertificate();
205+
auto ocspKey = TslTestHelper::getDefaultOcspPrivateKey();
206+
207+
auto response = MockOcsp::create(certId.get(), {certPairValid}, ocspCert, ocspKey).toDer();
208+
checkDescriptor.providedOcspResponse = OcspHelper::stringToOcspResponse(response);
209+
210+
211+
const auto fingerprint = x509Certificate.getSha256FingerprintHex();
212+
213+
// if we dont make a request, do not cache the ocsp response
214+
using enum OcspCheckDescriptor::OcspCheckMode;
215+
for (auto mode : {PROVIDED_OR_CACHE_REQUEST_IF_OUTDATED, PROVIDED_OR_CACHE, PROVIDED_OR_CACHE_REQUEST_IF_OUTDATED,
216+
PROVIDED_ONLY})
217+
{
218+
checkDescriptor.mode = mode;
219+
mTrustStore->cleanCachedOcspData(fingerprint);
220+
EXPECT_NO_THROW(TslService::checkCertificate(x509Certificate, {CertificateType::C_HCI_OSIG}, requestSender,
221+
*mTrustStore, checkDescriptor));
222+
ASSERT_FALSE(mTrustStore->getCachedOcspData(fingerprint).has_value());
223+
}
224+
225+
// if we have to make a request, allow caching of the ocsp response
226+
TslTestHelper::setOcspUrlRequestHandler(requestSender, "http://ocsp-testref.tsl.telematik-test/ocsp",
227+
{{cert, certCa, MockOcsp::CertificateOcspTestMode::SUCCESS}});
228+
229+
for (auto mode : {FORCE_OCSP_REQUEST_STRICT, FORCE_OCSP_REQUEST_ALLOW_CACHE})
230+
{
231+
checkDescriptor.mode = mode;
232+
mTrustStore->cleanCachedOcspData(fingerprint);
233+
EXPECT_NO_THROW(TslService::checkCertificate(x509Certificate, {CertificateType::C_HCI_OSIG}, requestSender,
234+
*mTrustStore, checkDescriptor));
235+
ASSERT_TRUE(mTrustStore->getCachedOcspData(fingerprint).has_value());
236+
}
237+
}

‎version.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v-2.16.12
1+
v-2.16.13

0 commit comments

Comments
 (0)