| Subject: | OCSP broken in 1.75+ - patch included |
Hi,
Due to code changes OCSP got broken in 1.75. Unfortunately the existing test showed no error because due to changed certificates for the external sites the test simply was skipped automatically.
Attached is a patch which makes OCSP work again. This also updates the patch to match the new certificates and additionally makes sure that the OCSP test will not skip subtests when the certificates change again, at least not if ENV RELEASE_TESTING is set.
Regards,
Steffen
| Subject: | patch.txt |
Index: SSLeay.xs
===================================================================
--- SSLeay.xs (revision 477)
+++ SSLeay.xs (working copy)
@@ -6011,7 +6011,7 @@
X509 *issuer;
X509 *last = sk_X509_value(chain,sk_X509_num(chain)-1);
if ( (issuer = find_issuer(last,store,chain))) {
- OCSP_basic_add1_cert(bsr, X509_dup(issuer));
+ OCSP_basic_add1_cert(bsr, issuer);
TRACE(1,"run OCSP_basic_verify with issuer for last chain element");
RETVAL = OCSP_basic_verify(bsr, NULL, store, flags);
}
@@ -6058,11 +6058,8 @@
goto end;
}
int first = OCSP_resp_find(bsr, certid, -1); /* Find the first matching */
- if (first >= 0)
- {
- sir = OCSP_resp_get0(bsr,first);
- break;
- }
+ if (first >= 0)
+ sir = OCSP_resp_get0(bsr,first);
}
int status, revocationReason;
@@ -6073,7 +6070,8 @@
status = OCSP_single_get0_status(sir, &revocationReason, &revocationTime, &thisupdate, &nextupdate);
#else
status = sir->certStatus->type;
- revocationTime = sir->certStatus->value.revoked->revocationTime;
+ if (status == V_OCSP_CERTSTATUS_REVOKED)
+ revocationTime = sir->certStatus->value.revoked->revocationTime;
thisupdate = sir->thisUpdate;
nextupdate = sir->nextUpdate;
#endif
Index: t/external/ocsp.t
===================================================================
--- t/external/ocsp.t (revision 477)
+++ t/external/ocsp.t (working copy)
@@ -16,7 +16,7 @@
# this should give us OCSP stapling
host => 'www.live.com',
port => 443,
- fingerprint => '10c56ee9e2acaf2e77caeb7072bf6522dd7422b8',
+ fingerprint => '0e37dc9b320d2526e93e360a26c824b202d1f3af',
ocsp_staple => 1,
expect_status => Net::SSLeay::V_OCSP_CERTSTATUS_GOOD(),
},
@@ -24,7 +24,7 @@
# no OCSP stapling yet
host => 'www.google.com',
port => 443,
- fingerprint => '007a5ab302f14446e2ea24d3a829de22ba1bf950',
+ fingerprint => '89380c438a076d9d5fac228a8f680ff452487f30',
expect_status => Net::SSLeay::V_OCSP_CERTSTATUS_GOOD(),
},
{
@@ -31,7 +31,7 @@
# this is revoked
host => 'revoked.grc.com',
port => 443,
- fingerprint => '34703c40093461ad3ce087e161c7b7f42abe770c',
+ fingerprint => '310665f4c8e78db761c764e798dca66047341264',
expect_status => Net::SSLeay::V_OCSP_CERTSTATUS_REVOKED(),
},
);
@@ -50,6 +50,12 @@
TEST:
+sub skip_unless_release {
+ die "this test should not be skipped for release - might need to fix test"
+ if $ENV{RELEASE_TESTING};
+ goto &skip;
+}
+
for my $test (@tests) {
my $cleanup = __cleanup__->new;
SKIP: {
@@ -61,7 +67,7 @@
PeerPort => $test->{port},
Timeout => $timeout,
);
- skip "TCP connect to $test->{host}:$test->{port} failed: $!",1
+ skip_unless_release "TCP connect to $test->{host}:$test->{port} failed: $!",1
if !$cl;
diag("tcp connect to $test->{host}:$test->{port} ok");
@@ -103,7 +109,7 @@
select(undef,$vec,undef,$to);
}
}
- skip "SSL_connect with $test->{host}:$test->{port} failed: ".
+ skip_unless_release "SSL_connect with $test->{host}:$test->{port} failed: ".
Net::SSLeay::print_errs(''),1
if $rv<=0;
diag("SSL_connect ok");
@@ -113,8 +119,8 @@
$cleanup->add(sub { Net::SSLeay::X509_free($leaf_cert) }) if $leaf_cert;
my $fp = $leaf_cert
&& unpack("H*",Net::SSLeay::X509_digest($leaf_cert,$sha1));
- skip "could not get fingerprint",1 if !$fp;
- skip "bad fingerprint $fp for $test->{host}:$test->{port}",1
+ skip_unless_release "could not get fingerprint",1 if !$fp;
+ skip_unless_release "bad fingerprint $fp for $test->{host}:$test->{port}",1
if $fp ne $test->{fingerprint};
diag("fingerprint matches");