wolfssl/.github/workflows/ocsp.yml at master · wolfSSL/wolfssl · GitHub

View runs

History

150 lines (131 loc) · 7.03 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

# START OF COMMON SECTION

on:

push:

branches: [ 'release/**' ]

pull_request:

types: [opened, synchronize, reopened, ready_for_review]

branches: [ '*' ]

concurrency:

group: ${{ github.workflow }}-${{ github.ref }}

cancel-in-progress: true

permissions:

contents: read

# END OF COMMON SECTION

jobs:

ocsp_stapling:

if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}

runs-on: ubuntu-24.04

timeout-minutes: 10

steps:

- name: Checkout wolfSSL

uses: actions/checkout@v5

- name: Build wolfSSL

run: autoreconf -ivf && ./configure --enable-ocsp --enable-ocspstapling && make

- name: Start OCSP responder 1

run: openssl ocsp -port 22221 -ndays 1000 -index certs/ocsp/index-intermediate1-ca-issued-certs.txt -rsigner certs/ocsp/ocsp-responder-int1-cert.pem -rkey certs/ocsp/ocsp-responder-int1-key.pem -CA certs/ocsp/intermediate1-ca-cert.pem &

- name: Start OCSP responder 2

run: openssl ocsp -port 22220 -ndays 1000 -index certs/ocsp/index-ca-and-intermediate-cas.txt -rsigner certs/ocsp/ocsp-responder-cert.pem -rkey certs/ocsp/ocsp-responder-key.pem -CA certs/ocsp/root-ca-cert.pem &

- name: Start TLS server

run: ./examples/server/server -p 11111 -c ./certs/ocsp/server1-cert.pem -k ./certs/ocsp/server1-key.pem -d &

- name: Test Look Up

run: ./examples/client/client -A ./certs/ocsp/root-ca-cert.pem -o

ocsp_ssrf_screen:

if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}

runs-on: ubuntu-24.04

timeout-minutes: 10

steps:

- name: Checkout wolfSSL

uses: actions/checkout@v5

# Build with the opt-in OCSP responder destination screening enabled

# (WOLFSSL_OCSP_SCREEN_RESPONDER). This guards against a certificate AIA

# OCSP URL driving an outbound request to an internal address (SSRF,

# CWE-918). The screening is off by default, so it is not exercised by

# the ocsp_stapling job above (which uses localhost responders).

- name: Build wolfSSL with OCSP responder screening enabled

run: autoreconf -ivf && ./configure --enable-ocsp CPPFLAGS=-DWOLFSSL_OCSP_SCREEN_RESPONDER && make

# Run only the boundary unit test, not the localhost OCSP test scripts:

# with screening on, 127.0.0.1 responders are (correctly) rejected, so

# the stapling scripts do not apply to this build. Assert the test

# actually ran (passed) rather than being compiled out and skipped, so a

# future build-define change cannot turn this into a false-green signal.

- name: Run OCSP destination screening boundary tests

run: |

./tests/unit.test -test_wolfIO_OcspDestAllowed | tee out.txt

grep -Eq 'test_wolfIO_OcspDestAllowed[^_].*: passed' out.txt

# The leaf OCSP request built for stapling is cached on the WOLFSSL_CTX and

# reused by every later connection on it, with the CTX owning it. None of the

# jobs above reach that cache: it is only populated when the SSL shares the

# CTX certificate buffer (ssl->buffers.weOwnCert == 0), and OPENSSL_ALL

# implies WOLFSSL_COPY_CERT, which gives every SSL its own copy instead.

ocsp_ctx_request_cache:

if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}

runs-on: ubuntu-24.04

timeout-minutes: 20

strategy:

fail-fast: false

matrix:

include:

# Plain stapling build: no OPENSSL_ALL, so no WOLFSSL_COPY_CERT and

# the cache is live.

- name: default

config: --enable-ocsp --enable-ocspstapling --enable-ocspstapling2

# The same cache under --enable-all, which pulls in OPENSSL_ALL and

# with it the compatibility-layer code paths around the cert manager.

# OPENSSL_ALL would otherwise force WOLFSSL_COPY_CERT and take the

# cache out of play entirely, so that is turned back off explicitly -

# which is what this entry is really here to prove.

- name: all, no cert copy

config: --enable-all CPPFLAGS=-DWOLFSSL_NO_COPY_CERT

# The cache hands one OcspRequest to many connections, so the failure

# mode of an ownership mistake is a double free or a use after free at

# CTX teardown rather than a wrong answer. ASan is what turns that into

# a test failure.

- name: asan

config: --enable-ocsp --enable-ocspstapling --enable-ocspstapling2 CFLAGS='-fsanitize=address -g' LDFLAGS='-fsanitize=address'

steps:

- name: workaround high-entropy ASLR

# Needed for the ASan build on this runner image; harmless for the rest.

run: sudo sysctl vm.mmap_rnd_bits=28

- name: Checkout wolfSSL

uses: actions/checkout@v5

- name: Build wolfSSL

run: autoreconf -ivf && ./configure ${{ matrix.config }} && make

# Assert on the counters rather than grepping the test name for "passed":

# the handshake under test logs to the same stream and splits the name and

# the result across lines. Running the one test on its own makes 0/0/1/1

# exact, and a build where the cache is compiled out reports 0/1/0/1

# instead - so a config change that quietly disables this cannot pass as

# green.

# Leak detection is off because wolfSSL's own unit.test has no verified

# clean LSan baseline; the double free and use after free this is here to

# catch are reported either way.

- name: Run the CTX OCSP request cache test

env:

ASAN_OPTIONS: detect_leaks=0

run: |

set -o pipefail

./tests/unit.test -test_ocsp_ctx_request_cache | tee out.txt

grep -Eq 'Failed/Skipped/Passed/All: 0/0/1/1' out.txt

ocsp_ssrf_screen_fallback:

if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}

runs-on: ubuntu-24.04

timeout-minutes: 10

steps:

- name: Checkout wolfSSL

uses: actions/checkout@v5

# Force the gethostbyname() resolver fallback (ac_cv_func_getaddrinfo=no)

# so the otherwise-untested fallback path of wolfIO_OcspDestAllowed is

# exercised. The fallback is IPv4-only and relies on glibc parsing

# numeric IPv4 literals locally.

- name: Build wolfSSL forcing the gethostbyname resolver fallback

run: autoreconf -ivf && ./configure --enable-ocsp ac_cv_func_getaddrinfo=no CPPFLAGS=-DWOLFSSL_OCSP_SCREEN_RESPONDER && make

- name: Run OCSP destination screening fallback boundary tests

run: |

./tests/unit.test -test_wolfIO_OcspDestAllowed_fallback | tee out.txt

grep -Eq 'test_wolfIO_OcspDestAllowed_fallback.*: passed' out.txt

wolfssl/.github/workflows/ocsp.yml at master · wolfSSL/wolfssl · GitHub

Uh oh!

Expand file tree

Breadcrumbs

ocsp.yml

Latest commit

History

Breadcrumbs

ocsp.yml

File metadata and controls