rustls / rustls/rustls-platform-verifier
Enable stapled OCSP verification test, investigate Windows verifier OCSP staple handling
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 158
- Forks
- 60
- Avg merge
- 5d 10h
- Merged PRs (30d)
- 3
Description
After https://github.com/rustls/rustls-platform-verifier/pull/50 lands we should be able to enable the stapled OCSP test in the real world verification test suite: https://github.com/rustls/rustls-platform-verifier/blob/65b2a97aff062585d91c97ae3b7b1d17fbcd7b62/rustls-platform-verifier/src/tests/verification_real_world/mod.rs#L221-L239
As described in this comment (which should also be fixed up) this was commented out when it wasn't possible to specify a time to use for verification to avoid flakes from the very short OCSP response validity period.
We know that Webpki doesn't support revocation checking via stapled OCSP (see https://github.com/rustls/webpki/issues/217) so we will need to cfg gate the expected result to only assert a revocation error result for non-Linux/WASM platforms - something like:
revoked_badssl_com_stapled => TestCase {
reference_id: "revoked.badssl.com",
chain: &[
include_bytes!("revoked_badssl_com_1.crt"),
include_bytes!("revoked_badssl_com_2.crt"),
],
stapled_ocsp: Some(include_bytes!("revoked_badssl_com_1.ocsp")),
// Note: the vendored revoked badssl cert and OCSP response expired ~Dec 9 2021,
// so we use a verification time fixed to Dec 4 02:09:01 2021 UTC
verification_time: SystemTime::UNIX_EPOCH + Duration::from_secs(1_638_583_741),
#[cfg(not(any(target_os = "linux", target_arch = "wasm32")))]
expected_result: Err(TlsError::InvalidCertificate(CertificateError::Revoked)),
#[cfg(any(target_os = "linux", target_arch = "wasm32"))]
expected_result: Ok(()), // https://github.com/rustls/webpki/issues/217
other_error: no_error!(),
},
However, it appears the Windows verifier is returning Ok(()) where Err(TlsError::InvalidCertificate(CertificateError::Revoked)) is expected. Further investigation is required.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the stapled OCSP test and explanatory comment in rustls-platform-verifier/src/tests/verification_real_world/mod.rs, after checking the behavior introduced by pull request 50. Enable the test with the fixed verification time and compare Windows with the platform-gated expected results. Done means the test reflects supported platform behavior and the Windows verifier's unexpected Ok(()) result is understood or corrected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100