Use wolfSSL's EmbedOcspLookup in non-blocking async OCSP example - #604
Use wolfSSL's EmbedOcspLookup in non-blocking async OCSP example#604night1rider wants to merge 1 commit into
Conversation
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #604
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
c7c49f3 to
8d7c242
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #604
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
…OCSP responder URL into a system() call, replace that with wolfSSL's EmbedOcspLookup so the untrusted URL is fetched over a socket as data instead of being executed. Resolve the default server by hostname with getaddrinfo instead of a hard-coded IP so the example keeps connecting as the address changes.
8d7c242 to
4011953
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #604
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #604
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
There was a problem hiding this comment.
Pull request overview
This PR hardens the non-blocking async OCSP example by removing execution of an untrusted OCSP responder URL via system()/curl, instead using wolfSSL’s built-in OCSP HTTP fetch API, and updates server connection setup to resolve the hostname dynamically via getaddrinfo().
Changes:
- Replace
system("curl ... <untrusted-url>")OCSP fetching withEmbedOcspLookup()+EmbedOcspRespFree(). - Resolve
SERVER_NAMEviagetaddrinfo()instead of using a hard-coded IP address. - Update README sample output to remove the printed curl command flow.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| ocsp/ocsp_nonblock/ocsp_nonblock_async.c | Switch OCSP callback to EmbedOcspLookup() and resolve server address via getaddrinfo(). |
| ocsp/ocsp_nonblock/README.md | Remove curl-command/temporary-file output lines from the example run log. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Overall this looks good and an improvement over the original system(3) based example.
Two requested changes:
- While you're updating the
README.mdwe should remove this outdated section:
NOTE: Before building this example the asynchronous support must be obtained from (https://github.com/wolfSSL/wolfAsyncCrypt) and installed into wolfSSL by following the instructions in the README file contained in the wolfAsyncCrypt repository.
The wolfAsyncCrypt repo is deprecated, and the async code is upstreamed into wolfssl now.
- It would be nice to just include a cert to use for this
ocsp_nonblock_asyncexample.
note: the google.pem used by ocsp_nonblock.c example is expired, but that's outside scope of this PR.
The callback built a curl command by interpolating the certificate's OCSP responder URL into a system() call, replace that with wolfSSL's EmbedOcspLookup so the untrusted URL is fetched over a socket as data instead of being executed.
Resolve the default server by hostname with getaddrinfo instead of a hard-coded IP so the example keeps connecting as the address changes.