bogo: test client use of OCSP stapling

ctz · ctz · commit 194ea36b908a · 2025-06-25T18:03:18.000Z
diff --git a/bogo/config.json.in b/bogo/config.json.in
@@ -17,8 +17,7 @@
     "CheckLeafCurve": "",
     "SendWarningAlerts-*": "",
     "Peek-*": "",
-    "ClientOCSPCallback*": "ocsp not supported yet",
-    "ServerOCSPCallback*": "",
+    "ServerOCSPCallback*": "ocsp not supported for servers",
     "SendUnsolicitedOCSPOnCertificate-TLS13": "we unconditionally request a stapled OCSP response",
     "DuplicateCertCompressionExt*-TLS12": "RFC8879: if TLS 1.2 or earlier is negotiated, the peers MUST ignore this extension",
 #if defined(RING)
diff --git a/bogo/src/main.rs b/bogo/src/main.rs
@@ -127,6 +127,7 @@ struct Options {
     on_initial_expect_curve_id: Option<NamedGroup>,
     on_resume_expect_curve_id: Option<NamedGroup>,
     wait_for_debugger: bool,
+    ocsp: OcspValidation,
 }
 
 impl Options {
@@ -197,6 +198,7 @@ impl Options {
             on_initial_expect_curve_id: None,
             on_resume_expect_curve_id: None,
             wait_for_debugger: false,
+            ocsp: OcspValidation::default(),
         }
     }
 
@@ -411,10 +413,11 @@ impl ClientCertVerifier for DummyClientAuth {
 #[derive(Debug)]
 struct DummyServerAuth {
     parent: Arc<dyn ServerCertVerifier>,
+    ocsp: OcspValidation,
 }
 
 impl DummyServerAuth {
-    fn new(trusted_cert_file: &str) -> Self {
+    fn new(trusted_cert_file: &str, ocsp: OcspValidation) -> Self {
         Self {
             parent: WebPkiServerVerifier::builder_with_provider(
                 load_root_certs(trusted_cert_file),
@@ -424,6 +427,7 @@ impl DummyServerAuth {
             )
             .build()
             .unwrap(),
+            ocsp,
         }
     }
 }
@@ -437,6 +441,9 @@ impl ServerCertVerifier for DummyServerAuth {
         _ocsp: &[u8],
         _now: UnixTime,
     ) -> Result<ServerCertVerified, Error> {
+        if let OcspValidation::Reject = self.ocsp {
+            return Err(CertificateError::InvalidOcspResponse.into());
+        }
         Ok(ServerCertVerified::assertion())
     }
 
@@ -465,6 +472,16 @@ impl ServerCertVerifier for DummyServerAuth {
     }
 }
 
+#[derive(Clone, Copy, Debug, Default)]
+enum OcspValidation {
+    /// Totally ignore `ocsp_response` value
+    #[default]
+    None,
+
+    /// Return an error (irrespective of `ocsp_response` value)
+    Reject,
+}
+
 #[derive(Debug)]
 struct FixedSignatureSchemeSigningKey {
     key: Arc<dyn sign::SigningKey>,
@@ -807,7 +824,10 @@ fn make_client_cfg(opts: &Options) -> Arc<ClientConfig> {
 
     let cfg = cfg
         .dangerous()
-        .with_custom_certificate_verifier(Arc::new(DummyServerAuth::new(&opts.trusted_cert_file)));
+        .with_custom_certificate_verifier(Arc::new(DummyServerAuth::new(
+            &opts.trusted_cert_file,
+            opts.ocsp,
+        )));
 
     let mut cfg = if !opts.cert_file.is_empty() && !opts.key_file.is_empty() {
         let cert = CertificateDer::pem_file_iter(&opts.cert_file)
@@ -1016,6 +1036,10 @@ fn handle_err(opts: &Options, err: Error) -> ! {
         Error::InvalidCertificate(CertificateError::UnsupportedSignatureAlgorithm) => {
             quit(":WRONG_SIGNATURE_TYPE:")
         }
+        Error::InvalidCertificate(CertificateError::InvalidOcspResponse) => {
+            // note: only use is in this file.
+            quit(":OCSP_CB_ERROR:")
+        }
         Error::InvalidCertificate(e) => quit(&format!(":BAD_CERT: ({e:?})")),
         Error::PeerSentOversizedRecord => quit(":DATA_LENGTH_TOO_LONG:"),
         _ => {
@@ -1645,6 +1669,9 @@ pub fn main() {
             "-server-preference" => {
                 opts.server_preference = true;
             }
+            "-fail-ocsp-callback" => {
+                opts.ocsp = OcspValidation::Reject;
+            }
             "-wait-for-debugger" => {
                 #[cfg(windows)]
                 {
@@ -1669,6 +1696,7 @@ pub fn main() {
             "-expect-no-session" |
             "-expect-ticket-renewal" |
             "-enable-ocsp-stapling" |
+            "-use-ocsp-callback" |
             "-forbid-renegotiation-after-handshake" |
             // internal openssl details:
             "-async" |
