Skip to content

Commit 4b4a7cc

Browse files
julek-wolfssljulek-wolfssl
committed
Use ready files for syncing
1 parent 7cd93bd commit 4b4a7cc

3 files changed

Lines changed: 91 additions & 76 deletions

File tree

‎examples/ocsp_responder/ocsp_responder.c‎

Lines changed: 23 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,7 @@ typedef struct {
124124
const char* certFile;
125125
const char* keyFile;
126126
const char* indexFile;
127+
const char* readyFile;
127128
int nrequests;
128129
int verbose;
129130
int sendCerts;
@@ -142,6 +143,7 @@ static void Usage(void)
142143
LOG_MSG(" -c <file> CA certificate\n");
143144
LOG_MSG(" -k <file> CA private key\n");
144145
LOG_MSG(" -i <file> Index file for cert status\n");
146+
LOG_MSG(" -R <file> Ready file for external monitor\n");
145147
LOG_MSG(" -n <num> Exit after n requests\n");
146148
LOG_MSG(" -v Verbose\n");
147149
LOG_MSG(" -x Exclude certs from response\n");
@@ -445,52 +447,6 @@ static int PopulateResponderFromIndex(OcspResponder* responder, IndexEntry* inde
445447
return count;
446448
}
447449

448-
/* Create TCP server socket */
449-
static SOCKET_T CreateServerSocket(word16 port)
450-
{
451-
SOCKET_T sockfd;
452-
struct sockaddr_in addr;
453-
int yes = 1;
454-
455-
#ifdef _WIN32
456-
WSADATA wsaData;
457-
if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0) {
458-
LOG_ERROR("WSAStartup failed\n");
459-
return INVALID_SOCKET;
460-
}
461-
#endif
462-
463-
sockfd = socket(AF_INET, SOCK_STREAM, 0);
464-
if (sockfd == INVALID_SOCKET) {
465-
LOG_ERROR("socket() failed\n");
466-
return INVALID_SOCKET;
467-
}
468-
469-
/* Allow reuse */
470-
if (setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, (const char*)&yes, sizeof(yes)) < 0) {
471-
LOG_ERROR("setsockopt() failed\n");
472-
}
473-
474-
XMEMSET(&addr, 0, sizeof(addr));
475-
addr.sin_family = AF_INET;
476-
addr.sin_addr.s_addr = INADDR_ANY;
477-
addr.sin_port = htons(port);
478-
479-
if (bind(sockfd, (struct sockaddr*)&addr, sizeof(addr)) < 0) {
480-
LOG_ERROR("bind() failed\n");
481-
close(sockfd);
482-
return INVALID_SOCKET;
483-
}
484-
485-
if (listen(sockfd, 5) < 0) {
486-
LOG_ERROR("listen() failed\n");
487-
close(sockfd);
488-
return INVALID_SOCKET;
489-
}
490-
491-
return sockfd;
492-
}
493-
494450
/* Receive a complete HTTP request, looping until the full body arrives */
495451
static int RecvHttpRequest(SOCKET_T fd, byte* buf, int bufSz)
496452
{
@@ -688,9 +644,10 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
688644
opts.nrequests = 0;
689645
opts.verbose = 0;
690646
opts.sendCerts = 1;
647+
opts.readyFile = NULL;
691648

692649
/* Parse command line arguments */
693-
while ((ch = mygetopt_long(argc, argv, "?p:c:k:i:n:vx", long_options, 0)) != -1) {
650+
while ((ch = mygetopt_long(argc, argv, "?p:c:k:i:R:n:vx", long_options, 0)) != -1) {
694651
switch (ch) {
695652
case '?':
696653
Usage();
@@ -708,6 +665,9 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
708665
case 'i':
709666
opts.indexFile = myoptarg;
710667
break;
668+
case 'R':
669+
opts.readyFile = myoptarg;
670+
break;
711671
case 'n':
712672
opts.nrequests = atoi(myoptarg);
713673
break;
@@ -813,14 +773,23 @@ THREAD_RETURN WOLFSSL_THREAD ocsp_responder_test(void* args)
813773
}
814774
}
815775

816-
/* Create server socket */
817-
sockfd = CreateServerSocket(opts.port);
818-
if (sockfd == INVALID_SOCKET) {
819-
LOG_ERROR("Error creating server socket on port %d\n", opts.port);
820-
ret = -1;
821-
goto cleanup;
776+
/* Create and listen on server socket */
777+
tcp_listen(&sockfd, &opts.port, 1, 0, 0);
778+
779+
/* Write ready file if requested */
780+
if (opts.readyFile != NULL) {
781+
XFILE rf = XFOPEN(opts.readyFile, "w");
782+
if (rf != NULL) {
783+
fprintf(rf, "%d\n", (int)opts.port);
784+
fclose(rf);
785+
if (opts.verbose) {
786+
LOG_MSG("Ready file created: %s\n", opts.readyFile);
787+
}
788+
}
789+
else {
790+
LOG_ERROR("Warning: Failed to create ready file: %s\n", opts.readyFile);
791+
}
822792
}
823-
LOG_MSG("OCSP Responder listening on port %d\n", opts.port);
824793

825794
#ifndef _WIN32
826795
/* Install signal handlers for clean shutdown */

‎scripts/ocsp-responder-openssl-interop.test‎

Lines changed: 47 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ generate_port() {
7272

7373
resp_pids=""
7474
resp_logs=""
75+
ready_files=""
7576

7677
cleanup() {
7778
for p in $resp_pids; do
@@ -82,6 +83,10 @@ cleanup() {
8283
for log in $resp_logs; do
8384
rm -f "$log" 2>/dev/null
8485
done
86+
# Clean up ready files
87+
for rf in $ready_files; do
88+
rm -f "$rf" 2>/dev/null
89+
done
8590
}
8691
trap cleanup EXIT INT TERM
8792

@@ -101,6 +106,30 @@ print_responder_logs() {
101106
echo "----------------------"
102107
}
103108

109+
# wait_for_ready_file READY_FILE PID PORT
110+
wait_for_ready_file() {
111+
local ready_file="$1"
112+
local pid="$2"
113+
local port="$3"
114+
local counter=0
115+
116+
while [ ! -s "$ready_file" ] && [ "$counter" -lt 20 ]; do
117+
if ! kill -0 "$pid" 2>/dev/null; then
118+
echo "ERROR: Responder pid $pid for port $port exited before creating ready file" 1>&2
119+
print_responder_logs
120+
exit 1
121+
fi
122+
sleep 0.1
123+
counter=$((counter + 1))
124+
done
125+
126+
if [ ! -s "$ready_file" ]; then
127+
echo "ERROR: Ready file $ready_file not created after 2 seconds" 1>&2
128+
print_responder_logs
129+
exit 1
130+
fi
131+
}
132+
104133
# query_ocsp ISSUER_CERT CERT_TO_CHECK PORT EXPECTED_STATUS DESCRIPTION
105134
query_ocsp() {
106135
local issuer="$1"
@@ -148,7 +177,9 @@ query_ocsp() {
148177
generate_port; port1=$port
149178
log1=$(mktemp /tmp/ocsp_resp1.XXXXXX)
150179
resp_logs="$resp_logs $log1"
151-
$OCSP_RESPONDER -p $port1 -v \
180+
ready1=$(mktemp /tmp/ocsp_ready1.XXXXXX)
181+
ready_files="$ready_files $ready1"
182+
$OCSP_RESPONDER -p $port1 -v -R "$ready1" \
152183
-c $OCSP_DIR/intermediate1-ca-cert.pem \
153184
-k $OCSP_DIR/intermediate1-ca-key.pem \
154185
-i $OCSP_DIR/index-intermediate1-ca-issued-certs.txt \
@@ -160,7 +191,9 @@ resp_pids="$resp_pids $pid1"
160191
generate_port; port2=$port
161192
log2=$(mktemp /tmp/ocsp_resp2.XXXXXX)
162193
resp_logs="$resp_logs $log2"
163-
$OCSP_RESPONDER -p $port2 -v \
194+
ready2=$(mktemp /tmp/ocsp_ready2.XXXXXX)
195+
ready_files="$ready_files $ready2"
196+
$OCSP_RESPONDER -p $port2 -v -R "$ready2" \
164197
-c $OCSP_DIR/intermediate2-ca-cert.pem \
165198
-k $OCSP_DIR/intermediate2-ca-key.pem \
166199
-i $OCSP_DIR/index-intermediate2-ca-issued-certs.txt \
@@ -172,7 +205,9 @@ resp_pids="$resp_pids $pid2"
172205
generate_port; port3=$port
173206
log3=$(mktemp /tmp/ocsp_resp3.XXXXXX)
174207
resp_logs="$resp_logs $log3"
175-
$OCSP_RESPONDER -p $port3 -v \
208+
ready3=$(mktemp /tmp/ocsp_ready3.XXXXXX)
209+
ready_files="$ready_files $ready3"
210+
$OCSP_RESPONDER -p $port3 -v -R "$ready3" \
176211
-c $OCSP_DIR/intermediate3-ca-cert.pem \
177212
-k $OCSP_DIR/intermediate3-ca-key.pem \
178213
-i $OCSP_DIR/index-intermediate3-ca-issued-certs.txt \
@@ -184,7 +219,9 @@ resp_pids="$resp_pids $pid3"
184219
generate_port; port4=$port
185220
log4=$(mktemp /tmp/ocsp_resp4.XXXXXX)
186221
resp_logs="$resp_logs $log4"
187-
$OCSP_RESPONDER -p $port4 -v \
222+
ready4=$(mktemp /tmp/ocsp_ready4.XXXXXX)
223+
ready_files="$ready_files $ready4"
224+
$OCSP_RESPONDER -p $port4 -v -R "$ready4" \
188225
-c $OCSP_DIR/root-ca-cert.pem \
189226
-k $OCSP_DIR/root-ca-key.pem \
190227
-i $OCSP_DIR/index-ca-and-intermediate-cas.txt \
@@ -198,15 +235,13 @@ echo " Responder 2 (intermediate2-ca): port $port2, pid $pid2"
198235
echo " Responder 3 (intermediate3-ca): port $port3, pid $pid3"
199236
echo " Responder 4 (root-ca): port $port4, pid $pid4"
200237

201-
sleep 0.1
238+
# Wait for all responders to be ready
239+
wait_for_ready_file "$ready1" "$pid1" "$port1"
240+
wait_for_ready_file "$ready2" "$pid2" "$port2"
241+
wait_for_ready_file "$ready3" "$pid3" "$port3"
242+
wait_for_ready_file "$ready4" "$pid4" "$port4"
202243

203-
# Verify all responders are running
204-
for p in $resp_pids; do
205-
if ! kill -0 "$p" 2>/dev/null; then
206-
echo "FATAL: Responder pid $p failed to start" 1>&2
207-
exit 1
208-
fi
209-
done
244+
echo "All responders ready"
210245

211246
echo "All responders running."
212247
echo

‎scripts/ocsp-stapling-with-wolfssl-responder.test‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -141,11 +141,19 @@ ready_file2="$WORKSPACE"/wolf_ocsp_wr_readyF2$$
141141
ready_file3="$WORKSPACE"/wolf_ocsp_wr_readyF3$$
142142
ready_file4="$WORKSPACE"/wolf_ocsp_wr_readyF4$$
143143
ready_file5="$WORKSPACE"/wolf_ocsp_wr_readyF5$$
144+
ready_file_resp1="$WORKSPACE"/wolf_ocsp_resp_readyF1$$
145+
ready_file_resp2="$WORKSPACE"/wolf_ocsp_resp_readyF2$$
146+
ready_file_resp3="$WORKSPACE"/wolf_ocsp_resp_readyF3$$
147+
ready_file_resp4="$WORKSPACE"/wolf_ocsp_resp_readyF4$$
144148
printf '%s\n' "ready file 1: $ready_file1"
145149
printf '%s\n' "ready file 2: $ready_file2"
146150
printf '%s\n' "ready file 3: $ready_file3"
147151
printf '%s\n' "ready file 4: $ready_file4"
148152
printf '%s\n' "ready file 5: $ready_file5"
153+
printf '%s\n' "ready file resp 1: $ready_file_resp1"
154+
printf '%s\n' "ready file resp 2: $ready_file_resp2"
155+
printf '%s\n' "ready file resp 3: $ready_file_resp3"
156+
printf '%s\n' "ready file resp 4: $ready_file_resp4"
149157

150158
# Create temporary log files for responder output
151159
responder_log1=$(mktemp)
@@ -399,39 +407,42 @@ printf '%s\n' "-----------------------------------"
399407
./examples/client/client -p $port4
400408
create_new_cnf $port1 $port2 $port3 $port4
401409

402-
sleep 0.1
403-
404410
# Start wolfSSL OCSP responders (CA signs responses directly)
405411
printf '%s\n' "Starting wolfSSL OCSP responders..."
406412

407413
# Responder 1: intermediate1-ca (for server1, server2)
408-
$OCSP_RESPONDER -v -p $port1 \
414+
$OCSP_RESPONDER -v -p $port1 -R "$ready_file_resp1" \
409415
-i certs/ocsp/index-intermediate1-ca-issued-certs.txt \
410416
-c certs/ocsp/intermediate1-ca-cert.pem \
411417
-k certs/ocsp/intermediate1-ca-key.pem > "$responder_log1" 2>&1 &
418+
resp_pid1=$!
412419

413420
# Responder 2: intermediate2-ca (for server3, server4)
414-
$OCSP_RESPONDER -v -p $port2 \
421+
$OCSP_RESPONDER -v -p $port2 -R "$ready_file_resp2" \
415422
-i certs/ocsp/index-intermediate2-ca-issued-certs.txt \
416423
-c certs/ocsp/intermediate2-ca-cert.pem \
417424
-k certs/ocsp/intermediate2-ca-key.pem > "$responder_log2" 2>&1 &
425+
resp_pid2=$!
418426

419427
# Responder 3: intermediate3-ca (for server5)
420-
$OCSP_RESPONDER -v -p $port3 \
428+
$OCSP_RESPONDER -v -p $port3 -R "$ready_file_resp3" \
421429
-i certs/ocsp/index-intermediate3-ca-issued-certs.txt \
422430
-c certs/ocsp/intermediate3-ca-cert.pem \
423431
-k certs/ocsp/intermediate3-ca-key.pem > "$responder_log3" 2>&1 &
432+
resp_pid3=$!
424433

425434
# Responder 4: root-ca (for intermediate CA certs)
426-
$OCSP_RESPONDER -v -p $port4 \
435+
$OCSP_RESPONDER -v -p $port4 -R "$ready_file_resp4" \
427436
-i certs/ocsp/index-ca-and-intermediate-cas.txt \
428437
-c certs/ocsp/root-ca-cert.pem \
429438
-k certs/ocsp/root-ca-key.pem > "$responder_log4" 2>&1 &
439+
resp_pid4=$!
430440

431-
sleep 0.5
432-
# "jobs" is not portable for posix. Must use bash interpreter!
433-
[ $(jobs -r | wc -l) -ne 4 ] && \
434-
printf '\n\n%s\n' "Setup wolfSSL OCSP responders failed" && exit 1
441+
# Wait for all responders to be ready
442+
wait_for_readyFile "$ready_file_resp1" "$resp_pid1" "$port1"
443+
wait_for_readyFile "$ready_file_resp2" "$resp_pid2" "$port2"
444+
wait_for_readyFile "$ready_file_resp3" "$resp_pid3" "$port3"
445+
wait_for_readyFile "$ready_file_resp4" "$resp_pid4" "$port4"
435446

436447
printf '\n\n%s\n\n' "All wolfSSL OCSP responders started successfully!"
437448

0 commit comments

Comments
 (0)