Merge GH #1470 Use soft fail for OCSP

2 files changed, 69 insertions, 1 deletions

diff --git a/src/tests/test_ocsp.cpp b/src/tests/test_ocsp.cpp
index dc3c6f47e..4b344891e 100644
--- a/src/tests/test_ocsp.cpp
+++ b/src/tests/test_ocsp.cpp
@@ -11,6 +11,7 @@
    #include <botan/x509path.h>
    #include <botan/certstor.h>
    #include <botan/calendar.h>
+   #include <botan/cert_status.h>   
    #include <fstream>
 #endif
 
@@ -153,6 +154,37 @@ class OCSP_Tests final : public Test
          return result;
          }
 
+      Test::Result test_response_verification_softfail()
+         {
+         Test::Result result("OCSP request softfail check");
+
+         std::shared_ptr<const Botan::X509_Certificate> ee = load_test_X509_cert("x509/ocsp/randombit.pem");
+         std::shared_ptr<const Botan::X509_Certificate> ca = load_test_X509_cert("x509/ocsp/letsencrypt.pem");
+         std::shared_ptr<const Botan::X509_Certificate> trust_root = load_test_X509_cert("x509/ocsp/geotrust.pem");
+
+         const std::vector<std::shared_ptr<const Botan::X509_Certificate>> cert_path = { ee, ca, trust_root };
+
+         std::shared_ptr<const Botan::OCSP::Response> ocsp = 
+            std::make_shared<const Botan::OCSP::Response>(Botan::Certificate_Status_Code::OSCP_NO_REVOCATION_URL);
+
+         Botan::Certificate_Store_In_Memory certstore;
+         certstore.add_certificate(trust_root);
+
+         // Some arbitrary time within the validity period of the test certs
+         const auto valid_time = Botan::calendar_point(2016, 11, 20, 8, 30, 0).to_std_timepoint();
+         const auto ocsp_status = Botan::PKIX::check_ocsp(cert_path, { ocsp }, { &certstore }, valid_time);
+
+         if(result.test_eq("Expected size of ocsp_status", ocsp_status.size(), 1))
+            {
+            if(result.test_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1))
+               {               
+               result.confirm("Status warning", ocsp_status[0].count(Botan::Certificate_Status_Code::OSCP_NO_REVOCATION_URL));
+               }
+            }
+
+         return result;
+         }
+
 #if defined(BOTAN_HAS_ONLINE_REVOCATION_CHECKS)
       Test::Result test_online_request()
          {
@@ -193,6 +225,7 @@ class OCSP_Tests final : public Test
          results.push_back(test_response_parsing());
          results.push_back(test_response_certificate_access());
          results.push_back(test_response_verification());
+         results.push_back(test_response_verification_softfail());
 
 #if defined(BOTAN_HAS_ONLINE_REVOCATION_CHECKS)
          if(Test::run_online_tests())
diff --git a/src/tests/test_x509_path.cpp b/src/tests/test_x509_path.cpp
index 7a9ff97bc..db74d6208 100644
--- a/src/tests/test_x509_path.cpp
+++ b/src/tests/test_x509_path.cpp
@@ -113,11 +113,46 @@ class X509test_Path_Validation_Tests final : public Test
 
             result.test_eq("test " + filename, path_result.result_string(), expected_result);
             result.test_eq("test no warnings string", path_result.warnings_string(), "");
-            result.confirm("test no warnings", path_result.no_warnings() == true);
+            result.confirm("test no warnings", path_result.no_warnings());
             result.end_timer();
             results.push_back(result);
             }
 
+         // test softfail
+            {
+            Test::Result result("X509test path validation softfail");
+            result.start_timer();
+
+            // this certificate must not have a OCSP URL
+            const std::string filename = "ValidAltName.pem";
+            std::vector<Botan::X509_Certificate> certs =
+               load_cert_file(Test::data_file("x509/x509test/" + filename));
+            if(certs.empty())
+               {
+               throw Test_Error("Failed to read certs from " + filename);
+               }
+
+            Botan::Path_Validation_Result path_result = Botan::x509_path_validate(
+                     certs, restrictions, trusted,
+                     "www.tls.test", Botan::Usage_Type::TLS_SERVER_AUTH,
+                     validation_time, 
+                     /* activate check_ocsp_online */ std::chrono::milliseconds(1000), {});
+
+            if(path_result.successful_validation() && path_result.trust_root() != root)
+               {
+               path_result = Botan::Path_Validation_Result(Botan::Certificate_Status_Code::CANNOT_ESTABLISH_TRUST);
+               }
+
+            // certificate verification succeed even if no OCSP URL (softfail)
+            result.confirm("test success", path_result.successful_validation());
+            result.test_eq("test " + filename, path_result.result_string(), "Verified");
+            // if softfail, there is warnings
+            result.confirm("test warnings", !path_result.no_warnings());
+            result.test_eq("test warnings string", path_result.warnings_string(), "[0] OCSP URL not available");
+            result.end_timer();
+            results.push_back(result);  
+            }
+
          return results;
          }