Use wolfSSL's EmbedOcspLookup in non-blocking async OCSP example#604
Use wolfSSL's EmbedOcspLookup in non-blocking async OCSP example#604night1rider wants to merge 1 commit into
Conversation
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #604
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
c7c49f3 to
8d7c242
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #604
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
…OCSP responder URL into a system() call, replace that with wolfSSL's EmbedOcspLookup so the untrusted URL is fetched over a socket as data instead of being executed. Resolve the default server by hostname with getaddrinfo instead of a hard-coded IP so the example keeps connecting as the address changes.
8d7c242 to
4011953
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #604
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #604
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
3 participants
The callback built a curl command by interpolating the certificate's OCSP responder URL into a system() call, replace that with wolfSSL's EmbedOcspLookup so the untrusted URL is fetched over a socket as data instead of being executed.
Resolve the default server by hostname with getaddrinfo instead of a hard-coded IP so the example keeps connecting as the address changes.