Add WISeKey/SealSQ VaultIC secure element port #13274
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OCSP Test | |
| # START OF COMMON SECTION | |
| on: | |
| push: | |
| branches: [ 'release/**' ] | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| branches: [ '*' ] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # END OF COMMON SECTION | |
| jobs: | |
| ocsp_stapling: | |
| name: ocsp stapling | |
| if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout wolfSSL | |
| uses: actions/checkout@v5 | |
| - name: Build wolfSSL | |
| run: autoreconf -ivf && ./configure --enable-ocsp --enable-ocspstapling && make | |
| - name: Start OCSP responder 1 | |
| run: openssl ocsp -port 22221 -ndays 1000 -index certs/ocsp/index-intermediate1-ca-issued-certs.txt -rsigner certs/ocsp/ocsp-responder-int1-cert.pem -rkey certs/ocsp/ocsp-responder-int1-key.pem -CA certs/ocsp/intermediate1-ca-cert.pem & | |
| - name: Start OCSP responder 2 | |
| run: openssl ocsp -port 22220 -ndays 1000 -index certs/ocsp/index-ca-and-intermediate-cas.txt -rsigner certs/ocsp/ocsp-responder-cert.pem -rkey certs/ocsp/ocsp-responder-key.pem -CA certs/ocsp/root-ca-cert.pem & | |
| - name: Start TLS server | |
| run: ./examples/server/server -p 11111 -c ./certs/ocsp/server1-cert.pem -k ./certs/ocsp/server1-key.pem -d & | |
| - name: Test Look Up | |
| run: ./examples/client/client -A ./certs/ocsp/root-ca-cert.pem -o | |
| ocsp_ssrf_screen: | |
| name: ocsp responder SSRF screening | |
| if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout wolfSSL | |
| uses: actions/checkout@v5 | |
| # Build with the opt-in OCSP responder destination screening enabled | |
| # (WOLFSSL_OCSP_SCREEN_RESPONDER). This guards against a certificate AIA | |
| # OCSP URL driving an outbound request to an internal address (SSRF, | |
| # CWE-918). The screening is off by default, so it is not exercised by | |
| # the ocsp_stapling job above (which uses localhost responders). | |
| - name: Build wolfSSL with OCSP responder screening enabled | |
| run: autoreconf -ivf && ./configure --enable-ocsp CPPFLAGS=-DWOLFSSL_OCSP_SCREEN_RESPONDER && make | |
| # Run only the boundary unit test, not the localhost OCSP test scripts: | |
| # with screening on, 127.0.0.1 responders are (correctly) rejected, so | |
| # the stapling scripts do not apply to this build. Assert the test | |
| # actually ran (passed) rather than being compiled out and skipped, so a | |
| # future build-define change cannot turn this into a false-green signal. | |
| - name: Run OCSP destination screening boundary tests | |
| run: | | |
| ./tests/unit.test -test_wolfIO_OcspDestAllowed | tee out.txt | |
| grep -Eq 'test_wolfIO_OcspDestAllowed[^_].*: passed' out.txt | |
| ocsp_ssrf_screen_fallback: | |
| name: ocsp responder SSRF screening (gethostbyname fallback) | |
| if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout wolfSSL | |
| uses: actions/checkout@v5 | |
| # Force the gethostbyname() resolver fallback (ac_cv_func_getaddrinfo=no) | |
| # so the otherwise-untested fallback path of wolfIO_OcspDestAllowed is | |
| # exercised. The fallback is IPv4-only and relies on glibc parsing | |
| # numeric IPv4 literals locally. | |
| - name: Build wolfSSL forcing the gethostbyname resolver fallback | |
| run: autoreconf -ivf && ./configure --enable-ocsp ac_cv_func_getaddrinfo=no CPPFLAGS=-DWOLFSSL_OCSP_SCREEN_RESPONDER && make | |
| - name: Run OCSP destination screening fallback boundary tests | |
| run: | | |
| ./tests/unit.test -test_wolfIO_OcspDestAllowed_fallback | tee out.txt | |
| grep -Eq 'test_wolfIO_OcspDestAllowed_fallback.*: passed' out.txt |