• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

randombit / botan / 23225340130

18 Mar 2026 01:53AM UTC coverage: 89.677% (-0.001%) from 89.678%
23225340130

push

github

web-flow
Merge pull request #5456 from randombit/jack/clang-tidy-22

Fix various warnings from clang-tidy 22

104438 of 116460 relevant lines covered (89.68%)

11819947.55 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

97.67
/src/tests/test_ocsp.cpp
1
/*
2
* (C) 2016 Jack Lloyd
3
* (C) 2022 René Meusel, Rohde & Schwarz Cybersecurity
4
*
5
* Botan is released under the Simplified BSD License (see license.txt)
6
*/
7

8
#include "tests.h"
9

10
#if defined(BOTAN_HAS_OCSP)
11
   #include "test_arb_eq.h"
12
   #include <botan/certstor.h>
13
   #include <botan/ocsp.h>
14
   #include <botan/x509path.h>
15
   #include <botan/internal/calendar.h>
16
#endif
17

18
namespace Botan_Tests {
19

20
namespace {
21

22
#if defined(BOTAN_HAS_OCSP) && defined(BOTAN_HAS_RSA) && defined(BOTAN_HAS_EMSA_PKCS1) && \
23
   defined(BOTAN_TARGET_OS_HAS_FILESYSTEM)
24

25
class OCSP_Tests final : public Test {
1✔
26
   private:
27
      static Botan::X509_Certificate load_test_X509_cert(const std::string& path) {
26✔
28
         return Botan::X509_Certificate(Test::data_file(path));
52✔
29
      }
30

31
      static Botan::OCSP::Response load_test_OCSP_resp(const std::string& path) {
10✔
32
         return Botan::OCSP::Response(Test::read_binary_data_file(path));
30✔
33
      }
34

35
      static Test::Result test_response_parsing() {
1✔
36
         Test::Result result("OCSP response parsing");
1✔
37

38
         // Simple parsing tests
39
         const std::vector<std::string> ocsp_input_paths = {
1✔
40
            "x509/ocsp/resp1.der", "x509/ocsp/resp2.der", "x509/ocsp/resp3.der"};
1✔
41

42
         for(const std::string& ocsp_input_path : ocsp_input_paths) {
4✔
43
            try {
3✔
44
               const Botan::OCSP::Response resp(Test::read_binary_data_file(ocsp_input_path));
6✔
45
               result.test_enum_eq(
6✔
46
                  "parsing was successful", resp.status(), Botan::OCSP::Response_Status_Code::Successful);
3✔
47
               result.test_success("Parsed input " + ocsp_input_path);
3✔
48
            } catch(Botan::Exception& e) {
3✔
49
               result.test_failure("Parsing failed", e.what());
×
50
            }
×
51
         }
52

53
         const Botan::OCSP::Response resp(
1✔
54
            Test::read_binary_data_file("x509/ocsp/patrickschmidt_ocsp_try_later_wrong_sig.der"));
3✔
55
         result.test_enum_eq(
2✔
56
            "parsing exposes correct status code", resp.status(), Botan::OCSP::Response_Status_Code::Try_Later);
1✔
57

58
         return result;
1✔
59
      }
1✔
60

61
      static Test::Result test_response_certificate_access() {
1✔
62
         Test::Result result("OCSP response certificate access");
1✔
63

64
         try {
1✔
65
            const Botan::OCSP::Response resp1(Test::read_binary_data_file("x509/ocsp/resp1.der"));
3✔
66
            const auto& certs1 = resp1.certificates();
1✔
67
            if(result.test_sz_eq("Expected count of certificates", certs1.size(), 1)) {
1✔
68
               const auto& cert = certs1.front();
1✔
69
               const Botan::X509_DN expected_dn(
1✔
70
                  {std::make_pair("X520.CommonName", "Symantec Class 3 EV SSL CA - G3 OCSP Responder")});
1✔
71
               const bool matches = cert.subject_dn() == expected_dn;
1✔
72
               result.test_is_true("CN matches expected", matches);
1✔
73
            }
1✔
74

75
            const Botan::OCSP::Response resp2(Test::read_binary_data_file("x509/ocsp/resp2.der"));
3✔
76
            const auto& certs2 = resp2.certificates();
1✔
77
            result.test_sz_eq("Expect no certificates", certs2.size(), 0);
1✔
78
         } catch(Botan::Exception& e) {
1✔
79
            result.test_failure("Parsing failed", e.what());
×
80
         }
×
81

82
         return result;
1✔
83
      }
×
84

85
      static Test::Result test_request_encoding() {
1✔
86
         Test::Result result("OCSP request encoding");
1✔
87

88
         const Botan::X509_Certificate end_entity(Test::data_file("x509/ocsp/gmail.pem"));
2✔
89
         const Botan::X509_Certificate issuer(Test::data_file("x509/ocsp/google_g2.pem"));
2✔
90

91
         try {
1✔
92
            const Botan::OCSP::Request bogus(end_entity, issuer);
1✔
93
            result.test_failure("Bad arguments (swapped end entity, issuer) accepted");
×
94
         } catch(Botan::Invalid_Argument&) {
1✔
95
            result.test_success("Bad arguments rejected");
1✔
96
         }
1✔
97

98
         const std::string expected_request =
1✔
99
            "ME4wTKADAgEAMEUwQzBBMAkGBSsOAwIaBQAEFPLgavmFih2NcJtJGSN6qbUaKH5kBBRK3QYWG7z2aLV29YG2u2IaulqBLwIIQkg+DF+RYMY=";
1✔
100

101
         const Botan::OCSP::Request req1(issuer, end_entity);
1✔
102
         result.test_str_eq("Encoded OCSP request", req1.base64_encode(), expected_request);
1✔
103

104
         const Botan::OCSP::Request req2(issuer, BigInt::from_bytes(end_entity.serial_number()));
1✔
105
         result.test_str_eq("Encoded OCSP request", req2.base64_encode(), expected_request);
1✔
106

107
         return result;
2✔
108
      }
2✔
109

110
      static Test::Result test_response_find_signing_certificate() {
1✔
111
         Test::Result result("OCSP response finding signature certificates");
1✔
112

113
         // OCSP response is signed by the issuing CA itself
114
         auto randombit_ocsp = load_test_OCSP_resp("x509/ocsp/randombit_ocsp.der");
1✔
115
         auto randombit_ca = load_test_X509_cert("x509/ocsp/letsencrypt.pem");
1✔
116

117
         // OCSP response is signed by an authorized responder certificate
118
         // issued by the issuing CA and embedded in the response
119
         auto bdr_ocsp = load_test_OCSP_resp("x509/ocsp/bdr-ocsp-resp.der");
1✔
120
         auto bdr_responder = load_test_X509_cert("x509/ocsp/bdr-ocsp-responder.pem");
1✔
121
         auto bdr_ca = load_test_X509_cert("x509/ocsp/bdr-int.pem");
1✔
122

123
         // The response in bdr_ocsp contains two certificates
124
         if(result.test_sz_eq("both certificates found", bdr_ocsp.certificates().size(), 2)) {
1✔
125
            result.test_str_eq("first cert in response",
2✔
126
                               bdr_ocsp.certificates()[0].subject_info("X520.CommonName").at(0),
2✔
127
                               "D-TRUST OCSP 4 2-2 EV 2016");
128
            result.test_str_eq("second cert in response",
2✔
129
                               bdr_ocsp.certificates()[1].subject_info("X520.CommonName").at(0),
2✔
130
                               "D-TRUST CA 2-2 EV 2016");
131
         }
132

133
         // Dummy OCSP response is not signed at all
134
         auto dummy_ocsp = Botan::OCSP::Response(Botan::Certificate_Status_Code::OCSP_SERVER_NOT_AVAILABLE);
1✔
135

136
         // OCSP response is signed by 3rd party responder certificate that is
137
         // not included in the OCSP response itself
138
         // See `src/scripts/randombit_ocsp_forger.sh` for a helper script to recreate those.
139
         auto randombit_alt_resp_ocsp = load_test_OCSP_resp("x509/ocsp/randombit_ocsp_forged_valid_nocerts.der");
1✔
140
         auto randombit_alt_resp_cert = load_test_X509_cert("x509/ocsp/randombit_ocsp_forged_responder.pem");
1✔
141

142
         result.test_opt_is_null("Dummy has no signing certificate",
1✔
143
                                 dummy_ocsp.find_signing_certificate(Botan::X509_Certificate()));
2✔
144

145
         test_arb_eq(result,
2✔
146
                     "CA is returned as signing certificate",
147
                     randombit_ocsp.find_signing_certificate(randombit_ca),
1✔
148
                     std::optional(randombit_ca));
1✔
149
         result.test_opt_is_null("No signer certificate is returned when signer couldn't be determined",
1✔
150
                                 randombit_ocsp.find_signing_certificate(bdr_ca));
1✔
151

152
         test_arb_eq(result,
2✔
153
                     "Delegated responder certificate is returned for further validation",
154
                     bdr_ocsp.find_signing_certificate(bdr_ca),
1✔
155
                     std::optional(bdr_responder));
1✔
156

157
         result.test_opt_is_null(
1✔
158
            "Delegated responder without stapled certs does not find signer without user-provided certs",
159
            randombit_alt_resp_ocsp.find_signing_certificate(randombit_ca));
1✔
160

161
         auto trusted_responders = std::make_unique<Botan::Certificate_Store_In_Memory>(randombit_alt_resp_cert);
1✔
162
         test_arb_eq(result,
2✔
163
                     "Delegated responder returns user-provided cert",
164
                     randombit_alt_resp_ocsp.find_signing_certificate(randombit_ca, trusted_responders.get()),
2✔
165
                     std::optional(randombit_alt_resp_cert));
1✔
166

167
         return result;
1✔
168
      }
1✔
169

170
      static Test::Result test_response_verification_with_next_update_without_max_age() {
1✔
171
         Test::Result result("OCSP request check with next_update w/o max_age");
1✔
172

173
         auto ee = load_test_X509_cert("x509/ocsp/randombit.pem");
1✔
174
         auto ca = load_test_X509_cert("x509/ocsp/letsencrypt.pem");
1✔
175
         auto trust_root = load_test_X509_cert("x509/ocsp/geotrust.pem");
1✔
176

177
         const std::vector<Botan::X509_Certificate> cert_path = {ee, ca, trust_root};
4✔
178

179
         auto ocsp = load_test_OCSP_resp("x509/ocsp/randombit_ocsp.der");
1✔
180

181
         Botan::Certificate_Store_In_Memory certstore;
1✔
182
         certstore.add_certificate(trust_root);
1✔
183

184
         auto check_ocsp = [&](const std::chrono::system_clock::time_point valid_time,
5✔
185
                               const Botan::Certificate_Status_Code expected) {
186
            const auto ocsp_status = Botan::PKIX::check_ocsp(
8✔
187
               cert_path, {ocsp}, {&certstore}, valid_time, Botan::Path_Validation_Restrictions());
16✔
188

189
            return result.test_sz_eq("Expected size of ocsp_status", ocsp_status.size(), 1) &&
8✔
190
                   result.test_sz_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1) &&
4✔
191
                   result.test_is_true(std::string("Status: '") + Botan::to_string(expected) + "'",
28✔
192
                                       ocsp_status[0].contains(expected));
12✔
193
         };
8✔
194

195
         check_ocsp(Botan::calendar_point(2016, 11, 11, 12, 30, 0).to_std_timepoint(),
1✔
196
                    Botan::Certificate_Status_Code::OCSP_NOT_YET_VALID);
197
         check_ocsp(Botan::calendar_point(2016, 11, 18, 12, 30, 0).to_std_timepoint(),
1✔
198
                    Botan::Certificate_Status_Code::OCSP_RESPONSE_GOOD);
199
         check_ocsp(Botan::calendar_point(2016, 11, 20, 8, 30, 0).to_std_timepoint(),
1✔
200
                    Botan::Certificate_Status_Code::OCSP_RESPONSE_GOOD);
201
         check_ocsp(Botan::calendar_point(2016, 11, 28, 8, 30, 0).to_std_timepoint(),
1✔
202
                    Botan::Certificate_Status_Code::OCSP_HAS_EXPIRED);
203

204
         return result;
1✔
205
      }
2✔
206

207
      static Test::Result test_response_verification_with_next_update_with_max_age() {
1✔
208
         Test::Result result("OCSP request check with next_update with max_age");
1✔
209

210
         auto ee = load_test_X509_cert("x509/ocsp/randombit.pem");
1✔
211
         auto ca = load_test_X509_cert("x509/ocsp/letsencrypt.pem");
1✔
212
         auto trust_root = load_test_X509_cert("x509/ocsp/geotrust.pem");
1✔
213

214
         const std::vector<Botan::X509_Certificate> cert_path = {ee, ca, trust_root};
4✔
215

216
         auto ocsp = load_test_OCSP_resp("x509/ocsp/randombit_ocsp.der");
1✔
217

218
         Botan::Certificate_Store_In_Memory certstore;
1✔
219
         certstore.add_certificate(trust_root);
1✔
220

221
         // Some arbitrary time within the validity period of the test certs
222
         const auto max_age = std::chrono::minutes(59);
1✔
223

224
         auto check_ocsp = [&](const std::chrono::system_clock::time_point valid_time,
5✔
225
                               const Botan::Certificate_Status_Code expected) {
226
            const Botan::Path_Validation_Restrictions pvr(false, 110, false, max_age);
4✔
227
            const auto ocsp_status = Botan::PKIX::check_ocsp(cert_path, {ocsp}, {&certstore}, valid_time, pvr);
12✔
228

229
            return result.test_sz_eq("Expected size of ocsp_status", ocsp_status.size(), 1) &&
8✔
230
                   result.test_sz_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1) &&
4✔
231
                   result.test_is_true(std::string("Status: '") + Botan::to_string(expected) + "'",
28✔
232
                                       ocsp_status[0].contains(expected));
12✔
233
         };
8✔
234

235
         check_ocsp(Botan::calendar_point(2016, 11, 11, 12, 30, 0).to_std_timepoint(),
1✔
236
                    Botan::Certificate_Status_Code::OCSP_NOT_YET_VALID);
237
         check_ocsp(Botan::calendar_point(2016, 11, 18, 12, 30, 0).to_std_timepoint(),
1✔
238
                    Botan::Certificate_Status_Code::OCSP_RESPONSE_GOOD);
239
         check_ocsp(Botan::calendar_point(2016, 11, 20, 8, 30, 0).to_std_timepoint(),
1✔
240
                    Botan::Certificate_Status_Code::OCSP_RESPONSE_GOOD);
241
         check_ocsp(Botan::calendar_point(2016, 11, 28, 8, 30, 0).to_std_timepoint(),
1✔
242
                    Botan::Certificate_Status_Code::OCSP_HAS_EXPIRED);
243

244
         return result;
1✔
245
      }
2✔
246

247
      static Test::Result test_response_verification_without_next_update_with_max_age() {
1✔
248
         Test::Result result("OCSP request check w/o next_update with max_age");
1✔
249

250
         auto ee = load_test_X509_cert("x509/ocsp/patrickschmidt.pem");
1✔
251
         auto ca = load_test_X509_cert("x509/ocsp/bdrive_encryption.pem");
1✔
252
         auto trust_root = load_test_X509_cert("x509/ocsp/bdrive_root.pem");
1✔
253

254
         const std::vector<Botan::X509_Certificate> cert_path = {ee, ca, trust_root};
4✔
255

256
         auto ocsp = load_test_OCSP_resp("x509/ocsp/patrickschmidt_ocsp.der");
1✔
257

258
         Botan::Certificate_Store_In_Memory certstore;
1✔
259
         certstore.add_certificate(trust_root);
1✔
260

261
         // Some arbitrary time within the validity period of the test certs
262
         const auto max_age = std::chrono::minutes(59);
1✔
263

264
         auto check_ocsp = [&](const std::chrono::system_clock::time_point valid_time,
4✔
265
                               const Botan::Certificate_Status_Code expected) {
266
            const Botan::Path_Validation_Restrictions pvr(false, 110, false, max_age);
3✔
267
            const auto ocsp_status = Botan::PKIX::check_ocsp(cert_path, {ocsp}, {&certstore}, valid_time, pvr);
9✔
268

269
            return result.test_sz_eq("Expected size of ocsp_status", ocsp_status.size(), 1) &&
6✔
270
                   result.test_sz_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1) &&
3✔
271
                   result.test_is_true(std::string("Status: '") + Botan::to_string(expected) + "'",
21✔
272
                                       ocsp_status[0].contains(expected));
9✔
273
         };
6✔
274

275
         check_ocsp(Botan::calendar_point(2019, 5, 28, 7, 0, 0).to_std_timepoint(),
1✔
276
                    Botan::Certificate_Status_Code::OCSP_NOT_YET_VALID);
277
         check_ocsp(Botan::calendar_point(2019, 5, 28, 7, 30, 0).to_std_timepoint(),
1✔
278
                    Botan::Certificate_Status_Code::OCSP_RESPONSE_GOOD);
279
         check_ocsp(Botan::calendar_point(2019, 5, 28, 8, 0, 0).to_std_timepoint(),
1✔
280
                    Botan::Certificate_Status_Code::OCSP_IS_TOO_OLD);
281

282
         return result;
1✔
283
      }
2✔
284

285
      static Test::Result test_response_verification_without_next_update_without_max_age() {
1✔
286
         Test::Result result("OCSP request check w/o next_update w/o max_age");
1✔
287

288
         auto ee = load_test_X509_cert("x509/ocsp/patrickschmidt.pem");
1✔
289
         auto ca = load_test_X509_cert("x509/ocsp/bdrive_encryption.pem");
1✔
290
         auto trust_root = load_test_X509_cert("x509/ocsp/bdrive_root.pem");
1✔
291

292
         const std::vector<Botan::X509_Certificate> cert_path = {ee, ca, trust_root};
4✔
293

294
         auto ocsp = load_test_OCSP_resp("x509/ocsp/patrickschmidt_ocsp.der");
1✔
295

296
         Botan::Certificate_Store_In_Memory certstore;
1✔
297
         certstore.add_certificate(trust_root);
1✔
298

299
         auto check_ocsp = [&](const std::chrono::system_clock::time_point valid_time,
4✔
300
                               const Botan::Certificate_Status_Code expected) {
301
            const auto ocsp_status = Botan::PKIX::check_ocsp(
6✔
302
               cert_path, {ocsp}, {&certstore}, valid_time, Botan::Path_Validation_Restrictions());
12✔
303

304
            return result.test_sz_eq("Expected size of ocsp_status", ocsp_status.size(), 1) &&
6✔
305
                   result.test_sz_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1) &&
3✔
306
                   result.test_is_true(std::string("Status: '") + Botan::to_string(expected) + "'",
21✔
307
                                       ocsp_status[0].contains(expected));
9✔
308
         };
6✔
309

310
         check_ocsp(Botan::calendar_point(2019, 5, 28, 7, 0, 0).to_std_timepoint(),
1✔
311
                    Botan::Certificate_Status_Code::OCSP_NOT_YET_VALID);
312
         check_ocsp(Botan::calendar_point(2019, 5, 28, 7, 30, 0).to_std_timepoint(),
1✔
313
                    Botan::Certificate_Status_Code::OCSP_RESPONSE_GOOD);
314
         check_ocsp(Botan::calendar_point(2019, 5, 28, 8, 0, 0).to_std_timepoint(),
1✔
315
                    Botan::Certificate_Status_Code::OCSP_RESPONSE_GOOD);
316

317
         return result;
1✔
318
      }
2✔
319

320
      static Test::Result test_response_verification_softfail() {
1✔
321
         Test::Result result("OCSP request softfail check");
1✔
322

323
         auto ee = load_test_X509_cert("x509/ocsp/randombit.pem");
1✔
324
         auto ca = load_test_X509_cert("x509/ocsp/letsencrypt.pem");
1✔
325
         auto trust_root = load_test_X509_cert("x509/ocsp/geotrust.pem");
1✔
326

327
         const std::vector<Botan::X509_Certificate> cert_path = {ee, ca, trust_root};
4✔
328

329
         Botan::OCSP::Response ocsp(Botan::Certificate_Status_Code::OCSP_NO_REVOCATION_URL);
1✔
330

331
         Botan::Certificate_Store_In_Memory certstore;
1✔
332
         certstore.add_certificate(trust_root);
1✔
333

334
         // Some arbitrary time within the validity period of the test certs
335
         const auto valid_time = Botan::calendar_point(2016, 11, 20, 8, 30, 0).to_std_timepoint();
1✔
336
         const auto ocsp_status =
1✔
337
            Botan::PKIX::check_ocsp(cert_path, {ocsp}, {&certstore}, valid_time, Botan::Path_Validation_Restrictions());
4✔
338

339
         if(result.test_sz_eq("Expected size of ocsp_status", ocsp_status.size(), 1)) {
1✔
340
            if(result.test_sz_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1)) {
1✔
341
               result.test_sz_gt(
2✔
342
                  "Status warning", ocsp_status[0].count(Botan::Certificate_Status_Code::OCSP_NO_REVOCATION_URL), 0);
1✔
343
            }
344
         }
345

346
         return result;
1✔
347
      }
3✔
348

349
   #if defined(BOTAN_HAS_ONLINE_REVOCATION_CHECKS)
350
      static Test::Result test_online_request() {
1✔
351
         Test::Result result("OCSP online check");
1✔
352

353
         auto cert = load_test_X509_cert("x509/ocsp/digicert-ecdsa-int.pem");
1✔
354
         auto trust_root = load_test_X509_cert("x509/ocsp/digicert-root.pem");
1✔
355

356
         const std::vector<Botan::X509_Certificate> cert_path = {cert, trust_root};
3✔
357

358
         Botan::Certificate_Store_In_Memory certstore;
1✔
359
         certstore.add_certificate(trust_root);
1✔
360

361
         const auto ocsp_timeout = std::chrono::milliseconds(3000);
1✔
362
         const auto now = std::chrono::system_clock::now();
1✔
363
         auto ocsp_status = Botan::PKIX::check_ocsp_online(
1✔
364
            cert_path, {&certstore}, now, ocsp_timeout, Botan::Path_Validation_Restrictions());
2✔
365

366
         if(result.test_sz_eq("Expected size of ocsp_status", ocsp_status.size(), 1)) {
1✔
367
            if(result.test_sz_eq("Expected size of ocsp_status[0]", ocsp_status[0].size(), 1)) {
1✔
368
               const bool status_good = ocsp_status[0].contains(Botan::Certificate_Status_Code::OCSP_RESPONSE_GOOD);
1✔
369
               const bool server_not_found =
1✔
370
                  ocsp_status[0].contains(Botan::Certificate_Status_Code::OCSP_SERVER_NOT_AVAILABLE);
1✔
371
               result.test_is_true("Expected status", status_good || server_not_found);
1✔
372
            }
373
         }
374

375
         return result;
1✔
376
      }
2✔
377
   #endif
378

379
      static Test::Result test_response_verification_with_additionally_trusted_responder() {
1✔
380
         Test::Result result("OCSP response with user-defined (additional) responder certificate");
1✔
381

382
         // OCSP response is signed by 3rd party responder certificate that is
383
         // not included in the OCSP response itself
384
         // See `src/scripts/randombit_ocsp_forger.sh` for a helper script to recreate those.
385
         auto ocsp = load_test_OCSP_resp("x509/ocsp/randombit_ocsp_forged_valid_nocerts.der");
1✔
386
         auto responder = load_test_X509_cert("x509/ocsp/randombit_ocsp_forged_responder.pem");
1✔
387
         auto ca = load_test_X509_cert("x509/ocsp/letsencrypt.pem");
1✔
388

389
         Botan::Certificate_Store_In_Memory trusted_responders;
1✔
390

391
         // without providing the 3rd party responder certificate no issuer will be found
392
         result.test_opt_is_null("cannot find signing certificate without trusted responders",
1✔
393
                                 ocsp.find_signing_certificate(ca));
1✔
394
         result.test_opt_is_null("cannot find signing certificate without additional help",
1✔
395
                                 ocsp.find_signing_certificate(ca, &trusted_responders));
1✔
396

397
         // add the 3rd party responder certificate to the list of trusted OCSP responder certs
398
         // to find the issuer certificate of this response
399
         trusted_responders.add_certificate(responder);
1✔
400
         test_arb_eq(result,
2✔
401
                     "the responder certificate is returned when it is trusted",
402
                     ocsp.find_signing_certificate(ca, &trusted_responders),
1✔
403
                     std::optional(responder));
1✔
404

405
         result.test_enum_eq("the responder's signature checks out",
1✔
406
                             ocsp.verify_signature(responder),
1✔
407
                             Botan::Certificate_Status_Code::OCSP_SIGNATURE_OK);
408

409
         return result;
1✔
410
      }
1✔
411

412
      static Test::Result test_forged_ocsp_signature_is_rejected() {
1✔
413
         Test::Result result("OCSP response with forged signature is rejected by path validation");
1✔
414

415
         auto ee = load_test_X509_cert("x509/ocsp/randombit.pem");
1✔
416
         auto ca = load_test_X509_cert("x509/ocsp/letsencrypt.pem");
1✔
417
         auto trust_root = load_test_X509_cert("x509/ocsp/geotrust.pem");
1✔
418

419
         const std::vector<Botan::X509_Certificate> cert_path = {ee, ca, trust_root};
4✔
420

421
         Botan::Certificate_Store_In_Memory certstore;
1✔
422
         certstore.add_certificate(trust_root);
1✔
423

424
         const auto valid_time = Botan::calendar_point(2016, 11, 18, 12, 30, 0).to_std_timepoint();
1✔
425

426
         // Verify the unmodified response is accepted
427
         {
1✔
428
            auto ocsp = load_test_OCSP_resp("x509/ocsp/randombit_ocsp.der");
1✔
429
            const auto ocsp_status = Botan::PKIX::check_ocsp(
2✔
430
               cert_path, {ocsp}, {&certstore}, valid_time, Botan::Path_Validation_Restrictions());
4✔
431

432
            if(result.test_sz_eq("Legitimate: expected result count", ocsp_status.size(), 1) &&
2✔
433
               result.test_sz_eq("Legitimate: expected status count", ocsp_status[0].size(), 1)) {
1✔
434
               result.test_is_true("Legitimate response is accepted",
2✔
435
                                   ocsp_status[0].contains(Botan::Certificate_Status_Code::OCSP_RESPONSE_GOOD));
2✔
436
            }
437
         }
1✔
438

439
         // Tamper with the signature and verify check_ocsp rejects it
440
         {
1✔
441
            auto ocsp_bytes = Test::read_binary_data_file("x509/ocsp/randombit_ocsp.der");
1✔
442
            ocsp_bytes.back() ^= 0x01;
1✔
443
            Botan::OCSP::Response forged_ocsp(ocsp_bytes.data(), ocsp_bytes.size());
1✔
444

445
            const auto ocsp_status = Botan::PKIX::check_ocsp(
2✔
446
               cert_path, {forged_ocsp}, {&certstore}, valid_time, Botan::Path_Validation_Restrictions());
4✔
447

448
            if(result.test_sz_eq("Forged: expected result count", ocsp_status.size(), 1) &&
2✔
449
               result.test_sz_eq("Forged: expected status count", ocsp_status[0].size(), 1)) {
1✔
450
               result.test_is_true("Forged signature is rejected",
2✔
451
                                   ocsp_status[0].contains(Botan::Certificate_Status_Code::OCSP_SIGNATURE_ERROR));
2✔
452
            }
453
         }
1✔
454

455
         return result;
1✔
456
      }
4✔
457

458
      static Test::Result test_responder_cert_with_nocheck_extension() {
1✔
459
         Test::Result result("BDr's OCSP response contains certificate featuring NoCheck extension");
1✔
460

461
         auto ocsp = load_test_OCSP_resp("x509/ocsp/bdr-ocsp-resp.der");
1✔
462
         const bool contains_cert_with_nocheck =
1✔
463
            std::find_if(ocsp.certificates().cbegin(), ocsp.certificates().cend(), [](const auto& cert) {
1✔
464
               return cert.v3_extensions().extension_set(Botan::OID::from_string("PKIX.OCSP.NoCheck"));
1✔
465
            }) != ocsp.certificates().end();
1✔
466

467
         result.test_is_true("Contains NoCheck extension", contains_cert_with_nocheck);
1✔
468

469
         return result;
1✔
470
      }
1✔
471

472
   public:
473
      std::vector<Test::Result> run() override {
1✔
474
         std::vector<Test::Result> results;
1✔
475

476
         results.push_back(test_request_encoding());
2✔
477
         results.push_back(test_response_parsing());
2✔
478
         results.push_back(test_response_certificate_access());
2✔
479
         results.push_back(test_response_find_signing_certificate());
2✔
480
         results.push_back(test_response_verification_with_next_update_without_max_age());
2✔
481
         results.push_back(test_response_verification_with_next_update_with_max_age());
2✔
482
         results.push_back(test_response_verification_without_next_update_with_max_age());
2✔
483
         results.push_back(test_response_verification_without_next_update_without_max_age());
2✔
484
         results.push_back(test_response_verification_softfail());
2✔
485
         results.push_back(test_response_verification_with_additionally_trusted_responder());
2✔
486
         results.push_back(test_forged_ocsp_signature_is_rejected());
2✔
487
         results.push_back(test_responder_cert_with_nocheck_extension());
2✔
488

489
   #if defined(BOTAN_HAS_ONLINE_REVOCATION_CHECKS)
490
         if(Test::options().run_online_tests()) {
1✔
491
            results.push_back(test_online_request());
2✔
492
         }
493
   #endif
494

495
         return results;
1✔
496
      }
×
497
};
498

499
BOTAN_REGISTER_TEST("x509", "ocsp", OCSP_Tests);
500

501
#endif
502

503
}  // namespace
504

505
}  // namespace Botan_Tests
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc