Skip to content

Commit 047785e

Browse files
author
Harry Xi
authored
SNOW-1300480: fix missing part for ocsp (#710)
1 parent f9b3e84 commit 047785e

File tree

6 files changed

+58
-15
lines changed

6 files changed

+58
-15
lines changed

‎deps/curl/lib/url.c

+12
Original file line numberDiff line numberDiff line change
@@ -1403,6 +1403,18 @@ static struct connectdata *allocate_conn(struct Curl_easy *data)
14031403
conn->connect_only = data->set.connect_only;
14041404
conn->transport = TRNSPRT_TCP; /* most of them are TCP streams */
14051405

1406+
conn->ssl_config.sf_ocsp_check = data->set.ssl.primary.sf_ocsp_check;
1407+
conn->ssl_config.sf_ocsp_failopen = data->set.ssl.primary.sf_ocsp_failopen;
1408+
conn->ssl_config.sf_oob_enable = data->set.ssl.primary.sf_oob_enable;
1409+
#ifndef CURL_DISABLE_PROXY
1410+
conn->proxy_ssl_config.sf_ocsp_check =
1411+
data->set.proxy_ssl.primary.sf_ocsp_check;
1412+
conn->proxy_ssl_config.sf_ocsp_failopen =
1413+
data->set.proxy_ssl.primary.sf_ocsp_failopen;
1414+
conn->proxy_ssl_config.sf_oob_enable =
1415+
data->set.proxy_ssl.primary.sf_oob_enable;
1416+
#endif
1417+
14061418
#if !defined(CURL_DISABLE_HTTP) && defined(USE_NTLM) && \
14071419
defined(NTLM_WB_ENABLED)
14081420
conn->ntlm.ntlm_auth_hlpr_socket = CURL_SOCKET_BAD;

‎deps/curl/lib/vtls/sf_ocsp.c

+3-2
Original file line numberDiff line numberDiff line change
@@ -836,7 +836,7 @@ static OCSP_RESPONSE * queryResponderUsingCurl(char *url, OCSP_CERTID *certid, c
836836
strcpy(last_timeout_host, host);
837837
}
838838
snprintf(error_msg, OCSP_TELEMETRY_ERROR_MSG_MAX_LEN,
839-
"OCSP checking curl_easy_perform() failed: %s\n",
839+
"OCSP checking curl_easy_perform() failed: %s",
840840
curl_easy_strerror(res));
841841
sf_otd_set_error_msg(error_msg, ocsp_log_data);
842842
sf_otd_set_event_sub_type(OCSP_RESPONSE_FETCH_FAILURE, ocsp_log_data);
@@ -1866,7 +1866,8 @@ CURLcode checkOneCert(X509 *cert, X509 *issuer,
18661866
{
18671867
sendOOBevent(ocsp_log_str);
18681868
}
1869-
infof(data, ocsp_log_str);
1869+
// multiple line logging is not allowed in curl
1870+
// infof(data, ocsp_log_str);
18701871
if(ocsp_log_str) sf_curl_cJSON_free(ocsp_log_str);
18711872
}
18721873
}

‎deps/curl/lib/vtls/vtls.c

+3
Original file line numberDiff line numberDiff line change
@@ -373,6 +373,9 @@ void Curl_ssl_conn_config_update(struct Curl_easy *data, bool for_proxy)
373373
dest->verifyhost = src->verifyhost;
374374
dest->verifypeer = src->verifypeer;
375375
dest->verifystatus = src->verifystatus;
376+
dest->sf_ocsp_check = src->sf_ocsp_check;
377+
dest->sf_ocsp_failopen = src->sf_ocsp_failopen;
378+
dest->sf_oob_enable = src->sf_oob_enable;
376379
}
377380
}
378381

‎scripts/build_curl.bat

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111

1212
@echo off
1313
set CURL_SRC_VERSION=8.7.1
14-
set CURL_BUILD_VERSION=2
14+
set CURL_BUILD_VERSION=4
1515
set CURL_VERSION=%CURL_SRC_VERSION%.%CURL_BUILD_VERSION%
1616
call %*
1717
goto :EOF

‎scripts/build_curl.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ function usage() {
1313
set -o pipefail
1414

1515
CURL_SRC_VERSION=8.7.1
16-
CURL_BUILD_VERSION=2
16+
CURL_BUILD_VERSION=4
1717
CURL_VERSION=${CURL_SRC_VERSION}.${CURL_BUILD_VERSION}
1818

1919
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

‎tests/unit_test_ocsp/test_ocsp.c

+38-11
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ static void dieIfNotSuccess(CURLcode ret)
141141
}
142142

143143
static void
144-
checkCertificateRevocationStatus(char *host, char *port, char *cacert, char *proxy, char *no_proxy, int oob_enable, int failopen)
144+
checkCertificateRevocationStatus(char *host, char *port, char *cacert, char *proxy, char *no_proxy, int oob_enable, int failopen, int expect_fail)
145145
{
146146
CURL *ch;
147147
struct configData config;
@@ -198,7 +198,19 @@ checkCertificateRevocationStatus(char *host, char *port, char *cacert, char *pro
198198
dieIfNotSuccess(curl_easy_setopt(ch, CURLOPT_SSL_SF_OCSP_FAIL_OPEN, 0));
199199
}
200200

201-
dieIfNotSuccess(curl_easy_perform(ch));
201+
CURLcode ret = curl_easy_perform(ch);
202+
if (expect_fail == 0)
203+
{
204+
dieIfNotSuccess(ret);
205+
}
206+
else
207+
{
208+
if (ret == CURLE_OK)
209+
{
210+
fprintf(stderr, "FAILED!\n");
211+
exit(1);
212+
}
213+
}
202214

203215
curl_easy_cleanup(ch);
204216
curl_global_cleanup();
@@ -269,29 +281,36 @@ int main(int argc, char **argv)
269281
return 2;
270282
}
271283
printf("host: %s, port: %s, cacert: %s\n", host, port, cacert);
284+
#ifdef __linux__
272285
sprintf(cache_file, "%s/.cache/snowflake/ocsp_response_cache.json",
273286
getenv("HOME"));
287+
#elif defined(__APPLE__)
288+
sprintf(cache_file, "%s/Library/Caches//Snowflake/ocsp_response_cache.json",
289+
getenv("HOME"));
290+
#else
291+
return 0;
292+
#endif
274293

275294
printf("===> Case 1: whatever default\n");
276-
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 0);
295+
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 0, 0);
277296

278297
printf("===> Case 2: Delete file cache and No Use Cache Server\n");
279298
setenv("SF_OCSP_RESPONSE_CACHE_SERVER_ENABLED", "false", 1);
280299
unlink(cache_file);
281-
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 0);
300+
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 0, 0);
282301

283302
printf("===> Case 3: Delete file cache and Use Cache Server\n");
284303
setenv("SF_OCSP_RESPONSE_CACHE_SERVER_ENABLED", "true", 1);
285304
unlink(cache_file);
286-
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 0);
305+
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 0, 0);
287306

288307
printf("===> Case 4: No Delete file cache and No Use Cache Server\n");
289308
setenv("SF_OCSP_RESPONSE_CACHE_SERVER_ENABLED", "false", 1);
290-
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 0);
309+
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 0, 0);
291310

292311
printf("===> Case 5: No Delete file cache and No Use Cache Server\n");
293312
setenv("SF_OCSP_RESPONSE_CACHE_SERVER_ENABLED", "false", 1);
294-
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 0);
313+
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 0, 0);
295314

296315
if (getenv("all_proxy") || getenv("https_proxy") ||
297316
getenv("http_proxy"))
@@ -305,14 +324,14 @@ int main(int argc, char **argv)
305324
setenv("http_proxy", "a.b.c", 1);
306325
setenv("https_proxy", "a.b.c", 1);
307326
unlink(cache_file);
308-
checkCertificateRevocationStatus(host, port, cacert, "", "", 0, 0);
327+
checkCertificateRevocationStatus(host, port, cacert, "", "", 0, 0, 0);
309328

310329
printf("===> Case 7: Delete file cache and overwrite invalid proxy with no_proxy\n");
311330
setenv("SF_OCSP_RESPONSE_CACHE_SERVER_ENABLED", "true", 1);
312331
setenv("http_proxy", "a.b.c", 1);
313332
setenv("https_proxy", "a.b.c", 1);
314333
unlink(cache_file);
315-
checkCertificateRevocationStatus(host, port, cacert, "a.b.c", "*", 0, 0);
334+
checkCertificateRevocationStatus(host, port, cacert, "a.b.c", "*", 0, 0, 0);
316335

317336
unsetenv("http_proxy");
318337
unsetenv("https_proxy");
@@ -326,7 +345,7 @@ int main(int argc, char **argv)
326345
// use random IP address so it will get connection timeout
327346
setenv("SF_OCSP_RESPONSE_CACHE_SERVER_URL", "http://10.24.123.89/ocsp_response_cache.json", 1);
328347
unlink(cache_file);
329-
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 1, 1);
348+
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 1, 1, 0);
330349

331350
printf("===> Case 10: Delete file cache with invalid cache server URL to test delay on failure and OOB disabled\n");
332351
setenv("SF_OCSP_RESPONSE_CACHE_SERVER_ENABLED", "false", 1);
@@ -335,7 +354,7 @@ int main(int argc, char **argv)
335354
unlink(cache_file);
336355

337356
time_t start_time = time(NULL);
338-
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 1);
357+
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 1, 0);
339358
time_t end_time = time(NULL);
340359
// should be around 5 seconds but no longer than 10.
341360
if ((end_time - start_time) > 10)
@@ -348,6 +367,14 @@ int main(int argc, char **argv)
348367
fprintf(stderr, "Delay check OK\n");
349368
}
350369

370+
printf("===> Case 11: Delete file cache with invalid cache server URL test with fail close\n");
371+
setenv("SF_OCSP_RESPONSE_CACHE_SERVER_ENABLED", "true", 1);
372+
// use random IP address so it will get connection timeout
373+
setenv("SF_OCSP_RESPONSE_CACHE_SERVER_URL", "http://10.24.123.89/ocsp_response_cache.json", 1);
374+
unlink(cache_file);
375+
376+
checkCertificateRevocationStatus(host, port, cacert, NULL, NULL, 0, 0, 1);
377+
351378
unsetenv("SF_OCSP_RESPONSE_CACHE_SERVER_ENABLED");
352379
unsetenv("SF_OCSP_RESPONSE_CACHE_SERVER_URL");
353380

0 commit comments

Comments
 (0)