Use wolfSSL's EmbedOcspLookup in non-blocking async OCSP example by night1rider · Pull Request #604 · wolfSSL/wolfssl-examples

night1rider · 2026-07-17T20:34:38Z

Replace the system("curl ... ") OCSP fetch in the async example with wolfSSL's EmbedOcspLookup, so the certificate-supplied URL is fetched as data over a socket instead of executed.

Both examples now target www.digicert.com (Google dropped OCSP): ocsp_nonblock
fetches the leaf live over TLS rather than a bundled cert that expires, and the async example uses wolfSSL's native async API. Bundle the DigiCert CAs and drop the expired google.pem and stale GTS certs.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #604

Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #604

Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #604

Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #604

Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Pull request overview

This PR hardens the non-blocking async OCSP example by removing execution of an untrusted OCSP responder URL via system()/curl, instead using wolfSSL’s built-in OCSP HTTP fetch API, and updates server connection setup to resolve the hostname dynamically via getaddrinfo().

Changes:

Replace system("curl ... <untrusted-url>") OCSP fetching with EmbedOcspLookup() + EmbedOcspRespFree().
Resolve SERVER_NAME via getaddrinfo() instead of using a hard-coded IP address.
Update README sample output to remove the printed curl command flow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
ocsp/ocsp_nonblock/ocsp_nonblock_async.c	Switch OCSP callback to `EmbedOcspLookup()` and resolve server address via `getaddrinfo()`.
ocsp/ocsp_nonblock/README.md	Remove curl-command/temporary-file output lines from the example run log.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

philljj

Overall this looks good and an improvement over the original system(3) based example.

Two requested changes:

While you're updating the README.md we should remove this outdated section:

NOTE: Before building this example the asynchronous support must be obtained from (https://github.com/wolfSSL/wolfAsyncCrypt) and installed into wolfSSL by following the instructions in the README file contained in the wolfAsyncCrypt repository.

The wolfAsyncCrypt repo is deprecated, and the async code is upstreamed into wolfssl now.

It would be nice to just include a cert to use for this ocsp_nonblock_async example.

note: the google.pem used by ocsp_nonblock.c example is expired, but that's outside scope of this PR.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #604

Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #604

Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #604

Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Replace the system("curl ... <untrusted responder URL>") OCSP fetch in the async example with wolfSSL's EmbedOcspLookup, so the certificate-supplied URL is fetched as data over a socket instead of executed. Both examples now target www.digicert.com (Google dropped OCSP): ocsp_nonblock fetches the leaf live over TLS rather than a bundled cert that expires, and the async example uses wolfSSL's native async API. Bundle the DigiCert CAs and drop the expired google.pem and stale GTS certs.

The rewritten clients need asynccrypt/opensslextra/sni/alpn and WOLFSSL_NONBLOCK_OCSP, which the shared ocsp profile lacks; add a dedicated ocsp-nonblock profile.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #604

Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

wolfSSL-Fenrir-bot · 2026-08-27T15:34:04Z

+    wolfSSL_set_fd(ssl, fd);
+    wolfSSL_UseSNI(ssl, WOLFSSL_SNI_HOST_NAME, host, (word16)XSTRLEN(host));
+    /* Bind the cert to the hostname; a chain check alone is not enough. */
+    wolfSSL_check_domain_name(ssl, host);


Return values of wolfSSL_UseSNI() and wolfSSL_check_domain_name() ignored in fetch_leaf_der() · Incorrect error handling

Every other call in fetch_leaf_der is error-checked, but wolfSSL_UseSNI and wolfSSL_check_domain_name are not. On failure the handshake proceeds with no hostname binding, silently contradicting the adjacent comment; the async example in this same PR checks both.

Related known finding #8939 (similar but distinct): Both involve failure handling being omitted, but this finding concerns ignored SNI/domain-binding return values in fetch_leaf_der, whereas #8939 concerns failure branches retaining a success return during EVP setup in encrypt_file. Their root causes and required patches differ, so one patch would not fix both.

Fix: Check both calls for WOLFSSL_SUCCESS and fail through the existing ssl/fd/ctx cleanup path on error.

wolfSSL-Fenrir-bot · 2026-08-27T15:34:04Z

+    wolfSSL_set_fd(ssl, fd);
+    wolfSSL_UseSNI(ssl, WOLFSSL_SNI_HOST_NAME, host, (word16)XSTRLEN(host));
+    /* Bind the cert to the hostname; a chain check alone is not enough. */
+    wolfSSL_check_domain_name(ssl, host);


Peer identity binding not verified in fetch_leaf_der · Incorrect wolfSSL/wolfCrypt API usage

wolfSSL_check_domain_name and wolfSSL_UseSNI return values are discarded, so if the call fails the handshake at line 214 still proceeds and the peer is authenticated by chain only — any CA-issued certificate for a different host is accepted. Adjacent to known finding #11800, which omits identity registration entirely rather than ignoring its result; configure_ssl in the sibling async file checks the same call.

Related known finding #11800 (similar but distinct): Both weaken TLS peer identity authentication while retaining chain verification. #11800 omits requested-IP identity registration in tls/client-tls.c:main; this finding invokes SNI/domain binding in fetch_leaf_der but ignores setup failures before connecting. The root causes and faulting operations differ, and each needs its own patch.

Fix: Check both calls for WOLFSSL_SUCCESS and abort with the existing ssl/fd/ctx cleanup sequence on failure.

night1rider self-assigned this Jul 17, 2026

night1rider requested a review from wolfSSL-Fenrir-bot July 17, 2026 20:35

wolfSSL-Fenrir-bot reviewed Jul 17, 2026

View reviewed changes

night1rider force-pushed the fenrir-issue-2904 branch from c7c49f3 to 8d7c242 Compare July 17, 2026 20:48

night1rider requested a review from wolfSSL-Fenrir-bot July 17, 2026 20:48

wolfSSL-Fenrir-bot reviewed Jul 17, 2026

View reviewed changes

night1rider force-pushed the fenrir-issue-2904 branch from 8d7c242 to 4011953 Compare July 17, 2026 21:21

night1rider requested a review from wolfSSL-Fenrir-bot July 17, 2026 21:21

wolfSSL-Fenrir-bot reviewed Jul 17, 2026

View reviewed changes

Comment thread ocsp/ocsp_nonblock/ocsp_nonblock_async.c Outdated

night1rider commented Jul 17, 2026

View reviewed changes

Comment thread ocsp/ocsp_nonblock/ocsp_nonblock_async.c Outdated

night1rider requested a review from wolfSSL-Fenrir-bot July 17, 2026 22:50

wolfSSL-Fenrir-bot reviewed Jul 17, 2026

View reviewed changes

night1rider assigned wolfSSL-Bot and unassigned night1rider Jul 21, 2026

philljj self-requested a review July 29, 2026 19:41

philljj self-assigned this Jul 29, 2026

philljj requested a review from Copilot July 30, 2026 02:10

Copilot started reviewing on behalf of philljj July 30, 2026 02:11 View session

Copilot AI reviewed Jul 30, 2026

View reviewed changes

Comment thread ocsp/ocsp_nonblock/ocsp_nonblock_async.c Outdated

Comment thread ocsp/ocsp_nonblock/ocsp_nonblock_async.c Outdated

philljj requested changes Jul 30, 2026

View reviewed changes

philljj assigned night1rider and unassigned wolfSSL-Bot and philljj Jul 30, 2026

night1rider requested a review from wolfSSL-Fenrir-bot August 25, 2026 17:04

wolfSSL-Fenrir-bot reviewed Aug 25, 2026

View reviewed changes

night1rider force-pushed the fenrir-issue-2904 branch from 8edbabb to de2be79 Compare August 25, 2026 19:25

night1rider requested a review from wolfSSL-Fenrir-bot August 25, 2026 19:29

wolfSSL-Fenrir-bot requested changes Aug 25, 2026

View reviewed changes

night1rider force-pushed the fenrir-issue-2904 branch from de2be79 to 770dfcd Compare August 25, 2026 20:03

night1rider requested a review from philljj August 25, 2026 20:03

night1rider requested a review from wolfSSL-Fenrir-bot August 25, 2026 20:03

wolfSSL-Fenrir-bot requested changes Aug 25, 2026

View reviewed changes

night1rider force-pushed the fenrir-issue-2904 branch from 770dfcd to 3425718 Compare August 25, 2026 21:09

night1rider added 2 commits August 26, 2026 21:51

CI: build ocsp_nonblock with its own profile

25ff2ff

The rewritten clients need asynccrypt/opensslextra/sni/alpn and WOLFSSL_NONBLOCK_OCSP, which the shared ocsp profile lacks; add a dedicated ocsp-nonblock profile.

night1rider force-pushed the fenrir-issue-2904 branch from 3425718 to 25ff2ff Compare August 27, 2026 04:05

night1rider assigned wolfSSL-Bot and unassigned night1rider Aug 27, 2026

night1rider requested a review from wolfSSL-Fenrir-bot August 27, 2026 15:11

night1rider assigned night1rider and unassigned wolfSSL-Bot Aug 27, 2026

wolfSSL-Fenrir-bot requested changes Aug 27, 2026

View reviewed changes

Uh oh!

Conversation

night1rider commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #604

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #604

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #604

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #604

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

philljj left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #604

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #604

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #604

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #604

Uh oh!

wolfSSL-Fenrir-bot Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

wolfSSL-Fenrir-bot Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

night1rider commented Jul 17, 2026 •

edited

Loading

philljj left a comment •

edited

Loading