Fix: ocsp - validate response timestamps in wolfSSL_OCSP_check_validity

[jackctj117]

This pull request implements comprehensive validation for OCSP response timestamps in the wolfSSL_OCSP_check_validity function and adds a thorough suite of tests to ensure correct behavior, especially regarding clock skew, staleness, and absent fields. The changes also integrate the new test into the test suite.

OCSP response timestamp validation improvements:

• src/ocsp.c: Rewrote wolfSSL_OCSP_check_validity to properly validate the thisUpdate and nextUpdate timestamps, enforcing clock skew (sec), maximum staleness (maxsec), and handling absent or malformed times as failures, except for absent nextUpdate which is now correctly accepted when represented as a zero-length structure.

Expanded OCSP validation testing:

• tests/api/test_ocsp.c: Added a comprehensive test function test_ocsp_check_validity covering all relevant edge cases, including future, stale, missing, and malformed thisUpdate, expired or inconsistent nextUpdate, and correct handling of absent nextUpdate as a zero-length structure. Also tests integration with the OCSP status getter.
• tests/api/test_ocsp.h: Declared the new test function for use in the test suite.
• tests/api.c: Registered the new test case in the OCSP test group, ensuring it runs as part of the standard test suite.

[wolfSSL-Bot]

Can one of the admins verify this patch?

[Copilot]

Pull request overview

This PR tightens OpenSSL-compat OCSP response validation by making wolfSSL_OCSP_check_validity actually enforce thisUpdate/nextUpdate timestamp rules (clock skew and staleness), and adds API tests to guard the behavior.

Changes:

• Reworked wolfSSL_OCSP_check_validity in src/ocsp.c to validate thisUpdate presence/format and enforce skew/staleness, while treating a zero-length nextUpdate as “absent”.
• Added a focused test suite for wolfSSL_OCSP_check_validity edge cases and integrated it into the API test runner.
• Exposed the new test via tests/api/test_ocsp.h and registered it in tests/api.c.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
src/ocsp.c	Implements timestamp validation logic for OCSP responses (thisUpdate/nextUpdate).
tests/api/test_ocsp.c	Adds coverage for validity checks across future/stale/missing/malformed timestamp scenarios.
tests/api/test_ocsp.h	Declares the new OCSP validity test entry point.
tests/api.c	Registers the new OCSP validity test in the OCSP test group.

Suppressed comments (1)

src/ocsp.c:819

• The nextUpdate expiration check is also strict (nextUpdate must be after now - sec). With the current wolfSSL_X509_cmp_time semantics (-1 for <=), this rejects a nextUpdate exactly at the edge of the allowed clock skew (nextUpdate == now - sec). Allow the boundary case by comparing against now - sec - 1.

        cmp = now - sec;
        if (wolfSSL_X509_cmp_time(nextupd, &cmp) != 1) {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11297

Scan targets checked: wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[philljj]

Retest this please.

tlslite.errors.TLSAbruptCloseError: TLSAbruptCloseError