fix bad & statement that was setting ocspSendNonce

[jpbland1]

to 1 when WOLFSSL_OCSP_NO_NONCE was selected
related to but doesn't solve zd 16377

Description

OCSP sends an optional nonce which is supposed to be disabled by WOLFSSL_OCSP_NO_NONCE but the logical statement was doing the opposite and sending the nonce when WOLFSSL_OCSP_NO_NONCE was set

Testing

Tested in gdb to confirm the nonce was being skipped

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[dgarske]

Please share steps to reproduce and make sure we have test coverage.

[jpbland1]

Originally, wolfSSL_CertManagerEnableOCSP set the variable ocspSendNonce by checking if the WOLFSSL_OCSP_NO_NONCE option was set:

        if (options & WOLFSSL_OCSP_NO_NONCE)
            cm->ocspSendNonce = 0;
        else
            cm->ocspSendNonce = 1;

When it was moved and refactored in , it looks like a logical error was made and ocspSendNonce is now set like:

        /* Set nonce option for creating OCSP requests. */
        cm->ocspSendNonce = (options & WOLFSSL_OCSP_NO_NONCE) != 0;

which sets ocspSendNonce to the opposite of what it should be, since (options & WOLFSSL_OCSP_NO_NONCE) != 0 will be 1 when WOLFSSL_OCSP_NO_NONCE is set and 0 when it is not set. It's hard to test this since we don't have a responder that we can check for the nonce with. You can see it's wrong manually by looking in gdb to see that the nonce is being set when it shouldn't be.

Anyways, all we need to do is change it to (options & WOLFSSL_OCSP_NO_NONCE) != WOLFSSL_OCSP_NO_NONCE which will be 0 when WOLFSSL_OCSP_NO_NONCE is set and 1 when not set.

[dgarske]

The current code works for me:

#define WOLFSSL_OCSP_NO_NONCE 2
uint32_t options, testnonce, ocspSendNonce;

options = WOLFSSL_OCSP_NO_NONCE;
testnonce = (options & WOLFSSL_OCSP_NO_NONCE);
ocspSendNonce = (options & WOLFSSL_OCSP_NO_NONCE) != 0;
printf("options 0x%x, test %u, sendNonce %u\n", options, testnonce, ocspSendNonce);

options = 0;
testnonce = (options & WOLFSSL_OCSP_NO_NONCE);
ocspSendNonce = (options & WOLFSSL_OCSP_NO_NONCE) != 0;
printf("options 0x%x, test %u, sendNonce %u\n", options, testnonce, ocspSendNonce);

options 0x2, test 2, sendNonce 1
options 0x0, test 0, sendNonce 0

[dgarske]

The current code works for me:

#define WOLFSSL_OCSP_NO_NONCE 2
uint32_t options, testnonce, ocspSendNonce;

options = WOLFSSL_OCSP_NO_NONCE;
testnonce = (options & WOLFSSL_OCSP_NO_NONCE);
ocspSendNonce = (options & WOLFSSL_OCSP_NO_NONCE) != 0;
printf("options 0x%x, test %u, sendNonce %u\n", options, testnonce, ocspSendNonce);

options = 0;
testnonce = (options & WOLFSSL_OCSP_NO_NONCE);
ocspSendNonce = (options & WOLFSSL_OCSP_NO_NONCE) != 0;
printf("options 0x%x, test %u, sendNonce %u\n", options, testnonce, ocspSendNonce);

options 0x2, test 2, sendNonce 1
options 0x0, test 0, sendNonce 0

Test code: This is backwards, right?

[jpbland1]

yes it's backwards, when it's set the result should be zero, not 1

[dgarske]

Confirmed backwards logic is correctly fixed with this. Thanks @jpbland1

[bandi13]

retest this please

[bandi13]

retest this please