Fixes for OCSP stapling, cert manager, and certificate_status_request_v2 handling

.github/workflows/ocsp.yml

@@ -68,6 +68,66 @@ jobs:
           ./tests/unit.test -test_wolfIO_OcspDestAllowed | tee out.txt
           grep -Eq 'test_wolfIO_OcspDestAllowed[^_].*: passed' out.txt
 
+  # The leaf OCSP request built for stapling is cached on the WOLFSSL_CTX and
+  # reused by every later connection on it, with the CTX owning it. None of the
+  # jobs above reach that cache: it is only populated when the SSL shares the
+  # CTX certificate buffer (ssl->buffers.weOwnCert == 0), and OPENSSL_ALL
+  # implies WOLFSSL_COPY_CERT, which gives every SSL its own copy instead.
+  ocsp_ctx_request_cache:
+    name: ocsp ctx request cache (${{ matrix.name }})
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Plain stapling build: no OPENSSL_ALL, so no WOLFSSL_COPY_CERT and
+          # the cache is live.
+          - name: default
+            config: --enable-ocsp --enable-ocspstapling --enable-ocspstapling2
+          # The same cache under --enable-all, which pulls in OPENSSL_ALL and
+          # with it the compatibility-layer code paths around the cert manager.
+          # OPENSSL_ALL would otherwise force WOLFSSL_COPY_CERT and take the
+          # cache out of play entirely, so that is turned back off explicitly -
+          # which is what this entry is really here to prove.
+          - name: all, no cert copy
+            config: --enable-all CPPFLAGS=-DWOLFSSL_NO_COPY_CERT
+          # The cache hands one OcspRequest to many connections, so the failure
+          # mode of an ownership mistake is a double free or a use after free at
+          # CTX teardown rather than a wrong answer. ASan is what turns that into
+          # a test failure.
+          - name: asan
+            config: --enable-ocsp --enable-ocspstapling --enable-ocspstapling2 CFLAGS='-fsanitize=address -g' LDFLAGS='-fsanitize=address'
+    steps:
+      - name: workaround high-entropy ASLR
+        # Needed for the ASan build on this runner image; harmless for the rest.
+        run: sudo sysctl vm.mmap_rnd_bits=28
+
+      - name: Checkout wolfSSL
+        uses: actions/checkout@v5
+
+      - name: Build wolfSSL
+        run: autoreconf -ivf && ./configure ${{ matrix.config }} && make
+
+      # Assert on the counters rather than grepping the test name for "passed":
+      # the handshake under test logs to the same stream and splits the name and
+      # the result across lines. Running the one test on its own makes 0/0/1/1
+      # exact, and a build where the cache is compiled out reports 0/1/0/1
+      # instead - so a config change that quietly disables this cannot pass as
+      # green.
+      #
+      # Leak detection is off because wolfSSL's own unit.test has no verified
+      # clean LSan baseline; the double free and use after free this is here to
+      # catch are reported either way.
+      - name: Run the CTX OCSP request cache test
+        env:
+          ASAN_OPTIONS: detect_leaks=0
+        run: |
+          set -o pipefail
+          ./tests/unit.test -test_ocsp_ctx_request_cache | tee out.txt
+          grep -Eq 'Failed/Skipped/Passed/All: 0/0/1/1' out.txt
+
   ocsp_ssrf_screen_fallback:
     name: ocsp responder SSRF screening (gethostbyname fallback)
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}

doc/dox_comments/header_files/ssl.h

@@ -11366,6 +11366,7 @@ int wolfSSL_SetOCSP_Cb(WOLFSSL* ssl, CbOCSPIO ioCb, CbOCSPRespFree respFreeCb,
     memory during execution of the function.
     \return SSL_FAILURE returned if the crl member of the
     WOLFSSL_CERT_MANAGER fails to initialize correctly.
+    \return BAD_MUTEX_E returned if locking the certificate manager failed.
     \return NOT_COMPILED_IN wolfSSL was not compiled with the HAVE_CRL option.
 
     \param ctx a pointer to a WOLFSSL_CTX structure, created using
@@ -11495,6 +11496,7 @@ int wolfSSL_CTX_SetCRL_Cb(WOLFSSL_CTX* ctx, CbMissingCRL cb);
 
     \return SSL_SUCCESS is returned upon success.
     \return SSL_FAILURE is returned upon failure.
+    \return BAD_MUTEX_E returned if locking the certificate manager failed.
     \return NOT_COMPILED_IN is returned when this function has been called,
     but OCSP support was not enabled when wolfSSL was compiled.
 
@@ -11617,6 +11619,7 @@ int wolfSSL_CTX_SetOCSP_Cb(WOLFSSL_CTX* ctx,
     \return MEMORY_E returned if there was an issue allocating memory.
     \return SSL_FAILURE returned if the initialization of the OCSP
     structure failed.
+    \return BAD_MUTEX_E returned if locking the certificate manager failed.
     \return NOT_COMPILED_IN returned if wolfSSL was not compiled with
     HAVE_CERTIFICATE_STATUS_REQUEST option.
 

src/crl.c

@@ -86,6 +86,11 @@ int InitCRL(WOLFSSL_CRL* crl, WOLFSSL_CERT_MANAGER* cm)
 #endif
     if (wc_InitRwLock(&crl->crlLock) != 0) {
         WOLFSSL_MSG("Init Mutex failed");
+    #ifdef HAVE_CRL_MONITOR
+        /* Undo the condition variable created above: a failed InitCRL() must
+         * leave nothing behind, since callers only free the memory. */
+        wolfSSL_CondFree(&crl->cond);
+    #endif
         return BAD_MUTEX_E;
     }
 #ifdef OPENSSL_ALL