diff --git a/src/ssl.c b/src/ssl.c index b1c0a9871..fdf638152 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -10343,6 +10343,34 @@ void wolfSSL_set_verify_result(WOLFSSL *ssl, long v) #endif } +#if defined(OPENSSL_EXTRA) && !defined(NO_CERTS) && \ + defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH) +/* For TLS v1.3 send handshake messages after handshake completes. */ +/* Returns 1=WOLFSSL_SUCCESS or 0=WOLFSSL_FAILURE */ +int wolfSSL_verify_client_post_handshake(WOLFSSL* ssl) +{ + int ret = wolfSSL_request_certificate(ssl); + return (ret == 0) ? WOLFSSL_SUCCESS : WOLFSSL_FAILURE; +} + +int wolfSSL_CTX_set_post_handshake_auth(WOLFSSL_CTX* ctx, int val) +{ + int ret = wolfSSL_CTX_allow_post_handshake_auth(ctx); + if (ret == 0) { + ctx->postHandshakeAuth = (val != 0); + } + return (ret == 0) ? WOLFSSL_SUCCESS : WOLFSSL_FAILURE; +} +int wolfSSL_set_post_handshake_auth(WOLFSSL* ssl, int val) +{ + int ret = wolfSSL_allow_post_handshake_auth(ssl); + if (ret == 0) { + ssl->options.postHandshakeAuth = (val != 0); + } + return (ret == 0) ? WOLFSSL_SUCCESS : WOLFSSL_FAILURE; +} +#endif /* OPENSSL_EXTRA && !NO_CERTS && WOLFSSL_TLS13 && WOLFSSL_POST_HANDSHAKE_AUTH */ + /* store user ctx for verify callback */ void wolfSSL_SetCertCbCtx(WOLFSSL* ssl, void* ctx) { @@ -31546,6 +31574,20 @@ void *wolfSSL_OPENSSL_malloc(size_t a) return XMALLOC(a, NULL, DYNAMIC_TYPE_OPENSSL); } +int wolfSSL_OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings) +{ + (void)opts; + (void)settings; + return wolfSSL_library_init(); +} + +int wolfSSL_OPENSSL_init_crypto(uint64_t opts, const OPENSSL_INIT_SETTINGS* settings) +{ + (void)opts; + (void)settings; + return wolfSSL_library_init(); +} + #if defined(WOLFSSL_KEY_GEN) && defined(WOLFSSL_PEM_TO_DER) static int EncryptDerKey(byte *der, int *derSz, const EVP_CIPHER* cipher, diff --git a/wolfssl/openssl/crypto.h b/wolfssl/openssl/crypto.h index fe2bb7d94..6b701aaec 100644 --- a/wolfssl/openssl/crypto.h +++ b/wolfssl/openssl/crypto.h @@ -24,10 +24,11 @@ #ifndef WOLFSSL_CRYPTO_H_ #define WOLFSSL_CRYPTO_H_ -#include - #include +#include +#include + #ifdef WOLFSSL_PREFIX #include "prefix_crypto.h" #endif @@ -38,8 +39,12 @@ WOLFSSL_API unsigned long wolfSSLeay(void); WOLFSSL_API unsigned long wolfSSL_OpenSSL_version_num(void); #ifdef OPENSSL_EXTRA +#include + WOLFSSL_API void wolfSSL_OPENSSL_free(void*); WOLFSSL_API void *wolfSSL_OPENSSL_malloc(size_t a); + +WOLFSSL_API int wolfSSL_OPENSSL_init_crypto(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings); #endif #define CRYPTO_THREADID void @@ -62,11 +67,13 @@ WOLFSSL_API void *wolfSSL_OPENSSL_malloc(size_t a); #define OPENSSL_free wolfSSL_OPENSSL_free #define OPENSSL_malloc wolfSSL_OPENSSL_malloc -#ifdef WOLFSSL_QT - #define OPENSSL_INIT_ADD_ALL_CIPHERS 0x00000004L - #define OPENSSL_INIT_ADD_ALL_DIGESTS 0x00000008L - #define OPENSSL_INIT_LOAD_CONFIG 0x00000040L -#endif +#define OPENSSL_INIT_ENGINE_ALL_BUILTIN 0x00000001L +#define OPENSSL_INIT_ADD_ALL_CIPHERS 0x00000004L +#define OPENSSL_INIT_ADD_ALL_DIGESTS 0x00000008L +#define OPENSSL_INIT_LOAD_CONFIG 0x00000040L + +#define OPENSSL_init_crypto wolfSSL_OPENSSL_init_crypto + #if defined(OPENSSL_ALL) || defined(HAVE_STUNNEL) || defined(WOLFSSL_NGINX) || \ defined(WOLFSSL_HAPROXY) || defined(OPENSSL_EXTRA) diff --git a/wolfssl/openssl/ssl.h b/wolfssl/openssl/ssl.h index 17ce61311..90407b695 100644 --- a/wolfssl/openssl/ssl.h +++ b/wolfssl/openssl/ssl.h @@ -67,6 +67,10 @@ #undef ASN1_INTEGER #endif +#ifdef OPENSSL_EXTRA +#include +WOLFSSL_API int wolfSSL_OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings); +#endif typedef WOLFSSL SSL; typedef WOLFSSL_SESSION SSL_SESSION; @@ -279,9 +283,13 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS; #define SSL_CTX_set_cert_verify_callback wolfSSL_CTX_set_cert_verify_callback #define SSL_set_verify wolfSSL_set_verify #define SSL_set_verify_result wolfSSL_set_verify_result +#define SSL_verify_client_post_handshake wolfSSL_verify_client_post_handshake +#define SSL_set_post_handshake_auth wolfSSL_set_post_handshake_auth +#define SSL_CTX_set_post_handshake_auth wolfSSL_CTX_set_post_handshake_auth #define SSL_pending wolfSSL_pending #define SSL_load_error_strings wolfSSL_load_error_strings #define SSL_library_init wolfSSL_library_init +#define OPENSSL_init_ssl wolfSSL_OPENSSL_init_ssl #define OpenSSL_add_ssl_algorithms wolfSSL_library_init #define SSL_CTX_set_session_cache_mode wolfSSL_CTX_set_session_cache_mode #define SSL_CTX_set_cipher_list wolfSSL_CTX_set_cipher_list diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h index 6f99f74ed..d90afd2b0 100644 --- a/wolfssl/ssl.h +++ b/wolfssl/ssl.h @@ -974,6 +974,14 @@ WOLFSSL_API void wolfSSL_CTX_set_cert_verify_callback(WOLFSSL_CTX* ctx, WOLFSSL_API void wolfSSL_set_verify(WOLFSSL*, int, VerifyCallback verify_callback); WOLFSSL_API void wolfSSL_set_verify_result(WOLFSSL*, long); + +#if defined(OPENSSL_EXTRA) && !defined(NO_CERTS) && \ + defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH) +WOLFSSL_API int wolfSSL_verify_client_post_handshake(WOLFSSL*); +WOLFSSL_API int wolfSSL_CTX_set_post_handshake_auth(WOLFSSL_CTX*, int); +WOLFSSL_API int wolfSSL_set_post_handshake_auth(WOLFSSL*, int); +#endif + WOLFSSL_API void wolfSSL_SetCertCbCtx(WOLFSSL*, void*); WOLFSSL_ABI WOLFSSL_API int wolfSSL_pending(WOLFSSL*);