feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Improve the client certificate checking logic. Make sure calling wolfSSL_CTX_mutual_auth is also checked.

Browse Source
This commit is contained in:
David Garske
2022-02-04 16:36:21 -08:00
parent f6d79ff598
commit 3cdb1c639d
3 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/internal.c
View File

@@ -11101,7 +11101,7 @@ int InitSigPkCb(WOLFSSL* ssl, SignatureCtx* sigCtx)
#if !defined(NO_WOLFSSL_CLIENT) || !defined(WOLFSSL_NO_CLIENT_AUTH)
static void DoCertFatalAlert(WOLFSSL* ssl, int ret)
void DoCertFatalAlert(WOLFSSL* ssl, int ret)
{
int alertWhy;
if (ssl == NULL || ret == 0) {
@@ -31519,7 +31519,8 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
}
#if !defined(NO_CERTS) && !defined(WOLFSSL_NO_CLIENT_AUTH)
if (ssl->options.verifyPeer && ssl->options.failNoCert) {
if (ssl->options.verifyPeer &&
(ssl->options.mutualAuth || ssl->options.failNoCert)) {
if (!ssl->options.havePeerCert) {
WOLFSSL_MSG("client didn't present peer cert");
ERROR_OUT(NO_PEER_CERT, exit_dcke);
@@ -31530,7 +31531,7 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
if (!ssl->options.havePeerCert &&
!ssl->options.usingPSK_cipher) {
WOLFSSL_MSG("client didn't present peer cert");
return NO_PEER_CERT;
ERROR_OUT(NO_PEER_CERT, exit_dcke);
}
}
#endif /* !NO_CERTS && !WOLFSSL_NO_CLIENT_AUTH */

12
src/tls13.c
View File

@@ -6890,6 +6890,18 @@ int DoTls13Finished(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
WOLFSSL_START(WC_FUNC_FINISHED_DO);
WOLFSSL_ENTER("DoTls13Finished");
#if !defined(NO_CERTS) && !defined(WOLFSSL_NO_CLIENT_AUTH)
/* verify the client sent certificate if required */
if (ssl->options.side == WOLFSSL_SERVER_END &&
(ssl->options.mutualAuth || ssl->options.failNoCert)) {
if (!ssl->options.havePeerVerify && !ssl->options.resuming) {
ret = NO_PEER_CERT;
DoCertFatalAlert(ssl, ret);
return ret;
}
}
#endif
/* check against totalSz */
if (*inOutIdx + size + ssl->keys.padSz > totalSz)
return BUFFER_E;

4
wolfssl/internal.h
View File

@@ -4839,7 +4839,9 @@ WOLFSSL_LOCAL int BuildTlsFinished(WOLFSSL* ssl, Hashes* hashes,
WOLFSSL_LOCAL void FreeArrays(WOLFSSL* ssl, int keep);
WOLFSSL_LOCAL int CheckAvailableSize(WOLFSSL *ssl, int size);
WOLFSSL_LOCAL int GrowInputBuffer(WOLFSSL* ssl, int size, int usedLength);
#if !defined(NO_WOLFSSL_CLIENT) || !defined(WOLFSSL_NO_CLIENT_AUTH)
WOLFSSL_LOCAL void DoCertFatalAlert(WOLFSSL* ssl, int ret);
#endif
#ifndef NO_TLS
WOLFSSL_LOCAL int MakeTlsMasterSecret(WOLFSSL* ssl);
#ifndef WOLFSSL_AEAD_ONLY