feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Fixes for TLS 1.3 and OCSP Stapling

Browse Source 
Create the OCSP Response for Stapling and TLS 1.3 when parsing.
When parsing OCSP stapling extension with TLS 1.3, use a new extension
object if it was created.
Set the extension size to 0 before writing extensions when sending a TLS
1.3 Certificate message.
This commit is contained in:
Sean Parkinson
2019-07-16 12:10:58 +10:00
parent 3e6246af59
commit 9af9941b90
2 changed files with 28 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
src/tls.c
View File

@ -2835,15 +2835,8 @@ static word16 TLSX_CSR_GetSize(CertificateStatusRequest* csr, byte isRequest)
}
#endif
#if defined(WOLFSSL_TLS13) && !defined(NO_WOLFSSL_SERVER)
if (!isRequest && csr->ssl->options.tls1_3) {
if (csr->response.buffer == NULL) {
OcspRequest* request = &csr->request.ocsp;
int ret = CreateOcspResponse(csr->ssl, &request, &csr->response);
if (ret < 0)
return ret;
}
if (!isRequest && csr->ssl->options.tls1_3)
return OPAQUE8_LEN + OPAQUE24_LEN + csr->response.length;
}
#endif
return size;
@ -2952,6 +2945,13 @@ static int TLSX_CSR_Parse(WOLFSSL* ssl, byte* input, word16 length,
if (ssl->options.tls1_3) {
word32 resp_length;
word32 offset = 0;
/* Get the new extension potentially created above. */
extension = TLSX_Find(ssl->extensions, TLSX_STATUS_REQUEST);
csr = extension ? (CertificateStatusRequest*)extension->data : NULL;
if (csr == NULL)
return MEMORY_ERROR;
ret = 0;
if (OPAQUE8_LEN + OPAQUE24_LEN > length)
ret = BUFFER_ERROR;
@ -3032,7 +3032,25 @@ static int TLSX_CSR_Parse(WOLFSSL* ssl, byte* input, word16 length,
if (ret != WOLFSSL_SUCCESS)
return ret; /* throw error */
TLSX_SetResponse(ssl, TLSX_STATUS_REQUEST);
#if defined(WOLFSSL_TLS13) && !defined(NO_WOLFSSL_SERVER)
if (ssl->options.tls1_3) {
OcspRequest* request;
TLSX* extension = TLSX_Find(ssl->extensions, TLSX_STATUS_REQUEST);
CertificateStatusRequest* csr = extension ?
(CertificateStatusRequest*)extension->data : NULL;
if (csr == NULL)
return MEMORY_ERROR;
request = &csr->request.ocsp;
ret = CreateOcspResponse(ssl, &request, &csr->response);
if (ret != 0)
return ret;
if (csr->response.buffer)
TLSX_SetResponse(ssl, TLSX_STATUS_REQUEST);
}
else
#endif
TLSX_SetResponse(ssl, TLSX_STATUS_REQUEST);
ssl->status_request = status_type;
#endif
}

1
src/tls13.c
View File

@ -5071,6 +5071,7 @@ static int SendTls13Certificate(WOLFSSL* ssl)
if (ret < 0)
return ret;
extSz = 0;
ret = TLSX_WriteResponse(ssl, ssl->buffers.certExts->buffer,
certificate, &extSz);
if (ret < 0)