From 8a42ee7ffd6058513c5f328820f2d802169a5d45 Mon Sep 17 00:00:00 2001 From: Sean Parkinson Date: Thu, 5 Nov 2020 12:21:19 +1000 Subject: [PATCH] TLS configurations fixes --enable-leanpsk --disable-tls13: ensure WriteSEQ is defined when !WOLFSSL_NO_TLS12 (tls.c) CFLAGS=-DWOLFSSL_NO_CLIENT_AUTH -disable-tls13" TLS server was expecting certificate from peer when verifyPeer is set. Fix with checks for !WOLFSSL_NO_CLIENT_AUTH. --- src/internal.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/internal.c b/src/internal.c index a2e856542..1cd165d56 100644 --- a/src/internal.c +++ b/src/internal.c @@ -6704,6 +6704,7 @@ void FreeSSL(WOLFSSL* ssl, void* heap) } #if !defined(NO_OLD_TLS) || defined(WOLFSSL_DTLS) || \ + !defined(WOLFSSL_NO_TLS12) || \ ((defined(HAVE_CHACHA) || defined(HAVE_AESCCM) || defined(HAVE_AESGCM)) \ && defined(HAVE_AEAD)) @@ -6827,7 +6828,7 @@ void WriteSEQ(WOLFSSL* ssl, int verifyOrder, byte* out) c32toa(seq[1], out + OPAQUE32_LEN); } #endif /* WOLFSSL_DTLS || !WOLFSSL_NO_TLS12 */ -#endif /* !NO_OLD_TLS || WOLFSSL_DTLS || +#endif /* !NO_OLD_TLS || WOLFSSL_DTLS || !WOLFSSL_NO_TLS12 || * ((HAVE_CHACHA || HAVE_AESCCM || HAVE_AESGCM) && HAVE_AEAD) */ #ifdef WOLFSSL_DTLS @@ -28922,7 +28923,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx, ERROR_OUT(OUT_OF_ORDER_E, exit_dcke); } - #ifndef NO_CERTS + #if !defined(NO_CERTS) && !defined(WOLFSSL_NO_CLIENT_AUTH) if (ssl->options.verifyPeer && ssl->options.failNoCert) { if (!ssl->options.havePeerCert) { WOLFSSL_MSG("client didn't present peer cert"); @@ -28937,7 +28938,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx, return NO_PEER_CERT; } } - #endif /* !NO_CERTS */ + #endif /* !NO_CERTS && !WOLFSSL_NO_CLIENT_AUTH */ #if defined(WOLFSSL_CALLBACKS) if (ssl->hsInfoOn) { @@ -30110,7 +30111,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx, *inOutIdx = args->idx; ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE; - #ifndef NO_CERTS + #if !defined(NO_CERTS) && !defined(WOLFSSL_NO_CLIENT_AUTH) if (ssl->options.verifyPeer) { ret = BuildCertHashes(ssl, &ssl->hsHashes->certHashes); }