wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-08-01 03:34:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Move API out of OPENSSL_EXTRA

Browse Source
This commit is contained in:
Eric Blankenhorn
2020-07-14 17:41:51 -05:00
parent d1a82589f9
commit 525a3cb9c3
6 changed files with 99 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/crl.c
View File

@@ -1176,7 +1176,7 @@ static int StartMonitorCRL(WOLFSSL_CRL* crl)
#else /* HAVE_CRL_MONITOR */
#ifndef NO_FILESYSTEM
#if !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
static int StartMonitorCRL(WOLFSSL_CRL* crl)
{
@@ -1188,7 +1188,7 @@ static int StartMonitorCRL(WOLFSSL_CRL* crl)
return NOT_COMPILED_IN;
}
#endif /* NO_FILESYSTEM */
#endif /* !NO_FILESYSTEM && !NO_WOLFSSL_DIR */
#endif /* HAVE_CRL_MONITOR */

4
src/internal.c
View File

@@ -9404,7 +9404,6 @@ int CheckAltNames(DecodedCert* dCert, char* domain)
return match;
}
#ifdef OPENSSL_EXTRA
/* Check that alternative names, if they exists, match the domain.
* Fail if there are wild patterns and they didn't match.
* Check the common name if no alternative names matched.
@@ -9450,6 +9449,7 @@ static int CheckForAltNames(DecodedCert* dCert, const char* domain, int* checkCN
return match;
}
/* Check the domain name matches the subject alternative name or the subject
* name.
*
@@ -9486,7 +9486,7 @@ int CheckIPAddr(DecodedCert* dCert, const char* ipasc)
return CheckHostName(dCert, ipasc, (size_t)XSTRLEN(ipasc));
}
#endif
#ifdef SESSION_CERTS
static void AddSessionCertToChain(WOLFSSL_X509_CHAIN* chain,

155
src/ssl.c
View File

@@ -14656,8 +14656,6 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
#endif
#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER)
static long wolf_set_options(long old_op, long op);
long wolfSSL_CTX_set_options(WOLFSSL_CTX* ctx, long opt)
{
@@ -14671,8 +14669,6 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
return ctx->mask;
}
#endif
#ifdef OPENSSL_EXTRA
long wolfSSL_CTX_clear_options(WOLFSSL_CTX* ctx, long opt)
@@ -24723,7 +24719,6 @@ int wolfSSL_PEM_def_callback(char* name, int num, int w, void* key)
#endif /* OPENSSL_EXTRA */
#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) || defined(WOLFSSL_WPAS_SMALL)
static long wolf_set_options(long old_op, long op)
{
/* if SSL_OP_ALL then turn all bug workarounds on */
@@ -24746,19 +24741,19 @@ static long wolf_set_options(long old_op, long op)
}
#endif
if ((op & SSL_OP_NO_TLSv1_2) == SSL_OP_NO_TLSv1_2) {
if ((op & WOLFSSL_OP_NO_TLSv1_2) == WOLFSSL_OP_NO_TLSv1_2) {
WOLFSSL_MSG("\tSSL_OP_NO_TLSv1_2");
}
if ((op & SSL_OP_NO_TLSv1_1) == SSL_OP_NO_TLSv1_1) {
if ((op & WOLFSSL_OP_NO_TLSv1_1) == WOLFSSL_OP_NO_TLSv1_1) {
WOLFSSL_MSG("\tSSL_OP_NO_TLSv1_1");
}
if ((op & SSL_OP_NO_TLSv1) == SSL_OP_NO_TLSv1) {
if ((op & WOLFSSL_OP_NO_TLSv1) == WOLFSSL_OP_NO_TLSv1) {
WOLFSSL_MSG("\tSSL_OP_NO_TLSv1");
}
if ((op & SSL_OP_NO_SSLv3) == SSL_OP_NO_SSLv3) {
if ((op & WOLFSSL_OP_NO_SSLv3) == WOLFSSL_OP_NO_SSLv3) {
WOLFSSL_MSG("\tSSL_OP_NO_SSLv3");
}
@@ -24776,7 +24771,6 @@ static long wolf_set_options(long old_op, long op)
return old_op | op;
}
#endif /* OPENSSL_EXTRA || HAVE_WEBSERVER || WOLFSSL_WPAS_SMALL */
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)
long wolfSSL_set_options(WOLFSSL* ssl, long op)
@@ -43239,6 +43233,77 @@ int wolfSSL_X509_set_ex_data(X509 *x509, int idx, void *data)
#endif /* OPENSSL_EXTRA || WOLFSSL_WPAS_SMALL */
#ifndef NO_ASN
int wolfSSL_X509_check_host(WOLFSSL_X509 *x, const char *chk, size_t chklen,
unsigned int flags, char **peername)
{
int ret;
DecodedCert dCert;
WOLFSSL_ENTER("wolfSSL_X509_check_host");
/* flags and peername not needed for Nginx. */
(void)flags;
(void)peername;
if (flags == WOLFSSL_NO_WILDCARDS) {
WOLFSSL_MSG("X509_CHECK_FLAG_NO_WILDCARDS not yet implemented");
return WOLFSSL_FAILURE;
}
InitDecodedCert(&dCert, x->derCert->buffer, x->derCert->length, NULL);
ret = ParseCertRelative(&dCert, CERT_TYPE, 0, NULL);
if (ret != 0) {
FreeDecodedCert(&dCert);
return WOLFSSL_FAILURE;
}
ret = CheckHostName(&dCert, (char *)chk, chklen);
FreeDecodedCert(&dCert);
if (ret != 0)
return WOLFSSL_FAILURE;
return WOLFSSL_SUCCESS;
}
int wolfSSL_X509_check_ip_asc(WOLFSSL_X509 *x, const char *ipasc,
unsigned int flags)
{
int ret = WOLFSSL_SUCCESS;
DecodedCert dCert;
WOLFSSL_ENTER("wolfSSL_X509_check_ip_asc");
/* flags not yet implemented */
(void)flags;
if ((x == NULL) || (x->derCert == NULL) || (ipasc == NULL)) {
WOLFSSL_MSG("Invalid parameter");
ret = WOLFSSL_FAILURE;
}
if (ret == WOLFSSL_SUCCESS) {
InitDecodedCert(&dCert, x->derCert->buffer, x->derCert->length, NULL);
ret = ParseCertRelative(&dCert, CERT_TYPE, 0, NULL);
if (ret != 0) {
ret = WOLFSSL_FAILURE;
}
else {
ret = CheckIPAddr(&dCert, ipasc);
if (ret != 0) {
ret = WOLFSSL_FAILURE;
}
else {
ret = WOLFSSL_SUCCESS;
}
}
FreeDecodedCert(&dCert);
}
return ret;
}
#endif
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) \
|| defined(OPENSSL_EXTRA) || defined(HAVE_LIGHTY)
@@ -43419,76 +43484,6 @@ WOLFSSL_SESSION *wolfSSL_SSL_get0_session(const WOLFSSL *ssl)
#endif /* NO_SESSION_CACHE */
int wolfSSL_X509_check_host(X509 *x, const char *chk, size_t chklen,
unsigned int flags, char **peername)
{
int ret;
DecodedCert dCert;
WOLFSSL_ENTER("wolfSSL_X509_check_host");
/* flags and peername not needed for Nginx. */
(void)flags;
(void)peername;
if (flags == WOLFSSL_NO_WILDCARDS) {
WOLFSSL_MSG("X509_CHECK_FLAG_NO_WILDCARDS not yet implemented");
return WOLFSSL_FAILURE;
}
InitDecodedCert(&dCert, x->derCert->buffer, x->derCert->length, NULL);
ret = ParseCertRelative(&dCert, CERT_TYPE, 0, NULL);
if (ret != 0) {
FreeDecodedCert(&dCert);
return WOLFSSL_FAILURE;
}
ret = CheckHostName(&dCert, (char *)chk, chklen);
FreeDecodedCert(&dCert);
if (ret != 0)
return WOLFSSL_FAILURE;
return WOLFSSL_SUCCESS;
}
int wolfSSL_X509_check_ip_asc(WOLFSSL_X509 *x, const char *ipasc,
unsigned int flags)
{
int ret = WOLFSSL_SUCCESS;
DecodedCert dCert;
WOLFSSL_ENTER("wolfSSL_X509_check_ip_asc");
/* flags not yet implemented */
(void)flags;
if ((x == NULL) || (x->derCert == NULL) || (ipasc == NULL)) {
WOLFSSL_MSG("Invalid parameter");
ret = WOLFSSL_FAILURE;
}
if (ret == WOLFSSL_SUCCESS) {
InitDecodedCert(&dCert, x->derCert->buffer, x->derCert->length, NULL);
ret = ParseCertRelative(&dCert, CERT_TYPE, 0, NULL);
if (ret != 0) {
ret = WOLFSSL_FAILURE;
}
else {
ret = CheckIPAddr(&dCert, ipasc);
if (ret != 0) {
ret = WOLFSSL_FAILURE;
}
else {
ret = WOLFSSL_SUCCESS;
}
}
FreeDecodedCert(&dCert);
}
return ret;
}
int wolfSSL_i2a_ASN1_INTEGER(BIO *bp, const WOLFSSL_ASN1_INTEGER *a)
{
static char num[16] = { '0', '1', '2', '3', '4', '5', '6', '7',

22
tests/api.c
View File

@@ -4290,8 +4290,8 @@ static void test_wolfSSL_UseMaxFragment(void)
#if defined(HAVE_MAX_FRAGMENT) && !defined(NO_CERTS) && !defined(NO_FILESYSTEM)
#ifndef NO_WOLFSSL_SERVER
WOLFSSL_CTX* ctx = wolfSSL_CTX_new(wolfSSLv23_server_method());
AssertTrue(wolfSSL_CTX_use_certificate_file(ctx, svrCertFile, SSL_FILETYPE_PEM));
AssertTrue(SSL_CTX_use_PrivateKey_file(ctx, svrKeyFile, SSL_FILETYPE_PEM));
AssertTrue(wolfSSL_CTX_use_certificate_file(ctx, svrCertFile, WOLFSSL_FILETYPE_PEM));
AssertTrue(SSL_CTX_use_PrivateKey_file(ctx, svrKeyFile, WOLFSSL_FILETYPE_PEM));
#else
WOLFSSL_CTX* ctx = wolfSSL_CTX_new(wolfSSLv23_client_method());
#endif
@@ -4332,8 +4332,8 @@ static void test_wolfSSL_UseTruncatedHMAC(void)
#if defined(HAVE_TRUNCATED_HMAC) && !defined(NO_CERTS) && !defined(NO_FILESYSTEM)
#ifndef NO_WOLFSSL_SERVER
WOLFSSL_CTX* ctx = wolfSSL_CTX_new(wolfSSLv23_server_method());
AssertTrue(wolfSSL_CTX_use_certificate_file(ctx, svrCertFile, SSL_FILETYPE_PEM));
AssertTrue(SSL_CTX_use_PrivateKey_file(ctx, svrKeyFile, SSL_FILETYPE_PEM));
AssertTrue(wolfSSL_CTX_use_certificate_file(ctx, svrCertFile, WOLFSSL_FILETYPE_PEM));
AssertTrue(SSL_CTX_use_PrivateKey_file(ctx, svrKeyFile, WOLFSSL_FILETYPE_PEM));
#else
WOLFSSL_CTX* ctx = wolfSSL_CTX_new(wolfSSLv23_client_method());
#endif
@@ -10767,7 +10767,7 @@ static int test_wc_InitCmac (void)
if (ret == BAD_FUNC_ARG) {
ret = 0;
} else {
ret = SSL_FATAL_ERROR;
ret = WOLFSSL_FATAL_ERROR;
}
}
@@ -10828,7 +10828,7 @@ static int test_wc_CmacUpdate (void)
if (ret == BAD_FUNC_ARG) {
ret = 0;
} else if (ret == 0) {
ret = SSL_FATAL_ERROR;
ret = WOLFSSL_FATAL_ERROR;
}
}
@@ -10891,7 +10891,7 @@ static int test_wc_CmacFinal (void)
if (ret == 0) {
ret = wc_CmacFinal(&cmac, mac, &macSz);
if (ret == 0 && XMEMCMP(mac, expMac, expMacSz) != 0) {
ret = SSL_FATAL_ERROR;
ret = WOLFSSL_FATAL_ERROR;
}
/* Pass in bad args. */
if (ret == 0) {
@@ -10905,7 +10905,7 @@ static int test_wc_CmacFinal (void)
ret = 0;
}
} else if (ret == 0) {
ret = SSL_FATAL_ERROR;
ret = WOLFSSL_FATAL_ERROR;
}
}
}
@@ -10957,7 +10957,7 @@ static int test_wc_AesCmacGenerate (void)
ret = wc_AesCmacGenerate(mac, &macSz, msg, msgSz, key, keySz);
if (ret == 0 && XMEMCMP(mac, expMac, expMacSz) != 0) {
ret = SSL_FATAL_ERROR;
ret = WOLFSSL_FATAL_ERROR;
}
/* Pass in bad args. */
if (ret == 0) {
@@ -10974,7 +10974,7 @@ static int test_wc_AesCmacGenerate (void)
if (ret == BAD_FUNC_ARG) {
ret = 0;
} else if (ret == 0) {
ret = SSL_FATAL_ERROR;
ret = WOLFSSL_FATAL_ERROR;
}
}
printf(resultFmt, ret == 0 ? passed : failed);
@@ -11001,7 +11001,7 @@ static int test_wc_AesCmacGenerate (void)
if (ret == BAD_FUNC_ARG) {
ret = 0;
} else if (ret == 0) {
ret = SSL_FATAL_ERROR;
ret = WOLFSSL_FATAL_ERROR;
}
}

6
wolfssl/internal.h
View File

@@ -1689,10 +1689,8 @@ WOLFSSL_LOCAL int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
WOLFSSL_LOCAL int MatchDomainName(const char* pattern, int len, const char* str);
#ifndef NO_CERTS
WOLFSSL_LOCAL int CheckAltNames(DecodedCert* dCert, char* domain);
#ifdef OPENSSL_EXTRA
WOLFSSL_LOCAL int CheckIPAddr(DecodedCert* dCert, const char* ipasc);
#endif
#endif
WOLFSSL_LOCAL int CreateTicket(WOLFSSL* ssl);
WOLFSSL_LOCAL int HashOutputRaw(WOLFSSL* ssl, const byte* output, int sz);
WOLFSSL_LOCAL int HashOutput(WOLFSSL* ssl, const byte* output, int sz,
@@ -2705,9 +2703,7 @@ struct WOLFSSL_CTX {
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448)
short minEccKeySz; /* minimum ECC key size */
#endif
#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) || defined(WOLFSSL_WPAS_SMALL)
unsigned long mask; /* store SSL_OP_ flags */
#endif
#ifdef OPENSSL_EXTRA
byte sessionCtx[ID_LEN]; /* app session context ID */
word32 disabledCurves; /* curves disabled by user */
@@ -4243,10 +4239,8 @@ WOLFSSL_API void SSL_ResourceFree(WOLFSSL*); /* Micrium uses */
int type, WOLFSSL* ssl, int userChain,
WOLFSSL_CRL* crl, int verify);
#ifdef OPENSSL_EXTRA
WOLFSSL_LOCAL int CheckHostName(DecodedCert* dCert, const char *domainName,
size_t domainNameLen);
#endif
#endif

16
wolfssl/ssl.h
View File

@@ -521,10 +521,10 @@ struct WOLFSSL_X509_STORE {
#endif
};
#define WOLFSSL_NO_WILDCARDS 0x4
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)
#define WOLFSSL_USE_CHECK_TIME 0x2
#define WOLFSSL_NO_CHECK_TIME 0x200000
#define WOLFSSL_NO_WILDCARDS 0x4
#define WOLFSSL_HOST_NAME_MAX 256
#define WOLFSSL_MAX_IPSTR 46 /* max ip size IPv4 mapped IPv6 */
struct WOLFSSL_X509_VERIFY_PARAM {
@@ -1601,8 +1601,6 @@ enum {
WOLFSSL_CRL_CHECK = 2,
};
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
defined(HAVE_WEBSERVER)
/* Separated out from other enums because of size */
enum {
SSL_OP_MICROSOFT_SESS_ID_BUG = 0x00000001,
@@ -1649,6 +1647,8 @@ enum {
| SSL_OP_TLS_ROLLBACK_BUG),
};
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
defined(HAVE_WEBSERVER)
/* for compatibility these must be macros */
#define SSL_OP_NO_SSLv2 WOLFSSL_OP_NO_SSLv2
#define SSL_OP_NO_SSLv3 WOLFSSL_OP_NO_SSLv3
@@ -3761,10 +3761,6 @@ WOLFSSL_API int wolfSSL_SSL_in_connect_init(WOLFSSL*);
#ifndef NO_SESSION_CACHE
WOLFSSL_API WOLFSSL_SESSION *wolfSSL_SSL_get0_session(const WOLFSSL *s);
#endif
WOLFSSL_API int wolfSSL_X509_check_host(WOLFSSL_X509 *x, const char *chk,
size_t chklen, unsigned int flags, char **peername);
WOLFSSL_API int wolfSSL_X509_check_ip_asc(WOLFSSL_X509 *x, const char *ipasc,
unsigned int flags);
WOLFSSL_API int wolfSSL_i2a_ASN1_INTEGER(WOLFSSL_BIO *bp,
const WOLFSSL_ASN1_INTEGER *a);
@@ -3830,6 +3826,12 @@ WOLFSSL_API void wolfSSL_CTX_set_next_proto_select_cb(WOLFSSL_CTX *s,
WOLFSSL_API void wolfSSL_get0_next_proto_negotiated(const WOLFSSL *s, const unsigned char **data,
unsigned *len);
#ifndef NO_ASN
WOLFSSL_API int wolfSSL_X509_check_host(WOLFSSL_X509 *x, const char *chk,
size_t chklen, unsigned int flags, char **peername);
WOLFSSL_API int wolfSSL_X509_check_ip_asc(WOLFSSL_X509 *x, const char *ipasc,
unsigned int flags);
#endif
#ifdef OPENSSL_EXTRA
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)