wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-29 18:27:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

bind 9.18.0 fixes

Browse Source 
- return `1` from `wolfSSL_BIO_set_mem_eof_return` instead of `0` for success
- bind requires ALPN
- `OPENSSL_COMPATIBLE_DEFAULT` defined for bind
- `WOLFSSL_ERROR_CODE_OPENSSL` defined when using compatibility layer
- return `bio->eof` on no pending data to read in memory BIO (defaults to `WOLFSSL_BIO_ERROR`)
- `flags` is no longer an input parameter in `wolfSSL_ERR_get_error_line_data`
- allow lazy parameter loading in `wolfSSL_DH_set0_key`
- implement reference counter in `WOLFSSL_EC_KEY`
- load serial number from `x509->serialNumber` if `x509->serial` is empty
This commit is contained in:
Juliusz Sosinowicz
2022-03-11 19:57:54 +01:00
parent f71a85d5f9
commit ae9b01c5b8
5 changed files with 130 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
configure.ac
View File

@ -4241,6 +4241,11 @@ AC_ARG_ENABLE([alpn],
[ ENABLED_ALPN=$enableval ],
[ ENABLED_ALPN=no ]
)
if test "$ENABLED_BIND" = "yes"
then
ENABLED_ALPN=yes
fi
if test "x$ENABLED_ALPN" = "xyes"
then
@ -4964,6 +4969,7 @@ then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_BIND -DWOLFSSL_DSA_768_MODULUS"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB -DWOLFSSL_DES_ECB"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA224 -DWOLFSSL_SHA384 -DWOLFSSL_SHA512"
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_COMPATIBLE_DEFAULTS"
ENABLED_SHA224="yes"
ENABLED_SHA384="yes"
ENABLED_SHA512="yes"
@ -7181,7 +7187,7 @@ then
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA -DWOLFSSL_ALWAYS_VERIFY_CB"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_VERIFY_CB_ALL_CERTS -DWOLFSSL_EXTRA_ALERTS"
AM_CFLAGS="$AM_CFLAGS -DHAVE_EXT_CACHE -DWOLFSSL_FORCE_CACHE_ON_TICKET"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AKID_NAME -DHAVE_CTS"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AKID_NAME -DHAVE_CTS -DWOLFSSL_ERROR_CODE_OPENSSL"
fi
if test "$ENABLED_OPENSSLEXTRA" = "x509small"

17
src/bio.c
View File

@ -133,7 +133,12 @@ static int wolfSSL_BIO_MEMORY_read(WOLFSSL_BIO* bio, void* buf, int len)
}
}
else {
return WOLFSSL_BIO_ERROR;
if (bio->eof < 0) /* Sanity check the eof value */
return bio->eof;
else {
WOLFSSL_MSG("Weird bio->eof value. Returning default");
return WOLFSSL_BIO_ERROR;
}
}
return sz;
@ -1583,13 +1588,13 @@ int wolfSSL_BIO_tell(WOLFSSL_BIO* bio)
long wolfSSL_BIO_set_mem_eof_return(WOLFSSL_BIO *bio, int v)
{
WOLFSSL_ENTER("wolfSSL_BIO_set_mem_eof_return");
WOLFSSL_ENTER("wolfSSL_BIO_set_mem_eof_return");
if (bio != NULL) {
if (bio != NULL) {
bio->eof = v;
}
}
return 0;
return WOLFSSL_SUCCESS;
}
int wolfSSL_BIO_get_len(WOLFSSL_BIO *bio)
@ -2467,6 +2472,8 @@ int wolfSSL_BIO_flush(WOLFSSL_BIO* bio)
bio->shutdown = BIO_CLOSE; /* default to close things */
bio->num = WOLFSSL_BIO_ERROR;
bio->init = 1;
if (method->type == WOLFSSL_BIO_MEMORY)
bio->eof = WOLFSSL_BIO_ERROR; /* Return value for empty buffer */
if (method->type == WOLFSSL_BIO_MEMORY ||
method->type == WOLFSSL_BIO_BIO) {
bio->mem_buf =(WOLFSSL_BUF_MEM*)XMALLOC(sizeof(WOLFSSL_BUF_MEM),

84
src/ssl.c
View File

@ -20872,7 +20872,7 @@ size_t wolfSSL_get_client_random(const WOLFSSL* ssl, unsigned char* out,
* file output pointer to file where error happened
* line output to line number of error
* data output data. Is a string if ERR_TXT_STRING flag is used
* flags bit flag to adjust data output
* flags output format of output
*
* Returns the error value or 0 if no errors are in the queue
*/
@ -20884,24 +20884,10 @@ size_t wolfSSL_get_client_random(const WOLFSSL* ssl, unsigned char* out,
WOLFSSL_ENTER("wolfSSL_ERR_get_error_line_data");
if (flags != NULL) {
if ((*flags & ERR_TXT_STRING) == ERR_TXT_STRING) {
ret = wc_PullErrorNode(file, data, line);
if (ret < 0) {
if (ret == BAD_STATE_E) return 0; /* no errors in queue */
WOLFSSL_MSG("Error with pulling error node!");
WOLFSSL_LEAVE("wolfSSL_ERR_get_error_line_data", ret);
ret = 0 - ret; /* return absolute value of error */
if (flags != NULL)
*flags = ERR_TXT_STRING; /* Clear the flags */
/* panic and try to clear out nodes */
wc_ClearErrorNodes();
}
return (unsigned long)ret;
}
}
ret = wc_PullErrorNode(file, NULL, line);
ret = wc_PullErrorNode(file, data, line);
if (ret < 0) {
if (ret == BAD_STATE_E) return 0; /* no errors in queue */
WOLFSSL_MSG("Error with pulling error node!");
@ -34998,7 +34984,10 @@ int wolfSSL_DH_set0_key(WOLFSSL_DH *dh, WOLFSSL_BIGNUM *pub_key,
dh->priv_key = priv_key;
}
return SetDhInternal(dh);
if (dh->p == NULL || dh->g == NULL)
return WOLFSSL_SUCCESS; /* Allow loading parameters afterwards */
else
return SetDhInternal(dh);
}
/* See RFC 5114 section 2.3, "2048-bit MODP Group with 256-bit Prime Order
@ -38992,11 +38981,13 @@ void wolfSSL_EC_KEY_free(WOLFSSL_EC_KEY *key)
WOLFSSL_ENTER("wolfSSL_EC_KEY_free");
if (key != NULL) {
int doFree = 0;
void* heap = key->heap;
#ifndef SINGLE_THREADED
if (wc_LockMutex(&key->refMutex) != 0) {
WOLFSSL_MSG("Could not lock EC_KEY mutex");
return;
}
#endif
@ -39017,14 +39008,30 @@ void wolfSSL_EC_KEY_free(WOLFSSL_EC_KEY *key)
wc_ecc_free((ecc_key*)key->internal);
XFREE(key->internal, heap, DYNAMIC_TYPE_ECC);
}
wolfSSL_BN_free(key->priv_key);
wolfSSL_EC_POINT_free(key->pub_key);
wolfSSL_EC_GROUP_free(key->group);
InitwolfSSL_ECKey(key); /* set back to NULLs for safety */
#endif
/* only free if all references to it are done */
key->refCount--;
if (key->refCount == 0) {
doFree = 1;
}
#ifndef SINGLE_THREADED
wc_UnLockMutex(&key->refMutex);
#endif
XFREE(key, heap, DYNAMIC_TYPE_ECC);
(void)heap;
/* key = NULL, don't try to access or double free it */
if (doFree) {
if (key->internal != NULL) {
wc_ecc_free((ecc_key*)key->internal);
XFREE(key->internal, heap, DYNAMIC_TYPE_ECC);
}
wolfSSL_BN_free(key->priv_key);
wolfSSL_EC_POINT_free(key->pub_key);
wolfSSL_EC_GROUP_free(key->group);
InitwolfSSL_ECKey(key); /* set back to NULLs for safety */
XFREE(key, heap, DYNAMIC_TYPE_ECC);
(void)heap;
/* key = NULL, don't try to access or double free it */
}
}
}
@ -39964,6 +39971,13 @@ int wolfSSL_i2o_ECPublicKey(const WOLFSSL_EC_KEY *in, unsigned char **out)
return WOLFSSL_FAILURE;
}
if (!in->exSet) {
if (SetECKeyExternal((WOLFSSL_EC_KEY*)in) != WOLFSSL_SUCCESS) {
WOLFSSL_MSG("SetECKeyExternal failure");
return WOLFSSL_FAILURE;
}
}
#ifdef HAVE_COMP_KEY
/* Default to compressed form if not set */
form = in->form == POINT_CONVERSION_UNCOMPRESSED ?
@ -44296,6 +44310,17 @@ void* wolfSSL_GetHKDFExtractCtx(WOLFSSL* ssl)
XMEMCPY(cert->challengePw, x509->challengePw, CTC_NAME_SIZE);
#endif
if (x509->serialSz == 0 && x509->serialNumber != NULL &&
/* Check if the buffer contains more than just the
* ASN tag and length */
x509->serialNumber->length > 2) {
if (wolfSSL_X509_set_serialNumber(x509, x509->serialNumber)
!= WOLFSSL_SUCCESS) {
WOLFSSL_MSG("Failed to set serial number");
return WOLFSSL_FAILURE;
}
}
/* set serial number */
if (x509->serialSz > 0) {
#if defined(OPENSSL_EXTRA)
@ -56602,6 +56627,7 @@ void wolfSSL_RSA_free(WOLFSSL_RSA* rsa)
#ifndef SINGLE_THREADED
if (wc_LockMutex(&rsa->refMutex) != 0) {
WOLFSSL_MSG("Couldn't lock rsa mutex");
return;
}
#endif
@ -57242,8 +57268,10 @@ int wolfSSL_X509_set_serialNumber(WOLFSSL_X509* x509, WOLFSSL_ASN1_INTEGER* s)
if (!x509 || !s || s->length >= EXTERNAL_SERIAL_SIZE)
return WOLFSSL_FAILURE;
/* WOLFSSL_ASN1_INTEGER has type | size | data */
if (s->length < 3) {
/* WOLFSSL_ASN1_INTEGER has type | size | data
* Sanity check that the data is actually in ASN format */
if (s->length < 3 && s->data[0] != ASN_INTEGER &&
s->data[1] != s->length - 2) {
return WOLFSSL_FAILURE;
}
XMEMCPY(x509->serial, s->data + 2, s->length - 2);

131
wolfcrypt/src/evp.c
View File

@ -6731,6 +6731,41 @@ const WOLFSSL_EVP_MD* wolfSSL_EVP_get_digestbynid(int id)
return NULL;
}
static void clearEVPPkeyKeys(WOLFSSL_EVP_PKEY *pkey)
{
if(pkey == NULL)
return;
WOLFSSL_ENTER("clearEVPPkeyKeys");
#ifndef NO_RSA
if (pkey->rsa != NULL && pkey->ownRsa == 1) {
wolfSSL_RSA_free(pkey->rsa);
pkey->rsa = NULL;
}
pkey->ownRsa = 0;
#endif
#ifndef NO_DSA
if (pkey->dsa != NULL && pkey->ownDsa == 1) {
wolfSSL_DSA_free(pkey->dsa);
pkey->dsa = NULL;
}
pkey->ownDsa = 0;
#endif
#ifndef NO_DH
if (pkey->dh != NULL && pkey->ownDh == 1) {
wolfSSL_DH_free(pkey->dh);
pkey->dh = NULL;
}
pkey->ownDh = 0;
#endif
#ifdef HAVE_ECC
if (pkey->ecc != NULL && pkey->ownEcc == 1) {
wolfSSL_EC_KEY_free(pkey->ecc);
pkey->ecc = NULL;
}
pkey->ownEcc = 0;
#endif
}
#ifndef NO_RSA
#if defined(WOLFSSL_KEY_GEN) && !defined(HAVE_USER_RSA)
static int PopulateRSAEvpPkeyDer(WOLFSSL_EVP_PKEY *pkey)
@ -6779,7 +6814,7 @@ static int PopulateRSAEvpPkeyDer(WOLFSSL_EVP_PKEY *pkey)
derBuf = (byte*)XREALLOC(pkey->pkey.ptr, derSz,
pkey->heap, DYNAMIC_TYPE_DER);
if (derBuf == NULL) {
WOLFSSL_MSG("EVP_PKEY_set1_RSA malloc failed");
WOLFSSL_MSG("PopulateRSAEvpPkeyDer malloc failed");
return WOLFSSL_FAILURE;
}
/* Old pointer is invalid from this point on */
@ -6866,9 +6901,7 @@ int wolfSSL_EVP_PKEY_set1_RSA(WOLFSSL_EVP_PKEY *pkey, WOLFSSL_RSA *key)
return WOLFSSL_FAILURE;
}
if (pkey->rsa != NULL && pkey->ownRsa == 1) {
wolfSSL_RSA_free(pkey->rsa);
}
clearEVPPkeyKeys(pkey);
pkey->rsa = key;
pkey->ownRsa = 1; /* pkey does not own RSA but needs to call free on it */
pkey->type = EVP_PKEY_RSA;
@ -6914,9 +6947,7 @@ int wolfSSL_EVP_PKEY_set1_DSA(WOLFSSL_EVP_PKEY *pkey, WOLFSSL_DSA *key)
WOLFSSL_ENTER("wolfSSL_EVP_PKEY_set1_DSA");
if((pkey == NULL) || (key == NULL))return WOLFSSL_FAILURE;
if (pkey->dsa != NULL && pkey->ownDsa == 1) {
wolfSSL_DSA_free(pkey->dsa);
}
clearEVPPkeyKeys(pkey);
pkey->dsa = key;
pkey->ownDsa = 0; /* pkey does not own DSA */
pkey->type = EVP_PKEY_DSA;
@ -7020,7 +7051,7 @@ WOLFSSL_DSA* wolfSSL_EVP_PKEY_get1_DSA(WOLFSSL_EVP_PKEY* key)
WOLFSSL_EC_KEY *wolfSSL_EVP_PKEY_get0_EC_KEY(WOLFSSL_EVP_PKEY *pkey)
{
WOLFSSL_EC_KEY *eckey = NULL;
if (pkey) {
if (pkey && pkey->type == EVP_PKEY_EC) {
#ifdef HAVE_ECC
eckey = pkey->ecc;
#endif
@ -7030,10 +7061,9 @@ WOLFSSL_EC_KEY *wolfSSL_EVP_PKEY_get0_EC_KEY(WOLFSSL_EVP_PKEY *pkey)
WOLFSSL_EC_KEY* wolfSSL_EVP_PKEY_get1_EC_KEY(WOLFSSL_EVP_PKEY* key)
{
WOLFSSL_EC_KEY* local = NULL;
WOLFSSL_ENTER("wolfSSL_EVP_PKEY_get1_EC_KEY");
if (key == NULL) {
if (key == NULL || key->type != EVP_PKEY_EC) {
return NULL;
}
if (key->type == EVP_PKEY_EC) {
@ -7050,27 +7080,12 @@ WOLFSSL_EC_KEY* wolfSSL_EVP_PKEY_get1_EC_KEY(WOLFSSL_EVP_PKEY* key)
return NULL;
}
if (wolfSSL_EC_KEY_LoadDer(local,
(const unsigned char*)key->pkey.ptr,
key->pkey_sz) != WOLFSSL_SUCCESS) {
/* now try public key */
if (wolfSSL_EC_KEY_LoadDer_ex(local,
(const unsigned char*)key->pkey.ptr, key->pkey_sz,
WOLFSSL_EC_KEY_LOAD_PUBLIC) != WOLFSSL_SUCCESS) {
wolfSSL_EC_KEY_free(local);
local = NULL;
}
}
}
}
else {
WOLFSSL_MSG("WOLFSSL_EVP_PKEY does not hold an EC key");
wolfSSL_EC_KEY_free(local);
local = NULL;
if (wolfSSL_EC_KEY_up_ref(key->ecc) != WOLFSSL_SUCCESS) {
WOLFSSL_MSG("wolfSSL_EC_KEY_up_ref error");
return NULL;
}
return local;
return key->ecc;
}
#endif /* HAVE_ECC */
@ -7095,33 +7110,7 @@ int wolfSSL_EVP_PKEY_set1_DH(WOLFSSL_EVP_PKEY *pkey, WOLFSSL_DH *key)
if (pkey == NULL || key == NULL)
return WOLFSSL_FAILURE;
/* free other types if needed */
#ifndef NO_RSA
if (pkey->rsa != NULL && pkey->ownRsa == 1) {
wolfSSL_RSA_free(pkey->rsa);
}
pkey->ownRsa = 0;
#endif
#ifndef NO_DSA
if (pkey->dsa != NULL && pkey->ownDsa == 1) {
wolfSSL_DSA_free(pkey->dsa);
}
pkey->ownDsa = 0;
#endif
#ifdef HAVE_ECC
if (pkey->ecc != NULL && pkey->ownEcc == 1) {
wolfSSL_EC_KEY_free(pkey->ecc);
}
pkey->ownEcc = 0;
#endif
if (wolfSSL_DH_up_ref(key) != WOLFSSL_SUCCESS) {
WOLFSSL_MSG("wolfSSL_DH_up_ref failed");
return WOLFSSL_FAILURE;
}
if (pkey->dh != NULL && pkey->ownDh == 1)
wolfSSL_DH_free(pkey->dh);
clearEVPPkeyKeys(pkey);
pkey->dh = key;
pkey->ownDh = 1; /* pkey does not own DH but needs to call free on it */
@ -7358,39 +7347,13 @@ int wolfSSL_EVP_PKEY_set1_EC_KEY(WOLFSSL_EVP_PKEY *pkey, WOLFSSL_EC_KEY *key)
{
#ifdef HAVE_ECC
WOLFSSL_ENTER("wolfSSL_EVP_PKEY_set1_EC_KEY");
if (pkey == NULL || key == NULL) {
return WOLFSSL_FAILURE;
}
#ifndef NO_RSA
if (pkey->rsa != NULL && pkey->ownRsa == 1) {
wolfSSL_RSA_free(pkey->rsa);
}
pkey->ownRsa = 0;
#endif
#ifndef NO_DSA
if (pkey->dsa != NULL && pkey->ownDsa == 1) {
wolfSSL_DSA_free(pkey->dsa);
}
pkey->ownDsa = 0;
#endif
#ifndef NO_DH
if (pkey->dh != NULL && pkey->ownDh == 1) {
wolfSSL_DH_free(pkey->dh);
}
pkey->ownDh = 0;
#endif
clearEVPPkeyKeys(pkey);
if (wolfSSL_EC_KEY_up_ref(key) != WOLFSSL_SUCCESS) {
WOLFSSL_MSG("wolfSSL_EC_KEY_up_ref failed");
return WOLFSSL_FAILURE;
}
if (pkey->ecc != NULL && pkey->ownEcc == 1) {
wolfSSL_EC_KEY_free(pkey->ecc);
}
pkey->ecc = key;
pkey->ownEcc = 1; /* doesn't own EC_KEY but needs to call free on it */
pkey->ownEcc = 1; /* pkey needs to call free on key */
pkey->type = EVP_PKEY_EC;
return ECC_populate_EVP_PKEY(pkey, key);
#else

8
wolfssl/openssl/ec.h
View File

@ -127,6 +127,11 @@ struct WOLFSSL_EC_KEY {
/* option bits */
byte inSet:1; /* internal set from external ? */
byte exSet:1; /* external set from internal ? */
#ifndef SINGLE_THREADED
wolfSSL_Mutex refMutex; /* ref count mutex */
#endif
int refCount; /* reference count */
};
struct WOLFSSL_EC_BUILTIN_CURVE {
@ -209,6 +214,8 @@ WOLFSSL_EC_KEY *wolfSSL_EC_KEY_new_ex(void* heap, int devId);
WOLFSSL_API
WOLFSSL_EC_KEY *wolfSSL_EC_KEY_new(void);
WOLFSSL_API
int wolfSSL_EC_KEY_up_ref(WOLFSSL_EC_KEY* key);
WOLFSSL_API
int wolfSSL_EC_KEY_set_group(WOLFSSL_EC_KEY *key, WOLFSSL_EC_GROUP *group);
WOLFSSL_API
int wolfSSL_EC_KEY_generate_key(WOLFSSL_EC_KEY *key);
@ -312,6 +319,7 @@ typedef WOLFSSL_EC_BUILTIN_CURVE EC_builtin_curve;
#define EC_KEY_new wolfSSL_EC_KEY_new
#define EC_KEY_free wolfSSL_EC_KEY_free
#define EC_KEY_up_ref wolfSSL_EC_KEY_up_ref
#define EC_KEY_dup wolfSSL_EC_KEY_dup
#define EC_KEY_up_ref wolfSSL_EC_KEY_up_ref
#define EC_KEY_get0_public_key wolfSSL_EC_KEY_get0_public_key