diff --git a/configure.ac b/configure.ac index 668dd2f31..1b4c6e998 100644 --- a/configure.ac +++ b/configure.ac @@ -4241,6 +4241,11 @@ AC_ARG_ENABLE([alpn], [ ENABLED_ALPN=$enableval ], [ ENABLED_ALPN=no ] ) + +if test "$ENABLED_BIND" = "yes" +then + ENABLED_ALPN=yes +fi if test "x$ENABLED_ALPN" = "xyes" then @@ -4964,6 +4969,7 @@ then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_BIND -DWOLFSSL_DSA_768_MODULUS" AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB -DWOLFSSL_DES_ECB" AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA224 -DWOLFSSL_SHA384 -DWOLFSSL_SHA512" + AM_CFLAGS="$AM_CFLAGS -DOPENSSL_COMPATIBLE_DEFAULTS" ENABLED_SHA224="yes" ENABLED_SHA384="yes" ENABLED_SHA512="yes" @@ -7181,7 +7187,7 @@ then AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA -DWOLFSSL_ALWAYS_VERIFY_CB" AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_VERIFY_CB_ALL_CERTS -DWOLFSSL_EXTRA_ALERTS" AM_CFLAGS="$AM_CFLAGS -DHAVE_EXT_CACHE -DWOLFSSL_FORCE_CACHE_ON_TICKET" - AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AKID_NAME -DHAVE_CTS" + AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AKID_NAME -DHAVE_CTS -DWOLFSSL_ERROR_CODE_OPENSSL" fi if test "$ENABLED_OPENSSLEXTRA" = "x509small" diff --git a/src/bio.c b/src/bio.c index 5c832a674..af989e8b3 100644 --- a/src/bio.c +++ b/src/bio.c @@ -133,7 +133,12 @@ static int wolfSSL_BIO_MEMORY_read(WOLFSSL_BIO* bio, void* buf, int len) } } else { - return WOLFSSL_BIO_ERROR; + if (bio->eof < 0) /* Sanity check the eof value */ + return bio->eof; + else { + WOLFSSL_MSG("Weird bio->eof value. Returning default"); + return WOLFSSL_BIO_ERROR; + } } return sz; @@ -1583,13 +1588,13 @@ int wolfSSL_BIO_tell(WOLFSSL_BIO* bio) long wolfSSL_BIO_set_mem_eof_return(WOLFSSL_BIO *bio, int v) { - WOLFSSL_ENTER("wolfSSL_BIO_set_mem_eof_return"); + WOLFSSL_ENTER("wolfSSL_BIO_set_mem_eof_return"); - if (bio != NULL) { + if (bio != NULL) { bio->eof = v; - } + } - return 0; + return WOLFSSL_SUCCESS; } int wolfSSL_BIO_get_len(WOLFSSL_BIO *bio) @@ -2467,6 +2472,8 @@ int wolfSSL_BIO_flush(WOLFSSL_BIO* bio) bio->shutdown = BIO_CLOSE; /* default to close things */ bio->num = WOLFSSL_BIO_ERROR; bio->init = 1; + if (method->type == WOLFSSL_BIO_MEMORY) + bio->eof = WOLFSSL_BIO_ERROR; /* Return value for empty buffer */ if (method->type == WOLFSSL_BIO_MEMORY || method->type == WOLFSSL_BIO_BIO) { bio->mem_buf =(WOLFSSL_BUF_MEM*)XMALLOC(sizeof(WOLFSSL_BUF_MEM), diff --git a/src/ssl.c b/src/ssl.c index 773c5ae05..31b5bbb8d 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -20872,7 +20872,7 @@ size_t wolfSSL_get_client_random(const WOLFSSL* ssl, unsigned char* out, * file output pointer to file where error happened * line output to line number of error * data output data. Is a string if ERR_TXT_STRING flag is used - * flags bit flag to adjust data output + * flags output format of output * * Returns the error value or 0 if no errors are in the queue */ @@ -20884,24 +20884,10 @@ size_t wolfSSL_get_client_random(const WOLFSSL* ssl, unsigned char* out, WOLFSSL_ENTER("wolfSSL_ERR_get_error_line_data"); - if (flags != NULL) { - if ((*flags & ERR_TXT_STRING) == ERR_TXT_STRING) { - ret = wc_PullErrorNode(file, data, line); - if (ret < 0) { - if (ret == BAD_STATE_E) return 0; /* no errors in queue */ - WOLFSSL_MSG("Error with pulling error node!"); - WOLFSSL_LEAVE("wolfSSL_ERR_get_error_line_data", ret); - ret = 0 - ret; /* return absolute value of error */ + if (flags != NULL) + *flags = ERR_TXT_STRING; /* Clear the flags */ - /* panic and try to clear out nodes */ - wc_ClearErrorNodes(); - } - - return (unsigned long)ret; - } - } - - ret = wc_PullErrorNode(file, NULL, line); + ret = wc_PullErrorNode(file, data, line); if (ret < 0) { if (ret == BAD_STATE_E) return 0; /* no errors in queue */ WOLFSSL_MSG("Error with pulling error node!"); @@ -34998,7 +34984,10 @@ int wolfSSL_DH_set0_key(WOLFSSL_DH *dh, WOLFSSL_BIGNUM *pub_key, dh->priv_key = priv_key; } - return SetDhInternal(dh); + if (dh->p == NULL || dh->g == NULL) + return WOLFSSL_SUCCESS; /* Allow loading parameters afterwards */ + else + return SetDhInternal(dh); } /* See RFC 5114 section 2.3, "2048-bit MODP Group with 256-bit Prime Order @@ -38992,11 +38981,13 @@ void wolfSSL_EC_KEY_free(WOLFSSL_EC_KEY *key) WOLFSSL_ENTER("wolfSSL_EC_KEY_free"); if (key != NULL) { + int doFree = 0; void* heap = key->heap; #ifndef SINGLE_THREADED if (wc_LockMutex(&key->refMutex) != 0) { WOLFSSL_MSG("Could not lock EC_KEY mutex"); + return; } #endif @@ -39017,14 +39008,30 @@ void wolfSSL_EC_KEY_free(WOLFSSL_EC_KEY *key) wc_ecc_free((ecc_key*)key->internal); XFREE(key->internal, heap, DYNAMIC_TYPE_ECC); } - wolfSSL_BN_free(key->priv_key); - wolfSSL_EC_POINT_free(key->pub_key); - wolfSSL_EC_GROUP_free(key->group); - InitwolfSSL_ECKey(key); /* set back to NULLs for safety */ +#endif + /* only free if all references to it are done */ + key->refCount--; + if (key->refCount == 0) { + doFree = 1; + } +#ifndef SINGLE_THREADED + wc_UnLockMutex(&key->refMutex); +#endif - XFREE(key, heap, DYNAMIC_TYPE_ECC); - (void)heap; - /* key = NULL, don't try to access or double free it */ + if (doFree) { + if (key->internal != NULL) { + wc_ecc_free((ecc_key*)key->internal); + XFREE(key->internal, heap, DYNAMIC_TYPE_ECC); + } + wolfSSL_BN_free(key->priv_key); + wolfSSL_EC_POINT_free(key->pub_key); + wolfSSL_EC_GROUP_free(key->group); + InitwolfSSL_ECKey(key); /* set back to NULLs for safety */ + + XFREE(key, heap, DYNAMIC_TYPE_ECC); + (void)heap; + /* key = NULL, don't try to access or double free it */ + } } } @@ -39964,6 +39971,13 @@ int wolfSSL_i2o_ECPublicKey(const WOLFSSL_EC_KEY *in, unsigned char **out) return WOLFSSL_FAILURE; } + if (!in->exSet) { + if (SetECKeyExternal((WOLFSSL_EC_KEY*)in) != WOLFSSL_SUCCESS) { + WOLFSSL_MSG("SetECKeyExternal failure"); + return WOLFSSL_FAILURE; + } + } + #ifdef HAVE_COMP_KEY /* Default to compressed form if not set */ form = in->form == POINT_CONVERSION_UNCOMPRESSED ? @@ -44296,6 +44310,17 @@ void* wolfSSL_GetHKDFExtractCtx(WOLFSSL* ssl) XMEMCPY(cert->challengePw, x509->challengePw, CTC_NAME_SIZE); #endif + if (x509->serialSz == 0 && x509->serialNumber != NULL && + /* Check if the buffer contains more than just the + * ASN tag and length */ + x509->serialNumber->length > 2) { + if (wolfSSL_X509_set_serialNumber(x509, x509->serialNumber) + != WOLFSSL_SUCCESS) { + WOLFSSL_MSG("Failed to set serial number"); + return WOLFSSL_FAILURE; + } + } + /* set serial number */ if (x509->serialSz > 0) { #if defined(OPENSSL_EXTRA) @@ -56602,6 +56627,7 @@ void wolfSSL_RSA_free(WOLFSSL_RSA* rsa) #ifndef SINGLE_THREADED if (wc_LockMutex(&rsa->refMutex) != 0) { WOLFSSL_MSG("Couldn't lock rsa mutex"); + return; } #endif @@ -57242,8 +57268,10 @@ int wolfSSL_X509_set_serialNumber(WOLFSSL_X509* x509, WOLFSSL_ASN1_INTEGER* s) if (!x509 || !s || s->length >= EXTERNAL_SERIAL_SIZE) return WOLFSSL_FAILURE; - /* WOLFSSL_ASN1_INTEGER has type | size | data */ - if (s->length < 3) { + /* WOLFSSL_ASN1_INTEGER has type | size | data + * Sanity check that the data is actually in ASN format */ + if (s->length < 3 && s->data[0] != ASN_INTEGER && + s->data[1] != s->length - 2) { return WOLFSSL_FAILURE; } XMEMCPY(x509->serial, s->data + 2, s->length - 2); diff --git a/wolfcrypt/src/evp.c b/wolfcrypt/src/evp.c index 864b468aa..39d306d09 100644 --- a/wolfcrypt/src/evp.c +++ b/wolfcrypt/src/evp.c @@ -6731,6 +6731,41 @@ const WOLFSSL_EVP_MD* wolfSSL_EVP_get_digestbynid(int id) return NULL; } +static void clearEVPPkeyKeys(WOLFSSL_EVP_PKEY *pkey) +{ + if(pkey == NULL) + return; + WOLFSSL_ENTER("clearEVPPkeyKeys"); +#ifndef NO_RSA + if (pkey->rsa != NULL && pkey->ownRsa == 1) { + wolfSSL_RSA_free(pkey->rsa); + pkey->rsa = NULL; + } + pkey->ownRsa = 0; +#endif +#ifndef NO_DSA + if (pkey->dsa != NULL && pkey->ownDsa == 1) { + wolfSSL_DSA_free(pkey->dsa); + pkey->dsa = NULL; + } + pkey->ownDsa = 0; +#endif +#ifndef NO_DH + if (pkey->dh != NULL && pkey->ownDh == 1) { + wolfSSL_DH_free(pkey->dh); + pkey->dh = NULL; + } + pkey->ownDh = 0; +#endif +#ifdef HAVE_ECC + if (pkey->ecc != NULL && pkey->ownEcc == 1) { + wolfSSL_EC_KEY_free(pkey->ecc); + pkey->ecc = NULL; + } + pkey->ownEcc = 0; +#endif +} + #ifndef NO_RSA #if defined(WOLFSSL_KEY_GEN) && !defined(HAVE_USER_RSA) static int PopulateRSAEvpPkeyDer(WOLFSSL_EVP_PKEY *pkey) @@ -6779,7 +6814,7 @@ static int PopulateRSAEvpPkeyDer(WOLFSSL_EVP_PKEY *pkey) derBuf = (byte*)XREALLOC(pkey->pkey.ptr, derSz, pkey->heap, DYNAMIC_TYPE_DER); if (derBuf == NULL) { - WOLFSSL_MSG("EVP_PKEY_set1_RSA malloc failed"); + WOLFSSL_MSG("PopulateRSAEvpPkeyDer malloc failed"); return WOLFSSL_FAILURE; } /* Old pointer is invalid from this point on */ @@ -6866,9 +6901,7 @@ int wolfSSL_EVP_PKEY_set1_RSA(WOLFSSL_EVP_PKEY *pkey, WOLFSSL_RSA *key) return WOLFSSL_FAILURE; } - if (pkey->rsa != NULL && pkey->ownRsa == 1) { - wolfSSL_RSA_free(pkey->rsa); - } + clearEVPPkeyKeys(pkey); pkey->rsa = key; pkey->ownRsa = 1; /* pkey does not own RSA but needs to call free on it */ pkey->type = EVP_PKEY_RSA; @@ -6914,9 +6947,7 @@ int wolfSSL_EVP_PKEY_set1_DSA(WOLFSSL_EVP_PKEY *pkey, WOLFSSL_DSA *key) WOLFSSL_ENTER("wolfSSL_EVP_PKEY_set1_DSA"); if((pkey == NULL) || (key == NULL))return WOLFSSL_FAILURE; - if (pkey->dsa != NULL && pkey->ownDsa == 1) { - wolfSSL_DSA_free(pkey->dsa); - } + clearEVPPkeyKeys(pkey); pkey->dsa = key; pkey->ownDsa = 0; /* pkey does not own DSA */ pkey->type = EVP_PKEY_DSA; @@ -7020,7 +7051,7 @@ WOLFSSL_DSA* wolfSSL_EVP_PKEY_get1_DSA(WOLFSSL_EVP_PKEY* key) WOLFSSL_EC_KEY *wolfSSL_EVP_PKEY_get0_EC_KEY(WOLFSSL_EVP_PKEY *pkey) { WOLFSSL_EC_KEY *eckey = NULL; - if (pkey) { + if (pkey && pkey->type == EVP_PKEY_EC) { #ifdef HAVE_ECC eckey = pkey->ecc; #endif @@ -7030,10 +7061,9 @@ WOLFSSL_EC_KEY *wolfSSL_EVP_PKEY_get0_EC_KEY(WOLFSSL_EVP_PKEY *pkey) WOLFSSL_EC_KEY* wolfSSL_EVP_PKEY_get1_EC_KEY(WOLFSSL_EVP_PKEY* key) { - WOLFSSL_EC_KEY* local = NULL; WOLFSSL_ENTER("wolfSSL_EVP_PKEY_get1_EC_KEY"); - if (key == NULL) { + if (key == NULL || key->type != EVP_PKEY_EC) { return NULL; } if (key->type == EVP_PKEY_EC) { @@ -7050,27 +7080,12 @@ WOLFSSL_EC_KEY* wolfSSL_EVP_PKEY_get1_EC_KEY(WOLFSSL_EVP_PKEY* key) return NULL; } - if (wolfSSL_EC_KEY_LoadDer(local, - (const unsigned char*)key->pkey.ptr, - key->pkey_sz) != WOLFSSL_SUCCESS) { - /* now try public key */ - if (wolfSSL_EC_KEY_LoadDer_ex(local, - (const unsigned char*)key->pkey.ptr, key->pkey_sz, - WOLFSSL_EC_KEY_LOAD_PUBLIC) != WOLFSSL_SUCCESS) { - - wolfSSL_EC_KEY_free(local); - local = NULL; - } - } - } - } - else { - WOLFSSL_MSG("WOLFSSL_EVP_PKEY does not hold an EC key"); - wolfSSL_EC_KEY_free(local); - local = NULL; + if (wolfSSL_EC_KEY_up_ref(key->ecc) != WOLFSSL_SUCCESS) { + WOLFSSL_MSG("wolfSSL_EC_KEY_up_ref error"); + return NULL; } - return local; + return key->ecc; } #endif /* HAVE_ECC */ @@ -7095,33 +7110,7 @@ int wolfSSL_EVP_PKEY_set1_DH(WOLFSSL_EVP_PKEY *pkey, WOLFSSL_DH *key) if (pkey == NULL || key == NULL) return WOLFSSL_FAILURE; - /* free other types if needed */ -#ifndef NO_RSA - if (pkey->rsa != NULL && pkey->ownRsa == 1) { - wolfSSL_RSA_free(pkey->rsa); - } - pkey->ownRsa = 0; -#endif -#ifndef NO_DSA - if (pkey->dsa != NULL && pkey->ownDsa == 1) { - wolfSSL_DSA_free(pkey->dsa); - } - pkey->ownDsa = 0; -#endif -#ifdef HAVE_ECC - if (pkey->ecc != NULL && pkey->ownEcc == 1) { - wolfSSL_EC_KEY_free(pkey->ecc); - } - pkey->ownEcc = 0; -#endif - - if (wolfSSL_DH_up_ref(key) != WOLFSSL_SUCCESS) { - WOLFSSL_MSG("wolfSSL_DH_up_ref failed"); - return WOLFSSL_FAILURE; - } - - if (pkey->dh != NULL && pkey->ownDh == 1) - wolfSSL_DH_free(pkey->dh); + clearEVPPkeyKeys(pkey); pkey->dh = key; pkey->ownDh = 1; /* pkey does not own DH but needs to call free on it */ @@ -7358,39 +7347,13 @@ int wolfSSL_EVP_PKEY_set1_EC_KEY(WOLFSSL_EVP_PKEY *pkey, WOLFSSL_EC_KEY *key) { #ifdef HAVE_ECC WOLFSSL_ENTER("wolfSSL_EVP_PKEY_set1_EC_KEY"); - - if (pkey == NULL || key == NULL) { - return WOLFSSL_FAILURE; - } -#ifndef NO_RSA - if (pkey->rsa != NULL && pkey->ownRsa == 1) { - wolfSSL_RSA_free(pkey->rsa); - } - pkey->ownRsa = 0; -#endif -#ifndef NO_DSA - if (pkey->dsa != NULL && pkey->ownDsa == 1) { - wolfSSL_DSA_free(pkey->dsa); - } - pkey->ownDsa = 0; -#endif -#ifndef NO_DH - if (pkey->dh != NULL && pkey->ownDh == 1) { - wolfSSL_DH_free(pkey->dh); - } - pkey->ownDh = 0; -#endif - + clearEVPPkeyKeys(pkey); if (wolfSSL_EC_KEY_up_ref(key) != WOLFSSL_SUCCESS) { WOLFSSL_MSG("wolfSSL_EC_KEY_up_ref failed"); return WOLFSSL_FAILURE; } - - if (pkey->ecc != NULL && pkey->ownEcc == 1) { - wolfSSL_EC_KEY_free(pkey->ecc); - } pkey->ecc = key; - pkey->ownEcc = 1; /* doesn't own EC_KEY but needs to call free on it */ + pkey->ownEcc = 1; /* pkey needs to call free on key */ pkey->type = EVP_PKEY_EC; return ECC_populate_EVP_PKEY(pkey, key); #else diff --git a/wolfssl/openssl/ec.h b/wolfssl/openssl/ec.h index fa0ac7a6b..6c57fc7c6 100644 --- a/wolfssl/openssl/ec.h +++ b/wolfssl/openssl/ec.h @@ -127,6 +127,11 @@ struct WOLFSSL_EC_KEY { /* option bits */ byte inSet:1; /* internal set from external ? */ byte exSet:1; /* external set from internal ? */ + +#ifndef SINGLE_THREADED + wolfSSL_Mutex refMutex; /* ref count mutex */ +#endif + int refCount; /* reference count */ }; struct WOLFSSL_EC_BUILTIN_CURVE { @@ -209,6 +214,8 @@ WOLFSSL_EC_KEY *wolfSSL_EC_KEY_new_ex(void* heap, int devId); WOLFSSL_API WOLFSSL_EC_KEY *wolfSSL_EC_KEY_new(void); WOLFSSL_API +int wolfSSL_EC_KEY_up_ref(WOLFSSL_EC_KEY* key); +WOLFSSL_API int wolfSSL_EC_KEY_set_group(WOLFSSL_EC_KEY *key, WOLFSSL_EC_GROUP *group); WOLFSSL_API int wolfSSL_EC_KEY_generate_key(WOLFSSL_EC_KEY *key); @@ -312,6 +319,7 @@ typedef WOLFSSL_EC_BUILTIN_CURVE EC_builtin_curve; #define EC_KEY_new wolfSSL_EC_KEY_new #define EC_KEY_free wolfSSL_EC_KEY_free +#define EC_KEY_up_ref wolfSSL_EC_KEY_up_ref #define EC_KEY_dup wolfSSL_EC_KEY_dup #define EC_KEY_up_ref wolfSSL_EC_KEY_up_ref #define EC_KEY_get0_public_key wolfSSL_EC_KEY_get0_public_key