From 961c696436a9892bd784bc08e2758727530ad4b2 Mon Sep 17 00:00:00 2001 From: jordan Date: Wed, 9 Nov 2022 10:27:31 -0600 Subject: [PATCH 1/2] Fix incorrect self signed error return. ASN_SELF_SIGNED_E was being overwritten with ASN_NO_SIGNER_E when compiled with certreq and certgen. --- src/internal.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/internal.c b/src/internal.c index b2b24e231..0568d0424 100644 --- a/src/internal.c +++ b/src/internal.c @@ -13609,6 +13609,7 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx, (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \ !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR) if (ret == ASN_NO_SIGNER_E || ret == ASN_SELF_SIGNED_E) { + args->lastErr = ret; /* save error from last time */ WOLFSSL_MSG("try to load certificate if hash dir is set"); ret = LoadCertByIssuer(SSL_STORE(ssl), (WOLFSSL_X509_NAME*)args->dCert->issuerName, @@ -13622,7 +13623,7 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx, &subjectHash, &alreadySigner); } else { - ret = ASN_NO_SIGNER_E; + ret = args->lastErr; /* restore error */ WOLFSSL_ERROR_VERBOSE(ret); } } From 5ad6ff23d58e5562a894af394d217840964d11c6 Mon Sep 17 00:00:00 2001 From: jordan Date: Thu, 10 Nov 2022 13:46:51 -0600 Subject: [PATCH 2/2] Use local int lastErr instead of args->lastErr. --- src/internal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/internal.c b/src/internal.c index 0568d0424..1a54537ee 100644 --- a/src/internal.c +++ b/src/internal.c @@ -13609,7 +13609,7 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx, (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \ !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR) if (ret == ASN_NO_SIGNER_E || ret == ASN_SELF_SIGNED_E) { - args->lastErr = ret; /* save error from last time */ + int lastErr = ret; /* save error from last time */ WOLFSSL_MSG("try to load certificate if hash dir is set"); ret = LoadCertByIssuer(SSL_STORE(ssl), (WOLFSSL_X509_NAME*)args->dCert->issuerName, @@ -13623,7 +13623,7 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx, &subjectHash, &alreadySigner); } else { - ret = args->lastErr; /* restore error */ + ret = lastErr; /* restore error */ WOLFSSL_ERROR_VERBOSE(ret); } }