wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-31 19:24:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2926 from SparkiDev/tls13_failnocert

Browse Source 
Fail when WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT set in TLS1.3
This commit is contained in:
toddouska
2020-05-14 10:53:18 -07:00
committed by GitHub
parent 88b8ea04f6 c153873337
commit fbfb28d5ee
4 changed files with 31 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
examples/client/client.c
View File

@@ -831,8 +831,8 @@ static void ClientWrite(WOLFSSL* ssl, char* msg, int msgSz, const char* str)
} }
} }
static void ClientRead(WOLFSSL* ssl, char* reply, int replyLen, int mustRead, static int ClientRead(WOLFSSL* ssl, char* reply, int replyLen, int mustRead,
const char* str) const char* str, int exitWithRet)
{ {
int ret, err; int ret, err;
char buffer[WOLFSSL_MAX_ERROR_SZ]; char buffer[WOLFSSL_MAX_ERROR_SZ];
@@ -853,8 +853,13 @@ static void ClientRead(WOLFSSL* ssl, char* reply, int replyLen, int mustRead,
if (err != WOLFSSL_ERROR_WANT_READ) { if (err != WOLFSSL_ERROR_WANT_READ) {
printf("SSL_read reply error %d, %s\n", err, printf("SSL_read reply error %d, %s\n", err,
wolfSSL_ERR_error_string(err, buffer)); wolfSSL_ERR_error_string(err, buffer));
if (!exitWithRet) {
err_sys("SSL_read failed"); err_sys("SSL_read failed");
} }
else {
break;
}
}
} }
if (mustRead && err == WOLFSSL_ERROR_WANT_READ) { if (mustRead && err == WOLFSSL_ERROR_WANT_READ) {
@@ -874,6 +879,8 @@ static void ClientRead(WOLFSSL* ssl, char* reply, int replyLen, int mustRead,
reply[ret] = 0; reply[ret] = 0;
printf("%s%s\n", str, reply); printf("%s%s\n", str, reply);
} }
return err;
} }
@@ -3095,14 +3102,18 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
ClientWrite(ssl, msg, msgSz, ""); ClientWrite(ssl, msg, msgSz, "");
ClientRead(ssl, reply, sizeof(reply)-1, 1, ""); err = ClientRead(ssl, reply, sizeof(reply)-1, 1, "", exitWithRet);
if (exitWithRet && (err != 0)) {
((func_args*)args)->return_code = err;
goto exit;
}
#if defined(WOLFSSL_TLS13) #if defined(WOLFSSL_TLS13)
if (updateKeysIVs || postHandAuth) if (updateKeysIVs || postHandAuth)
ClientWrite(ssl, msg, msgSz, ""); ClientWrite(ssl, msg, msgSz, "");
#endif #endif
if (sendGET) { /* get html */ if (sendGET) { /* get html */
ClientRead(ssl, reply, sizeof(reply)-1, 0, ""); (void)ClientRead(ssl, reply, sizeof(reply)-1, 0, "", 0);
} }
#ifndef NO_SESSION_CACHE #ifndef NO_SESSION_CACHE
@@ -3353,8 +3364,8 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
ClientWrite(sslResume, resumeMsg, resumeSz, " resume"); ClientWrite(sslResume, resumeMsg, resumeSz, " resume");
ClientRead(sslResume, reply, sizeof(reply)-1, sendGET, (void)ClientRead(sslResume, reply, sizeof(reply)-1, sendGET,
"Server resume: "); "Server resume: ", 0);
/* try to send session break */ /* try to send session break */
ClientWrite(sslResume, msg, msgSz, " resume 2"); ClientWrite(sslResume, msg, msgSz, " resume 2");

3
src/internal.c
View File

@@ -10665,7 +10665,8 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
args->count = args->totalCerts; args->count = args->totalCerts;
args->certIdx = 0; /* select peer cert (first one) */ args->certIdx = 0; /* select peer cert (first one) */
if (args->count == 0 && ssl->options.mutualAuth && if (args->count == 0 && (ssl->options.mutualAuth ||
(ssl->options.failNoCert && IsAtLeastTLSv1_3(ssl->version))) &&
ssl->options.side == WOLFSSL_SERVER_END) { ssl->options.side == WOLFSSL_SERVER_END) {
ret = NO_PEER_CERT; ret = NO_PEER_CERT;
DoCertFatalAlert(ssl, ret); DoCertFatalAlert(ssl, ret);

11
tests/test-fails.conf
View File

@@ -177,3 +177,14 @@
# client send alert on no mutual authentication # client send alert on no mutual authentication
-v 3 -v 3
-x -x
# server TLSv1.3 fail on no client certificate
# server always sets WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT unless using -d
-v 4
-l TLS13-AES128-GCM-SHA256
# client TLSv1.3 no client certificate
-v 4
-l TLS13-AES128-GCM-SHA256
-x

9
tests/test-tls13.conf
View File

@@ -135,15 +135,6 @@
-v 4 -v 4
-l TLS13-AES128-GCM-SHA256 -l TLS13-AES128-GCM-SHA256
# client TLSv1.3 no client certificate
-v 4
-l TLS13-AES128-GCM-SHA256
-x
# server TLSv1.3
-v 4
-l TLS13-AES128-GCM-SHA256
# client TLSv1.3 DH key exchange # client TLSv1.3 DH key exchange
-v 4 -v 4
-l TLS13-AES128-GCM-SHA256 -l TLS13-AES128-GCM-SHA256