WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Eliminate `EIGHTK_BUF` use in asn. Cleanup uses of `0` in set_verify for callback.

pull/4522/head
David Garske 2021-11-05 09:56:40 -07:00
parent 1d9832c0de
commit 5dac25f470
9 changed files with 95 additions and 104 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
IDE/GCC-ARM/Source/tls_client.c
View File

@ -100,7 +100,7 @@ static int tls_client(void)
/*---------------------*/ /*---------------------*/
/* for no peer auth: */ /* for no peer auth: */
/*---------------------*/ /*---------------------*/
wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, 0); wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL);
/*---------------------*/ /*---------------------*/
/* end peer auth option*/ /* end peer auth option*/
/*---------------------*/ /*---------------------*/

2
IDE/GCC-ARM/Source/tls_server.c
View File

@ -99,7 +99,7 @@ static int tls_server(void)
/*---------------------*/ /*---------------------*/
/* for no peer auth: */ /* for no peer auth: */
/*---------------------*/ /*---------------------*/
wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, 0); wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL);
/*---------------------*/ /*---------------------*/
/* end peer auth option*/ /* end peer auth option*/
/*---------------------*/ /*---------------------*/

2
README.md
View File

@ -65,7 +65,7 @@ If you want to mimic OpenSSL behavior of having `SSL_connect` succeed even if
verifying the server fails and reducing security you can do this by calling: verifying the server fails and reducing security you can do this by calling:
```c ```c
wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, 0); wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL);
``` ```
before calling `wolfSSL_new();`. Though it's not recommended. before calling `wolfSSL_new();`. Though it's not recommended.

6
doc/dox_comments/header_files/asn_public.h
View File

@ -1078,10 +1078,10 @@ WOLFSSL_API int wc_PubKeyPemToDer(const unsigned char*, int,
\code \code
char * file = “./certs/client-cert.pem”; char * file = “./certs/client-cert.pem”;
int derSz; int derSz;
byte * der = (byte*)XMALLOC(EIGHTK_BUF, NULL, DYNAMIC_TYPE_CERT); byte* der = (byte*)XMALLOC((8*1024), NULL, DYNAMIC_TYPE_CERT);
derSz = wc_PemCertToDer(file, der, EIGHTK_BUF); derSz = wc_PemCertToDer(file, der, (8*1024));
if(derSz <= 0) { if (derSz <= 0) {
//PemCertToDer error //PemCertToDer error
} }
\endcode \endcode

4
doc/dox_comments/header_files/ssl.h
View File

@ -2513,8 +2513,8 @@ WOLFSSL_API
\code \code
WOLFSSL_CTX* ctx = 0; WOLFSSL_CTX* ctx = 0;
... ...
wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | wolfSSL_CTX_set_verify(ctx, (WOLFSSL_VERIFY_PEER |
SSL_VERIFY_FAIL_IF_NO_PEER_CERT, 0); WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT), NULL);
\endcode \endcode
\sa wolfSSL_set_verify \sa wolfSSL_set_verify

4
examples/client/client.c
View File

@ -3062,7 +3062,7 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, myVerify); wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, myVerify);
} }
else if (!usePsk && !useAnon && doPeerCheck == 0) { else if (!usePsk && !useAnon && doPeerCheck == 0) {
wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, 0); wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL);
} }
else if (!usePsk && !useAnon && myVerifyAction == VERIFY_OVERRIDE_DATE_ERR) { else if (!usePsk && !useAnon && myVerifyAction == VERIFY_OVERRIDE_DATE_ERR) {
wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, myVerify); wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, myVerify);
@ -3191,7 +3191,7 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
} }
#if defined(WOLFSSL_MDK_ARM) #if defined(WOLFSSL_MDK_ARM)
wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, 0); wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL);
#endif #endif
#if defined(OPENSSL_EXTRA) #if defined(OPENSSL_EXTRA)

172
wolfcrypt/src/asn.c
View File

@ -19721,11 +19721,10 @@ int wc_PubKeyPemToDer(const unsigned char* pem, int pemSz,
#endif /* WOLFSSL_CERT_EXT || WOLFSSL_PUB_PEM_TO_DER */ #endif /* WOLFSSL_CERT_EXT || WOLFSSL_PUB_PEM_TO_DER */
#endif /* WOLFSSL_PEM_TO_DER */ #endif /* WOLFSSL_PEM_TO_DER */
#ifndef NO_FILESYSTEM #if !defined(NO_FILESYSTEM) && defined(WOLFSSL_PEM_TO_DER)
#ifdef WOLFSSL_CERT_GEN #ifdef WOLFSSL_CERT_GEN
/* load pem cert from file into der buffer, return der size or error */ int wc_PemCertToDer_ex(const char* fileName, DerBuffer** der)
int wc_PemCertToDer(const char* fileName, unsigned char* derBuf, int derSz)
{ {
#ifdef WOLFSSL_SMALL_STACK #ifdef WOLFSSL_SMALL_STACK
byte staticBuffer[1]; /* force XMALLOC */ byte staticBuffer[1]; /* force XMALLOC */
@ -19737,7 +19736,6 @@ int wc_PemCertToDer(const char* fileName, unsigned char* derBuf, int derSz)
int ret = 0; int ret = 0;
long sz = 0; long sz = 0;
XFILE file; XFILE file;
DerBuffer* converted = NULL;
WOLFSSL_ENTER("wc_PemCertToDer"); WOLFSSL_ENTER("wc_PemCertToDer");
@ -19752,8 +19750,9 @@ int wc_PemCertToDer(const char* fileName, unsigned char* derBuf, int derSz)
} }
if (ret == 0) { if (ret == 0) {
if(XFSEEK(file, 0, XSEEK_END) != 0) if (XFSEEK(file, 0, XSEEK_END) != 0) {
ret = BUFFER_E; ret = BUFFER_E;
}
sz = XFTELL(file); sz = XFTELL(file);
XREWIND(file); XREWIND(file);
@ -19763,35 +19762,23 @@ int wc_PemCertToDer(const char* fileName, unsigned char* derBuf, int derSz)
else if (sz > (long)sizeof(staticBuffer)) { else if (sz > (long)sizeof(staticBuffer)) {
#ifdef WOLFSSL_STATIC_MEMORY #ifdef WOLFSSL_STATIC_MEMORY
WOLFSSL_MSG("File was larger then static buffer"); WOLFSSL_MSG("File was larger then static buffer");
return MEMORY_E; ret = MEMORY_E;
#endif #else
fileBuf = (byte*)XMALLOC(sz, NULL, DYNAMIC_TYPE_FILE); fileBuf = (byte*)XMALLOC(sz, NULL, DYNAMIC_TYPE_FILE);
if (fileBuf == NULL) if (fileBuf == NULL)
ret = MEMORY_E; ret = MEMORY_E;
else else
dynamic = 1; dynamic = 1;
#endif
} }
if (ret == 0) { if (ret == 0) {
if ((size_t)XFREAD(fileBuf, 1, sz, file) != (size_t)sz) { if ((size_t)XFREAD(fileBuf, 1, sz, file) != (size_t)sz) {
ret = BUFFER_E; ret = BUFFER_E;
} }
#ifdef WOLFSSL_PEM_TO_DER
else { else {
ret = PemToDer(fileBuf, sz, CA_TYPE, &converted, 0, NULL,NULL); ret = PemToDer(fileBuf, sz, CA_TYPE, der, 0, NULL,NULL);
} }
#endif
if (ret == 0) {
if (converted->length < (word32)derSz) {
XMEMCPY(derBuf, converted->buffer, converted->length);
ret = converted->length;
}
else
ret = BUFFER_E;
}
FreeDer(&converted);
} }
XFCLOSE(file); XFCLOSE(file);
@ -19801,12 +19788,29 @@ int wc_PemCertToDer(const char* fileName, unsigned char* derBuf, int derSz)
return ret; return ret;
} }
/* load pem cert from file into der buffer, return der size or error */
int wc_PemCertToDer(const char* fileName, unsigned char* derBuf, int derSz)
{
int ret;
DerBuffer* converted = NULL;
ret = wc_PemCertToDer_ex(fileName, &converted);
if (ret == 0) {
if (converted->length < (word32)derSz) {
XMEMCPY(derBuf, converted->buffer, converted->length);
ret = converted->length;
}
else
ret = BUFFER_E;
FreeDer(&converted);
}
return ret;
}
#endif /* WOLFSSL_CERT_GEN */ #endif /* WOLFSSL_CERT_GEN */
#if defined(WOLFSSL_CERT_EXT) || defined(WOLFSSL_PUB_PEM_TO_DER) #if defined(WOLFSSL_CERT_EXT) || defined(WOLFSSL_PUB_PEM_TO_DER)
/* load pem public key from file into der buffer, return der size or error */ /* load pem public key from file into der buffer, return der size or error */
int wc_PemPubKeyToDer(const char* fileName, int wc_PemPubKeyToDer_ex(const char* fileName, DerBuffer** der)
unsigned char* derBuf, int derSz)
{ {
#ifdef WOLFSSL_SMALL_STACK #ifdef WOLFSSL_SMALL_STACK
byte staticBuffer[1]; /* force XMALLOC */ byte staticBuffer[1]; /* force XMALLOC */
@ -19818,7 +19822,6 @@ int wc_PemPubKeyToDer(const char* fileName,
int ret = 0; int ret = 0;
long sz = 0; long sz = 0;
XFILE file; XFILE file;
DerBuffer* converted = NULL;
WOLFSSL_ENTER("wc_PemPubKeyToDer"); WOLFSSL_ENTER("wc_PemPubKeyToDer");
@ -19833,8 +19836,9 @@ int wc_PemPubKeyToDer(const char* fileName,
} }
if (ret == 0) { if (ret == 0) {
if(XFSEEK(file, 0, XSEEK_END) != 0) if (XFSEEK(file, 0, XSEEK_END) != 0) {
ret = BUFFER_E; ret = BUFFER_E;
}
sz = XFTELL(file); sz = XFTELL(file);
XREWIND(file); XREWIND(file);
@ -19844,47 +19848,55 @@ int wc_PemPubKeyToDer(const char* fileName,
else if (sz > (long)sizeof(staticBuffer)) { else if (sz > (long)sizeof(staticBuffer)) {
#ifdef WOLFSSL_STATIC_MEMORY #ifdef WOLFSSL_STATIC_MEMORY
WOLFSSL_MSG("File was larger then static buffer"); WOLFSSL_MSG("File was larger then static buffer");
return MEMORY_E; ret = MEMORY_E;
#endif #else
fileBuf = (byte*)XMALLOC(sz, NULL, DYNAMIC_TYPE_FILE); fileBuf = (byte*)XMALLOC(sz, NULL, DYNAMIC_TYPE_FILE);
if (fileBuf == NULL) if (fileBuf == NULL)
ret = MEMORY_E; ret = MEMORY_E;
else else
dynamic = 1; dynamic = 1;
#endif
} }
if (ret == 0) { if (ret == 0) {
if ((size_t)XFREAD(fileBuf, 1, sz, file) != (size_t)sz) { if ((size_t)XFREAD(fileBuf, 1, sz, file) != (size_t)sz) {
ret = BUFFER_E; ret = BUFFER_E;
} }
#ifdef WOLFSSL_PEM_TO_DER
else { else {
ret = PemToDer(fileBuf, sz, PUBLICKEY_TYPE, &converted, ret = PemToDer(fileBuf, sz, PUBLICKEY_TYPE, der,
0, NULL, NULL); 0, NULL, NULL);
} }
#endif
if (ret == 0) {
if (converted->length < (word32)derSz) {
XMEMCPY(derBuf, converted->buffer, converted->length);
ret = converted->length;
}
else
ret = BUFFER_E;
}
FreeDer(&converted);
} }
XFCLOSE(file); XFCLOSE(file);
if (dynamic) if (dynamic) {
XFREE(fileBuf, NULL, DYNAMIC_TYPE_FILE); XFREE(fileBuf, NULL, DYNAMIC_TYPE_FILE);
}
} }
return ret; return ret;
} }
/* load pem public key from file into der buffer, return der size or error */
int wc_PemPubKeyToDer(const char* fileName,
unsigned char* derBuf, int derSz)
{
int ret;
DerBuffer* converted = NULL;
ret = wc_PemPubKeyToDer_ex(fileName, &converted);
if (ret == 0) {
if (converted->length < (word32)derSz) {
XMEMCPY(derBuf, converted->buffer, converted->length);
ret = converted->length;
}
else
ret = BUFFER_E;
FreeDer(&converted);
}
return ret;
}
#endif /* WOLFSSL_CERT_EXT || WOLFSSL_PUB_PEM_TO_DER */ #endif /* WOLFSSL_CERT_EXT || WOLFSSL_PUB_PEM_TO_DER */
#endif /* !NO_FILESYSTEM */ #endif /* !NO_FILESYSTEM && WOLFSSL_PEM_TO_DER */
#if !defined(NO_RSA) && (defined(WOLFSSL_CERT_GEN) || \ #if !defined(NO_RSA) && (defined(WOLFSSL_CERT_GEN) || \
@ -25118,28 +25130,18 @@ int wc_SetAuthKeyIdFromCert(Cert *cert, const byte *der, int derSz)
int wc_SetAuthKeyId(Cert *cert, const char* file) int wc_SetAuthKeyId(Cert *cert, const char* file)
{ {
int ret; int ret;
int derSz; DerBuffer* der = NULL;
byte* der;
if (cert == NULL || file == NULL) if (cert == NULL || file == NULL)
return BAD_FUNC_ARG; return BAD_FUNC_ARG;
der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT); ret = wc_PemCertToDer_ex(file, &der);
if (der == NULL) { if (ret == 0)
WOLFSSL_MSG("wc_SetAuthKeyId OOF Problem");
return MEMORY_E;
}
derSz = wc_PemCertToDer(file, der, EIGHTK_BUF);
if (derSz <= 0)
{ {
XFREE(der, cert->heap, DYNAMIC_TYPE_CERT); ret = wc_SetAuthKeyIdFromCert(cert, der->buffer, der->length);
return derSz; FreeDer(&der);
} }
ret = wc_SetAuthKeyIdFromCert(cert, der, derSz);
XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
return ret; return ret;
} }
@ -25516,22 +25518,18 @@ static int SetNameFromCert(CertName* cn, const byte* der, int derSz)
int wc_SetIssuer(Cert* cert, const char* issuerFile) int wc_SetIssuer(Cert* cert, const char* issuerFile)
{ {
int ret; int ret;
int derSz; DerBuffer* der = NULL;
byte* der;
if (cert == NULL) { if (cert == NULL || issuerFile == NULL)
return BAD_FUNC_ARG; return BAD_FUNC_ARG;
}
der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT); ret = wc_PemCertToDer_ex(issuerFile, &der);
if (der == NULL) { if (ret == 0) {
WOLFSSL_MSG("wc_SetIssuer OOF Problem"); cert->selfSigned = 0;
return MEMORY_E; ret = SetNameFromCert(&cert->issuer, der->buffer, der->length);
FreeDer(&der);
} }
derSz = wc_PemCertToDer(issuerFile, der, EIGHTK_BUF);
cert->selfSigned = 0;
ret = SetNameFromCert(&cert->issuer, der, derSz);
XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
return ret; return ret;
} }
@ -25541,22 +25539,17 @@ int wc_SetIssuer(Cert* cert, const char* issuerFile)
int wc_SetSubject(Cert* cert, const char* subjectFile) int wc_SetSubject(Cert* cert, const char* subjectFile)
{ {
int ret; int ret;
int derSz; DerBuffer* der = NULL;
byte* der;
if (cert == NULL) { if (cert == NULL || subjectFile == NULL)
return BAD_FUNC_ARG; return BAD_FUNC_ARG;
}
der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT); ret = wc_PemCertToDer_ex(subjectFile, &der);
if (der == NULL) { if (ret == 0) {
WOLFSSL_MSG("wc_SetSubject OOF Problem"); ret = SetNameFromCert(&cert->subject, der->buffer, der->length);
return MEMORY_E;
}
derSz = wc_PemCertToDer(subjectFile, der, EIGHTK_BUF); FreeDer(&der);
ret = SetNameFromCert(&cert->subject, der, derSz); }
XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
return ret; return ret;
} }
@ -25567,21 +25560,18 @@ int wc_SetSubject(Cert* cert, const char* subjectFile)
int wc_SetAltNames(Cert* cert, const char* file) int wc_SetAltNames(Cert* cert, const char* file)
{ {
int ret; int ret;
int derSz; DerBuffer* der = NULL;
byte* der;
if (cert == NULL) { if (cert == NULL) {
return BAD_FUNC_ARG; return BAD_FUNC_ARG;
} }
der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT); ret = wc_PemCertToDer_ex(file, &der);
if (der == NULL) { if (ret == 0) {
WOLFSSL_MSG("wc_SetAltNames OOF Problem"); ret = SetAltNamesFromCert(cert, der->buffer, der->length);
return MEMORY_E;
FreeDer(&der);
} }
derSz = wc_PemCertToDer(file, der, EIGHTK_BUF);
ret = SetAltNamesFromCert(cert, der, derSz);
XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
return ret; return ret;
} }

1
wolfssl/wolfcrypt/asn.h
View File

@ -894,7 +894,6 @@ enum Misc_ASN {
OCSP_NONCE_EXT_SZ = 35, /* OCSP Nonce Extension size */ OCSP_NONCE_EXT_SZ = 35, /* OCSP Nonce Extension size */
MAX_OCSP_EXT_SZ = 58, /* Max OCSP Extension length */ MAX_OCSP_EXT_SZ = 58, /* Max OCSP Extension length */
MAX_OCSP_NONCE_SZ = 16, /* OCSP Nonce size */ MAX_OCSP_NONCE_SZ = 16, /* OCSP Nonce size */
EIGHTK_BUF = 8192, /* Tmp buffer size */
MAX_PUBLIC_KEY_SZ = MAX_DSA_PUBKEY_SZ + MAX_ALGO_SZ + MAX_SEQ_SZ * 2, MAX_PUBLIC_KEY_SZ = MAX_DSA_PUBKEY_SZ + MAX_ALGO_SZ + MAX_SEQ_SZ * 2,
#ifdef WOLFSSL_ENCRYPTED_KEYS #ifdef WOLFSSL_ENCRYPTED_KEYS
HEADER_ENCRYPTED_KEY_SIZE = 88,/* Extra header size for encrypted key */ HEADER_ENCRYPTED_KEY_SIZE = 88,/* Extra header size for encrypted key */

6
wolfssl/wolfcrypt/asn_public.h
View File

@ -535,9 +535,10 @@ WOLFSSL_API void wc_FreeDer(DerBuffer** pDer);
#endif /* WOLFSSL_PEM_TO_DER */ #endif /* WOLFSSL_PEM_TO_DER */
#if defined(WOLFSSL_CERT_EXT) || defined(WOLFSSL_PUB_PEM_TO_DER) #if defined(WOLFSSL_CERT_EXT) || defined(WOLFSSL_PUB_PEM_TO_DER)
#ifndef NO_FILESYSTEM #if !defined(NO_FILESYSTEM) && defined(WOLFSSL_PEM_TO_DER)
WOLFSSL_API int wc_PemPubKeyToDer(const char* fileName, WOLFSSL_API int wc_PemPubKeyToDer(const char* fileName,
unsigned char* derBuf, int derSz); unsigned char* derBuf, int derSz);
WOLFSSL_API int wc_PemPubKeyToDer_ex(const char* fileName, DerBuffer** der);
#endif #endif
WOLFSSL_API int wc_PubKeyPemToDer(const unsigned char*, int, WOLFSSL_API int wc_PubKeyPemToDer(const unsigned char*, int,
@ -545,9 +546,10 @@ WOLFSSL_API void wc_FreeDer(DerBuffer** pDer);
#endif /* WOLFSSL_CERT_EXT || WOLFSSL_PUB_PEM_TO_DER */ #endif /* WOLFSSL_CERT_EXT || WOLFSSL_PUB_PEM_TO_DER */
#ifdef WOLFSSL_CERT_GEN #ifdef WOLFSSL_CERT_GEN
#ifndef NO_FILESYSTEM #if !defined(NO_FILESYSTEM) && defined(WOLFSSL_PEM_TO_DER)
WOLFSSL_API int wc_PemCertToDer(const char* fileName, WOLFSSL_API int wc_PemCertToDer(const char* fileName,
unsigned char* derBuf, int derSz); unsigned char* derBuf, int derSz);
WOLFSSL_API int wc_PemCertToDer_ex(const char* fileName, DerBuffer** der);
#endif #endif
#endif /* WOLFSSL_CERT_GEN */ #endif /* WOLFSSL_CERT_GEN */