Skip to content

Commit 71f9162

Browse files
SparkiDevSparkiDev
authored
Merge pull request #6668 from julek-wolfssl/zd/16515
DTLS downgrade bug fixes
2 parents a60810c + 8a9a363 commit 71f9162

7 files changed

Lines changed: 163 additions & 9 deletions

File tree

‎src/internal.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19949,7 +19949,7 @@ static int DtlsShouldDrop(WOLFSSL* ssl, int retcode)
1994919949

1995019950
#ifndef NO_WOLFSSL_SERVER
1995119951
if (ssl->options.side == WOLFSSL_SERVER_END
19952-
&& ssl->curRL.type != handshake) {
19952+
&& ssl->curRL.type != handshake && !IsSCR(ssl)) {
1995319953
int beforeCookieVerified = 0;
1995419954
if (!IsAtLeastTLSv1_3(ssl->version)) {
1995519955
beforeCookieVerified =

‎src/ssl.c‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4004,7 +4004,7 @@ int wolfSSL_CTX_UseSecureRenegotiation(WOLFSSL_CTX* ctx)
40044004
return WOLFSSL_SUCCESS;
40054005
}
40064006

4007-
4007+
#ifdef HAVE_SECURE_RENEGOTIATION
40084008
/* do a secure renegotiation handshake, user forced, we discourage */
40094009
static int _Rehandshake(WOLFSSL* ssl)
40104010
{
@@ -4069,15 +4069,15 @@ static int _Rehandshake(WOLFSSL* ssl)
40694069

40704070
ssl->secure_renegotiation->cache_status = SCR_CACHE_NEEDED;
40714071

4072-
#if !defined(NO_WOLFSSL_SERVER) && defined(HAVE_SECURE_RENEGOTIATION)
4072+
#if !defined(NO_WOLFSSL_SERVER)
40734073
if (ssl->options.side == WOLFSSL_SERVER_END) {
40744074
ret = SendHelloRequest(ssl);
40754075
if (ret != 0) {
40764076
ssl->error = ret;
40774077
return WOLFSSL_FATAL_ERROR;
40784078
}
40794079
}
4080-
#endif /* !NO_WOLFSSL_SERVER && HAVE_SECURE_RENEGOTIATION */
4080+
#endif /* !NO_WOLFSSL_SERVER */
40814081

40824082
ret = InitHandshakeHashes(ssl);
40834083
if (ret != 0) {
@@ -4151,6 +4151,8 @@ int wolfSSL_SecureResume(WOLFSSL* ssl)
41514151

41524152
#endif /* NO_WOLFSSL_CLIENT */
41534153

4154+
#endif /* HAVE_SECURE_RENEGOTIATION */
4155+
41544156
long wolfSSL_SSL_get_secure_renegotiation_support(WOLFSSL* ssl)
41554157
{
41564158
WOLFSSL_ENTER("wolfSSL_SSL_get_secure_renegotiation_support");

‎src/tls13.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11917,7 +11917,7 @@ int wolfSSL_connect_TLSv13(WOLFSSL* ssl)
1191711917
case CLIENT_HELLO_SENT:
1191811918
/* Get the response/s from the server. */
1191911919
while (ssl->options.serverState <
11920-
SERVER_HELLO_RETRY_REQUEST_COMPLETE) {
11920+
SERVER_HELLOVERIFYREQUEST_COMPLETE) {
1192111921
if ((ssl->error = ProcessReply(ssl)) < 0) {
1192211922
WOLFSSL_ERROR(ssl->error);
1192311923
return WOLFSSL_FATAL_ERROR;

‎tests/api.c‎

Lines changed: 138 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6152,6 +6152,8 @@ static THREAD_RETURN WOLFSSL_THREAD test_server_nofail(void* args)
61526152
size_t msg_len = 0;
61536153
#endif
61546154

6155+
wolfSSL_SetLoggingPrefix("server");
6156+
61556157
#ifdef WOLFSSL_TIRTOS
61566158
fdOpenSession(Task_self());
61576159
#endif
@@ -6365,7 +6367,7 @@ static THREAD_RETURN WOLFSSL_THREAD test_server_nofail(void* args)
63656367
if (ret < 0) { break; } else if (ret == 0) { continue; }
63666368
}
63676369
#endif
6368-
ret = wolfSSL_accept(ssl);
6370+
ret = wolfSSL_negotiate(ssl);
63696371
err = wolfSSL_get_error(ssl, 0);
63706372
} while (err == WC_PENDING_E);
63716373
if (ret != WOLFSSL_SUCCESS) {
@@ -6442,6 +6444,8 @@ static THREAD_RETURN WOLFSSL_THREAD test_server_nofail(void* args)
64426444
#endif
64436445
}
64446446

6447+
wolfSSL_SetLoggingPrefix(NULL);
6448+
64456449
#ifndef WOLFSSL_TIRTOS
64466450
return 0;
64476451
#endif
@@ -6688,6 +6692,8 @@ static int test_client_nofail(void* args, cbType cb)
66886692
int doUdp = 0;
66896693
const char* cipherName1, *cipherName2;
66906694

6695+
wolfSSL_SetLoggingPrefix("client");
6696+
66916697
#ifdef WOLFSSL_TIRTOS
66926698
fdOpenSession(Task_self());
66936699
#endif
@@ -6830,7 +6836,7 @@ static int test_client_nofail(void* args, cbType cb)
68306836
if (ret < 0) { break; } else if (ret == 0) { continue; }
68316837
}
68326838
#endif
6833-
ret = wolfSSL_connect(ssl);
6839+
ret = wolfSSL_negotiate(ssl);
68346840
err = wolfSSL_get_error(ssl, 0);
68356841
} while (err == WC_PENDING_E);
68366842
if (ret != WOLFSSL_SUCCESS) {
@@ -6907,6 +6913,9 @@ static int test_client_nofail(void* args, cbType cb)
69076913
(void)args;
69086914
(void)cb;
69096915
#endif /* !NO_WOLFSSL_CLIENT */
6916+
6917+
wolfSSL_SetLoggingPrefix(NULL);
6918+
69106919
return 0;
69116920
}
69126921

@@ -63153,8 +63162,8 @@ static int test_dtls_1_0_hvr_downgrade(void)
6315363162
XMEMSET(&func_cb_server, 0, sizeof(callback_functions));
6315463163

6315563164
func_cb_client.doUdp = func_cb_server.doUdp = 1;
63156-
func_cb_server.method = wolfDTLSv1_2_server_method;
6315763165
func_cb_client.method = wolfDTLS_client_method;
63166+
func_cb_server.method = wolfDTLSv1_2_server_method;
6315863167
func_cb_client.ctx_ready = test_dtls_1_0_hvr_downgrade_ctx_ready;
6315963168

6316063169
test_wolfSSL_client_server_nofail(&func_cb_client, &func_cb_server);
@@ -63242,6 +63251,130 @@ static int test_session_ticket_no_id(void)
6324263251
}
6324363252
#endif
6324463253

63254+
#if defined(WOLFSSL_DTLS) && !defined(WOLFSSL_NO_TLS12) && \
63255+
defined(HAVE_IO_TESTS_DEPENDENCIES) && defined(HAVE_SECURE_RENEGOTIATION)
63256+
static void test_dtls_downgrade_scr_server_ctx_ready_server(WOLFSSL_CTX* ctx)
63257+
{
63258+
AssertIntEQ(wolfSSL_CTX_SetMinVersion(ctx, WOLFSSL_DTLSV1_2),
63259+
WOLFSSL_SUCCESS);
63260+
AssertIntEQ(wolfSSL_CTX_UseSecureRenegotiation(ctx), WOLFSSL_SUCCESS);
63261+
}
63262+
63263+
static void test_dtls_downgrade_scr_server_ctx_ready(WOLFSSL_CTX* ctx)
63264+
{
63265+
AssertIntEQ(wolfSSL_CTX_UseSecureRenegotiation(ctx), WOLFSSL_SUCCESS);
63266+
}
63267+
63268+
static void test_dtls_downgrade_scr_server_on_result(WOLFSSL* ssl)
63269+
{
63270+
char testMsg[] = "Message after SCR";
63271+
char msgBuf[sizeof(testMsg)];
63272+
if (wolfSSL_is_server(ssl)) {
63273+
AssertIntEQ(wolfSSL_Rehandshake(ssl), WOLFSSL_FATAL_ERROR);
63274+
AssertIntEQ(wolfSSL_get_error(ssl, -1), APP_DATA_READY);
63275+
AssertIntEQ(wolfSSL_read(ssl, msgBuf, sizeof(msgBuf)), sizeof(msgBuf));
63276+
AssertIntEQ(wolfSSL_Rehandshake(ssl), WOLFSSL_SUCCESS);
63277+
AssertIntEQ(wolfSSL_write(ssl, testMsg, sizeof(testMsg)),
63278+
sizeof(testMsg));
63279+
}
63280+
else {
63281+
AssertIntEQ(wolfSSL_write(ssl, testMsg, sizeof(testMsg)),
63282+
sizeof(testMsg));
63283+
AssertIntEQ(wolfSSL_read(ssl, msgBuf, sizeof(msgBuf)), sizeof(msgBuf));
63284+
}
63285+
}
63286+
63287+
static int test_dtls_downgrade_scr_server(void)
63288+
{
63289+
EXPECT_DECLS;
63290+
callback_functions func_cb_client;
63291+
callback_functions func_cb_server;
63292+
63293+
XMEMSET(&func_cb_client, 0, sizeof(callback_functions));
63294+
XMEMSET(&func_cb_server, 0, sizeof(callback_functions));
63295+
63296+
func_cb_client.doUdp = func_cb_server.doUdp = 1;
63297+
func_cb_client.method = wolfDTLSv1_2_client_method;
63298+
func_cb_server.method = wolfDTLS_server_method;
63299+
func_cb_client.ctx_ready = test_dtls_downgrade_scr_server_ctx_ready;
63300+
func_cb_server.ctx_ready = test_dtls_downgrade_scr_server_ctx_ready_server;
63301+
func_cb_client.on_result = test_dtls_downgrade_scr_server_on_result;
63302+
func_cb_server.on_result = test_dtls_downgrade_scr_server_on_result;
63303+
63304+
test_wolfSSL_client_server_nofail(&func_cb_client, &func_cb_server);
63305+
63306+
ExpectIntEQ(func_cb_client.return_code, TEST_SUCCESS);
63307+
ExpectIntEQ(func_cb_server.return_code, TEST_SUCCESS);
63308+
63309+
return EXPECT_RESULT();
63310+
}
63311+
#else
63312+
static int test_dtls_downgrade_scr_server(void)
63313+
{
63314+
EXPECT_DECLS;
63315+
return EXPECT_RESULT();
63316+
}
63317+
#endif
63318+
63319+
#if defined(WOLFSSL_DTLS) && !defined(WOLFSSL_NO_TLS12) && \
63320+
defined(HAVE_IO_TESTS_DEPENDENCIES) && defined(HAVE_SECURE_RENEGOTIATION)
63321+
static void test_dtls_downgrade_scr_ctx_ready(WOLFSSL_CTX* ctx)
63322+
{
63323+
AssertIntEQ(wolfSSL_CTX_SetMinVersion(ctx, WOLFSSL_DTLSV1_2),
63324+
WOLFSSL_SUCCESS);
63325+
AssertIntEQ(wolfSSL_CTX_UseSecureRenegotiation(ctx), WOLFSSL_SUCCESS);
63326+
}
63327+
63328+
static void test_dtls_downgrade_scr_on_result(WOLFSSL* ssl)
63329+
{
63330+
char testMsg[] = "Message after SCR";
63331+
char msgBuf[sizeof(testMsg)];
63332+
if (wolfSSL_is_server(ssl)) {
63333+
AssertIntEQ(wolfSSL_Rehandshake(ssl), WOLFSSL_FATAL_ERROR);
63334+
AssertIntEQ(wolfSSL_get_error(ssl, -1), APP_DATA_READY);
63335+
AssertIntEQ(wolfSSL_read(ssl, msgBuf, sizeof(msgBuf)), sizeof(msgBuf));
63336+
AssertIntEQ(wolfSSL_Rehandshake(ssl), WOLFSSL_SUCCESS);
63337+
AssertIntEQ(wolfSSL_write(ssl, testMsg, sizeof(testMsg)),
63338+
sizeof(testMsg));
63339+
}
63340+
else {
63341+
AssertIntEQ(wolfSSL_write(ssl, testMsg, sizeof(testMsg)),
63342+
sizeof(testMsg));
63343+
AssertIntEQ(wolfSSL_read(ssl, msgBuf, sizeof(msgBuf)), sizeof(msgBuf));
63344+
}
63345+
}
63346+
63347+
static int test_dtls_downgrade_scr(void)
63348+
{
63349+
EXPECT_DECLS;
63350+
callback_functions func_cb_client;
63351+
callback_functions func_cb_server;
63352+
63353+
XMEMSET(&func_cb_client, 0, sizeof(callback_functions));
63354+
XMEMSET(&func_cb_server, 0, sizeof(callback_functions));
63355+
63356+
func_cb_client.doUdp = func_cb_server.doUdp = 1;
63357+
func_cb_client.method = wolfDTLS_client_method;
63358+
func_cb_server.method = wolfDTLSv1_2_server_method;
63359+
func_cb_client.ctx_ready = test_dtls_downgrade_scr_ctx_ready;
63360+
func_cb_client.on_result = test_dtls_downgrade_scr_on_result;
63361+
func_cb_server.on_result = test_dtls_downgrade_scr_on_result;
63362+
63363+
test_wolfSSL_client_server_nofail(&func_cb_client, &func_cb_server);
63364+
63365+
ExpectIntEQ(func_cb_client.return_code, TEST_SUCCESS);
63366+
ExpectIntEQ(func_cb_server.return_code, TEST_SUCCESS);
63367+
63368+
return EXPECT_RESULT();
63369+
}
63370+
#else
63371+
static int test_dtls_downgrade_scr(void)
63372+
{
63373+
EXPECT_DECLS;
63374+
return EXPECT_RESULT();
63375+
}
63376+
#endif
63377+
6324563378
/*----------------------------------------------------------------------------*
6324663379
| Main
6324763380
*----------------------------------------------------------------------------*/
@@ -64496,6 +64629,8 @@ TEST_CASE testCases[] = {
6449664629
TEST_DECL(test_TLSX_CA_NAMES_bad_extension),
6449764630
TEST_DECL(test_dtls_1_0_hvr_downgrade),
6449864631
TEST_DECL(test_session_ticket_no_id),
64632+
TEST_DECL(test_dtls_downgrade_scr_server),
64633+
TEST_DECL(test_dtls_downgrade_scr),
6449964634
/* This test needs to stay at the end to clean up any caches allocated. */
6450064635
TEST_DECL(test_wolfSSL_Cleanup)
6450164636
};

‎wolfcrypt/src/logging.c‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,7 @@ THREAD_LS_T void *StackSizeCheck_stackOffsetPointer = 0;
127127
/* Set these to default values initially. */
128128
static wolfSSL_Logging_cb log_function = NULL;
129129
static int loggingEnabled = 0;
130+
THREAD_LS_T const char* log_prefix = NULL;
130131

131132
#if defined(WOLFSSL_APACHE_MYNEWT)
132133
#include "log/log.h"
@@ -186,6 +187,15 @@ void wolfSSL_Debugging_OFF(void)
186187
#endif
187188
}
188189

190+
WOLFSSL_API void wolfSSL_SetLoggingPrefix(const char* prefix)
191+
{
192+
#ifdef DEBUG_WOLFSSL
193+
log_prefix = prefix;
194+
#else
195+
(void)prefix;
196+
#endif
197+
}
198+
189199
#ifdef WOLFSSL_FUNC_TIME
190200
/* WARNING: This code is only to be used for debugging performance.
191201
* The code is not thread-safe.
@@ -316,7 +326,10 @@ static void wolfssl_log(const int logLevel, const char *const logMessage)
316326
defined(HAVE_STACK_SIZE_VERBOSE) && defined(HAVE_STACK_SIZE_VERBOSE_LOG)
317327
STACK_SIZE_CHECKPOINT_MSG(logMessage);
318328
#else
319-
fprintf(stderr, "%s\n", logMessage);
329+
if (log_prefix != NULL)
330+
fprintf(stderr, "[%s]: %s\n", log_prefix, logMessage);
331+
else
332+
fprintf(stderr, "%s\n", logMessage);
320333
#endif
321334
}
322335
}

‎wolfssl/ssl.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3984,8 +3984,10 @@ WOLFSSL_API int wolfSSL_NoKeyShares(WOLFSSL* ssl);
39843984

39853985
WOLFSSL_API int wolfSSL_UseSecureRenegotiation(WOLFSSL* ssl);
39863986
WOLFSSL_API int wolfSSL_CTX_UseSecureRenegotiation(WOLFSSL_CTX* ctx);
3987+
#ifdef HAVE_SECURE_RENEGOTIATION
39873988
WOLFSSL_API int wolfSSL_Rehandshake(WOLFSSL* ssl);
39883989
WOLFSSL_API int wolfSSL_SecureResume(WOLFSSL* ssl);
3990+
#endif
39893991
WOLFSSL_API long wolfSSL_SSL_get_secure_renegotiation_support(WOLFSSL* ssl);
39903992

39913993
#endif

‎wolfssl/wolfcrypt/logging.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,8 @@ WOLFSSL_API int wolfSSL_Debugging_ON(void);
100100
/* turn logging off */
101101
WOLFSSL_API void wolfSSL_Debugging_OFF(void);
102102

103+
WOLFSSL_API void wolfSSL_SetLoggingPrefix(const char* prefix);
104+
103105
#ifdef HAVE_WC_INTROSPECTION
104106
WOLFSSL_API const char *wolfSSL_configure_args(void);
105107
WOLFSSL_API const char *wolfSSL_global_cflags(void);

0 commit comments

Comments
 (0)