Skip to content

Commit 9b50708

Browse files
dgarskedgarske
committed
Fix to expose API to access "store" error code and error depth for cert failure callback (from set_verify). Useful for C# wrapper or clients that cannot directly dereference X509_STORE. Fixes for building with WOLFSSL_EXTRA and WOLFSSL_NO_CA_NAMES (and added new tests). Added example in CSharp TLS client for overriding a begin date error (useful if date is not set).
1 parent 7610b4e commit 9b50708

9 files changed

Lines changed: 90 additions & 53 deletions

File tree

‎.github/workflows/os-check.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,16 +41,21 @@ jobs:
4141
'--enable-dtls --enable-dtls13 --enable-dtls-frag-ch
4242
--enable-dtls-mtu',
4343
'--enable-dtls --enable-dtlscid --enable-dtls13 --enable-secure-renegotiation
44-
--enable-psk --enable-aesccm --enable-nullcipher CPPFLAGS=-DWOLFSSL_STATIC_RSA',
44+
--enable-psk --enable-aesccm --enable-nullcipher
45+
CPPFLAGS=-DWOLFSSL_STATIC_RSA',
4546
'--enable-ascon --enable-experimental',
4647
'--enable-ascon CPPFLAGS=-DWOLFSSL_ASCON_UNROLL --enable-experimental',
4748
'--enable-all CPPFLAGS=''-DNO_AES_192 -DNO_AES_256'' ',
48-
'--enable-sniffer --enable-curve25519 --enable-curve448 --enable-enckeys CFLAGS=-DWOLFSSL_DH_EXTRA',
49+
'--enable-sniffer --enable-curve25519 --enable-curve448 --enable-enckeys
50+
CPPFLAGS=-DWOLFSSL_DH_EXTRA',
4951
'--enable-dtls --enable-dtls13 --enable-dtls-frag-ch
5052
--enable-dtls-mtu CPPFLAGS=-DWOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS',
5153
'--enable-opensslall --enable-opensslextra CPPFLAGS=-DWC_RNG_SEED_CB',
5254
'--enable-opensslall --enable-opensslextra
5355
CPPFLAGS=''-DWC_RNG_SEED_CB -DWOLFSSL_NO_GETPID'' ',
56+
'--enable-opensslextra CPPFLAGS=''-DWOLFSSL_NO_CA_NAMES'' ',
57+
'--enable-opensslextra=x509small',
58+
'CPPFLAGS=''-DWOLFSSL_EXTRA'' '
5459
]
5560
name: make check
5661
if: github.repository_owner == 'wolfssl'

‎src/internal.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2905,7 +2905,7 @@ void SSL_CtxResourceFree(WOLFSSL_CTX* ctx)
29052905
defined(WOLFSSL_WPAS_SMALL)
29062906
wolfSSL_X509_STORE_free(ctx->x509_store_pt);
29072907
#endif
2908-
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EXTRA) || defined(HAVE_LIGHTY)
2908+
#ifndef WOLFSSL_NO_CA_NAMES
29092909
wolfSSL_sk_X509_NAME_pop_free(ctx->client_ca_names, NULL);
29102910
ctx->client_ca_names = NULL;
29112911
#endif
@@ -8784,7 +8784,7 @@ void wolfSSL_ResourceFree(WOLFSSL* ssl)
87848784
wolfSSL_sk_X509_pop_free(ssl->ourCertChain, NULL);
87858785
#endif
87868786
#endif
8787-
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EXTRA) || defined(HAVE_LIGHTY)
8787+
#ifndef WOLFSSL_NO_CA_NAMES
87888788
wolfSSL_sk_X509_NAME_pop_free(ssl->client_ca_names, NULL);
87898789
ssl->client_ca_names = NULL;
87908790
#endif

‎src/ssl.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12163,7 +12163,7 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
1216312163
#endif /* !NO_BIO */
1216412164
#endif /* OPENSSL_EXTRA */
1216512165

12166-
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EXTRA)
12166+
#ifndef WOLFSSL_NO_CA_NAMES
1216712167
void wolfSSL_CTX_set_client_CA_list(WOLFSSL_CTX* ctx,
1216812168
WOLF_STACK_OF(WOLFSSL_X509_NAME)* names)
1216912169
{
@@ -12184,7 +12184,9 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
1218412184
ssl->client_ca_names = names;
1218512185
}
1218612186
}
12187+
#endif
1218712188

12189+
#if defined(OPENSSL_EXTRA) || defined(HAVE_LIGHTY)
1218812190
#ifdef OPENSSL_EXTRA
1218912191
/* registers client cert callback, called during handshake if server
1219012192
requests client auth but user has not loaded client cert/key */
@@ -12399,7 +12401,7 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
1239912401
}
1240012402
#endif /* OPENSSL_EXTRA */
1240112403

12402-
#endif /* OPENSSL_EXTRA || WOLFSSL_EXTRA || HAVE_WEBSERVER */
12404+
#endif /* OPENSSL_EXTRA || HAVE_LIGHTY */
1240312405

1240412406
#ifndef WOLFSSL_NO_CA_NAMES
1240512407
WOLF_STACK_OF(WOLFSSL_X509_NAME)* wolfSSL_CTX_get_client_CA_list(

‎src/x509_str.c‎

Lines changed: 27 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -577,17 +577,35 @@ int wolfSSL_X509_verify_cert(WOLFSSL_X509_STORE_CTX* ctx)
577577

578578
#endif /* OPENSSL_EXTRA */
579579

580-
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)
581-
WOLFSSL_X509* wolfSSL_X509_STORE_CTX_get_current_cert(
582-
WOLFSSL_X509_STORE_CTX* ctx)
583-
{
584-
WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get_current_cert");
585-
if (ctx)
586-
return ctx->current_cert;
587-
return NULL;
580+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
581+
WOLFSSL_X509* wolfSSL_X509_STORE_CTX_get_current_cert(
582+
WOLFSSL_X509_STORE_CTX* ctx)
583+
{
584+
WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get_current_cert");
585+
if (ctx)
586+
return ctx->current_cert;
587+
return NULL;
588+
}
589+
590+
/* get X509_STORE_CTX ex_data, max idx is MAX_EX_DATA */
591+
void* wolfSSL_X509_STORE_CTX_get_ex_data(WOLFSSL_X509_STORE_CTX* ctx, int idx)
592+
{
593+
WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get_ex_data");
594+
#ifdef HAVE_EX_DATA
595+
if (ctx != NULL) {
596+
return wolfSSL_CRYPTO_get_ex_data(&ctx->ex_data, idx);
588597
}
598+
#else
599+
(void)ctx;
600+
(void)idx;
601+
#endif
602+
return NULL;
603+
}
604+
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */
589605

590606

607+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
608+
defined(WOLFSSL_EXTRA)
591609
int wolfSSL_X509_STORE_CTX_get_error(WOLFSSL_X509_STORE_CTX* ctx)
592610
{
593611
WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get_error");
@@ -596,30 +614,14 @@ int wolfSSL_X509_verify_cert(WOLFSSL_X509_STORE_CTX* ctx)
596614
return 0;
597615
}
598616

599-
600617
int wolfSSL_X509_STORE_CTX_get_error_depth(WOLFSSL_X509_STORE_CTX* ctx)
601618
{
602619
WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get_error_depth");
603-
if(ctx)
620+
if (ctx)
604621
return ctx->error_depth;
605622
return WOLFSSL_FATAL_ERROR;
606623
}
607-
608-
/* get X509_STORE_CTX ex_data, max idx is MAX_EX_DATA */
609-
void* wolfSSL_X509_STORE_CTX_get_ex_data(WOLFSSL_X509_STORE_CTX* ctx, int idx)
610-
{
611-
WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get_ex_data");
612-
#ifdef HAVE_EX_DATA
613-
if (ctx != NULL) {
614-
return wolfSSL_CRYPTO_get_ex_data(&ctx->ex_data, idx);
615-
}
616-
#else
617-
(void)ctx;
618-
(void)idx;
619624
#endif
620-
return NULL;
621-
}
622-
#endif /* OPENSSL_EXTRA || WOLFSSL_WPAS_SMALL */
623625

624626
#ifdef OPENSSL_EXTRA
625627
void wolfSSL_X509_STORE_CTX_set_verify_cb(WOLFSSL_X509_STORE_CTX *ctx,

‎tests/api.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28110,7 +28110,8 @@ static int test_wolfSSL_CTX_set_client_CA_list(void)
2811028110
static int test_wolfSSL_CTX_add_client_CA(void)
2811128111
{
2811228112
EXPECT_DECLS;
28113-
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA) && !defined(NO_CERTS) && \
28113+
#if !defined(WOLFSSL_NO_CA_NAMES) && defined(OPENSSL_EXTRA) && \
28114+
!defined(NO_RSA) && !defined(NO_CERTS) && \
2811428115
!defined(NO_TLS) && !defined(NO_WOLFSSL_CLIENT)
2811528116
WOLFSSL_CTX* ctx = NULL;
2811628117
WOLFSSL_X509* x509 = NULL;
@@ -38569,7 +38570,7 @@ static int test_wolfSSL_cert_cb_dyn_ciphers(void)
3856938570
static int test_wolfSSL_ciphersuite_auth(void)
3857038571
{
3857138572
EXPECT_DECLS;
38572-
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EXTRA)
38573+
#if defined(OPENSSL_EXTRA)
3857338574
WOLFSSL_CIPHERSUITE_INFO info;
3857438575

3857538576
(void)info;
@@ -38659,7 +38660,7 @@ static int test_wolfSSL_ciphersuite_auth(void)
3865938660
static int test_wolfSSL_sigalg_info(void)
3866038661
{
3866138662
EXPECT_DECLS;
38662-
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EXTRA)
38663+
#if defined(OPENSSL_EXTRA)
3866338664
byte hashSigAlgo[WOLFSSL_MAX_SIGALGO];
3866438665
word16 len = 0;
3866538666
word16 idx = 0;

‎wolfssl/internal.h‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1086,13 +1086,17 @@
10861086

10871087
#undef WSSL_HARDEN_TLS
10881088

1089-
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EXTRA) || defined(HAVE_LIGHTY)
1090-
#define SSL_CA_NAMES(ssl) ((ssl)->client_ca_names != NULL ? (ssl)->client_ca_names : \
1089+
#if !defined(WOLFSSL_NO_CA_NAMES) && \
1090+
(defined(OPENSSL_EXTRA) || defined(HAVE_LIGHTY))
1091+
#define SSL_CA_NAMES(ssl) ((ssl)->client_ca_names != NULL ? \
1092+
(ssl)->client_ca_names : \
10911093
(ssl)->ctx->client_ca_names)
10921094
#else
1093-
#define WOLFSSL_NO_CA_NAMES
1095+
#undef WOLFSSL_NO_CA_NAMES
1096+
#define WOLFSSL_NO_CA_NAMES
10941097
#endif
10951098

1099+
10961100
/* actual cipher values, 2nd byte */
10971101
enum {
10981102
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA = 0x16,

‎wolfssl/ssl.h‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1841,6 +1841,12 @@ WOLFSSL_API const char* wolfSSL_ERR_func_error_string(unsigned long e);
18411841
WOLFSSL_API const char* wolfSSL_ERR_lib_error_string(unsigned long e);
18421842

18431843
/* -------- EXTRAS BEGIN -------- */
1844+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
1845+
defined(WOLFSSL_EXTRA)
1846+
WOLFSSL_API int wolfSSL_X509_STORE_CTX_get_error(WOLFSSL_X509_STORE_CTX* ctx);
1847+
WOLFSSL_API int wolfSSL_X509_STORE_CTX_get_error_depth(WOLFSSL_X509_STORE_CTX* ctx);
1848+
#endif
1849+
18441850
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
18451851
WOLFSSL_API void wolfSSL_ERR_print_errors(WOLFSSL_BIO *bio);
18461852

@@ -2144,9 +2150,6 @@ WOLFSSL_API int wolfSSL_num_locks(void);
21442150

21452151
WOLFSSL_API WOLFSSL_X509* wolfSSL_X509_STORE_CTX_get_current_cert(
21462152
WOLFSSL_X509_STORE_CTX* ctx);
2147-
WOLFSSL_API int wolfSSL_X509_STORE_CTX_get_error(WOLFSSL_X509_STORE_CTX* ctx);
2148-
WOLFSSL_API int wolfSSL_X509_STORE_CTX_get_error_depth(WOLFSSL_X509_STORE_CTX* ctx);
2149-
21502153
WOLFSSL_API void wolfSSL_X509_STORE_CTX_set_verify_cb(WOLFSSL_X509_STORE_CTX *ctx,
21512154
WOLFSSL_X509_STORE_CTX_verify_cb verify_cb);
21522155
WOLFSSL_API void wolfSSL_X509_STORE_set_verify_cb(WOLFSSL_X509_STORE *st,
@@ -2407,6 +2410,8 @@ WOLFSSL_API void wolfSSL_ASN1_TIME_free(WOLFSSL_ASN1_TIME* t);
24072410
#endif
24082411

24092412
WOLFSSL_API WOLF_STACK_OF(WOLFSSL_X509_NAME)* wolfSSL_load_client_CA_file(const char* fname);
2413+
2414+
#ifndef WOLFSSL_NO_CA_NAMES
24102415
WOLFSSL_API WOLF_STACK_OF(WOLFSSL_X509_NAME)* wolfSSL_CTX_get_client_CA_list(
24112416
const WOLFSSL_CTX *ctx);
24122417
/* deprecated function name */
@@ -2418,6 +2423,7 @@ WOLFSSL_API void wolfSSL_set_client_CA_list(WOLFSSL* ssl,
24182423
WOLF_STACK_OF(WOLFSSL_X509_NAME)*);
24192424
WOLFSSL_API WOLF_STACK_OF(WOLFSSL_X509_NAME)* wolfSSL_get_client_CA_list(
24202425
const WOLFSSL* ssl);
2426+
#endif /* !WOLFSSL_NO_CA_NAMES */
24212427

24222428
typedef int (*client_cert_cb)(WOLFSSL *ssl, WOLFSSL_X509 **x509,
24232429
WOLFSSL_EVP_PKEY **pkey);

‎wolfssl/test.h‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2467,14 +2467,14 @@ static THREAD_LS_T int myVerifyAction = VERIFY_OVERRIDE_ERROR;
24672467
static WC_INLINE int myVerify(int preverify, WOLFSSL_X509_STORE_CTX* store)
24682468
{
24692469
char err_buffer[WOLFSSL_MAX_ERROR_SZ];
2470+
int err;
24702471
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
24712472
WOLFSSL_X509* peer;
2472-
#if defined(SHOW_CERTS) && !defined(NO_FILESYSTEM) && \
2473-
!defined(OPENSSL_EXTRA_X509_SMALL)
2473+
#endif
2474+
#if defined(OPENSSL_EXTRA) && defined(SHOW_CERTS) && !defined(NO_FILESYSTEM)
24742475
WOLFSSL_BIO* bio = NULL;
24752476
WOLFSSL_STACK* sk = NULL;
24762477
X509* x509 = NULL;
2477-
#endif
24782478
#endif
24792479

24802480
/* Verify Callback Arguments:
@@ -2492,10 +2492,17 @@ static WC_INLINE int myVerify(int preverify, WOLFSSL_X509_STORE_CTX* store)
24922492
will be discarded (only with SESSION_CERTS)
24932493
*/
24942494

2495-
fprintf(stderr, "In verification callback, error = %d, %s\n", store->error,
2496-
wolfSSL_ERR_error_string((unsigned long) store->error, err_buffer));
2495+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
2496+
defined(WOLFSSL_EXTRA)
2497+
err = wolfSSL_X509_STORE_CTX_get_error(store);
2498+
#else
2499+
err = store->error;
2500+
#endif
2501+
2502+
fprintf(stderr, "In verification callback, error = %d, %s\n", err,
2503+
wolfSSL_ERR_error_string((unsigned long) err, err_buffer));
24972504
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
2498-
peer = store->current_cert;
2505+
peer = wolfSSL_X509_STORE_CTX_get_current_cert(store);
24992506
if (peer) {
25002507
char* issuer = wolfSSL_X509_NAME_oneline(
25012508
wolfSSL_X509_get_issuer_name(peer), 0, 0);
@@ -2515,8 +2522,7 @@ static WC_INLINE int myVerify(int preverify, WOLFSSL_X509_STORE_CTX* store)
25152522

25162523
XFREE(subject, 0, DYNAMIC_TYPE_OPENSSL);
25172524
XFREE(issuer, 0, DYNAMIC_TYPE_OPENSSL);
2518-
#if defined(SHOW_CERTS) && !defined(NO_FILESYSTEM) && \
2519-
!defined(OPENSSL_EXTRA_X509_SMALL)
2525+
#if defined(OPENSSL_EXTRA) && defined(SHOW_CERTS) && !defined(NO_FILESYSTEM)
25202526
/* avoid printing duplicate certs */
25212527
if (store->depth == 1) {
25222528
int i;

‎wrapper/CSharp/wolfSSL-TLS-Client/wolfSSL-TLS-Client.cs‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,20 @@ private static void clean(IntPtr ssl, IntPtr ctx)
5454
/// <param name="x509_ctx">Certificate in WOLFSSL_X509_STORE_CTX format</param>
5555
private static int myVerify(int preverify, IntPtr x509_ctx)
5656
{
57-
/* Use the provided verification */
57+
int verify = preverify;
58+
59+
/* example for overriding an error code */
60+
/* X509_STORE_CTX_get_error API can be enabled with
61+
* OPENSSL_EXTRA_X509_SMALL or WOLFSSL_EXTRA */
62+
int error = wolfssl.X509_STORE_CTX_get_error(x509_ctx);
63+
const int ASN_BEFORE_DATE_E = -150; /* ASN date error, current date before */
64+
65+
if (error == ASN_BEFORE_DATE_E) {
66+
verify = 1; /* override error */
67+
}
68+
5869
/* Can optionally override failures by returning non-zero value */
59-
return preverify;
70+
return verify;
6071
}
6172

6273
/// <summary>
@@ -90,7 +101,7 @@ public static void Main(string[] args)
90101

91102
if (caCert == "" || dhparam.Length == 0) {
92103
Console.WriteLine("Platform not supported.");
93-
return;
104+
return;
94105
}
95106

96107
StringBuilder buff = new StringBuilder(1024);
@@ -133,14 +144,14 @@ public static void Main(string[] args)
133144
}
134145

135146
int sniArg = haveSNI(args);
136-
if (sniArg >= 0)
147+
if (sniArg >= 0)
137148
{
138149
string sniHostNameString = args[sniArg].Trim();
139150
sniHostName = Marshal.StringToHGlobalAnsi(sniHostNameString);
140151

141152
ushort size = (ushort)sniHostNameString.Length;
142153

143-
if (wolfssl.CTX_UseSNI(ctx, (byte)wolfssl.WOLFSSL_SNI_HOST_NAME, sniHostName, size) != wolfssl.SUCCESS)
154+
if (wolfssl.CTX_UseSNI(ctx, (byte)wolfssl.WOLFSSL_SNI_HOST_NAME, sniHostName, size) != wolfssl.SUCCESS)
144155
{
145156
Console.WriteLine("UseSNI failed");
146157
wolfssl.CTX_free(ctx);

0 commit comments

Comments
 (0)