crypt/wolfssl
1
0
Fork 0
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-10-24 04:09:07 +03:00
Code Activity

Document what accepting means and re-check the callback's restrictions

Browse Source 
Documentation:
- wolfSSL_get_verify_result() reports WOLFSSL_X509_V_OK once the callback
  accepts. wolfSSL verified nothing, so say that this records the
  callback's verdict rather than a check wolfSSL made.
- The OCSP stapling restriction is client-side. Both guards test
  side != WOLFSSL_SERVER_END: a server staples its own status, which is not
  part of verifying the peer. A server that asks the client to staple is
  not refused, and no stapled response is checked for it either, because
  ProcessPeerCertLeafRevocation is skipped with the callback.
- The list of what still applies was neither "two" nor complete. Add
  PEER_KEY_ERROR and SCR_DIFFERENT_CERT_E, note MAX_CERTIFICATE_SZ next to
  MAX_CHAIN_DEPTH, and state that 0 is the only accepting value, so
  returning WOLFSSL_SUCCESS rejects.
- DoChainVerifyCb no longer allocates; drop MEMORY_E from its comment.

Code:
- NULL-check the certificate manager in ChainVerifyCbCheckSsl, as
  ChainVerifyCbCheckCtx already does for ctx->cm.
- Re-run ChainVerifyCbCheckSsl in TLS_ASYNC_BUILD. A deferred verdict
  resumes there, so TLS_ASYNC_BEGIN ran on the first pass only.

Tests:
- Pin both halves of the headline contract on the accept path: the verify
  callback set with wolfSSL_set_verify() is not called, and
  wolfSSL_get_verify_result() reports WOLFSSL_X509_V_OK.
- Cover a callback returning WOLFSSL_SUCCESS, which rejects.
- Rename test_tls13_chain_verify_cb_async to _defer. It exercises deferral
  over TLS 1.3, not async crypto.

CI:
- Add chain-verify-cb-async, the first build combining the callback with
  WOLFSSL_ASYNC_CRYPT, and the only one with async crypt and CRL but
  without WOLFSSL_NONBLOCK_OCSP.

Three behaviour changes to existing configurations, introduced earlier in
this series and not called out until now:
- IsHsSuspendErr() recognizes OCSP_WANT_READ only under
  WOLFSSL_NONBLOCK_OCSP, where the sites it replaced tested
  WOLFSSL_ASYNC_CRYPT || WOLFSSL_NONBLOCK_OCSP. The keep-state re-entry
  branch it replaced was itself under WOLFSSL_NONBLOCK_OCSP, so an
  async-only build rewound into reset args and a freed pendingMsg. It now
  fails cleanly instead.
- DoCertificate no longer advances serverState to SERVER_CERT_COMPLETE
  when ProcessPeerCerts suspended.
- ReceiveData admits a suspended handshake error rather than refusing the
  read, which under WOLFSSL_NONBLOCK_OCSP now includes OCSP_WANT_READ.
This commit is contained in:
Juliusz Sosinowicz
2026-09-07 10:12:47 +00:00
parent 676960c0da
commit b4e77e8951
6 changed files with 153 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.github/configs/os-check-linux.json vendored
View File

@@ -91,6 +91,11 @@
"CPPFLAGS=-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK"]},
{"name": "all-asn-template", "minutes": 3.5,
"configure": ["--enable-all", "--enable-asn=template"]},
{"name": "chain-verify-cb-async", "minutes": 3.5,
"comment": "chain verify callback with async crypt, the third handshake-suspend feature. Also the only leg with async crypt and CRL but without WOLFSSL_NONBLOCK_OCSP.",
"configure": ["--enable-chain-verify-cb", "--enable-asynccrypt",
"--enable-asynccrypt-sw", "--enable-ocsp", "--enable-crl",
"--enable-opensslextra", "--enable-sessioncerts"]},
{"name": "tls13-dtls13-session-misc", "minutes": 3.3,
"configure": ["--enable-tls13", "--enable-session-ticket", "--enable-dtls",
"--enable-dtls13", "--enable-opensslextra", "--enable-sessioncerts",