mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-10-24 04:09:07 +03:00
b4e77e8951
Documentation: - wolfSSL_get_verify_result() reports WOLFSSL_X509_V_OK once the callback accepts. wolfSSL verified nothing, so say that this records the callback's verdict rather than a check wolfSSL made. - The OCSP stapling restriction is client-side. Both guards test side != WOLFSSL_SERVER_END: a server staples its own status, which is not part of verifying the peer. A server that asks the client to staple is not refused, and no stapled response is checked for it either, because ProcessPeerCertLeafRevocation is skipped with the callback. - The list of what still applies was neither "two" nor complete. Add PEER_KEY_ERROR and SCR_DIFFERENT_CERT_E, note MAX_CERTIFICATE_SZ next to MAX_CHAIN_DEPTH, and state that 0 is the only accepting value, so returning WOLFSSL_SUCCESS rejects. - DoChainVerifyCb no longer allocates; drop MEMORY_E from its comment. Code: - NULL-check the certificate manager in ChainVerifyCbCheckSsl, as ChainVerifyCbCheckCtx already does for ctx->cm. - Re-run ChainVerifyCbCheckSsl in TLS_ASYNC_BUILD. A deferred verdict resumes there, so TLS_ASYNC_BEGIN ran on the first pass only. Tests: - Pin both halves of the headline contract on the accept path: the verify callback set with wolfSSL_set_verify() is not called, and wolfSSL_get_verify_result() reports WOLFSSL_X509_V_OK. - Cover a callback returning WOLFSSL_SUCCESS, which rejects. - Rename test_tls13_chain_verify_cb_async to _defer. It exercises deferral over TLS 1.3, not async crypto. CI: - Add chain-verify-cb-async, the first build combining the callback with WOLFSSL_ASYNC_CRYPT, and the only one with async crypt and CRL but without WOLFSSL_NONBLOCK_OCSP. Three behaviour changes to existing configurations, introduced earlier in this series and not called out until now: - IsHsSuspendErr() recognizes OCSP_WANT_READ only under WOLFSSL_NONBLOCK_OCSP, where the sites it replaced tested WOLFSSL_ASYNC_CRYPT || WOLFSSL_NONBLOCK_OCSP. The keep-state re-entry branch it replaced was itself under WOLFSSL_NONBLOCK_OCSP, so an async-only build rewound into reset args and a freed pendingMsg. It now fails cleanly instead. - DoCertificate no longer advances serverState to SERVER_CERT_COMPLETE when ProcessPeerCerts suspended. - ReceiveData admits a suspended handshake error rather than refusing the read, which under WOLFSSL_NONBLOCK_OCSP now includes OCSP_WANT_READ.