Skip to content

Commit 05ef7eb

Browse files
scaprilescaprile
committed
allow no certs for client with (not enforced) two-way auth
1 parent 03afe3a commit 05ef7eb

2 files changed

Lines changed: 46 additions & 40 deletions

File tree

‎mongoose.c‎

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -16125,33 +16125,36 @@ static bool mg_tls_send_cert(struct mg_connection *c, bool is_client) {
1612516125
cert = (uint8_t *) mg_calloc(1, 13 + total_size);
1612616126
if (cert == NULL) return res;
1612716127
cert[0] = MG_TLS_CERTIFICATE; // handshake header
16128+
if (is_client && tls->cert_der.len == 0) total_size = 0; // empty list
1612816129
MG_STORE_BE24(cert + 1, total_size + 4);
1612916130
cert[4] = 0; // request context
1613016131
MG_STORE_BE24(cert + 5, total_size); // 3 bytes: cert (s) length
1613116132
offset = 8;
16132-
MG_STORE_BE24(cert + offset, tls->cert_der.len); // 3 bytes: first cert len
16133-
offset += 3;
16134-
// bytes 11+ are certificate in DER format
16135-
memmove(cert + offset, tls->cert_der.buf, tls->cert_der.len);
16136-
offset += tls->cert_der.len;
16137-
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
16138-
offset += 2;
16139-
for (i = 1; i < tls->chain_len; i++) {
16140-
MG_STORE_BE24(cert + offset, tls->chain_der[i].len);
16133+
if (total_size > 0) { // handle empty list, RFC-8446 4.4.2
16134+
MG_STORE_BE24(cert + offset, tls->cert_der.len); // 3 bytes: 1st cert len
1614116135
offset += 3;
16142-
memmove(cert + offset, tls->chain_der[i].buf, tls->chain_der[i].len);
16143-
offset += tls->chain_der[i].len;
16144-
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
16145-
offset += 2;
16146-
}
16147-
if (send_ca) {
16148-
MG_STORE_BE24(cert + offset, tls->ca_der.len); // 3 bytes: CA cert length
16149-
offset += 3;
16150-
memmove(cert + offset, tls->ca_der.buf,
16151-
tls->ca_der.len); // CA cert data
16152-
offset += tls->ca_der.len;
16136+
// bytes 11+ are certificate in DER format
16137+
memmove(cert + offset, tls->cert_der.buf, tls->cert_der.len);
16138+
offset += tls->cert_der.len;
1615316139
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
1615416140
offset += 2;
16141+
for (i = 1; i < tls->chain_len; i++) {
16142+
MG_STORE_BE24(cert + offset, tls->chain_der[i].len);
16143+
offset += 3;
16144+
memmove(cert + offset, tls->chain_der[i].buf, tls->chain_der[i].len);
16145+
offset += tls->chain_der[i].len;
16146+
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
16147+
offset += 2;
16148+
}
16149+
if (send_ca) {
16150+
MG_STORE_BE24(cert + offset, tls->ca_der.len); // 3 bytes: CA cert length
16151+
offset += 3;
16152+
memmove(cert + offset, tls->ca_der.buf,
16153+
tls->ca_der.len); // CA cert data
16154+
offset += tls->ca_der.len;
16155+
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
16156+
offset += 2;
16157+
}
1615516158
}
1615616159
mg_sha256_update(&tls->sha256, cert, offset);
1615716160
res = mg_tls_encrypt(c, cert, offset, MG_TLS_HANDSHAKE);

‎src/tls_builtin.c‎

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -813,33 +813,36 @@ static bool mg_tls_send_cert(struct mg_connection *c, bool is_client) {
813813
cert = (uint8_t *) mg_calloc(1, 13 + total_size);
814814
if (cert == NULL) return res;
815815
cert[0] = MG_TLS_CERTIFICATE; // handshake header
816+
if (is_client && tls->cert_der.len == 0) total_size = 0; // empty list
816817
MG_STORE_BE24(cert + 1, total_size + 4);
817818
cert[4] = 0; // request context
818819
MG_STORE_BE24(cert + 5, total_size); // 3 bytes: cert (s) length
819820
offset = 8;
820-
MG_STORE_BE24(cert + offset, tls->cert_der.len); // 3 bytes: first cert len
821-
offset += 3;
822-
// bytes 11+ are certificate in DER format
823-
memmove(cert + offset, tls->cert_der.buf, tls->cert_der.len);
824-
offset += tls->cert_der.len;
825-
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
826-
offset += 2;
827-
for (i = 1; i < tls->chain_len; i++) {
828-
MG_STORE_BE24(cert + offset, tls->chain_der[i].len);
829-
offset += 3;
830-
memmove(cert + offset, tls->chain_der[i].buf, tls->chain_der[i].len);
831-
offset += tls->chain_der[i].len;
832-
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
833-
offset += 2;
834-
}
835-
if (send_ca) {
836-
MG_STORE_BE24(cert + offset, tls->ca_der.len); // 3 bytes: CA cert length
821+
if (total_size > 0) { // handle empty list, RFC-8446 4.4.2
822+
MG_STORE_BE24(cert + offset, tls->cert_der.len); // 3 bytes: 1st cert len
837823
offset += 3;
838-
memmove(cert + offset, tls->ca_der.buf,
839-
tls->ca_der.len); // CA cert data
840-
offset += tls->ca_der.len;
824+
// bytes 11+ are certificate in DER format
825+
memmove(cert + offset, tls->cert_der.buf, tls->cert_der.len);
826+
offset += tls->cert_der.len;
841827
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
842828
offset += 2;
829+
for (i = 1; i < tls->chain_len; i++) {
830+
MG_STORE_BE24(cert + offset, tls->chain_der[i].len);
831+
offset += 3;
832+
memmove(cert + offset, tls->chain_der[i].buf, tls->chain_der[i].len);
833+
offset += tls->chain_der[i].len;
834+
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
835+
offset += 2;
836+
}
837+
if (send_ca) {
838+
MG_STORE_BE24(cert + offset, tls->ca_der.len); // 3 bytes: CA cert length
839+
offset += 3;
840+
memmove(cert + offset, tls->ca_der.buf,
841+
tls->ca_der.len); // CA cert data
842+
offset += tls->ca_der.len;
843+
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
844+
offset += 2;
845+
}
843846
}
844847
mg_sha256_update(&tls->sha256, cert, offset);
845848
res = mg_tls_encrypt(c, cert, offset, MG_TLS_HANDSHAKE);

0 commit comments

Comments
 (0)