Skip to content

Commit 9f0248d

Browse files
scaprilescaprile
committed
allow no certs for client with (not enforced) two-way auth
1 parent d003d28 commit 9f0248d

2 files changed

Lines changed: 46 additions & 40 deletions

File tree

‎mongoose.c‎

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -15285,33 +15285,36 @@ static bool mg_tls_send_cert(struct mg_connection *c, bool is_client) {
1528515285
cert = (uint8_t *) mg_calloc(1, 13 + total_size);
1528615286
if (cert == NULL) return res;
1528715287
cert[0] = MG_TLS_CERTIFICATE; // handshake header
15288+
if (is_client && tls->cert_der.len == 0) total_size = 0; // empty list
1528815289
MG_STORE_BE24(cert + 1, total_size + 4);
1528915290
cert[4] = 0; // request context
1529015291
MG_STORE_BE24(cert + 5, total_size); // 3 bytes: cert (s) length
1529115292
offset = 8;
15292-
MG_STORE_BE24(cert + offset, tls->cert_der.len); // 3 bytes: first cert len
15293-
offset += 3;
15294-
// bytes 11+ are certificate in DER format
15295-
memmove(cert + offset, tls->cert_der.buf, tls->cert_der.len);
15296-
offset += tls->cert_der.len;
15297-
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
15298-
offset += 2;
15299-
for (i = 1; i < tls->chain_len; i++) {
15300-
MG_STORE_BE24(cert + offset, tls->chain_der[i].len);
15293+
if (total_size > 0) { // handle empty list, RFC-8446 4.4.2
15294+
MG_STORE_BE24(cert + offset, tls->cert_der.len); // 3 bytes: 1st cert len
1530115295
offset += 3;
15302-
memmove(cert + offset, tls->chain_der[i].buf, tls->chain_der[i].len);
15303-
offset += tls->chain_der[i].len;
15304-
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
15305-
offset += 2;
15306-
}
15307-
if (send_ca) {
15308-
MG_STORE_BE24(cert + offset, tls->ca_der.len); // 3 bytes: CA cert length
15309-
offset += 3;
15310-
memmove(cert + offset, tls->ca_der.buf,
15311-
tls->ca_der.len); // CA cert data
15312-
offset += tls->ca_der.len;
15296+
// bytes 11+ are certificate in DER format
15297+
memmove(cert + offset, tls->cert_der.buf, tls->cert_der.len);
15298+
offset += tls->cert_der.len;
1531315299
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
1531415300
offset += 2;
15301+
for (i = 1; i < tls->chain_len; i++) {
15302+
MG_STORE_BE24(cert + offset, tls->chain_der[i].len);
15303+
offset += 3;
15304+
memmove(cert + offset, tls->chain_der[i].buf, tls->chain_der[i].len);
15305+
offset += tls->chain_der[i].len;
15306+
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
15307+
offset += 2;
15308+
}
15309+
if (send_ca) {
15310+
MG_STORE_BE24(cert + offset, tls->ca_der.len); // 3 bytes: CA cert length
15311+
offset += 3;
15312+
memmove(cert + offset, tls->ca_der.buf,
15313+
tls->ca_der.len); // CA cert data
15314+
offset += tls->ca_der.len;
15315+
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
15316+
offset += 2;
15317+
}
1531515318
}
1531615319
mg_sha256_update(&tls->sha256, cert, offset);
1531715320
res = mg_tls_encrypt(c, cert, offset, MG_TLS_HANDSHAKE);

‎src/tls_builtin.c‎

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -811,33 +811,36 @@ static bool mg_tls_send_cert(struct mg_connection *c, bool is_client) {
811811
cert = (uint8_t *) mg_calloc(1, 13 + total_size);
812812
if (cert == NULL) return res;
813813
cert[0] = MG_TLS_CERTIFICATE; // handshake header
814+
if (is_client && tls->cert_der.len == 0) total_size = 0; // empty list
814815
MG_STORE_BE24(cert + 1, total_size + 4);
815816
cert[4] = 0; // request context
816817
MG_STORE_BE24(cert + 5, total_size); // 3 bytes: cert (s) length
817818
offset = 8;
818-
MG_STORE_BE24(cert + offset, tls->cert_der.len); // 3 bytes: first cert len
819-
offset += 3;
820-
// bytes 11+ are certificate in DER format
821-
memmove(cert + offset, tls->cert_der.buf, tls->cert_der.len);
822-
offset += tls->cert_der.len;
823-
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
824-
offset += 2;
825-
for (i = 1; i < tls->chain_len; i++) {
826-
MG_STORE_BE24(cert + offset, tls->chain_der[i].len);
827-
offset += 3;
828-
memmove(cert + offset, tls->chain_der[i].buf, tls->chain_der[i].len);
829-
offset += tls->chain_der[i].len;
830-
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
831-
offset += 2;
832-
}
833-
if (send_ca) {
834-
MG_STORE_BE24(cert + offset, tls->ca_der.len); // 3 bytes: CA cert length
819+
if (total_size > 0) { // handle empty list, RFC-8446 4.4.2
820+
MG_STORE_BE24(cert + offset, tls->cert_der.len); // 3 bytes: 1st cert len
835821
offset += 3;
836-
memmove(cert + offset, tls->ca_der.buf,
837-
tls->ca_der.len); // CA cert data
838-
offset += tls->ca_der.len;
822+
// bytes 11+ are certificate in DER format
823+
memmove(cert + offset, tls->cert_der.buf, tls->cert_der.len);
824+
offset += tls->cert_der.len;
839825
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
840826
offset += 2;
827+
for (i = 1; i < tls->chain_len; i++) {
828+
MG_STORE_BE24(cert + offset, tls->chain_der[i].len);
829+
offset += 3;
830+
memmove(cert + offset, tls->chain_der[i].buf, tls->chain_der[i].len);
831+
offset += tls->chain_der[i].len;
832+
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
833+
offset += 2;
834+
}
835+
if (send_ca) {
836+
MG_STORE_BE24(cert + offset, tls->ca_der.len); // 3 bytes: CA cert length
837+
offset += 3;
838+
memmove(cert + offset, tls->ca_der.buf,
839+
tls->ca_der.len); // CA cert data
840+
offset += tls->ca_der.len;
841+
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
842+
offset += 2;
843+
}
841844
}
842845
mg_sha256_update(&tls->sha256, cert, offset);
843846
res = mg_tls_encrypt(c, cert, offset, MG_TLS_HANDSHAKE);

0 commit comments

Comments
 (0)