Skip to content

Commit

Permalink
Merge pull request #8345 from JacobBarthelmeh/python_update
Browse files Browse the repository at this point in the history 
Python update to 3.12.6
  • Loading branch information
@dgarske
dgarske authored Jan 24, 2025
2 parents 7ad4131 + 69be9aa commit 2e87dfc
Show file tree
Hide file tree
Showing 20 changed files with 1,002 additions and 331 deletions.
109 changes: 71 additions & 38 deletions src/internal.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7785,6 +7785,14 @@ int InitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup)
return MEMORY_E;
}
XMEMSET(ssl->param, 0, sizeof(WOLFSSL_X509_VERIFY_PARAM));

/* pass on PARAM flags value from ctx to ssl */
if (wolfSSL_X509_VERIFY_PARAM_set_flags(wolfSSL_get0_param(ssl),
(unsigned long)wolfSSL_X509_VERIFY_PARAM_get_flags(
wolfSSL_CTX_get0_param(ctx))) != WOLFSSL_SUCCESS) {
WOLFSSL_MSG("ssl->param set flags error");
return WOLFSSL_FAILURE;
}
#endif

if (ctx->suites == NULL) {
Expand Down Expand Up @@ -8364,6 +8372,16 @@ void FreeSuites(WOLFSSL* ssl)
wolfSSL_sk_SSL_CIPHER_free(ssl->suitesStack);
ssl->suitesStack = NULL;
}
if (ssl->clSuitesStack != NULL) {
/* Enough to free stack structure since WOLFSSL_CIPHER
* isn't allocated separately. */
wolfSSL_sk_SSL_CIPHER_free(ssl->clSuitesStack);
ssl->clSuitesStack = NULL;
}
#endif
#ifdef OPENSSL_EXTRA
XFREE(ssl->clSuites, ssl->heap, DYNAMIC_TYPE_SUITES);
ssl->clSuites = NULL;
#endif
XFREE(ssl->suites, ssl->heap, DYNAMIC_TYPE_SUITES);
ssl->suites = NULL;
Expand Down Expand Up @@ -8731,6 +8749,7 @@ void wolfSSL_ResourceFree(WOLFSSL* ssl)
* isn't allocated separately. */
wolfSSL_sk_CIPHER_free(ssl->supportedCiphers);
wolfSSL_sk_X509_pop_free(ssl->peerCertChain, NULL);
wolfSSL_sk_X509_pop_free(ssl->verifiedChain, NULL);
#ifdef KEEP_OUR_CERT
wolfSSL_sk_X509_pop_free(ssl->ourCertChain, NULL);
#endif
Expand Down Expand Up @@ -14995,6 +15014,25 @@ static int ProcessPeerCertsChainCRLCheck(WOLFSSL* ssl, ProcPeerCertArgs* args)
}
#endif

#ifdef OPENSSL_EXTRA
/* account for verify params flag set */
static int AdjustCMForParams(WOLFSSL* ssl)
{
int flags;
WOLFSSL_X509_VERIFY_PARAM* param;

param = wolfSSL_get0_param(ssl);
flags = wolfSSL_X509_VERIFY_PARAM_get_flags(param);

/* For now there is a possible contradiction of PARAM flags and store flags.
* Do not disable CRL support if it has already been enabled with store. */
if (flags == 0) {
return WOLFSSL_SUCCESS;
}
return wolfSSL_X509_STORE_set_flags(SSL_STORE(ssl), flags);
}
#endif

int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
word32 totalSz)
{
Expand Down Expand Up @@ -15063,6 +15101,14 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
#endif
}

#ifdef OPENSSL_EXTRA
/* account for verify params flag set */
if (AdjustCMForParams(ssl) != WOLFSSL_SUCCESS) {
WOLFSSL_MSG("Issue with updating store flags from PARAMS set");
ERROR_OUT(WOLFSSL_FAILURE, exit_ppc);
}
#endif

switch (ssl->options.asyncState)
{
case TLS_ASYNC_BEGIN:
Expand Down Expand Up @@ -37553,11 +37599,6 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
{
byte b;
ProtocolVersion pv;
#ifdef WOLFSSL_SMALL_STACK
Suites* clSuites = NULL;
#else
Suites clSuites[1];
#endif
word32 i = *inOutIdx;
word32 begin = i;
int ret = 0;
Expand Down Expand Up @@ -37855,40 +37896,40 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
goto out;
}

#ifdef WOLFSSL_SMALL_STACK
clSuites = (Suites*)XMALLOC(sizeof(Suites), ssl->heap,
XFREE(ssl->clSuites, ssl->heap, DYNAMIC_TYPE_SUITES);
ssl->clSuites = (Suites*)XMALLOC(sizeof(Suites), ssl->heap,
DYNAMIC_TYPE_SUITES);
if (clSuites == NULL) {
if (ssl->clSuites == NULL) {
ret = MEMORY_E;
goto out;
}
#endif
XMEMSET(clSuites, 0, sizeof(Suites));
ato16(&input[i], &clSuites->suiteSz);
XMEMSET(ssl->clSuites, 0, sizeof(Suites));
ato16(&input[i], &ssl->clSuites->suiteSz);
i += OPAQUE16_LEN;

/* Cipher suite lists are always multiples of two in length. */
if (clSuites->suiteSz % 2 != 0) {
if (ssl->clSuites->suiteSz % 2 != 0) {
ret = BUFFER_ERROR;
goto out;
}

/* suites and compression length check */
if ((i - begin) + clSuites->suiteSz + OPAQUE8_LEN > helloSz) {
if ((i - begin) + ssl->clSuites->suiteSz + OPAQUE8_LEN > helloSz) {
ret = BUFFER_ERROR;
goto out;
}

if (clSuites->suiteSz > WOLFSSL_MAX_SUITE_SZ) {
if (ssl->clSuites->suiteSz > WOLFSSL_MAX_SUITE_SZ) {
ret = BUFFER_ERROR;
goto out;
}

XMEMCPY(clSuites->suites, input + i, clSuites->suiteSz);
XMEMCPY(ssl->clSuites->suites, input + i, ssl->clSuites->suiteSz);

#ifdef HAVE_SERVER_RENEGOTIATION_INFO
/* check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV suite */
if (FindSuite(clSuites, 0, TLS_EMPTY_RENEGOTIATION_INFO_SCSV) >= 0) {
if (FindSuite(ssl->clSuites, 0, TLS_EMPTY_RENEGOTIATION_INFO_SCSV) >=
0) {
TLSX* extension;

/* check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV suite */
Expand All @@ -37910,7 +37951,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
#endif /* HAVE_SERVER_RENEGOTIATION_INFO */
#if defined(HAVE_FALLBACK_SCSV) || defined(OPENSSL_ALL)
/* check for TLS_FALLBACK_SCSV suite */
if (FindSuite(clSuites, TLS_FALLBACK_SCSV, 0) >= 0) {
if (FindSuite(ssl->clSuites, TLS_FALLBACK_SCSV, 0) >= 0) {
WOLFSSL_MSG("Found Fallback SCSV");
if (ssl->ctx->method->version.minor > pv.minor) {
WOLFSSL_MSG("Client trying to connect with lesser version");
Expand All @@ -37921,8 +37962,8 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
}
#endif

i += clSuites->suiteSz;
clSuites->hashSigAlgoSz = 0;
i += ssl->clSuites->suiteSz;
ssl->clSuites->hashSigAlgoSz = 0;

/* compression length */
b = input[i++];
Expand Down Expand Up @@ -38009,7 +38050,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
#ifdef HAVE_TLS_EXTENSIONS
/* tls extensions */
if ((ret = TLSX_Parse(ssl, input + i, totalExtSz, client_hello,
clSuites)))
ssl->clSuites)))
goto out;
#ifdef WOLFSSL_TLS13
if (TLSX_Find(ssl->extensions,
Expand Down Expand Up @@ -38065,15 +38106,16 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
goto out;
}

clSuites->hashSigAlgoSz = hashSigAlgoSz;
if (clSuites->hashSigAlgoSz > WOLFSSL_MAX_SIGALGO) {
ssl->clSuites->hashSigAlgoSz = hashSigAlgoSz;
if (ssl->clSuites->hashSigAlgoSz >
WOLFSSL_MAX_SIGALGO) {
WOLFSSL_MSG("ClientHello SigAlgo list exceeds max, "
"truncating");
clSuites->hashSigAlgoSz = WOLFSSL_MAX_SIGALGO;
ssl->clSuites->hashSigAlgoSz = WOLFSSL_MAX_SIGALGO;
}

XMEMCPY(clSuites->hashSigAlgo, &input[i],
clSuites->hashSigAlgoSz);
XMEMCPY(ssl->clSuites->hashSigAlgo, &input[i],
ssl->clSuites->hashSigAlgoSz);

i += hashSigAlgoSz;
}
Expand Down Expand Up @@ -38104,7 +38146,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
/* ProcessOld uses same resume code */
WOLFSSL_MSG_EX("ssl->options.resuming %d", ssl->options.resuming);
if (ssl->options.resuming) {
ret = HandleTlsResumption(ssl, clSuites);
ret = HandleTlsResumption(ssl, ssl->clSuites);
if (ret != 0)
goto out;

Expand Down Expand Up @@ -38140,19 +38182,12 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
#endif

#ifdef OPENSSL_EXTRA
ssl->clSuites = clSuites; /* cppcheck-suppress autoVariables
*
* (suppress warning that ssl, a persistent
* non-local allocation, has its ->clSuites
* set to clSuites, a local stack allocation.
* we clear this assignment before returning.)
*/
/* Give user last chance to provide a cert for cipher selection */
if (ret == 0 && ssl->ctx->certSetupCb != NULL)
ret = CertSetupCbWrapper(ssl);
#endif
if (ret == 0)
ret = MatchSuite(ssl, clSuites);
ret = MatchSuite(ssl, ssl->clSuites);

#if defined(HAVE_TLS_EXTENSIONS) && defined(HAVE_ENCRYPT_THEN_MAC) && \
!defined(WOLFSSL_AEAD_ONLY)
Expand All @@ -38170,11 +38205,9 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
#endif

out:
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
#if !defined(OPENSSL_EXTRA)
XFREE(ssl->clSuites, ssl->heap, DYNAMIC_TYPE_SUITES);
ssl->clSuites = NULL;
#endif
#ifdef WOLFSSL_SMALL_STACK
XFREE(clSuites, ssl->heap, DYNAMIC_TYPE_SUITES);
#endif
WOLFSSL_LEAVE("DoClientHello", ret);
WOLFSSL_END(WC_FUNC_CLIENT_HELLO_DO);
Expand Down
Loading

0 comments on commit 2e87dfc

Please sign in to comment.