wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-11-15 19:13:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

allow no certs for client with (not enforced) two-way auth

Browse Source
This commit is contained in:
Sergio R. Caprile committed 2026-06-03 13:39:59 -03:00
1 parent 03afe3aeb1
commit 05ef7ebad9
2 files changed
+46 -40
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

mongoose.c
+23 -20
View File
@@ -16125,33 +16125,36 @@ static bool mg_tls_send_cert(struct mg_connection *c, bool is_client) {
cert = (uint8_t *) mg_calloc(1, 13 + total_size); cert = (uint8_t *) mg_calloc(1, 13 + total_size);
if (cert == NULL) return res; if (cert == NULL) return res;
cert[0] = MG_TLS_CERTIFICATE; // handshake header cert[0] = MG_TLS_CERTIFICATE; // handshake header
if (is_client && tls->cert_der.len == 0) total_size = 0; // empty list
MG_STORE_BE24(cert + 1, total_size + 4); MG_STORE_BE24(cert + 1, total_size + 4);
cert[4] = 0; // request context cert[4] = 0; // request context
MG_STORE_BE24(cert + 5, total_size); // 3 bytes: cert (s) length MG_STORE_BE24(cert + 5, total_size); // 3 bytes: cert (s) length
offset = 8; offset = 8;
MG_STORE_BE24(cert + offset, tls->cert_der.len); // 3 bytes: first cert len if (total_size > 0) { // handle empty list, RFC-8446 4.4.2
offset += 3; MG_STORE_BE24(cert + offset, tls->cert_der.len); // 3 bytes: 1st cert len
// bytes 11+ are certificate in DER format
memmove(cert + offset, tls->cert_der.buf, tls->cert_der.len);
offset += tls->cert_der.len;
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
offset += 2;
for (i = 1; i < tls->chain_len; i++) {
MG_STORE_BE24(cert + offset, tls->chain_der[i].len);
offset += 3; offset += 3;
memmove(cert + offset, tls->chain_der[i].buf, tls->chain_der[i].len); // bytes 11+ are certificate in DER format
offset += tls->chain_der[i].len; memmove(cert + offset, tls->cert_der.buf, tls->cert_der.len);
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none) offset += tls->cert_der.len;
offset += 2;
}
if (send_ca) {
MG_STORE_BE24(cert + offset, tls->ca_der.len); // 3 bytes: CA cert length
offset += 3;
memmove(cert + offset, tls->ca_der.buf,
tls->ca_der.len); // CA cert data
offset += tls->ca_der.len;
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none) MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
offset += 2; offset += 2;
for (i = 1; i < tls->chain_len; i++) {
MG_STORE_BE24(cert + offset, tls->chain_der[i].len);
offset += 3;
memmove(cert + offset, tls->chain_der[i].buf, tls->chain_der[i].len);
offset += tls->chain_der[i].len;
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
offset += 2;
}
if (send_ca) {
MG_STORE_BE24(cert + offset, tls->ca_der.len); // 3 bytes: CA cert length
offset += 3;
memmove(cert + offset, tls->ca_der.buf,
tls->ca_der.len); // CA cert data
offset += tls->ca_der.len;
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
offset += 2;
}
} }
mg_sha256_update(&tls->sha256, cert, offset); mg_sha256_update(&tls->sha256, cert, offset);
res = mg_tls_encrypt(c, cert, offset, MG_TLS_HANDSHAKE); res = mg_tls_encrypt(c, cert, offset, MG_TLS_HANDSHAKE);
src/tls_builtin.c
+23 -20
View File
@@ -813,33 +813,36 @@ static bool mg_tls_send_cert(struct mg_connection *c, bool is_client) {
cert = (uint8_t *) mg_calloc(1, 13 + total_size); cert = (uint8_t *) mg_calloc(1, 13 + total_size);
if (cert == NULL) return res; if (cert == NULL) return res;
cert[0] = MG_TLS_CERTIFICATE; // handshake header cert[0] = MG_TLS_CERTIFICATE; // handshake header
if (is_client && tls->cert_der.len == 0) total_size = 0; // empty list
MG_STORE_BE24(cert + 1, total_size + 4); MG_STORE_BE24(cert + 1, total_size + 4);
cert[4] = 0; // request context cert[4] = 0; // request context
MG_STORE_BE24(cert + 5, total_size); // 3 bytes: cert (s) length MG_STORE_BE24(cert + 5, total_size); // 3 bytes: cert (s) length
offset = 8; offset = 8;
MG_STORE_BE24(cert + offset, tls->cert_der.len); // 3 bytes: first cert len if (total_size > 0) { // handle empty list, RFC-8446 4.4.2
offset += 3; MG_STORE_BE24(cert + offset, tls->cert_der.len); // 3 bytes: 1st cert len
// bytes 11+ are certificate in DER format
memmove(cert + offset, tls->cert_der.buf, tls->cert_der.len);
offset += tls->cert_der.len;
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
offset += 2;
for (i = 1; i < tls->chain_len; i++) {
MG_STORE_BE24(cert + offset, tls->chain_der[i].len);
offset += 3; offset += 3;
memmove(cert + offset, tls->chain_der[i].buf, tls->chain_der[i].len); // bytes 11+ are certificate in DER format
offset += tls->chain_der[i].len; memmove(cert + offset, tls->cert_der.buf, tls->cert_der.len);
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none) offset += tls->cert_der.len;
offset += 2;
}
if (send_ca) {
MG_STORE_BE24(cert + offset, tls->ca_der.len); // 3 bytes: CA cert length
offset += 3;
memmove(cert + offset, tls->ca_der.buf,
tls->ca_der.len); // CA cert data
offset += tls->ca_der.len;
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none) MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
offset += 2; offset += 2;
for (i = 1; i < tls->chain_len; i++) {
MG_STORE_BE24(cert + offset, tls->chain_der[i].len);
offset += 3;
memmove(cert + offset, tls->chain_der[i].buf, tls->chain_der[i].len);
offset += tls->chain_der[i].len;
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
offset += 2;
}
if (send_ca) {
MG_STORE_BE24(cert + offset, tls->ca_der.len); // 3 bytes: CA cert length
offset += 3;
memmove(cert + offset, tls->ca_der.buf,
tls->ca_der.len); // CA cert data
offset += tls->ca_der.len;
MG_STORE_BE16(cert + offset, 0); // certificate extensions (none)
offset += 2;
}
} }
mg_sha256_update(&tls->sha256, cert, offset); mg_sha256_update(&tls->sha256, cert, offset);
res = mg_tls_encrypt(c, cert, offset, MG_TLS_HANDSHAKE); res = mg_tls_encrypt(c, cert, offset, MG_TLS_HANDSHAKE);