Merge pull request #3769 from cesanta/nocaquit

close connection on bad CA or missing server cert for builtin TLS

mongoose.c

@@ -21164,15 +21164,19 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
       mg_free(all_certs);
     } else { // parse again for a possible DER (or a truncated begin string)
       if (mg_parse_pem(opts->ca, mg_str_s("CERTIFICATE"), &tls->ca_der) < 0) {
-        MG_ERROR(("Failed to load CA certificate"));
-        goto xit;
+        mg_error(c, "Failed to load CA certificate");
+        return;
       }
     } // ca_bundle_len != 0 && ca_der.len = 0 => bundle
     if (!c->is_client) tls->is_twoway = true;  // server + CA: two-way auth
   }
 
   if (opts->cert.buf == NULL || opts->cert.len == 0) {
-    MG_VERBOSE(("No certificate provided"));
+    if (!c->is_client) {
+      mg_error(c, "No server certificate provided");
+      return;
+    }
+    MG_VERBOSE(("No client certificate provided"));
     goto xit;
   }
 

src/tls_builtin.c

@@ -2760,15 +2760,19 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
       mg_free(all_certs);
     } else { // parse again for a possible DER (or a truncated begin string)
       if (mg_parse_pem(opts->ca, mg_str_s("CERTIFICATE"), &tls->ca_der) < 0) {
-        MG_ERROR(("Failed to load CA certificate"));
-        goto xit;
+        mg_error(c, "Failed to load CA certificate");
+        return;
       }
     } // ca_bundle_len != 0 && ca_der.len = 0 => bundle
     if (!c->is_client) tls->is_twoway = true;  // server + CA: two-way auth
   }
 
   if (opts->cert.buf == NULL || opts->cert.len == 0) {
-    MG_VERBOSE(("No certificate provided"));
+    if (!c->is_client) {
+      mg_error(c, "No server certificate provided");
+      return;
+    }
+    MG_VERBOSE(("No client certificate provided"));
     goto xit;
   }
 

test/mip_test.c

@@ -132,13 +132,12 @@ static void tcpdrain_fn(struct mg_connection *c, int ev, void *ev_data) {
     s_drain_conn = c;
 #if MG_TLS == MG_TLS_BUILTIN
     if (s_drain_tls) {
-      struct mg_tls_opts opts;
       struct tls_data *tls;
 
-      memset(&opts, 0, sizeof(opts));
-      mg_tls_init(c, &opts);
-      tls = (struct tls_data *) c->tls;
+      tls = (struct tls_data *) mg_calloc(1, sizeof(*tls));
       ASSERT(tls != NULL);
+      c->tls = tls;
+      c->is_tls = 1;
       ASSERT(mg_iobuf_add(&tls->send, 0, data, sizeof(data)) == sizeof(data));
     } else
 #endif