This new function, wolfSSL_CTX_load_system_CA_certs, currently only supports
Linux-based OS's. It searches through conventional CA directories and once it
finds one, attempts to load CA certs from it. After the first directory is
found, we don't check the others.
This commit also adds a function wolfSSL_get_system_CA_dirs, which returns a
pointer to an array of directories where wolfSSL_CTX_load_system_CA_certs will
look for CA certs. This is used in a unit test, where we only want to expect
success if one of these directories actually exists on the test system.
Finally, this commit adds support for SSL_CTX_set_default_verify_paths to the
compatibility layer. It doesn't model the exact behavior of its OpenSSL
counterpart; it's mostly a wrapper around wolfSSL_CTX_load_system_CA_certs,
manipulating the return value of that function to conform to OpenSSL's
conventions.
Make logic to avoid masking return error conditionally compiled based on STSAFE configuration
Update logic at second crypto-callback location to return error code rather than mask it
In async mode, we always store all handshake messages before processing them. The server hello done message has a length of 0 but we still need to store it to process it.
in DtlsMsgNew(), iff WOLFSSL_ASYNC_CRYPT, allow sz==0 allocation, to fix infinite loop in ProcessReplyEx() around DoDtlsHandShakeMsg();
in DtlsMsgAssembleCompleteMessage() restore fix from 0603031362 for pointerOutOfBounds (undefined behavior) construct;
in ProcessReplyEx(), in WOLFSSL_DTLS13 case ack, check and propagate error from DoDtls13Ack() (fix from @guidovranken).
ticketEncCb can return WC_PENDING_E. If it does in DoClientTicket, we need to
propagate this up to the calling function (e.g. DoPreSharedKeys), rather than
treating it as a failure.
I tested this by running the following experiment
./examples/server/server -v 4 -r &
./examples/client/client -v 4 -r
and adding the following async simulation code to wc_ChaCha20Poly1305_Decrypt:
#ifdef WOLFSSL_ASYNC_CRYPT
static int testAsync = 0;
if ((testAsync++ % 2) == 0) {
return WC_PENDING_E;
}
#endif
Prior to these changes, you can see that the WC_PENDING_E will not be handled
properly in DoClientTicket (using gdb). A full TLS handshake proceeds from
there. With this commit, running the same experiment shows the pending error
being handled properly.
