romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 20:13:35 +03:00
Code Issues Projects Releases Packages Wiki Activity

mbedtls: v3.6.0 workarounds

Browse source 
- add special sauce to disable unwanted peer verification by mbedtls
  when negotiating TLS v1.3
- add special sauce for MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET
  return code on *writing* TLS data. We assume the data had not been
  written and EAGAIN.
- return correct Curl error code when peer verification failed.
- disable test_08_05 with 50 HTTP/1.1 connections, as mbedtls reports a
  memory allocation failed during handshake.
- bump CI mbedtls version to 3.6.0

Fixes #13653
Closes #13838
This commit is contained in:
Stefan Eissing 2024-05-31 13:01:17 +02:00 • committed by Daniel Stenberg
parent 5dd8f13bfc
commit 5f9017d4e2
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 52 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

52
lib/vtls/mbedtls.c
View file

@ -483,6 +483,20 @@ mbed_set_selected_ciphers(struct Curl_easy *data,
return CURLE_OK;
}
#ifdef TLS13_SUPPORT
static int mbed_no_verify(void *udata, mbedtls_x509_crt *crt,
int depth, uint32_t *flags)
{
(void)udata;
(void)crt;
(void)depth;
/* we clear any faults the mbedtls' own verification found.
* See <https://github.com/Mbed-TLS/mbedtls/issues/9210> */
*flags = 0;
return 0;
}
#endif
static CURLcode
mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
{
@ -739,6 +753,16 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
failf(data, "mbedTLS: ssl_config failed");
return CURLE_SSL_CONNECT_ERROR;
}
#ifdef TLS13_SUPPORT
if(!verifypeer) {
/* Default verify behaviour changed in mbedtls v3.6.0 with TLS v1.3.
* On 1.3 connections, the handshake fails by default without trust
* anchors. We override this questionable change by installing our
* own verify callback that clears all errors. */
mbedtls_ssl_conf_verify(&backend->config, mbed_no_verify, cf);
}
#endif
mbedtls_ssl_init(&backend->ssl);
backend->initialized = TRUE;
@ -926,10 +950,16 @@ mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
connssl->connecting_state = ssl_connect_2_writing;
return CURLE_OK;
}
else if(ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED) {
failf(data, "peer certificate could not be verified");
return CURLE_PEER_FAILED_VERIFICATION;
}
else if(ret) {
char errorbuf[128];
CURL_TRC_CF(data, cf, "TLS version %04X",
mbedtls_ssl_get_version_number(&backend->ssl));
mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
failf(data, "ssl_handshake returned - mbedTLS: (-0x%04X) %s",
failf(data, "ssl_handshake returned: (-0x%04X) %s",
-ret, errorbuf);
return CURLE_SSL_CONNECT_ERROR;
}
@ -1150,8 +1180,13 @@ static ssize_t mbed_send(struct Curl_cfilter *cf, struct Curl_easy *data,
ret = mbedtls_ssl_write(&backend->ssl, (unsigned char *)mem, len);
if(ret < 0) {
*curlcode = (ret == MBEDTLS_ERR_SSL_WANT_WRITE) ?
CURLE_AGAIN : CURLE_SEND_ERROR;
CURL_TRC_CF(data, cf, "mbedtls_ssl_write(len=%zu) -> -0x%04X",
len, -ret);
*curlcode = ((ret == MBEDTLS_ERR_SSL_WANT_WRITE)
#ifdef TLS13_SUPPORT
|| (ret == MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET)
#endif
)? CURLE_AGAIN : CURLE_SEND_ERROR;
ret = -1;
}
@ -1179,7 +1214,7 @@ static void mbedtls_close(struct Curl_cfilter *cf, struct Curl_easy *data)
Read it to avoid an RST on the TCP connection. */
(void)mbedtls_ssl_read(&backend->ssl, (unsigned char *)buf, sizeof(buf));
ret = mbedtls_ssl_close_notify(&backend->ssl);
CURL_TRC_CF(data, cf, "close_notify() -> %x", ret);
CURL_TRC_CF(data, cf, "close_notify() -> %04x", -ret);
mbedtls_pk_free(&backend->pk);
mbedtls_x509_crt_free(&backend->clicert);
@ -1213,16 +1248,21 @@ static ssize_t mbed_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
ret = mbedtls_ssl_read(&backend->ssl, (unsigned char *)buf,
buffersize);
if(ret <= 0) {
CURL_TRC_CF(data, cf, "mbedtls_ssl_read(len=%zu) -> -0x%04X",
buffersize, -ret);
if(ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY)
return 0;
*curlcode = ((ret == MBEDTLS_ERR_SSL_WANT_READ)
#ifdef TLS13_SUPPORT
|| (ret == MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET)
#endif
) ? CURLE_AGAIN : CURLE_RECV_ERROR;
if(*curlcode != CURLE_AGAIN) {
char errorbuf[128];
mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
failf(data, "ssl_read returned: (-0x%04X) %s", -ret, errorbuf);
}
return -1;
}