Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix not calling the signing callback when using PK callbacks + TLS 1.3. #7761

Merged
merged 1 commit into from
Jul 19, 2024

Conversation

kareem-wolfssl
Copy link
Contributor

Description

Fixes zd#18300

Testing

Customer confirmed fix

Checklist

  • added tests
  • updated/added doxygen
  • updated appropriate READMEs
  • Updated manual and documentation

Copy link
Contributor

@dgarske dgarske left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kareem-wolfssl ,

Fix looks good, but it would be nice if our test cases covered this...

I was able to reproduce the issue with ./configure --enable-pkcallbacks CFLAGS="-DTEST_PK_PRIVKEY -DDEBUG_PK_CB" && make && ./tests/unit.test. And confirmed this fix resolves it... Any idea why that wasn't picked up with our CI?

starting TLSv13 extra cipher suite tests
trying server command line[1001]: SuiteTest -v 4 -l TLS13-CHACHA20-POLY1305-SHA256 -2 -p 0 -P
trying client command line[1002]: SuiteTest -v 4 -l TLS13-CHACHA20-POLY1305-SHA256 -2 -p 62126 -P
PK ECC KeyGen: keySz 32, Curve ID 7
PK ECC KeyGen: ret 0
PK ECC KeyGen: keySz 32, Curve ID 7
PK ECC KeyGen: ret 0
PK HKDF Extract: ret 0 saltLen 0 ikmLen 32
PK ECC PMS: Side server, Peer Curve 7
PK ECC PMS: Side client, Peer Curve 7
PK ECC PMS: ret 0, PubKeySz 65, OutLen 32
PK HKDF Extract: ret 0 saltLen 32 ikmLen 32
Set Encrypt Keys CbSet Encrypt Keys Cb: ret -288
PK ECC PMS: ret 0, PubKeySz 65, OutLen 32
PK HKDF Extract: ret 0 saltLen 0 ikmLen 32
PK HKDF Extract: ret 0 saltLen 32 ikmLen 32
Set Encrypt Keys CbSet Encrypt Keys Cb: ret -288
SSL_accept error -317, need the private key
wolfSSL error: SSL_accept failed
PK RSA Verify: sigSz 256, keySz 270
PK RSA Verify: ret 51

This line args->sigLen = (word16)GetPrivateKeySigSize(ssl); is a copy/paste from the TLS v1.2 code, which existed before the TLS v1.3 code.

@dgarske dgarske merged commit 08b211c into wolfSSL:master Jul 19, 2024
119 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants