Update TLS 1.3

src/tls.c

@@ -1999,6 +1999,8 @@ int tls_authorities_from_certs(uint8_t *names, size_t *nameslen, size_t maxlen,
 	return 1;
 }
 
+// 这个函数在语义上有问题:
+//	首先我们判断的是证书链，因此函数名上应该是一个cert_chain
 int tls_authorities_issued_certificate(const uint8_t *ca_names, size_t ca_names_len, const uint8_t *certs, size_t certslen)
 {
 	const uint8_t *cert;
@@ -2240,6 +2242,10 @@ int tls_ctx_init(TLS_CTX *ctx, int protocol, int is_client)
 	ctx->verify_depth = 5;
 
 
+	// 默认就发送一个，因为只要发送key_share，那么至少有一个group
+	ctx->key_exchanges_cnt = 1;
+
+
 	return 1;
 }
 
@@ -2343,6 +2349,11 @@ int tls_ctx_set_ca_certificates(TLS_CTX *ctx, const char *cacertsfile, int depth
 		error_print();
 		return -1;
 	}
+	if (tls_authorities_from_certs(ctx->ca_names, &ctx->ca_names_len, sizeof(ctx->ca_names),
+		ctx->cacerts, ctx->cacertslen) != 1) {
+		error_print();
+		return -1;
+	}
 
 	ctx->verify_depth = depth;
 	return 1;
@@ -2651,8 +2662,6 @@ int tls_ctx_set_supported_groups(TLS_CTX *ctx, const int *groups, size_t groups_
 	}
 	ctx->supported_groups_cnt = groups_cnt;
 
-	ctx->key_exchanges_cnt = (groups_cnt >= 2) ? 2 : 1;
-
 	return 1;
 }
 
@@ -2716,7 +2725,7 @@ int tls_init(TLS_CONNECT *conn, TLS_CTX *ctx)
 
 
 
-	conn->is_client = ctx->is_client;
+	//conn->is_client = ctx->is_client;
 
 	conn->protocol = ctx->protocol;
 
@@ -2753,10 +2762,6 @@ int tls_init(TLS_CONNECT *conn, TLS_CTX *ctx)
 	conn->sign_key = ctx->signkey;
 	conn->kenc_key = ctx->kenckey;
 
-	conn->quiet = ctx->quiet;
-
-
-
 	conn->ctx = ctx;
 
 	conn->key_exchanges_cnt = ctx->key_exchanges_cnt;

src/tls12.c

@@ -172,6 +172,10 @@ int tls_recv_record(TLS_CONNECT *conn)
 	}
 
 	conn->recordlen = conn->record_offset;
+
+
+	// 应该判断是否为Alert这种异常状况
+
 	return 1;
 }
 
@@ -2407,7 +2411,7 @@ int tls_recv_server_finished(TLS_CONNECT *conn)
 		return -1;
 	}
 
-	if (!conn->quiet)
+	if (!conn->ctx->quiet)
 		fprintf(stderr, "Connection established!\n");
 
 	return 1;

src/tls_ext.c

@@ -327,7 +327,7 @@ Example:
 
 */
 
-int tls_signature_algorithms_print_ex(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
+int tls_signature_algorithms_print(FILE *fp, int fmt, int ind, const uint8_t *d, size_t dlen)
 {
 	const uint8_t *sig_algs;
 	size_t sig_algs_len;
@@ -355,6 +355,23 @@ int tls_signature_algorithms_print_ex(FILE *fp, int fmt, int ind, const char *la
 	return 1;
 }
 
+
+int tls_enable_signature_algorithms_cert(TLS_CONNECT *conn)
+{
+	if (!conn) {
+		error_print();
+		return -1;
+	}
+	if (!conn->ctx->signature_algorithms_cnt) {
+		error_print();
+		return -1;
+	}
+	conn->signature_algorithms_cert = 1;
+	return 1;
+}
+
+
+/*
 int tls_signature_algorithms_print(FILE *fp, int fmt, int ind, const uint8_t *d, size_t dlen)
 {
 	if (tls_signature_algorithms_print_ex(fp, fmt, ind, "signature_algorithms", d, dlen) != 1) {
@@ -372,7 +389,7 @@ int tls13_signature_algorithms_cert_print(FILE *fp, int fmt, int ind, const uint
 	}
 	return 1;
 }
-
+*/
 
 
 

src/tls_ocsp.c

@@ -28,7 +28,6 @@
 #include <sys/select.h>
 
 
-
 /*
 status_request(5)
 
@@ -46,7 +45,6 @@ ClientHello.status_request
 	} OCSPStatusRequest;
 */
 
-// 如果两个参数都为空的话，我们应该提供一个空的request			
 int tls_ocsp_status_request_to_bytes(
 	const uint8_t *responder_id_list, size_t responder_id_list_len, // optional
 	const uint8_t *request_exts, size_t request_exts_len, // optinoal
@@ -302,11 +300,11 @@ int tls13_set_client_status_request(TLS_CONNECT *conn,
 		error_print();
 		return -1;
 	}
-	conn->status_request = 1;
 	conn->status_request_responder_id_list = status_request_responder_id_list;
 	conn->status_request_responder_id_list_len = status_request_responder_id_list_len;
 	conn->status_request_exts = status_request_exts;
 	conn->status_request_exts_len = status_request_exts_len;
+	conn->status_request = 1;
 	return 1;
 }
 

src/tls_psk.c

@@ -735,6 +735,7 @@ int tls13_send_new_session_ticket(TLS_CONNECT *conn)
 	return 1;
 }
 
+// 这个函数是有点问题的，还是应该改为recv_new_session_ticket
 int tls13_process_new_session_ticket(TLS_CONNECT *conn)
 {
 	int ret;
@@ -756,7 +757,6 @@ int tls13_process_new_session_ticket(TLS_CONNECT *conn)
 	const uint8_t *cp;
 	size_t len;
 
-
 	// only cheching encoding
 	if ((ret = tls13_record_get_handshake_new_session_ticket(conn->plain_record,
 		&ticket_lifetime, &ticket_age_add, &ticket_nonce, &ticket_nonce_len,
@@ -775,6 +775,9 @@ int tls13_process_new_session_ticket(TLS_CONNECT *conn)
 		const uint8_t *ext_data;
 		size_t ext_datalen;
 
+		// exts in NST
+		//  * early_data
+
 		if (tls_ext_from_bytes(&ext_type, &ext_data, &ext_datalen, &exts, &extslen) != 1) {
 			error_print();
 			return -1;

src/tls_sct.c

@@ -163,3 +163,13 @@ int tls_ctx_enable_signed_certificate_timestamp(TLS_CTX *ctx)
 	ctx->signed_certificate_timestamp = 1;
 	return 1;
 }
+
+
+int tls13_signed_certificate_timestamp_verify(const uint8_t *sct_list, size_t sct_list_len)
+{
+	//error_print();
+	return 1;
+}
+
+
+

src/tls_sni.c

@@ -130,7 +130,7 @@ int tls_server_name_print(FILE *fp, int fmt, int ind, const uint8_t *ext_data, s
 			return -1;
 		}
 		format_print(fp, fmt, ind, "name_type: %s (%d)\n", name_type == 0 ? "host_name" : "(unknown)", name_type);
-		format_bytes(fp, fmt, ind, "host_name", host_name, host_name_len); // TODO: print string
+		format_string(fp, fmt, ind, "host_name", host_name, host_name_len); // TODO: print string
 	}
 	if (ext_datalen) {
 		error_print();