Fixes to better handle re-use of a WOLFSSL object via wolfSSL_clear

[SparkiDev]

Description

Fixes to better handle re-use of a WOLFSSL object via wolfSSL_clear. The ssl->arrays and ssl->rng fields (as well as a few options bits) needed to be cleared to enable this use-case.

Fixes ZD14659

Testing

Patched example server and client to use wolfSSL_clear:

diff --git a/examples/client/client.c b/examples/client/client.c
index 1d12aa6bf..152988d86 100644
--- a/examples/client/client.c
+++ b/examples/client/client.c
@@ -4190,12 +4190,20 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
     wolfSSL_PrintStatsConn(&ssl_stats);
 #endif

-    wolfSSL_free(ssl); ssl = NULL;
+    if (!resumeSession) {
+        wolfSSL_free(ssl); ssl = NULL;
+    }
     CloseSocket(sockfd);

 #ifndef NO_SESSION_CACHE
     if (resumeSession) {
+    #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)
+        /* test re-use of wolfSSL session via wolfSSL_clear */
+        wolfSSL_clear(ssl);
+        sslResume = ssl;
+    #else
         sslResume = wolfSSL_new(ctx);
+    #endif
         if (sslResume == NULL) {
             wolfSSL_CTX_free(ctx); ctx = NULL;
             err_sys("unable to get SSL object");
diff --git a/examples/server/server.c b/examples/server/server.c
index 049986b97..b1e4fcf18 100644
--- a/examples/server/server.c
+++ b/examples/server/server.c
@@ -2764,7 +2764,9 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
         SetupPkCallbacks(ctx);
 #endif

-    ssl = SSL_new(ctx);
+    if (ssl == NULL) {
+        ssl = SSL_new(ctx);
+    }
     if (ssl == NULL)
         err_sys_ex(catastrophic, "unable to create an SSL object");

@@ -3515,7 +3517,13 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
         wolfSSL_PrintStatsConn(&ssl_stats);

 #endif
+
+    #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)
+        /* test re-use of wolfSSL session via wolfSSL_clear */
+        wolfSSL_clear(ssl);
+    #else
         SSL_free(ssl); ssl = NULL;
+    #endif

         CloseSocket(clientfd);

@@ -3531,6 +3539,8 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
         }
     } /* while(1) */

+    SSL_free(ssl); ssl = NULL;
+
     WOLFSSL_TIME(cnt);
     (void)cnt;

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[dgarske]

This is not ready: Need to review --enable-asynccrypt use case

And:

./examples/server/server -v 4 -l TLS13-AES128-GCM-SHA256 -r -2
./examples/client/client -v 4 -l TLS13-AES128-GCM-SHA256 -r -0 -2

[maxammann]

Looks good to me!