More specific error for unexpected cert request

[lrstewart]

Description of changes:

A customer saw a confusing S2N_ERR_BAD_MESSAGE error when their server requested client auth but their client wasn't configured to support client auth. I'm adding a more specific error, since this seems like it would be a fairly common situation.

Call-outs:

I'm not changing any behavior here, but is the current behavior correct? It seems to me like a client shouldn't fail if the server requests client auth, it should just act like it does when S2N_CERT_AUTH_OPTIONAL is chosen and send an empty certificate. Basically, I think clients should default to S2N_CERT_AUTH_OPTIONAL instead of S2N_CERT_AUTH_NONE.

A better error is an improvement, but I'm wondering if the correct fix is a behavior change.

Testing:

Added a new self-talk test for the handshake.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[goatgoose]

Basically, I think clients should default to S2N_CERT_AUTH_OPTIONAL instead of S2N_CERT_AUTH_NONE.

Yeah, this makes sense to me. Since this is currently inherited by the config, we should just be careful not to enable this by default for servers.

[maddeleine]

Basically, I think clients should default to S2N_CERT_AUTH_OPTIONAL instead of S2N_CERT_AUTH_NONE.

Yeah, this makes sense to me. Since this is currently inherited by the config, we should just be careful not to enable this by default for servers.

Any idea why we had this behavior in the first place? It does seem weird to error on the client-side in this case.

[lrstewart]

Basically, I think clients should default to S2N_CERT_AUTH_OPTIONAL instead of S2N_CERT_AUTH_NONE.

Yeah, this makes sense to me. Since this is currently inherited by the config, we should just be careful not to enable this by default for servers.

Any idea why we had this behavior in the first place? It does seem weird to error on the client-side in this case.

Nope. We'd need to investigate before making the change. Changing default behavior is always risky-- maybe it was just a mistake, or maybe there was a good reason for it we're just not guessing.