Return new error CTX_BUSY_E on APIs which would modify aliased buffers

[padelsbach]

Description

Alternate approach to #10860. Prevent several APIs from running in SNI callback since they would free buffers pointed to by both the WOLFSSL and WOLFSSL_CTX objects.

Fixes zd 22107

The full list of newly disallowed functions is below. Instead, applications should use wolfSSL_use_certificate_file, wolfSSL_use_PrivateKey_file, wolfSSL_SetTmpDH, wolfSSL_set_SSL_CTX, wolfSSL_CTX_load_verify_locations.

Certificate (leaf)

wolfSSL_CTX_use_certificate_file
wolfSSL_CTX_use_certificate_buffer
wolfSSL_CTX_use_certificate_ASN1
wolfSSL_CTX_use_certificate (X509)
wolfSSL_CTX_use_certificate_label (WOLF_CRYPTO_CB)
wolfSSL_CTX_use_certificate_id (WOLF_CRYPTO_CB)

Certificate chain

wolfSSL_CTX_use_certificate_chain_file
wolfSSL_CTX_use_certificate_chain_file_format
wolfSSL_CTX_use_certificate_chain_buffer
wolfSSL_CTX_use_certificate_chain_buffer_format
wolfSSL_CTX_add_extra_chain_cert
wolfSSL_CTX_add0_chain_cert → via add1
wolfSSL_CTX_add1_chain_cert
wolfSSL_CTX_ctrl — SSL_CTRL_CHAIN (and SSL_CTRL_EXTRA_CHAIN_CERT via add_extra_chain_cert)

Private key

wolfSSL_CTX_use_PrivateKey_file
wolfSSL_CTX_use_PrivateKey_buffer
wolfSSL_CTX_use_PrivateKey_ASN1
wolfSSL_CTX_use_PrivateKey (EVP_PKEY)
wolfSSL_CTX_use_RSAPrivateKey
wolfSSL_CTX_use_RSAPrivateKey_file → via use_PrivateKey_file
wolfSSL_CTX_use_PrivateKey_Id (WOLF_PRIVATE_KEY_ID)
wolfSSL_CTX_use_PrivateKey_Id_ex → via _Id
wolfSSL_CTX_use_PrivateKey_Label (WOLF_PRIVATE_KEY_ID)

Alt private key (WOLFSSL_DUAL_ALG_CERTS)

wolfSSL_CTX_use_AltPrivateKey_file
wolfSSL_CTX_use_AltPrivateKey_buffer
wolfSSL_CTX_use_AltPrivateKey_Id
wolfSSL_CTX_use_AltPrivateKey_Id_ex → via _Id
wolfSSL_CTX_use_AltPrivateKey_Label

DH parameters

wolfSSL_CTX_SetTmpDH
wolfSSL_CTX_SetTmpDH_buffer
wolfSSL_CTX_SetTmpDH_file
wolfSSL_CTX_set_tmp_dh (OpenSSL-compat, WOLFSSL_DH*)

Cert manager

wolfSSL_CTX_UnloadIntermediateCerts

Testing

Added unit tests.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[padelsbach]

jenkins retest this please

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m3

• FLASH: .text +28 B (+0.0%, 122,509 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4

• FLASH: .rodata.wolfSSL_ERR_reason_error_string.str1.1 +57 B, .text +64 B (+0.1%, 200,441 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +64 B, .text +192 B (+0.0%, 771,404 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-pq

• FLASH: .rodata +56 B, .text +64 B (+0.0%, 279,516 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .rodata +64 B, .text +64 B (+0.0%, 325,184 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +64 B (+0.1%, 123,277 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4-tls13

• FLASH: .rodata.wolfSSL_ERR_reason_error_string.str1.1 +57 B, .text +64 B (+0.1%, 236,203 B / 262,144 B, total: 90% used)

gcc-arm-cortex-m7

• FLASH: .rodata.wolfSSL_ERR_reason_error_string.str1.1 +57 B, .text +64 B (+0.1%, 200,441 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m7-pq

• FLASH: .rodata +56 B, .text +64 B (+0.0%, 280,092 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m7-tls13

• FLASH: .rodata.wolfSSL_ERR_reason_error_string.str1.1 +57 B, .text +64 B (+0.1%, 236,267 B / 262,144 B, total: 90% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-sp-math
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[padelsbach]

Rolling this into the hybrid approach in #10905. Closing this PR