WolfSSL
/
wolfTPM
mirror of https://github.com/wolfSSL/wolfTPM.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #598 from aidangarske/examples-fixes-11902 

Fix error handling in wolfTPM examples
pull/603/head
David Garske 2026-09-10 10:42:33 -07:00 committed by GitHub
parent 5f3a6af5af 0df6f5253a
commit 338f56fedc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
9 changed files with 161 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
examples/attestation/make_credential.c
View File

@ -153,8 +153,13 @@ int TPM2_MakeCredential_Example(void* userCtx, int argc, char *argv[])
XMEMSET(&makeCredIn, 0, sizeof(makeCredIn));
XMEMSET(&makeCredOut, 0, sizeof(makeCredOut));
makeCredIn.credential.size = CRED_SECRET_SIZE;
wolfTPM2_GetRandom(&dev, makeCredIn.credential.buffer,
rc = wolfTPM2_GetRandom(&dev, makeCredIn.credential.buffer,
makeCredIn.credential.size);
if (rc != TPM_RC_SUCCESS) {
printf("wolfTPM2_GetRandom failed 0x%x: %s\n", rc,
TPM2_GetRCString(rc));
goto exit;
}
/* Set the object name */
if (name.size > sizeof(makeCredIn.objectName.name)) {
printf("Name size %d exceeds buffer\n", name.size);
@ -180,14 +185,23 @@ int TPM2_MakeCredential_Example(void* userCtx, int argc, char *argv[])
#if !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES)
fp = XFOPEN(output, "wb");
if (fp != XBADFILE) {
dataSize = (int)XFWRITE((BYTE*)&makeCredOut.credentialBlob, 1,
sizeof(makeCredOut.credentialBlob), fp);
if (dataSize > 0) {
dataSize += (int)XFWRITE((BYTE*)&makeCredOut.secret, 1,
sizeof(makeCredOut.secret), fp);
}
XFCLOSE(fp);
if (fp == XBADFILE) {
printf("Failed to open %s for writing\n", output);
rc = BAD_FUNC_ARG;
goto exit;
}
dataSize = (int)XFWRITE((BYTE*)&makeCredOut.credentialBlob, 1,
sizeof(makeCredOut.credentialBlob), fp);
if (dataSize == (int)sizeof(makeCredOut.credentialBlob)) {
dataSize += (int)XFWRITE((BYTE*)&makeCredOut.secret, 1,
sizeof(makeCredOut.secret), fp);
}
XFCLOSE(fp);
if (dataSize != (int)(sizeof(makeCredOut.credentialBlob) +
sizeof(makeCredOut.secret))) {
printf("Failed to write credential blob and secret to %s\n", output);
rc = BAD_FUNC_ARG;
goto exit;
}
printf("Wrote credential blob and secret to %s, %d bytes\n",
output, dataSize);

36
examples/pcr/extend.c
View File

@ -75,6 +75,11 @@ int TPM2_PCR_Extend_Test(void* userCtx, int argc, char *argv[])
enum wc_HashType hashType;
wc_HashAlg dig;
int hashInitialized = 0;
#elif !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES) && \
defined(WOLFTPM2_NO_WOLFCRYPT)
XFILE fp = NULL;
size_t len;
BYTE extra;
#endif
union {
@ -157,11 +162,19 @@ int TPM2_PCR_Extend_Test(void* userCtx, int argc, char *argv[])
rc = wc_HashInit(&dig, hashType);
if (rc == 0)
hashInitialized = 1;
while (rc == 0 && !XFEOF(fp)) {
while (rc == 0) {
len = XFREAD(dataBuffer, 1, sizeof(dataBuffer), fp);
if (len > 0) {
rc = wc_HashUpdate(&dig, hashType, dataBuffer, (int)len);
}
if (len < sizeof(dataBuffer)) {
/* Short read: end of file, or an input error to report */
if (!XFEOF(fp)) {
printf("Error reading file %s\n", filename);
rc = BAD_FUNC_ARG;
}
break;
}
}
XFCLOSE(fp);
if (rc == 0)
@ -177,7 +190,26 @@ int TPM2_PCR_Extend_Test(void* userCtx, int argc, char *argv[])
hash, hashSz);
}
else
#endif /* !WOLFTPM2_NO_WOLFCRYPT && !NO_FILESYSTEM */
#elif !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES) && \
defined(WOLFTPM2_NO_WOLFCRYPT)
/* Crypto disabled: the file must contain a precomputed digest */
fp = XFOPEN(filename, "rb");
if (fp != XBADFILE) {
len = XFREAD(cmdIn.pcrExtend.digests.digests[0].digest.H, 1,
hashSz, fp);
if ((int)len == hashSz && XFREAD(&extra, 1, 1, fp) != 0) {
len = 0; /* trailing bytes mean this is not a bare digest */
}
XFCLOSE(fp);
if ((int)len != hashSz) {
printf("Expected exactly %d digest bytes in %s\n",
hashSz, filename);
rc = BAD_FUNC_ARG;
goto exit;
}
}
else
#endif /* !NO_FILESYSTEM */
{
printf("Error loading file %s, using test data\n", filename);
for (i=0; i<hashSz; i++) {

14
examples/pcr/quote.c
View File

@ -300,9 +300,17 @@ int TPM2_PCR_Quote_Test(void* userCtx, int argc, char *argv[])
dataSz = cmdOut.quoteResult.quoted.size;
#if !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES)
f = XFOPEN(outputFile, "wb");
if (f != XBADFILE) {
dataSz = (int)XFWRITE(data, 1, dataSz, f);
XFCLOSE(f);
if (f == XBADFILE) {
printf("Failed to open %s for writing\n", outputFile);
rc = BAD_FUNC_ARG;
goto exit;
}
dataSz = (int)XFWRITE(data, 1, dataSz, f);
XFCLOSE(f);
if (dataSz != (int)cmdOut.quoteResult.quoted.size) {
printf("Failed to write quote to %s\n", outputFile);
rc = BAD_FUNC_ARG;
goto exit;
}
printf("Wrote %d bytes to %s\n", dataSz, outputFile);
#else

8
examples/pkcs7/pkcs7.c
View File

@ -221,6 +221,10 @@ static int PKCS7_SignVerifyEx(WOLFTPM2_DEV* dev, int tpmDevId,
XFCLOSE(pemFile);
}
else {
printf("Failed to open %s for writing\n", outFile);
rc = -1; goto exit;
}
#else
(void)outFile;
#endif
@ -306,6 +310,10 @@ static int PKCS7_SignVerify(WOLFTPM2_DEV* dev, int tpmDevId,
rc = -1; goto exit;
}
}
else {
printf("Failed to open %s for writing\n", outFile);
rc = -1; goto exit;
}
#else
(void)outFile;
#endif

43
examples/run_examples.sh
View File

@ -652,9 +652,18 @@ run_tpm_tls_client() { # Usage: run_tpm_tls_client [ecc/rsa] [tpmargs] [tlsversi
generate_port
READY_FILE="/tmp/wolftpm_tls_ready_$$"
rm -f "$READY_FILE"
# The TPM client verifies the peer, so the wolfSSL server presents a cert
# for this key type and the client trusts the CA that issued it
if [ "$1" = "ecc" ]; then
PEER_CERT_ARGS="-c ./certs/server-ecc.pem -k ./certs/ecc-key.pem"
PEER_CA_FILE="$WOLFSSL_PATH/certs/ca-ecc-cert.pem"
else
PEER_CERT_ARGS="-c ./certs/server-cert.pem -k ./certs/server-key.pem"
PEER_CA_FILE="$WOLFSSL_PATH/certs/ca-cert.pem"
fi
pushd $WOLFSSL_PATH >> $TPMPWD/run.out 2>&1
echo -e "./examples/server/server -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem -R $READY_FILE"
./examples/server/server -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem -R "$READY_FILE" >> $TPMPWD/run.out 2>&1 &
echo -e "./examples/server/server -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $PEER_CERT_ARGS -R $READY_FILE"
./examples/server/server -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $PEER_CERT_ARGS -R "$READY_FILE" >> $TPMPWD/run.out 2>&1 &
SERVER_PID=$!
popd >> $TPMPWD/run.out 2>&1
if ! wait_for_ready "$READY_FILE" 500; then
@ -665,8 +674,8 @@ run_tpm_tls_client() { # Usage: run_tpm_tls_client [ecc/rsa] [tpmargs] [tlsversi
fi
rm -f "$READY_FILE"
echo -e "./examples/tls/tls_client -p=$port -$1 $2"
./examples/tls/tls_client -p=$port -$1 $2 >> $TPMPWD/run.out 2>&1
echo -e "./examples/tls/tls_client -p=$port -A=$PEER_CA_FILE -$1 $2"
./examples/tls/tls_client -p=$port "-A=$PEER_CA_FILE" -$1 $2 >> $TPMPWD/run.out 2>&1
RESULT=$?
[ $RESULT -ne 0 ] && echo -e "tpm tls client $1 $2 failed! $RESULT" && exit 1
}
@ -674,9 +683,18 @@ run_tpm_tls_client() { # Usage: run_tpm_tls_client [ecc/rsa] [tpmargs] [tlsversi
run_tpm_tls_server() { # Usage: run_tpm_tls_server [ecc/rsa] [tpmargs] [tlsversion] [extraargs]
echo -e "TLS test (TPM as server) $1 $2 $3"
generate_port
# The TPM server verifies the peer, so the wolfSSL client presents a
# client-auth cert for this key type and the server trusts its issuer
if [ "$1" = "ecc" ]; then
PEER_CERT_ARGS="-c ./certs/client-ecc-ca-cert.pem -k ./certs/ecc-client-key.pem"
PEER_CA_FILE="$WOLFSSL_PATH/certs/ca-ecc-cert.pem"
else
PEER_CERT_ARGS="-c ./certs/client-ca-cert.pem -k ./certs/client-key.pem"
PEER_CA_FILE="$WOLFSSL_PATH/certs/ca-cert.pem"
fi
echo -e "./examples/tls/tls_server -p=$port -$1 $2"
./examples/tls/tls_server -p=$port -$1 $2 >> $TPMPWD/run.out 2>&1 &
echo -e "./examples/tls/tls_server -p=$port -A=$PEER_CA_FILE -$1 $2"
./examples/tls/tls_server -p=$port "-A=$PEER_CA_FILE" -$1 $2 >> $TPMPWD/run.out 2>&1 &
SERVER_PID=$!
if ! wait_for_port "$port" 500; then
echo -e "TPM TLS server failed to start on port $port for $1 $2"
@ -685,8 +703,8 @@ run_tpm_tls_server() { # Usage: run_tpm_tls_server [ecc/rsa] [tpmargs] [tlsversi
fi
pushd $WOLFSSL_PATH >> $TPMPWD/run.out 2>&1
echo -e "./examples/client/client -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $4"
./examples/client/client -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $4 >> $TPMPWD/run.out 2>&1
echo -e "./examples/client/client -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $PEER_CERT_ARGS $4"
./examples/client/client -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $PEER_CERT_ARGS $4 >> $TPMPWD/run.out 2>&1
RESULT=$?
[ $RESULT -ne 0 ] && echo -e "tls client $1 $2 failed! $RESULT" && exit 1
popd >> $TPMPWD/run.out 2>&1
@ -877,8 +895,15 @@ echo -e "PCR Quote tests"
./examples/pcr/reset 16 >> $TPMPWD/run.out 2>&1
RESULT=$?
[ $RESULT -ne 0 ] && echo -e "pcr reset failed! $RESULT" && exit 1
./examples/pcr/extend 16 /usr/bin/zip >> $TPMPWD/run.out 2>&1
PCR_EXTEND_FILE=/usr/bin/zip
if [ $WOLFCRYPT_ENABLE -eq 0 ]; then
# Without wolfCrypt, extend expects a raw, precomputed SHA-256 digest.
PCR_EXTEND_FILE="$TPMPWD/pcr-extend.digest"
printf '%s' '0123456789abcdef0123456789abcdef' > "$PCR_EXTEND_FILE"
fi
./examples/pcr/extend 16 "$PCR_EXTEND_FILE" >> $TPMPWD/run.out 2>&1
RESULT=$?
[ $WOLFCRYPT_ENABLE -eq 0 ] && rm -f "$PCR_EXTEND_FILE"
[ $RESULT -ne 0 ] && echo -e "pcr extend file failed! $RESULT" && exit 1
./examples/pcr/quote 16 zip.quote >> $TPMPWD/run.out 2>&1
RESULT=$?

10
examples/timestamp/clock_set.c
View File

@ -112,8 +112,14 @@ int TPM2_ClockSet_Test(void* userCtx, int argc, char *argv[])
/* Set the TPM clock forward */
cmdIn.clockSet.auth = TPM_RH_OWNER;
if (newClock)
cmdIn.clockSet.newTime = newClock;
if (newClock) {
if (newClock > (UINT64)0xFFFFFFFFFFFFFFFFULL - oldClock) {
printf("Clock increment out of range\n");
rc = BAD_FUNC_ARG;
goto exit;
}
cmdIn.clockSet.newTime = oldClock + newClock;
}
else
cmdIn.clockSet.newTime = oldClock + 50000;
rc = TPM2_ClockSet(&cmdIn.clockSet);

21
examples/tls/tls_client.c
View File

@ -101,6 +101,9 @@ static void usage(void)
printf("* -aes/xor: Use Parameter Encryption\n");
printf("* -h=host: Server hostname (default %s)\n", TLS_HOST);
printf("* -p=port: Supply a custom port number (default %d)\n", TLS_PORT);
#ifndef NO_FILESYSTEM
printf("* -A=file: CA certificate file to trust\n");
#endif
#if defined(WOLFTPM_CRYPTOCB) && defined(HAVE_PK_CALLBACKS)
printf("* -pk: Use PK callbacks, not crypto callbacks\n");
#endif
@ -142,6 +145,9 @@ int TPM2_TLS_ClientArgs(void* userCtx, int argc, char *argv[])
#endif
const char* host = TLS_HOST;
int hostGiven = 0;
#ifndef NO_FILESYSTEM
const char* caFile = NULL;
#endif
int useECC = 0;
int usePK = 0;
#ifdef WOLFTPM_TLS_PQC
@ -226,6 +232,11 @@ int TPM2_TLS_ClientArgs(void* userCtx, int argc, char *argv[])
const char* portStr = argv[argc-1] + XSTRLEN("-p=");
port = (word32)XATOI(portStr);
}
#ifndef NO_FILESYSTEM
else if (XSTRNCMP(argv[argc-1], "-A=", XSTRLEN("-A=")) == 0) {
caFile = argv[argc-1] + XSTRLEN("-A=");
}
#endif
else {
printf("Warning: Unrecognized option: %s\n", argv[argc-1]);
}
@ -479,7 +490,15 @@ tls_setup:
}
#else
/* Load CA Certificates */
if (!useECC) {
if (caFile != NULL) {
if (wolfSSL_CTX_load_verify_locations(ctx, caFile,
0) != WOLFSSL_SUCCESS) {
printf("Error loading %s cert\n", caFile);
rc = -1;
goto exit;
}
}
else if (!useECC) {
#ifndef NO_RSA
if (wolfSSL_CTX_load_verify_locations(ctx, "./certs/ca-rsa-cert.pem",
0) != WOLFSSL_SUCCESS) {

10
examples/tls/tls_common.h
View File

@ -479,16 +479,12 @@ static inline int myVerify(int preverify, WOLFSSL_X509_STORE_CTX* store)
printf("\tSubject's domain name at %d is %s\n",
store->error_depth, store->domain);
(void)preverify;
/* If error indicate we are overriding it for testing purposes */
if (store->error != 0) {
printf("\tAllowing failed certificate check, testing only "
"(shouldn't do this in production)\n");
printf("\tCertificate verification failed\n");
}
/* A non-zero return code indicates failure override */
return 1;
/* Honor the verification result instead of overriding failures */
return preverify;
}
#ifndef NO_DH

21
examples/tls/tls_server.c
View File

@ -122,6 +122,9 @@ static void usage(void)
#endif
printf("* -aes/xor: Use Parameter Encryption\n");
printf("* -p=port: Supply a custom port number (default %d)\n", TLS_PORT);
#ifndef NO_FILESYSTEM
printf("* -A=file: CA certificate file to trust\n");
#endif
#if defined(WOLFTPM_CRYPTOCB) && defined(HAVE_PK_CALLBACKS)
printf("* -pk: Use PK callbacks, not crypto callbacks\n");
#endif
@ -177,6 +180,9 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[])
int usePK = 0;
int runLoop = 0;
int useSelfSign = 0;
#ifndef NO_FILESYSTEM
const char* caFile = NULL;
#endif
#ifdef WOLFTPM_TLS_PQC
int useMLDSA = 0;
TPMI_MLDSA_PARAMETER_SET mldsaSet = TPM_MLDSA_65;
@ -262,6 +268,11 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[])
const char* portStr = argv[argc-1] + XSTRLEN("-p=");
port = (word32)XATOI(portStr);
}
#ifndef NO_FILESYSTEM
else if (XSTRNCMP(argv[argc-1], "-A=", XSTRLEN("-A=")) == 0) {
caFile = argv[argc-1] + XSTRLEN("-A=");
}
#endif
else {
printf("Warning: Unrecognized option: %s\n", argv[argc-1]);
}
@ -526,7 +537,15 @@ tls_setup:
#endif
#else
/* Load CA Certificates */
if (!useECC) {
if (caFile != NULL) {
if (wolfSSL_CTX_load_verify_locations(ctx, caFile,
0) != WOLFSSL_SUCCESS) {
printf("Error loading %s cert\n", caFile);
rc = -1;
goto exit;
}
}
else if (!useECC) {
#ifndef NO_RSA
if (wolfSSL_CTX_load_verify_locations(ctx, CA_RSA_CERT_PATH,
0) != WOLFSSL_SUCCESS) {