From 53acf0bcbfc8f41c0fef460a8e226736d5ffba3a Mon Sep 17 00:00:00 2001 From: David Garske Date: Fri, 1 Dec 2023 14:37:34 -0800 Subject: [PATCH] Use localhost 127.0.0.1 for CSR. Add TLS server option `-self` to use the self signed certs. --- examples/csr/csr.c | 4 ++-- examples/tls/tls_server.c | 26 ++++++++++++++++++-------- 2 files changed, 20 insertions(+), 10 deletions(-) diff --git a/examples/csr/csr.c b/examples/csr/csr.c index 38ea0dc2..6bd3bd09 100644 --- a/examples/csr/csr.c +++ b/examples/csr/csr.c @@ -73,11 +73,11 @@ static int TPM2_CSR_Generate(WOLFTPM2_DEV* dev, int keyType, WOLFTPM2_KEY* key, /* make sure each subject is unique */ if (keyType == RSA_TYPE) { subject = "/C=US/ST=Oregon/L=Portland/SN=Test/O=wolfSSL" - "/OU=RSA/CN=www.wolfssl.com/emailAddress=info@wolfssl.com"; + "/OU=RSA/CN=127.0.0.1/emailAddress=info@wolfssl.com"; } else if (keyType == ECC_TYPE) { subject = "/C=US/ST=Oregon/L=Portland/SN=Test/O=wolfSSL" - "/OU=ECC/CN=www.wolfssl.com/emailAddress=info@wolfssl.com"; + "/OU=ECC/CN=127.0.0.1/emailAddress=info@wolfssl.com"; } outputSz = (int)sizeof(output); diff --git a/examples/tls/tls_server.c b/examples/tls/tls_server.c index 7247b533..fc19f220 100644 --- a/examples/tls/tls_server.c +++ b/examples/tls/tls_server.c @@ -87,6 +87,7 @@ static void usage(void) printf("* -pk: Use PK callbacks, not crypto callbacks\n"); #endif printf("* -i: Run in loop, keep serving connections until failure\n"); + printf("* -self: Use self-signed certs (csr -cert)\n"); } int TPM2_TLS_Server(void* userCtx) @@ -137,6 +138,7 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[]) int useECC = 0; int usePK = 0; int runLoop = 0; + int useSelfSign = 0; TPM_ALG_ID paramEncAlg = TPM_ALG_NULL; WOLFTPM2_SESSION tpmSession; TPMT_PUBLIC publicTemplate; @@ -191,6 +193,9 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[]) else if (XSTRCMP(argv[argc-1], "-i") == 0) { runLoop = 1; } + else if (XSTRCMP(argv[argc-1], "-self") == 0) { + useSelfSign = 1; + } else if (XSTRNCMP(argv[argc-1], "-p=", XSTRLEN("-p=")) == 0) { const char* portStr = argv[argc-1] + XSTRLEN("-p="); port = (word32)XATOI(portStr); @@ -383,13 +388,15 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[]) #ifndef NO_RSA byte der[1024]; word32 derSz = sizeof(der); + const char* useCert = "./certs/server-rsa-cert.pem"; + if (useSelfSign) { + useCert = "./certs/tpm-rsa-cert.pem"; + } - printf("Loading RSA certificate and public key\n"); + printf("Loading RSA certificate (%s) and public key\n", useCert); - if ((rc = wolfSSL_CTX_use_certificate_file(ctx, - "./certs/server-rsa-cert.pem", - WOLFSSL_FILETYPE_PEM)) - != WOLFSSL_SUCCESS) { + if ((rc = wolfSSL_CTX_use_certificate_file(ctx, useCert, + WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { printf("Error loading RSA client cert\n"); goto exit; } @@ -420,11 +427,14 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[]) #ifdef HAVE_ECC byte der[256]; word32 derSz = sizeof(der); + const char* useCert = "./certs/server-ecc-cert.pem"; + if (useSelfSign) { + useCert = "./certs/tpm-ecc-cert.pem"; + } - printf("Loading ECC certificate and public key\n"); + printf("Loading ECC certificate (%s) and public key\n", useCert); - if ((rc = wolfSSL_CTX_use_certificate_file(ctx, - "./certs/server-ecc-cert.pem", + if ((rc = wolfSSL_CTX_use_certificate_file(ctx, useCert, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { printf("Error loading ECC client cert\n"); goto exit;