Fix TLS client example to properly shutdown before closing socket. Added additional logging and fixed comment about certreq.sh script. Improved the cert signing script to not prompt. Also supports option `./certs/certreq.sh clean` to do a clean sign. Added way to do a TPM clean/reset using `TPM2_Wrapper_SetReset`.

certs/certreq.sh

@@ -14,6 +14,12 @@ if [ ! -f ./certs/crlnumber ]; then
 	echo 2000 > ./certs/crlnumber
 fi
 
+if [ $1 == clean ]; then
+	rm ./certs/*.pem
+	rm ./certs/*.der
+	rm ./certs/*.old
+fi
+
 
 # Generate RSA 2048-bit CA
 if [ ! -f ./certs/ca-rsa-key.pem ]; then
@@ -30,7 +36,7 @@ fi
 
 # Sign RSA certificate
 if [ -f ./certs/client-rsa-cert.csr ]; then
-	openssl ca -config ./certs/ca-rsa.cnf -extensions usr_cert -days 3650 -notext -md sha256 -in ./certs/client-rsa-cert.csr -out ./certs/client-rsa-cert.pem
+	openssl ca -config ./certs/ca-rsa.cnf -extensions usr_cert -days 3650 -notext -md sha256 -in ./certs/client-rsa-cert.csr -out ./certs/client-rsa-cert.pem -batch
 	openssl x509 -in ./certs/client-rsa-cert.pem -outform der -out ./certs/client-rsa-cert.der
 fi
 
@@ -56,6 +62,6 @@ if [ -f ./certs/client-ecc-cert.csr ]; then
 	#openssl req -config ./certs/ca-ecc.cnf -sha256 -new -newkey ec:./certs/client-ecc-key.par -keyout ./certs/client-ecc-key.pem -out ./certs/client-ecc-cert.csr -subj "/C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC/CN=www.wolfssl.com/emailAddress=info@wolfssl.com/"
 	#rm ./certs/client-ecc-key.par
 
-	openssl ca -config ./certs/ca-ecc.cnf -extensions usr_cert -days 3650 -notext -md sha256 -in ./certs/client-ecc-cert.csr -out ./certs/client-ecc-cert.pem
+	openssl ca -config ./certs/ca-ecc.cnf -extensions usr_cert -days 3650 -notext -md sha256 -in ./certs/client-ecc-cert.csr -out ./certs/client-ecc-cert.pem -batch
 	openssl x509 -in ./certs/client-ecc-cert.pem -outform der -out ./certs/client-ecc-cert.der
 fi

examples/tls/tls_client.c

@@ -39,7 +39,7 @@
  * Run example for ./examples/csr/csr
  * Result is: ./certs/client-rsa-cert.csr and ./certs/client-ecc-cert.csr
  *
- * Run ./certs/certsign.sh
+ * Run ./certs/certreq.sh
  * Result is: ./certs/client-rsa-cert.pem and ./certs/client-ecc-cert.pem
  */
 
@@ -377,6 +377,7 @@ int TPM2_TLS_Client(void* userCtx)
     /* Load CA Certificate */
     if (wolfSSL_CTX_load_verify_locations(ctx, "./certs/wolfssl-website-ca.pem",
         0) != WOLFSSL_SUCCESS) {
+        printf("Error loading wolfSSL website certs\n");
         goto exit;
     }
 #endif /* !NO_FILESYSTEM */
@@ -395,11 +396,13 @@ int TPM2_TLS_Client(void* userCtx)
 #ifndef NO_RSA
     if ((rc = wolfSSL_CTX_use_certificate_file(ctx, "./certs/client-rsa-cert.pem",
         WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) {
+        printf("Error loading RSA client cert\n");
         goto exit;
     }
 #elif defined(HAVE_ECC)
     if ((rc = wolfSSL_CTX_use_certificate_file(ctx, "./certs/client-ecc-cert.pem",
         WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) {
+        printf("Error loading ECC client cert\n");
         goto exit;
     }
 #endif
@@ -472,8 +475,9 @@ exit:
         printf("Failure 0x%x: %s\n", rc, wolfTPM2_GetRCString(rc));
     }
 
-    CloseAndCleanupSocket(&sockIoCtx);
     wolfSSL_shutdown(ssl);
+
+    CloseAndCleanupSocket(&sockIoCtx);
     wolfSSL_free(ssl);
     wolfSSL_CTX_free(ctx);
 

examples/wrap/wrap_test.c

@@ -32,7 +32,6 @@
 /* Configuration */
 #define TPM2_DEMO_NV_TEST_INDEX                 0x01800200
 #define TPM2_DEMO_NV_TEST_SIZE                  1024 /* max size on Infineon SLB9670 is 1664 */
-//#define WOLFTPM_TEST_WITH_RESET
 
 /* from wolfSSL ./certs/client-keyPub.der */
 static const byte kRsaPubKeyRaw[] = {
@@ -87,6 +86,13 @@ static const byte kEccPubKeyYRaw[] = {
 /* --- BEGIN Wrapper API Tests -- */
 /******************************************************************************/
 
+static int resetTPM = 0;
+
+void TPM2_Wrapper_SetReset(int reset)
+{
+    resetTPM = reset;
+}
+
 int TPM2_Wrapper_Test(void* userCtx)
 {
     int rc;
@@ -140,11 +146,11 @@ int TPM2_Wrapper_Test(void* userCtx)
     if (rc != 0) goto exit;
 #endif
 
-#ifdef WOLFTPM_TEST_WITH_RESET
-    /* reset all content on TPM and reseed */
-    rc = wolfTPM2_Clear(&dev);
-    if (rc != 0) return rc;
-#endif
+    if (resetTPM) {
+        /* reset all content on TPM and reseed */
+        rc = wolfTPM2_Clear(&dev);
+        if (rc != 0) return rc;
+    }
 
     /* Get the RSA endorsement key (EK) */
     rc = wolfTPM2_GetKeyTemplate_RSA_EK(&publicTemplate);
@@ -394,9 +400,7 @@ exit:
     wolfTPM2_UnloadHandle(&dev, &rsaKey.handle);
     wolfTPM2_UnloadHandle(&dev, &eccKey.handle);
     wolfTPM2_UnloadHandle(&dev, &ekKey.handle);
-#ifdef WOLFTPM_TEST_WITH_RESET
-    wolfTPM2_NVDeleteKey(&dev, TPM_RH_OWNER, &storageKey);
-#endif
+
     wolfTPM2_Cleanup(&dev);
 
     return rc;

examples/wrap/wrap_test.h

@@ -23,6 +23,7 @@
 #define _WRAP_TEST_H_
 
 
+void TPM2_Wrapper_SetReset(int reset);
 int TPM2_Wrapper_Test(void* userCtx);
 
 #endif /* _WRAP_TEST_H_ */