From 653a2a9c637447bdf034102efe999684a0d6002f Mon Sep 17 00:00:00 2001 From: Anthony Hu Date: Thu, 12 Sep 2024 14:05:27 -0400 Subject: [PATCH 1/3] Add in client examples that use PKCS11. --- pkcs11/client-tls-pkcs11-ecc.c | 245 +++++++++++++++++++++++++++++++++ pkcs11/client-tls-pkcs11-rsa.c | 245 +++++++++++++++++++++++++++++++++ 2 files changed, 490 insertions(+) create mode 100644 pkcs11/client-tls-pkcs11-ecc.c create mode 100644 pkcs11/client-tls-pkcs11-rsa.c diff --git a/pkcs11/client-tls-pkcs11-ecc.c b/pkcs11/client-tls-pkcs11-ecc.c new file mode 100644 index 00000000..afa67aa7 --- /dev/null +++ b/pkcs11/client-tls-pkcs11-ecc.c @@ -0,0 +1,245 @@ +/* client-tls-pkcs11.c + * + * Copyright (C) 2006-2020 wolfSSL Inc. + * + * This file is part of wolfSSL. (formerly known as CyaSSL) + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* the usual suspects */ +#include +#include +#include + +/* socket includes */ +#include +#include +#include +#include + +/* wolfSSL */ +#include +#include +#include + +#define DEFAULT_PORT 11111 + +#define CA_FILE "../certs/ca-ecc-cert.pem" + +int client_tls(int devId, Pkcs11Token* token) +{ + int sockfd; + struct sockaddr_in servAddr; + socklen_t size = sizeof(servAddr); + char buff[256]; + size_t len; + int shutdown = 0; + int ret; + + /* declare wolfSSL objects */ + WOLFSSL_CTX* ctx = NULL; + WOLFSSL* ssl = NULL; + WOLFSSL_CIPHER* cipher; + + /* Initialize wolfSSL */ + wolfSSL_Init(); + + /* Create a socket that uses an internet IPv4 address, + * Sets the socket to be stream based (TCP), + * 0 means choose the default protocol. */ + if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { + fprintf(stderr, "ERROR: failed to create the socket\n"); + return -1; + } + + /* Initialize the server address struct with zeros */ + memset(&servAddr, 0, sizeof(servAddr)); + + /* Fill in the server address */ + servAddr.sin_family = AF_INET; /* using IPv4 */ + servAddr.sin_port = htons(DEFAULT_PORT); /* on DEFAULT_PORT */ + + /* IPv4 127.0.0.1 */ + if (inet_pton(AF_INET, "127.0.0.1", &servAddr.sin_addr) != 1) { + fprintf(stderr, "ERROR: invalid address\n"); + ret = -1; + goto exit; + } + + /* Connect to the server */ + if ((ret = connect(sockfd, (struct sockaddr*) &servAddr, sizeof(servAddr))) + == -1) { + fprintf(stderr, "ERROR: failed to connect\n"); + goto exit; + } + +#if 0 + wolfSSL_Debugging_ON(); +#endif + + /* Initialize wolfSSL */ + if ((ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method())) == NULL) { + fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); + return -1; + } + + /* Set devId associated with the PKCS11 device. */ + if (wolfSSL_CTX_SetDevId(ctx, devId) != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); + return -1; + } + + /* Load CA certificate into WOLFSSL_CTX for validating peer */ + if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CA_FILE, NULL)) + != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", + CA_FILE); + goto exit; + } + + /* validate peer certificate */ + wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, NULL); + + /* Open the PKCS11 token. */ + if ((ret = wc_Pkcs11Token_Open(token, 1)) != 0) { + fprintf(stderr, "ERROR: failed to open session on token (%d)\n", ret); + return -1; + } + + /* Create a WOLFSSL object */ + if ((ssl = wolfSSL_new(ctx)) == NULL) { + fprintf(stderr, "ERROR: failed to create WOLFSSL object\n"); + return -1; + } + + /* Attach wolfSSL to the socket */ + if ((ret = wolfSSL_set_fd(ssl, sockfd)) != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: Failed to set the file descriptor\n"); + goto exit; + } + + /* Connect to wolfSSL on the server side */ + if ((ret = wolfSSL_connect(ssl)) != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: failed to connect to wolfSSL\n"); + goto exit; + } + + cipher = wolfSSL_get_current_cipher(ssl); + printf("SSL cipher suite is %s\n", wolfSSL_CIPHER_get_name(cipher)); + + /* Get a message for the server from stdin */ + printf("Message for server: "); + memset(buff, 0, sizeof(buff)); + if (fgets(buff, sizeof(buff), stdin) == NULL) { + fprintf(stderr, "ERROR: failed to get message for server\n"); + ret = -1; + goto exit; + } + len = strnlen(buff, sizeof(buff)); + + /* Send the message to the server */ + if ((ret = wolfSSL_write(ssl, buff, len)) != len) { + fprintf(stderr, "ERROR: failed to write entire message\n"); + fprintf(stderr, "%d bytes of %d bytes were sent", ret, (int) len); + goto exit; + } + + /* Read the server data into our buff array */ + memset(buff, 0, sizeof(buff)); + if ((ret = wolfSSL_read(ssl, buff, sizeof(buff)-1)) == -1) { + fprintf(stderr, "ERROR: failed to read\n"); + goto exit; + } + + /* Print to stdout any data the server sends */ + printf("Server: %s\n", buff); + + ret = 0; /* return success */ + +exit: + /* Cleanup after this connection */ + wolfSSL_free(ssl); + wc_Pkcs11Token_Close(token); + + wolfSSL_CTX_free(ctx); + if (sockfd != SOCKET_INVALID) + close(sockfd); + return ret; +} + +int main(int argc, char* argv[]) +{ + int ret; + const char* library; + const char* slot; + const char* tokenName; + const char* userPin; + Pkcs11Dev dev; + Pkcs11Token token; + int slotId; + int devId = 1; + + if (argc != 4 && argc != 5) { + fprintf(stderr, + "Usage: server_tls_pkcs11 [userpin]\n"); + return 1; + } + + library = argv[1]; + slot = argv[2]; + tokenName = argv[3]; + userPin = (argc == 4) ? NULL : argv[4]; + slotId = atoi(slot); + +#if defined(DEBUG_WOLFSSL) + wolfSSL_Debugging_ON(); +#endif + wolfCrypt_Init(); + + ret = wc_Pkcs11_Initialize(&dev, library, NULL); + if (ret != 0) { + fprintf(stderr, "Failed to initialize PKCS#11 library\n"); + ret = 2; + } + if (ret == 0) { + ret = wc_Pkcs11Token_Init(&token, &dev, slotId, tokenName, + (byte*)userPin, userPin == NULL ? 0 : strlen(userPin)); + if (ret != 0) { + fprintf(stderr, "Failed to initialize PKCS#11 token\n"); + ret = 2; + } + if (ret == 0) { + ret = wc_CryptoDev_RegisterDevice(devId, wc_Pkcs11_CryptoDevCb, + &token); + if (ret != 0) { + fprintf(stderr, "Failed to register PKCS#11 token\n"); + ret = 2; + } + if (ret == 0) { + ret = client_tls(devId, &token); + if (ret != 0) + ret = 1; + } + wc_Pkcs11Token_Final(&token); + } + wc_Pkcs11_Finalize(&dev); + } + + wolfCrypt_Cleanup(); + + return ret; +} + diff --git a/pkcs11/client-tls-pkcs11-rsa.c b/pkcs11/client-tls-pkcs11-rsa.c new file mode 100644 index 00000000..49baaabe --- /dev/null +++ b/pkcs11/client-tls-pkcs11-rsa.c @@ -0,0 +1,245 @@ +/* client-tls-pkcs11.c + * + * Copyright (C) 2006-2020 wolfSSL Inc. + * + * This file is part of wolfSSL. (formerly known as CyaSSL) + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* the usual suspects */ +#include +#include +#include + +/* socket includes */ +#include +#include +#include +#include + +/* wolfSSL */ +#include +#include +#include + +#define DEFAULT_PORT 11111 + +#define CA_FILE "../certs/ca-cert.pem" + +int client_tls(int devId, Pkcs11Token* token) +{ + int sockfd; + struct sockaddr_in servAddr; + socklen_t size = sizeof(servAddr); + char buff[256]; + size_t len; + int shutdown = 0; + int ret; + + /* declare wolfSSL objects */ + WOLFSSL_CTX* ctx = NULL; + WOLFSSL* ssl = NULL; + WOLFSSL_CIPHER* cipher; + + /* Initialize wolfSSL */ + wolfSSL_Init(); + + /* Create a socket that uses an internet IPv4 address, + * Sets the socket to be stream based (TCP), + * 0 means choose the default protocol. */ + if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { + fprintf(stderr, "ERROR: failed to create the socket\n"); + return -1; + } + + /* Initialize the server address struct with zeros */ + memset(&servAddr, 0, sizeof(servAddr)); + + /* Fill in the server address */ + servAddr.sin_family = AF_INET; /* using IPv4 */ + servAddr.sin_port = htons(DEFAULT_PORT); /* on DEFAULT_PORT */ + + /* IPv4 127.0.0.1 */ + if (inet_pton(AF_INET, "127.0.0.1", &servAddr.sin_addr) != 1) { + fprintf(stderr, "ERROR: invalid address\n"); + ret = -1; + goto exit; + } + + /* Connect to the server */ + if ((ret = connect(sockfd, (struct sockaddr*) &servAddr, sizeof(servAddr))) + == -1) { + fprintf(stderr, "ERROR: failed to connect\n"); + goto exit; + } + +#if 0 + wolfSSL_Debugging_ON(); +#endif + + /* Initialize wolfSSL */ + if ((ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method())) == NULL) { + fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); + return -1; + } + + /* Set devId associated with the PKCS11 device. */ + if (wolfSSL_CTX_SetDevId(ctx, devId) != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); + return -1; + } + + /* Load CA certificate into WOLFSSL_CTX for validating peer */ + if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CA_FILE, NULL)) + != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", + CA_FILE); + goto exit; + } + + /* validate peer certificate */ + wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, NULL); + + /* Open the PKCS11 token. */ + if ((ret = wc_Pkcs11Token_Open(token, 1)) != 0) { + fprintf(stderr, "ERROR: failed to open session on token (%d)\n", ret); + return -1; + } + + /* Create a WOLFSSL object */ + if ((ssl = wolfSSL_new(ctx)) == NULL) { + fprintf(stderr, "ERROR: failed to create WOLFSSL object\n"); + return -1; + } + + /* Attach wolfSSL to the socket */ + if ((ret = wolfSSL_set_fd(ssl, sockfd)) != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: Failed to set the file descriptor\n"); + goto exit; + } + + /* Connect to wolfSSL on the server side */ + if ((ret = wolfSSL_connect(ssl)) != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: failed to connect to wolfSSL\n"); + goto exit; + } + + cipher = wolfSSL_get_current_cipher(ssl); + printf("SSL cipher suite is %s\n", wolfSSL_CIPHER_get_name(cipher)); + + /* Get a message for the server from stdin */ + printf("Message for server: "); + memset(buff, 0, sizeof(buff)); + if (fgets(buff, sizeof(buff), stdin) == NULL) { + fprintf(stderr, "ERROR: failed to get message for server\n"); + ret = -1; + goto exit; + } + len = strnlen(buff, sizeof(buff)); + + /* Send the message to the server */ + if ((ret = wolfSSL_write(ssl, buff, len)) != len) { + fprintf(stderr, "ERROR: failed to write entire message\n"); + fprintf(stderr, "%d bytes of %d bytes were sent", ret, (int) len); + goto exit; + } + + /* Read the server data into our buff array */ + memset(buff, 0, sizeof(buff)); + if ((ret = wolfSSL_read(ssl, buff, sizeof(buff)-1)) == -1) { + fprintf(stderr, "ERROR: failed to read\n"); + goto exit; + } + + /* Print to stdout any data the server sends */ + printf("Server: %s\n", buff); + + ret = 0; /* return success */ + +exit: + /* Cleanup after this connection */ + wolfSSL_free(ssl); + wc_Pkcs11Token_Close(token); + + wolfSSL_CTX_free(ctx); + if (sockfd != SOCKET_INVALID) + close(sockfd); + return ret; +} + +int main(int argc, char* argv[]) +{ + int ret; + const char* library; + const char* slot; + const char* tokenName; + const char* userPin; + Pkcs11Dev dev; + Pkcs11Token token; + int slotId; + int devId = 1; + + if (argc != 4 && argc != 5) { + fprintf(stderr, + "Usage: server_tls_pkcs11 [userpin]\n"); + return 1; + } + + library = argv[1]; + slot = argv[2]; + tokenName = argv[3]; + userPin = (argc == 4) ? NULL : argv[4]; + slotId = atoi(slot); + +#if defined(DEBUG_WOLFSSL) + wolfSSL_Debugging_ON(); +#endif + wolfCrypt_Init(); + + ret = wc_Pkcs11_Initialize(&dev, library, NULL); + if (ret != 0) { + fprintf(stderr, "Failed to initialize PKCS#11 library\n"); + ret = 2; + } + if (ret == 0) { + ret = wc_Pkcs11Token_Init(&token, &dev, slotId, tokenName, + (byte*)userPin, userPin == NULL ? 0 : strlen(userPin)); + if (ret != 0) { + fprintf(stderr, "Failed to initialize PKCS#11 token\n"); + ret = 2; + } + if (ret == 0) { + ret = wc_CryptoDev_RegisterDevice(devId, wc_Pkcs11_CryptoDevCb, + &token); + if (ret != 0) { + fprintf(stderr, "Failed to register PKCS#11 token\n"); + ret = 2; + } + if (ret == 0) { + ret = client_tls(devId, &token); + if (ret != 0) + ret = 1; + } + wc_Pkcs11Token_Final(&token); + } + wc_Pkcs11_Finalize(&dev); + } + + wolfCrypt_Cleanup(); + + return ret; +} + From e95373bf30cb813adb6845b046c965368aba5fa9 Mon Sep 17 00:00:00 2001 From: Anthony Hu Date: Fri, 20 Sep 2024 16:12:19 -0400 Subject: [PATCH 2/3] Fixups suggested in review. --- pkcs11/client-tls-pkcs11-ecc.c | 245 ------------------ ...t-tls-pkcs11-rsa.c => client-tls-pkcs11.c} | 26 +- pkcs11/pkcs11_hmac.c | 4 +- pkcs11/pkcs11_test.c | 28 +- 4 files changed, 29 insertions(+), 274 deletions(-) delete mode 100644 pkcs11/client-tls-pkcs11-ecc.c rename pkcs11/{client-tls-pkcs11-rsa.c => client-tls-pkcs11.c} (92%) diff --git a/pkcs11/client-tls-pkcs11-ecc.c b/pkcs11/client-tls-pkcs11-ecc.c deleted file mode 100644 index afa67aa7..00000000 --- a/pkcs11/client-tls-pkcs11-ecc.c +++ /dev/null @@ -1,245 +0,0 @@ -/* client-tls-pkcs11.c - * - * Copyright (C) 2006-2020 wolfSSL Inc. - * - * This file is part of wolfSSL. (formerly known as CyaSSL) - * - * wolfSSL is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * wolfSSL is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA - */ - -/* the usual suspects */ -#include -#include -#include - -/* socket includes */ -#include -#include -#include -#include - -/* wolfSSL */ -#include -#include -#include - -#define DEFAULT_PORT 11111 - -#define CA_FILE "../certs/ca-ecc-cert.pem" - -int client_tls(int devId, Pkcs11Token* token) -{ - int sockfd; - struct sockaddr_in servAddr; - socklen_t size = sizeof(servAddr); - char buff[256]; - size_t len; - int shutdown = 0; - int ret; - - /* declare wolfSSL objects */ - WOLFSSL_CTX* ctx = NULL; - WOLFSSL* ssl = NULL; - WOLFSSL_CIPHER* cipher; - - /* Initialize wolfSSL */ - wolfSSL_Init(); - - /* Create a socket that uses an internet IPv4 address, - * Sets the socket to be stream based (TCP), - * 0 means choose the default protocol. */ - if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { - fprintf(stderr, "ERROR: failed to create the socket\n"); - return -1; - } - - /* Initialize the server address struct with zeros */ - memset(&servAddr, 0, sizeof(servAddr)); - - /* Fill in the server address */ - servAddr.sin_family = AF_INET; /* using IPv4 */ - servAddr.sin_port = htons(DEFAULT_PORT); /* on DEFAULT_PORT */ - - /* IPv4 127.0.0.1 */ - if (inet_pton(AF_INET, "127.0.0.1", &servAddr.sin_addr) != 1) { - fprintf(stderr, "ERROR: invalid address\n"); - ret = -1; - goto exit; - } - - /* Connect to the server */ - if ((ret = connect(sockfd, (struct sockaddr*) &servAddr, sizeof(servAddr))) - == -1) { - fprintf(stderr, "ERROR: failed to connect\n"); - goto exit; - } - -#if 0 - wolfSSL_Debugging_ON(); -#endif - - /* Initialize wolfSSL */ - if ((ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method())) == NULL) { - fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); - return -1; - } - - /* Set devId associated with the PKCS11 device. */ - if (wolfSSL_CTX_SetDevId(ctx, devId) != WOLFSSL_SUCCESS) { - fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); - return -1; - } - - /* Load CA certificate into WOLFSSL_CTX for validating peer */ - if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CA_FILE, NULL)) - != WOLFSSL_SUCCESS) { - fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", - CA_FILE); - goto exit; - } - - /* validate peer certificate */ - wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, NULL); - - /* Open the PKCS11 token. */ - if ((ret = wc_Pkcs11Token_Open(token, 1)) != 0) { - fprintf(stderr, "ERROR: failed to open session on token (%d)\n", ret); - return -1; - } - - /* Create a WOLFSSL object */ - if ((ssl = wolfSSL_new(ctx)) == NULL) { - fprintf(stderr, "ERROR: failed to create WOLFSSL object\n"); - return -1; - } - - /* Attach wolfSSL to the socket */ - if ((ret = wolfSSL_set_fd(ssl, sockfd)) != WOLFSSL_SUCCESS) { - fprintf(stderr, "ERROR: Failed to set the file descriptor\n"); - goto exit; - } - - /* Connect to wolfSSL on the server side */ - if ((ret = wolfSSL_connect(ssl)) != WOLFSSL_SUCCESS) { - fprintf(stderr, "ERROR: failed to connect to wolfSSL\n"); - goto exit; - } - - cipher = wolfSSL_get_current_cipher(ssl); - printf("SSL cipher suite is %s\n", wolfSSL_CIPHER_get_name(cipher)); - - /* Get a message for the server from stdin */ - printf("Message for server: "); - memset(buff, 0, sizeof(buff)); - if (fgets(buff, sizeof(buff), stdin) == NULL) { - fprintf(stderr, "ERROR: failed to get message for server\n"); - ret = -1; - goto exit; - } - len = strnlen(buff, sizeof(buff)); - - /* Send the message to the server */ - if ((ret = wolfSSL_write(ssl, buff, len)) != len) { - fprintf(stderr, "ERROR: failed to write entire message\n"); - fprintf(stderr, "%d bytes of %d bytes were sent", ret, (int) len); - goto exit; - } - - /* Read the server data into our buff array */ - memset(buff, 0, sizeof(buff)); - if ((ret = wolfSSL_read(ssl, buff, sizeof(buff)-1)) == -1) { - fprintf(stderr, "ERROR: failed to read\n"); - goto exit; - } - - /* Print to stdout any data the server sends */ - printf("Server: %s\n", buff); - - ret = 0; /* return success */ - -exit: - /* Cleanup after this connection */ - wolfSSL_free(ssl); - wc_Pkcs11Token_Close(token); - - wolfSSL_CTX_free(ctx); - if (sockfd != SOCKET_INVALID) - close(sockfd); - return ret; -} - -int main(int argc, char* argv[]) -{ - int ret; - const char* library; - const char* slot; - const char* tokenName; - const char* userPin; - Pkcs11Dev dev; - Pkcs11Token token; - int slotId; - int devId = 1; - - if (argc != 4 && argc != 5) { - fprintf(stderr, - "Usage: server_tls_pkcs11 [userpin]\n"); - return 1; - } - - library = argv[1]; - slot = argv[2]; - tokenName = argv[3]; - userPin = (argc == 4) ? NULL : argv[4]; - slotId = atoi(slot); - -#if defined(DEBUG_WOLFSSL) - wolfSSL_Debugging_ON(); -#endif - wolfCrypt_Init(); - - ret = wc_Pkcs11_Initialize(&dev, library, NULL); - if (ret != 0) { - fprintf(stderr, "Failed to initialize PKCS#11 library\n"); - ret = 2; - } - if (ret == 0) { - ret = wc_Pkcs11Token_Init(&token, &dev, slotId, tokenName, - (byte*)userPin, userPin == NULL ? 0 : strlen(userPin)); - if (ret != 0) { - fprintf(stderr, "Failed to initialize PKCS#11 token\n"); - ret = 2; - } - if (ret == 0) { - ret = wc_CryptoDev_RegisterDevice(devId, wc_Pkcs11_CryptoDevCb, - &token); - if (ret != 0) { - fprintf(stderr, "Failed to register PKCS#11 token\n"); - ret = 2; - } - if (ret == 0) { - ret = client_tls(devId, &token); - if (ret != 0) - ret = 1; - } - wc_Pkcs11Token_Final(&token); - } - wc_Pkcs11_Finalize(&dev); - } - - wolfCrypt_Cleanup(); - - return ret; -} - diff --git a/pkcs11/client-tls-pkcs11-rsa.c b/pkcs11/client-tls-pkcs11.c similarity index 92% rename from pkcs11/client-tls-pkcs11-rsa.c rename to pkcs11/client-tls-pkcs11.c index 49baaabe..0d620122 100644 --- a/pkcs11/client-tls-pkcs11-rsa.c +++ b/pkcs11/client-tls-pkcs11.c @@ -31,22 +31,20 @@ #include /* wolfSSL */ +#ifndef WOLFSSL_USER_SETTINGS #include +#endif #include #include #define DEFAULT_PORT 11111 -#define CA_FILE "../certs/ca-cert.pem" - -int client_tls(int devId, Pkcs11Token* token) +int client_tls(const char *cacert, int devId, Pkcs11Token* token) { int sockfd; struct sockaddr_in servAddr; - socklen_t size = sizeof(servAddr); char buff[256]; size_t len; - int shutdown = 0; int ret; /* declare wolfSSL objects */ @@ -103,7 +101,7 @@ int client_tls(int devId, Pkcs11Token* token) } /* Load CA certificate into WOLFSSL_CTX for validating peer */ - if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CA_FILE, NULL)) + if ((ret = wolfSSL_CTX_load_verify_locations(ctx, cacert, NULL)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", CA_FILE); @@ -187,21 +185,23 @@ int main(int argc, char* argv[]) const char* slot; const char* tokenName; const char* userPin; + const char* cacert; Pkcs11Dev dev; Pkcs11Token token; int slotId; int devId = 1; - if (argc != 4 && argc != 5) { + if (argc != 5 && argc != 6) { fprintf(stderr, - "Usage: server_tls_pkcs11 [userpin]\n"); + "Usage: client_tls_pkcs11 [userpin]\n"); return 1; } - library = argv[1]; - slot = argv[2]; - tokenName = argv[3]; - userPin = (argc == 4) ? NULL : argv[4]; + cacert = argv[1] + library = argv[2]; + slot = argv[3]; + tokenName = argv[4]; + userPin = (argc == 5) ? NULL : argv[5]; slotId = atoi(slot); #if defined(DEBUG_WOLFSSL) @@ -229,7 +229,7 @@ int main(int argc, char* argv[]) ret = 2; } if (ret == 0) { - ret = client_tls(devId, &token); + ret = client_tls(cacert, devId, &token); if (ret != 0) ret = 1; } diff --git a/pkcs11/pkcs11_hmac.c b/pkcs11/pkcs11_hmac.c index 7a47097f..5d54c8eb 100644 --- a/pkcs11/pkcs11_hmac.c +++ b/pkcs11/pkcs11_hmac.c @@ -31,10 +31,10 @@ int hmac(int devId, Pkcs11Token* token) { Hmac hmac; - unsigned char key[SHA256_DIGEST_SIZE]; + unsigned char key[WC_SHA256_DIGEST_SIZE]; int ret = 0; unsigned char data[57]; - unsigned char mac[SHA256_DIGEST_SIZE]; + unsigned char mac[WC_SHA256_DIGEST_SIZE]; memset(key, 9, sizeof(key)); memset(data, 9, sizeof(data)); diff --git a/pkcs11/pkcs11_test.c b/pkcs11/pkcs11_test.c index 0e656cd1..0c0f2efd 100644 --- a/pkcs11/pkcs11_test.c +++ b/pkcs11/pkcs11_test.c @@ -1067,20 +1067,20 @@ int hmac_test(int devId, Pkcs11Token* token) unsigned char key[WC_MAX_DIGEST_SIZE]; unsigned char data[57]; #if !defined(NO_MD5) - unsigned char exp_md5[MD5_DIGEST_SIZE] = { + unsigned char exp_md5[WC_MD5_DIGEST_SIZE] = { 0x58, 0x8e, 0xd2, 0x4e, 0x04, 0x1f, 0xf4, 0xc6, 0x98, 0x7c, 0x8e, 0xdc, 0xe5, 0xb1, 0xbc, 0x4b }; #endif #if !defined(NO_SHA) - unsigned char exp_sha[SHA_DIGEST_SIZE] = { + unsigned char exp_sha[WC_SHA_DIGEST_SIZE] = { 0x2f, 0x69, 0xc1, 0xf9, 0xe1, 0x97, 0x04, 0xe4, 0x75, 0x9f, 0x1c, 0x2a, 0x85, 0x87, 0x7e, 0x6b, 0xa7, 0x9f, 0xe1, 0x13 }; #endif #if defined(WOLFSSL_SHA224) - unsigned char exp_sha224[SHA224_DIGEST_SIZE] = { + unsigned char exp_sha224[WC_SHA224_DIGEST_SIZE] = { 0x86, 0xa8, 0xfc, 0xfd, 0xd5, 0x95, 0xf2, 0xa6, 0x45, 0x89, 0x3b, 0x8b, 0x4c, 0x0d, 0xd1, 0x81, 0x20, 0x6b, 0x71, 0x2d, 0x7c, 0x88, 0x31, 0xa8, @@ -1088,7 +1088,7 @@ int hmac_test(int devId, Pkcs11Token* token) }; #endif #if !defined(NO_SHA256) - unsigned char exp_sha256[SHA256_DIGEST_SIZE] = { + unsigned char exp_sha256[WC_SHA256_DIGEST_SIZE] = { 0x04, 0x9e, 0x43, 0x3c, 0x48, 0x7c, 0x31, 0x11, 0x54, 0x90, 0x43, 0xf6, 0x2f, 0x97, 0x42, 0x80, 0x3d, 0x22, 0x47, 0x1d, 0x4f, 0xc9, 0xb8, 0xa0, @@ -1096,7 +1096,7 @@ int hmac_test(int devId, Pkcs11Token* token) }; #endif #if defined(WOLFSSL_SHA384) - unsigned char exp_sha384[SHA384_DIGEST_SIZE] = { + unsigned char exp_sha384[WC_SHA384_DIGEST_SIZE] = { 0x0b, 0x4c, 0x32, 0x58, 0x7b, 0x00, 0xb7, 0xfa, 0x82, 0x9f, 0xf0, 0x1d, 0x10, 0x85, 0xbc, 0x2e, 0xe0, 0x4a, 0x71, 0x91, 0xd6, 0x9a, 0x93, 0xc2, @@ -1106,7 +1106,7 @@ int hmac_test(int devId, Pkcs11Token* token) }; #endif #if defined(WOLFSSL_SHA512) - unsigned char exp_sha512[SHA512_DIGEST_SIZE] = { + unsigned char exp_sha512[WC_SHA512_DIGEST_SIZE] = { 0x94, 0x7b, 0x97, 0x0f, 0x48, 0x68, 0xd1, 0x88, 0x08, 0x09, 0xcf, 0xea, 0xae, 0x3e, 0xba, 0xa2, 0x3f, 0xf4, 0x9d, 0x73, 0x78, 0x15, 0x34, 0x44, @@ -1124,42 +1124,42 @@ int hmac_test(int devId, Pkcs11Token* token) #ifndef NO_MD5 if (ret == 0) { fprintf(stderr, "HMAC-MD5\n"); - ret = hmac_op(key, MD5_DIGEST_SIZE, WC_MD5, data, sizeof(data), exp_md5, - sizeof(exp_md5), devId, token); + ret = hmac_op(key, WC_MD5_DIGEST_SIZE, WC_MD5, data, sizeof(data), + exp_md5, sizeof(exp_md5), devId, token); } #endif #ifndef NO_SHA if (ret == 0) { fprintf(stderr, "HMAC-SHA\n"); - ret = hmac_op(key, SHA_DIGEST_SIZE, WC_SHA, data, sizeof(data), exp_sha, - sizeof(exp_sha), devId, token); + ret = hmac_op(key, WC_SHA_DIGEST_SIZE, WC_SHA, data, sizeof(data), + exp_sha, sizeof(exp_sha), devId, token); } #endif #ifdef WOLFSSL_SHA224 if (ret == 0) { fprintf(stderr, "HMAC-SHA224\n"); - ret = hmac_op(key, SHA224_DIGEST_SIZE, WC_SHA224, data, sizeof(data), + ret = hmac_op(key, WC_SHA224_DIGEST_SIZE, WC_SHA224, data, sizeof(data), exp_sha224, sizeof(exp_sha224), devId, token); } #endif #ifndef NO_SHA256 if (ret == 0) { fprintf(stderr, "HMAC-SHA256\n"); - ret = hmac_op(key, SHA256_DIGEST_SIZE, WC_SHA256, data, sizeof(data), + ret = hmac_op(key, WC_SHA256_DIGEST_SIZE, WC_SHA256, data, sizeof(data), exp_sha256, sizeof(exp_sha256), devId, token); } #endif #ifdef WOLFSSL_SHA384 if (ret == 0) { fprintf(stderr, "HMAC-SHA384\n"); - ret = hmac_op(key, SHA384_DIGEST_SIZE, WC_SHA384, data, sizeof(data), + ret = hmac_op(key, WC_SHA384_DIGEST_SIZE, WC_SHA384, data, sizeof(data), exp_sha384, sizeof(exp_sha384), devId, token); } #endif #ifdef WOLFSSL_SHA512 if (ret == 0) { fprintf(stderr, "HMAC-SHA512\n"); - ret = hmac_op(key, SHA512_DIGEST_SIZE, WC_SHA512, data, sizeof(data), + ret = hmac_op(key, WC_SHA512_DIGEST_SIZE, WC_SHA512, data, sizeof(data), exp_sha512, sizeof(exp_sha512), devId, token); } #endif From 0f7a32e75cfc6b7a122366e782b8edcd1bd4f97b Mon Sep 17 00:00:00 2001 From: Anthony Hu Date: Mon, 23 Sep 2024 12:37:13 -0400 Subject: [PATCH 3/3] Quick fixes --- pkcs11/client-tls-pkcs11.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkcs11/client-tls-pkcs11.c b/pkcs11/client-tls-pkcs11.c index 0d620122..63b0b2eb 100644 --- a/pkcs11/client-tls-pkcs11.c +++ b/pkcs11/client-tls-pkcs11.c @@ -104,7 +104,7 @@ int client_tls(const char *cacert, int devId, Pkcs11Token* token) if ((ret = wolfSSL_CTX_load_verify_locations(ctx, cacert, NULL)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", - CA_FILE); + cacert); goto exit; } @@ -197,7 +197,7 @@ int main(int argc, char* argv[]) return 1; } - cacert = argv[1] + cacert = argv[1]; library = argv[2]; slot = argv[3]; tokenName = argv[4];