WolfSSL
/
wolfssl-examples
mirror of https://github.com/wolfSSL/wolfssl-examples.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-5613: keep peer verification enabled after loading CA cert in Mynewt client

pull/606/head
Emma Stensland 2026-07-16 14:30:54 -06:00 committed by Paul Adelsbach
parent 3e274a11ac
commit 478701b8b8
8 changed files with 388 additions and 64 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
mynewt/README.md
View File

@ -113,6 +113,35 @@ including the `wolfssl` command with represents the client TLS application.
## Usage
### Run a local TLS server to connect to
This example uses the repo's test CA (`certs/ca-cert.pem`, embedded as `local_ca.h`).
To avoid dependencies on live internet hosts, point the client at the local
`tls/server-tls` example.
In a separate terminal, from the `wolfssl-examples` directory:
```
$ cd tls
$ make
$ ./server-tls
```
Leave this running. It handles one connection at a time.
### Connecting to a different target instead
To connect to a real host, build with `WOLFSSL_MN_USE_CUSTOM_CA`:
```
$ newt target set wolfsslclienttlsmn_sim syscfg=WOLFSSL_MN_USE_CUSTOM_CA=1
```
Fill in `mynewt/custom_ca.h` with your target's root CA. Set `DEFAULT_IPADDR`
and `DEFAULT_PORT` in `client-tls-mn.c`, then rebuild.
Note: This demo pins the CA and IP address at build time. Update them manually if the target changes.
### Command list
The client TLS application `wolfssl` has the following commands:
@ -123,28 +152,29 @@ The client TLS application `wolfssl` has the following commands:
| time | "unix timestamp" | To set the time | "time 1532616682" |
| net | udp | create udp socket | "net udp" |
| net | tcp | create tcp socket | "net tcp" |
| net | connect "ipaddress" port | connect "ipaddress" | "net connect 93.184.216.34 443" |
| net | connect "ipaddress" port | connect "ipaddress" | "net connect 127.0.0.1 11111" |
| net | close | close socket | "net close" |
| net | send "string" "ipaddress" "port" | send string | "net send "GET \r\n" 93.184.216.34 80 |
| net | recv "ipaddress" | recv from ipaddress | "net recv 93.184.216.34 80 |
| net | send "string" "ipaddress" "port" | send string | "net send "hello" 127.0.0.1 11111" |
| net | recv "ipaddress" | recv from ipaddress | "net recv 127.0.0.1 11111" |
| wolfssl | init | initialize wolfssl library | "wolfssl init" |
| wolfssl | connect | connect via ssl | "wolfssl connect" |
| wolfssl | write "string" | send string via ssl | "wolfssl write "GET /"" |
| wolfssl | write "string" | send string via ssl | "wolfssl write "hello wolfssl!"" |
| wolfssl | read | recv via ssl | "wolfssl recv" |
| wolfssl | clear | finish wolfssl library | "wolfssl clear" |
### Command examples
Get `index.html` from `www.example.com:443` (i.e. `93.184.216.34:443`) using
Mynewt TCP networking and the wolfSSL TLS and crypto.
Connect to the locally-run `tls/server-tls` example (`127.0.0.1:11111`)
using Mynewt TCP networking and the wolfSSL TLS and crypto. Make sure
`./server-tls` (see above) is running first.
At the Mynewt `compat>` shell prompt:
```
net tcp
net connect 93.184.216.34 443
net connect 127.0.0.1 11111
wolfssl init
wolfssl connect
wolfssl write "GET /"
wolfssl write "hello wolfssl!"
wolfssl read
wolfssl clear
net close
@ -155,8 +185,8 @@ The resulting application output should be similar to the following:
```
compat> net tcp
001143 mn_socket(TCP) = 0 566b7800
compat> net connect 93.184.216.34 443
005078 93.184.216.34/443
compat> net connect 127.0.0.1 11111
005078 127.0.0.1/11111
005078 mn_connect() = 0
compat> net_test_writable 0 - 0
wolfssl init
@ -164,24 +194,12 @@ wolfssl init
005854 wolfSSL ctx initialize
compat> wolfssl connect
006517 wolfSSL_connect() = 1
compat> wolfssl write "GET /"
009182 wolfSSL_write() = 4L
compat> wolfssl write "hello wolfssl!"
009182 wolfSSL_write() = 14L
compat> wolfssl read
010564 HTTP/1.0 501 Not Implemented
Content-Type: text/html
Content-Length: 357
Connection: close
Date: Wed, 12 Apr 2023 14:49:27 <?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://wwwitle>501 - Not Implemented</title>
</head>
<body>
<h1>501 - Not Implemented</h1>
</body>
</html>
010564 I hear ya fa shizzle!
010578
010578 ERROR: wolfSSL_read rc:-1 err:6
compat> wolfssl clear
012551 clear wolfssl contexts
012553 wolfSSL ctx clear
@ -190,8 +208,7 @@ compat> net close
compat>
```
NOTE: The server-side connection close after reception of data results in the
read error.
`server-tls` handles one request per connection and loops. It can be reused for repeated `wolfssl connect` runs.
## Notes
@ -211,6 +228,10 @@ Install:
- expect
- bash
- screen
- openssl
- xxd
- python3
- fuser
- [newt](https://mynewt.apache.org/latest/get_started/native_install/index.html)(v1.4.1 over)
## Usage

4
mynewt/apps.wolfsslclienttlsmn.pkg.yml
View File

@ -36,4 +36,6 @@ pkg.deps:
- "@apache-mynewt-core/sys/log/full"
- "@apache-mynewt-core/sys/stats/full"
pkg.cflags: -DWOLFSSL_APACHE_MYNEWT -Wno-error -DNO_FILESYSTEM -DWOLFSSL_IGNORE_FILE_WARN
# WC_NO_HARDEN is required for native sim targets.
# WOLFSSL_CUSTOM_CONFIG applies Mynewt-specific settings.
pkg.cflags: -DWOLFSSL_APACHE_MYNEWT -DWOLFSSL_CUSTOM_CONFIG -DWC_NO_HARDEN -Wno-error -DNO_FILESYSTEM -DWOLFSSL_IGNORE_FILE_WARN

5
mynewt/apps.wolfsslclienttlsmn.syscfg.yml
View File

@ -19,6 +19,11 @@
# Settings this app defines.
syscfg.defs:
WOLFSSL_MN_USE_CUSTOM_CA:
description: >
Use custom CA (custom_ca.h) and IP/port (client-tls-mn.c)
instead of local server-tls demo.
value: 0
# Settings this app overrides.
syscfg.vals:

93
mynewt/client-tls-mn.c
View File

@ -53,11 +53,26 @@ extern time_t time(time_t*);
/* wolfSSL */
#include <wolfssl/ssl.h>
#define USE_CERT_BUFFERS_2048
#include <wolfssl/certs_test.h>
#define DEFAULT_IPADDR "93.184.216.34" /* www.example.com */
#if MYNEWT_VAL(WOLFSSL_MN_USE_CUSTOM_CA)
#include "custom_ca.h"
/* TODO: set to your real target's current IP/port/hostname; see custom_ca.h */
#define DEFAULT_IPADDR_PLACEHOLDER
#ifdef DEFAULT_IPADDR_PLACEHOLDER
#error "mynewt/client-tls-mn.c: set DEFAULT_IPADDR/DEFAULT_PORT/DEFAULT_HOSTNAME (in the " \
"WOLFSSL_MN_USE_CUSTOM_CA branch above) to your real target's " \
"current IP/port/hostname and remove this #error before building."
#endif
#define DEFAULT_IPADDR "0.0.0.0"
#define DEFAULT_PORT 443
#define DEFAULT_HOSTNAME "example.com"
#else
/* Generated by setup.sh from certs/ca-cert.pem. */
#include "local_ca.h"
#define DEFAULT_IPADDR "127.0.0.1" /* local tls/server-tls example */
#define DEFAULT_PORT 11111
#endif
struct os_sem test_sem;
@ -120,12 +135,12 @@ static const oc_handler_t omgr_oc_handler = {
static void net_test_readable(void *arg, int err)
{
console_printf("net_test_readable %x - %d\n", (int)arg, err);
console_printf("net_test_readable %lx - %d\n", (unsigned long)(uintptr_t)arg, err);
}
static void net_test_writable(void *arg, int err)
{
console_printf("net_test_writable %x - %d\n", (int)arg, err);
console_printf("net_test_writable %lx - %d\n", (unsigned long)(uintptr_t)arg, err);
}
static const union mn_socket_cb net_test_cbs = {
@ -135,7 +150,7 @@ static const union mn_socket_cb net_test_cbs = {
static int net_test_newconn(void *arg, struct mn_socket *new)
{
console_printf("net_test_newconn %x - %x\n", (int)arg, (int)new);
console_printf("net_test_newconn %lx - %lx\n", (unsigned long)(uintptr_t)arg, (unsigned long)(uintptr_t)new);
mn_socket_set_cbs(new, NULL, &net_test_cbs);
net_test_socket2 = new;
return 0;
@ -161,12 +176,12 @@ net_cli(int argc, char **argv)
}
if (!strcmp(argv[1], "udp")) {
rc = mn_socket(&net_test_socket, MN_PF_INET, MN_SOCK_DGRAM, 0);
console_printf("mn_socket(UDP) = %d %x\n", rc,
(int)net_test_socket);
console_printf("mn_socket(UDP) = %d %lx\n", rc,
(unsigned long)(uintptr_t)net_test_socket);
} else if (!strcmp(argv[1], "tcp")) {
rc = mn_socket(&net_test_socket, MN_PF_INET, MN_SOCK_STREAM, 0);
console_printf("mn_socket(TCP) = %d %x\n", rc,
(int)net_test_socket);
console_printf("mn_socket(TCP) = %d %lx\n", rc,
(unsigned long)(uintptr_t)net_test_socket);
} else if (!strcmp(argv[1], "connect") || !strcmp(argv[1], "bind")) {
char *addrStr = DEFAULT_IPADDR;
int port = DEFAULT_PORT;
@ -389,16 +404,38 @@ static int wolfssl_ctx_init() {
return -1;
}
int ret = wolfSSL_CTX_load_verify_buffer(wolfsslCtx, ca_cert_der_2048, sizeof_ca_cert_der_2048, SSL_FILETYPE_ASN1);
#if MYNEWT_VAL(WOLFSSL_MN_USE_CUSTOM_CA)
int ret = wolfSSL_CTX_load_verify_buffer(wolfsslCtx, custom_ca_der, sizeof_custom_ca_der, SSL_FILETYPE_ASN1);
#else
int ret = wolfSSL_CTX_load_verify_buffer(wolfsslCtx, local_ca_der, sizeof_local_ca_der, SSL_FILETYPE_ASN1);
#endif
if(ret != SSL_SUCCESS) {
console_printf("Error %d loading CA cert\n", ret);
return ret;
wolfSSL_CTX_free(wolfsslCtx);
wolfsslCtx = NULL;
return -1;
}
wolfSSL_CTX_set_verify(wolfsslCtx, SSL_VERIFY_NONE, 0);
/* Depends on bundled test CA certs not expiring. */
wolfSSL_CTX_set_verify(wolfsslCtx, SSL_VERIFY_PEER, NULL);
/* Create a WOLFSSL object */
if ((ssl = wolfSSL_new(wolfsslCtx)) == NULL) {
console_printf("ERROR: failed to create WOLFSSL object\n");
wolfSSL_CTX_free(wolfsslCtx);
wolfsslCtx = NULL;
return -1;
}
#if MYNEWT_VAL(WOLFSSL_MN_USE_CUSTOM_CA)
if (wolfSSL_check_domain_name(ssl, DEFAULT_HOSTNAME) != SSL_SUCCESS) {
#else
if (wolfSSL_check_domain_name(ssl, DEFAULT_IPADDR) != SSL_SUCCESS) {
#endif
console_printf("ERROR: failed to set expected hostname\n");
wolfSSL_free(ssl);
ssl = NULL;
wolfSSL_CTX_free(wolfsslCtx);
wolfsslCtx = NULL;
return -1;
}
@ -428,13 +465,19 @@ wolfssl_cli(int argc, char **argv)
const char *subCommand = argv[1];
if(!strcmp(subCommand, "init")) {
wolfssl_ctx_init();
if (wolfssl_ctx_init() != 0) {
return -1;
}
wolfSSL_SetIO_Mynewt(ssl, net_test_socket, &net_test_sin);
console_printf("wolfSSL ctx initialize\n");
} else if(!strcmp(subCommand, "clear")) {
wolfssl_ctx_clear();
console_printf("wolfSSL ctx clear\n");
} else if(!strcmp(subCommand, "connect")) {
if (ssl == NULL) {
console_printf("ERROR: run \"wolfssl init\" first\n");
return -1;
}
rc = wolfSSL_connect(ssl);
if(rc != SSL_SUCCESS) {
err = wolfSSL_get_error(ssl, 0);
@ -445,7 +488,11 @@ wolfssl_cli(int argc, char **argv)
} else if(!strcmp(subCommand, "write")) {
char *str = "GET /index.html HTTP/1.0\r\n\r\n";
int len;
if(argc > 3) {
if (ssl == NULL) {
console_printf("ERROR: run \"wolfssl init\" first\n");
return -1;
}
if(argc > 2) {
str = argv[2];
}
len = strlen(str);
@ -459,14 +506,20 @@ wolfssl_cli(int argc, char **argv)
console_printf("wolfSSL_write() = %dL\n", rc);
} else if(!strcmp(subCommand, "read")) {
char buff[256];
rc = 0;
while(rc >= 0) {
if (ssl == NULL) {
console_printf("ERROR: run \"wolfssl init\" first\n");
return -1;
}
rc = 1;
while(rc > 0) {
memset(buff, 0, sizeof(buff));
rc = wolfSSL_read(ssl, buff, sizeof(buff)-1);
if(rc < 0) {
err = wolfSSL_get_error(ssl, 0);
console_printf("ERROR: wolfSSL_read rc:%d err:%d\n", rc, err);
return 0;
} else if (rc == 0) {
break;
}
console_printf("%.*s\n", rc, buff);
}
@ -558,16 +611,18 @@ omgr_app_init(void)
#endif
/**
* main
* mynewt_main
*
* The main task for the project. This function initializes the packages, calls
* init_tasks to initialize additional tasks (and possibly other objects),
* then starts serving events from default event queue.
*
* Named mynewt_main because the BSP provides main().
*
* @return int NOTE: this function should never return!
*/
int
main(int argc, char **argv)
mynewt_main(int argc, char **argv)
{
#ifdef ARCH_sim
mcu_sim_parse_args(argc, argv);

52
mynewt/custom_ca.h 100644
View File

@ -0,0 +1,52 @@
/* custom_ca.h
*
* Copyright (C) 2006-2026 wolfSSL Inc.
*
* This file is part of wolfSSL. (formerly known as CyaSSL)
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
*/
#ifndef CUSTOM_CA_H
#define CUSTOM_CA_H
/* Trust anchor for WOLFSSL_MN_USE_CUSTOM_CA=1.
*
* CA is pinned at compile time and must be manually updated if the target's chain changes.
* Hostname verification is enforced using DEFAULT_HOSTNAME in client-tls-mn.c.
*
* To configure:
* 1. Get root CA: openssl s_client -connect <host>:443 -servername <host> -showcerts </dev/null
* 2. Convert to DER: openssl x509 -in root.pem -outform der | xxd -i
* 3. Paste bytes below and update DEFAULT_IPADDR/DEFAULT_PORT/DEFAULT_HOSTNAME in client-tls-mn.c.
*/
#define CUSTOM_CA_PLACEHOLDER
#ifdef CUSTOM_CA_PLACEHOLDER
#error "mynewt/custom_ca.h: paste your target's root CA DER bytes into " \
"custom_ca_der[] and remove this #error before building with " \
"WOLFSSL_MN_USE_CUSTOM_CA=1 (see the instructions above)."
#endif
static const unsigned char custom_ca_der[] =
{
/* TODO: paste your target's root CA DER bytes here */
0
};
static const int sizeof_custom_ca_der = sizeof(custom_ca_der);
#endif /* CUSTOM_CA_H */

167
mynewt/jenkins.sh
View File

@ -1,8 +1,23 @@
#!/bin/bash -ex
BASEDIR=`dirname $0`
BASEDIR=`cd $BASEDIR && pwd -P`
# Resolve local WOLFSSL_REPO to absolute path.
WOLFSSL_REPO=${WOLFSSL_REPO:-https://github.com/wolfSSL/wolfssl.git}
WOLFSSL_BRANCH=${WOLFSSL_BRANCH:-master}
if [ -d "$WOLFSSL_REPO" ]; then
WOLFSSL_REPO=$(cd "$WOLFSSL_REPO" && pwd -P)
fi
# check for required dependencies
for cmd in newt expect screen git openssl ss xxd python3 fuser; do
if ! command -v $cmd &> /dev/null; then
echo "Error: Required command '$cmd' is not installed."
echo "Please install it before running this script."
exit 1
fi
done
# kill previous process
set +e
killall -9 wolfsslclienttlsmn.elf
@ -10,8 +25,8 @@ set -e
pushd ${BASEDIR} > /dev/null
/bin/rm -rf tmp
/bin/mkdir tmp
/bin/rm -rf tmp/myproj
/bin/mkdir -p tmp
pushd tmp > /dev/null
# create mynewt project
@ -22,8 +37,23 @@ newt upgrade
popd > /dev/null
# deploy wolfssl source files to mynewt project
git clone https://github.com/wolfSSL/wolfssl.git
WOLFSSL=`pwd`/wolfssl
if [ -d "$WOLFSSL_REPO" ]; then
echo "Using local wolfssl repository at $WOLFSSL_REPO"
WOLFSSL="$WOLFSSL_REPO"
else
if [ -d "wolfssl" ]; then
echo "wolfssl already cloned, updating..."
pushd wolfssl > /dev/null
git fetch --depth 1 origin $WOLFSSL_BRANCH
git checkout -B $WOLFSSL_BRANCH FETCH_HEAD
popd > /dev/null
else
echo "Cloning wolfssl..."
git clone --depth 1 -b $WOLFSSL_BRANCH $WOLFSSL_REPO
fi
WOLFSSL=`pwd`/wolfssl
fi
${WOLFSSL}/IDE/mynewt/setup.sh ${NEWTPROJ}
# deploy wolfssl example source files to mynewt project
@ -35,6 +65,91 @@ newt target create wolfsslclienttlsmn_sim
newt target set wolfsslclienttlsmn_sim app=apps/wolfsslclienttlsmn
newt target set wolfsslclienttlsmn_sim bsp=@apache-mynewt-core/hw/bsp/native
newt target set wolfsslclienttlsmn_sim build_profile=debug
# Fix compiler -Werror for sim targets on 64-bit Linux.
# Upstream PR: https://github.com/apache/mynewt-core/pull/3713
sed -i -E 's/-Werror([[:space:]",]|$)/-Wno-error\1/g' repos/apache-mynewt-core/compiler/sim/compiler.yml
if grep -qE -- '-Werror([[:space:]",]|$)' repos/apache-mynewt-core/compiler/sim/compiler.yml; then
echo "Error: -Werror patch did not apply to compiler.yml (upstream may have changed)."
exit 1
fi
# Fix LINK_TABLE start pointer alignment in shell module tables.
# Upstream PR: https://github.com/apache/mynewt-core/pull/3711
python3 - repos/apache-mynewt-core/sys/shell/src/shell.c <<'PYEOF'
import re, sys
path = sys.argv[1]
with open(path) as f:
src = f.read()
old = """static size_t
shell_mod_std_count(shell_mod_t mod)
{
const struct shell_mod_std *std_mod = (const struct shell_mod_std *)mod;
return std_mod->commands_end - std_mod->commands;
}
static shell_cmd_t
shell_mod_std_get(shell_mod_t mod, size_t ix)
{
const struct shell_mod_std *std_mod = (const struct shell_mod_std *)mod;
size_t limit = std_mod->commands_end - std_mod->commands;
return ix < limit ? &std_mod->commands[ix] : NULL;
}"""
new = """static const struct shell_cmd *
shell_mod_std_commands(const struct shell_mod_std *std_mod)
{
uintptr_t addr = (uintptr_t)std_mod->commands;
uintptr_t aligned = (addr + sizeof(struct shell_cmd) - 1) &
~(uintptr_t)(sizeof(struct shell_cmd) - 1);
return (const struct shell_cmd *)aligned;
}
static size_t
shell_mod_std_count(shell_mod_t mod)
{
const struct shell_mod_std *std_mod = (const struct shell_mod_std *)mod;
return std_mod->commands_end - shell_mod_std_commands(std_mod);
}
static shell_cmd_t
shell_mod_std_get(shell_mod_t mod, size_t ix)
{
const struct shell_mod_std *std_mod = (const struct shell_mod_std *)mod;
const struct shell_cmd *commands = shell_mod_std_commands(std_mod);
size_t limit = std_mod->commands_end - commands;
return ix < limit ? &commands[ix] : NULL;
}"""
if old not in src:
print("Error: shell_mod_std_count/get patch target not found in shell.c "
"(upstream may have changed).", file=sys.stderr)
sys.exit(1)
with open(path, "w") as f:
f.write(src.replace(old, new, 1))
PYEOF
# Fix uart_pty() loop_slave FD leak.
# Upstream PR: https://github.com/apache/mynewt-core/pull/3712
sed -i 's|snprintf(msg, sizeof(msg), "uart%d at %s\\n", port, pty_name);|close(loop_slave);\n snprintf(msg, sizeof(msg), "uart%d at %s\\n", port, pty_name);|' \
repos/apache-mynewt-core/hw/mcu/native/src/hal_uart.c
if ! grep -q 'close(loop_slave);' repos/apache-mynewt-core/hw/mcu/native/src/hal_uart.c; then
echo "Error: loop_slave close patch did not apply to hal_uart.c (upstream may have changed)."
exit 1
fi
# Test that WOLFSSL_MN_USE_CUSTOM_CA path halts compilation with #error as intended
newt target set wolfsslclienttlsmn_sim syscfg=WOLFSSL_MN_USE_CUSTOM_CA=1
if newt build wolfsslclienttlsmn_sim > /dev/null 2>&1; then
echo "Error: WOLFSSL_MN_USE_CUSTOM_CA build succeeded but was expected to fail with #error."
exit 1
fi
newt target set wolfsslclienttlsmn_sim syscfg=WOLFSSL_MN_USE_CUSTOM_CA=0
newt build wolfsslclienttlsmn_sim
/bin/rm -f wolfsslclienttlsmn.log
@ -42,8 +157,49 @@ newt build wolfsslclienttlsmn_sim
sleep 1
TTY_NAME=`cat wolfsslclienttlsmn.log | cut -d ' ' -f 3`
# Free port 11111 of any stale listener left behind by an aborted previous run.
set +e
fuser -k 11111/tcp 2> /dev/null
set -e
# Start a local TLS server on port 11111 for the client to connect to
pushd ${BASEDIR}/../tls > /dev/null
make
./server-tls &
OSSL_PID=$!
popd > /dev/null
trap "kill $OSSL_PID 2> /dev/null || true" EXIT
# Wait for server to listen via socket state, avoiding probing TCP connections.
for i in $(seq 1 30); do
if ! kill -0 $OSSL_PID 2>/dev/null; then
echo "Error: server-tls (PID $OSSL_PID) died unexpectedly."
exit 1
fi
if ss -ltn "sport = :11111" 2> /dev/null | grep -q ':11111'; then
break
fi
if [ "$i" -eq 30 ]; then
echo "Error: server-tls never started listening on port 11111."
exit 1
fi
sleep 0.5
done
export TERM=vt100
expect ${BASEDIR}/test_client-tls.expect $TTY_NAME
kill $OSSL_PID 2> /dev/null || true
trap - EXIT
echo ""
echo "=========================================================="
echo "✅ SUCCESS: All TLS tests passed!"
echo "A transcript of the test session was saved to:"
echo "tmp/myproj/expect_output.log"
echo "=========================================================="
echo ""
killall -9 wolfsslclienttlsmn.elf
popd > /dev/null
@ -52,6 +208,7 @@ popd > /dev/null # tmp
# cleanup tmp directory on jenkins
if [ ! -z "$JENKINS_URL" ]; then
[ -f tmp/myproj/expect_output.log ] && mv tmp/myproj/expect_output.log expect_output.log
/bin/rm -rf tmp
fi

20
mynewt/setup.sh
View File

@ -42,5 +42,25 @@ echo "deploy wolfssl client-tls to apps/wolfsslclienttlsmn"
/bin/mkdir -p $MYNEWT_PROJECT/apps/wolfsslclienttlsmn/src
/bin/cp $WOLFSSL_MYNEWTDIR/client-tls-mn.c $MYNEWT_PROJECT/apps/wolfsslclienttlsmn/src/main.c
/bin/cp $WOLFSSL_MYNEWTDIR/custom_ca.h $MYNEWT_PROJECT/apps/wolfsslclienttlsmn/src/custom_ca.h
# Generate local_ca.h from certs/ca-cert.pem.
LOCAL_CA_HEADER=$MYNEWT_PROJECT/apps/wolfsslclienttlsmn/src/local_ca.h
{
echo "/* Generated by mynewt/setup.sh from wolfssl-examples/certs/ca-cert.pem. */"
echo "#ifndef LOCAL_CA_H"
echo "#define LOCAL_CA_H"
echo "static const unsigned char local_ca_der[] = {"
openssl x509 -in $WOLFSSL_MYNEWTDIR/../certs/ca-cert.pem -outform der | xxd -i
echo "};"
echo "static const int sizeof_local_ca_der = sizeof(local_ca_der);"
echo "#endif /* LOCAL_CA_H */"
} > $LOCAL_CA_HEADER
if ! grep -q '0x' $LOCAL_CA_HEADER; then
echo "Error: generated $LOCAL_CA_HEADER has no CA bytes -- is" \
"$WOLFSSL_MYNEWTDIR/../certs/ca-cert.pem missing or unreadable?" 1>&2
exit 1
fi
popd > /dev/null # $BASEDIR

36
mynewt/test_client-tls.expect
View File

@ -1,62 +1,74 @@
#!/usr/bin/env expect
set timeout 10
set timeout 30
set tty [lindex $argv 0]
log_file expect_output.log
exp_internal 0
spawn screen $tty
send "\n"
expect {
timeout {exit 2}
-re ".* compat>"
-re "compat>"
}
send "net tcp\n"
expect {
timeout {exit 3}
-re ".* mn_socket\\(TCP\\) = 0.*\n.* compat>"
-re "(?s)mn_socket\\(TCP\\) = 0.*compat>"
}
send "net connect\n"
expect {
timeout {exit 4}
-re ".* net_test_writable 0 - 0.*"
-re "(?s)net_test_writable 0 - 0.*"
}
foreach {cmd code} {
"wolfssl connect" 11
"wolfssl write" 12
"wolfssl read" 13
} {
send "$cmd\n"
expect {
timeout {exit $code}
-re "(?s)ERROR: run \"wolfssl init\" first.*compat>"
}
}
send "wolfssl init\n"
expect {
timeout {exit 5}
-re ".* compat>"
-re "compat>"
}
send "wolfssl connect\n"
expect {
timeout {exit 6}
-re ".* wolfSSL_connect\\(\\) = 1.*\n.* compat>"
-re "(?s)wolfSSL_connect\\(\\) = 1.*compat>"
}
send "wolfssl write\n"
expect {
timeout {exit 7}
-re ".* wolfSSL_write\\(\\) = .*\n.* compat>"
-re "(?s)wolfSSL_write\\(\\) = \\d+L.*compat>"
}
send "wolfssl read\n"
expect {
timeout {exit 8}
-re ".* compat>"
-re "compat>"
}
send "wolfssl clear\n"
expect {
timeout {exit 9}
-re ".* compat>"
-re "compat>"
}
send "net close\n"
expect {
timeout {exit 10}
-re ".* mn_close\\(\\) = 0.*\n.* compat>"
-re "(?s)mn_close\\(\\) = 0.*compat>"
}
exit 0