diff --git a/.gitignore b/.gitignore index a1182ade..f3b34ad3 100644 --- a/.gitignore +++ b/.gitignore @@ -73,6 +73,7 @@ android/wolfssljni-ndk-sample/proguard-project.txt /psk/server-psk /psk/server-tcp +/tls/client-async /tls/client-tcp /tls/client-tls /tls/client-tls13 @@ -80,6 +81,7 @@ android/wolfssljni-ndk-sample/proguard-project.txt /tls/client-tls-bio /tls/client-tls-cacb /tls/client-tls-callback +/tls/client-tls-cryptocb /tls/client-tls-ecdhe /tls/client-tls-nonblocking /tls/client-tls-perf @@ -89,10 +91,12 @@ android/wolfssljni-ndk-sample/proguard-project.txt /tls/memory-tls +/tls/server-async /tls/server-tcp /tls/server-tls /tls/server-tls13 /tls/server-tls-callback +/tls/server-tls-cryptocb /tls/server-tls-ecdhe /tls/server-tls-epoll-perf /tls/server-tls-epoll-threaded diff --git a/tls/Makefile b/tls/Makefile index 0cbce682..b46d9802 100644 --- a/tls/Makefile +++ b/tls/Makefile @@ -10,6 +10,7 @@ STATIC_LIB = $(LIB_PATH)/lib/libwolfssl.a DEBUG_FLAGS = -g -DDEBUG DEBUG_INC_PATHS = -MD OPTIMIZE = -Os +DEPS = # Options #CFLAGS+=$(DEBUG_FLAGS) @@ -19,9 +20,14 @@ CFLAGS+=$(OPTIMIZE) #LIBS+=$(STATIC_LIB) LIBS+=$(DYN_LIB) +# Openssl Option +#CFLAGS+=-DUSE_OPENSSL +#LIBS+=-lcrypto + # build targets SRC=$(wildcard *.c) -TARGETS=$(patsubst %.c, %, $(SRC)) +IGNORE_FILES=cryptocb-common +TARGETS=$(filter-out $(IGNORE_FILES), $(patsubst %.c, %, $(SRC))) LINUX_SPECIFIC=client-tls-perf \ server-tls-poll-perf \ server-tls-epoll-perf \ @@ -97,9 +103,11 @@ memory-tls: CFLAGS+=-pthread # compile tcp examples without the LIBS variable %-tcp: LIBS= +%-cryptocb: DEPS+=cryptocb-common.c + # build template %: %.c - $(CC) -o $@ $< $(CFLAGS) $(LIBS) + $(CC) -o $@ $(DEPS) $< $(CFLAGS) $(LIBS) clean: rm -f $(TARGETS) diff --git a/tls/client-tls-cacb.c b/tls/client-tls-cacb.c index f17015a1..5ecbd70b 100644 --- a/tls/client-tls-cacb.c +++ b/tls/client-tls-cacb.c @@ -97,7 +97,7 @@ static void CaCb(unsigned char* der, int sz, int type) } ret = wolfSSL_X509_get_serial_number(x509, serial, &sz); - if (ret == SSL_SUCCESS) { + if (ret == WOLFSSL_SUCCESS) { int i; int strLen; char serialMsg[80]; @@ -134,7 +134,7 @@ int Security(int sock) /* create and initialize WOLFSSL_CTX structure */ if ((ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method())) == NULL) { printf("SSL_CTX_new error.\n"); - ret = EXIT_FAILURE; + ret = EXIT_FAILURE; goto exit; } @@ -142,20 +142,20 @@ int Security(int sock) wolfSSL_CTX_SetCACb(ctx, CaCb); /* load CA certificates into wolfSSL_CTX. which will verify the server */ - if ((ret = wolfSSL_CTX_load_verify_locations(ctx, cert, 0)) + if ((ret = wolfSSL_CTX_load_verify_locations(ctx, cert, 0)) != WOLFSSL_SUCCESS) { printf("Error loading %s. Please check the file.\n", cert); goto exit; } if ((ssl = wolfSSL_new(ctx)) == NULL) { printf("wolfSSL_new error.\n"); - ret = EXIT_FAILURE; + ret = EXIT_FAILURE; goto exit; } wolfSSL_set_fd(ssl, sock); ret = wolfSSL_connect(ssl); - if (ret == SSL_SUCCESS) { + if (ret == WOLFSSL_SUCCESS) { ret = ClientGreet(sock, ssl); } @@ -190,7 +190,7 @@ int main(int argc, char** argv) if (sockfd < 0) { printf("Failed to create socket. Error: %i\n", errno); - ret = EXIT_FAILURE; + ret = EXIT_FAILURE; goto exit; } diff --git a/tls/client-tls-cryptocb.c b/tls/client-tls-cryptocb.c index 566f386c..03a91c81 100644 --- a/tls/client-tls-cryptocb.c +++ b/tls/client-tls-cryptocb.c @@ -31,374 +31,51 @@ #include /* wolfSSL */ -#include +#ifndef WOLFSSL_USER_SETTINGS + #include +#endif #include #include #include #include +#include "cryptocb-common.h" + #define DEFAULT_PORT 11111 -#define CA_FILE "../certs/ca-cert.pem" +#define USE_ECDHE_ECDSA +#define USE_TLSV13 -#ifdef WOLF_CRYPTO_CB -/* Example custom context for crypto callback */ -typedef struct { - int exampleVar; /* example, not used */ -} myCryptoCbCtx; - -static void error_out(char* msg, int err) -{ - printf("Failed at %s with code %d\n", msg, err); - exit(1); -} - - -/* Example crypto dev callback function that calls software version */ -/* This is where you would plug-in calls to your own hardware crypto */ -static int myCryptoCb(int devIdArg, wc_CryptoInfo* info, void* ctx) -{ - int ret = CRYPTOCB_UNAVAILABLE; /* return this to bypass HW and use SW */ - myCryptoCbCtx* myCtx = (myCryptoCbCtx*)ctx; - - if (info == NULL) - return BAD_FUNC_ARG; - -#ifdef DEBUG_CRYPTOCB - wc_CryptoCb_InfoString(info); +#ifdef USE_ECDHE_ECDSA +#define CERT_FILE "../certs/client-ecc-cert.pem" +#define KEY_FILE "../certs/ecc-client-key.pem" +#define CA_FILE "../certs/ca-ecc-cert.pem" +#else +#define CERT_FILE "../certs/client-cert.pem" +#define KEY_FILE "../certs/client-key.pem" +#define CA_FILE "../certs/ca-cert.pem" #endif - if (info->algo_type == WC_ALGO_TYPE_RNG) { - #ifndef WC_NO_RNG - /* set devId to invalid, so software is used */ - info->rng.rng->devId = INVALID_DEVID; - - ret = wc_RNG_GenerateBlock(info->rng.rng, - info->rng.out, info->rng.sz); - - /* reset devId */ - info->rng.rng->devId = devIdArg; - #endif - } - else if (info->algo_type == WC_ALGO_TYPE_SEED) { - #ifndef WC_NO_RNG - static byte seed[sizeof(word32)] = { 0x00, 0x00, 0x00, 0x01 }; - word32* seedWord32 = (word32*)seed; - word32 len; - - /* wc_GenerateSeed is a local symbol so we need to fake the entropy. */ - while (info->seed.sz > 0) { - len = (word32)sizeof(seed); - if (info->seed.sz < len) - len = info->seed.sz; - XMEMCPY(info->seed.seed, seed, sizeof(seed)); - info->seed.seed += len; - info->seed.sz -= len; - (*seedWord32)++; - } - - ret = 0; - #endif - } - else if (info->algo_type == WC_ALGO_TYPE_PK) { - #ifndef NO_RSA - if (info->pk.type == WC_PK_TYPE_RSA) { - /* set devId to invalid, so software is used */ - info->pk.rsa.key->devId = INVALID_DEVID; - - switch (info->pk.rsa.type) { - case RSA_PUBLIC_ENCRYPT: - case RSA_PUBLIC_DECRYPT: - /* perform software based RSA public op */ - ret = wc_RsaFunction( - info->pk.rsa.in, info->pk.rsa.inLen, - info->pk.rsa.out, info->pk.rsa.outLen, - info->pk.rsa.type, info->pk.rsa.key, info->pk.rsa.rng); - break; - case RSA_PRIVATE_ENCRYPT: - case RSA_PRIVATE_DECRYPT: - /* perform software based RSA private op */ - ret = wc_RsaFunction( - info->pk.rsa.in, info->pk.rsa.inLen, - info->pk.rsa.out, info->pk.rsa.outLen, - info->pk.rsa.type, info->pk.rsa.key, info->pk.rsa.rng); - break; - } - - /* reset devId */ - info->pk.rsa.key->devId = devIdArg; - } - #ifdef WOLFSSL_KEY_GEN - else if (info->pk.type == WC_PK_TYPE_RSA_KEYGEN) { - info->pk.rsakg.key->devId = INVALID_DEVID; - - ret = wc_MakeRsaKey(info->pk.rsakg.key, info->pk.rsakg.size, - info->pk.rsakg.e, info->pk.rsakg.rng); - - /* reset devId */ - info->pk.rsakg.key->devId = devIdArg; - } - #endif - #endif /* !NO_RSA */ - #ifdef HAVE_ECC - if (info->pk.type == WC_PK_TYPE_EC_KEYGEN) { - /* set devId to invalid, so software is used */ - info->pk.eckg.key->devId = INVALID_DEVID; - - ret = wc_ecc_make_key_ex(info->pk.eckg.rng, info->pk.eckg.size, - info->pk.eckg.key, info->pk.eckg.curveId); - - /* reset devId */ - info->pk.eckg.key->devId = devIdArg; - } - else if (info->pk.type == WC_PK_TYPE_ECDSA_SIGN) { - /* set devId to invalid, so software is used */ - info->pk.eccsign.key->devId = INVALID_DEVID; - - ret = wc_ecc_sign_hash( - info->pk.eccsign.in, info->pk.eccsign.inlen, - info->pk.eccsign.out, info->pk.eccsign.outlen, - info->pk.eccsign.rng, info->pk.eccsign.key); - - /* reset devId */ - info->pk.eccsign.key->devId = devIdArg; - } - else if (info->pk.type == WC_PK_TYPE_ECDSA_VERIFY) { - /* set devId to invalid, so software is used */ - info->pk.eccverify.key->devId = INVALID_DEVID; - - ret = wc_ecc_verify_hash( - info->pk.eccverify.sig, info->pk.eccverify.siglen, - info->pk.eccverify.hash, info->pk.eccverify.hashlen, - info->pk.eccverify.res, info->pk.eccverify.key); - - /* reset devId */ - info->pk.eccverify.key->devId = devIdArg; - } - else if (info->pk.type == WC_PK_TYPE_ECDH) { - /* set devId to invalid, so software is used */ - info->pk.ecdh.private_key->devId = INVALID_DEVID; - - ret = wc_ecc_shared_secret( - info->pk.ecdh.private_key, info->pk.ecdh.public_key, - info->pk.ecdh.out, info->pk.ecdh.outlen); - - /* reset devId */ - info->pk.ecdh.private_key->devId = devIdArg; - } - #endif /* HAVE_ECC */ - } - else if (info->algo_type == WC_ALGO_TYPE_CIPHER) { -#if !defined(NO_AES) || !defined(NO_DES3) - #ifdef HAVE_AESGCM - if (info->cipher.type == WC_CIPHER_AES_GCM) { - if (info->cipher.enc) { - /* set devId to invalid, so software is used */ - info->cipher.aesgcm_enc.aes->devId = INVALID_DEVID; - - ret = wc_AesGcmEncrypt( - info->cipher.aesgcm_enc.aes, - info->cipher.aesgcm_enc.out, - info->cipher.aesgcm_enc.in, - info->cipher.aesgcm_enc.sz, - info->cipher.aesgcm_enc.iv, - info->cipher.aesgcm_enc.ivSz, - info->cipher.aesgcm_enc.authTag, - info->cipher.aesgcm_enc.authTagSz, - info->cipher.aesgcm_enc.authIn, - info->cipher.aesgcm_enc.authInSz); - - /* reset devId */ - info->cipher.aesgcm_enc.aes->devId = devIdArg; - } - else { - /* set devId to invalid, so software is used */ - info->cipher.aesgcm_dec.aes->devId = INVALID_DEVID; - - ret = wc_AesGcmDecrypt( - info->cipher.aesgcm_dec.aes, - info->cipher.aesgcm_dec.out, - info->cipher.aesgcm_dec.in, - info->cipher.aesgcm_dec.sz, - info->cipher.aesgcm_dec.iv, - info->cipher.aesgcm_dec.ivSz, - info->cipher.aesgcm_dec.authTag, - info->cipher.aesgcm_dec.authTagSz, - info->cipher.aesgcm_dec.authIn, - info->cipher.aesgcm_dec.authInSz); - - /* reset devId */ - info->cipher.aesgcm_dec.aes->devId = devIdArg; - } - } - #endif /* HAVE_AESGCM */ - #ifdef HAVE_AES_CBC - if (info->cipher.type == WC_CIPHER_AES_CBC) { - if (info->cipher.enc) { - /* set devId to invalid, so software is used */ - info->cipher.aescbc.aes->devId = INVALID_DEVID; - - ret = wc_AesCbcEncrypt( - info->cipher.aescbc.aes, - info->cipher.aescbc.out, - info->cipher.aescbc.in, - info->cipher.aescbc.sz); - - /* reset devId */ - info->cipher.aescbc.aes->devId = devIdArg; - } - else { - /* set devId to invalid, so software is used */ - info->cipher.aescbc.aes->devId = INVALID_DEVID; - - ret = wc_AesCbcDecrypt( - info->cipher.aescbc.aes, - info->cipher.aescbc.out, - info->cipher.aescbc.in, - info->cipher.aescbc.sz); - - /* reset devId */ - info->cipher.aescbc.aes->devId = devIdArg; - } - } - #endif /* HAVE_AES_CBC */ - #ifndef NO_DES3 - if (info->cipher.type == WC_CIPHER_DES3) { - if (info->cipher.enc) { - /* set devId to invalid, so software is used */ - info->cipher.des3.des->devId = INVALID_DEVID; - - ret = wc_Des3_CbcEncrypt( - info->cipher.des3.des, - info->cipher.des3.out, - info->cipher.des3.in, - info->cipher.des3.sz); - - /* reset devId */ - info->cipher.des3.des->devId = devIdArg; - } - else { - /* set devId to invalid, so software is used */ - info->cipher.des3.des->devId = INVALID_DEVID; - - ret = wc_Des3_CbcDecrypt( - info->cipher.des3.des, - info->cipher.des3.out, - info->cipher.des3.in, - info->cipher.des3.sz); - - /* reset devId */ - info->cipher.des3.des->devId = devIdArg; - } - } - #endif /* !NO_DES3 */ -#endif /* !NO_AES || !NO_DES3 */ - } - else if (info->algo_type == WC_ALGO_TYPE_HASH) { -#if !defined(NO_SHA) || !defined(NO_SHA256) - #if !defined(NO_SHA) - if (info->hash.type == WC_HASH_TYPE_SHA) { - if (info->hash.sha1 == NULL) - return CRYPTOCB_UNAVAILABLE; - - /* set devId to invalid, so software is used */ - info->hash.sha1->devId = INVALID_DEVID; - - if (info->hash.in != NULL) { - ret = wc_ShaUpdate( - info->hash.sha1, - info->hash.in, - info->hash.inSz); - } - if (info->hash.digest != NULL) { - ret = wc_ShaFinal( - info->hash.sha1, - info->hash.digest); - } - - /* reset devId */ - info->hash.sha1->devId = devIdArg; - } - else - #endif - #if !defined(NO_SHA256) - if (info->hash.type == WC_HASH_TYPE_SHA256) { - if (info->hash.sha256 == NULL) - return CRYPTOCB_UNAVAILABLE; - - /* set devId to invalid, so software is used */ - info->hash.sha256->devId = INVALID_DEVID; - - if (info->hash.in != NULL) { - ret = wc_Sha256Update( - info->hash.sha256, - info->hash.in, - info->hash.inSz); - } - if (info->hash.digest != NULL) { - ret = wc_Sha256Final( - info->hash.sha256, - info->hash.digest); - } - - /* reset devId */ - info->hash.sha256->devId = devIdArg; - } - else - #endif - { - } -#endif /* !NO_SHA || !NO_SHA256 */ - } - else if (info->algo_type == WC_ALGO_TYPE_HMAC) { -#ifndef NO_HMAC - if (info->hmac.hmac == NULL) - return CRYPTOCB_UNAVAILABLE; - - /* set devId to invalid, so software is used */ - info->hmac.hmac->devId = INVALID_DEVID; - - if (info->hash.in != NULL) { - ret = wc_HmacUpdate( - info->hmac.hmac, - info->hmac.in, - info->hmac.inSz); - } - else if (info->hash.digest != NULL) { - ret = wc_HmacFinal( - info->hmac.hmac, - info->hmac.digest); - } - - /* reset devId */ - info->hmac.hmac->devId = devIdArg; -#endif - } - - (void)devIdArg; - (void)myCtx; - - return ret; -} -#endif /* WOLF_CRYPTO_CB */ int main(int argc, char** argv) { int ret = 0; #ifdef WOLF_CRYPTO_CB - int sockfd; + int sockfd = SOCKET_INVALID; struct sockaddr_in servAddr; char buff[256]; size_t len; /* declare wolfSSL objects */ - WOLFSSL_CTX* ctx; - WOLFSSL* ssl; + WOLFSSL_CTX* ctx = NULL; + WOLFSSL* ssl = NULL; + WOLFSSL_CIPHER* cipher; int devId = 1; /* anything besides -2 (INVALID_DEVID) */ myCryptoCbCtx myCtx; /* example data for callback */ + memset(&myCtx, 0, sizeof(myCtx)); myCtx.exampleVar = 1; /* Check for proper calling convention */ @@ -413,7 +90,7 @@ int main(int argc, char** argv) if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { fprintf(stderr, "ERROR: failed to create the socket\n"); ret = -1; - goto end; + goto exit; } /* Initialize the server address struct with zeros */ @@ -427,74 +104,123 @@ int main(int argc, char** argv) if (inet_pton(AF_INET, argv[1], &servAddr.sin_addr) != 1) { fprintf(stderr, "ERROR: invalid address\n"); ret = -1; - goto end; + goto exit; } /* Connect to the server */ if ((ret = connect(sockfd, (struct sockaddr*) &servAddr, sizeof(servAddr))) == -1) { fprintf(stderr, "ERROR: failed to connect\n"); - goto end; + goto exit; } +#if 0 + wolfSSL_Debugging_ON(); +#endif + /*---------------------------------*/ /* Start of wolfSSL initialization and configuration */ /*---------------------------------*/ /* Initialize wolfSSL */ if ((ret = wolfSSL_Init()) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: Failed to initialize the library\n"); - goto socket_cleanup; - } - - /* Create and initialize WOLFSSL_CTX */ - if ((ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method())) == NULL) { - fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); - ret = -1; - goto socket_cleanup; + goto exit; } /* register a devID for crypto callbacks */ ret = wc_CryptoCb_RegisterDevice(devId, myCryptoCb, &myCtx); - if (ret != 0) - error_out("wc_CryptoCb_RegisterDevice", ret); + if (ret != 0) { + fprintf(stderr, "ERROR: wc_CryptoCb_RegisterDevice failed %d\n", ret); + goto exit; + } + + /* Create and initialize WOLFSSL_CTX */ +#ifdef USE_TLSV13 + ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()); +#else + ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method()); +#endif + if (ctx == NULL) { + fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); + ret = -1; + goto exit; + } + + /* Mutual Authentication */ + /* Load client certificate into WOLFSSL_CTX */ + if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, + WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", + CERT_FILE); + goto exit; + } + + /* Load client key into WOLFSSL_CTX */ + if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, + WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", + KEY_FILE); + goto exit; + } + + /* Load CA certificate into WOLFSSL_CTX for validating peer */ + if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CA_FILE, NULL)) + != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", + CA_FILE); + goto exit; + } + + /* validate peer certificate */ + wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, NULL); /* register a devID for crypto callbacks */ wolfSSL_CTX_SetDevId(ctx, devId); +#if 0 + /* Examples: "TLS13-AES256-GCM-SHA384", + * "TLS13-AES128-GCM-SHA256" or + * "TLS13-CHACHA20-POLY1305-SHA256" */ + wolfSSL_CTX_set_cipher_list(ctx, "TLS13-AES256-GCM-SHA384"); +#endif + /* Load client certificates into WOLFSSL_CTX */ if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CA_FILE, NULL)) - != SSL_SUCCESS) { + != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", CA_FILE); - goto ctx_cleanup; + goto exit; } /* Create a WOLFSSL object */ if ((ssl = wolfSSL_new(ctx)) == NULL) { fprintf(stderr, "ERROR: failed to create WOLFSSL object\n"); ret = -1; - goto ctx_cleanup; + goto exit; } /* Attach wolfSSL to the socket */ if ((ret = wolfSSL_set_fd(ssl, sockfd)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: Failed to set the file descriptor\n"); - goto cleanup; + goto exit; } /* Connect to wolfSSL on the server side */ - if ((ret = wolfSSL_connect(ssl)) != SSL_SUCCESS) { + if ((ret = wolfSSL_connect(ssl)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to connect to wolfSSL\n"); - goto cleanup; + goto exit; } + cipher = wolfSSL_get_current_cipher(ssl); + printf("SSL cipher suite is %s\n", wolfSSL_CIPHER_get_name(cipher)); + /* Get a message for the server from stdin */ printf("Message for server: "); memset(buff, 0, sizeof(buff)); if (fgets(buff, sizeof(buff), stdin) == NULL) { fprintf(stderr, "ERROR: failed to get message for server\n"); ret = -1; - goto cleanup; + goto exit; } len = strnlen(buff, sizeof(buff)); @@ -502,33 +228,32 @@ int main(int argc, char** argv) if ((ret = wolfSSL_write(ssl, buff, len)) != len) { fprintf(stderr, "ERROR: failed to write entire message\n"); fprintf(stderr, "%d bytes of %d bytes were sent", ret, (int) len); - goto cleanup; + goto exit; } /* Read the server data into our buff array */ memset(buff, 0, sizeof(buff)); if ((ret = wolfSSL_read(ssl, buff, sizeof(buff)-1)) == -1) { fprintf(stderr, "ERROR: failed to read\n"); - goto cleanup; + goto exit; } /* Print to stdout any data the server sends */ printf("Server: %s\n", buff); - ret = 0; + ret = 0; /* return success */ +exit: /* Cleanup and return */ -cleanup: wolfSSL_free(ssl); /* Free the wolfSSL object */ -ctx_cleanup: + if (sockfd != SOCKET_INVALID) + close(sockfd); /* Close the connection to the server */ wolfSSL_CTX_free(ctx); /* Free the wolfSSL context object */ wolfSSL_Cleanup(); /* Cleanup the wolfSSL environment */ -socket_cleanup: - close(sockfd); /* Close the connection to the server */ -end: #else printf("Please configure wolfSSL with --enable-cryptocb and try again\n"); #endif /* WOLF_CRYPTO_CB */ - return ret; /* Return reporting a success */ + + return ret; } diff --git a/tls/client-tls-ecdhe.c b/tls/client-tls-ecdhe.c index 3773ae58..e8073623 100644 --- a/tls/client-tls-ecdhe.c +++ b/tls/client-tls-ecdhe.c @@ -46,7 +46,7 @@ int main(int argc, char** argv) { - int ret; + int ret; int sockfd = SOCKET_INVALID; struct sockaddr_in servAddr; char buff[256]; @@ -76,7 +76,7 @@ int main(int argc, char** argv) * 0 means choose the default protocol. */ if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { fprintf(stderr, "ERROR: failed to create the socket\n"); - ret = -1; + ret = -1; goto exit; } @@ -85,7 +85,7 @@ int main(int argc, char** argv) /* Create and initialize WOLFSSL_CTX */ if ((ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method())) == NULL) { fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); - ret = -1; + ret = -1; goto exit; } @@ -98,7 +98,7 @@ int main(int argc, char** argv) } /* Load client ecc certificates into WOLFSSL_CTX */ - if ((ret = wolfSSL_CTX_use_certificate_chain_file(ctx, ECC_FILE)) != + if ((ret = wolfSSL_CTX_use_certificate_chain_file(ctx, ECC_FILE)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", ECC_FILE); @@ -106,7 +106,7 @@ int main(int argc, char** argv) } /* Load client ecc key into WOLFSSL_CTX */ - if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, SSL_FILETYPE_PEM)) + if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", KEY_FILE); @@ -132,7 +132,7 @@ int main(int argc, char** argv) /* Get the server IPv4 address from the command line call */ if (inet_pton(AF_INET, argv[1], &servAddr.sin_addr) != 1) { fprintf(stderr, "ERROR: invalid address\n"); - ret = -1; + ret = -1; goto exit; } @@ -142,7 +142,7 @@ int main(int argc, char** argv) if (connect(sockfd, (struct sockaddr*) &servAddr, sizeof(servAddr)) == -1) { fprintf(stderr, "ERROR: failed to connect\n"); - ret = -1; + ret = -1; goto exit; } @@ -151,7 +151,7 @@ int main(int argc, char** argv) /* Create a WOLFSSL object */ if ((ssl = wolfSSL_new(ctx)) == NULL) { fprintf(stderr, "ERROR: failed to create WOLFSSL object\n"); - ret = -1; + ret = -1; goto exit; } @@ -171,7 +171,7 @@ int main(int argc, char** argv) memset(buff, 0, sizeof(buff)); if (fgets(buff, sizeof(buff), stdin) == NULL) { fprintf(stderr, "ERROR: failed to get message for server\n"); - ret = -1; + ret = -1; goto exit; } len = strnlen(buff, sizeof(buff)); diff --git a/tls/client-tls-uart.c b/tls/client-tls-uart.c index c67618b8..8e58eacf 100644 --- a/tls/client-tls-uart.c +++ b/tls/client-tls-uart.c @@ -206,7 +206,7 @@ int main(int argc, char** argv) wolfSSL_CTX_SetIORecv(ctx, uartIORx); /* For testing disable peer cert verification */ - wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL); + wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL); ssl = wolfSSL_new(ctx); if (ssl == NULL) { diff --git a/tls/client-tls.c b/tls/client-tls.c index d1e06be6..b3a6a421 100644 --- a/tls/client-tls.c +++ b/tls/client-tls.c @@ -108,7 +108,7 @@ int main(int argc, char** argv) /* Load client certificates into WOLFSSL_CTX */ if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CERT_FILE, NULL)) - != SSL_SUCCESS) { + != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", CERT_FILE); goto ctx_cleanup; @@ -128,7 +128,7 @@ int main(int argc, char** argv) } /* Connect to wolfSSL on the server side */ - if ((ret = wolfSSL_connect(ssl)) != SSL_SUCCESS) { + if ((ret = wolfSSL_connect(ssl)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to connect to wolfSSL\n"); goto cleanup; } @@ -161,7 +161,7 @@ int main(int argc, char** argv) printf("Server: %s\n", buff); /* Bidirectional shutdown */ - while (wolfSSL_shutdown(ssl) == SSL_SHUTDOWN_NOT_DONE) { + while (wolfSSL_shutdown(ssl) == WOLFSSL_SHUTDOWN_NOT_DONE) { printf("Shutdown not complete\n"); } diff --git a/tls/cryptocb-common.c b/tls/cryptocb-common.c new file mode 100644 index 00000000..d4aac2e9 --- /dev/null +++ b/tls/cryptocb-common.c @@ -0,0 +1,452 @@ +/* crypto-common.c + * + * Copyright (C) 2006-2024 wolfSSL Inc. + * + * This file is part of wolfSSL. (formerly known as CyaSSL) + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +#include "cryptocb-common.h" + +#ifdef WOLF_CRYPTO_CB + +typedef struct { + word32 bufSz; +} hash_ctx_t; + +#ifdef USE_OPENSSL +#include +#endif + +/* type: WC_HASH_TYPE_SHA, WC_HASH_TYPE_SHA256, WC_HASH_TYPE_SHA384, etc */ +/* in: Update (when not NULL) / Final (when NULL) */ +static int cb_hash(int type, const byte* in, word32 inSz, byte* digest, + void* shactx, void** devCtx, word32 flags) +{ + int ret = 0; + enum wc_HashType hash_type = (enum wc_HashType)type; + hash_ctx_t* ctx = (hash_ctx_t*)*devCtx; + byte* hashBuf = NULL; + word32 hashBufSz = 0; + + /* for updates alloc/realloc and copy */ + if (in != NULL) { + if (ctx == NULL) { + ctx = (hash_ctx_t*)malloc(sizeof(hash_ctx_t) + hashBufSz + inSz); + } + else { + hashBufSz = ctx->bufSz; + ctx = (hash_ctx_t*)realloc(ctx, sizeof(hash_ctx_t) + hashBufSz + inSz); + } + if (ctx == NULL) { + return MEMORY_E; + } + hashBuf = (byte*)ctx + sizeof(hash_ctx_t); + memcpy(&hashBuf[hashBufSz], in, inSz); + ctx->bufSz = hashBufSz + inSz; + *devCtx = ctx; + } + /* final */ + else if (digest != NULL) { + if (ctx == NULL) { + /* valid case of empty hash (0 len hash) */ + } + else { + hashBuf = (byte*)ctx + sizeof(hash_ctx_t); + hashBufSz = ctx->bufSz; + } + +#ifdef USE_OPENSSL + switch (hash_type) { + case WC_HASH_TYPE_SHA: + SHA1(hashBuf, hashBufSz, digest); + break; + case WC_HASH_TYPE_SHA224: + SHA224(hashBuf, hashBufSz, digest); + break; + case WC_HASH_TYPE_SHA256: + SHA256(hashBuf, hashBufSz, digest); + break; + case WC_HASH_TYPE_SHA384: + SHA384(hashBuf, hashBufSz, digest); + break; + case WC_HASH_TYPE_SHA512: + SHA512(hashBuf, hashBufSz, digest); + break; + default: + ret = NOT_COMPILED_IN; + break; + } +#else + ret = wc_Hash_ex(hash_type, + hashBuf, hashBufSz, + digest, wc_HashGetDigestSize(hash_type), + NULL, INVALID_DEVID); +#endif + if (!(flags & WC_HASH_FLAG_ISCOPY)) { + free(ctx); + *devCtx = NULL; + } + } + return ret; +} + +/* Example crypto dev callback function that calls software version */ +/* This is where you would plug-in calls to your own hardware crypto */ +int myCryptoCb(int devIdArg, wc_CryptoInfo* info, void* ctx) +{ + int ret = CRYPTOCB_UNAVAILABLE; /* return this to bypass HW and use SW */ + myCryptoCbCtx* myCtx = (myCryptoCbCtx*)ctx; + + if (info == NULL) + return BAD_FUNC_ARG; + +#ifdef DEBUG_CRYPTOCB + wc_CryptoCb_InfoString(info); +#endif + + if (info->algo_type == WC_ALGO_TYPE_RNG) { + #ifndef WC_NO_RNG + /* set devId to invalid, so software is used */ + info->rng.rng->devId = INVALID_DEVID; + + ret = wc_RNG_GenerateBlock(info->rng.rng, + info->rng.out, info->rng.sz); + + /* reset devId */ + info->rng.rng->devId = devIdArg; + #endif + } + else if (info->algo_type == WC_ALGO_TYPE_SEED) { + #ifndef WC_NO_RNG + static byte seed[sizeof(word32)] = { 0x00, 0x00, 0x00, 0x01 }; + word32* seedWord32 = (word32*)seed; + word32 len; + + /* wc_GenerateSeed is a local symbol so we need to fake the entropy. */ + while (info->seed.sz > 0) { + len = (word32)sizeof(seed); + if (info->seed.sz < len) + len = info->seed.sz; + XMEMCPY(info->seed.seed, seed, sizeof(seed)); + info->seed.seed += len; + info->seed.sz -= len; + (*seedWord32)++; + } + + ret = 0; + #endif + } + else if (info->algo_type == WC_ALGO_TYPE_PK) { + #ifndef NO_RSA + if (info->pk.type == WC_PK_TYPE_RSA) { + /* set devId to invalid, so software is used */ + info->pk.rsa.key->devId = INVALID_DEVID; + + switch (info->pk.rsa.type) { + case RSA_PUBLIC_ENCRYPT: + case RSA_PUBLIC_DECRYPT: + /* perform software based RSA public op */ + ret = wc_RsaFunction( + info->pk.rsa.in, info->pk.rsa.inLen, + info->pk.rsa.out, info->pk.rsa.outLen, + info->pk.rsa.type, info->pk.rsa.key, info->pk.rsa.rng); + break; + case RSA_PRIVATE_ENCRYPT: + case RSA_PRIVATE_DECRYPT: + /* perform software based RSA private op */ + ret = wc_RsaFunction( + info->pk.rsa.in, info->pk.rsa.inLen, + info->pk.rsa.out, info->pk.rsa.outLen, + info->pk.rsa.type, info->pk.rsa.key, info->pk.rsa.rng); + break; + } + + /* reset devId */ + info->pk.rsa.key->devId = devIdArg; + } + #ifdef WOLFSSL_KEY_GEN + else if (info->pk.type == WC_PK_TYPE_RSA_KEYGEN) { + info->pk.rsakg.key->devId = INVALID_DEVID; + + ret = wc_MakeRsaKey(info->pk.rsakg.key, info->pk.rsakg.size, + info->pk.rsakg.e, info->pk.rsakg.rng); + + /* reset devId */ + info->pk.rsakg.key->devId = devIdArg; + } + #endif + #endif /* !NO_RSA */ + #ifdef HAVE_ECC + if (info->pk.type == WC_PK_TYPE_EC_KEYGEN) { + /* set devId to invalid, so software is used */ + info->pk.eckg.key->devId = INVALID_DEVID; + + ret = wc_ecc_make_key_ex(info->pk.eckg.rng, info->pk.eckg.size, + info->pk.eckg.key, info->pk.eckg.curveId); + + /* reset devId */ + info->pk.eckg.key->devId = devIdArg; + } + else if (info->pk.type == WC_PK_TYPE_ECDSA_SIGN) { + /* set devId to invalid, so software is used */ + info->pk.eccsign.key->devId = INVALID_DEVID; + + ret = wc_ecc_sign_hash( + info->pk.eccsign.in, info->pk.eccsign.inlen, + info->pk.eccsign.out, info->pk.eccsign.outlen, + info->pk.eccsign.rng, info->pk.eccsign.key); + + /* reset devId */ + info->pk.eccsign.key->devId = devIdArg; + } + else if (info->pk.type == WC_PK_TYPE_ECDSA_VERIFY) { + /* set devId to invalid, so software is used */ + info->pk.eccverify.key->devId = INVALID_DEVID; + + ret = wc_ecc_verify_hash( + info->pk.eccverify.sig, info->pk.eccverify.siglen, + info->pk.eccverify.hash, info->pk.eccverify.hashlen, + info->pk.eccverify.res, info->pk.eccverify.key); + + /* reset devId */ + info->pk.eccverify.key->devId = devIdArg; + } + else if (info->pk.type == WC_PK_TYPE_ECDH) { + /* set devId to invalid, so software is used */ + info->pk.ecdh.private_key->devId = INVALID_DEVID; + + ret = wc_ecc_shared_secret( + info->pk.ecdh.private_key, info->pk.ecdh.public_key, + info->pk.ecdh.out, info->pk.ecdh.outlen); + + /* reset devId */ + info->pk.ecdh.private_key->devId = devIdArg; + } + #endif /* HAVE_ECC */ + } + else if (info->algo_type == WC_ALGO_TYPE_CIPHER) { +#if !defined(NO_AES) || !defined(NO_DES3) + #ifdef HAVE_AESGCM + if (info->cipher.type == WC_CIPHER_AES_GCM) { + if (info->cipher.enc) { + /* set devId to invalid, so software is used */ + info->cipher.aesgcm_enc.aes->devId = INVALID_DEVID; + + ret = wc_AesGcmEncrypt( + info->cipher.aesgcm_enc.aes, + info->cipher.aesgcm_enc.out, + info->cipher.aesgcm_enc.in, + info->cipher.aesgcm_enc.sz, + info->cipher.aesgcm_enc.iv, + info->cipher.aesgcm_enc.ivSz, + info->cipher.aesgcm_enc.authTag, + info->cipher.aesgcm_enc.authTagSz, + info->cipher.aesgcm_enc.authIn, + info->cipher.aesgcm_enc.authInSz); + + /* reset devId */ + info->cipher.aesgcm_enc.aes->devId = devIdArg; + } + else { + /* set devId to invalid, so software is used */ + info->cipher.aesgcm_dec.aes->devId = INVALID_DEVID; + + ret = wc_AesGcmDecrypt( + info->cipher.aesgcm_dec.aes, + info->cipher.aesgcm_dec.out, + info->cipher.aesgcm_dec.in, + info->cipher.aesgcm_dec.sz, + info->cipher.aesgcm_dec.iv, + info->cipher.aesgcm_dec.ivSz, + info->cipher.aesgcm_dec.authTag, + info->cipher.aesgcm_dec.authTagSz, + info->cipher.aesgcm_dec.authIn, + info->cipher.aesgcm_dec.authInSz); + + /* reset devId */ + info->cipher.aesgcm_dec.aes->devId = devIdArg; + } + } + #endif /* HAVE_AESGCM */ + #ifdef HAVE_AES_CBC + if (info->cipher.type == WC_CIPHER_AES_CBC) { + if (info->cipher.enc) { + /* set devId to invalid, so software is used */ + info->cipher.aescbc.aes->devId = INVALID_DEVID; + + ret = wc_AesCbcEncrypt( + info->cipher.aescbc.aes, + info->cipher.aescbc.out, + info->cipher.aescbc.in, + info->cipher.aescbc.sz); + + /* reset devId */ + info->cipher.aescbc.aes->devId = devIdArg; + } + else { + /* set devId to invalid, so software is used */ + info->cipher.aescbc.aes->devId = INVALID_DEVID; + + ret = wc_AesCbcDecrypt( + info->cipher.aescbc.aes, + info->cipher.aescbc.out, + info->cipher.aescbc.in, + info->cipher.aescbc.sz); + + /* reset devId */ + info->cipher.aescbc.aes->devId = devIdArg; + } + } + #endif /* HAVE_AES_CBC */ + #ifndef NO_DES3 + if (info->cipher.type == WC_CIPHER_DES3) { + if (info->cipher.enc) { + /* set devId to invalid, so software is used */ + info->cipher.des3.des->devId = INVALID_DEVID; + + ret = wc_Des3_CbcEncrypt( + info->cipher.des3.des, + info->cipher.des3.out, + info->cipher.des3.in, + info->cipher.des3.sz); + + /* reset devId */ + info->cipher.des3.des->devId = devIdArg; + } + else { + /* set devId to invalid, so software is used */ + info->cipher.des3.des->devId = INVALID_DEVID; + + ret = wc_Des3_CbcDecrypt( + info->cipher.des3.des, + info->cipher.des3.out, + info->cipher.des3.in, + info->cipher.des3.sz); + + /* reset devId */ + info->cipher.des3.des->devId = devIdArg; + } + } + #endif /* !NO_DES3 */ +#endif /* !NO_AES || !NO_DES3 */ + } + else if (info->algo_type == WC_ALGO_TYPE_HASH) { +#if !defined(NO_SHA) || !defined(NO_SHA256) || defined(WOLFSSL_SHA384) || \ + defined(WOLFSSL_SHA512) + #if !defined(NO_SHA) + if (info->hash.type == WC_HASH_TYPE_SHA) { + if (info->hash.sha1 == NULL) + return CRYPTOCB_UNAVAILABLE; + + /* set devId to invalid, so software is used */ + info->hash.sha1->devId = INVALID_DEVID; + + ret = cb_hash(info->hash.type, info->hash.in, info->hash.inSz, + info->hash.digest, info->hash.sha1, &info->hash.sha1->devCtx, + info->hash.sha1->flags); + + /* reset devId */ + info->hash.sha1->devId = devIdArg; + } + else + #endif + #if !defined(NO_SHA256) + if (info->hash.type == WC_HASH_TYPE_SHA256) { + if (info->hash.sha256 == NULL) + return CRYPTOCB_UNAVAILABLE; + + /* set devId to invalid, so software is used */ + info->hash.sha256->devId = INVALID_DEVID; + + ret = cb_hash(info->hash.type, info->hash.in, info->hash.inSz, + info->hash.digest, info->hash.sha256, &info->hash.sha256->devCtx, + info->hash.sha256->flags); + + /* reset devId */ + info->hash.sha256->devId = devIdArg; + } + else + #endif + #ifdef WOLFSSL_SHA384 + if (info->hash.type == WC_HASH_TYPE_SHA384) { + if (info->hash.sha384 == NULL) + return CRYPTOCB_UNAVAILABLE; + + /* set devId to invalid, so software is used */ + info->hash.sha384->devId = INVALID_DEVID; + + ret = cb_hash(info->hash.type, info->hash.in, info->hash.inSz, + info->hash.digest, info->hash.sha384, &info->hash.sha384->devCtx, + info->hash.sha384->flags); + + /* reset devId */ + info->hash.sha384->devId = devIdArg; + } + else + #endif + #ifdef WOLFSSL_SHA512 + if (info->hash.type == WC_HASH_TYPE_SHA512) { + if (info->hash.sha512 == NULL) + return CRYPTOCB_UNAVAILABLE; + + /* set devId to invalid, so software is used */ + info->hash.sha512->devId = INVALID_DEVID; + + ret = cb_hash(info->hash.type, info->hash.in, info->hash.inSz, + info->hash.digest, info->hash.sha512, &info->hash.sha512->devCtx, + info->hash.sha512->flags); + + /* reset devId */ + info->hash.sha512->devId = devIdArg; + } + else + #endif + { + } +#endif /* !NO_SHA || !NO_SHA256 || WOLFSSL_SHA384 || WOLFSSL_SHA512 */ + } + else if (info->algo_type == WC_ALGO_TYPE_HMAC) { +#ifndef NO_HMAC + if (info->hmac.hmac == NULL) + return CRYPTOCB_UNAVAILABLE; + + /* set devId to invalid, so software is used */ + info->hmac.hmac->devId = INVALID_DEVID; + + if (info->hmac.in != NULL) { + ret = wc_HmacUpdate( + info->hmac.hmac, + info->hmac.in, + info->hmac.inSz); + } + else if (info->hmac.digest != NULL) { + ret = wc_HmacFinal( + info->hmac.hmac, + info->hmac.digest); + } + + /* reset devId */ + info->hmac.hmac->devId = devIdArg; +#endif + } + + (void)devIdArg; + (void)myCtx; + + return ret; +} +#endif /* WOLF_CRYPTO_CB */ diff --git a/tls/cryptocb-common.h b/tls/cryptocb-common.h new file mode 100644 index 00000000..958a53c3 --- /dev/null +++ b/tls/cryptocb-common.h @@ -0,0 +1,45 @@ +/* cryptocb-common.h + * + * Copyright (C) 2006-2020 wolfSSL Inc. + * + * This file is part of wolfSSL. (formerly known as CyaSSL) + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +#ifndef _CRYPTOCB_COMMON_H_ +#define _CRYPTOCB_COMMON_H_ + +/* wolfSSL */ +#ifndef WOLFSSL_USER_SETTINGS + #include +#endif +#include +#include +#include +#include + +#ifdef WOLF_CRYPTO_CB + +/* Example custom context for crypto callback */ +typedef struct { + int exampleVar; /* example, not used */ +} myCryptoCbCtx; + +int myCryptoCb(int devIdArg, wc_CryptoInfo* info, void* ctx); + +#endif /* WOLF_CRYPTO_CB */ + +#endif /* !_CRYPTOCB_COMMON_H_ */ diff --git a/tls/memory-tls.c b/tls/memory-tls.c index b50457fd..663ac855 100644 --- a/tls/memory-tls.c +++ b/tls/memory-tls.c @@ -147,7 +147,7 @@ static void* client_thread(void* args) if (cli_ctx == NULL) err_sys("bad client ctx new"); int ret = wolfSSL_CTX_load_verify_locations(cli_ctx, cacert, NULL); - if (ret != SSL_SUCCESS) err_sys("bad ca load"); + if (ret != WOLFSSL_SUCCESS) err_sys("bad ca load"); wolfSSL_SetIOSend(cli_ctx, ClientSend); wolfSSL_SetIORecv(cli_ctx, ClientRecv); @@ -156,7 +156,7 @@ static void* client_thread(void* args) if (cli_ctx == NULL) err_sys("bad client new"); ret = wolfSSL_connect(cli_ssl); - if (ret != SSL_SUCCESS) err_sys("bad client tls connect"); + if (ret != WOLFSSL_SUCCESS) err_sys("bad client tls connect"); printf("wolfSSL client success!\n"); ret = wolfSSL_write(cli_ssl, "hello memory wolfSSL!", 21); @@ -175,11 +175,11 @@ int main() WOLFSSL_CTX* srv_ctx = wolfSSL_CTX_new(wolfTLSv1_2_server_method()); if (srv_ctx == NULL) err_sys("bad server ctx new"); - int ret = wolfSSL_CTX_use_PrivateKey_file(srv_ctx, key, SSL_FILETYPE_PEM); - if (ret != SSL_SUCCESS) err_sys("bad server key file load"); + int ret = wolfSSL_CTX_use_PrivateKey_file(srv_ctx, key, WOLFSSL_FILETYPE_PEM); + if (ret != WOLFSSL_SUCCESS) err_sys("bad server key file load"); - ret = wolfSSL_CTX_use_certificate_file(srv_ctx, cert, SSL_FILETYPE_PEM); - if (ret != SSL_SUCCESS) err_sys("bad server cert file load"); + ret = wolfSSL_CTX_use_certificate_file(srv_ctx, cert, WOLFSSL_FILETYPE_PEM); + if (ret != WOLFSSL_SUCCESS) err_sys("bad server cert file load"); wolfSSL_SetIOSend(srv_ctx, ServerSend); wolfSSL_SetIORecv(srv_ctx, ServerRecv); @@ -193,7 +193,7 @@ int main() /* accept tls connection without tcp sockets */ ret = wolfSSL_accept(srv_ssl); - if (ret != SSL_SUCCESS) err_sys("bad server tls accept"); + if (ret != WOLFSSL_SUCCESS) err_sys("bad server tls accept"); printf("wolfSSL accept success!\n"); /* read msg post handshake from client */ diff --git a/tls/server-tls-callback.c b/tls/server-tls-callback.c index c3d9bd73..a53d1235 100644 --- a/tls/server-tls-callback.c +++ b/tls/server-tls-callback.c @@ -170,7 +170,7 @@ int main() * 0 means choose the default protocol. */ if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { fprintf(stderr, "ERROR: failed to create the socket\n"); - ret = -1; + ret = -1; goto exit; } @@ -184,7 +184,7 @@ int main() } /* Load server certificates into WOLFSSL_CTX */ - if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, SSL_FILETYPE_PEM)) + if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", CERT_FILE); @@ -192,7 +192,7 @@ int main() } /* Load server key into WOLFSSL_CTX */ - if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, SSL_FILETYPE_PEM)) + if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", KEY_FILE); @@ -220,7 +220,7 @@ int main() /* Bind the server socket to our port */ if (bind(sockfd, (struct sockaddr*)&servAddr, sizeof(servAddr)) == -1) { fprintf(stderr, "ERROR: failed to bind\n"); - ret = -1; + ret = -1; goto exit; } @@ -248,7 +248,7 @@ int main() /* Create a WOLFSSL object */ if ((ssl = wolfSSL_new(ctx)) == NULL) { fprintf(stderr, "ERROR: failed to create WOLFSSL object\n"); - ret = -1; + ret = -1; goto exit; } @@ -308,7 +308,7 @@ int main() } ret = 0; - + exit: /* Cleanup and return */ if (ssl) diff --git a/tls/server-tls-cryptocb.c b/tls/server-tls-cryptocb.c new file mode 100644 index 00000000..3d5dc53c --- /dev/null +++ b/tls/server-tls-cryptocb.c @@ -0,0 +1,283 @@ +/* server-tls-cryptocb.c + * + * Copyright (C) 2006-2020 wolfSSL Inc. + * + * This file is part of wolfSSL. (formerly known as CyaSSL) + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* the usual suspects */ +#include +#include +#include + +/* socket includes */ +#include +#include +#include +#include + +/* wolfSSL */ +#ifndef WOLFSSL_USER_SETTINGS + #include +#endif +#include +#include +#include +#include + +#include "cryptocb-common.h" + +#define DEFAULT_PORT 11111 + +#define USE_ECDHE_ECDSA +#define USE_TLSV13 + +#ifdef USE_ECDHE_ECDSA +#define CERT_FILE "../certs/server-ecc.pem" +#define KEY_FILE "../certs/ecc-key.pem" +#define CA_FILE "../certs/client-ecc-cert.pem" +#else +#define CERT_FILE "../certs/server-cert.pem" +#define KEY_FILE "../certs/server-key.pem" +#define CA_FILE "../certs/client-cert.pem" +#endif + + +int main(int argc, char** argv) +{ + int ret = 0; +#ifdef WOLF_CRYPTO_CB + int sockfd = SOCKET_INVALID; + int connd = SOCKET_INVALID; + struct sockaddr_in servAddr; + struct sockaddr_in clientAddr; + socklen_t size = sizeof(clientAddr); + char buff[256]; + size_t len; + int shutdown = 0; + const char* reply = "I hear ya fa shizzle!\n"; + int on; + + /* declare wolfSSL objects */ + WOLFSSL_CTX* ctx = NULL; + WOLFSSL* ssl = NULL; + WOLFSSL_CIPHER* cipher; + + int devId = 1; /* anything besides -2 (INVALID_DEVID) */ + myCryptoCbCtx myCtx; + +#if 0 + wolfSSL_Debugging_ON(); +#endif + + /* Initialize wolfSSL */ + wolfSSL_Init(); + + /* example data for callback */ + memset(&myCtx, 0, sizeof(myCtx)); + myCtx.exampleVar = 1; + + /* register a devID for crypto callbacks */ + ret = wc_CryptoCb_RegisterDevice(devId, myCryptoCb, &myCtx); + if (ret != 0) { + fprintf(stderr, "ERROR: wc_CryptoCb_RegisterDevice failed %d\n", ret); + goto exit; + } + + /* Create and initialize WOLFSSL_CTX */ +#ifdef USE_TLSV13 + ctx = wolfSSL_CTX_new(wolfTLSv1_3_server_method()); +#else + ctx = wolfSSL_CTX_new(wolfTLSv1_2_server_method()); +#endif + if (ctx == NULL) { + fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); + ret = -1; + goto exit; + } + + /* register a devID for crypto callbacks */ + wolfSSL_CTX_SetDevId(ctx, devId); + + /* Load server certificates into WOLFSSL_CTX */ + if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, WOLFSSL_FILETYPE_PEM)) + != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", + CERT_FILE); + goto exit; + } + + /* Load server key into WOLFSSL_CTX */ + if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, WOLFSSL_FILETYPE_PEM)) + != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", + KEY_FILE); + goto exit; + } + + /* Load CA certificate into WOLFSSL_CTX for validating peer */ + if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CA_FILE, NULL)) + != WOLFSSL_SUCCESS) { + fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", + CA_FILE); + goto exit; + } + + /* enable mutual authentication */ + wolfSSL_CTX_set_verify(ctx, + WOLFSSL_VERIFY_PEER | WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL); + +#if 0 + /* Examples: "TLS13-AES256-GCM-SHA384", + * "TLS13-AES128-GCM-SHA256" or + * "TLS13-CHACHA20-POLY1305-SHA256" */ + wolfSSL_CTX_set_cipher_list(ctx, "TLS13-AES256-GCM-SHA384"); +#endif + + /* Create a socket that uses an internet IPv4 address, + * Sets the socket to be stream based (TCP), + * 0 means choose the default protocol. */ + if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { + fprintf(stderr, "ERROR: failed to create the socket\n"); + ret = -1; + goto exit; + } + + on = 1; + setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, + (char*)&on, (socklen_t)sizeof(on)); + + + /* Initialize the server address struct with zeros */ + memset(&servAddr, 0, sizeof(servAddr)); + + /* Fill in the server address */ + servAddr.sin_family = AF_INET; /* using IPv4 */ + servAddr.sin_port = htons(DEFAULT_PORT); /* on DEFAULT_PORT */ + servAddr.sin_addr.s_addr = INADDR_ANY; /* from anywhere */ + + + /* Bind the server socket to our port */ + if (bind(sockfd, (struct sockaddr*)&servAddr, sizeof(servAddr)) == -1) { + fprintf(stderr, "ERROR: failed to bind\n"); + ret = -1; + goto exit; + } + + /* Listen for a new connection, allow 5 pending connections */ + if (listen(sockfd, 5) == -1) { + fprintf(stderr, "ERROR: failed to listen\n"); + ret = -1; + goto exit; + } + + + /* Continue to accept clients until shutdown is issued */ + while (!shutdown) { + printf("Waiting for a connection...\n"); + + /* Accept client connections */ + if ((connd = accept(sockfd, (struct sockaddr*)&clientAddr, &size)) + == -1) { + fprintf(stderr, "ERROR: failed to accept the connection\n\n"); + ret = -1; + goto exit; + } + + /* Create a WOLFSSL object */ + if ((ssl = wolfSSL_new(ctx)) == NULL) { + fprintf(stderr, "ERROR: failed to create WOLFSSL object\n"); + ret = -1; + goto exit; + } + + /* Attach wolfSSL to the socket */ + wolfSSL_set_fd(ssl, connd); + + /* Establish TLS connection */ + ret = wolfSSL_accept(ssl); + if (ret != WOLFSSL_SUCCESS) { + fprintf(stderr, "wolfSSL_accept error = %d\n", + wolfSSL_get_error(ssl, ret)); + goto exit; + } + + + printf("Client connected successfully\n"); + + cipher = wolfSSL_get_current_cipher(ssl); + printf("SSL cipher suite is %s\n", wolfSSL_CIPHER_get_name(cipher)); + + + /* Read the client data into our buff array */ + memset(buff, 0, sizeof(buff)); + if ((ret = wolfSSL_read(ssl, buff, sizeof(buff)-1)) == -1) { + fprintf(stderr, "ERROR: failed to read\n"); + goto exit; + } + + /* Print to stdout any data the client sends */ + printf("Client: %s\n", buff); + + /* Check for server shutdown command */ + if (strncmp(buff, "shutdown", 8) == 0) { + printf("Shutdown command issued!\n"); + shutdown = 1; + } + + + /* Write our reply into buff */ + memset(buff, 0, sizeof(buff)); + memcpy(buff, reply, strlen(reply)); + len = strnlen(buff, sizeof(buff)); + + /* Reply back to the client */ + if ((ret = wolfSSL_write(ssl, buff, len)) != len) { + fprintf(stderr, "ERROR: failed to write\n"); + goto exit; + } + + /* Notify the client that the connection is ending */ + wolfSSL_shutdown(ssl); + printf("Shutdown complete\n"); + + /* Cleanup after this connection */ + wolfSSL_free(ssl); /* Free the wolfSSL object */ + ssl = NULL; + close(connd); /* Close the connection to the client */ + } + + ret = 0; + +exit: + /* Cleanup and return */ + wolfSSL_free(ssl); /* Free the wolfSSL object */ + if (connd != SOCKET_INVALID) + close(connd); /* Close the connection to the client */ + if (sockfd != SOCKET_INVALID) + close(sockfd); /* Close the socket listening for clients */ + wolfSSL_CTX_free(ctx); /* Free the wolfSSL context object */ + wolfSSL_Cleanup(); /* Cleanup the wolfSSL environment */ +#else + printf("Please configure wolfSSL with --enable-cryptocb and try again\n"); +#endif /* WOLF_CRYPTO_CB */ + + (void)argc; + (void)argv; + + return ret; /* Return reporting a success */ +} diff --git a/tls/server-tls-ecdhe.c b/tls/server-tls-ecdhe.c index d870466c..679ea15d 100644 --- a/tls/server-tls-ecdhe.c +++ b/tls/server-tls-ecdhe.c @@ -86,7 +86,7 @@ int main() } /* Load server certificates into WOLFSSL_CTX */ - if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, SSL_FILETYPE_PEM)) + if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", CERT_FILE); @@ -94,7 +94,7 @@ int main() } /* Load server key into WOLFSSL_CTX */ - if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, SSL_FILETYPE_PEM)) + if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", KEY_FILE); diff --git a/tls/server-tls-nonblocking.c b/tls/server-tls-nonblocking.c index 7201186e..c863a0cd 100644 --- a/tls/server-tls-nonblocking.c +++ b/tls/server-tls-nonblocking.c @@ -125,7 +125,7 @@ int main() if (fcntl(sockfd, F_SETFL, O_NONBLOCK) == -1) { fprintf(stderr, "ERROR: failed to set socket options\n"); ret = -1; - goto exit; + goto exit; } @@ -138,7 +138,7 @@ int main() } /* Load server certificates into WOLFSSL_CTX */ - if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, SSL_FILETYPE_PEM)) + if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", CERT_FILE); @@ -146,12 +146,12 @@ int main() } /* Load server key into WOLFSSL_CTX */ - if (wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, SSL_FILETYPE_PEM) + if (wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, WOLFSSL_FILETYPE_PEM) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", KEY_FILE); ret = -1; - goto exit; + goto exit; } @@ -191,7 +191,7 @@ int main() /* non-blocking, wait for read activity on socket */ tcp_select(sockfd, SELECT_WAIT_SEC, 1); continue; - } + } else if (errno == EINPROGRESS || errno == EALREADY) { break; } @@ -212,10 +212,10 @@ int main() fprintf(stderr, "ERROR: Failed to set the file descriptor\n"); goto exit; } - + /* Establish TLS connection */ printf("wolfSSL_accepting\n"); - + do { ret = wolfSSL_accept(ssl); err = wolfSSL_get_error(ssl, ret); @@ -234,7 +234,7 @@ int main() do { ret = wolfSSL_read(ssl, buff, sizeof(buff)-1); err = wolfSSL_get_error(ssl, ret); - + if (err == WOLFSSL_ERROR_WANT_READ) tcp_select(sockfd, SELECT_WAIT_SEC, 1); } @@ -302,6 +302,6 @@ exit: if (ctx) wolfSSL_CTX_free(ctx); /* Free the wolfSSL context object */ wolfSSL_Cleanup(); /* Cleanup the wolfSSL environment */ - + return ret; } diff --git a/tls/server-tls-threaded.c b/tls/server-tls-threaded.c index 94ea9ccd..810746e7 100644 --- a/tls/server-tls-threaded.c +++ b/tls/server-tls-threaded.c @@ -86,7 +86,7 @@ void* ClientHandler(void* args) ret = wolfSSL_accept(ssl); } while(wolfSSL_want_read(ssl)); - if (ret != SSL_SUCCESS) { + if (ret != WOLFSSL_SUCCESS) { printf("ret = %d\n", ret); fprintf(stderr, "wolfSSL_accept error = %d\n", wolfSSL_get_error(ssl, ret)); @@ -159,7 +159,7 @@ void* ClientHandler(void* args) int main() { - int ret; + int ret; int sockfd = SOCKET_INVALID; int connd; struct sockaddr_in servAddr; @@ -186,7 +186,7 @@ int main() * 0 means choose the default protocol. */ if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { fprintf(stderr, "ERROR: failed to create the socket\n"); - ret = -1; + ret = -1; goto exit; } @@ -207,7 +207,7 @@ int main() } /* Load server certificates into WOLFSSL_CTX */ - if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, SSL_FILETYPE_PEM)) + if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", CERT_FILE); @@ -215,7 +215,7 @@ int main() } /* Load server key into WOLFSSL_CTX */ - if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, SSL_FILETYPE_PEM)) + if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", KEY_FILE); @@ -237,14 +237,14 @@ int main() /* Bind the server socket to our port */ if (bind(sockfd, (struct sockaddr*)&servAddr, sizeof(servAddr)) == -1) { fprintf(stderr, "ERROR: failed to bind\n"); - ret = -1; + ret = -1; goto exit; } /* Listen for a new connection, allow 5 pending connections */ if (listen(sockfd, 5) == -1) { fprintf(stderr, "ERROR: failed to listen\n"); - ret = -1; + ret = -1; goto exit; } diff --git a/tls/server-tls-uart.c b/tls/server-tls-uart.c index b52f9841..bacf99f1 100644 --- a/tls/server-tls-uart.c +++ b/tls/server-tls-uart.c @@ -207,16 +207,16 @@ int main(int argc, char** argv) wolfSSL_CTX_SetIORecv(ctx, uartIORx); /* For testing disable peer cert verification */ - wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL); + wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL); /* Set server key and certificate (required) */ - if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, SSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { + if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", CERT_FILE); goto done; } /* Load server key into WOLFSSL_CTX */ - if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, SSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { + if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", KEY_FILE); goto done; } diff --git a/tls/server-tls.c b/tls/server-tls.c index fa79a4d2..a3ab5ad6 100644 --- a/tls/server-tls.c +++ b/tls/server-tls.c @@ -57,8 +57,11 @@ int main() /* declare wolfSSL objects */ WOLFSSL_CTX* ctx = NULL; WOLFSSL* ssl = NULL; + WOLFSSL_CIPHER* cipher; - +#if 0 + wolfSSL_Debugging_ON(); +#endif /* Initialize wolfSSL */ wolfSSL_Init(); @@ -84,7 +87,7 @@ int main() } /* Load server certificates into WOLFSSL_CTX */ - if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, SSL_FILETYPE_PEM)) + if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", CERT_FILE); @@ -92,7 +95,7 @@ int main() } /* Load server key into WOLFSSL_CTX */ - if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, SSL_FILETYPE_PEM)) + if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", KEY_FILE); @@ -114,7 +117,7 @@ int main() /* Bind the server socket to our port */ if (bind(sockfd, (struct sockaddr*)&servAddr, sizeof(servAddr)) == -1) { fprintf(stderr, "ERROR: failed to bind\n"); - ret = -1; + ret = -1; goto exit; } @@ -160,6 +163,8 @@ int main() printf("Client connected successfully\n"); + cipher = wolfSSL_get_current_cipher(ssl); + printf("SSL cipher suite is %s\n", wolfSSL_CIPHER_get_name(cipher)); /* Read the client data into our buff array */