F-1296 F-2112 F-2893 F-2900 F-3899 F-4121 F-4127: Fix error handling in TLS, DTLS, and protocol examples

TOPPERS/WolfSSLDemo/src/wolfDemo/wolf_client.c

@@ -149,7 +149,7 @@ int wolfSSL_TLS_client(void *v_ctx, func_args *args)
     }
 
     if ((ssl = wolfSSL_new(ctx)) == NULL) {
-        printf("ERROR wolfSSL_new: %d\n", wolfSSL_get_error(ssl, 0));
+        printf("ERROR wolfSSL_new failed\n");
         ret = -1;
         goto exit_;
     }

btle/ecies/ecc-client.c

@@ -142,6 +142,7 @@ int main(int argc, char** argv)
         ret = btle_recv(peerSalt, EXCHANGE_SALT_SZ, &type, devCtx);
         if (ret <= 0) {
             printf("btle_recv failed %d!\n", ret);
+            goto cleanup;
         }
         if (type != BTLE_PKT_TYPE_SALT) {
             printf("btle_recv expected salt!\n");

crypto/aes/aesgcm-file-encrypt.c

@@ -475,7 +475,6 @@ int decrypt_file_AesGCM(const char *in_file, const char *out_file,
              * remove the partially written output file. */
             fprintf(stderr,
                 "Authentication failed, removing unverified output file\n");
-            unlink(out_file);
         }
     }
 exit:
@@ -497,6 +496,10 @@ exit:
         unlink(out_file);
     }
 
+    if (ret != 0) {
+        unlink(out_file);
+    }
+
     printf("File decryption with AES GCM complete.\n");
     return ret;
 }
@@ -760,7 +763,8 @@ int decrypt_file(const char *in_file, const char *out_file, const char *key_str)
         goto exit;
     }
     if (EVP_DecryptFinal_ex(ctx, out_buf, &out_len) != WOLFSSL_SUCCESS) {
-        perror("EVP_DecryptFinal_ex");
+        fprintf(stderr,
+            "Authentication failed, removing unverified output file\n");
         ret = AES_GCM_AUTH_E;
         goto exit;
     }
@@ -773,11 +777,10 @@ int decrypt_file(const char *in_file, const char *out_file, const char *key_str)
     if (ret == WOLFSSL_SUCCESS) {
         ret = EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG,
                                   AES_IV_SIZE, tag_dec);
-        if (ret == WOLFSSL_SUCCESS &&
+        if (ret != WOLFSSL_SUCCESS ||
             (memcmp(tag_enc, tag_dec, AESGCM_TAG_SIZE) != 0)) {
-            perror("TAG didn't match\n");
+            fprintf(stderr,
-            /* Authentication failed, unauthenticated plaintext was
+                "Authentication failed, removing unverified output file\n");
-             * already written to out_file above; remove it. */
             ret = AES_GCM_AUTH_E;
             goto exit;
         }
@@ -837,11 +840,11 @@ text.bin", (file_sz/1024)+1, file_sz);
     pclose(pipe);
 
 #ifdef OPENSSL_EXTRA
-    const char *cmd_enc_evp ="./aesgcm-file-encrypt -e 256 -m 1 \
+    const char *cmd_enc_evp ="./aesgcm-file-encrypt -e 256 -m 2 \
                               -k 77CF00EC060192530B5D06B6B426799B \
                               -v 77CF00EC060192530B5D06B6B426799B \
                               -i text.bin -o text2cipher.evp.bin";
-    const char *cmd_dec_evp ="./aesgcm-file-encrypt -d 256 -m 1 \
+    const char *cmd_dec_evp ="./aesgcm-file-encrypt -d 256 -m 2 \
                             -k 77CF00EC060192530B5D06B6B426799B \
                             -i text2cipher.evp.bin -o text2cipher2text.evp.bin";
     const char *cmd_diff_evp = "diff -q text.bin text2cipher2text.evp.bin";

dtls/server-dtls13.c

@@ -152,7 +152,7 @@ int main(int argc, char** argv)
 
         if (wolfSSL_set_fd(ssl, listenfd) != WOLFSSL_SUCCESS) {
             fprintf(stderr, "wolfSSL_set_fd error.\n");
-            break;
+            goto cleanup;
         }
 
         if (wolfSSL_accept(ssl) != WOLFSSL_SUCCESS) {

psk/server-psk.c

@@ -198,8 +198,8 @@ int main()
             if (n > 0) {
                 printf("%s\n", buf);
                 /* server response */
-                if (wolfSSL_write(ssl, response, strlen(response)) >
+                n = wolfSSL_write(ssl, response, strlen(response));
-                    strlen(response)) {
+                if (n != (int)strlen(response)) {
                     printf("Fatal error : respond: write error\n");
                     return 1;
                 }

tls-options/client-tls-cipher.c

@@ -96,9 +96,8 @@ int main(int argc, char** argv)
      * Sets the socket to be stream based (TCP),
      * 0 means choose the default protocol. */
     if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
+        printf("ERROR: failed to create socket\n");
         ret = -1;
-        err = wolfSSL_get_error(ssl, ret);
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto end;
     }
 
@@ -111,17 +110,15 @@ int main(int argc, char** argv)
 
     /* Get the server IPv4 address from the command line call */
     if (inet_pton(AF_INET, argv[1], &servAddr.sin_addr) != 1) {
+        printf("ERROR: invalid address\n");
         ret = -1;
-        err = wolfSSL_get_error(ssl, ret);
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto end;
     }
 
     /* Connect to the server */
     if ((ret = connect(sockfd, (struct sockaddr*) &servAddr, sizeof(servAddr)))
          == -1) {
-        err = wolfSSL_get_error(ssl, ret);
+        printf("ERROR: failed to connect\n");
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto end;
     }
 
@@ -130,24 +127,22 @@ int main(int argc, char** argv)
     /*---------------------------------*/
     /* Initialize wolfSSL */
     if ((ret = wolfSSL_Init()) != WOLFSSL_SUCCESS) {
-        err = wolfSSL_get_error(ssl, ret);
+        printf("ERROR: failed to initialize the library\n");
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto socket_cleanup;
     }
 
     /* Create and initialize WOLFSSL_CTX */
     if ((ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method())) == NULL) {
+        printf("ERROR: failed to create WOLFSSL_CTX\n");
         ret = -1;
-        err = wolfSSL_get_error(ssl, ret);
+        goto ctx_cleanup;
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
-        goto socket_cleanup;
     }
 
     /* Set cipher suite */
     if (cipherList != NULL) {
         if (wolfSSL_CTX_set_cipher_list(ctx, cipherList) != WOLFSSL_SUCCESS) {
-            err = wolfSSL_get_error(ssl, ret);
+            printf("ERROR: failed to set cipher list: %s\n", cipherList);
-            printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
+            ret = -1;
             goto ctx_cleanup;
         }
     }
@@ -155,16 +150,14 @@ int main(int argc, char** argv)
     /* Load client certificates into WOLFSSL_CTX */
     if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CERT_FILE, NULL))
          != SSL_SUCCESS) {
-        err = wolfSSL_get_error(ssl, ret);
+        printf("ERROR %d: failed to load %s\n", ret, CERT_FILE);
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto ctx_cleanup;
     }
 
     /* Create a WOLFSSL object */
     if ((ssl = wolfSSL_new(ctx)) == NULL) {
         ret = -1;
-        err = wolfSSL_get_error(ssl, ret);
+        printf("ERROR: failed to create WOLFSSL object\n");
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto ctx_cleanup;
     }
 
@@ -190,9 +183,8 @@ int main(int argc, char** argv)
     printf("Message for server: ");
     memset(buff, 0, sizeof(buff));
     if (fgets(buff, sizeof(buff), stdin) == NULL) {
+        printf("ERROR: failed to get message for server\n");
         ret = -1;
-        err = wolfSSL_get_error(ssl, ret);
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto cleanup;
     }
     len = strnlen(buff, sizeof(buff));
@@ -228,6 +220,7 @@ int main(int argc, char** argv)
 cleanup:
     wolfSSL_free(ssl);      /* Free the wolfSSL object                  */
 ctx_cleanup:
+    if (ctx)
         wolfSSL_CTX_free(ctx);  /* Free the wolfSSL context object      */
     wolfSSL_Cleanup();      /* Cleanup the wolfSSL environment          */
 socket_cleanup:

tls-options/server-tls-cipher.c

@@ -109,9 +109,8 @@ int main(int argc, char **argv)
      * Sets the socket to be stream based (TCP),
      * 0 means choose the default protocol. */
     if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
+        printf("ERROR: failed to create socket\n");
         ret = -1;
-        err = wolfSSL_get_error(ssl, ret);
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto exit;
     }
 
@@ -119,18 +118,16 @@ int main(int argc, char **argv)
 
     /* Create and initialize WOLFSSL_CTX */
     if ((ctx = wolfSSL_CTX_new(wolfTLSv1_2_server_method())) == NULL) {
+        printf("ERROR: failed to create CTX\n");
         ret = -1;
-        err = wolfSSL_get_error(ssl, ret);
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto exit;
     }
 
     /* Set cipher suite */
     if (cipherList != NULL) {
         if (wolfSSL_CTX_set_cipher_list(ctx, cipherList) != WOLFSSL_SUCCESS) {
+            printf("ERROR: failed to set cipher list: %s\n", cipherList);
             ret = -1;
-            err = wolfSSL_get_error(ssl, ret);
-            printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
             goto exit;
         }
     }
@@ -138,16 +135,14 @@ int main(int argc, char **argv)
     /* Load server certificates into WOLFSSL_CTX */
     if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, SSL_FILETYPE_PEM))
         != WOLFSSL_SUCCESS) {
-        err = wolfSSL_get_error(ssl, ret);
+        printf("ERROR %d: failed to use certificate file %s\n", ret, CERT_FILE);
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto exit;
     }
 
     /* Load server key into WOLFSSL_CTX */
     if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, SSL_FILETYPE_PEM))
         != WOLFSSL_SUCCESS) {
-        err = wolfSSL_get_error(ssl, ret);
+        printf("ERROR %d: failed to use private key file %s\n", ret, KEY_FILE);
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto exit;
     }
 
@@ -165,17 +160,15 @@ int main(int argc, char **argv)
 
     /* Bind the server socket to our port */
     if (bind(sockfd, (struct sockaddr*)&servAddr, sizeof(servAddr)) == -1) {
+        printf("ERROR: failed to bind socket\n");
         ret = -1;
-        err = wolfSSL_get_error(ssl, ret);
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto exit;
     }
 
     /* Listen for a new connection, allow 5 pending connections */
     if (listen(sockfd, 5) == -1) {
+        printf("ERROR: failed to listen on socket\n");
         ret = -1;
-        err = wolfSSL_get_error(ssl, ret);
-        printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
         goto exit;
     }
 
@@ -188,17 +181,15 @@ int main(int argc, char **argv)
         /* Accept client connections */
         if ((connd = accept(sockfd, (struct sockaddr*)&clientAddr, &size))
             == -1) {
+            printf("ERROR: failed to accept connection\n");
             ret = -1;
-            err = wolfSSL_get_error(ssl, ret);
-            printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
             goto exit;
         }
 
         /* Create a WOLFSSL object */
         if ((ssl = wolfSSL_new(ctx)) == NULL) {
             ret = -1;
-            err = wolfSSL_get_error(ssl, ret);
+            printf("ERROR: failed to create WOLFSSL object\n");
-            printf("error = %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer));
             goto exit;
         }
 

tls/client-tls.c

@@ -108,7 +108,7 @@ int main(int argc, char** argv)
     if (ctx == NULL) {
         fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n");
         ret = -1;
-        goto socket_cleanup;
+        goto ctx_cleanup;
     }
 
     /* Load client certificates into WOLFSSL_CTX */
@@ -178,6 +178,7 @@ int main(int argc, char** argv)
 cleanup:
     wolfSSL_free(ssl);      /* Free the wolfSSL object                  */
 ctx_cleanup:
+    if (ctx)
         wolfSSL_CTX_free(ctx);  /* Free the wolfSSL context object      */
     wolfSSL_Cleanup();      /* Cleanup the wolfSSL environment          */
 socket_cleanup: