WolfSSL
/
wolfssl-examples
mirror of https://github.com/wolfSSL/wolfssl-examples.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #340 from JacobBarthelmeh/pkcs12 

adding use of devid to pkcs12 example
pull/363/head
David Garske 2023-01-09 16:13:23 -08:00 committed by GitHub
parent af315f9c65 401d467506
commit a363898fbc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 333 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
certgen/Makefile
View File

@ -29,11 +29,14 @@ CFLAGS+=$(OPTIMIZE)
#LIBS+=$(STATIC_LIB)
LIBS+=$(DYN_LIB)
all:certgen_example csr_example csr_w_ed25519_example csr_sign csr_cryptocb custom_ext custom_ext_callback
all:certgen_example certgen_ca_example csr_example csr_w_ed25519_example csr_sign csr_cryptocb custom_ext custom_ext_callback
certgen_example:certgen_example.o
$(CC) -o $@ $^ $(CFLAGS) $(CPPFLAGS) $(LIBS)
certgen_ca_example:certgen_ca_example.o
$(CC) -o $@ $^ $(CFLAGS) $(CPPFLAGS) $(LIBS)
csr_example:csr_example.o
$(CC) -o $@ $^ $(CFLAGS) $(CPPFLAGS) $(LIBS)
@ -55,5 +58,5 @@ custom_ext_callback:custom_ext_callback.o
.PHONY: clean all
clean:
rm -f *.o certgen_example csr_example csr_w_ed25519_example csr_sign csr_cryptocb custom_ext custom_ext_callback
rm -f *.o certgen_example certgen_ca_example csr_example csr_w_ed25519_example csr_sign csr_cryptocb custom_ext custom_ext_callback
rm -f newCert.*

241
certgen/certgen_ca_example.c 100644
View File

@ -0,0 +1,241 @@
/* certgen_ca_example.c
*
* Copyright (C) 2006-2021 wolfSSL Inc.
*
* This file is part of wolfSSL.
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
*/
#include <stdio.h>
#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/settings.h>
#include <wolfssl/wolfcrypt/rsa.h>
#include <wolfssl/wolfcrypt/asn_public.h>
#include <wolfssl/wolfcrypt/asn.h>
#include <wolfssl/wolfcrypt/error-crypt.h>
#include <wolfssl/wolfcrypt/wc_port.h>
#ifdef WOLFSSL_CAAM
#include <wolfssl/wolfcrypt/port/caam/wolfcaam.h>
#endif
#if defined(WOLFSSL_CERT_REQ) && defined(WOLFSSL_CERT_GEN) && \
defined(WOLFSSL_KEY_GEN) && defined(HAVE_ECC)
#define HEAP_HINT NULL
#define LARGE_TEMP_SZ 4096
static int devId = WOLFSSL_CAAM_DEVID;
static int do_cagen(int argc, char** argv)
{
int ret = 0;
Cert newCert;
FILE* file;
int derBufSz;
int caKeySz = 4096;
byte* derBuf = NULL;
byte* pemBuf = NULL;
/* for MakeCert and SignCert */
WC_RNG rng;
RsaKey newKey;
int initRng = 0, initNewKey = 0;
char newCertOutput[] = "./ca-rsa-cert.der";
char newKeyOutput[] = "./ca-rsa-key.der";
#ifdef WOLFSSL_DER_TO_PEM
char pemOutput[] = "./ca-rsa-cert.pem";
char pemKeyOutput[] = "./ca-rsa-key.pem";
int pemBufSz;
#endif
ret = wolfCrypt_Init();
if (ret != 0) goto exit;
ret = wc_InitRng(&rng);
if (ret != 0) goto exit;
initRng = 1;
printf("Creating the CA RSA private key of size %d\n", caKeySz);
ret = wc_InitRsaKey_ex(&newKey, HEAP_HINT, devId);
if (ret != 0) goto exit;
initNewKey = 1;
ret = wc_MakeRsaKey(&newKey, caKeySz, WC_RSA_EXPONENT, &rng);
if (ret != 0) goto exit;
#ifdef WOLFSSL_CAAM
printf("Black key value = %u\n", newKey.blackKey);
#endif
printf("Successfully created CA Key\n\n");
derBuf = (byte*)XMALLOC(LARGE_TEMP_SZ, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
if (derBuf == NULL) goto exit;
/*------------------------------------------------------------------------*/
/* write the new key to file in der format */
/*------------------------------------------------------------------------*/
printf("Writing newly generated DER key to file \"%s\"\n",
newKeyOutput);
file = fopen(newKeyOutput, "wb");
if (!file) {
printf("failed to open file: %s\n", newKeyOutput);
goto exit;
}
ret = wc_RsaKeyToDer(&newKey, derBuf, LARGE_TEMP_SZ);
if (ret < 0) {
goto exit;
}
derBufSz = ret;
ret = (int)fwrite(derBuf, 1, derBufSz, file);
fclose(file);
printf("Successfully output %d bytes\n", ret);
#ifdef WOLFSSL_DER_TO_PEM
/*------------------------------------------------------------------------*/
/* convert the der to a pem and write it to a file */
/*------------------------------------------------------------------------*/
printf("Convert the DER key to PEM formatted key\n");
pemBuf = (byte*)XMALLOC(LARGE_TEMP_SZ, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
if (pemBuf == NULL) goto exit;
XMEMSET(pemBuf, 0, LARGE_TEMP_SZ);
pemBufSz = wc_DerToPem(derBuf, derBufSz, pemBuf, LARGE_TEMP_SZ, PRIVATEKEY_TYPE);
if (pemBufSz < 0) goto exit;
printf("Resulting PEM buffer is %d bytes\n", pemBufSz);
file = fopen(pemKeyOutput, "wb");
if (!file) {
printf("failed to open file: %s\n", pemKeyOutput);
goto exit;
}
fwrite(pemBuf, 1, pemBufSz, file);
fclose(file);
printf("Successfully converted the DER to PEM to \"%s\"\n\n",
pemKeyOutput);
XFREE(pemBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
pemBuf = NULL;
#endif
/*------------------------------------------------------------------------*/
/* Create a new certificate using SUBJECT information from ca cert
* for ISSUER information in generated cert */
/*------------------------------------------------------------------------*/
printf("Setting up new cert\n");
wc_InitCert(&newCert);
strncpy(newCert.subject.country, "US", CTC_NAME_SIZE);
strncpy(newCert.subject.state, "MT", CTC_NAME_SIZE);
strncpy(newCert.subject.locality, "Bozeman", CTC_NAME_SIZE);
strncpy(newCert.subject.org, "yourOrgNameHere", CTC_NAME_SIZE);
strncpy(newCert.subject.unit, "yourUnitNameHere", CTC_NAME_SIZE);
strncpy(newCert.subject.commonName, "www.yourDomain.com", CTC_NAME_SIZE);
strncpy(newCert.subject.email, "yourEmail@yourDomain.com", CTC_NAME_SIZE);
newCert.isCA = 1;
newCert.sigType = CTC_SHA256wRSA;
ret = wc_MakeSelfCert(&newCert, derBuf, LARGE_TEMP_SZ, &newKey, &rng);
if (ret < 0) goto exit;
printf("Make Self Cert returned %d\n", ret);
derBufSz = ret;
printf("Successfully created new ca certificate\n\n");
/*------------------------------------------------------------------------*/
/* write the new cert to file in der format */
/*------------------------------------------------------------------------*/
printf("Writing newly generated DER certificate to file \"%s\"\n",
newCertOutput);
file = fopen(newCertOutput, "wb");
if (!file) {
printf("failed to open file: %s\n", newCertOutput);
goto exit;
}
ret = (int)fwrite(derBuf, 1, derBufSz, file);
fclose(file);
printf("Successfully output %d bytes\n", ret);
#ifdef WOLFSSL_DER_TO_PEM
/*------------------------------------------------------------------------*/
/* convert the der to a pem and write it to a file */
/*------------------------------------------------------------------------*/
printf("Convert the DER cert to PEM formatted cert\n");
pemBuf = (byte*)XMALLOC(LARGE_TEMP_SZ, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
if (pemBuf == NULL) goto exit;
XMEMSET(pemBuf, 0, LARGE_TEMP_SZ);
pemBufSz = wc_DerToPem(derBuf, derBufSz, pemBuf, LARGE_TEMP_SZ, CERT_TYPE);
if (pemBufSz < 0) goto exit;
printf("Resulting PEM buffer is %d bytes\n", pemBufSz);
file = fopen(pemOutput, "wb");
if (!file) {
printf("failed to open file: %s\n", pemOutput);
goto exit;
}
fwrite(pemBuf, 1, pemBufSz, file);
fclose(file);
printf("Successfully converted the DER to PEM to \"%s\"\n\n",
pemOutput);
#endif
ret = 0; /* success */
exit:
XFREE(derBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
XFREE(pemBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
if (initNewKey)
wc_FreeRsaKey(&newKey);
if (initRng) {
wc_FreeRng(&rng);
}
if (ret == 0)
printf("Tests passed\n");
else
printf("Failure code was %d\n", ret);
wolfCrypt_Cleanup();
return ret;
}
#endif
int main(int argc, char** argv)
{
#if !defined(WOLFSSL_CERT_REQ) || !defined(WOLFSSL_CERT_GEN) || \
!defined(WOLFSSL_KEY_GEN) || defined(NO_RSA)
printf("Please compile wolfSSL with --enable-certreq --enable-certgen "
"--enable-keygen --enable-rsa\n");
return 0;
#else
return do_cagen(argc, argv);
#endif
}

75
crypto/pkcs12/pkcs12-create-example.c
View File

@ -19,15 +19,24 @@
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
*/
#include <stdio.h>
#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/logging.h>
#include <wolfssl/wolfcrypt/pkcs12.h>
#include <wolfssl/wolfcrypt/asn.h>
#include <wolfssl/wolfcrypt/rsa.h>
#include <wolfssl/wolfcrypt/error-crypt.h>
#include <wolfssl/wolfcrypt/wc_port.h>
#define WC_RSA_KEYSIZE 2048
#define HEAP_HINT NULL
#ifndef CA_CERT
#define CA_CERT "../../certs/ca-cert.der"
#endif
#ifndef CA_KEY
#define CA_KEY "../../certs/ca-key.der"
#endif
static int devId = INVALID_DEVID; /* set to alternate dev id if wanted */
#if defined(HAVE_PKCS12) && defined(WOLFSSL_KEY_GEN) && \
defined(WOLFSSL_CERT_GEN) && !defined(NO_RSA)
@ -38,9 +47,9 @@ static int createKey(byte** keyDer, word32* keySz, RsaKey* key, WC_RNG* rng)
*keyDer = NULL;
*keySz = 0;
ret = wc_InitRsaKey(key, HEAP_HINT);
ret = wc_InitRsaKey_ex(key, HEAP_HINT, devId);
if (ret == 0) {
ret = wc_InitRng(rng);
ret = wc_InitRng_ex(rng, HEAP_HINT, devId);
}
if (ret == 0) {
@ -125,11 +134,38 @@ static int readFile(byte** out, word32* outSz, char* fileName)
}
static int loadKey(byte** keyDer, word32* keySz, RsaKey* key, const char* f)
{
int ret;
*keyDer = NULL;
*keySz = 0;
ret = wc_InitRsaKey_ex(key, HEAP_HINT, devId);
if (ret == 0) {
ret = readFile(keyDer, keySz, (char*)f);
}
if (ret == 0) {
word32 idx = 0;
ret = wc_RsaPrivateKeyDecode(*keyDer, &idx, key, *keySz);
printf("return from loading in private key = %d\n", ret);
}
if (*keySz < 0) {
printf("unable to decode private key\n");
ret = *keySz;
}
return ret;
}
static int getCa(byte** caCert, word32* caCertSz, RsaKey* caKey)
{
int ret;
char caCertFile[] = "../../certs/ca-cert.der";
char caKeyFile[] = "../../certs/ca-key.der";
char caCertFile[] = CA_CERT;
char caKeyFile[] = CA_KEY;
byte* caKeyDer = NULL;
word32 caKeyDerSz;
@ -138,11 +174,10 @@ static int getCa(byte** caCert, word32* caCertSz, RsaKey* caKey)
*caCert = NULL;
*caCertSz = 0;
printf("Getting the caKey from %s\n", caKeyFile);
ret = readFile(&caKeyDer, &caKeyDerSz, caKeyFile);
if (ret == 0) {
ret = wc_InitRsaKey(caKey, HEAP_HINT);
ret = wc_InitRsaKey_ex(caKey, HEAP_HINT, devId);
}
if (ret == 0) {
@ -233,11 +268,28 @@ int main(int argc, char* argv[])
byte* certDer = NULL;
word32 certSz;
if (createKey(&keyDer, &keySz, &rsa, &rng) != 0) {
printf("Unable to create RSA key\n");
if (wolfCrypt_Init() != 0) {
printf("issue with wolfCrypt_Init()\n");
return -1;
}
if (argc == 2) {
if (loadKey(&keyDer, &keySz, &rsa, argv[1]) != 0) {
printf("Unable to create RSA key\n");
return -1;
}
else {
printf("loaded in key %s\n", argv[1]);
wc_InitRng_ex(&rng, HEAP_HINT, devId);
}
}
else {
if (createKey(&keyDer, &keySz, &rsa, &rng) != 0) {
printf("Unable to create RSA key\n");
return -1;
}
}
if (createCert(&certDer, &certSz, &rsa, &rng) != 0) {
printf("Unable to create certificate\n");
wc_FreeRsaKey(&rsa);
@ -246,7 +298,7 @@ int main(int argc, char* argv[])
return -1;
}
pkcs12 = wc_PKCS12_create("test password", strlen("test password"),
pkcs12 = wc_PKCS12_create("wolfSSL test", strlen("wolfSSL test"),
NULL, keyDer, keySz, certDer, certSz,
NULL, PBE_SHA1_DES3, PBE_SHA1_DES3, 100, 100, 0, HEAP_HINT);
@ -267,11 +319,16 @@ int main(int argc, char* argv[])
}
wc_PKCS12_free(pkcs12);
}
else {
printf("Issue creating new PKCS12 structure\n");
}
wc_FreeRsaKey(&rsa);
wc_FreeRng(&rng);
XFREE(keyDer, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
XFREE(certDer, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
wolfCrypt_Cleanup();
#else
printf("pkcs12-create-key requires wolfssl to be built with:\n");
printf("\t./configure --enable-pkcs12 --enable-pwdbased --enable-des3 --enable-keygen --enable-certgen\n");

26
crypto/pkcs12/pkcs12-example.c
View File

@ -20,13 +20,15 @@
*/
#include <stdio.h>
#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/pkcs12.h>
#include <wolfssl/wolfcrypt/types.h>
#include <wolfssl/wolfcrypt/wc_port.h>
/* This is an example with using wc_ function for PKCS12. To see an example of
* wolfSSL_PKCS12 functions look in tests/api.c */
int main()
int main(int argc, char** argv)
{
#if defined(HAVE_PKCS12) && !defined(NO_RSA)
WC_DerCertList* list;
@ -37,10 +39,16 @@ int main()
word32 certSz;
word32 i;
byte buffer[5300];
char file[] = "./test-servercert.p12";
char *file;
char defaultFile[] = "./test-servercert.p12";
FILE *f;
int bytes, ret;
if (wolfCrypt_Init() != 0) {
printf("issue with wolfCrypt_Init()\n");
return -1;
}
printf("extracting private key and certificate from PKCS12 (test-servercert.p12)\n");
pkcs12 = wc_PKCS12_new();
@ -49,10 +57,17 @@ int main()
return -1;
}
if (argc == 2) {
file = argv[1];
}
else {
file = defaultFile;
}
/* open PKCS12 file */
f = fopen(file, "rb");
if (f == NULL) {
printf("error opening test-servercert.p12\n");
printf("error opening file %s\n", file);
wc_PKCS12_free(pkcs12);
return -1;
}
@ -61,7 +76,7 @@ int main()
/* convert the DER file into an internal structure */
ret = wc_d2i_PKCS12(buffer, bytes, pkcs12);
printf("return value of d2i pkcs12 = %d %s\n", ret, (ret == 1)? "SUCCESS": "FAIL");
printf("return value of d2i pkcs12 = %d %s\n", ret, (ret == 0)? "SUCCESS": "FAIL");
if (ret != 0) {
printf("\t error converting pkcs12 to an internal structure\n");
wc_PKCS12_free(pkcs12);
@ -71,7 +86,7 @@ int main()
/* parse the internal structure into its parts */
ret = wc_PKCS12_parse(pkcs12, "wolfSSL test", &keyDer, &keySz,
&certDer, &certSz, &list);
printf("return value of parsing pkcs12 = %d %s\n", ret, (ret == 1)? "SUCCESS": "FAIL");
printf("return value of parsing pkcs12 = %d %s\n", ret, (ret == 0)? "SUCCESS": "FAIL");
if (ret != 0 || keyDer == NULL || certDer == NULL) {
printf("\t error parsing pkcs12\n");
wc_PKCS12_free(pkcs12);
@ -116,6 +131,7 @@ int main()
}
wc_PKCS12_free(pkcs12);
wolfCrypt_Cleanup();
#else
printf("pkcs12-example requires wolfssl to be built with:\n");
printf("\t./configure --enable-pkcs12 --enable-pwdbased --enable-des3\n");