Update the includes to use options.h then ssl.h. Updated and renamed the README.md to indicate that “WOLFSSL_STATIC_PSK” is required when building wolfSSL.
static inline unsigned int My_Psk_Client_Cb(WOLFSSL* ssl, const char* hint,
char* identity, unsigned int id_max_len, unsigned char* key,
char* identity, unsigned int id_max_len, unsigned char* key,
unsigned int key_max_len)
{
(void)ssl;
(void)hint;
(void)key_max_len;
strncpy(identity, "Client_identity", id_max_len);
key[0] = 26;
key[1] = 43;
key[2] = 60;
key[3] = 77;
return 4;
}
## **Adding Non-Blocking to the wolfSSL Simple Client.**
## **Adding Non-Blocking to the wolfSSL Simple Client.**
1. Include the fcntl.h header file. This is needed for some of the constants that will be used when dealing with non-blocking on the socket. `` #include<fcntl.h>``
1. Include the fcntl.h header file. This is needed for some of the constants that will be used when dealing with non-blocking on the socket. `` #include<fcntl.h>``
2. After the function ``wolfSSL_set_fd(ssl,sockfd)``, tell wolfSSL that you want non-blocking to be used. This is done by adding : `` wolfSSL_set_using_nonblock(ssl,1);``
3. Now we much invoke the fcnt callable serve to use non-blocking.
3. Now we much invoke the fcnt callable serve to use non-blocking.
int flags = fcntl(sockfd, F_GETFL, 0);
if (flags <0){
@ -95,7 +95,7 @@ TCP/PSK Tutorial
printf("fcntl set failed\n");
return 1;
}
4. Now we are ready to call the function to start non-blocking on our socket. This is done by adding:
4. Now we are ready to call the function to start non-blocking on our socket. This is done by adding:
ret = NonBlockingSSL_Connect(ssl);
@ -103,7 +103,7 @@ TCP/PSK Tutorial
return 1;
}
5. Now we need to add the non-blocking function.
5. Now we need to add the non-blocking function.
**Add the tcp_select function**
@ -145,7 +145,7 @@ TCP/PSK Tutorial
static int NonBlockingSSL_Connect(WOLFSSL* ssl)
{
int ret, error, sockfd, select_ret, currTimeout;
ret = wolfSSL_connect(ssl);
error = wolfSSL_get_error(ssl, 0);
sockfd = (int)wolfSSL_get_fd(ssl);
@ -182,16 +182,16 @@ TCP/PSK Tutorial
## **Adding Session Resumption to Simple Client**
Session resumption allows a client/server pair to re-use previously generated crypto material, so that they don't have to compute new crypto keys every time a connection gets established.
Session resumption allows a client/server pair to re-use previously generated crypto material, so that they don't have to compute new crypto keys every time a connection gets established.
1. After sending a string to the server we need to save the session ID so it can be used again for the next connection.
1. After sending a string to the server we need to save the session ID so it can be used again for the next connection.
@ -268,18 +268,18 @@ Session resumption allows a client/server pair to re-use previously generated cr
``wolfSSL_Init()``
5. Create a ctx pointer that contains using the following process.
```
```
WOLFSSL_CTX* ctx;
if ((ctx = wolfSSL_CTX_new(wolfSSLv23_server_method())) == NULL)
err_sys(“wolfSSL_CTX_new error”);
```
6. In the servers main loop for accepting clients create a WOLFSSL pointer. Once a new client is accepted create a wolfSSL object and associate that object with the socket that the client is on. After using the wolfSSL object it should be freed and also before closing the program the ctx pointer should be freed and a wolfSSL cleanup method called.
```
WOLFSSL* ssl;
wolfSSL_set_fd(ssl, “integer returned from accept”);
wolfSSL_free(ssl);
@ -288,7 +288,7 @@ Session resumption allows a client/server pair to re-use previously generated cr
wolfSSL_Cleanup();
```
## Now adding Pre-Shared Keys (PSK) to the wolfSSL Simple Server:
The following steps are on how to use PSK in a wolfSSL server
@ -307,13 +307,13 @@ The following steps are on how to use PSK in a wolfSSL server
>PSK-AES128-CBC-SHA256 creates the cipher list of having pre shared keys with advanced encryption security using 128 bit key
>PSK-AES128-CBC-SHA256 creates the cipher list of having pre shared keys with advanced encryption security using 128 bit key
>with cipher block chaining using secure hash algorithm.
3. Add the my_psk_server_cb function as follows. This is a function needed that is passed in as an argument to the wolfSSL callback.
```
static inline unsigned int my_psk_client_cb(WOLFSSL* ssl, char* identity, unsigned
static inline unsigned int my_psk_client_cb(WOLFSSL* ssl, char* identity, unsigned
char* key, unsigned int key_max_len) {
(void)ssl;
(void)key_max_len;
@ -332,9 +332,9 @@ The following steps are on how to use PSK in a wolfSSL server
}
```
Example Makefile for Simple wolfSSL PSK Client:
```
CC=gcc
OBJ = client-psk.o
@ -344,20 +344,20 @@ Example Makefile for Simple wolfSSL PSK Client:
$(CC) -c -o $@ $< $(CFLAGS)
client-psk: client-psk.c
$(CC) -Wall -o client-psk client-psk.c -lwolfssl
$(CC) -Wall -o client-psk client-psk.c -lwolfssl
.PHONY: clean
clean:
clean:
rm -f *.o client-psk
```
The -lwolfssl will link the wolfSSL Libraries to your program
The -lwolfssl will link the wolfSSL Libraries to your program
The makefile for the server is going to be similar to that of the client. If the user wants separate makefiles just make a use the same set up of the client makefile and replace every instance of client-psk with server-psk. To combine make files just add a server-psk with similar ending to each time client-psk is referenced and change the target. There will also need to be a target for when compiling all targets.
```
```
all: server-psk client-psk
server-psk: server-psk.c
@ -380,7 +380,7 @@ When a socket is setup as non-blocking, reads and writes to the socket do not ca
3. Now we much invoke the fcntl callable serve to use nonblocking. This is done by adding:
```
/* invokes the fcntl callable service to get the file status
/* invokes the fcntl callable service to get the file status
* flags for a file. checks if it returns an error, if it does
* stop program */
int flags = fcntl(sockfd, F_GETFL, 0);
@ -390,8 +390,8 @@ When a socket is setup as non-blocking, reads and writes to the socket do not ca
}
/* invokes the fcntl callable service set file status flags.
* Do not block an open, a read, or a write on the file
* (do not wait for terminal input. If an error occurs,
* Do not block an open, a read, or a write on the file
* (do not wait for terminal input. If an error occurs,
@ -415,7 +415,7 @@ When a socket is setup as non-blocking, reads and writes to the socket do not ca
```
/*
* enum used for tcp_select function
* enum used for tcp_select function
*/
enum {
TEST_SELECT_FAIL,
@ -500,21 +500,21 @@ Nonblocking on the server side allows for switching between multiple client conn
1. Include the fcntl.h header file. This is needed for some of the constants that will be used when dealing with non blocking on the socket.
``#include <fcntl.h>``
2. After accept has found a client and an ssl object has been made and associated with the clients socket then call the wolfSSL function to set wolfSSL in non blocking mode. This is done using the following function call.
``wolfSSL_set_using_nonblock(ssl, 1);``
3. Immediately after setting wolfSSL to use non blocking, the socket that the client is connected on needs to also be set up to be non blocking. This is done using the included fcntl.h and making the following function call.
``fcntl(*sockfd, F_SETFL, O_NONBLOCK);``
>Both F_SETFL and O_NONBLOCK are constants from the fcntl.h file.
4. Include a function to select tcp. What this function does is it checks file descriptors for readiness of reading, writing, for pending exceptions, and for timeout. The timeout variable needs to point to struct timeval type. If the timeval members are 0 then the function does not block. The function and its input parameters are listed below.
>For the example server we do not consider write when selecting the tcp so it is set to NULL. For ease the example code uses enumerated values for which state the function select returns. This then makes the next loop discussed easier.
5. Next is to add a loop for handling when to read and write. This loop uses the select tcp function to continually check on the status of the tcp connection and when it is ready or has an exception the wolfSSL_accept function is called.
6. The final thing added is a loop around wolfSSL_read. This is done so that when encountering the error SSL_ERROR_WANT_READ the server gives the client some time to send the message.
@ -534,7 +534,7 @@ Nonblocking on the server side allows for switching between multiple client conn
```
## Concurrent Server
@ -564,16 +564,16 @@ The main thread accepts clients and for each client accepted a new thread is spa
int n; /* length of string read */
char buf[MAXLINE]; /* string read from client */
char response[22] = "I hear ya for shizzle";
/* create WOLFSSL object and respond */
if ((ssl = wolfSSL_new(ctx)) == NULL)
err_sys("wolfSSL_new error");
wolfSSL_set_fd(ssl, connfd);
/* respond to client */
n = wolfSSL_read(ssl, buf, MAXLINE);
if (n > 0) {
printf("%s\n", buf);
wolfSSL_set_fd(ssl, connfd);
/* respond to client */
n = wolfSSL_read(ssl, buf, MAXLINE);
if (n > 0) {
printf("%s\n", buf);
if (wolfSSL_write(ssl, response, 22) > 22) {
err_sys("respond: write error");
}
@ -581,14 +581,14 @@ The main thread accepts clients and for each client accepted a new thread is spa
if (n <0){
err_sys("respond: read error");
}
/* closes the connections after responding */
wolfSSL_shutdown(ssl);
wolfSSL_free(ssl);
if (close(connfd) == -1)
wolfSSL_free(ssl);
if (close(connfd) == -1)
err_sys("close error");
pthread_exit( NULL);
}
```
5. Void* arg is the argument that gets passed into wolfssal_thread when pthread_create is called. In this example that argument is used to pass the socket value that the client for the current thread is on.
David Garske