diff --git a/pkcs11/client-tls-pkcs11-ecc.c b/pkcs11/client-tls-pkcs11-ecc.c deleted file mode 100644 index afa67aa7..00000000 --- a/pkcs11/client-tls-pkcs11-ecc.c +++ /dev/null @@ -1,245 +0,0 @@ -/* client-tls-pkcs11.c - * - * Copyright (C) 2006-2020 wolfSSL Inc. - * - * This file is part of wolfSSL. (formerly known as CyaSSL) - * - * wolfSSL is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * wolfSSL is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA - */ - -/* the usual suspects */ -#include -#include -#include - -/* socket includes */ -#include -#include -#include -#include - -/* wolfSSL */ -#include -#include -#include - -#define DEFAULT_PORT 11111 - -#define CA_FILE "../certs/ca-ecc-cert.pem" - -int client_tls(int devId, Pkcs11Token* token) -{ - int sockfd; - struct sockaddr_in servAddr; - socklen_t size = sizeof(servAddr); - char buff[256]; - size_t len; - int shutdown = 0; - int ret; - - /* declare wolfSSL objects */ - WOLFSSL_CTX* ctx = NULL; - WOLFSSL* ssl = NULL; - WOLFSSL_CIPHER* cipher; - - /* Initialize wolfSSL */ - wolfSSL_Init(); - - /* Create a socket that uses an internet IPv4 address, - * Sets the socket to be stream based (TCP), - * 0 means choose the default protocol. */ - if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { - fprintf(stderr, "ERROR: failed to create the socket\n"); - return -1; - } - - /* Initialize the server address struct with zeros */ - memset(&servAddr, 0, sizeof(servAddr)); - - /* Fill in the server address */ - servAddr.sin_family = AF_INET; /* using IPv4 */ - servAddr.sin_port = htons(DEFAULT_PORT); /* on DEFAULT_PORT */ - - /* IPv4 127.0.0.1 */ - if (inet_pton(AF_INET, "127.0.0.1", &servAddr.sin_addr) != 1) { - fprintf(stderr, "ERROR: invalid address\n"); - ret = -1; - goto exit; - } - - /* Connect to the server */ - if ((ret = connect(sockfd, (struct sockaddr*) &servAddr, sizeof(servAddr))) - == -1) { - fprintf(stderr, "ERROR: failed to connect\n"); - goto exit; - } - -#if 0 - wolfSSL_Debugging_ON(); -#endif - - /* Initialize wolfSSL */ - if ((ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method())) == NULL) { - fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); - return -1; - } - - /* Set devId associated with the PKCS11 device. */ - if (wolfSSL_CTX_SetDevId(ctx, devId) != WOLFSSL_SUCCESS) { - fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); - return -1; - } - - /* Load CA certificate into WOLFSSL_CTX for validating peer */ - if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CA_FILE, NULL)) - != WOLFSSL_SUCCESS) { - fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", - CA_FILE); - goto exit; - } - - /* validate peer certificate */ - wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, NULL); - - /* Open the PKCS11 token. */ - if ((ret = wc_Pkcs11Token_Open(token, 1)) != 0) { - fprintf(stderr, "ERROR: failed to open session on token (%d)\n", ret); - return -1; - } - - /* Create a WOLFSSL object */ - if ((ssl = wolfSSL_new(ctx)) == NULL) { - fprintf(stderr, "ERROR: failed to create WOLFSSL object\n"); - return -1; - } - - /* Attach wolfSSL to the socket */ - if ((ret = wolfSSL_set_fd(ssl, sockfd)) != WOLFSSL_SUCCESS) { - fprintf(stderr, "ERROR: Failed to set the file descriptor\n"); - goto exit; - } - - /* Connect to wolfSSL on the server side */ - if ((ret = wolfSSL_connect(ssl)) != WOLFSSL_SUCCESS) { - fprintf(stderr, "ERROR: failed to connect to wolfSSL\n"); - goto exit; - } - - cipher = wolfSSL_get_current_cipher(ssl); - printf("SSL cipher suite is %s\n", wolfSSL_CIPHER_get_name(cipher)); - - /* Get a message for the server from stdin */ - printf("Message for server: "); - memset(buff, 0, sizeof(buff)); - if (fgets(buff, sizeof(buff), stdin) == NULL) { - fprintf(stderr, "ERROR: failed to get message for server\n"); - ret = -1; - goto exit; - } - len = strnlen(buff, sizeof(buff)); - - /* Send the message to the server */ - if ((ret = wolfSSL_write(ssl, buff, len)) != len) { - fprintf(stderr, "ERROR: failed to write entire message\n"); - fprintf(stderr, "%d bytes of %d bytes were sent", ret, (int) len); - goto exit; - } - - /* Read the server data into our buff array */ - memset(buff, 0, sizeof(buff)); - if ((ret = wolfSSL_read(ssl, buff, sizeof(buff)-1)) == -1) { - fprintf(stderr, "ERROR: failed to read\n"); - goto exit; - } - - /* Print to stdout any data the server sends */ - printf("Server: %s\n", buff); - - ret = 0; /* return success */ - -exit: - /* Cleanup after this connection */ - wolfSSL_free(ssl); - wc_Pkcs11Token_Close(token); - - wolfSSL_CTX_free(ctx); - if (sockfd != SOCKET_INVALID) - close(sockfd); - return ret; -} - -int main(int argc, char* argv[]) -{ - int ret; - const char* library; - const char* slot; - const char* tokenName; - const char* userPin; - Pkcs11Dev dev; - Pkcs11Token token; - int slotId; - int devId = 1; - - if (argc != 4 && argc != 5) { - fprintf(stderr, - "Usage: server_tls_pkcs11 [userpin]\n"); - return 1; - } - - library = argv[1]; - slot = argv[2]; - tokenName = argv[3]; - userPin = (argc == 4) ? NULL : argv[4]; - slotId = atoi(slot); - -#if defined(DEBUG_WOLFSSL) - wolfSSL_Debugging_ON(); -#endif - wolfCrypt_Init(); - - ret = wc_Pkcs11_Initialize(&dev, library, NULL); - if (ret != 0) { - fprintf(stderr, "Failed to initialize PKCS#11 library\n"); - ret = 2; - } - if (ret == 0) { - ret = wc_Pkcs11Token_Init(&token, &dev, slotId, tokenName, - (byte*)userPin, userPin == NULL ? 0 : strlen(userPin)); - if (ret != 0) { - fprintf(stderr, "Failed to initialize PKCS#11 token\n"); - ret = 2; - } - if (ret == 0) { - ret = wc_CryptoDev_RegisterDevice(devId, wc_Pkcs11_CryptoDevCb, - &token); - if (ret != 0) { - fprintf(stderr, "Failed to register PKCS#11 token\n"); - ret = 2; - } - if (ret == 0) { - ret = client_tls(devId, &token); - if (ret != 0) - ret = 1; - } - wc_Pkcs11Token_Final(&token); - } - wc_Pkcs11_Finalize(&dev); - } - - wolfCrypt_Cleanup(); - - return ret; -} - diff --git a/pkcs11/client-tls-pkcs11-rsa.c b/pkcs11/client-tls-pkcs11.c similarity index 92% rename from pkcs11/client-tls-pkcs11-rsa.c rename to pkcs11/client-tls-pkcs11.c index 49baaabe..0d620122 100644 --- a/pkcs11/client-tls-pkcs11-rsa.c +++ b/pkcs11/client-tls-pkcs11.c @@ -31,22 +31,20 @@ #include /* wolfSSL */ +#ifndef WOLFSSL_USER_SETTINGS #include +#endif #include #include #define DEFAULT_PORT 11111 -#define CA_FILE "../certs/ca-cert.pem" - -int client_tls(int devId, Pkcs11Token* token) +int client_tls(const char *cacert, int devId, Pkcs11Token* token) { int sockfd; struct sockaddr_in servAddr; - socklen_t size = sizeof(servAddr); char buff[256]; size_t len; - int shutdown = 0; int ret; /* declare wolfSSL objects */ @@ -103,7 +101,7 @@ int client_tls(int devId, Pkcs11Token* token) } /* Load CA certificate into WOLFSSL_CTX for validating peer */ - if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CA_FILE, NULL)) + if ((ret = wolfSSL_CTX_load_verify_locations(ctx, cacert, NULL)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", CA_FILE); @@ -187,21 +185,23 @@ int main(int argc, char* argv[]) const char* slot; const char* tokenName; const char* userPin; + const char* cacert; Pkcs11Dev dev; Pkcs11Token token; int slotId; int devId = 1; - if (argc != 4 && argc != 5) { + if (argc != 5 && argc != 6) { fprintf(stderr, - "Usage: server_tls_pkcs11 [userpin]\n"); + "Usage: client_tls_pkcs11 [userpin]\n"); return 1; } - library = argv[1]; - slot = argv[2]; - tokenName = argv[3]; - userPin = (argc == 4) ? NULL : argv[4]; + cacert = argv[1] + library = argv[2]; + slot = argv[3]; + tokenName = argv[4]; + userPin = (argc == 5) ? NULL : argv[5]; slotId = atoi(slot); #if defined(DEBUG_WOLFSSL) @@ -229,7 +229,7 @@ int main(int argc, char* argv[]) ret = 2; } if (ret == 0) { - ret = client_tls(devId, &token); + ret = client_tls(cacert, devId, &token); if (ret != 0) ret = 1; } diff --git a/pkcs11/pkcs11_hmac.c b/pkcs11/pkcs11_hmac.c index 7a47097f..5d54c8eb 100644 --- a/pkcs11/pkcs11_hmac.c +++ b/pkcs11/pkcs11_hmac.c @@ -31,10 +31,10 @@ int hmac(int devId, Pkcs11Token* token) { Hmac hmac; - unsigned char key[SHA256_DIGEST_SIZE]; + unsigned char key[WC_SHA256_DIGEST_SIZE]; int ret = 0; unsigned char data[57]; - unsigned char mac[SHA256_DIGEST_SIZE]; + unsigned char mac[WC_SHA256_DIGEST_SIZE]; memset(key, 9, sizeof(key)); memset(data, 9, sizeof(data)); diff --git a/pkcs11/pkcs11_test.c b/pkcs11/pkcs11_test.c index 0e656cd1..0c0f2efd 100644 --- a/pkcs11/pkcs11_test.c +++ b/pkcs11/pkcs11_test.c @@ -1067,20 +1067,20 @@ int hmac_test(int devId, Pkcs11Token* token) unsigned char key[WC_MAX_DIGEST_SIZE]; unsigned char data[57]; #if !defined(NO_MD5) - unsigned char exp_md5[MD5_DIGEST_SIZE] = { + unsigned char exp_md5[WC_MD5_DIGEST_SIZE] = { 0x58, 0x8e, 0xd2, 0x4e, 0x04, 0x1f, 0xf4, 0xc6, 0x98, 0x7c, 0x8e, 0xdc, 0xe5, 0xb1, 0xbc, 0x4b }; #endif #if !defined(NO_SHA) - unsigned char exp_sha[SHA_DIGEST_SIZE] = { + unsigned char exp_sha[WC_SHA_DIGEST_SIZE] = { 0x2f, 0x69, 0xc1, 0xf9, 0xe1, 0x97, 0x04, 0xe4, 0x75, 0x9f, 0x1c, 0x2a, 0x85, 0x87, 0x7e, 0x6b, 0xa7, 0x9f, 0xe1, 0x13 }; #endif #if defined(WOLFSSL_SHA224) - unsigned char exp_sha224[SHA224_DIGEST_SIZE] = { + unsigned char exp_sha224[WC_SHA224_DIGEST_SIZE] = { 0x86, 0xa8, 0xfc, 0xfd, 0xd5, 0x95, 0xf2, 0xa6, 0x45, 0x89, 0x3b, 0x8b, 0x4c, 0x0d, 0xd1, 0x81, 0x20, 0x6b, 0x71, 0x2d, 0x7c, 0x88, 0x31, 0xa8, @@ -1088,7 +1088,7 @@ int hmac_test(int devId, Pkcs11Token* token) }; #endif #if !defined(NO_SHA256) - unsigned char exp_sha256[SHA256_DIGEST_SIZE] = { + unsigned char exp_sha256[WC_SHA256_DIGEST_SIZE] = { 0x04, 0x9e, 0x43, 0x3c, 0x48, 0x7c, 0x31, 0x11, 0x54, 0x90, 0x43, 0xf6, 0x2f, 0x97, 0x42, 0x80, 0x3d, 0x22, 0x47, 0x1d, 0x4f, 0xc9, 0xb8, 0xa0, @@ -1096,7 +1096,7 @@ int hmac_test(int devId, Pkcs11Token* token) }; #endif #if defined(WOLFSSL_SHA384) - unsigned char exp_sha384[SHA384_DIGEST_SIZE] = { + unsigned char exp_sha384[WC_SHA384_DIGEST_SIZE] = { 0x0b, 0x4c, 0x32, 0x58, 0x7b, 0x00, 0xb7, 0xfa, 0x82, 0x9f, 0xf0, 0x1d, 0x10, 0x85, 0xbc, 0x2e, 0xe0, 0x4a, 0x71, 0x91, 0xd6, 0x9a, 0x93, 0xc2, @@ -1106,7 +1106,7 @@ int hmac_test(int devId, Pkcs11Token* token) }; #endif #if defined(WOLFSSL_SHA512) - unsigned char exp_sha512[SHA512_DIGEST_SIZE] = { + unsigned char exp_sha512[WC_SHA512_DIGEST_SIZE] = { 0x94, 0x7b, 0x97, 0x0f, 0x48, 0x68, 0xd1, 0x88, 0x08, 0x09, 0xcf, 0xea, 0xae, 0x3e, 0xba, 0xa2, 0x3f, 0xf4, 0x9d, 0x73, 0x78, 0x15, 0x34, 0x44, @@ -1124,42 +1124,42 @@ int hmac_test(int devId, Pkcs11Token* token) #ifndef NO_MD5 if (ret == 0) { fprintf(stderr, "HMAC-MD5\n"); - ret = hmac_op(key, MD5_DIGEST_SIZE, WC_MD5, data, sizeof(data), exp_md5, - sizeof(exp_md5), devId, token); + ret = hmac_op(key, WC_MD5_DIGEST_SIZE, WC_MD5, data, sizeof(data), + exp_md5, sizeof(exp_md5), devId, token); } #endif #ifndef NO_SHA if (ret == 0) { fprintf(stderr, "HMAC-SHA\n"); - ret = hmac_op(key, SHA_DIGEST_SIZE, WC_SHA, data, sizeof(data), exp_sha, - sizeof(exp_sha), devId, token); + ret = hmac_op(key, WC_SHA_DIGEST_SIZE, WC_SHA, data, sizeof(data), + exp_sha, sizeof(exp_sha), devId, token); } #endif #ifdef WOLFSSL_SHA224 if (ret == 0) { fprintf(stderr, "HMAC-SHA224\n"); - ret = hmac_op(key, SHA224_DIGEST_SIZE, WC_SHA224, data, sizeof(data), + ret = hmac_op(key, WC_SHA224_DIGEST_SIZE, WC_SHA224, data, sizeof(data), exp_sha224, sizeof(exp_sha224), devId, token); } #endif #ifndef NO_SHA256 if (ret == 0) { fprintf(stderr, "HMAC-SHA256\n"); - ret = hmac_op(key, SHA256_DIGEST_SIZE, WC_SHA256, data, sizeof(data), + ret = hmac_op(key, WC_SHA256_DIGEST_SIZE, WC_SHA256, data, sizeof(data), exp_sha256, sizeof(exp_sha256), devId, token); } #endif #ifdef WOLFSSL_SHA384 if (ret == 0) { fprintf(stderr, "HMAC-SHA384\n"); - ret = hmac_op(key, SHA384_DIGEST_SIZE, WC_SHA384, data, sizeof(data), + ret = hmac_op(key, WC_SHA384_DIGEST_SIZE, WC_SHA384, data, sizeof(data), exp_sha384, sizeof(exp_sha384), devId, token); } #endif #ifdef WOLFSSL_SHA512 if (ret == 0) { fprintf(stderr, "HMAC-SHA512\n"); - ret = hmac_op(key, SHA512_DIGEST_SIZE, WC_SHA512, data, sizeof(data), + ret = hmac_op(key, WC_SHA512_DIGEST_SIZE, WC_SHA512, data, sizeof(data), exp_sha512, sizeof(exp_sha512), devId, token); } #endif