WolfSSL
/
wolfssl-examples
mirror of https://github.com/wolfSSL/wolfssl-examples.git
1
0
Fork 0
Code Issues Releases Wiki Activity
1,875 Commits
18 Branches
2 Tags
197 MiB
Commit Graph

3 Commits (master)

Author SHA1 Message Date
Sameeh Jubran 09966434e4 http-message-signatures: address Skoll review feedback 
- http_client_signed: check build_http_request() return before
  send() and cast to size_t; free key on import_private_only
  failure.
- http_server_verify: consolidate main() error paths around a
  single "cleanup:" label so pubKey and listenFd are released
  uniformly (import_public, socket, bind, listen).
- test_vectors: guard ed25519_free with per-key init flags so
  the shared cleanup path never frees an uninitialized struct.
- wc_http_sig.h: document that WC_SF_MAX_STRING / WC_SF_MAX_ITEMS
  drive ~12KB stack usage and must be tuned for embedded targets.
- wc_sf: reject *outSz > INT_MAX in wc_SfGenSigParams and
  wc_SfGenSigInput to guard word32 -> int casts (matches
  build_signature_base).

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
 2026-04-23 12:37:58 +03:00
Sameeh Jubran 330c9b258b wc_http_sig: remove extra braces around header lookup loop 
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
 2026-04-09 13:32:58 +03:00
Sameeh Jubran 9a3b8458b3 Add RFC 9421 HTTP Message Signatures example using wolfCrypt Ed25519 
Initial implementation of RFC 9421 HTTP Message Signatures as a
wolfssl-examples project. Covers a minimal interoperable subset:
derived components (@method, @authority, @path, @query), arbitrary
HTTP header fields, Ed25519 signing/verification, single signature
(sig1), and timestamp-based replay protection.

Files:
- common/wc_sf.{c,h}: Minimal RFC 8941 structured fields subset
  (dictionary lookup, inner lists, parameters, byte sequences)
- common/wc_http_sig.{c,h}: RFC 9421 Sign/Verify/GetKeyId API
- sign_request.c: Standalone signing example
- http_server_verify.c: Demo HTTP server with signature verification
- http_client_signed.c: Demo HTTP client sending signed requests
- test_vectors.c: 11 tests including RFC 9421 Appendix B.2.6

Design decisions:
- Ed25519-only (alg enforced on verify path)
- sigOut/inputOut are char* (NUL-terminated strings)
- Header names lowercased per RFC 9421 Section 2.1
- Portable case-insensitive comparison (no POSIX strcasecmp)
- SO_RCVTIMEO on server to prevent blocking on slow clients
- Signature base written directly to caller buffer (no double-buffer)

Known limitations:
- 32-bit long: parse_sf_integer caps at 9 digits, breaking current
  UNIX timestamps (needs fix, see below)
- No content-digest, multi-signature, or full RFC 8941 support
- Duplicate headers: first match wins, no folding

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
 2026-03-30 13:17:51 +03:00