/* client-tls-pkcs11.c * * Copyright (C) 2006-2020 wolfSSL Inc. * * This file is part of wolfSSL. (formerly known as CyaSSL) * * wolfSSL is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * wolfSSL is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA */ /* the usual suspects */ #include #include #include /* socket includes */ #include #include #include #include /* wolfSSL */ #ifndef WOLFSSL_USER_SETTINGS #include #endif #include #include #define DEFAULT_PORT 11111 int client_tls(const char *cacert, int devId, Pkcs11Token* token) { int sockfd; struct sockaddr_in servAddr; char buff[256]; size_t len; int ret; /* declare wolfSSL objects */ WOLFSSL_CTX* ctx = NULL; WOLFSSL* ssl = NULL; WOLFSSL_CIPHER* cipher; /* Initialize wolfSSL */ wolfSSL_Init(); /* Create a socket that uses an internet IPv4 address, * Sets the socket to be stream based (TCP), * 0 means choose the default protocol. */ if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { fprintf(stderr, "ERROR: failed to create the socket\n"); return -1; } /* Initialize the server address struct with zeros */ memset(&servAddr, 0, sizeof(servAddr)); /* Fill in the server address */ servAddr.sin_family = AF_INET; /* using IPv4 */ servAddr.sin_port = htons(DEFAULT_PORT); /* on DEFAULT_PORT */ /* IPv4 127.0.0.1 */ if (inet_pton(AF_INET, "127.0.0.1", &servAddr.sin_addr) != 1) { fprintf(stderr, "ERROR: invalid address\n"); ret = -1; goto exit; } /* Connect to the server */ if ((ret = connect(sockfd, (struct sockaddr*) &servAddr, sizeof(servAddr))) == -1) { fprintf(stderr, "ERROR: failed to connect\n"); goto exit; } #if 0 wolfSSL_Debugging_ON(); #endif /* Initialize wolfSSL */ if ((ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method())) == NULL) { fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); return -1; } /* Set devId associated with the PKCS11 device. */ if (wolfSSL_CTX_SetDevId(ctx, devId) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n"); return -1; } /* Load CA certificate into WOLFSSL_CTX for validating peer */ if ((ret = wolfSSL_CTX_load_verify_locations(ctx, cacert, NULL)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load %s, please check the file.\n", cacert); goto exit; } /* validate peer certificate */ wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, NULL); /* Open the PKCS11 token. */ if ((ret = wc_Pkcs11Token_Open(token, 1)) != 0) { fprintf(stderr, "ERROR: failed to open session on token (%d)\n", ret); return -1; } /* Create a WOLFSSL object */ if ((ssl = wolfSSL_new(ctx)) == NULL) { fprintf(stderr, "ERROR: failed to create WOLFSSL object\n"); return -1; } /* Attach wolfSSL to the socket */ if ((ret = wolfSSL_set_fd(ssl, sockfd)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: Failed to set the file descriptor\n"); goto exit; } /* Connect to wolfSSL on the server side */ if ((ret = wolfSSL_connect(ssl)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to connect to wolfSSL\n"); goto exit; } cipher = wolfSSL_get_current_cipher(ssl); printf("SSL cipher suite is %s\n", wolfSSL_CIPHER_get_name(cipher)); /* Get a message for the server from stdin */ printf("Message for server: "); memset(buff, 0, sizeof(buff)); if (fgets(buff, sizeof(buff), stdin) == NULL) { fprintf(stderr, "ERROR: failed to get message for server\n"); ret = -1; goto exit; } len = strnlen(buff, sizeof(buff)); /* Send the message to the server */ if ((ret = wolfSSL_write(ssl, buff, len)) != len) { fprintf(stderr, "ERROR: failed to write entire message\n"); fprintf(stderr, "%d bytes of %d bytes were sent", ret, (int) len); goto exit; } /* Read the server data into our buff array */ memset(buff, 0, sizeof(buff)); if ((ret = wolfSSL_read(ssl, buff, sizeof(buff)-1)) == -1) { fprintf(stderr, "ERROR: failed to read\n"); goto exit; } /* Print to stdout any data the server sends */ printf("Server: %s\n", buff); ret = 0; /* return success */ exit: /* Cleanup after this connection */ wolfSSL_free(ssl); wc_Pkcs11Token_Close(token); wolfSSL_CTX_free(ctx); if (sockfd != SOCKET_INVALID) close(sockfd); return ret; } int main(int argc, char* argv[]) { int ret; const char* library; const char* slot; const char* tokenName; const char* userPin; const char* cacert; Pkcs11Dev dev; Pkcs11Token token; int slotId; int devId = 1; if (argc != 5 && argc != 6) { fprintf(stderr, "Usage: client_tls_pkcs11 [userpin]\n"); return 1; } cacert = argv[1]; library = argv[2]; slot = argv[3]; tokenName = argv[4]; userPin = (argc == 5) ? NULL : argv[5]; slotId = atoi(slot); #if defined(DEBUG_WOLFSSL) wolfSSL_Debugging_ON(); #endif wolfCrypt_Init(); ret = wc_Pkcs11_Initialize(&dev, library, NULL); if (ret != 0) { fprintf(stderr, "Failed to initialize PKCS#11 library\n"); ret = 2; } if (ret == 0) { ret = wc_Pkcs11Token_Init(&token, &dev, slotId, tokenName, (byte*)userPin, userPin == NULL ? 0 : strlen(userPin)); if (ret != 0) { fprintf(stderr, "Failed to initialize PKCS#11 token\n"); ret = 2; } if (ret == 0) { ret = wc_CryptoDev_RegisterDevice(devId, wc_Pkcs11_CryptoDevCb, &token); if (ret != 0) { fprintf(stderr, "Failed to register PKCS#11 token\n"); ret = 2; } if (ret == 0) { ret = client_tls(cacert, devId, &token); if (ret != 0) ret = 1; } wc_Pkcs11Token_Final(&token); } wc_Pkcs11_Finalize(&dev); } wolfCrypt_Cleanup(); return ret; }