394 lines
11 KiB
C
394 lines
11 KiB
C
/* maxq10xx-wolfssl-client.c
|
|
*
|
|
* Based on client-tls-pkcallback.c
|
|
*
|
|
* Copyright (C) 2006-2022 wolfSSL Inc.
|
|
*
|
|
* This file is part of wolfSSL.
|
|
*
|
|
* wolfSSL is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* wolfSSL is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
|
*/
|
|
|
|
/* This example shows how to write a simple TLS client that uses the features
|
|
* of the Analog Devices MAXQ 1065 and 1080. */
|
|
|
|
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
|
|
/* wolfSSL */
|
|
#ifndef WOLFSSL_USER_SETTINGS
|
|
#include <wolfssl/options.h>
|
|
#endif
|
|
#include <wolfssl/ssl.h>
|
|
#include <wolfssl/wolfcrypt/sha256.h>
|
|
#include <wolfssl/wolfcrypt/cryptocb.h>
|
|
#include <wolfssl/wolfcrypt/ecc.h>
|
|
#include <wolfssl/wolfcrypt/rsa.h>
|
|
#include <wolfssl/wolfcrypt/asn.h>
|
|
#include <wolfssl/wolfcrypt/error-crypt.h>
|
|
|
|
#ifdef USE_WINDOWS_API
|
|
#include <winsock2.h>
|
|
#else
|
|
#include <sys/socket.h>
|
|
#include <arpa/inet.h>
|
|
#include <netinet/in.h>
|
|
#endif
|
|
|
|
#if (defined(WOLFSSL_MAXQ1065) || defined(WOLFSSL_MAXQ108X)) && \
|
|
defined(HAVE_PK_CALLBACKS) && defined(WOLF_CRYPTO_CB) && \
|
|
!defined(NO_PSK) && !defined(HAVE_EXTENDED_MASTER) && \
|
|
defined(NO_WOLFSSL_SERVER)
|
|
|
|
/* -------------- */
|
|
/* Configurations */
|
|
/* -------------- */
|
|
|
|
/* Please define this if you want wolfSSL's debug output */
|
|
#define WANT_DEBUG
|
|
|
|
/* Please set the server's address and the port it listens on */
|
|
#define DEFAULT_SERVER "127.0.0.1"
|
|
#define DEFAULT_PORT 11111
|
|
#define MESSAGE "Hello from MAXQ10xx!"
|
|
#define MESSAGE_LEN 20
|
|
|
|
/* ------------------------------------ */
|
|
/* No modifications required below here */
|
|
/* ------------------------------------ */
|
|
|
|
/* identity is OpenSSL testing default for openssl s_client, keep same */
|
|
static const char* kIdentityStr = "Client_identity";
|
|
|
|
static WC_INLINE unsigned int my_psk_client_cb(WOLFSSL* ssl, const char* hint,
|
|
char* identity, unsigned int id_max_len, unsigned char* key,
|
|
unsigned int key_max_len)
|
|
{
|
|
(void)ssl;
|
|
(void)hint;
|
|
(void)key;
|
|
(void)key_max_len;
|
|
|
|
/* see internal.h MAX_PSK_ID_LEN for PSK identity limit */
|
|
XSTRNCPY(identity, kIdentityStr, id_max_len);
|
|
|
|
/* For TLS 1.2, we indicate that MAXQ has the PSK. */
|
|
return USE_HW_PSK;
|
|
}
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
static WC_INLINE unsigned int my_psk_client_cs_cb(WOLFSSL* ssl,
|
|
const char* hint, char* identity, unsigned int id_max_len,
|
|
unsigned char* key, unsigned int key_max_len, const char* ciphersuite)
|
|
{
|
|
(void)ssl;
|
|
(void)hint;
|
|
(void)key;
|
|
(void)key_max_len;
|
|
|
|
#ifdef WOLFSSL_PSK_MULTI_ID_PER_CS
|
|
/* Multiple calls for each cipher suite. First identity byte indicates the
|
|
* number of identites seen so far for cipher suite. */
|
|
if (identity[0] != 0) {
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
/* see internal.h MAX_PSK_ID_LEN for PSK identity limit */
|
|
XSTRNCPY(identity, kIdentityStr, id_max_len);
|
|
XSTRNCAT(identity, ciphersuite + XSTRLEN(ciphersuite) - 6, id_max_len);
|
|
|
|
/* For TLS 1.3, we just return an unmodified key. */
|
|
return 32;
|
|
}
|
|
#endif /* WOLFSSL_TLS13 */
|
|
|
|
static void print_usage() {
|
|
fprintf(stderr, "usage: ./maxq10xx-wolfssl-client [-tls12|-tls13] "
|
|
"[-ecc|-rsa|-psk] <cipher suite>\n");
|
|
fprintf(stderr, "Use `example/client/client -e` to get a list of cipher "
|
|
"suites.\n");
|
|
fprintf(stderr, "Specifying a cipher suite is Optional.\n");
|
|
}
|
|
|
|
#define TLS12 1
|
|
#define TLS13 2
|
|
|
|
#define ECC 1
|
|
#define RSA 2
|
|
#define PSK 3
|
|
|
|
static int tls_version = TLS12;
|
|
static int alg = ECC;
|
|
static char *key_file = NULL;
|
|
static char *ciphersuite = NULL;
|
|
|
|
static int cmd_line_parse(int argc, char** argv) {
|
|
const size_t tls_vers_len = 6;
|
|
const size_t alg_len = 4;
|
|
|
|
if ((argc != 3) && (argc != 4)) {
|
|
print_usage();
|
|
return -1;
|
|
}
|
|
|
|
if (strncmp("-tls12", argv[1], tls_vers_len) == 0) {
|
|
tls_version = TLS12;
|
|
}
|
|
else if (strncmp("-tls13", argv[1], tls_vers_len) == 0) {
|
|
#ifdef WOLFSSL_TLS13
|
|
tls_version = TLS13;
|
|
#else
|
|
fprintf(stderr, "TLS 1.3 is not supported on MAXQ1065.\n");
|
|
return -1;
|
|
#endif
|
|
}
|
|
else {
|
|
print_usage();
|
|
return -1;
|
|
}
|
|
|
|
if (strncmp("-ecc", argv[2], alg_len) == 0) {
|
|
alg = ECC;
|
|
key_file = "ecc-p256-pub.pem";
|
|
}
|
|
else if (strncmp("-rsa", argv[2], alg_len) == 0) {
|
|
alg = RSA;
|
|
key_file = "rsa-2048-pub.pem";
|
|
}
|
|
else if (strncmp("-psk", argv[2], alg_len) == 0) {
|
|
alg = PSK;
|
|
}
|
|
else {
|
|
print_usage();
|
|
return -1;
|
|
}
|
|
|
|
if (argc == 4) {
|
|
ciphersuite = argv[3];
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
int main(int argc, char** argv)
|
|
{
|
|
int ret, err;
|
|
#ifdef USE_WINDOWS_API
|
|
SOCKET sockfd = SOCKET_INVALID;
|
|
#else
|
|
int sockfd = SOCKET_INVALID;
|
|
#endif
|
|
struct sockaddr_in servAddr;
|
|
char buff[256];
|
|
|
|
/* declare wolfSSL objects */
|
|
WOLFSSL_CTX* ctx = NULL;
|
|
WOLFSSL* ssl = NULL;
|
|
|
|
/* Command-line parameter check */
|
|
ret = cmd_line_parse(argc, argv);
|
|
if (ret < 0) {
|
|
goto exit;
|
|
}
|
|
|
|
#ifdef USE_WINDOWS_API
|
|
StartTCP();
|
|
#endif
|
|
|
|
/* Create a socket that uses an internet IPv4 address.
|
|
* Sets the socket to be stream based (TCP).
|
|
* 0 means choose the default protocol. */
|
|
if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
|
|
fprintf(stderr, "ERROR: failed to create the socket\n");
|
|
ret = -1;
|
|
goto exit;
|
|
}
|
|
|
|
/* Initialize the server address struct with zeros */
|
|
memset(&servAddr, 0, sizeof(servAddr));
|
|
|
|
/* Fill in the server address */
|
|
servAddr.sin_family = AF_INET; /* using IPv4 */
|
|
servAddr.sin_port = htons(DEFAULT_PORT); /* on DEFAULT_PORT */
|
|
|
|
/* Get the server IPv4 address from the command line call */
|
|
if (inet_pton(AF_INET, DEFAULT_SERVER, &servAddr.sin_addr) != 1) {
|
|
fprintf(stderr, "ERROR: invalid address\n");
|
|
ret = -1;
|
|
goto exit;
|
|
}
|
|
|
|
/* Connect to the server */
|
|
if ((ret = connect(sockfd, (struct sockaddr*) &servAddr, sizeof(servAddr)))
|
|
== -1) {
|
|
fprintf(stderr, "ERROR: failed to connect\n");
|
|
goto exit;
|
|
}
|
|
|
|
/*---------------------------------------------------*/
|
|
/* Start of wolfSSL initialization and configuration */
|
|
/*---------------------------------------------------*/
|
|
#ifdef WANT_DEBUG
|
|
wolfSSL_Debugging_ON();
|
|
#endif
|
|
|
|
/* Initialize wolfSSL */
|
|
if ((ret = wolfSSL_Init()) != WOLFSSL_SUCCESS) {
|
|
fprintf(stderr, "ERROR: Failed to initialize the library\n");
|
|
goto exit;
|
|
}
|
|
|
|
/* Create and initialize WOLFSSL_CTX */
|
|
#ifdef WOLFSSL_TLS13
|
|
if (tls_version == TLS13)
|
|
ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method());
|
|
else
|
|
#endif /* WOLFSSL_TLS13 */
|
|
ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method());
|
|
|
|
if (ctx == NULL) {
|
|
fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n");
|
|
ret = -1;
|
|
goto exit;
|
|
}
|
|
|
|
/* At this point you would normally register a CA certificate, however, it
|
|
* resides in MAXQ10xx and has already been registered. */
|
|
|
|
/* Load the dummy private key; actually a public key. The actual private
|
|
* key resides in MAXQ 10xx. */
|
|
if (key_file != NULL) {
|
|
if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, key_file,
|
|
WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) {
|
|
fprintf(stderr, "ERROR: failed to load %s, please check the "
|
|
"file.\n", key_file);
|
|
goto exit;
|
|
}
|
|
}
|
|
|
|
/* If specified, set the ciphersuite. */
|
|
if (ciphersuite != NULL) {
|
|
if (wolfSSL_CTX_set_cipher_list(ctx, ciphersuite) != WOLFSSL_SUCCESS) {
|
|
fprintf(stderr, "Invalid cipher suite.\n");
|
|
print_usage();
|
|
goto exit;
|
|
}
|
|
}
|
|
|
|
if (alg == PSK) {
|
|
wolfSSL_CTX_set_psk_client_callback(ctx, my_psk_client_cb);
|
|
#ifdef WOLFSSL_TLS13
|
|
if (tls_version == TLS13) {
|
|
wolfSSL_CTX_set_psk_client_cs_callback(ctx, my_psk_client_cs_cb);
|
|
}
|
|
#endif /* WOLFSSL_TLS13 */
|
|
|
|
if (ciphersuite != NULL) {
|
|
wolfSSL_CTX_set_psk_callback_ctx(ctx, (void*)ciphersuite);
|
|
}
|
|
}
|
|
|
|
/* Validate peer certificate */
|
|
wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, NULL);
|
|
|
|
/* Create a WOLFSSL object */
|
|
if ((ssl = wolfSSL_new(ctx)) == NULL) {
|
|
fprintf(stderr, "ERROR: failed to create WOLFSSL object\n");
|
|
ret = -1;
|
|
goto exit;
|
|
}
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
if (alg == RSA) {
|
|
if (wolfSSL_UseKeyShare(ssl, WOLFSSL_FFDHE_2048) != WOLFSSL_SUCCESS) {
|
|
fprintf(stderr, "ERROR: failed to create WOLFSSL object\n");
|
|
ret = -1;
|
|
goto exit;
|
|
}
|
|
}
|
|
#endif /* WOLFSSL_TLS13 */
|
|
|
|
/* Attach wolfSSL to the socket */
|
|
if ((ret = wolfSSL_set_fd(ssl, sockfd)) != WOLFSSL_SUCCESS) {
|
|
fprintf(stderr, "ERROR: Failed to set the file descriptor\n");
|
|
goto exit;
|
|
}
|
|
|
|
/* Connect to wolfSSL on the server side */
|
|
do {
|
|
ret = wolfSSL_connect(ssl);
|
|
err = wolfSSL_get_error(ssl, ret);
|
|
} while (err == WC_PENDING_E);
|
|
if (ret != WOLFSSL_SUCCESS) {
|
|
fprintf(stderr, "ERROR: failed to connect to wolfSSL\n");
|
|
goto exit;
|
|
}
|
|
|
|
/* Send the message to the server */
|
|
if ((ret = wolfSSL_write(ssl, MESSAGE, MESSAGE_LEN)) != MESSAGE_LEN) {
|
|
fprintf(stderr, "ERROR: failed to write entire message\n");
|
|
fprintf(stderr, "%d bytes of %d bytes were sent", ret, MESSAGE_LEN);
|
|
goto exit;
|
|
}
|
|
|
|
/* Read the server data into our buff array */
|
|
memset(buff, 0, sizeof(buff));
|
|
if ((ret = wolfSSL_read(ssl, buff, sizeof(buff)-1)) == -1) {
|
|
fprintf(stderr, "ERROR: failed to read\n");
|
|
goto exit;
|
|
}
|
|
|
|
/* Print to stdout any data the server sends */
|
|
printf("Server: %s\n", buff);
|
|
|
|
ret = 0; /* success */
|
|
|
|
exit:
|
|
/* Cleanup and return */
|
|
if (sockfd != SOCKET_INVALID)
|
|
close(sockfd);
|
|
if (ssl != NULL)
|
|
wolfSSL_free(ssl);
|
|
if (ctx != NULL)
|
|
wolfSSL_CTX_free(ctx);
|
|
|
|
wolfSSL_Cleanup();
|
|
|
|
return ret;
|
|
}
|
|
|
|
#else
|
|
|
|
int main(int argc, char** argv)
|
|
{
|
|
printf("Warning: Required flags have not been used!\n"
|
|
"Please configure with the following flags:\n"
|
|
" --enable-pkcallbacks\n"
|
|
" --enable-cryptocb\n"
|
|
" --disable-extended-master\n"
|
|
" --enable-psk\n"
|
|
" --enable-aesccm\n"
|
|
" --with-maxq10xx=MAXQ108x|MAXQ1065\n"
|
|
" CFLAGS=-DNO_WOLFSSL_SERVER\n"
|
|
);
|
|
return -1;
|
|
}
|
|
#endif /* (WOLFSSL_MAXQ1065 || WOLFSSL_MAXQ108X) && HAVE_PK_CALLBACKS &&
|
|
* WOLF_CRYPTO_CB && !NO_PSK && !HAVE_EXTENDED_MASTER &&
|
|
* NO_WOLFSSL_SERVER */
|