Skip to content

Commit fcb0a97

Browse files
JacobBarthelmehJacobBarthelmeh
committed
Use TLS over transport for authentication of peer
1 parent 732e964 commit fcb0a97

File tree

11 files changed

+1158
-16
lines changed

11 files changed

+1158
-16
lines changed

‎examples/posix/wh_posix_client/wh_posix_client.c‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,17 @@ void Usage(const char* exeName)
151151
{
152152
printf("Usage: %s --type <type> --test\n", exeName);
153153
printf("Example: %s --type tcp\n", exeName);
154-
printf("type: tcp (default), shm\n");
154+
printf("type: tcp (default), shm");
155+
#ifndef WOLFHSM_CFG_NO_CRYPTO
156+
printf(", tls");
157+
#endif
158+
#ifndef NO_PSK
159+
printf(", psk");
160+
#endif
161+
#ifdef WOLFSSL_STATIC_MEMORY
162+
printf(", dma");
163+
#endif
164+
printf("\n");
155165
}
156166

157167
int main(int argc, char** argv)
@@ -195,6 +205,18 @@ int main(int argc, char** argv)
195205
printf("Using shared memory transport\n");
196206
wh_PosixClient_ExampleShmConfig(c_conf);
197207
}
208+
#ifndef WOLFHSM_CFG_NO_CRYPTO
209+
else if (strcmp(type, "tls") == 0) {
210+
printf("Using TLS transport\n");
211+
wh_PosixClient_ExampleTlsConfig(c_conf);
212+
}
213+
#endif
214+
#if !defined(WOLFHSM_CFG_NO_CRYPTO) && !defined(NO_PSK)
215+
else if (strcmp(type, "psk") == 0) {
216+
printf("Using TLS PSK transport\n");
217+
wh_PosixClient_ExamplePskConfig(c_conf);
218+
}
219+
#endif
198220
#ifdef WOLFSSL_STATIC_MEMORY
199221
else if (strcmp(type, "dma") == 0) {
200222
printf("Using DMA with shared memory transport\n");

‎examples/posix/wh_posix_client/wh_posix_client_cfg.c‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,19 +10,31 @@
1010

1111
#include "port/posix/posix_transport_shm.h"
1212
#include "port/posix/posix_transport_tcp.h"
13+
#ifndef WOLFHSM_CFG_NO_CRYPTO
14+
#include "port/posix/posix_transport_tls.h"
15+
#endif
1316

1417
#include <string.h>
1518

1619
posixTransportShmClientContext tccShm;
1720
posixTransportTcpClientContext tccTcp;
21+
#ifndef WOLFHSM_CFG_NO_CRYPTO
22+
posixTransportTlsClientContext tccTls;
23+
#endif
1824

1925
posixTransportShmConfig shmConfig;
2026
posixTransportTcpConfig tcpConfig;
27+
#ifndef WOLFHSM_CFG_NO_CRYPTO
28+
posixTransportTlsConfig tlsConfig;
29+
#endif
2130

2231
whCommClientConfig c_comm;
2332

2433
whTransportClientCb shmCb = POSIX_TRANSPORT_SHM_CLIENT_CB;
2534
whTransportClientCb tcpCb = PTT_CLIENT_CB;
35+
#ifndef WOLFHSM_CFG_NO_CRYPTO
36+
whTransportClientCb tlsCb = PTTLS_CLIENT_CB;
37+
#endif
2638

2739
#ifdef WOLFSSL_STATIC_MEMORY
2840
whTransportClientCb dmaCb = POSIX_TRANSPORT_SHM_CLIENT_CB;
@@ -123,6 +135,166 @@ int wh_PosixClient_ExampleTcpConfig(void* conf)
123135
return WH_ERROR_OK;
124136
}
125137

138+
#ifndef WOLFHSM_CFG_NO_CRYPTO
139+
/* client configuration setup example for TLS transport */
140+
#undef USE_CERT_BUFFERS_2048
141+
#define USE_CERT_BUFFERS_2048
142+
#include "wolfssl/certs_test.h"
143+
static int
144+
wh_PosixClient_ExampleTlsContextSetup(posixTransportTlsClientContext* ctx)
145+
{
146+
int rc;
147+
148+
/* uncomment and compile with DEBUG_WOLFSSL for debugging */
149+
/* wolfSSL_Debugging_ON(); */
150+
151+
/* Create a new wolfSSL context to use with this connection */
152+
ctx->ssl_ctx = wolfSSL_CTX_new(wolfSSLv23_client_method());
153+
if (!ctx->ssl_ctx) {
154+
return WH_ERROR_ABORTED;
155+
}
156+
157+
/* don't use wolfHSM for TLS crypto when communicating with wolfHSM */
158+
wolfSSL_CTX_SetDevId(ctx->ssl_ctx, INVALID_DEVID);
159+
160+
/* Load CA certificate for server verification */
161+
rc = wolfSSL_CTX_load_verify_buffer(ctx->ssl_ctx, ca_cert_der_2048,
162+
sizeof_ca_cert_der_2048,
163+
CTC_FILETYPE_ASN1);
164+
if (rc != WOLFSSL_SUCCESS) {
165+
wolfSSL_CTX_free(ctx->ssl_ctx);
166+
ctx->ssl_ctx = NULL;
167+
return WH_ERROR_ABORTED;
168+
}
169+
170+
rc = wolfSSL_CTX_use_certificate_buffer(ctx->ssl_ctx, client_cert_der_2048,
171+
sizeof(client_cert_der_2048),
172+
CTC_FILETYPE_ASN1);
173+
if (rc != WOLFSSL_SUCCESS) {
174+
wolfSSL_CTX_free(ctx->ssl_ctx);
175+
ctx->ssl_ctx = NULL;
176+
return WH_ERROR_ABORTED;
177+
}
178+
179+
/* load private key for TLS connection */
180+
rc = wolfSSL_CTX_use_PrivateKey_buffer(ctx->ssl_ctx, client_key_der_2048,
181+
sizeof(client_key_der_2048),
182+
CTC_FILETYPE_ASN1);
183+
if (rc != WOLFSSL_SUCCESS) {
184+
wolfSSL_CTX_free(ctx->ssl_ctx);
185+
ctx->ssl_ctx = NULL;
186+
return WH_ERROR_ABORTED;
187+
}
188+
/* Set verification mode */
189+
wolfSSL_CTX_set_verify(ctx->ssl_ctx, WOLFSSL_VERIFY_PEER, NULL);
190+
191+
return WH_ERROR_OK;
192+
}
193+
194+
#ifndef NO_PSK
195+
/* Simple PSK example callback */
196+
static unsigned int psk_tls12_client_cb(WOLFSSL* ssl, const char* hint,
197+
char* identity, unsigned int id_max_len,
198+
unsigned char* key,
199+
unsigned int key_max_len)
200+
{
201+
size_t len;
202+
203+
memset(key, 0, key_max_len);
204+
const char* exampleIdentity = "PSK_EXAMPLE_CLIENT_IDENTITY";
205+
206+
printf("PSK server identity hint: %s\n", hint);
207+
printf("PSK using identity: %s\n", exampleIdentity);
208+
strncpy(identity, exampleIdentity, id_max_len);
209+
210+
printf("Enter PSK password: ");
211+
if (fgets((char*)key, key_max_len - 1, stdin) == NULL) {
212+
memset(key, 0, key_max_len);
213+
return 0U;
214+
}
215+
216+
(void)ssl;
217+
len = strcspn((char*)key, "\n");
218+
((char*)key)[len] = '\0';
219+
return (unsigned int)len;
220+
}
221+
222+
/* Setup WOLFSSL_CTX for use with PSK */
223+
static int
224+
wh_PosixClient_ExamplePskContextSetup(posixTransportTlsClientContext* ctx)
225+
{
226+
/* uncomment and compile with DEBUG_WOLFSSL for debugging */
227+
/* wolfSSL_Debugging_ON(); */
228+
229+
/* Create a new wolfSSL context to use with this connection */
230+
ctx->ssl_ctx = wolfSSL_CTX_new(wolfSSLv23_client_method());
231+
if (!ctx->ssl_ctx) {
232+
return WH_ERROR_ABORTED;
233+
}
234+
235+
/* don't use wolfHSM for TLS crypto when communicating with wolfHSM */
236+
wolfSSL_CTX_SetDevId(ctx->ssl_ctx, INVALID_DEVID);
237+
238+
wolfSSL_CTX_set_psk_client_callback(ctx->ssl_ctx, psk_tls12_client_cb);
239+
/* Set verification mode */
240+
wolfSSL_CTX_set_verify(ctx->ssl_ctx, WOLFSSL_VERIFY_PEER, NULL);
241+
242+
return WH_ERROR_OK;
243+
}
244+
#endif /* NO_PSK */
245+
246+
static int wh_PosixClient_ExampleTlsCommonConfig(void* conf)
247+
{
248+
whClientConfig* c_conf = (whClientConfig*)conf;
249+
250+
memset(&tccTls, 0, sizeof(posixTransportTlsClientContext));
251+
252+
/* Initialize TCP context fields that need specific values */
253+
tccTls.state = 0;
254+
tccTls.connect_fd_p1 = 0; /* Invalid fd */
255+
tccTls.request_sent = 0;
256+
tccTls.buffer_offset = 0;
257+
258+
tlsConfig.server_ip_string = WH_POSIX_SERVER_TCP_IPSTRING;
259+
tlsConfig.server_port = WH_POSIX_SERVER_TCP_PORT;
260+
tlsConfig.verify_peer = true;
261+
262+
c_comm.transport_cb = &tlsCb;
263+
c_comm.transport_context = (void*)&tccTls;
264+
c_comm.transport_config = (void*)&tlsConfig;
265+
c_comm.client_id = WH_POSIX_CLIENT_ID;
266+
c_conf->comm = &c_comm;
267+
268+
return WH_ERROR_OK;
269+
}
270+
271+
int wh_PosixClient_ExampleTlsConfig(void* conf)
272+
{
273+
if (wh_PosixClient_ExampleTlsCommonConfig(conf) != WH_ERROR_OK) {
274+
return WH_ERROR_ABORTED;
275+
}
276+
277+
if (wh_PosixClient_ExampleTlsContextSetup(&tccTls) != WH_ERROR_OK) {
278+
return WH_ERROR_ABORTED;
279+
}
280+
return WH_ERROR_OK;
281+
}
282+
283+
#ifndef NO_PSK
284+
int wh_PosixClient_ExamplePskConfig(void* conf)
285+
{
286+
if (wh_PosixClient_ExampleTlsCommonConfig(conf) != WH_ERROR_OK) {
287+
return WH_ERROR_ABORTED;
288+
}
289+
290+
if (wh_PosixClient_ExamplePskContextSetup(&tccTls) != WH_ERROR_OK) {
291+
return WH_ERROR_ABORTED;
292+
}
293+
return WH_ERROR_OK;
294+
}
295+
#endif /* NO_PSK */
296+
#endif /* WOLFHSM_CFG_NO_CRYPTO */
297+
126298

127299
/* client configuration setup example for transport */
128300
int wh_PosixClient_ExampleShmConfig(void* conf)

‎examples/posix/wh_posix_client/wh_posix_client_cfg.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,11 @@
44
int wh_PosixClient_ExampleShmDmaConfig(void* c_conf);
55
int wh_PosixClient_ExampleShmConfig(void* c_conf);
66
int wh_PosixClient_ExampleTcpConfig(void* c_conf);
7+
#ifndef WOLFHSM_CFG_NO_CRYPTO
8+
int wh_PosixClient_ExampleTlsConfig(void* c_conf);
9+
#endif
10+
#if !defined(WOLFHSM_CFG_NO_CRYPTO) && !defined(NO_PSK)
11+
int wh_PosixClient_ExamplePskConfig(void* c_conf);
12+
#endif
713
int wh_PosixClient_ExampleSetupDmaMemory(void* ctx, void* c_conf);
814
#endif /* WH_POSIX_CLIENT_CFG_H */

‎examples/posix/wh_posix_server/user_settings.h‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,7 @@ extern "C" {
4848
#define HAVE_ANONYMOUS_INLINE_AGGREGATES 1
4949

5050
/* For cert manager */
51-
#define NO_TLS
52-
/* Eliminates need for IO layer since we only use CM */
53-
#define WOLFSSL_USER_IO
51+
/* #define NO_TLS */
5452
/* For ACert support (also requires WOLFSSL_ASN_TEMPLATE) */
5553
#define WOLFSSL_ACERT
5654

@@ -67,11 +65,11 @@ extern "C" {
6765

6866
/** Remove unneeded features*/
6967
#define NO_MAIN_DRIVER
70-
#define NO_ERROR_STRINGS
68+
/* #define NO_ERROR_STRINGS */
7169
#define NO_ERROR_QUEUE
7270
#define NO_INLINE
7371
#define NO_OLD_TLS
74-
#define WOLFSSL_NO_TLS12
72+
/* #define WOLFSSL_NO_TLS12 */
7573
#define NO_DO178
7674
/* Prevents certain functions (SHA, hash.c) on server from falling back to
7775
* client cryptoCb when using non-devId APIs */
@@ -150,7 +148,7 @@ extern "C" {
150148
/* Remove unneeded crypto */
151149
#define NO_DSA
152150
#define NO_RC4
153-
#define NO_PSK
151+
/* #define NO_PSK */
154152
#define NO_MD4
155153
#define NO_MD5
156154
#define NO_DES3
@@ -191,6 +189,11 @@ extern "C" {
191189
#define WOLFSSL_STATIC_MEMORY
192190
#endif
193191

192+
/* additional memory debugging macros, prints out each alloc and free */
193+
/* #define WOLFSSL_DEBUG_MEMORY */
194+
/* #define WOLFSSL_DEBUG_MEMORY_PRINT */
195+
196+
/* #define DEBUG_WOLFSSL */
194197
#ifdef __cplusplus
195198
}
196199
#endif

‎examples/posix/wh_posix_server/wh_posix_server.c‎

Lines changed: 46 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -273,7 +273,17 @@ static void Usage(const char* exeName)
273273
printf("Example: %s --key key.bin --id 123 --client 456 "
274274
"--nvminit nvm_init.txt --type tcp\n",
275275
exeName);
276-
printf("type: tcp (default), shm, dma\n");
276+
printf("type: tcp (default), shm");
277+
#ifndef WOLFHSM_CFG_NO_CRYPTO
278+
printf(", tls");
279+
#endif
280+
#ifndef NO_PSK
281+
printf(", psk");
282+
#endif
283+
#ifdef WOLFSSL_STATIC_MEMORY
284+
printf(", dma");
285+
#endif
286+
printf("\n");
277287
}
278288

279289

@@ -322,16 +332,48 @@ int main(int argc, char** argv)
322332
memset(s_conf, 0, sizeof(whServerConfig));
323333
if (strcmp(type, "tcp") == 0) {
324334
printf("Using TCP transport\n");
325-
wh_PosixServer_ExampleTcpConfig(s_conf);
335+
rc = wh_PosixServer_ExampleTcpConfig(s_conf);
336+
if (rc != WH_ERROR_OK) {
337+
printf("Failed to initialize TCP transport\n");
338+
return -1;
339+
}
326340
}
327341
else if (strcmp(type, "shm") == 0) {
328342
printf("Using shared memory transport\n");
329-
wh_PosixServer_ExampleShmConfig(s_conf);
343+
rc = wh_PosixServer_ExampleShmConfig(s_conf);
344+
if (rc != WH_ERROR_OK) {
345+
printf("Failed to initialize shared memory transport\n");
346+
return -1;
347+
}
348+
}
349+
#ifndef WOLFHSM_CFG_NO_CRYPTO
350+
else if (strcmp(type, "tls") == 0) {
351+
printf("Using TLS transport\n");
352+
rc = wh_PosixServer_ExampleTlsConfig(s_conf);
353+
if (rc != WH_ERROR_OK) {
354+
printf("Failed to initialize TLS transport\n");
355+
return -1;
356+
}
357+
}
358+
#if !defined(WOLFHSM_CFG_NO_CRYPTO) && !defined(NO_PSK)
359+
else if (strcmp(type, "psk") == 0) {
360+
printf("Using TLS PSK transport\n");
361+
rc = wh_PosixServer_ExamplePskConfig(s_conf);
362+
if (rc != WH_ERROR_OK) {
363+
printf("Failed to initialize TLS PSK transport\n");
364+
return -1;
365+
}
330366
}
367+
#endif
368+
#endif
331369
#ifdef WOLFSSL_STATIC_MEMORY
332370
else if (strcmp(type, "dma") == 0) {
333371
printf("Using DMA with shared memory transport\n");
334-
wh_PosixServer_ExampleShmDmaConfig(s_conf);
372+
rc = wh_PosixServer_ExampleShmDmaConfig(s_conf);
373+
if (rc != WH_ERROR_OK) {
374+
printf("Failed to initialize DMA with shared memory transport\n");
375+
return -1;
376+
}
335377
}
336378
#endif
337379
else {

0 commit comments

Comments
 (0)