F-5613: keep peer verification enabled after loading CA cert in Mynewt client

Author: Emma Stensland

mynewt/README.md

@@ -113,6 +113,35 @@ including the `wolfssl` command with represents the client TLS application.
 
 ## Usage
 
+### Run a local TLS server to connect to
+
+This example uses the repo's test CA (`certs/ca-cert.pem`, embedded as `local_ca.h`). 
+To avoid dependencies on live internet hosts, point the client at the local 
+`tls/server-tls` example.
+
+In a separate terminal, from the `wolfssl-examples` directory:
+
+```
+$ cd tls
+$ make
+$ ./server-tls
+```
+
+Leave this running. It handles one connection at a time.
+
+### Connecting to a different target instead
+
+To connect to a real host, build with `WOLFSSL_MN_USE_CUSTOM_CA`:
+
+```
+$ newt target set wolfsslclienttlsmn_sim syscfg=WOLFSSL_MN_USE_CUSTOM_CA=1
+```
+
+Fill in `mynewt/custom_ca.h` with your target's root CA. Set `DEFAULT_IPADDR` 
+and `DEFAULT_PORT` in `client-tls-mn.c`, then rebuild.
+
+Note: This demo pins the CA and IP address at build time. Update them manually if the target changes.
+
 ### Command list
 
 The client TLS application `wolfssl` has the following commands:
@@ -123,28 +152,29 @@ The client TLS application `wolfssl` has the following commands:
 | time    | "unix timestamp"                 | To set the time            | "time 1532616682"                     |
 | net     | udp                              | create udp socket          | "net udp"                             |
 | net     | tcp                              | create tcp socket          | "net tcp"                             |
-| net     | connect "ipaddress" port         | connect "ipaddress"        | "net connect 93.184.216.34 443"       |
+| net     | connect "ipaddress" port         | connect "ipaddress"        | "net connect 127.0.0.1 11111"         |
 | net     | close                            | close socket               | "net close"                           |
-| net     | send "string" "ipaddress" "port" | send string                | "net send "GET \r\n" 93.184.216.34 80 |
-| net     | recv "ipaddress"                 | recv from ipaddress        | "net recv 93.184.216.34 80            |
+| net     | send "string" "ipaddress" "port" | send string                | "net send "hello" 127.0.0.1 11111"    |
+| net     | recv "ipaddress"                 | recv from ipaddress        | "net recv 127.0.0.1 11111"            |
 | wolfssl | init                             | initialize wolfssl library | "wolfssl init"                        |
 | wolfssl | connect                          | connect via ssl            | "wolfssl connect"                     |
-| wolfssl | write "string"                   | send string via ssl        | "wolfssl write "GET /""               |
+| wolfssl | write "string"                   | send string via ssl        | "wolfssl write "hello wolfssl!""      |
 | wolfssl | read                             | recv via ssl               | "wolfssl recv"                        |
 | wolfssl | clear                            | finish wolfssl library     | "wolfssl clear"                       |
 
 ### Command examples
-Get `index.html` from `www.example.com:443` (i.e. `93.184.216.34:443`) using
-Mynewt TCP networking and the wolfSSL TLS and crypto.
+Connect to the locally-run `tls/server-tls` example (`127.0.0.1:11111`)
+using Mynewt TCP networking and the wolfSSL TLS and crypto. Make sure
+`./server-tls` (see above) is running first.
 
 At the Mynewt `compat>` shell prompt:
 
 ```
 net tcp
-net connect 93.184.216.34 443
+net connect 127.0.0.1 11111
 wolfssl init
 wolfssl connect
-wolfssl write "GET /"
+wolfssl write "hello wolfssl!"
 wolfssl read
 wolfssl clear
 net close
@@ -155,33 +185,21 @@ The resulting application output should be similar to the following:
 ```
 compat> net tcp
 001143 mn_socket(TCP) = 0 566b7800
-compat> net connect 93.184.216.34 443
-005078 93.184.216.34/443
+compat> net connect 127.0.0.1 11111
+005078 127.0.0.1/11111
 005078 mn_connect() = 0
 compat> net_test_writable 0 - 0
 wolfssl init
 005853 wolfssl contexts are initialized
 005854 wolfSSL ctx initialize
 compat> wolfssl connect
 006517 wolfSSL_connect() = 1
-compat> wolfssl write "GET /"
-009182 wolfSSL_write() = 4L
+compat> wolfssl write "hello wolfssl!"
+009182 wolfSSL_write() = 14L
 compat> wolfssl read
-010564 HTTP/1.0 501 Not Implemented
-Content-Type: text/html
-Content-Length: 357
-Connection: close
-Date: Wed, 12 Apr 2023 14:49:27 <?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
-         "http://wwwitle>501 - Not Implemented</title>
-	</head>
-	<body>
-		<h1>501 - Not Implemented</h1>
-	</body>
-</html>
+010564 I hear ya fa shizzle!
 
 010578 
-010578 ERROR: wolfSSL_read rc:-1 err:6
 compat> wolfssl clear
 012551 clear wolfssl contexts
 012553 wolfSSL ctx clear
@@ -190,8 +208,7 @@ compat> net close
 compat> 
 ```
 
-NOTE: The server-side connection close after reception of data results in the 
-      read error.
+`server-tls` handles one request per connection and loops. It can be reused for repeated `wolfssl connect` runs.
 
 ## Notes
 
@@ -211,6 +228,10 @@ Install:
 - expect
 - bash
 - screen
+- openssl
+- xxd
+- python3
+- fuser
 - [newt](https://mynewt.apache.org/latest/get_started/native_install/index.html)(v1.4.1 over)
 
 ## Usage

mynewt/apps.wolfsslclienttlsmn.pkg.yml

@@ -36,4 +36,6 @@ pkg.deps:
     - "@apache-mynewt-core/sys/log/full"
     - "@apache-mynewt-core/sys/stats/full"
 
-pkg.cflags: -DWOLFSSL_APACHE_MYNEWT -Wno-error -DNO_FILESYSTEM -DWOLFSSL_IGNORE_FILE_WARN
+# WC_NO_HARDEN is required for native sim targets.
+# WOLFSSL_CUSTOM_CONFIG applies Mynewt-specific settings.
+pkg.cflags: -DWOLFSSL_APACHE_MYNEWT -DWOLFSSL_CUSTOM_CONFIG -DWC_NO_HARDEN -Wno-error -DNO_FILESYSTEM -DWOLFSSL_IGNORE_FILE_WARN

mynewt/apps.wolfsslclienttlsmn.syscfg.yml

@@ -19,6 +19,11 @@
 
 # Settings this app defines.
 syscfg.defs:
+    WOLFSSL_MN_USE_CUSTOM_CA:
+        description: >
+            Use custom CA (custom_ca.h) and IP/port (client-tls-mn.c) 
+            instead of local server-tls demo.
+        value: 0
 
 # Settings this app overrides.
 syscfg.vals:

mynewt/client-tls-mn.c

@@ -53,11 +53,26 @@ extern time_t time(time_t*);
 
 /* wolfSSL */
 #include <wolfssl/ssl.h>
-#define USE_CERT_BUFFERS_2048
-#include <wolfssl/certs_test.h>
 
-#define DEFAULT_IPADDR "93.184.216.34" /* www.example.com */
+#if MYNEWT_VAL(WOLFSSL_MN_USE_CUSTOM_CA)
+#include "custom_ca.h"
+
+/* TODO: set to your real target's current IP/port/hostname; see custom_ca.h */
+#define DEFAULT_IPADDR_PLACEHOLDER
+#ifdef DEFAULT_IPADDR_PLACEHOLDER
+#error "mynewt/client-tls-mn.c: set DEFAULT_IPADDR/DEFAULT_PORT/DEFAULT_HOSTNAME (in the " \
+       "WOLFSSL_MN_USE_CUSTOM_CA branch above) to your real target's " \
+       "current IP/port/hostname and remove this #error before building."
+#endif
+#define DEFAULT_IPADDR "0.0.0.0"
 #define DEFAULT_PORT 443
+#define DEFAULT_HOSTNAME "example.com"
+#else
+/* Generated by setup.sh from certs/ca-cert.pem. */
+#include "local_ca.h"
+#define DEFAULT_IPADDR "127.0.0.1" /* local tls/server-tls example */
+#define DEFAULT_PORT 11111
+#endif
 
 struct os_sem test_sem;
 
@@ -120,12 +135,12 @@ static const oc_handler_t omgr_oc_handler = {
 
 static void net_test_readable(void *arg, int err)
 {
-    console_printf("net_test_readable %x - %d\n", (int)arg, err);
+    console_printf("net_test_readable %lx - %d\n", (unsigned long)(uintptr_t)arg, err);
 }
 
 static void net_test_writable(void *arg, int err)
 {
-    console_printf("net_test_writable %x - %d\n", (int)arg, err);
+    console_printf("net_test_writable %lx - %d\n", (unsigned long)(uintptr_t)arg, err);
 }
 
 static const union mn_socket_cb net_test_cbs = {
@@ -135,7 +150,7 @@ static const union mn_socket_cb net_test_cbs = {
 
 static int net_test_newconn(void *arg, struct mn_socket *new)
 {
-    console_printf("net_test_newconn %x - %x\n", (int)arg, (int)new);
+    console_printf("net_test_newconn %lx - %lx\n", (unsigned long)(uintptr_t)arg, (unsigned long)(uintptr_t)new);
     mn_socket_set_cbs(new, NULL, &net_test_cbs);
     net_test_socket2 = new;
     return 0;
@@ -161,12 +176,12 @@ net_cli(int argc, char **argv)
     }
     if (!strcmp(argv[1], "udp")) {
         rc = mn_socket(&net_test_socket, MN_PF_INET, MN_SOCK_DGRAM, 0);
-        console_printf("mn_socket(UDP) = %d %x\n", rc,
-          (int)net_test_socket);
+        console_printf("mn_socket(UDP) = %d %lx\n", rc,
+          (unsigned long)(uintptr_t)net_test_socket);
     } else if (!strcmp(argv[1], "tcp")) {
         rc = mn_socket(&net_test_socket, MN_PF_INET, MN_SOCK_STREAM, 0);
-        console_printf("mn_socket(TCP) = %d %x\n", rc,
-          (int)net_test_socket);
+        console_printf("mn_socket(TCP) = %d %lx\n", rc,
+          (unsigned long)(uintptr_t)net_test_socket);
     } else if (!strcmp(argv[1], "connect") || !strcmp(argv[1], "bind")) {
         char *addrStr = DEFAULT_IPADDR;
         int port = DEFAULT_PORT;
@@ -389,16 +404,38 @@ static int wolfssl_ctx_init() {
         return -1;
     }
 
-    int ret = wolfSSL_CTX_load_verify_buffer(wolfsslCtx, ca_cert_der_2048, sizeof_ca_cert_der_2048, SSL_FILETYPE_ASN1);
+#if MYNEWT_VAL(WOLFSSL_MN_USE_CUSTOM_CA)
+    int ret = wolfSSL_CTX_load_verify_buffer(wolfsslCtx, custom_ca_der, sizeof_custom_ca_der, SSL_FILETYPE_ASN1);
+#else
+    int ret = wolfSSL_CTX_load_verify_buffer(wolfsslCtx, local_ca_der, sizeof_local_ca_der, SSL_FILETYPE_ASN1);
+#endif
     if(ret != SSL_SUCCESS) {
         console_printf("Error %d loading CA cert\n", ret);
-        return ret;
+        wolfSSL_CTX_free(wolfsslCtx);
+        wolfsslCtx = NULL;
+        return -1;
     }
 
-    wolfSSL_CTX_set_verify(wolfsslCtx, SSL_VERIFY_NONE, 0);
+    /* Depends on bundled test CA certs not expiring. */
+    wolfSSL_CTX_set_verify(wolfsslCtx, SSL_VERIFY_PEER, NULL);
     /* Create a WOLFSSL object */
     if ((ssl = wolfSSL_new(wolfsslCtx)) == NULL) {
         console_printf("ERROR: failed to create WOLFSSL object\n");
+        wolfSSL_CTX_free(wolfsslCtx);
+        wolfsslCtx = NULL;
+        return -1;
+    }
+
+#if MYNEWT_VAL(WOLFSSL_MN_USE_CUSTOM_CA)
+    if (wolfSSL_check_domain_name(ssl, DEFAULT_HOSTNAME) != SSL_SUCCESS) {
+#else
+    if (wolfSSL_check_domain_name(ssl, DEFAULT_IPADDR) != SSL_SUCCESS) {
+#endif
+        console_printf("ERROR: failed to set expected hostname\n");
+        wolfSSL_free(ssl);
+        ssl = NULL;
+        wolfSSL_CTX_free(wolfsslCtx);
+        wolfsslCtx = NULL;
         return -1;
     }
 
@@ -428,13 +465,19 @@ wolfssl_cli(int argc, char **argv)
     const char *subCommand = argv[1];
 
     if(!strcmp(subCommand, "init")) {
-        wolfssl_ctx_init();
+        if (wolfssl_ctx_init() != 0) {
+            return -1;
+        }
         wolfSSL_SetIO_Mynewt(ssl, net_test_socket, &net_test_sin);
         console_printf("wolfSSL ctx initialize\n");
     } else if(!strcmp(subCommand, "clear")) {
         wolfssl_ctx_clear();
         console_printf("wolfSSL ctx clear\n");
     } else if(!strcmp(subCommand, "connect")) {
+        if (ssl == NULL) {
+            console_printf("ERROR: run \"wolfssl init\" first\n");
+            return -1;
+        }
         rc = wolfSSL_connect(ssl);
         if(rc != SSL_SUCCESS) {
             err = wolfSSL_get_error(ssl, 0);
@@ -445,7 +488,11 @@ wolfssl_cli(int argc, char **argv)
     } else if(!strcmp(subCommand, "write")) {
         char *str = "GET /index.html HTTP/1.0\r\n\r\n";
         int len;
-        if(argc > 3) {
+        if (ssl == NULL) {
+            console_printf("ERROR: run \"wolfssl init\" first\n");
+            return -1;
+        }
+        if(argc > 2) {
             str = argv[2];
         }
         len = strlen(str);
@@ -459,14 +506,20 @@ wolfssl_cli(int argc, char **argv)
         console_printf("wolfSSL_write() = %dL\n", rc);
     } else if(!strcmp(subCommand, "read")) {
         char buff[256];
-        rc = 0;
-        while(rc >= 0) {
+        if (ssl == NULL) {
+            console_printf("ERROR: run \"wolfssl init\" first\n");
+            return -1;
+        }
+        rc = 1;
+        while(rc > 0) {
             memset(buff, 0, sizeof(buff));
             rc = wolfSSL_read(ssl, buff, sizeof(buff)-1);
             if(rc < 0) {
                 err = wolfSSL_get_error(ssl, 0);
                 console_printf("ERROR: wolfSSL_read rc:%d err:%d\n", rc, err);
                 return 0;
+            } else if (rc == 0) {
+                break;
             }
             console_printf("%.*s\n", rc, buff);
         }
@@ -558,16 +611,18 @@ omgr_app_init(void)
 #endif
 
 /**
- * main
+ * mynewt_main
  *
  * The main task for the project. This function initializes the packages, calls
  * init_tasks to initialize additional tasks (and possibly other objects),
  * then starts serving events from default event queue.
  *
+ * Named mynewt_main because the BSP provides main().
+ *
  * @return int NOTE: this function should never return!
  */
 int
-main(int argc, char **argv)
+mynewt_main(int argc, char **argv)
 {
 #ifdef ARCH_sim
     mcu_sim_parse_args(argc, argv);

mynewt/custom_ca.h

@@ -0,0 +1,52 @@
+/* custom_ca.h
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL. (formerly known as CyaSSL)
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifndef CUSTOM_CA_H
+#define CUSTOM_CA_H
+
+/* Trust anchor for WOLFSSL_MN_USE_CUSTOM_CA=1.
+ *
+ * CA is pinned at compile time and must be manually updated if the target's chain changes.
+ * Hostname verification is enforced using DEFAULT_HOSTNAME in client-tls-mn.c.
+ *
+ * To configure:
+ * 1. Get root CA: openssl s_client -connect <host>:443 -servername <host> -showcerts </dev/null
+ * 2. Convert to DER: openssl x509 -in root.pem -outform der | xxd -i
+ * 3. Paste bytes below and update DEFAULT_IPADDR/DEFAULT_PORT/DEFAULT_HOSTNAME in client-tls-mn.c.
+ */
+
+#define CUSTOM_CA_PLACEHOLDER
+
+#ifdef CUSTOM_CA_PLACEHOLDER
+#error "mynewt/custom_ca.h: paste your target's root CA DER bytes into " \
+       "custom_ca_der[] and remove this #error before building with " \
+       "WOLFSSL_MN_USE_CUSTOM_CA=1 (see the instructions above)."
+#endif
+
+static const unsigned char custom_ca_der[] =
+{
+    /* TODO: paste your target's root CA DER bytes here */
+    0
+};
+
+static const int sizeof_custom_ca_der = sizeof(custom_ca_der);
+
+#endif /* CUSTOM_CA_H */