Skip to content

Commit 7d66cc4

Browse files
douzzerdouzzer
authored
Merge pull request #7375 from mrdeep1/fix_rpk
RPK: Define Certificates correctly for (D)TLS1.2
2 parents 2ba12a8 + f2e6f49 commit 7d66cc4

2 files changed

Lines changed: 116 additions & 21 deletions

File tree

‎examples/client/client.c‎

Lines changed: 56 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1103,7 +1103,7 @@ static int ClientWriteRead(WOLFSSL* ssl, const char* msg, int msgSz,
11031103
/* 4. add the same message into Japanese section */
11041104
/* (will be translated later) */
11051105
/* 5. add printf() into suitable position of Usage() */
1106-
static const char* client_usage_msg[][75] = {
1106+
static const char* client_usage_msg[][78] = {
11071107
/* English */
11081108
{
11091109
" NOTE: All files relative to wolfSSL home dir\n", /* 0 */
@@ -1318,9 +1318,13 @@ static const char* client_usage_msg[][75] = {
13181318
#ifndef NO_PSK
13191319
"--openssl-psk Use TLS 1.3 PSK callback compatible with OpenSSL\n", /* 74 */
13201320
#endif
1321+
#ifdef HAVE_RPK
1322+
"--rpk Use RPK for the defined certificates\n", /* 75 */
1323+
#endif
1324+
"--files-are-der Specified files are in DER, not PEM format\n", /* 76 */
13211325
"\n"
13221326
"For simpler wolfSSL TLS client examples, visit\n"
1323-
"https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n", /* 75 */
1327+
"https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n", /* 77 */
13241328
NULL,
13251329
},
13261330
#ifndef NO_MULTIBYTE_PRINT
@@ -1542,10 +1546,14 @@ static const char* client_usage_msg[][75] = {
15421546
#ifndef NO_PSK
15431547
"--openssl-psk Use TLS 1.3 PSK callback compatible with OpenSSL\n", /* 74 */
15441548
#endif
1549+
#ifdef HAVE_RPK
1550+
"--rpk Use RPK for the defined certificates\n", /* 75 */
1551+
#endif
1552+
"--files-are-der Specified files are in DER, not PEM format\n", /* 76 */
15451553
"\n"
15461554
"より簡単なwolfSSL TLS クライアントの例については"
15471555
"下記にアクセスしてください\n"
1548-
"https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n", /* 75 */
1556+
"https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n", /* 77 */
15491557
NULL,
15501558
},
15511559
#endif
@@ -1763,19 +1771,24 @@ static void Usage(void)
17631771
printf("%s", msg[++msgid]); /* Examples repo link */
17641772
#ifdef HAVE_PQC
17651773
printf("%s", msg[++msgid]); /* --pqc */
1766-
printf("%s", msg[++msgid]); /* --pqc options */
1767-
printf("%s", msg[++msgid]); /* more --pqc options */
1768-
printf("%s", msg[++msgid]); /* more --pqc options */
1774+
#endif
1775+
#ifdef WOLFSSL_SRTP
1776+
printf("%s", msg[++msgid]); /* dtls-srtp */
17691777
#endif
17701778
#ifdef WOLFSSL_SYS_CA_CERTS
17711779
printf("%s", msg[++msgid]); /* --sys-ca-certs */
17721780
#endif
17731781
#ifdef HAVE_SUPPORTED_CURVES
17741782
printf("%s", msg[++msgid]); /* --onlyPskDheKe */
17751783
#endif
1776-
#ifdef WOLFSSL_SRTP
1777-
printf("%s", msg[++msgid]); /* dtls-srtp */
1784+
#ifndef NO_PSK
1785+
printf("%s", msg[++msgid]); /* --openssl-psk */
17781786
#endif
1787+
#ifdef HAVE_RPK
1788+
printf("%s", msg[++msgid]); /* --rpk */
1789+
#endif
1790+
printf("%s", msg[++msgid]); /* --files-are-der */
1791+
printf("%s", msg[++msgid]); /* Documentation Hint */
17791792
}
17801793

17811794
#ifdef WOLFSSL_SRTP
@@ -1919,6 +1932,10 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
19191932
{ "openssl-psk", 0, 265 },
19201933
#endif
19211934
{ "quieter", 0, 266 },
1935+
#ifdef HAVE_RPK
1936+
{ "rpk", 0, 267 },
1937+
#endif /* HAVE_RPK */
1938+
{ "files-are-der", 0, 268 },
19221939
{ 0, 0, 0 }
19231940
};
19241941
#endif
@@ -2059,6 +2076,10 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
20592076
int useDtlsCID = 0;
20602077
char dtlsCID[DTLS_CID_BUFFER_SIZE] = { 0 };
20612078
#endif /* WOLFSSL_DTLS_CID */
2079+
#ifdef HAVE_RPK
2080+
int useRPK = 0;
2081+
#endif /* HAVE_RPK */
2082+
int fileFormat = WOLFSSL_FILETYPE_PEM;
20622083

20632084
char buffer[WOLFSSL_MAX_ERROR_SZ];
20642085

@@ -2767,6 +2788,14 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
27672788
case 266:
27682789
quieter = 1;
27692790
break;
2791+
case 267:
2792+
#ifdef HAVE_RPK
2793+
useRPK = 1;
2794+
#endif /* HAVE_RPK */
2795+
break;
2796+
case 268:
2797+
fileFormat = WOLFSSL_FILETYPE_ASN1;
2798+
break;
27702799
default:
27712800
Usage();
27722801
XEXIT_T(MY_EX_USAGE);
@@ -3140,6 +3169,21 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
31403169
}
31413170
#endif
31423171

3172+
#ifdef HAVE_RPK
3173+
if (useRPK) {
3174+
char ctype[] = {WOLFSSL_CERT_TYPE_RPK};
3175+
char stype[] = {WOLFSSL_CERT_TYPE_RPK};
3176+
3177+
wolfSSL_CTX_set_client_cert_type(ctx, ctype, sizeof(ctype)/sizeof(ctype[0]));
3178+
wolfSSL_CTX_set_server_cert_type(ctx, stype, sizeof(stype)/sizeof(stype[0]));
3179+
usePsk = 0;
3180+
#ifdef HAVE_CRL
3181+
disableCRL = 1;
3182+
#endif
3183+
doPeerCheck = 0;
3184+
}
3185+
#endif /* HAVE_RPK */
3186+
31433187
if (usePsk) {
31443188
#ifndef NO_PSK
31453189
const char *defaultCipherList = cipherList;
@@ -3272,7 +3316,7 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
32723316
WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS)
32733317
err_sys("can't load client cert buffer");
32743318
#elif !defined(TEST_LOAD_BUFFER)
3275-
if (wolfSSL_CTX_use_certificate_chain_file(ctx, ourCert)
3319+
if (wolfSSL_CTX_use_certificate_chain_file_format(ctx, ourCert, fileFormat)
32763320
!= WOLFSSL_SUCCESS) {
32773321
wolfSSL_CTX_free(ctx); ctx = NULL;
32783322
err_sys("can't load client cert file, check file and run from"
@@ -3296,7 +3340,7 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
32963340
sizeof_client_key_der_2048, SSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS)
32973341
err_sys("can't load client private key buffer");
32983342
#elif !defined(TEST_LOAD_BUFFER)
3299-
if (wolfSSL_CTX_use_PrivateKey_file(ctx, ourKey, WOLFSSL_FILETYPE_PEM)
3343+
if (wolfSSL_CTX_use_PrivateKey_file(ctx, ourKey, fileFormat)
33003344
!= WOLFSSL_SUCCESS) {
33013345
wolfSSL_CTX_free(ctx); ctx = NULL;
33023346
err_sys("can't load client private key file, check file and run "
@@ -3593,7 +3637,7 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
35933637
err_sys("can't load client cert buffer");
35943638
}
35953639
#elif !defined(TEST_LOAD_BUFFER)
3596-
if (wolfSSL_use_certificate_chain_file(ssl, ourCert)
3640+
if (wolfSSL_use_certificate_chain_file_format(ssl, ourCert, fileFormat)
35973641
!= WOLFSSL_SUCCESS) {
35983642
wolfSSL_CTX_free(ctx); ctx = NULL;
35993643
err_sys("can't load client cert file, check file and run from"
@@ -3614,7 +3658,7 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
36143658
sizeof_client_key_der_2048, SSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS)
36153659
err_sys("can't load client private key buffer");
36163660
#elif !defined(TEST_LOAD_BUFFER)
3617-
if (wolfSSL_use_PrivateKey_file(ssl, ourKey, WOLFSSL_FILETYPE_PEM)
3661+
if (wolfSSL_use_PrivateKey_file(ssl, ourKey, fileFormat)
36183662
!= WOLFSSL_SUCCESS) {
36193663
wolfSSL_CTX_free(ctx); ctx = NULL;
36203664
err_sys("can't load client private key file, check file and run "

‎src/internal.c‎

Lines changed: 60 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14295,7 +14295,25 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
1429514295
ERROR_OUT(BUFFER_ERROR, exit_ppc);
1429614296
}
1429714297
c24to32(input + args->idx, &listSz);
14298-
args->idx += OPAQUE24_LEN;
14298+
#ifdef HAVE_RPK
14299+
/*
14300+
* If this is RPK from the peer, then single cert (if TLS1.2).
14301+
* So, ListSz location is same as CertSz location, so fake
14302+
* we have just seen this ListSz.
14303+
*/
14304+
if (!IsAtLeastTLSv1_3(ssl->version) &&
14305+
((ssl->options.side == WOLFSSL_SERVER_END &&
14306+
ssl->options.rpkState.received_ClientCertTypeCnt == 1 &&
14307+
ssl->options.rpkState.received_ClientCertTypes[0] == WOLFSSL_CERT_TYPE_RPK) ||
14308+
(ssl->options.side == WOLFSSL_CLIENT_END &&
14309+
ssl->options.rpkState.received_ServerCertTypeCnt == 1 &&
14310+
ssl->options.rpkState.received_ServerCertTypes[0] == WOLFSSL_CERT_TYPE_RPK))) {
14311+
listSz += OPAQUE24_LEN;
14312+
} else
14313+
#endif /* HAVE_RPK */
14314+
{
14315+
args->idx += OPAQUE24_LEN;
14316+
}
1429914317
if (listSz > MAX_CERTIFICATE_SZ) {
1430014318
ERROR_OUT(BUFFER_ERROR, exit_ppc);
1430114319
}
@@ -23083,6 +23101,9 @@ int SendCertificate(WOLFSSL* ssl)
2308323101
int ret = 0;
2308423102
word32 certSz, certChainSz, headerSz, listSz, payloadSz;
2308523103
word32 length, maxFragment;
23104+
#ifdef HAVE_RPK
23105+
int usingRpkTls12 = 0;
23106+
#endif /* HAVE_RPK */
2308623107

2308723108
WOLFSSL_START(WC_FUNC_CERTIFICATE_SEND);
2308823109
WOLFSSL_ENTER("SendCertificate");
@@ -23092,6 +23113,21 @@ int SendCertificate(WOLFSSL* ssl)
2309223113
return 0; /* not needed */
2309323114
}
2309423115

23116+
#ifdef HAVE_RPK
23117+
if (!IsAtLeastTLSv1_3(ssl->version)) {
23118+
/* If this is (D)TLS1.2 and RPK, then single cert, not list. */
23119+
if (ssl->options.side == WOLFSSL_SERVER_END) {
23120+
if (ssl->options.rpkState.sending_ServerCertTypeCnt == 1 &&
23121+
ssl->options.rpkState.sending_ServerCertTypes[0] == WOLFSSL_CERT_TYPE_RPK)
23122+
usingRpkTls12 = 1;
23123+
} else if (ssl->options.side == WOLFSSL_CLIENT_END) {
23124+
if (ssl->options.rpkState.sending_ClientCertTypeCnt == 1 &&
23125+
ssl->options.rpkState.sending_ClientCertTypes[0] == WOLFSSL_CERT_TYPE_RPK)
23126+
usingRpkTls12 = 1;
23127+
}
23128+
}
23129+
#endif /* HAVE_RPK */
23130+
2309523131
if (ssl->options.sendVerify == SEND_BLANK_CERT) {
2309623132
#ifdef OPENSSL_EXTRA
2309723133
if (ssl->version.major == SSLv3_MAJOR
@@ -23114,10 +23150,19 @@ int SendCertificate(WOLFSSL* ssl)
2311423150
return BUFFER_ERROR;
2311523151
}
2311623152
certSz = ssl->buffers.certificate->length;
23117-
headerSz = 2 * CERT_HEADER_SZ;
23153+
#ifdef HAVE_RPK
23154+
if (usingRpkTls12) {
23155+
headerSz = 1 * CERT_HEADER_SZ;
23156+
listSz = certSz;
23157+
} else {
23158+
#endif /* HAVE_RPK */
23159+
headerSz = 2 * CERT_HEADER_SZ;
23160+
listSz = certSz + CERT_HEADER_SZ;
23161+
#ifdef HAVE_RPK
23162+
}
23163+
#endif /* HAVE_RPK */
2311823164
/* list + cert size */
2311923165
length = certSz + headerSz;
23120-
listSz = certSz + CERT_HEADER_SZ;
2312123166

2312223167
/* may need to send rest of chain, already has leading size(s) */
2312323168
if (certSz && ssl->buffers.certChain) {
@@ -23210,12 +23255,18 @@ int SendCertificate(WOLFSSL* ssl)
2321023255
}
2321123256

2321223257
/* list total */
23213-
c32to24(listSz, output + i);
23214-
if (ssl->options.dtls || !IsEncryptionOn(ssl, 1))
23215-
HashRaw(ssl, output + i, CERT_HEADER_SZ);
23216-
i += CERT_HEADER_SZ;
23217-
length -= CERT_HEADER_SZ;
23218-
fragSz -= CERT_HEADER_SZ;
23258+
#ifdef HAVE_RPK
23259+
if (!usingRpkTls12) {
23260+
#endif /* HAVE_RPK */
23261+
c32to24(listSz, output + i);
23262+
if (ssl->options.dtls || !IsEncryptionOn(ssl, 1))
23263+
HashRaw(ssl, output + i, CERT_HEADER_SZ);
23264+
i += CERT_HEADER_SZ;
23265+
length -= CERT_HEADER_SZ;
23266+
fragSz -= CERT_HEADER_SZ;
23267+
#ifdef HAVE_RPK
23268+
}
23269+
#endif /* HAVE_RPK */
2321923270
if (certSz) {
2322023271
c32to24(certSz, output + i);
2322123272
if (ssl->options.dtls || !IsEncryptionOn(ssl, 1))

0 commit comments

Comments
 (0)