Skip to content

Commit b375acd

Browse files
anhuanhu
committed
Better guarding, better commenting, remove irrelevant code
1 parent 4b84114 commit b375acd

2 files changed

Lines changed: 26 additions & 167 deletions

File tree

‎tls/client-tls-posthsauth.c‎

Lines changed: 11 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -36,81 +36,13 @@
3636
#include <wolfssl/wolfio.h>
3737
#include <wolfssl/wolfcrypt/error-crypt.h>
3838

39+
#ifdef WOLFSSL_POST_HANDSHAKE_AUTH
3940
#define DEFAULT_PORT 11111
4041

4142
#define CERT_FILE "../certs/client-cert.pem"
4243
#define KEY_FILE "../certs/client-key.pem"
4344
#define CA_FILE "../certs/ca-cert.pem"
4445

45-
#if defined(WOLFSSL_TLS13) && defined(HAVE_SECRET_CALLBACK)
46-
47-
#ifndef WOLFSSL_SSLKEYLOGFILE_OUTPUT
48-
#define WOLFSSL_SSLKEYLOGFILE_OUTPUT "sslkeylog.log"
49-
#endif
50-
51-
/* Callback function for TLS v1.3 secrets for use with Wireshark */
52-
static int Tls13SecretCallback(WOLFSSL* ssl, int id, const unsigned char* secret,
53-
int secretSz, void* ctx)
54-
{
55-
int i;
56-
const char* str = NULL;
57-
unsigned char clientRandom[32];
58-
int clientRandomSz;
59-
XFILE fp = stderr;
60-
if (ctx) {
61-
fp = XFOPEN((const char*)ctx, "ab");
62-
if (fp == XBADFILE) {
63-
return BAD_FUNC_ARG;
64-
}
65-
}
66-
67-
clientRandomSz = (int)wolfSSL_get_client_random(ssl, clientRandom,
68-
sizeof(clientRandom));
69-
70-
if (clientRandomSz <= 0) {
71-
printf("Error getting client random %d\n", clientRandomSz);
72-
}
73-
74-
#if 0
75-
printf("TLS Client Secret CB: Rand %d, Secret %d\n",
76-
clientRandomSz, secretSz);
77-
#endif
78-
79-
switch (id) {
80-
case CLIENT_EARLY_TRAFFIC_SECRET:
81-
str = "CLIENT_EARLY_TRAFFIC_SECRET"; break;
82-
case EARLY_EXPORTER_SECRET:
83-
str = "EARLY_EXPORTER_SECRET"; break;
84-
case CLIENT_HANDSHAKE_TRAFFIC_SECRET:
85-
str = "CLIENT_HANDSHAKE_TRAFFIC_SECRET"; break;
86-
case SERVER_HANDSHAKE_TRAFFIC_SECRET:
87-
str = "SERVER_HANDSHAKE_TRAFFIC_SECRET"; break;
88-
case CLIENT_TRAFFIC_SECRET:
89-
str = "CLIENT_TRAFFIC_SECRET_0"; break;
90-
case SERVER_TRAFFIC_SECRET:
91-
str = "SERVER_TRAFFIC_SECRET_0"; break;
92-
case EXPORTER_SECRET:
93-
str = "EXPORTER_SECRET"; break;
94-
}
95-
96-
fprintf(fp, "%s ", str);
97-
for (i = 0; i < clientRandomSz; i++) {
98-
fprintf(fp, "%02x", clientRandom[i]);
99-
}
100-
fprintf(fp, " ");
101-
for (i = 0; i < secretSz; i++) {
102-
fprintf(fp, "%02x", secret[i]);
103-
}
104-
fprintf(fp, "\n");
105-
106-
if (fp != stderr) {
107-
XFCLOSE(fp);
108-
}
109-
110-
return 0;
111-
}
112-
#endif /* WOLFSSL_TLS13 && HAVE_SECRET_CALLBACK */
113-
11446
int main(int argc, char** argv)
11547
{
11648
int ret = 0;
@@ -201,6 +133,7 @@ int main(int argc, char** argv)
201133
goto exit;
202134
}
203135

136+
/* POSTHSAUTH: Prepare for post-handshake authentication. */
204137
if ((ret = wolfSSL_CTX_allow_post_handshake_auth(ctx)) != 0) {
205138
fprintf(stderr, "ERROR: failed to allow post hand-shake auth.\n");
206139
goto exit;
@@ -218,25 +151,12 @@ int main(int argc, char** argv)
218151
goto exit;
219152
}
220153

221-
#ifdef HAVE_SECRET_CALLBACK
222-
/* required for getting random used */
223-
wolfSSL_KeepArrays(ssl);
224-
225-
/* optional logging for wireshark */
226-
wolfSSL_set_tls13_secret_cb(ssl, Tls13SecretCallback,
227-
(void*)WOLFSSL_SSLKEYLOGFILE_OUTPUT);
228-
#endif
229-
230154
/* Connect to wolfSSL on the server side */
231155
if ((ret = wolfSSL_connect(ssl)) != WOLFSSL_SUCCESS) {
232156
fprintf(stderr, "ERROR: failed to connect to wolfSSL\n");
233157
goto exit;
234158
}
235159

236-
#ifdef HAVE_SECRET_CALLBACK
237-
wolfSSL_FreeArrays(ssl);
238-
#endif
239-
240160
/* Get a message for the server from stdin */
241161
printf("Message for server: ");
242162
memset(buff, 0, sizeof(buff));
@@ -263,7 +183,8 @@ int main(int argc, char** argv)
263183
/* Print to stdout any data the server sends */
264184
printf("Server: %s\n", buff);
265185

266-
/* Send the second message to the server */
186+
/* POSTHSAUTH: Send the second message to the server. This message is now
187+
* authenticated. */
267188
memset(buff, 0, sizeof(buff));
268189
memcpy(buff, "Hello again from the client\n", 28);
269190
len = strnlen(buff, sizeof(buff));
@@ -294,3 +215,10 @@ int main(int argc, char** argv)
294215

295216
return ret;
296217
}
218+
#else
219+
int main() {
220+
fprintf(stderr, "Please configure with --enable-postauth or compile with "
221+
"WOLFSSL_POST_HANDSHAKE_AUTH defined.\n");
222+
return 0;
223+
}
224+
#endif /* WOLFSSL_POST_HANDSHAKE_AUTH */

‎tls/server-tls-posthsauth.c‎

Lines changed: 15 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -41,82 +41,14 @@
4141
#include <wolfssl/wolfio.h>
4242
#include <wolfssl/wolfcrypt/error-crypt.h>
4343

44+
#ifdef WOLFSSL_POST_HANDSHAKE_AUTH
4445
#define DEFAULT_PORT 11111
4546

4647
#define CERT_FILE "../certs/server-cert.pem"
4748
#define KEY_FILE "../certs/server-key.pem"
4849
#define CA_FILE "../certs/client-cert.pem"
4950

5051

51-
#if defined(WOLFSSL_TLS13) && defined(HAVE_SECRET_CALLBACK)
52-
53-
#ifndef WOLFSSL_SSLKEYLOGFILE_OUTPUT
54-
#define WOLFSSL_SSLKEYLOGFILE_OUTPUT "sslkeylog.log"
55-
#endif
56-
57-
/* Callback function for TLS v1.3 secrets for use with Wireshark */
58-
static int Tls13SecretCallback(WOLFSSL* ssl, int id, const unsigned char* secret,
59-
int secretSz, void* ctx)
60-
{
61-
int i;
62-
const char* str = NULL;
63-
unsigned char serverRandom[32];
64-
int serverRandomSz;
65-
XFILE fp = stderr;
66-
if (ctx) {
67-
fp = XFOPEN((const char*)ctx, "ab");
68-
if (fp == XBADFILE) {
69-
return BAD_FUNC_ARG;
70-
}
71-
}
72-
73-
serverRandomSz = (int)wolfSSL_get_server_random(ssl, serverRandom,
74-
sizeof(serverRandom));
75-
76-
if (serverRandomSz <= 0) {
77-
printf("Error getting server random %d\n", serverRandomSz);
78-
}
79-
80-
#if 0
81-
printf("TLS Server Secret CB: Rand %d, Secret %d\n",
82-
serverRandomSz, secretSz);
83-
#endif
84-
85-
switch (id) {
86-
case CLIENT_EARLY_TRAFFIC_SECRET:
87-
str = "CLIENT_EARLY_TRAFFIC_SECRET"; break;
88-
case EARLY_EXPORTER_SECRET:
89-
str = "EARLY_EXPORTER_SECRET"; break;
90-
case CLIENT_HANDSHAKE_TRAFFIC_SECRET:
91-
str = "CLIENT_HANDSHAKE_TRAFFIC_SECRET"; break;
92-
case SERVER_HANDSHAKE_TRAFFIC_SECRET:
93-
str = "SERVER_HANDSHAKE_TRAFFIC_SECRET"; break;
94-
case CLIENT_TRAFFIC_SECRET:
95-
str = "CLIENT_TRAFFIC_SECRET_0"; break;
96-
case SERVER_TRAFFIC_SECRET:
97-
str = "SERVER_TRAFFIC_SECRET_0"; break;
98-
case EXPORTER_SECRET:
99-
str = "EXPORTER_SECRET"; break;
100-
}
101-
102-
fprintf(fp, "%s ", str);
103-
for (i = 0; i < (int)serverRandomSz; i++) {
104-
fprintf(fp, "%02x", serverRandom[i]);
105-
}
106-
fprintf(fp, " ");
107-
for (i = 0; i < secretSz; i++) {
108-
fprintf(fp, "%02x", secret[i]);
109-
}
110-
fprintf(fp, "\n");
111-
112-
if (fp != stderr) {
113-
XFCLOSE(fp);
114-
}
115-
116-
return 0;
117-
}
118-
#endif /* WOLFSSL_TLS13 && HAVE_SECRET_CALLBACK */
119-
12052
static int mSockfd = SOCKET_INVALID;
12153
static int mConnd = SOCKET_INVALID;
12254
static int mShutdown = 0;
@@ -216,7 +148,8 @@ int main(int argc, char** argv)
216148
goto exit;
217149
}
218150

219-
/* No verification during handshake. Will be doing it post handshake. */
151+
/* POSTHSAUTH: No verification during handshake. Will be doing it post
152+
* handshake. */
220153
wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL);
221154

222155
/* Load server certificates into WOLFSSL_CTX */
@@ -263,15 +196,6 @@ int main(int argc, char** argv)
263196
/* Attach wolfSSL to the socket */
264197
wolfSSL_set_fd(ssl, mConnd);
265198

266-
#ifdef HAVE_SECRET_CALLBACK
267-
/* required for getting random used */
268-
wolfSSL_KeepArrays(ssl);
269-
270-
/* optional logging for wireshark */
271-
wolfSSL_set_tls13_secret_cb(ssl, Tls13SecretCallback,
272-
(void*)WOLFSSL_SSLKEYLOGFILE_OUTPUT);
273-
#endif
274-
275199
/* Establish TLS connection */
276200
if ((ret = wolfSSL_accept(ssl)) != WOLFSSL_SUCCESS) {
277201
fprintf(stderr, "wolfSSL_accept error = %d\n",
@@ -281,10 +205,6 @@ int main(int argc, char** argv)
281205

282206
printf("Client connected successfully\n");
283207

284-
#ifdef HAVE_SECRET_CALLBACK
285-
wolfSSL_FreeArrays(ssl);
286-
#endif
287-
288208
/* Read the client data into our buff array */
289209
memset(buff, 0, sizeof(buff));
290210
if ((ret = wolfSSL_read(ssl, buff, sizeof(buff)-1)) < 0) {
@@ -301,9 +221,12 @@ int main(int argc, char** argv)
301221
mShutdown = 1;
302222
}
303223

224+
/* POSTHSAUTH: Require the client to send over their certificate; fail
225+
* if we cannot verify the client. */
304226
wolfSSL_set_verify(ssl,
305227
WOLFSSL_VERIFY_PEER | WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT, 0);
306228

229+
/* POSTHSAUTH: Request the certficate and do the verification. */
307230
if (wolfSSL_request_certificate(ssl) != WOLFSSL_SUCCESS) {
308231
fprintf(stderr, "ERROR: Request for post-hs certificate failed\n");
309232
goto exit;
@@ -323,7 +246,8 @@ int main(int argc, char** argv)
323246
goto exit;
324247
}
325248

326-
/* Read second message into our buff array */
249+
/* POSTHSAUTH: Read second message into our buff array. This is now
250+
* authenticated. */
327251
memset(buff, 0, sizeof(buff));
328252
if ((ret = wolfSSL_read(ssl, buff, sizeof(buff)-1)) < 0) {
329253
fprintf(stderr, "ERROR: failed to read\n");
@@ -372,3 +296,10 @@ int main(int argc, char** argv)
372296

373297
return ret;
374298
}
299+
#else
300+
int main() {
301+
fprintf(stderr, "Please configure with --enable-postauth or compile with "
302+
"WOLFSSL_POST_HANDSHAKE_AUTH defined.\n");
303+
return 0;
304+
}
305+
#endif /* WOLFSSL_POST_HANDSHAKE_AUTH */

0 commit comments

Comments
 (0)