Skip to content

Add support for raw-public-key#6544

Merged
JacobBarthelmeh merged 1 commit intowolfSSL:masterfrom
TakayukiMatsuo:rpk
Aug 17, 2023
Merged

Add support for raw-public-key#6544
JacobBarthelmeh merged 1 commit intowolfSSL:masterfrom
TakayukiMatsuo:rpk

Conversation

@TakayukiMatsuo
Copy link
Copy Markdown
Contributor

@TakayukiMatsuo TakayukiMatsuo commented Jun 26, 2023

Description

This PR intend to add support for raw public key(rfc7250) and includes following features:
- Introduced a macro definition "HAVE_RPK" to show RPK support.
- Introduced APIs for setting user preference to client(server)_certificate_type extensions.
- Introduced APIs for getting negotiated client(server)_certificate_type extensions.
- Added Raw-Public-Key-certs in to certs/rpk for testing.
- Extended existing APIs for loading own RPK certificate to accept RPK cert in buffer.
- Added unit test cases for added APIs.

The peer RPK cert received is accepted without any verification. If users want to add their own verification, build with WOLFSSL_ALWAYS_VERIFY_CB macro and set verify callback via wolfSSL_CTX_set_verify.

Testing

  • Added unit test cases checks APIs and performs handshake with raw public key cert certs.
  • Inter-op test with gnutls-cli/gnutls-serv v3.6.13 apps.

Checklist

  • added tests
  • updated/added doxygen
  • updated appropriate READMEs
  • Updated manual and documentation

@cconlon
Copy link
Copy Markdown
Member

cconlon commented Jul 24, 2023

Assigning to @JacobBarthelmeh and @SparkiDev for reviews as well.

Comment thread src/tls.c Outdated
Comment thread src/tls.c Outdated
Comment thread src/tls.c Outdated
Comment thread src/tls.c Outdated
Comment thread src/tls.c Outdated
Comment thread src/tls.c Outdated
Comment thread src/tls.c Outdated
Comment thread src/tls.c Outdated
Comment thread src/tls.c Outdated
Comment thread tests/api.c Outdated
Comment thread certs/rpk/include.am Outdated
Comment thread src/ssl.c Outdated
Comment thread src/ssl.c Outdated
@TakayukiMatsuo
Copy link
Copy Markdown
Contributor Author

Jenkins retest this please

Comment thread wolfcrypt/src/asn.c Outdated
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@TakayukiMatsuo should this be cert->isRPK ?

I was testing the RPK feature in RIOT-OS and I got the following error: wolfssl/wolfcrypt/src/asn.c:15205:13: error: 'cert' is a pointer; did you mean to use '->'?

Copy link
Copy Markdown

@geonnave geonnave Aug 9, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In fact, even after changing . to ->, I realized that the RPK configuration does not work unless WOLFSSL_ASN_TEMPLATE is defined:

# to reproduce, make sure WOLFSSL_ASN_TEMPLATE is undefined
$ make && ./tests/unit.test -test_tls13_rpk_handshake
...
processing certificate
wolfSSL Entering DoTls13Certificate
wolfSSL Entering ProcessPeerCerts
Loading peer's cert chain
        Parsing 0 bytes of cert extensions
        Put another cert into chain
Verifying Peer's cert
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId
wolfSSL Entering GetObjectId
Parsed Past Key
Buffer too small for ASN tag
Got Peer cert ASN PARSE_E, BUFFER E, MEMORY_E
wolfSSL Leaving ProcessPeerCerts, return -140
wolfSSL Leaving DoTls13Certificate, return -140
wolfSSL Leaving DoTls13HandShakeMsgType(), return -140
wolfSSL Leaving DoTls13HandShakeMsg, return -140
wolfSSL error occurred, error = -140
wolfSSL error occurred, error = -140
wolfSSL Entering wolfSSL_get_error
wolfSSL Leaving wolfSSL_get_error, return -140
 failed (  0.00419)

ERROR - tests/api.c line 65599 failed with:
    expected: Test failed

    result:   ret 0

wolfSSL Entering wolfSSL_Cleanup
wolfSSL Entering wolfCrypt_Cleanup

FAILURES:
   816: test_tls13_rpk_handshake

 End API Tests

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @geonnave, thank you for heads-up. Fixed what you pointed out and addressed the case when WOLFSSL_ASN_TEMPLATE is not defined.

@JacobBarthelmeh JacobBarthelmeh merged commit cc4e327 into wolfSSL:master Aug 17, 2023
@TakayukiMatsuo TakayukiMatsuo deleted the rpk branch August 24, 2023 04:20
@douzzer douzzer mentioned this pull request Apr 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants