Fixes for TLS v1.3 and x25519 non-blocking crypto

Author: dgarske

.github/workflows/async-examples.yml

@@ -24,25 +24,63 @@ jobs:
           make -C examples/async clean
           make -C examples/async
 
-      - name: Run async examples (ECC + X25519)
+      - name: Run async examples
         run: |
           set -euo pipefail
+
+          MIN_PENDING=100
+
           run_pair() {
-            local mode="$1"
-            local ready="/tmp/wolfssl_async_ready_${mode}"
+            local label="$1"
+            shift
+            local args="$*"
+            local ready="/tmp/wolfssl_async_ready_${label}"
             rm -f "$ready"
+
             WOLFSSL_ASYNC_READYFILE="$ready" \
-              ./examples/async/async_server --"$mode" > "/tmp/async_server_${mode}.log" 2>&1 &
+              ./examples/async/async_server $args \
+              > "/tmp/async_server_${label}.log" 2>&1 &
             local pid=$!
+
             WOLFSSL_ASYNC_READYFILE="$ready" \
-              ./examples/async/async_client --"$mode" 127.0.0.1 11111 > "/tmp/async_client_${mode}.log" 2>&1
+              ./examples/async/async_client $args 127.0.0.1 11111 \
+              > "/tmp/async_client_${label}.log" 2>&1
             local rc=$?
+
             kill "$pid" >/dev/null 2>&1 || true
             wait "$pid" >/dev/null 2>&1 || true
-            return "$rc"
+
+            if [ "$rc" -ne 0 ]; then
+              echo "FAIL: $label (exit=$rc)"
+              return 1
+            fi
+
+            # Validate WC_PENDING_E count is a proper value
+            local count
+            count=$(awk '/WC_PENDING_E count:/ {print $NF}' \
+              "/tmp/async_client_${label}.log")
+            if [ -z "$count" ] || [ "$count" -lt "$MIN_PENDING" ]; then
+              echo "FAIL: $label - WC_PENDING_E count too low:" \
+                "${count:-missing} (expected >= $MIN_PENDING)"
+              return 1
+            fi
+            echo "PASS: $label (WC_PENDING_E: $count)"
+            return 0
           }
-          run_pair ecc
-          run_pair x25519
+
+          # TLS 1.3
+          run_pair ecc_tls13              --ecc
+          run_pair x25519_tls13           --x25519
+
+          # TLS 1.2
+          run_pair ecc_tls12              --tls12 --ecc
+          run_pair x25519_tls12           --tls12 --x25519
+
+          # BELOW ARE NOT WORKING YET
+          # TLS 1.3 mutual auth
+          #run_pair ecc_tls13_mutual       --mutual --ecc
+          #run_pair x25519_tls13_mutual    --mutual --x25519
+
 
       - name: Print async logs
         if: ${{ failure() }}

.github/workflows/os-check.yml

@@ -81,7 +81,8 @@ jobs:
           '--enable-all CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH',
           '--enable-all CPPFLAGS=''-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH''',
           '--enable-all CPPFLAGS=''-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH''',
-          '--enable-curve25519=nonblock --enable-ecc=nonblock --enable-sp=yes,nonblock CFLAGS="-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK"',
+          '--enable-curve25519=nonblock --enable-ecc=nonblock --enable-sp=yes,nonblock CPPFLAGS="-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK"',
+          '--enable-certreq --enable-certext --enable-certgen --disable-secure-renegotiation-info CPPFLAGS="-DNO_TLS"',
         ]
     name: make check
     if: github.repository_owner == 'wolfssl'

examples/async/async_client.c

@@ -52,6 +52,7 @@
 #include <wolfssl/ssl.h>
 #include <wolfssl/wolfio.h>
 #include <wolfssl/wolfcrypt/error-crypt.h>
+#include <wolfssl/certs_test.h>
 #include "examples/async/async_tls.h"
 
 /* ------------------------------------------------------------------ */
@@ -154,7 +155,8 @@ static int posix_net_connect(const char* host, int port)
 /* ------------------------------------------------------------------ */
 static void usage(const char* prog)
 {
-    printf("usage: %s [--ecc|--x25519] [host] [port]\n", prog);
+    printf("usage: %s [--ecc|--x25519] [--mutual] [--tls12] [host] [port]\n",
+        prog);
 }
 
 static const char* group_name(word16 group)
@@ -170,7 +172,7 @@ static const char* group_name(word16 group)
 }
 
 static int parse_client_args(int argc, char** argv,
-    const char** host, int* port, word16* group)
+    const char** host, int* port, word16* group, int* mutual, int* tls12)
 {
     int i;
     int host_set = 0;
@@ -179,6 +181,8 @@ static int parse_client_args(int argc, char** argv,
     *host = DEFAULT_TLS_HOST;
     *port = DEFAULT_TLS_PORT;
     *group = WOLFSSL_ECC_SECP256R1;
+    *mutual = 0;
+    *tls12 = 0;
 
     for (i = 1; i < argc; i++) {
         if (XSTRCMP(argv[i], "--ecc") == 0) {
@@ -187,6 +191,12 @@ static int parse_client_args(int argc, char** argv,
         else if (XSTRCMP(argv[i], "--x25519") == 0) {
             *group = WOLFSSL_ECC_X25519;
         }
+        else if (XSTRCMP(argv[i], "--mutual") == 0) {
+            *mutual = 1;
+        }
+        else if (XSTRCMP(argv[i], "--tls12") == 0) {
+            *tls12 = 1;
+        }
         else if (XSTRCMP(argv[i], "--help") == 0) {
             return -1;
         }
@@ -227,13 +237,17 @@ int client_async_test(int argc, char** argv)
     int port = 0;
     word16 group = WOLFSSL_ECC_SECP256R1;
     const char* mode = NULL;
+    int mutual = 0;
+    int tls12 = 0;
 
-    if (parse_client_args(argc, argv, &host, &port, &group) != 0) {
+    if (parse_client_args(argc, argv, &host, &port, &group, &mutual,
+            &tls12) != 0) {
         usage(argv[0]);
         return 0;
     }
     mode = group_name(group);
-    printf("Async client mode: %s (keyshare 0x%04x)\n", mode, group);
+    printf("Async client mode: %s, TLS %s%s\n", mode,
+        tls12 ? "1.2" : "1.3", mutual ? ", mutual auth" : "");
 
     {
         const char* ready = getenv(WOLFSSL_ASYNC_READYFILE_ENV);
@@ -259,16 +273,71 @@ int client_async_test(int argc, char** argv)
     }
 #endif
 
-    ctx = wolfSSL_CTX_new(wolfSSLv23_client_method());
+#ifndef WOLFSSL_NO_TLS12
+    if (tls12)
+        ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method());
+    else
+#endif
+        ctx = wolfSSL_CTX_new(wolfSSLv23_client_method());
     if (ctx == NULL) {
         goto out;
     }
 #ifdef WOLFSSL_ASYNC_CRYPT
     wolfSSL_CTX_SetDevId(ctx, devId);
 #endif
 
-    /* Bare-metal style: disable verification unless you load CA/peer certs. */
-    wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL);
+    if (mutual) {
+        if (group == WOLFSSL_ECC_X25519) {
+        #ifdef HAVE_ED25519
+            ret = wolfSSL_CTX_load_verify_buffer(ctx, ca_ed25519_cert,
+                sizeof_ca_ed25519_cert, WOLFSSL_FILETYPE_ASN1);
+            if (ret != WOLFSSL_SUCCESS) {
+                fprintf(stderr, "ERROR: failed to load ED25519 CA cert.\n");
+                goto out;
+            }
+            ret = wolfSSL_CTX_use_certificate_buffer(ctx, client_ed25519_cert,
+                sizeof_client_ed25519_cert, WOLFSSL_FILETYPE_ASN1);
+            if (ret != WOLFSSL_SUCCESS) {
+                fprintf(stderr, "ERROR: failed to load ED25519 client cert.\n");
+                goto out;
+            }
+            ret = wolfSSL_CTX_use_PrivateKey_buffer(ctx, client_ed25519_key,
+                sizeof_client_ed25519_key, WOLFSSL_FILETYPE_ASN1);
+            if (ret != WOLFSSL_SUCCESS) {
+                fprintf(stderr, "ERROR: failed to load ED25519 client key.\n");
+                goto out;
+            }
+        #else
+            fprintf(stderr,
+                "ERROR: --x25519 --mutual requires HAVE_ED25519\n");
+            goto out;
+        #endif
+        }
+        else {
+            ret = wolfSSL_CTX_load_verify_buffer(ctx, ca_ecc_cert_der_256,
+                sizeof_ca_ecc_cert_der_256, WOLFSSL_FILETYPE_ASN1);
+            if (ret != WOLFSSL_SUCCESS) {
+                fprintf(stderr, "ERROR: failed to load ECC CA cert.\n");
+                goto out;
+            }
+            ret = wolfSSL_CTX_use_certificate_buffer(ctx, cliecc_cert_der_256,
+                sizeof_cliecc_cert_der_256, WOLFSSL_FILETYPE_ASN1);
+            if (ret != WOLFSSL_SUCCESS) {
+                fprintf(stderr, "ERROR: failed to load ECC client cert.\n");
+                goto out;
+            }
+            ret = wolfSSL_CTX_use_PrivateKey_buffer(ctx, ecc_clikey_der_256,
+                sizeof_ecc_clikey_der_256, WOLFSSL_FILETYPE_ASN1);
+            if (ret != WOLFSSL_SUCCESS) {
+                fprintf(stderr, "ERROR: failed to load ECC client key.\n");
+                goto out;
+            }
+        }
+        wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, NULL);
+    }
+    else {
+        wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL);
+    }
 
     wolfSSL_SetIORecv(ctx, NET_IO_RECV_CB);
     wolfSSL_SetIOSend(ctx, NET_IO_SEND_CB);
@@ -286,23 +355,26 @@ int client_async_test(int argc, char** argv)
     (void)wolfSSL_UseSNI(ssl, WOLFSSL_SNI_HOST_NAME, host,
         (word16)XSTRLEN(host));
 
-    for (;;) {
-        ret = wolfSSL_UseKeyShare(ssl, group);
-        if (ret == WOLFSSL_SUCCESS) {
-            break;
-        }
-        if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
+    /* UseKeyShare is TLS 1.3 only */
+    if (!tls12) {
+        for (;;) {
+            ret = wolfSSL_UseKeyShare(ssl, group);
+            if (ret == WOLFSSL_SUCCESS) {
+                break;
+            }
+            if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
 #ifdef WOLFSSL_DEBUG_NONBLOCK
-            pending_count++;
+                pending_count++;
 #endif
 #ifdef WOLFSSL_ASYNC_CRYPT
-            if (wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW) < 0) {
-                goto out;
-            }
+                if (wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW) < 0) {
+                    goto out;
+                }
 #endif
-            continue;
+                continue;
+            }
+            goto out;
         }
-        goto out;
     }
 
     /* Non-blocking style loop. */
@@ -332,6 +404,8 @@ int client_async_test(int argc, char** argv)
             }
             continue;
         }
+        fprintf(stderr, "ERROR: wolfSSL_connect failed: %d (%s)\n",
+            err, wolfSSL_ERR_reason_error_string(err));
         goto out;
     }