summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/supplemental/tls/mbedtls/tls.c44
-rw-r--r--src/supplemental/tls/tls_test.c5
-rw-r--r--src/supplemental/websocket/wssfile_test.c96
3 files changed, 56 insertions, 89 deletions
diff --git a/src/supplemental/tls/mbedtls/tls.c b/src/supplemental/tls/mbedtls/tls.c
index 3e424cc8..3dd39f7f 100644
--- a/src/supplemental/tls/mbedtls/tls.c
+++ b/src/supplemental/tls/mbedtls/tls.c
@@ -17,6 +17,9 @@
#include "mbedtls/version.h" // Must be first in order to pick up version
#include "mbedtls/error.h"
+#ifdef MBEDTLS_PSA_CRYPTO_C
+#include "psa/crypto.h"
+#endif
#include "nng/nng.h"
#include "nng/supplemental/tls/tls.h"
@@ -28,6 +31,7 @@
#include "mbedtls/net.h"
#endif
+#include "mbedtls/debug.h"
#include "mbedtls/ssl.h"
#include "core/nng_impl.h"
@@ -95,11 +99,13 @@ struct nng_tls_engine_config {
static void
tls_dbg(void *ctx, int level, const char *file, int line, const char *s)
{
- char buf[128];
NNI_ARG_UNUSED(ctx);
NNI_ARG_UNUSED(level);
- snprintf(buf, sizeof(buf), "%s:%04d: %s", file, line, s);
- nni_plat_println(buf);
+ const char *f;
+ while ((f = strchr(file, '/')) != NULL) {
+ file = f + 1;
+ }
+ nng_log_debug("MBED", "%s: %d: %s", file, line, s);
}
static int
@@ -465,7 +471,11 @@ config_init(nng_tls_engine_config *cfg, enum nng_tls_mode mode)
// SSL v3.3. As of this writing, Mbed TLS still does not support
// version 1.3, and we would want to test it before enabling it here.
cfg->min_ver = MBEDTLS_SSL_MINOR_VERSION_3;
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
+ cfg->max_ver = MBEDTLS_SSL_MINOR_VERSION_4;
+#else
cfg->max_ver = MBEDTLS_SSL_MINOR_VERSION_3;
+#endif
mbedtls_ssl_conf_min_version(
&cfg->cfg_ctx, MBEDTLS_SSL_MAJOR_VERSION_3, cfg->min_ver);
@@ -689,9 +699,16 @@ config_version(nng_tls_engine_config *cfg, nng_tls_version min_ver,
v1 = MBEDTLS_SSL_MINOR_VERSION_2;
break;
#endif
+#ifdef MBEDTLS_SSL_MINOR_VERSION_3
case NNG_TLS_1_2:
v1 = MBEDTLS_SSL_MINOR_VERSION_3;
break;
+#endif
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
+ case NNG_TLS_1_3:
+ v1 = MBEDTLS_SSL_MINOR_VERSION_4;
+ break;
+#endif
default:
nng_log_err(
"TLS-CFG-VER", "TLS minimum version not supported");
@@ -709,9 +726,17 @@ config_version(nng_tls_engine_config *cfg, nng_tls_version min_ver,
v2 = MBEDTLS_SSL_MINOR_VERSION_2;
break;
#endif
+#ifdef MBEDTLS_SSL_MINOR_VERSION_3
case NNG_TLS_1_2:
+ v2 = MBEDTLS_SSL_MINOR_VERSION_3;
+ break;
+#endif
case NNG_TLS_1_3: // We lack support for 1.3, so treat as 1.2.
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
+ v2 = MBEDTLS_SSL_MINOR_VERSION_4;
+#else
v2 = MBEDTLS_SSL_MINOR_VERSION_3;
+#endif
break;
default:
// Note that this means that if we ever TLS 1.4 or 2.0,
@@ -779,9 +804,17 @@ nng_tls_engine_init_mbed(void)
return (rv);
}
#endif
+#ifdef MBEDTLS_PSA_CRYPTO_C
+ rv = psa_crypto_init();
+ if (rv != 0) {
+ tls_log_err(
+ "NNG-TLS-INIT", "Failed initializing PSA crypto", rv);
+ return (rv);
+ }
+#endif
// Uncomment the following to have noisy debug from mbedTLS.
// This may be useful when trying to debug failures.
- // mbedtls_debug_set_threshold(3);
+ // mbedtls_debug_set_threshold(9);
rv = nng_tls_engine_register(&tls_engine_mbed);
@@ -801,4 +834,7 @@ nng_tls_engine_fini_mbed(void)
mbedtls_ctr_drbg_free(&rng_ctx);
nni_mtx_fini(&rng_lock);
#endif
+#ifdef MBEDTLS_PSA_CRYPTO_C
+ mbedtls_psa_crypto_free();
+#endif
}
diff --git a/src/supplemental/tls/tls_test.c b/src/supplemental/tls/tls_test.c
index 0aa18708..3d0c16a0 100644
--- a/src/supplemental/tls/tls_test.c
+++ b/src/supplemental/tls/tls_test.c
@@ -417,8 +417,9 @@ test_tls_psk_bad_identity(void)
t1 = nuts_stream_send_start(s1, buf1, size);
t2 = nuts_stream_recv_start(s2, buf2, size);
- NUTS_FAIL(nuts_stream_wait(t1), NNG_ECRYPTO);
- NUTS_FAIL(nuts_stream_wait(t2), NNG_ECRYPTO);
+ // These can fail due to ECRYPTO, EPEERAUTH, or ECONNSHUT, for example
+ NUTS_ASSERT(nuts_stream_wait(t1) != 0);
+ NUTS_ASSERT(nuts_stream_wait(t2) != 0);
nng_free(buf1, size);
nng_free(buf2, size);
diff --git a/src/supplemental/websocket/wssfile_test.c b/src/supplemental/websocket/wssfile_test.c
index ee7c8ffd..51b78645 100644
--- a/src/supplemental/websocket/wssfile_test.c
+++ b/src/supplemental/websocket/wssfile_test.c
@@ -1,5 +1,5 @@
//
-// Copyright 2020 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
// Copyright 2018 Capitar IT Group BV <info@capitar.com>
//
// This software is supplied under the terms of the MIT License, a
@@ -13,82 +13,6 @@
#include <nuts.h>
#ifdef NNG_SUPP_TLS
-// These keys are for demonstration purposes ONLY. DO NOT USE.
-// The certificate is valid for 100 years, because I don't want to
-// have to regenerate it ever again. The CN is 127.0.0.1, and self-signed.
-//
-// Generated using openssl:
-//
-// % openssl rsa -genkey -out key.key
-// % openssl req -new -key key.key -out cert.csr -sha256
-// % openssl x509 -req -in cert.csr -days 36500 -out cert.crt
-// -signkey key.key -sha256
-//
-// Relevant metadata:
-//
-// Certificate:
-// Data:
-// Version: 1 (0x0)
-// Serial Number: 17127835813110005400 (0xedb24becc3a2be98)
-// Signature Algorithm: sha256WithRSAEncryption
-// Issuer: C=US, ST=CA, L=San Diego, O=nanomsg.org, CN=localhost
-// Validity
-// Not Before: Jan 11 22:34:35 2018 GMT
-// Not After : Dec 18 22:34:35 2117 GMT
-// Subject: C=US, ST=CA, L=San Diego, O=nanomsg.org, CN=localhost
-// Subject Public Key Info:
-// Public Key Algorithm: rsaEncryption
-// Public-Key: (2048 bit)
-//
-static const char cert[] =
- "-----BEGIN CERTIFICATE-----\n"
- "MIIDLjCCAhYCCQDtskvsw6K+mDANBgkqhkiG9w0BAQsFADBYMQswCQYDVQQGEwJV\n"
- "UzELMAkGA1UECAwCQ0ExEjAQBgNVBAcMCVNhbiBEaWVnbzEUMBIGA1UECgwLbmFu\n"
- "b21zZy5vcmcxEjAQBgNVBAMMCWxvY2FsaG9zdDAgFw0xODAxMTEyMjM0MzVaGA8y\n"
- "MTE3MTIxODIyMzQzNVowWDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRIwEAYD\n"
- "VQQHDAlTYW4gRGllZ28xFDASBgNVBAoMC25hbm9tc2cub3JnMRIwEAYDVQQDDAls\n"
- "b2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMvoHdEnfO\n"
- "hmG3PTj6YC5qz6N5hgmcwf4EZkor4+R1Q5hDOKqOknWmVuGBD5mA61ObK76vycIT\n"
- "Tp+H+vKvfgunySZrlyYg8IbgoDbvVgj9RF8xFHdN0PVeqnkBCsCzLtSu6TP8PSgI\n"
- "SKiRMH0NUSakWqCPEc2E1r1CKdOpa7av/Na30LPsuKFcAUhu7QiVYfER86ktrO8G\n"
- "F2PeVy44Q8RkiLw8uhU0bpAflqkR1KCjOLajw1eL3C+Io75Io8qUOLxWc3LH0hl3\n"
- "oEI0jWu7JYlRAw/O7xm4pcGTwy5L8Odz4a7ZTAmuapFRarGOIcDg8Yr0tllRd1mH\n"
- "1T4Z2Wv7Rs0tAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAIfUXK7UonrYAOrlXUHH\n"
- "gfHNdOXMzQP2Ms6Sxov+1tCTfgsYE65Mggo7hRJUqmKpstpbdRBVXhTyht/xjyTz\n"
- "5sMjoeCyv1tXOHpLTfD3LBXwYZwsFdoLS1UHhD3qiYjCyyY2LWa6S786CtlcbCvu\n"
- "Uij2q8zJ4WFrNqAzxZtsTfg16/6JRFw9zpVSCNlHqCxNQxzWucbmUFTiWn9rnc/N\n"
- "r7utG4JsDPZbEI6QS43R7gGLDF7s0ftWKqzlQiZEtuDQh2p7Uejbft8XmZd/VuV/\n"
- "dFMXOO1rleU0lWAJcXWOWHH3er0fivu2ISL8fRjjikYvhRGxtkwC0kPDa2Ntzgd3\n"
- "Hsg=\n"
- "-----END CERTIFICATE-----\n";
-static const char key[] =
- "-----BEGIN RSA PRIVATE KEY-----\n"
- "MIIEpQIBAAKCAQEAzL6B3RJ3zoZhtz04+mAuas+jeYYJnMH+BGZKK+PkdUOYQziq\n"
- "jpJ1plbhgQ+ZgOtTmyu+r8nCE06fh/ryr34Lp8kma5cmIPCG4KA271YI/URfMRR3\n"
- "TdD1Xqp5AQrAsy7Urukz/D0oCEiokTB9DVEmpFqgjxHNhNa9QinTqWu2r/zWt9Cz\n"
- "7LihXAFIbu0IlWHxEfOpLazvBhdj3lcuOEPEZIi8PLoVNG6QH5apEdSgozi2o8NX\n"
- "i9wviKO+SKPKlDi8VnNyx9IZd6BCNI1ruyWJUQMPzu8ZuKXBk8MuS/Dnc+Gu2UwJ\n"
- "rmqRUWqxjiHA4PGK9LZZUXdZh9U+Gdlr+0bNLQIDAQABAoIBAC82HqvjfkzZH98o\n"
- "9uKFGy72AjQbfEvxT6mkDKZiPmPr2khl4K5Ph2F71zPzbOoVWYoGZEoUs/PPxWmN\n"
- "rDhbUES4VWupxtkBnZheWUyHAjukcG7Y0UnYTTwvAwgCerzWp6RNkfcwAvMmDfis\n"
- "vak8dTSg0TUsXb+r5KhFDNGcTNv3f7R0cJmaZ/t9FT7SerXf1LW7itvTjRor8/ZK\n"
- "KPwT4oklp1o6RFXSenn/e2e3rAjI+TEwJA3Zp5dqO/M/AhaZKVaxL4voDVdVVkT+\n"
- "LHJWVhjLY5ilPkmPWqmZ2reTaF+gGSSjAQ+t/ahGWFqEdWIz9UoXhBBOd1ibeyvd\n"
- "Kyxp1QECgYEA8KcDkmwPrhqFlQe/U+Md27OhrQ4cecLCa6EVLsCXN1bFyCi3NSo2\n"
- "o5zFCC699KOL0ZwSmYlaQP4xjnqv4Gsa0s3uL7tqOJR2UuEtGK/MPMluGHVaWsGt\n"
- "zbnWH3xgsvvsxdt6hInFhcABLDupW336tJ8EcH7mOKoIP+azwF4kPiUCgYEA2c09\n"
- "zJBUW6SZXhgJ5vgENYc+UwDT7pfhIWZaRL+wXnwSoa7igodTKJtQp/KfFBJK4RA0\n"
- "prvwj4Wr/1ScaboR2hYZApbqXU5zkEkjC1hHIbg1fBe0EcnhP7ojMXrk6B5ed+Lq\n"
- "OVdYhUuvtdL/perelmbTJLnb8S214+tzVyg7EGkCgYEA6JLwX8zxpnhZSztOjBr9\n"
- "2zuSb7YojQBNd0kZOLLGMaQ5xwSactYWMi8rOIo76Lc6RFxKmXnl8NP5PtKRMRkx\n"
- "tjNxE05UDNRmOhkGxUn433JoZVjc9sMhXqZQKuPAbJoOLPW9RWQEsgtq1r3eId7x\n"
- "sSfRWYs6od6p1F/4rlwNOMUCgYEAtJmqf+DCAoe3IL3gICRSISy28k7CbZqE9JQR\n"
- "j+Y/Uemh7W29pyydOROoysq1PAh7DKrKbeNzcx8NYxh+5nCC8wrVzD7lsV8nFmJ+\n"
- "655UxVIhD3f8Oa/j1lr7acEU5KCiBtkjDU8vOMBsv+FpWOQrlB1JQa/X/+G+bHLF\n"
- "XmUerNkCgYEAv7R8vIKgJ1f69imgHdB31kue3wnOO/6NlfY3GTcaZcTdChY8SZ5B\n"
- "xits8xog0VcaxXhWlfO0hyCnZ9YRQbyDu0qp5eBU2p3qcE01x4ljJBZUOTweG06N\n"
- "cL9dYcwse5FhNMjrQ/OKv6B38SIXpoKQUtjgkaMtmpK8cXX1eqEMNkM=\n"
- "-----END RSA PRIVATE KEY-----\n";
#define CACERT "wss_test_ca_cert.pem"
#define CERT_KEY "wss_test_cert_key.pem"
@@ -102,8 +26,10 @@ init_dialer_wss_file(nng_dialer d)
NUTS_ASSERT((tmpdir = nni_plat_temp_dir()) != NULL);
NUTS_ASSERT((pth = nni_file_join(tmpdir, CACERT)) != NULL);
nng_strfree(tmpdir);
- NUTS_PASS(nni_file_put(pth, cert, strlen(cert)));
+ NUTS_PASS(nni_file_put(pth, nuts_server_crt, strlen(nuts_server_crt)));
NUTS_PASS(nng_dialer_set_string(d, NNG_OPT_TLS_CA_FILE, pth));
+ NUTS_PASS(
+ nng_dialer_set_string(d, NNG_OPT_TLS_SERVER_NAME, "localhost"));
nni_file_delete(pth);
nng_strfree(pth);
}
@@ -119,7 +45,8 @@ init_listener_wss_file(nng_listener l)
NUTS_ASSERT((pth = nni_file_join(tmpdir, CERT_KEY)) != NULL);
nng_strfree(tmpdir);
- NUTS_PASS(nni_asprintf(&cert_key, "%s\r\n%s\r\n", cert, key));
+ NUTS_PASS(nni_asprintf(
+ &cert_key, "%s\r\n%s\r\n", nuts_server_key, nuts_server_crt));
NUTS_PASS(nni_file_put(pth, cert_key, strlen(cert_key)));
nng_strfree(cert_key);
@@ -178,11 +105,12 @@ test_no_verify(void)
nng_listener l;
nng_dialer d;
char addr[64];
- nng_msg * msg;
+ nng_msg *msg;
nng_pipe p;
bool b;
uint16_t port;
+ NUTS_ENABLE_LOG(NNG_LOG_DEBUG);
NUTS_PASS(nng_pair_open(&s1));
NUTS_PASS(nng_pair_open(&s2));
NUTS_PASS(nng_socket_set_ms(s1, NNG_OPT_SENDTIMEO, 5000));
@@ -201,7 +129,7 @@ test_no_verify(void)
NUTS_PASS(nng_dialer_set_int(
d, NNG_OPT_TLS_AUTH_MODE, NNG_TLS_AUTH_MODE_OPTIONAL));
NUTS_PASS(
- nng_dialer_set_string(d, NNG_OPT_TLS_SERVER_NAME, "example.com"));
+ nng_dialer_set_string(d, NNG_OPT_TLS_SERVER_NAME, "localhost"));
NUTS_PASS(nng_dialer_start(d, 0));
nng_msleep(100);
@@ -215,7 +143,9 @@ test_no_verify(void)
p = nng_msg_get_pipe(msg);
NUTS_TRUE(nng_pipe_id(p) > 0);
NUTS_PASS(nng_pipe_get_bool(p, NNG_OPT_TLS_VERIFIED, &b));
- NUTS_TRUE(b == false);
+ // Server may have verified, us, or might not have.
+ // This is dependent
+ // NUTS_TRUE(b == false);
nng_msg_free(msg);
NUTS_CLOSE(s1);
@@ -230,7 +160,7 @@ test_verify_works(void)
nng_listener l;
nng_dialer d;
char addr[NNG_MAXADDRLEN];
- nng_msg * msg;
+ nng_msg *msg;
nng_pipe p;
bool b;
uint16_t port;
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2026-01-18 07:12:03 +0000