mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-03-23 07:20:56 +00:00
Merge pull request #5007 from mprse/pk_opaque
Add key_opaque option to ssl_server2.c + test
This commit is contained in:
Manuel Pégourié-Gonnard
GitHub
commit
9317e09d15
@ -1683,7 +1683,7 @@ int main( int argc, char *argv[] )
|
||||
if( opt.key_opaque != 0 )
|
||||
{
|
||||
if( ( ret = mbedtls_pk_wrap_as_opaque( &pkey, &key_slot,
|
||||
PSA_ALG_SHA_256 ) ) != 0 )
|
||||
PSA_ALG_ANY_HASH ) ) != 0 )
|
||||
{
|
||||
mbedtls_printf( " failed\n ! "
|
||||
"mbedtls_pk_wrap_as_opaque returned -0x%x\n\n", (unsigned int) -ret );
|
||||
|
||||
@ -80,6 +80,7 @@ int main( void )
|
||||
#define DFL_CA_PATH ""
|
||||
#define DFL_CRT_FILE ""
|
||||
#define DFL_KEY_FILE ""
|
||||
#define DFL_KEY_OPAQUE 0
|
||||
#define DFL_KEY_PWD ""
|
||||
#define DFL_CRT_FILE2 ""
|
||||
#define DFL_KEY_FILE2 ""
|
||||
@ -200,6 +201,13 @@ int main( void )
|
||||
#else
|
||||
#define USAGE_IO ""
|
||||
#endif /* MBEDTLS_X509_CRT_PARSE_C */
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_X509_CRT_PARSE_C)
|
||||
#define USAGE_KEY_OPAQUE \
|
||||
" key_opaque=%%d Handle your private keys as if they were opaque\n" \
|
||||
" default: 0 (disabled)\n"
|
||||
#else
|
||||
#define USAGE_KEY_OPAQUE ""
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
|
||||
#define USAGE_SSL_ASYNC \
|
||||
@ -476,6 +484,7 @@ int main( void )
|
||||
" cert_req_ca_list=%%d default: 1 (send ca list)\n" \
|
||||
" options: 1 (send ca list), 0 (don't send)\n" \
|
||||
USAGE_IO \
|
||||
USAGE_KEY_OPAQUE \
|
||||
"\n" \
|
||||
USAGE_PSK \
|
||||
USAGE_CA_CALLBACK \
|
||||
@ -560,6 +569,7 @@ struct options
|
||||
const char *ca_path; /* the path with the CA certificate(s) reside */
|
||||
const char *crt_file; /* the file with the server certificate */
|
||||
const char *key_file; /* the file with the server key */
|
||||
int key_opaque; /* handle private key as if it were opaque */
|
||||
const char *key_pwd; /* the password for the server key */
|
||||
const char *crt_file2; /* the file with the 2nd server certificate */
|
||||
const char *key_file2; /* the file with the 2nd server key */
|
||||
@ -1308,6 +1318,10 @@ int main( int argc, char *argv[] )
|
||||
mbedtls_pk_context pkey;
|
||||
mbedtls_x509_crt srvcert2;
|
||||
mbedtls_pk_context pkey2;
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
psa_key_id_t key_slot = 0; /* invalid key slot */
|
||||
psa_key_id_t key_slot2 = 0; /* invalid key slot */
|
||||
#endif
|
||||
int key_cert_init = 0, key_cert_init2 = 0;
|
||||
#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
|
||||
ssl_async_key_context_t ssl_async_keys;
|
||||
@ -1482,6 +1496,7 @@ int main( int argc, char *argv[] )
|
||||
opt.ca_path = DFL_CA_PATH;
|
||||
opt.crt_file = DFL_CRT_FILE;
|
||||
opt.key_file = DFL_KEY_FILE;
|
||||
opt.key_opaque = DFL_KEY_OPAQUE;
|
||||
opt.key_pwd = DFL_KEY_PWD;
|
||||
opt.crt_file2 = DFL_CRT_FILE2;
|
||||
opt.key_file2 = DFL_KEY_FILE2;
|
||||
@ -1613,6 +1628,10 @@ int main( int argc, char *argv[] )
|
||||
opt.key_file = q;
|
||||
else if( strcmp( p, "key_pwd" ) == 0 )
|
||||
opt.key_pwd = q;
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_X509_CRT_PARSE_C)
|
||||
else if( strcmp( p, "key_opaque" ) == 0 )
|
||||
opt.key_opaque = atoi( q );
|
||||
#endif
|
||||
else if( strcmp( p, "crt_file2" ) == 0 )
|
||||
opt.crt_file2 = q;
|
||||
else if( strcmp( p, "key_file2" ) == 0 )
|
||||
@ -2468,7 +2487,34 @@ int main( int argc, char *argv[] )
|
||||
#endif /* MBEDTLS_ECDSA_C */
|
||||
}
|
||||
|
||||
mbedtls_printf( " ok\n" );
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
if( opt.key_opaque != 0 )
|
||||
{
|
||||
if ( mbedtls_pk_get_type( &pkey ) == MBEDTLS_PK_ECKEY )
|
||||
{
|
||||
if( ( ret = mbedtls_pk_wrap_as_opaque( &pkey, &key_slot,
|
||||
PSA_ALG_ANY_HASH ) ) != 0 )
|
||||
{
|
||||
mbedtls_printf( " failed\n ! "
|
||||
"mbedtls_pk_wrap_as_opaque returned -0x%x\n\n", (unsigned int) -ret );
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
|
||||
if ( mbedtls_pk_get_type( &pkey2 ) == MBEDTLS_PK_ECKEY )
|
||||
{
|
||||
if( ( ret = mbedtls_pk_wrap_as_opaque( &pkey2, &key_slot2,
|
||||
PSA_ALG_ANY_HASH ) ) != 0 )
|
||||
{
|
||||
mbedtls_printf( " failed\n ! "
|
||||
"mbedtls_pk_wrap_as_opaque returned -0x%x\n\n", (unsigned int) -ret );
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_USE_PSA_CRYPTO */
|
||||
|
||||
mbedtls_printf( " ok (key types: %s - %s)\n", mbedtls_pk_get_name( &pkey ), mbedtls_pk_get_name( &pkey2 ) );
|
||||
#endif /* MBEDTLS_X509_CRT_PARSE_C */
|
||||
|
||||
#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO)
|
||||
@ -3910,6 +3956,10 @@ exit:
|
||||
mbedtls_pk_free( &pkey );
|
||||
mbedtls_x509_crt_free( &srvcert2 );
|
||||
mbedtls_pk_free( &pkey2 );
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
psa_destroy_key( key_slot );
|
||||
psa_destroy_key( key_slot2 );
|
||||
#endif
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
|
||||
for( i = 0; (size_t) i < ssl_async_keys.slots_used; i++ )
|
||||
|
||||
@ -1447,12 +1447,53 @@ requires_config_enabled MBEDTLS_X509_CRT_PARSE_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SHA256_C
|
||||
run_test "Opaque key for client authentication" \
|
||||
"$P_SRV auth_mode=required" \
|
||||
"$P_SRV auth_mode=required crt_file=data_files/server5.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
"$P_CLI key_opaque=1 crt_file=data_files/server5.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
0 \
|
||||
-c "key type: Opaque" \
|
||||
-c "Ciphersuite is TLS-ECDHE-ECDSA" \
|
||||
-s "Verifying peer X.509 certificate... ok" \
|
||||
-s "Ciphersuite is TLS-ECDHE-ECDSA" \
|
||||
-S "error" \
|
||||
-C "error"
|
||||
|
||||
# Test using an opaque private key for server authentication
|
||||
requires_config_enabled MBEDTLS_USE_PSA_CRYPTO
|
||||
requires_config_enabled MBEDTLS_X509_CRT_PARSE_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SHA256_C
|
||||
run_test "Opaque key for server authentication" \
|
||||
"$P_SRV auth_mode=required key_opaque=1 crt_file=data_files/server5.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
"$P_CLI crt_file=data_files/server5.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
0 \
|
||||
-c "Verifying peer X.509 certificate... ok" \
|
||||
-c "Ciphersuite is TLS-ECDHE-ECDSA" \
|
||||
-s "key types: Opaque - invalid PK" \
|
||||
-s "Ciphersuite is TLS-ECDHE-ECDSA" \
|
||||
-S "error" \
|
||||
-C "error"
|
||||
|
||||
# Test using an opaque private key for client/server authentication
|
||||
requires_config_enabled MBEDTLS_USE_PSA_CRYPTO
|
||||
requires_config_enabled MBEDTLS_X509_CRT_PARSE_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SHA256_C
|
||||
run_test "Opaque key for client/server authentication" \
|
||||
"$P_SRV auth_mode=required key_opaque=1 crt_file=data_files/server5.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
"$P_CLI key_opaque=1 crt_file=data_files/server5.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
0 \
|
||||
-c "key type: Opaque" \
|
||||
-c "Verifying peer X.509 certificate... ok" \
|
||||
-c "Ciphersuite is TLS-ECDHE-ECDSA" \
|
||||
-s "key types: Opaque - invalid PK" \
|
||||
-s "Verifying peer X.509 certificate... ok" \
|
||||
-s "Ciphersuite is TLS-ECDHE-ECDSA" \
|
||||
-S "error" \
|
||||
-C "error"
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user