diff --git a/examples/client/client.c b/examples/client/client.c index 6520ac43c..c3d5c9a0c 100644 --- a/examples/client/client.c +++ b/examples/client/client.c @@ -867,7 +867,8 @@ static int ClientWrite(WOLFSSL* ssl, const char* msg, int msgSz, const char* str } #endif } - } while (err == WOLFSSL_ERROR_WANT_WRITE + } while (err == WOLFSSL_ERROR_WANT_WRITE || + err == WOLFSSL_ERROR_WANT_READ #ifdef WOLFSSL_ASYNC_CRYPT || err == WC_PENDING_E #endif @@ -1012,7 +1013,11 @@ static const char* client_usage_msg[][66] = { "-M Use STARTTLS, using protocol (smtp)\n", /* 27 */ #ifdef HAVE_SECURE_RENEGOTIATION "-R Allow Secure Renegotiation\n", /* 28 */ - "-i Force client Initiated Secure Renegotiation\n", /* 29 */ + "-i Force client Initiated Secure Renegotiation. If the\n" + " string 'scr-app-data' is passed in as the value and\n" + " Non-blocking sockets are enabled ('-N') then wolfSSL\n" + " sends a test message during the secure renegotiation.\n" + " The string parameter is optional.\n", /* 29 */ #endif "-f Fewer packets/group messages\n", /* 30 */ "-x Disable client cert/key loading\n", /* 31 */ @@ -1178,7 +1183,7 @@ static const char* client_usage_msg[][66] = { "使用する\n", /* 27 */ #ifdef HAVE_SECURE_RENEGOTIATION "-R セキュアな再ネゴシエーションを許可する\n", /* 28 */ - "-i クライアント主導のネゴシエーションを強制する\n", /* 29 */ + "-i クライアント主導のネゴシエーションを強制する\n", /* 29 */ #endif "-f より少ないパケット/グループメッセージを使用する\n",/* 30 */ "-x クライアントの証明書/鍵のロードを無効する\n", /* 31 */ @@ -1481,6 +1486,7 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args) int err = 0; int scr = 0; /* allow secure renegotiation */ int forceScr = 0; /* force client initiated scr */ + int scrAppData = 0; int resumeScr = 0; /* use resumption for renegotiation */ #ifndef WOLFSSL_NO_CLIENT_AUTH int useClientCert = 1; @@ -1617,6 +1623,7 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args) (void)atomicUser; (void)scr; (void)forceScr; + (void)scrAppData; (void)resumeScr; (void)ourKey; (void)ourCert; @@ -1643,7 +1650,7 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args) #ifndef WOLFSSL_VXWORKS /* Not used: All used */ while ((ch = mygetopt(argc, argv, "?:" - "ab:c:defgh:ijk:l:mnop:q:rstuv:wxyz" + "ab:c:defgh:i;jk:l:mnop:q:rstuv:wxyz" "A:B:CDE:F:GH:IJKL:M:NO:PQRS:TUVW:XYZ:" "01:23:458")) != -1) { switch (ch) { @@ -1882,6 +1889,9 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args) #ifdef HAVE_SECURE_RENEGOTIATION scr = 1; forceScr = 1; + if (XSTRNCMP(myoptarg, "scr-app-data", 12) == 0) { + scrAppData = 1; + } #endif break; @@ -3160,8 +3170,67 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args) #ifdef HAVE_SECURE_RENEGOTIATION if (scr && forceScr) { if (nonBlocking) { - printf("not doing secure renegotiation on example with" - " nonblocking yet\n"); + if (!resumeScr) { + if ((ret = wolfSSL_Rehandshake(ssl)) != WOLFSSL_SUCCESS) { + err = wolfSSL_get_error(ssl, 0); + if (err == WOLFSSL_ERROR_WANT_READ || + err == WOLFSSL_ERROR_WANT_WRITE) { + if (scrAppData) { + ret = ClientWrite(ssl, + "msg sent during renegotiation", + sizeof("msg sent during renegotiation") - 1, + "", 1); + } + else { + ret = 0; + } + if (ret != 0) { + ret = WOLFSSL_FAILURE; + } + else { + do { + if (err == APP_DATA_READY) { + if ((ret = wolfSSL_read(ssl, reply, + sizeof(reply)-1)) < 0) { + err_sys("APP DATA should be present " + "but error returned"); + } + printf("Received message during " + "renegotiation: %s\n", reply); + } + err = 0; + if ((ret = wolfSSL_connect(ssl)) + != WOLFSSL_SUCCESS) { + err = wolfSSL_get_error(ssl, ret); + } + } while (ret != WOLFSSL_SUCCESS && + (err == WOLFSSL_ERROR_WANT_READ || + err == WOLFSSL_ERROR_WANT_WRITE || + err == APP_DATA_READY)); + } + + if (ret != WOLFSSL_SUCCESS) { + err = wolfSSL_get_error(ssl, 0); + printf("wolfSSL_Rehandshake error %d, %s\n", err, + wolfSSL_ERR_error_string(err, buffer)); + wolfSSL_free(ssl); ssl = NULL; + wolfSSL_CTX_free(ctx); ctx = NULL; + err_sys("non-blocking wolfSSL_Rehandshake failed"); + } + printf("NON-BLOCKING RENEGOTIATION SUCCESSFUL\n"); + } + else { + printf("wolfSSL_Rehandshake error %d, %s\n", err, + wolfSSL_ERR_error_string(err, buffer)); + wolfSSL_free(ssl); ssl = NULL; + wolfSSL_CTX_free(ctx); ctx = NULL; + err_sys("non-blocking wolfSSL_Rehandshake failed"); + } + } + } + else { + printf("not doing secure resumption with non-blocking"); + } } else { if (!resumeScr) { printf("Beginning secure renegotiation.\n"); diff --git a/examples/server/server.c b/examples/server/server.c index 5c58ace82..09eb86025 100644 --- a/examples/server/server.c +++ b/examples/server/server.c @@ -48,9 +48,7 @@ #include #include -#ifdef WOLFSSL_DTLS - #include -#endif +#include #include "examples/server/server.h" @@ -354,7 +352,7 @@ static int NonBlockingSSL_Accept(SSL* ssl) return ret; } -/* Echo number of bytes specified by -e arg */ +/* Echo number of bytes specified by -B arg */ int ServerEchoData(SSL* ssl, int clientfd, int echoData, int block, size_t throughput) { @@ -375,7 +373,10 @@ int ServerEchoData(SSL* ssl, int clientfd, int echoData, int block, select_ret = tcp_select(clientfd, 1); /* Timeout=1 second */ if (select_ret == TEST_RECV_READY) { - len = min(block, (int)(throughput - xfer_bytes)); + if (throughput) + len = min(block, (int)(throughput - xfer_bytes)); + else + len = block; rx_pos = 0; if (throughput) { @@ -395,7 +396,8 @@ int ServerEchoData(SSL* ssl, int clientfd, int echoData, int block, else #endif if (err != WOLFSSL_ERROR_WANT_READ && - err != WOLFSSL_ERROR_ZERO_RETURN) { + err != WOLFSSL_ERROR_ZERO_RETURN && + err != APP_DATA_READY) { printf("SSL_read echo error %d\n", err); err_sys_ex(runWithErrors, "SSL_read failed"); break; @@ -407,6 +409,8 @@ int ServerEchoData(SSL* ssl, int clientfd, int echoData, int block, } else { rx_pos += ret; + if (!throughput) + break; } } if (throughput) { @@ -417,7 +421,7 @@ int ServerEchoData(SSL* ssl, int clientfd, int echoData, int block, /* Write data */ do { err = 0; /* reset error */ - ret = SSL_write(ssl, buffer, len); + ret = SSL_write(ssl, buffer, min(len, rx_pos)); if (ret <= 0) { err = SSL_get_error(ssl, 0); #ifdef WOLFSSL_ASYNC_CRYPT @@ -428,7 +432,7 @@ int ServerEchoData(SSL* ssl, int clientfd, int echoData, int block, #endif } } while (err == WC_PENDING_E); - if (ret != len) { + if (ret != (int)min(len, rx_pos)) { printf("SSL_write echo error %d\n", err); err_sys_ex(runWithErrors, "SSL_write failed"); } @@ -475,8 +479,26 @@ static void ServerRead(WOLFSSL* ssl, char* input, int inputLen) err = 0; /* reset error */ ret = SSL_read(ssl, input, inputLen); if (ret < 0) { - err = SSL_get_error(ssl, 0); + err = SSL_get_error(ssl, ret); + #ifdef HAVE_SECURE_RENEGOTIATION + if (err == APP_DATA_READY) { + /* If we receive a message during renegotiation + * then just print it. We return the message sent + * after the renegotiation. */ + ret = SSL_read(ssl, input, inputLen); + if (ret >= 0) { + /* null terminate message */ + input[ret] = '\0'; + printf("Client message received during " + "secure renegotiation: %s\n", input); + err = WOLFSSL_ERROR_WANT_READ; + } + else { + err = SSL_get_error(ssl, ret); + } + } + #endif #ifdef WOLFSSL_ASYNC_CRYPT if (err == WC_PENDING_E) { ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW); @@ -490,7 +512,11 @@ static void ServerRead(WOLFSSL* ssl, char* input, int inputLen) } else #endif - if (err != WOLFSSL_ERROR_WANT_READ) { + if (err != WOLFSSL_ERROR_WANT_READ + #ifdef HAVE_SECURE_RENEGOTIATION + && err != APP_DATA_READY + #endif + ) { printf("SSL_read input error %d, %s\n", err, ERR_error_string(err, buffer)); err_sys_ex(runWithErrors, "SSL_read failed"); @@ -502,7 +528,8 @@ static void ServerRead(WOLFSSL* ssl, char* input, int inputLen) } } while (err == WC_PENDING_E || err == WOLFSSL_ERROR_WANT_READ); if (ret > 0) { - input[ret] = 0; /* null terminate message */ + /* null terminate message */ + input[ret] = '\0'; printf("Client message: %s\n", input); } } @@ -2455,8 +2482,44 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args) defined(HAVE_SERVER_RENEGOTIATION_INFO) if (scr && forceScr) { if (nonBlocking) { - printf("not doing secure renegotiation on example with" - " nonblocking yet\n"); + if ((ret = wolfSSL_Rehandshake(ssl)) != WOLFSSL_SUCCESS) { + err = wolfSSL_get_error(ssl, 0); + if (err == WOLFSSL_ERROR_WANT_READ || + err == WOLFSSL_ERROR_WANT_WRITE) { + do { + if (err == APP_DATA_READY) { + if ((ret = wolfSSL_read(ssl, input, sizeof(input)-1)) < 0) { + err_sys("APP DATA should be present but error returned"); + } + printf("Received message: %s\n", input); + } + err = 0; + if ((ret = wolfSSL_accept(ssl)) != WOLFSSL_SUCCESS) { + err = wolfSSL_get_error(ssl, ret); + } + } while (ret != WOLFSSL_SUCCESS && + (err == WOLFSSL_ERROR_WANT_READ || + err == WOLFSSL_ERROR_WANT_WRITE || + err == APP_DATA_READY)); + + if (ret != WOLFSSL_SUCCESS) { + err = wolfSSL_get_error(ssl, 0); + printf("wolfSSL_Rehandshake error %d, %s\n", err, + wolfSSL_ERR_error_string(err, buffer)); + wolfSSL_free(ssl); ssl = NULL; + wolfSSL_CTX_free(ctx); ctx = NULL; + err_sys("non-blocking wolfSSL_Rehandshake failed"); + } + printf("NON-BLOCKING RENEGOTIATION SUCCESSFUL\n"); + } + else { + printf("wolfSSL_Rehandshake error %d, %s\n", err, + wolfSSL_ERR_error_string(err, buffer)); + wolfSSL_free(ssl); ssl = NULL; + wolfSSL_CTX_free(ctx); ctx = NULL; + err_sys("non-blocking wolfSSL_Rehandshake failed"); + } + } } else { if ((ret = wolfSSL_Rehandshake(ssl)) != WOLFSSL_SUCCESS) { #ifdef WOLFSSL_ASYNC_CRYPT diff --git a/src/internal.c b/src/internal.c index ece674972..49f67fda1 100644 --- a/src/internal.c +++ b/src/internal.c @@ -14642,6 +14642,16 @@ int DoApplicationData(WOLFSSL* ssl, byte* input, word32* inOutIdx) #endif *inOutIdx = idx; +#ifdef HAVE_SECURE_RENEGOTIATION + if (IsSCR(ssl)) { + /* Reset the processReply state since + * we finished processing this message. */ + ssl->options.processReply = doProcessInit; + /* If we are in a secure renegotiation then APP DATA is treated + * differently */ + return APP_DATA_READY; + } +#endif return 0; } @@ -14922,6 +14932,9 @@ int ProcessReply(WOLFSSL* ssl) #endif if (ssl->error != 0 && ssl->error != WANT_READ && ssl->error != WANT_WRITE + #ifdef HAVE_SECURE_RENEGOTIATION + && ssl->error != APP_DATA_READY + #endif #ifdef WOLFSSL_ASYNC_CRYPT && ssl->error != WC_PENDING_E #endif @@ -17658,14 +17671,15 @@ int DtlsCheckOrder(WOLFSSL* ssl, int order) /* If secure renegotiation is disabled, this will always return false. * Otherwise it checks to see if we are currently renegotiating. */ -static WC_INLINE int IsSCR(WOLFSSL* ssl) +int IsSCR(WOLFSSL* ssl) { #ifndef HAVE_SECURE_RENEGOTIATION (void)ssl; #else /* HAVE_SECURE_RENEGOTIATION */ if (ssl->secure_renegotiation && - ssl->secure_renegotiation->enabled && - ssl->options.handShakeState != HANDSHAKE_DONE) + ssl->secure_renegotiation->enabled && /* Is SCR enabled? */ + ssl->options.handShakeDone && /* At least one handshake done? */ + ssl->options.handShakeState != HANDSHAKE_DONE) /* Currently handshaking? */ return 1; #endif /* HAVE_SECURE_RENEGOTIATION */ return 0; @@ -17873,6 +17887,9 @@ int ReceiveData(WOLFSSL* ssl, byte* output, int sz, int peek) if (ssl->error != 0 && ssl->error != WANT_WRITE #ifdef WOLFSSL_ASYNC_CRYPT && ssl->error != WC_PENDING_E +#endif +#ifdef HAVE_SECURE_RENEGOTIATION + && ssl->error != APP_DATA_READY #endif ) { WOLFSSL_MSG("User calling wolfSSL_read in error state, not allowed"); @@ -17884,28 +17901,43 @@ int ReceiveData(WOLFSSL* ssl, byte* output, int sz, int peek) } else #endif - if (ssl->options.handShakeState != HANDSHAKE_DONE) { - int err; - WOLFSSL_MSG("Handshake not complete, trying to finish"); - if ( (err = wolfSSL_negotiate(ssl)) != WOLFSSL_SUCCESS) { - #ifdef WOLFSSL_ASYNC_CRYPT - /* if async would block return WANT_WRITE */ - if (ssl->error == WC_PENDING_E) { - return WOLFSSL_CBIO_ERR_WANT_READ; + { + int negotiate = 0; +#ifdef HAVE_SECURE_RENEGOTIATION + if (ssl->secure_renegotiation && ssl->secure_renegotiation->enabled) { + if (ssl->options.handShakeState != HANDSHAKE_DONE + && ssl->buffers.clearOutputBuffer.length == 0) + negotiate = 1; + } + else +#endif + if (ssl->options.handShakeState != HANDSHAKE_DONE) + negotiate = 1; + + if (negotiate) { + int err; + WOLFSSL_MSG("Handshake not complete, trying to finish"); + if ( (err = wolfSSL_negotiate(ssl)) != WOLFSSL_SUCCESS) { + #ifdef WOLFSSL_ASYNC_CRYPT + /* if async would block return WANT_WRITE */ + if (ssl->error == WC_PENDING_E) { + return WOLFSSL_CBIO_ERR_WANT_READ; + } + #endif + return err; } - #endif - return err; } } #ifdef HAVE_SECURE_RENEGOTIATION startScr: if (ssl->secure_renegotiation && ssl->secure_renegotiation->startScr) { - int err; + int ret; WOLFSSL_MSG("Need to start scr, server requested"); - if ( (err = wolfSSL_Rehandshake(ssl)) != WOLFSSL_SUCCESS) - return err; + ret = wolfSSL_Rehandshake(ssl); ssl->secure_renegotiation->startScr = 0; /* only start once */ + if (ret != WOLFSSL_SUCCESS) + return ret; } #endif @@ -17944,10 +17976,7 @@ startScr: #endif } - if (sz < (int)ssl->buffers.clearOutputBuffer.length) - size = sz; - else - size = ssl->buffers.clearOutputBuffer.length; + size = min(sz, (int)ssl->buffers.clearOutputBuffer.length); XMEMCPY(output, ssl->buffers.clearOutputBuffer.buffer, size); diff --git a/tests/test-dtls-reneg-client.conf b/tests/test-dtls-reneg-client.conf index bb405c16d..60d73af5c 100644 --- a/tests/test-dtls-reneg-client.conf +++ b/tests/test-dtls-reneg-client.conf @@ -4,6 +4,87 @@ -v 3 -l DHE-RSA-CHACHA20-POLY1305 +# client DTLSv1.2 DHE-RSA-CHACHA20-POLY1305 +-i scr-app-data +-u +-v 3 +-l DHE-RSA-CHACHA20-POLY1305 + +# server DTLSv1.2 ECDHE-RSA-CHACHA20-POLY1305 +-M +-u +-v 3 +-l ECDHE-RSA-CHACHA20-POLY1305 + +# client DTLSv1.2 ECDHE-RSA-CHACHA20-POLY1305 +-i scr-app-data +-u +-v 3 +-l ECDHE-RSA-CHACHA20-POLY1305 + +# server DTLSv1.2 ECDHE-EDCSA-CHACHA20-POLY1305 +-M +-u +-v 3 +-l ECDHE-ECDSA-CHACHA20-POLY1305 +-c ./certs/server-ecc.pem +-k ./certs/ecc-key.pem + +# client DTLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305 +-i scr-app-data +-u +-v 3 +-l ECDHE-ECDSA-CHACHA20-POLY1305 +-A ./certs/ca-ecc-cert.pem + +# server TLSv1.2 DHE-PSK-CHACHA20-POLY1305 +-M +-u +-v 3 +-s +-l DHE-PSK-CHACHA20-POLY1305 + +# client TLSv1.2 DHE-PSK-CHACHA20-POLY1305 +-i scr-app-data +-u +-v 3 +-s +-l DHE-PSK-CHACHA20-POLY1305 + +# server TLSv1.2 ECDHE-PSK-CHACHA20-POLY1305 +-M +-u +-v 3 +-s +-l ECDHE-PSK-CHACHA20-POLY1305 + +# client TLSv1.2 ECDHE-PSK-CHACHA20-POLY1305 +-i scr-app-data +-u +-v 3 +-s +-l ECDHE-PSK-CHACHA20-POLY1305 + +# server TLSv1.2 PSK-CHACHA20-POLY1305 +-M +-u +-v 3 +-s +-l PSK-CHACHA20-POLY1305 + +# client TLSv1.2 PSK-CHACHA20-POLY1305 +-i scr-app-data +-u +-v 3 +-s +-l PSK-CHACHA20-POLY1305 + +# server DTLSv1.2 DHE-RSA-CHACHA20-POLY1305 +-M +-u +-v 3 +-l DHE-RSA-CHACHA20-POLY1305 + # client DTLSv1.2 DHE-RSA-CHACHA20-POLY1305 -i -u diff --git a/wolfssl/error-ssl.h b/wolfssl/error-ssl.h index c6870d96c..88c47b9c6 100644 --- a/wolfssl/error-ssl.h +++ b/wolfssl/error-ssl.h @@ -169,6 +169,7 @@ enum wolfSSL_ErrorCodes { TLS13_SECRET_CB_E = -438, /* TLS1.3 secret Cb fcn failure */ DTLS_SIZE_ERROR = -439, /* Trying to send too much data */ NO_CERT_ERROR = -440, /* TLS1.3 - no cert set error */ + APP_DATA_READY = -441, /* DTLS1.2 application data ready for read */ /* add strings to wolfSSL_ERR_reason_error_string in internal.c !!!!! */ diff --git a/wolfssl/internal.h b/wolfssl/internal.h index dd9dc36bc..d1651b943 100644 --- a/wolfssl/internal.h +++ b/wolfssl/internal.h @@ -4559,6 +4559,7 @@ WOLFSSL_LOCAL int GrowInputBuffer(WOLFSSL* ssl, int size, int usedLength); WOLFSSL_LOCAL int DtlsUseSCRKeys(WOLFSSL* ssl); WOLFSSL_LOCAL int DtlsCheckOrder(WOLFSSL* ssl, int order); #endif + WOLFSSL_LOCAL int IsSCR(WOLFSSL* ssl); WOLFSSL_LOCAL void WriteSEQ(WOLFSSL* ssl, int verifyOrder, byte* out); diff --git a/wolfssl/test.h b/wolfssl/test.h index 7d87b92ec..f9b56657e 100644 --- a/wolfssl/test.h +++ b/wolfssl/test.h @@ -536,6 +536,17 @@ err_sys_with_errno(const char* msg) extern int myoptind; extern char* myoptarg; +/** + * + * @param argc Number of argv strings + * @param argv Array of string arguments + * @param optstring String containing the supported alphanumeric arguments. + * A ':' following a character means that it requires a + * value in myoptarg to be set. A ';' means that the + * myoptarg is optional. myoptarg is set to "" if not + * present. + * @return Option letter in argument + */ static WC_INLINE int mygetopt(int argc, char** argv, const char* optstring) { static char* next = NULL; @@ -585,7 +596,7 @@ static WC_INLINE int mygetopt(int argc, char** argv, const char* optstring) /* The C++ strchr can return a different value */ cp = (char*)strchr(optstring, c); - if (cp == NULL || c == ':') + if (cp == NULL || c == ':' || 'c' == ';') return '?'; cp++; @@ -602,6 +613,20 @@ static WC_INLINE int mygetopt(int argc, char** argv, const char* optstring) else return '?'; } + else if (*cp == ';') { + myoptarg = (char*)""; + if (*next != '\0') { + myoptarg = next; + next = NULL; + } + else if (myoptind < argc) { + /* Check if next argument is not a parameter argument */ + if (argv[myoptind] && argv[myoptind][0] != '-') { + myoptarg = argv[myoptind]; + myoptind++; + } + } + } return c; }