From f74f5ce88d395a6bd096cba59ed0b2d3ab9439c2 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Tue, 5 Mar 2019 16:02:15 +0000 Subject: [PATCH 1/5] ssl_client2: Skip CA setup if `ca_path` or `ca_file` argument "none" This allows to test PSK-based ciphersuites via ssl_client2 in builds which have MBEDTLS_X509_CRT_PARSE_C enabled but both MBEDTLS_FS_IO and MBEDTLS_CERTS_C disabled. A similar change is applied to the `crt_file` and `key_file` arguments. --- programs/ssl/ssl_client2.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c index 81514321f..94230b842 100644 --- a/programs/ssl/ssl_client2.c +++ b/programs/ssl/ssl_client2.c @@ -1072,17 +1072,17 @@ int main( int argc, char *argv[] ) mbedtls_printf( " . Loading the CA root certificate ..." ); fflush( stdout ); + if( strcmp( opt.ca_path, "none" ) == 0 || + strcmp( opt.ca_file, "none" ) == 0 ) + { + ret = 0; + } + else #if defined(MBEDTLS_FS_IO) if( strlen( opt.ca_path ) ) - if( strcmp( opt.ca_path, "none" ) == 0 ) - ret = 0; - else - ret = mbedtls_x509_crt_parse_path( &cacert, opt.ca_path ); + ret = mbedtls_x509_crt_parse_path( &cacert, opt.ca_path ); else if( strlen( opt.ca_file ) ) - if( strcmp( opt.ca_file, "none" ) == 0 ) - ret = 0; - else - ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file ); + ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file ); else #endif #if defined(MBEDTLS_CERTS_C) @@ -1116,12 +1116,12 @@ int main( int argc, char *argv[] ) mbedtls_printf( " . Loading the client cert. and key..." ); fflush( stdout ); + if( strcmp( opt.crt_file, "none" ) == 0 ) + ret = 0; + else #if defined(MBEDTLS_FS_IO) if( strlen( opt.crt_file ) ) - if( strcmp( opt.crt_file, "none" ) == 0 ) - ret = 0; - else - ret = mbedtls_x509_crt_parse_file( &clicert, opt.crt_file ); + ret = mbedtls_x509_crt_parse_file( &clicert, opt.crt_file ); else #endif #if defined(MBEDTLS_CERTS_C) @@ -1139,12 +1139,12 @@ int main( int argc, char *argv[] ) goto exit; } + if( strcmp( opt.key_file, "none" ) == 0 ) + ret = 0; + else #if defined(MBEDTLS_FS_IO) if( strlen( opt.key_file ) ) - if( strcmp( opt.key_file, "none" ) == 0 ) - ret = 0; - else - ret = mbedtls_pk_parse_keyfile( &pkey, opt.key_file, "" ); + ret = mbedtls_pk_parse_keyfile( &pkey, opt.key_file, "" ); else #endif #if defined(MBEDTLS_CERTS_C) From 37e7db23d356f4eac95e548feb556cdd864d972d Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Tue, 5 Mar 2019 16:10:27 +0000 Subject: [PATCH 2/5] ssl_client2: Fail gracefully if no PEM-encoded CRTs are available --- programs/ssl/ssl_client2.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c index 94230b842..c63c4f75a 100644 --- a/programs/ssl/ssl_client2.c +++ b/programs/ssl/ssl_client2.c @@ -1085,7 +1085,7 @@ int main( int argc, char *argv[] ) ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file ); else #endif -#if defined(MBEDTLS_CERTS_C) +#if defined(MBEDTLS_CERTS_C) && defined(MBEDTLS_PEM_PARSE_C) for( i = 0; mbedtls_test_cas[i] != NULL; i++ ) { ret = mbedtls_x509_crt_parse( &cacert, @@ -1097,9 +1097,13 @@ int main( int argc, char *argv[] ) #else { ret = 1; - mbedtls_printf("MBEDTLS_CERTS_C not defined."); +#if !defined(MBEDTLS_CERTS_C) + mbedtls_printf( "MBEDTLS_CERTS_C not defined." ); +#else + mbedtls_printf( "All test CRTs loaded via MBEDTLS_CERTS_C are PEM-encoded, but MBEDTLS_PEM_PARSE_C is disabled." ); } -#endif +#endif /* MBEDTLS_CERTS_C */ +#endif /* MBEDTLS_CERTS_C && MBEDTLS_PEM_PARSE_C */ if( ret < 0 ) { mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret ); @@ -1124,15 +1128,19 @@ int main( int argc, char *argv[] ) ret = mbedtls_x509_crt_parse_file( &clicert, opt.crt_file ); else #endif -#if defined(MBEDTLS_CERTS_C) +#if defined(MBEDTLS_CERTS_C) && defined(MBEDTLS_PEM_PARSE_C) ret = mbedtls_x509_crt_parse( &clicert, (const unsigned char *) mbedtls_test_cli_crt, mbedtls_test_cli_crt_len ); #else { ret = 1; - mbedtls_printf("MBEDTLS_CERTS_C not defined."); +#if !defined(MBEDTLS_CERTS_C) + mbedtls_printf( "MBEDTLS_CERTS_C not defined." ); +#else + mbedtls_printf( "All test CRTs loaded via MBEDTLS_CERTS_C are PEM-encoded, but MBEDTLS_PEM_PARSE_C is disabled." ); } -#endif +#endif /* MBEDTLS_CERTS_C */ +#endif /* MBEDTLS_CERTS_C && MBEDTLS_PEM_PARSE_C */ if( ret != 0 ) { mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret ); @@ -1147,15 +1155,19 @@ int main( int argc, char *argv[] ) ret = mbedtls_pk_parse_keyfile( &pkey, opt.key_file, "" ); else #endif -#if defined(MBEDTLS_CERTS_C) +#if defined(MBEDTLS_CERTS_C) && defined(MBEDTLS_PEM_PARSE_C) ret = mbedtls_pk_parse_key( &pkey, (const unsigned char *) mbedtls_test_cli_key, mbedtls_test_cli_key_len, NULL, 0 ); #else { ret = 1; - mbedtls_printf("MBEDTLS_CERTS_C not defined."); +#if !defined(MBEDTLS_CERTS_C) + mbedtls_printf( "MBEDTLS_CERTS_C not defined." ); +#else + mbedtls_printf( "All test keys loaded via MBEDTLS_CERTS_C are PEM-encoded, but MBEDTLS_PEM_PARSE_C is disabled." ); } -#endif +#endif /* MBEDTLS_CERTS_C */ +#endif /* MBEDTLS_CERTS_C && MBEDTLS_PEM_PARSE_C */ if( ret != 0 ) { mbedtls_printf( " failed\n ! mbedtls_pk_parse_key returned -0x%x\n\n", -ret ); From d6bbf05f7c663802cd092e2fbf7fc89ae5c4b4d9 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Tue, 5 Mar 2019 16:22:07 +0000 Subject: [PATCH 3/5] ssl_server2: Skip CA setup if `ca_path` or `ca_file` argument "none" This allows to test PSK-based ciphersuites via ssl_server2 in builds which have MBEDTLS_X509_CRT_PARSE_C enabled but both MBEDTLS_FS_IO and MBEDTLS_CERTS_C disabled. --- programs/ssl/ssl_server2.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c index ec23c8a85..2c5a8cee9 100644 --- a/programs/ssl/ssl_server2.c +++ b/programs/ssl/ssl_server2.c @@ -1582,17 +1582,17 @@ int main( int argc, char *argv[] ) mbedtls_printf( " . Loading the CA root certificate ..." ); fflush( stdout ); + if( strcmp( opt.ca_path, "none" ) == 0 || + strcmp( opt.ca_file, "none" ) == 0 ) + { + ret = 0; + } + else #if defined(MBEDTLS_FS_IO) if( strlen( opt.ca_path ) ) - if( strcmp( opt.ca_path, "none" ) == 0 ) - ret = 0; - else - ret = mbedtls_x509_crt_parse_path( &cacert, opt.ca_path ); + ret = mbedtls_x509_crt_parse_path( &cacert, opt.ca_path ); else if( strlen( opt.ca_file ) ) - if( strcmp( opt.ca_file, "none" ) == 0 ) - ret = 0; - else - ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file ); + ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file ); else #endif #if defined(MBEDTLS_CERTS_C) From beaf3d0eaa74d957b6b35e50ec0cd39c9b6797c5 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Tue, 5 Mar 2019 16:22:15 +0000 Subject: [PATCH 4/5] ssl_server2: Fail gracefully if no PEM-encoded CRTs are available --- programs/ssl/ssl_server2.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c index 2c5a8cee9..f369dc840 100644 --- a/programs/ssl/ssl_server2.c +++ b/programs/ssl/ssl_server2.c @@ -1595,7 +1595,7 @@ int main( int argc, char *argv[] ) ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file ); else #endif -#if defined(MBEDTLS_CERTS_C) +#if defined(MBEDTLS_CERTS_C) && defined(MBEDTLS_PEM_PARSE_C) for( i = 0; mbedtls_test_cas[i] != NULL; i++ ) { ret = mbedtls_x509_crt_parse( &cacert, @@ -1607,9 +1607,13 @@ int main( int argc, char *argv[] ) #else { ret = 1; - mbedtls_printf("MBEDTLS_CERTS_C not defined."); +#if !defined(MBEDTLS_CERTS_C) + mbedtls_printf( "MBEDTLS_CERTS_C not defined." ); +#else + mbedtls_printf( "All test CRTs loaded via MBEDTLS_CERTS_C are PEM-encoded, but MBEDTLS_PEM_PARSE_C is disabled." ); } -#endif +#endif /* MBEDTLS_CERTS_C */ +#endif /* MBEDTLS_CERTS_C && MBEDTLS_PEM_PARSE_C */ if( ret < 0 ) { mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret ); From 0f1e53f6fec35e9e5ddf4a89646cb9071b3604dd Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Tue, 5 Mar 2019 16:18:47 +0000 Subject: [PATCH 5/5] Adapt ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 84ffe33be..2b3be7c1e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -36,6 +36,9 @@ Changes underlying OS actually guarantees. * Ciphersuites based on 3DES now have the lowest priority by default when they are enabled. + * Improve debug output of ssl_client2 and ssl_server2 in case suitable + test CRTs are available because MBEDTLS_PEM_PARSE_C is disabled. + Fixes #2254. = mbed TLS 2.7.9 branch released 2018-12-21