Skip to content

Commit 375fbf9

Browse files
sebastian-carpentersebastian-carpenter
committed
testing + bug fixes for TLS ECH
1 parent 62dfbd8 commit 375fbf9

10 files changed

Lines changed: 1110 additions & 114 deletions

File tree

‎.github/workflows/openssl-ech.yml‎

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
name: OpenSSL ECH Interop Test
2+
3+
# START OF COMMON SECTION
4+
on:
5+
push:
6+
branches: [ 'master', 'main', 'release/**' ]
7+
pull_request:
8+
branches: [ '*' ]
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
# END OF COMMON SECTION
14+
15+
jobs:
16+
build_wolfssl:
17+
name: Build wolfSSL
18+
if: github.repository_owner == 'wolfssl'
19+
runs-on: ubuntu-24.04
20+
timeout-minutes: 4
21+
steps:
22+
- name: Build wolfSSL
23+
uses: wolfSSL/actions-build-autotools-project@v1
24+
with:
25+
path: wolfssl
26+
configure: --enable-ech CFLAGS='-DUSE_FLAT_TEST_H'
27+
install: true
28+
29+
- name: tar build-dir
30+
run: |
31+
# need server.h which is not installed normally
32+
cp "$GITHUB_WORKSPACE/wolfssl/examples/server/server.h" \
33+
build-dir/share/doc/wolfssl/example/server.h
34+
# need certs so 'wolfSSL error: wolf root not found' does not show up
35+
cp -r "$GITHUB_WORKSPACE/wolfssl/certs" build-dir/certs
36+
tar -zcf build-dir.tgz build-dir
37+
38+
- name: Upload built wolfSSL
39+
uses: actions/upload-artifact@v4
40+
with:
41+
name: wolf-install-openssl-ech
42+
path: build-dir.tgz
43+
retention-days: 5
44+
45+
build_openssl_ech:
46+
name: Build OpenSSL (feature/ech)
47+
if: github.repository_owner == 'wolfssl'
48+
runs-on: ubuntu-24.04
49+
timeout-minutes: 10
50+
steps:
51+
- name: Checkout OpenSSL feature/ech branch
52+
uses: actions/checkout@v4
53+
with:
54+
repository: openssl/openssl
55+
ref: feature/ech
56+
path: openssl
57+
58+
- name: Build OpenSSL
59+
working-directory: openssl
60+
run: |
61+
./Configure --prefix=$GITHUB_WORKSPACE/openssl-install \
62+
--openssldir=$GITHUB_WORKSPACE/openssl-install/ssl \
63+
enable-ech no-docs
64+
make -j$(nproc)
65+
make install_sw
66+
67+
- name: tar openssl-install
68+
run: tar -zcf openssl-install.tgz openssl-install
69+
70+
- name: Upload built OpenSSL
71+
uses: actions/upload-artifact@v4
72+
with:
73+
name: openssl-ech-install
74+
path: openssl-install.tgz
75+
retention-days: 5
76+
77+
ech_interop_test:
78+
name: ECH Interop Test
79+
if: github.repository_owner == 'wolfssl'
80+
needs: [build_wolfssl, build_openssl_ech]
81+
runs-on: ubuntu-24.04
82+
timeout-minutes: 10
83+
steps:
84+
- name: Download wolfSSL build
85+
uses: actions/download-artifact@v4
86+
with:
87+
name: wolf-install-openssl-ech
88+
89+
- name: Download OpenSSL build
90+
uses: actions/download-artifact@v4
91+
with:
92+
name: openssl-ech-install
93+
94+
- name: Extract builds
95+
run: |
96+
tar -xzf build-dir.tgz
97+
tar -xzf openssl-install.tgz
98+
99+
- name: Build wolfssl server example
100+
run: |
101+
export WOLFSSL_INSTALL_DIR="$GITHUB_WORKSPACE/build-dir"
102+
export WOLFSSL_BIN_DIR="$GITHUB_WORKSPACE/build-dir/bin"
103+
export CFLAGS="-Wall -I$WOLFSSL_INSTALL_DIR/include"
104+
export LIBS="-L$WOLFSSL_INSTALL_DIR/lib -lm -lwolfssl"
105+
export LD_LIBRARY_PATH="$GITHUB_WORKSPACE/lib/:$LD_LIBRARY_PATH"
106+
107+
gcc -o "$WOLFSSL_BIN_DIR/server" \
108+
"$WOLFSSL_INSTALL_DIR/share/doc/wolfssl/example/server.c" \
109+
$CFLAGS $LIBS -I"$WOLFSSL_INSTALL_DIR/share/doc/wolfssl/example"
110+
111+
- name: ECH interop - wolfSSL server, OpenSSL client
112+
run: |
113+
set -e
114+
115+
export LD_LIBRARY_PATH="$GITHUB_WORKSPACE/openssl-install/lib64:$GITHUB_WORKSPACE/openssl-install/lib:$GITHUB_WORKSPACE/build-dir/lib:$LD_LIBRARY_PATH"
116+
117+
OPENSSL=$GITHUB_WORKSPACE/openssl-install/bin/openssl
118+
WOLFSSL_SERVER=$GITHUB_WORKSPACE/build-dir/bin/server
119+
120+
CERT_DIR="$GITHUB_WORKSPACE/build-dir/certs"
121+
READY_FILE="$GITHUB_WORKSPACE/wolfssl_tls13_ready$$"
122+
LOG_FILE="$GITHUB_WORKSPACE/log_file.log"
123+
PRIV_NAME="ech-private-name.com"
124+
PUB_NAME="ech-public-name.com"
125+
ECH_CONFIG=""
126+
PORT=0
127+
128+
rm -f "$READY_FILE"
129+
rm -f "$LOG_FILE"
130+
131+
# need to cd into build-dir so the certs/ dir is available for server
132+
cd build-dir
133+
134+
$OPENSSL version
135+
136+
# start server with ephemeral port + ready file
137+
# also set server to be line buffered so the log can be grepped
138+
stdbuf -oL $WOLFSSL_SERVER -v 4 -R "$READY_FILE" -p "$PORT" \
139+
-S "$PRIV_NAME" --ech "$PUB_NAME" &> "$LOG_FILE" &
140+
SERVER_PID=$!
141+
142+
# wait for server to be ready, then get port
143+
counter=0
144+
while [ ! -s "$READY_FILE" ]; do
145+
sleep 0.1
146+
counter=$((counter + 1))
147+
if [ "$counter" -gt 50 ]; then
148+
echo "ERROR: no ready file" &>> "$LOG_FILE"
149+
exit 1
150+
fi
151+
done
152+
PORT="$(cat "$READY_FILE")"
153+
154+
# get ECH config from server
155+
counter=0
156+
while [ -z "$ECH_CONFIG" ]; do
157+
ECH_CONFIG=$(grep -m1 "ECH config (base64): " "$LOG_FILE" \
158+
2>/dev/null | sed 's/ECH config (base64): //g')
159+
sleep 0.1
160+
counter=$((counter + 1))
161+
if [ "$counter" -gt 50 ]; then
162+
echo "ERROR: no ECH configs" &>> "$LOG_FILE"
163+
exit 1
164+
fi
165+
done
166+
167+
# Test with OpenSSL s_client using ECH
168+
echo "wolfssl" | $OPENSSL s_client \
169+
-tls1_3 \
170+
-connect "localhost:$PORT" \
171+
-cert "$CERT_DIR/client-cert.pem" \
172+
-key "$CERT_DIR/client-key.pem" \
173+
-CAfile "$CERT_DIR/ca-cert.pem" \
174+
-servername "$PRIV_NAME" \
175+
-ech_config_list "$ECH_CONFIG" \
176+
&>> "$LOG_FILE"
177+
178+
grep "ECH: success: 1" "$LOG_FILE"
179+
180+
# cleanup
181+
rm -f "$READY_FILE"
182+
kill $SERVER_PID 2>/dev/null
183+
184+
- name: Print debug info on failure
185+
if: ${{ failure() }}
186+
run: |
187+
if [ -s "$GITHUB_WORKSPACE/log_file.log" ]; then
188+
cat "$GITHUB_WORKSPACE/log_file.log"
189+
else
190+
echo "No log file"
191+
fi

‎examples/client/client.c‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1171,7 +1171,7 @@ static int ClientWriteRead(WOLFSSL* ssl, const char* msg, int msgSz,
11711171
/* 4. add the same message into Japanese section */
11721172
/* (will be translated later) */
11731173
/* 5. add printf() into suitable position of Usage() */
1174-
static const char* client_usage_msg[][79] = {
1174+
static const char* client_usage_msg[][80] = {
11751175
/* English */
11761176
{
11771177
" NOTE: All files relative to wolfSSL home dir\n", /* 0 */
@@ -1425,10 +1425,15 @@ static const char* client_usage_msg[][79] = {
14251425
#endif
14261426
#ifdef HAVE_ECC_BRAINPOOL
14271427
"--bpKs Use Brainpool ECC group for key share\n", /* 77 */
1428+
#endif
1429+
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH)
1430+
"--ech <base64> Use Encrypted Client Hello with base64 encoded "
1431+
"ECH configs\n",
1432+
/* 78 */
14281433
#endif
14291434
"\n"
14301435
"For simpler wolfSSL TLS client examples, visit\n"
1431-
"https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n", /* 78 */
1436+
"https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n", /* 79 */
14321437
NULL,
14331438
},
14341439
#ifndef NO_MULTIBYTE_PRINT
@@ -1931,6 +1936,9 @@ static void Usage(void)
19311936
#endif
19321937
#ifdef HAVE_ECC_BRAINPOOL
19331938
printf("%s", msg[++msgid]); /* --bpKs */
1939+
#endif
1940+
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH)
1941+
printf("%s", msg[++msgid]); /* --ech */
19341942
#endif
19351943
printf("%s", msg[++msgid]); /* --files-are-der */
19361944
printf("%s", msg[++msgid]); /* Documentation Hint */
@@ -2119,6 +2127,9 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
21192127
#endif /* WOLFSSL_SYS_CRYPTO_POLICY */
21202128
#ifdef HAVE_ECC_BRAINPOOL
21212129
{ "bpKs", 0, 270 },
2130+
#endif
2131+
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH)
2132+
{ "ech", 1, 271 },
21222133
#endif
21232134
{ 0, 0, 0 }
21242135
};
@@ -2187,6 +2198,9 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
21872198
#ifdef HAVE_SNI
21882199
char* sniHostName = NULL;
21892200
#endif
2201+
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH)
2202+
char* echConfigs64 = NULL;
2203+
#endif
21902204
#ifdef HAVE_TRUSTED_CA
21912205
int trustedCaKeyId = 0;
21922206
#endif
@@ -3013,6 +3027,11 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
30133027
#endif
30143028
break;
30153029
#endif
3030+
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH)
3031+
case 271:
3032+
echConfigs64 = myoptarg;
3033+
break;
3034+
#endif
30163035

30173036
default:
30183037
Usage();
@@ -3878,6 +3897,16 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
38783897
err_sys("unable to get SSL object");
38793898
}
38803899

3900+
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH)
3901+
if (echConfigs64 != NULL) {
3902+
if (wolfSSL_SetEchConfigsBase64(ssl, echConfigs64,
3903+
(word32)XSTRLEN(echConfigs64)) != WOLFSSL_SUCCESS) {
3904+
wolfSSL_CTX_free(ctx); ctx = NULL;
3905+
err_sys("SetEchConfigsBase64 failed");
3906+
}
3907+
}
3908+
#endif
3909+
38813910
#ifdef WOLFSSL_DUAL_ALG_CERTS
38823911
if (!wolfSSL_UseCKS(ssl, cks_order, sizeof(cks_order))) {
38833912
wolfSSL_CTX_free(ctx); ctx = NULL;

0 commit comments

Comments
 (0)