Skip to content

Commit fcedc91

Browse files
sebastian-carpentersebastian-carpenter
committed
touch-ups:
- shrink ech interop workflow - x448 macro now unused in hpke WOLFSSL_LOCAL functions - bug fixes in added tests
1 parent 7e9f9dc commit fcedc91

7 files changed

Lines changed: 77 additions & 107 deletions

File tree

‎.github/scripts/openssl-ech.sh‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,10 @@
33
set -e
44

55
cleanup() {
6-
cat "$TMP_LOG"
7-
rm -f "$TMP_LOG"
6+
if [ -f "$TMP_LOG" ]; then
7+
cat "$TMP_LOG"
8+
rm -f "$TMP_LOG"
9+
fi
810
}
911
trap cleanup EXIT
1012

‎.github/workflows/openssl-ech.yml‎

Lines changed: 22 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,13 @@ jobs:
3737
3838
# need certs so 'wolfSSL error: wolf root not found' does not show up
3939
cp -r "$GITHUB_WORKSPACE/wolfssl/certs" build-dir/certs
40-
tar -zcf build-dir.tgz build-dir
4140
4241
# need the ech script to run tests
4342
cp "$GITHUB_WORKSPACE/wolfssl/.github/scripts/openssl-ech.sh" \
4443
build-dir/openssl-ech.sh
4544
45+
tar -zcf build-dir.tgz build-dir
46+
4647
- name: Upload built wolfSSL
4748
uses: actions/upload-artifact@v4
4849
with:
@@ -82,8 +83,8 @@ jobs:
8283
path: openssl-install.tgz
8384
retention-days: 5
8485

85-
ech_server_interop_test:
86-
name: ECH Server Interop Test
86+
ech_interop_test:
87+
name: ECH Interop Test
8788
if: github.repository_owner == 'wolfssl'
8889
needs: [build_wolfssl, build_openssl_ech]
8990
runs-on: ubuntu-24.04
@@ -104,27 +105,32 @@ jobs:
104105
tar -xzf build-dir.tgz
105106
tar -xzf openssl-install.tgz
106107
107-
- name: Build wolfssl server example
108+
- name: Build wolfssl client and server examples
108109
run: |
109110
export WOLFSSL_INSTALL_DIR="$GITHUB_WORKSPACE/build-dir"
110111
export WOLFSSL_BIN_DIR="$WOLFSSL_INSTALL_DIR/bin"
111112
export CFLAGS="-Wall -I$WOLFSSL_INSTALL_DIR/include"
112113
export LIBS="-L$WOLFSSL_INSTALL_DIR/lib -lm -lwolfssl"
113114
export LD_LIBRARY_PATH="$WOLFSSL_INSTALL_DIR/lib/:$LD_LIBRARY_PATH"
114115
116+
gcc -o "$WOLFSSL_BIN_DIR/client" \
117+
"$WOLFSSL_INSTALL_DIR/share/doc/wolfssl/example/client.c" \
118+
$CFLAGS $LIBS -I"$WOLFSSL_INSTALL_DIR/share/doc/wolfssl/example"
119+
115120
gcc -o "$WOLFSSL_BIN_DIR/server" \
116121
"$WOLFSSL_INSTALL_DIR/share/doc/wolfssl/example/server.c" \
117122
$CFLAGS $LIBS -I"$WOLFSSL_INSTALL_DIR/share/doc/wolfssl/example"
118123
119-
- name: ECH interop - wolfSSL server, OpenSSL client
124+
- name: Interop test
120125
run: |
121126
set -e
122127
123128
export LD_LIBRARY_PATH="$GITHUB_WORKSPACE/openssl-install/lib64:$GITHUB_WORKSPACE/openssl-install/lib:$GITHUB_WORKSPACE/build-dir/lib:$LD_LIBRARY_PATH"
124129
125-
OPENSSL="$GITHUB_WORKSPACE/openssl-install/bin/openssl"
126-
WOLFSSL_SERVER="$GITHUB_WORKSPACE/build-dir/bin/server"
127-
CERT_DIR="$GITHUB_WORKSPACE/build-dir/certs"
130+
export OPENSSL="$GITHUB_WORKSPACE/openssl-install/bin/openssl"
131+
export WOLFSSL_CLIENT="$GITHUB_WORKSPACE/build-dir/bin/client"
132+
export WOLFSSL_SERVER="$GITHUB_WORKSPACE/build-dir/bin/server"
133+
export CERT_DIR="$GITHUB_WORKSPACE/build-dir/certs"
128134
LOG_FILE="$GITHUB_WORKSPACE/log_file.log"
129135
130136
# need to cd into build-dir so the certs/ dir is available for server
@@ -133,78 +139,18 @@ jobs:
133139
$OPENSSL version | tee "$LOG_FILE"
134140
135141
# default suite (DHKEM_X25519_HKDF_SHA256, HKDF_SHA256, HPKE_AES_128_GCM)
142+
echo -e "\nTesting default suite with OpenSSL server and wolfSSL client\n" &>> "$LOG_FILE"
143+
bash ./openssl-ech.sh server &>> "$LOG_FILE"
144+
145+
echo -e "\nTesting default suite with OpenSSL client and wolfSSL server\n" &>> "$LOG_FILE"
136146
bash ./openssl-ech.sh client &>> "$LOG_FILE"
137147
138148
# weird suite (DHKEM_P521_HKDF_SHA512, HKDF_SHA256, HPKE_AES_256_GCM)
139-
bash ./openssl-ech.sh client --suite "18,3,2" &>> "$LOG_FILE"
140-
141-
# cleanup
142-
rm -f "$LOG_FILE"
143-
144-
- name: Print debug info on failure
145-
if: ${{ failure() }}
146-
run: |
147-
if [ -s "$GITHUB_WORKSPACE/log_file.log" ]; then
148-
cat "$GITHUB_WORKSPACE/log_file.log"
149-
else
150-
echo "No log file"
151-
fi
149+
echo -e "\nTesting weird suite with OpenSSL server and wolfSSL client\n" &>> "$LOG_FILE"
150+
bash ./openssl-ech.sh server --suite "18,1,2" &>> "$LOG_FILE"
152151
153-
ech_client_interop_test:
154-
name: ECH Client Interop Test
155-
if: github.repository_owner == 'wolfssl'
156-
needs: [build_wolfssl, build_openssl_ech]
157-
runs-on: ubuntu-24.04
158-
timeout-minutes: 10
159-
steps:
160-
- name: Download wolfSSL build
161-
uses: actions/download-artifact@v4
162-
with:
163-
name: wolf-install-openssl-ech
164-
165-
- name: Download OpenSSL build
166-
uses: actions/download-artifact@v4
167-
with:
168-
name: openssl-ech-install
169-
170-
- name: Extract builds
171-
run: |
172-
tar -xzf build-dir.tgz
173-
tar -xzf openssl-install.tgz
174-
175-
- name: Build wolfssl client example
176-
run: |
177-
export WOLFSSL_INSTALL_DIR="$GITHUB_WORKSPACE/build-dir"
178-
export WOLFSSL_BIN_DIR="$WOLFSSL_INSTALL_DIR/bin"
179-
export CFLAGS="-Wall -I$WOLFSSL_INSTALL_DIR/include"
180-
export LIBS="-L$WOLFSSL_INSTALL_DIR/lib -lm -lwolfssl"
181-
export LD_LIBRARY_PATH="$WOLFSSL_INSTALL_DIR/lib/:$LD_LIBRARY_PATH"
182-
183-
gcc -o "$WOLFSSL_BIN_DIR/client" \
184-
"$WOLFSSL_INSTALL_DIR/share/doc/wolfssl/example/client.c" \
185-
$CFLAGS $LIBS -I"$WOLFSSL_INSTALL_DIR/share/doc/wolfssl/example"
186-
187-
- name: ECH interop - wolfSSL client, OpenSSL server
188-
run: |
189-
set -e
190-
191-
export LD_LIBRARY_PATH="$GITHUB_WORKSPACE/openssl-install/lib64:$GITHUB_WORKSPACE/openssl-install/lib:$GITHUB_WORKSPACE/build-dir/lib:$LD_LIBRARY_PATH"
192-
193-
OPENSSL="$GITHUB_WORKSPACE/openssl-install/bin/openssl"
194-
WOLFSSL_CLIENT="$GITHUB_WORKSPACE/build-dir/bin/client"
195-
CERT_DIR="$GITHUB_WORKSPACE/build-dir/certs"
196-
LOG_FILE="$GITHUB_WORKSPACE/log_file.log"
197-
198-
# need to cd into build-dir so the certs/ dir is available for client
199-
cd build-dir
200-
201-
$OPENSSL version | tee "$LOG_FILE"
202-
203-
# default suite (DHKEM_X25519_HKDF_SHA256, HKDF_SHA256, HPKE_AES_128_GCM)
204-
bash ./openssl-ech.sh server &>> "$LOG_FILE"
205-
206-
# weird suite (DHKEM_P521_HKDF_SHA512, HKDF_SHA256, HPKE_AES_256_GCM)
207-
bash ./openssl-ech.sh server --suite "18,3,2" &>> "$LOG_FILE"
152+
echo -e "\nTesting weird suite with OpenSSL client and wolfSSL server\n" &>> "$LOG_FILE"
153+
bash ./openssl-ech.sh client --suite "18,1,2" &>> "$LOG_FILE"
208154
209155
# cleanup
210156
rm -f "$LOG_FILE"

‎examples/server/server.c‎

Lines changed: 37 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1120,8 +1120,8 @@ static const char* server_usage_msg[][70] = {
11201120
"--ech <name> Generate Encrypted Client Hello config with "
11211121
"public name <name>\n",
11221122
/* 67 */
1123-
"--ech-suite <KEM,KDF,AEAD> HPKE suite to use for ech config. "
1124-
"Supplied as 3 integers (e.g., 32,1,3)\n",
1123+
"--ech-suite <KEM,KDF,AEAD> HPKE suite to use for ech config.\n"
1124+
" Supplied as 3 integers (ex: 32,1,3)\n",
11251125
/* 68 */
11261126
#endif
11271127
"\n"
@@ -1338,12 +1338,20 @@ static const char* server_usage_msg[][70] = {
13381338
#endif
13391339
#ifdef WOLFSSL_SYS_CRYPTO_POLICY
13401340
"--crypto-policy <path to crypto policy file>\n", /* 66 */
1341+
#endif
1342+
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH)
1343+
"--ech <name> Generate Encrypted Client Hello config with "
1344+
"public name <name>\n",
1345+
/* 67 */
1346+
"--ech-suite <KEM,KDF,AEAD> HPKE suite to use for ech config.\n"
1347+
" Supplied as 3 integers (ex: 32,1,3)\n",
1348+
/* 68 */
13411349
#endif
13421350
"\n"
13431351
"より簡単なwolfSSL TSL クライアントの例については"
13441352
"下記にアクセスしてください\n"
13451353
"https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n",
1346-
/* 67 */
1354+
/* 69 */
13471355
NULL,
13481356
},
13491357
#endif
@@ -1712,6 +1720,9 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
17121720
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH)
17131721
char* echPublicName = NULL;
17141722
char* echSuite = NULL;
1723+
word16 kemId = 0;
1724+
word16 kdfId = 0;
1725+
word16 aeadId = 0;
17151726
#endif
17161727

17171728
#ifdef HAVE_TRUSTED_CA
@@ -2547,6 +2558,29 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
25472558
break;
25482559
case 270:
25492560
echSuite = myoptarg;
2561+
2562+
/* parse alg id's ignoring overflows
2563+
* commas can be entered with no number to accept the default */
2564+
if (echSuite != NULL) {
2565+
kemId = (word16)atoi(echSuite);
2566+
for (; *echSuite != '\0' && *echSuite != ','; echSuite++);
2567+
if (*echSuite != ',') {
2568+
LOG_ERROR("Expected two commas '%s'\n", myoptarg);
2569+
XEXIT_T(EXIT_FAILURE);
2570+
}
2571+
echSuite++;
2572+
2573+
kdfId = (word16)atoi(echSuite);
2574+
for (; *echSuite != '\0' && *echSuite != ','; echSuite++);
2575+
if (*echSuite != ',') {
2576+
LOG_ERROR("Expected two commas'%s'\n", myoptarg);
2577+
XEXIT_T(EXIT_FAILURE);
2578+
}
2579+
echSuite++;
2580+
2581+
aeadId = (word16)atoi(echSuite);
2582+
}
2583+
25502584
break;
25512585
#endif
25522586

@@ -3116,24 +3150,6 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
31163150
char echConfigBase64[512];
31173151
char* echConfigBase64Ptr;
31183152
word32 echConfigBase64Len = sizeof(echConfigBase64);
3119-
word16 kemId = 0;
3120-
word16 kdfId = 0;
3121-
word16 aeadId = 0;
3122-
3123-
/* an optimistic approach to parsing the ciphersuite */
3124-
if (echSuite != NULL) {
3125-
const char* s = echSuite;
3126-
3127-
kemId = (word16)atoi(s);
3128-
for (; *s != '\0' && *s != ','; s++);
3129-
if (*s == ',') s++;
3130-
3131-
kdfId = (word16)atoi(s);
3132-
for (; *s != '\0' && *s != ','; s++);
3133-
if (*s == ',') s++;
3134-
3135-
aeadId = (word16)atoi(s);
3136-
}
31373153

31383154
if (wolfSSL_CTX_GenerateEchConfig(ctx, echPublicName, kemId, kdfId,
31393155
aeadId) != WOLFSSL_SUCCESS) {

‎src/ssl_ech.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ int wolfSSL_CTX_GenerateEchConfig(WOLFSSL_CTX* ctx, const char* publicName,
3535
{
3636
int ret = 0;
3737
WOLFSSL_EchConfig* newConfig;
38-
word16 encLen = sizeof(newConfig->receiverPubkey);
38+
word16 encLen = HPKE_Npk_MAX;
3939
#ifdef WOLFSSL_SMALL_STACK
4040
Hpke* hpke = NULL;
4141
WC_RNG* rng;

‎src/tls.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13260,6 +13260,10 @@ static int TLSX_ECH_Use(WOLFSSL_EchConfig* echConfig, TLSX** extensions,
1326013260
ech->configId = echConfig->configId;
1326113261
/* encLen */
1326213262
ech->encLen = wc_HpkeKemGetEncLen(echConfig->kemId);
13263+
if (ech->encLen == 0) {
13264+
XFREE(ech, heap, DYNAMIC_TYPE_TMP_BUFFER);
13265+
return BAD_FUNC_ARG;
13266+
}
1326313267
/* setup hpke */
1326413268
ech->hpke = (Hpke*)XMALLOC(sizeof(Hpke), heap, DYNAMIC_TYPE_TMP_BUFFER);
1326513269
if (ech->hpke == NULL) {

‎tests/api.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14613,7 +14613,7 @@ static int test_wolfSSL_Tls13_ECH_all_algos(void)
1461314613
for (k = 0; k < (int)(sizeof(aeads) / sizeof(*aeads)); k++) {
1461414614
echCbTestAeadID = aeads[k];
1461514615
ExpectIntEQ(test_wolfSSL_Tls13_ECH_all_algos_ex(),
14616-
WOLFSSL_SUCCESS);
14616+
TEST_SUCCESS);
1461714617
}
1461814618
}
1461914619
}

‎wolfcrypt/src/hpke.c‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1218,6 +1218,8 @@ int wc_HpkeOpenBase(Hpke* hpke, void* receiverKey, const byte* pubKey,
12181218
return ret;
12191219
}
12201220

1221+
/* return the encrypted length of the KEM
1222+
* return 0 otherwise */
12211223
WOLFSSL_LOCAL word16 wc_HpkeKemGetEncLen(word16 kemId)
12221224
{
12231225
switch (kemId)
@@ -1240,17 +1242,14 @@ WOLFSSL_LOCAL word16 wc_HpkeKemGetEncLen(word16 kemId)
12401242
(defined(WOLFSSL_SHA224) || !defined(NO_SHA256))
12411243
case DHKEM_X25519_HKDF_SHA256:
12421244
return DHKEM_X25519_ENC_LEN;
1243-
#endif
1244-
#if defined(HAVE_CURVE448) &&\
1245-
(defined(WOLFSSL_SHA384) || defined(WOLFSSL_SHA512))
1246-
case DHKEM_X448_HKDF_SHA512:
1247-
return DHKEM_X448_ENC_LEN;
12481245
#endif
12491246
default:
12501247
return 0;
12511248
}
12521249
}
12531250

1251+
/* return true if hpke is compiled with support for the given KEM
1252+
* return false otherwise */
12541253
WOLFSSL_LOCAL int wc_HpkeKemIsSupported(word16 kemId)
12551254
{
12561255
switch (kemId) {
@@ -1271,12 +1270,13 @@ WOLFSSL_LOCAL int wc_HpkeKemIsSupported(word16 kemId)
12711270
#endif
12721271
return 1;
12731272

1274-
case DHKEM_X448_HKDF_SHA512:
12751273
default:
12761274
return 0;
12771275
}
12781276
}
12791277

1278+
/* return true if hpke is compiled with support for the given KDF
1279+
* return false otherwise */
12801280
WOLFSSL_LOCAL int wc_HpkeKdfIsSupported(word16 kdfId)
12811281
{
12821282
switch (kdfId) {
@@ -1296,6 +1296,8 @@ WOLFSSL_LOCAL int wc_HpkeKdfIsSupported(word16 kdfId)
12961296
}
12971297
}
12981298

1299+
/* return true if hpke is compiled with support for the given AEAD
1300+
* return false otherwise */
12991301
WOLFSSL_LOCAL int wc_HpkeAeadIsSupported(word16 aeadId)
13001302
{
13011303
switch (aeadId) {

0 commit comments

Comments
 (0)