Skip to content

Commit 33cdc6a

Browse files
dgarskedgarske
committed
wolfKeyMgr v0.5:
* Fix for missing "make dist" files. * Fix possible seg fault if pid creation failed. * Fixed issue with forcful close of listen socket causing loop. * Added missing files for cert generation. * Added fingerprint to push syntax. * Added TODO item for key expires. * Remove certservice requirement. * Cleanup unused `KeyManager_t`. * Do not track and ignore options.h. * Spelling fixes.
1 parent f8a0fc7 commit 33cdc6a

File tree

17 files changed

+240
-37
lines changed

17 files changed

+240
-37
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,3 +56,4 @@ certs/server-*.pem
5656
certs/client-*.der
5757
certs/client-*.pem
5858
certs/serial.old
59+
options.h

‎README.md‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,16 +53,23 @@ $ sudo make install
5353

5454
2. Install wolfssl version 3.4.2+
5555

56+
Note: Requires at least wolfSSL v4.7.0 with PR https://github.com/wolfSSL/wolfssl/pull/3832
57+
5658
```sh
57-
$ ./configure --enable-certservice --enable-sniffer CFLAGS="-DWOLFSSL_DH_EXTRA"
59+
$ ./autogen.sh
60+
$ git clone https://github.com/wolfssl/wolfssl
61+
$ cd wolfssl
62+
$ ./autogen.sh
63+
$ ./configure --enable-sniffer CFLAGS="-DWOLFSSL_DH_EXTRA -DWOLFSSL_SNIFFER_WATCH"
5864
$ make
5965
$ make check # (optional, but highly recommended)
6066
$ sudo make install
6167
```
6268

6369
Notes:
64-
* To enable all Intel speedups use `--enable-intelasm --enable-sp --enable-sp-asm`
65-
* To enable all Aarch64 speedups use `--enable-armasm --enable-sp --enable-sp-asm`
70+
71+
* To enable all Intel (AESNI/AVX) speedups use `--enable-intelasm --enable-sp --enable-sp-asm`
72+
* To enable all ARMv8 (aarch64) speedups use `--enable-armasm --enable-sp --enable-sp-asm`
6673

6774
3. Building wolfKeyMgr on *nix from git repository
6875

‎certs/ca-ecc.cnf‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
[ ca ]
2+
# `man ca`
3+
default_ca = CA_default
4+
5+
[ CA_default ]
6+
# Directory and file locations.
7+
dir = .
8+
certs = $dir/certs
9+
new_certs_dir = $dir/certs
10+
database = $dir/certs/index.txt
11+
serial = $dir/certs/serial
12+
RANDFILE = $dir/private/.rand
13+
14+
# The root key and root certificate.
15+
private_key = $dir/certs/ca-key.pem
16+
certificate = $dir/certs/ca-cert.pem
17+
18+
# For certificate revocation lists.
19+
crlnumber = $dir/certs/crlnumber
20+
crl_extensions = crl_ext
21+
default_crl_days = 1000
22+
23+
# SHA-1 is deprecated, so use SHA-2 instead.
24+
default_md = sha256
25+
26+
name_opt = ca_default
27+
cert_opt = ca_default
28+
default_days = 3650
29+
preserve = no
30+
policy = policy_loose
31+
unique_subject = no
32+
33+
[ policy_strict ]
34+
# The root CA should only sign intermediate certificates that match.
35+
# See the POLICY FORMAT section of `man ca`.
36+
countryName = match
37+
stateOrProvinceName = match
38+
organizationName = match
39+
organizationalUnitName = optional
40+
commonName = supplied
41+
emailAddress = optional
42+
43+
[ policy_loose ]
44+
# Allow the intermediate CA to sign a more diverse range of certificates.
45+
# See the POLICY FORMAT section of the `ca` man page.
46+
countryName = optional
47+
stateOrProvinceName = optional
48+
localityName = optional
49+
organizationName = optional
50+
organizationalUnitName = optional
51+
commonName = supplied
52+
emailAddress = optional
53+
54+
[ req ]
55+
# Options for the `req` tool (`man req`).
56+
default_bits = 2048
57+
distinguished_name = req_distinguished_name
58+
string_mask = utf8only
59+
60+
# SHA-1 is deprecated, so use SHA-2 instead.
61+
default_md = sha256
62+
63+
# Extension to add when the -x509 option is used.
64+
x509_extensions = v3_ca
65+
66+
[ req_distinguished_name ]
67+
countryName = US
68+
stateOrProvinceName = Washington
69+
localityName = Seattle
70+
0.organizationName = wolfSSL
71+
organizationalUnitName = Development
72+
commonName = www.wolfssl.com
73+
emailAddress = [email protected]
74+
75+
[ v3_ca ]
76+
# Extensions for a typical CA (`man x509v3_config`).
77+
subjectKeyIdentifier = hash
78+
authorityKeyIdentifier = keyid:always,issuer
79+
basicConstraints = critical, CA:true
80+
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
81+
82+
[ v3_intermediate_ca ]
83+
# Extensions for a typical intermediate CA (`man x509v3_config`).
84+
subjectKeyIdentifier = hash
85+
authorityKeyIdentifier = keyid:always,issuer
86+
basicConstraints = critical, CA:true, pathlen:0
87+
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
88+
89+
[ usr_cert ]
90+
# Extensions for client certificates (`man x509v3_config`).
91+
basicConstraints = CA:FALSE
92+
nsCertType = client, email
93+
subjectKeyIdentifier = hash
94+
authorityKeyIdentifier = keyid,issuer
95+
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
96+
extendedKeyUsage = clientAuth, emailProtection
97+
98+
[ server_cert ]
99+
# Extensions for server certificates (`man x509v3_config`).
100+
basicConstraints = CA:FALSE
101+
nsCertType = server
102+
subjectKeyIdentifier = hash
103+
subjectAltName=IP:127.0.0.1
104+
authorityKeyIdentifier = keyid,issuer:always
105+
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
106+
extendedKeyUsage = serverAuth
107+
108+
[ crl_ext ]
109+
# Extension for CRLs (`man x509v3_config`).
110+
authorityKeyIdentifier=keyid:always

‎certs/gen-certs.sh‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
#!/bin/bash
2+
3+
echo "Run from wolfkeymgr root"
4+
5+
# Make sure required CA files exist and are populated
6+
rm -f ./certs/index.*
7+
touch ./certs/index.txt
8+
if [ ! -f ./certs/serial ]; then
9+
echo 1000 > ./certs/serial
10+
fi
11+
if [ ! -f ./certs/crlnumber ]; then
12+
echo 2000 > ./certs/crlnumber
13+
fi
14+
15+
if [ "$1" == "clean" ]; then
16+
rm -f ./certs/1*.pem
17+
rm -f ./certs/ca-*.pem
18+
rm -f ./certs/client-*.pem
19+
rm -f ./certs/client-*.der
20+
rm -f ./certs/server-*.pem
21+
rm -f ./certs/server-*.der
22+
rm -f ./certs/*.old
23+
24+
exit 0
25+
fi
26+
27+
# Script to generated a TLS server and client certificates
28+
29+
# Keys use ECC and PKCS8 with password "wolfssl"
30+
31+
# Generate ECC 256-bit CA
32+
if [ ! -f ./certs/ca-key.pem ]; then
33+
echo "Creating CA Key (SECP256R1)"
34+
openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 -topk8 -v2 aes-128-cbc -outform pem -out ./certs/ca-key.pem
35+
fi
36+
echo "Creating self signed root CA certificate"
37+
openssl req -config ./certs/ca-ecc.cnf -extensions v3_ca -x509 -nodes -key ./certs/ca-key.pem -passin pass:'wolfssl' \
38+
-out ./certs/ca-cert.pem -sha256 -days 7300 -batch \
39+
-subj "/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/[email protected]"
40+
41+
# Client Key
42+
if [ ! -f ./certs/client-key.pem ]; then
43+
echo "Creating Client Key (SECP256R1)"
44+
openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 -topk8 -v2 aes-128-cbc -outform pem -out ./certs/client-key.pem
45+
fi
46+
47+
# Client Cert
48+
echo "Creating signed Client certificate"
49+
openssl req -config ./certs/ca-ecc.cnf -sha256 -new -key ./certs/client-key.pem -passin pass:'wolfssl' \
50+
-out ./certs/client-cert.csr \
51+
-subj "/C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC/CN=www.wolfssl.com/[email protected]/"
52+
openssl ca -config ./certs/ca-ecc.cnf -extensions usr_cert -days 3650 -notext -md sha256 \
53+
-passin pass:'wolfssl' -in ./certs/client-cert.csr -out ./certs/client-cert.pem -batch
54+
rm ./certs/client-cert.csr
55+
56+
if [ ! -f ./certs/server-key.pem ]; then
57+
echo "Creating Server Key (SECP256R1)"
58+
openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 -topk8 -v2 aes-128-cbc -outform pem -out ./certs/server-key.pem
59+
fi
60+
61+
# Server Cert
62+
echo "Creating signed Server certificate"
63+
openssl req -config ./certs/ca-ecc.cnf -sha256 -new -key ./certs/server-key.pem -passin pass:'wolfssl' \
64+
-out ./certs/server-cert.csr \
65+
-subj "/C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC/CN=www.wolfssl.com/[email protected]/"
66+
openssl ca -config ./certs/ca-ecc.cnf -extensions server_cert -days 3650 -notext -md sha256 \
67+
-passin pass:'wolfssl' -in ./certs/server-cert.csr -out ./certs/server-cert.pem -batch
68+
rm ./certs/server-cert.csr
69+
70+
71+
# Script to generated a self-signed TLS server certificate for Apache
72+
# No key password
73+
74+
if [ -f ./certs/test-key.pem ]; then
75+
# ECC
76+
openssl ecparam -name prime256v1 -genkey -outform pem -out ./certs/test-key.pem
77+
fi
78+
79+
openssl req -new -x509 -nodes -key ./certs/test-key.pem -out ./certs/test-cert.pem -sha256 -days 7300 -batch -subj "/C=US/ST=CA/L=Seattle/O=wolfSSL/OU=Development/CN=etsitest.com/[email protected]"

‎certs/include.am‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,5 @@ EXTRA_DIST += certs/client-key.pem
1010
EXTRA_DIST += certs/client-cert.pem
1111
EXTRA_DIST += certs/server-key.pem
1212
EXTRA_DIST += certs/server-cert.pem
13+
EXTRA_DIST += certs/test-cert.pem
14+
EXTRA_DIST += certs/test-key.pem

‎certs/test-cert.pem‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,16 @@
11
-----BEGIN CERTIFICATE-----
2-
MIICajCCAg+gAwIBAgIUMkpxF7cixTbgy2s3ZtLYCCq7pmEwCgYIKoZIzj0EAwIw
3-
gYkxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHU2VhdHRsZTEQ
4-
MA4GA1UECgwHd29sZlNTTDEUMBIGA1UECwwLRGV2ZWxvcG1lbnQxEjAQBgNVBAMM
5-
CWxvY2FsaG9zdDEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTAeFw0y
6-
MTAzMDExOTU2MjFaFw00MTAyMjQxOTU2MjFaMIGJMQswCQYDVQQGEwJVUzELMAkG
7-
A1UECAwCQ0ExEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZTU0wxFDAS
8-
BgNVBAsMC0RldmVsb3BtZW50MRIwEAYDVQQDDAlsb2NhbGhvc3QxHzAdBgkqhkiG
9-
9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC
10-
AAToBp+YdaHpiRuvAWYXgK/mv7M1szpyfv7EXYDQXibu3moryej10+ReWc5neXgD
11-
VfQEZ1O6CkwPo7lZU6FBhGxmo1MwUTAdBgNVHQ4EFgQUvWcAwbZL6I6LHUZYMSdT
12-
FBzD3cswHwYDVR0jBBgwFoAUvWcAwbZL6I6LHUZYMSdTFBzD3cswDwYDVR0TAQH/
13-
BAUwAwEB/zAKBggqhkjOPQQDAgNJADBGAiEAtC5RgbHrOuOOZznMc62hjjmSHFCz
14-
3GJOj6dVuZkbFxMCIQC+RA9BvaXbUirbRZzyQThhN9ohZR5cu2G9PAwy7o1cXw==
2+
MIICbzCCAhWgAwIBAgIUXcyHnGxDNR6GBYq4ZHSm7hJ+e8gwCgYIKoZIzj0EAwIw
3+
gYwxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHU2VhdHRsZTEQ
4+
MA4GA1UECgwHd29sZlNTTDEUMBIGA1UECwwLRGV2ZWxvcG1lbnQxFTATBgNVBAMM
5+
DGV0c2l0ZXN0LmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTAe
6+
Fw0yMTAzMTkxOTAzMTVaFw00MTAzMTQxOTAzMTVaMIGMMQswCQYDVQQGEwJVUzEL
7+
MAkGA1UECAwCQ0ExEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZTU0wx
8+
FDASBgNVBAsMC0RldmVsb3BtZW50MRUwEwYDVQQDDAxldHNpdGVzdC5jb20xHzAd
9+
BgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wWTATBgcqhkjOPQIBBggqhkjO
10+
PQMBBwNCAAToBp+YdaHpiRuvAWYXgK/mv7M1szpyfv7EXYDQXibu3moryej10+Re
11+
Wc5neXgDVfQEZ1O6CkwPo7lZU6FBhGxmo1MwUTAdBgNVHQ4EFgQUvWcAwbZL6I6L
12+
HUZYMSdTFBzD3cswHwYDVR0jBBgwFoAUvWcAwbZL6I6LHUZYMSdTFBzD3cswDwYD
13+
VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiEA6JE1aOqHMqa5zMtRuwuK
14+
qhKVmsgaV/FHHALuS6BmEF4CIEbQMTDs9HuSJiLUD15KqkDvgTs5EUJC7CTxgd+r
15+
WRpw
1516
-----END CERTIFICATE-----

‎configure.ac‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
AC_PREREQ(2.59)
77

8-
AC_INIT([wolfKeyManager],[0.4],[http://www.wolfssl.com])
8+
AC_INIT([wolfKeyManager],[0.5],[http://www.wolfssl.com])
99
AC_CONFIG_AUX_DIR(config)
1010
AC_CONFIG_HEADERS([wolfkeymgr/config.h])
1111
AC_CONFIG_MACRO_DIR(m4)
@@ -71,7 +71,7 @@ LT_PREREQ([2.2])
7171
LT_INIT([disable-static win32-dll])
7272

7373
# Shared library versioning
74-
WOLFKM_LIBRARY_VERSION=3:0:1
74+
WOLFKM_LIBRARY_VERSION=3:0:2
7575
# | | |
7676
# +------+ | +---+
7777
# | | |

‎examples/etsi_client/include.am‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@ examples_etsi_client_etsi_client_CFLAGS = -Isrc
99
examples_etsi_client_etsi_client_LDFLAGS = -Lsrc
1010
examples_etsi_client_etsi_client_LDADD = src/libwolfkeymgr.la $(LIB_STATIC_ADD)
1111
examples_etsi_client_etsi_client_DEPENDENCIES = src/libwolfkeymgr.la
12-
EXTRA_DIST +=
12+
EXTRA_DIST += examples/etsi_client/etsi_client.h

‎m4/have_cyassl.m4‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ AC_DEFUN([_TAO_SEARCH_LIBCYASSL],[
1515
#include <cyassl/ssl.h>
1616
],[
1717
CyaSSL_Init();
18-
CyaSSL_cert_service();
1918
])
2019
2120
AM_CONDITIONAL(HAVE_LIBCYASSL, [test "x${ac_cv_libcyassl}" = "xyes"])
@@ -49,7 +48,7 @@ AC_DEFUN([_TAO_REQUIRE_LIBCYASSL],[
4948
_TAO_SEARCH_LIBCYASSL
5049
5150
AS_IF([test x$ac_cv_libcyassl = xno],[
52-
AC_MSG_ERROR([libcyassl is required for ${PACKAGE}, it should be built with --enable-certservice. It can be obtained from http://www.yassl.com/download.html/])
51+
AC_MSG_ERROR([libcyassl is required for ${PACKAGE}. It can be obtained from http://www.yassl.com/download.html/])
5352
])
5453
])
5554

‎m4/have_wolfssl.m4‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ AC_DEFUN([_WOLF_SEARCH_LIBWOLFSSL],[
1616
#include <wolfssl/ssl.h>
1717
],[
1818
wolfSSL_Init();
19-
wolfSSL_cert_service();
2019
])
2120
2221
AM_CONDITIONAL(HAVE_LIBWOLFSSL, [test "x${ac_cv_libwolfssl}" = "xyes"])
@@ -50,7 +49,7 @@ AC_DEFUN([_WOLF_REQUIRE_LIBWOLFSSL],[
5049
_WOLF_SEARCH_LIBWOLFSSL
5150
5251
AS_IF([test x$ac_cv_libwolfssl = xno],[
53-
AC_MSG_ERROR([libwolfssl is required for ${PACKAGE}, it should be built with --enable-certservice. It can be obtained from http://www.wolfssl.com/download.html/])
52+
AC_MSG_ERROR([libwolfssl is required for ${PACKAGE}. It can be obtained from http://www.wolfssl.com/download.html/])
5453
])
5554
])
5655

0 commit comments

Comments
 (0)