Skip to content

Commit 55801ba

Browse files
gojimmypigojimmypi
committed
Introduce WOLFSSL_DEBUG_CERTS Certificate Debug Messages
1 parent 17f3da1 commit 55801ba

File tree

10 files changed

+198
-36
lines changed

10 files changed

+198
-36
lines changed

‎.github/workflows/os-check.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ jobs:
5151
'--enable-opensslall --enable-opensslextra CPPFLAGS=-DWC_RNG_SEED_CB',
5252
'--enable-opensslall --enable-opensslextra
5353
CPPFLAGS=''-DWC_RNG_SEED_CB -DWOLFSSL_NO_GETPID'' ',
54+
'--enable-all CPPFLAGS=-DWOLFSSL_DEBUG_CERTS ',
5455
]
5556
name: make check
5657
if: github.repository_owner == 'wolfssl'

‎.wolfssl_known_macro_extras‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -320,6 +320,7 @@ MODULE_SOCK_TCP
320320
MP_31BIT
321321
MP_8BIT
322322
MQX_USE_IO_OLD
323+
MSG_CERT_INDENT
323324
MULTI_VALUE_STATISTICS
324325
MUTEX_DURING_INIT
325326
NEED_THREADX_TYPES

‎src/internal.c‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15707,7 +15707,7 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
1570715707
if (ret == WC_NO_ERR_TRACE(ASN_NO_SIGNER_E) ||
1570815708
ret == WC_NO_ERR_TRACE(ASN_SELF_SIGNED_E)) {
1570915709
if (!ssl->options.usingAltCertChain) {
15710-
WOLFSSL_MSG("Trying alternate cert chain");
15710+
WOLFSSL_MSG_CERT("Trying alternate cert chain");
1571115711
ssl->options.usingAltCertChain = 1;
1571215712
}
1571315713

@@ -15719,8 +15719,22 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
1571915719

1572015720
/* do not add to certificate manager */
1572115721
skipAddCA = 1;
15722+
} /* ASN_NO_SIGNER_E || ASN_SELF_SIGNED_E */
15723+
} /* ret != 0 && isCA */
15724+
#else
15725+
/* When WOLFSSL_DEBUG_CERTS enabled, suggest solution */
15726+
if (ret != 0 && args->dCert->isCA) {
15727+
if (ret == WC_NO_ERR_TRACE(ASN_NO_SIGNER_E)) {
15728+
WOLFSSL_MSG_CERT(
15729+
"Consider enabling WOLFSSL_ALT_CERT_CHAINS"
15730+
" to resolve ASN_NO_SIGNER_E");
1572215731
}
15723-
}
15732+
if (ret == WC_NO_ERR_TRACE(ASN_SELF_SIGNED_E)) {
15733+
WOLFSSL_MSG_CERT(
15734+
"Consider enabling WOLFSSL_ALT_CERT_CHAINS"
15735+
" to resolve ASN_SELF_SIGNED_E");
15736+
}
15737+
} /* check alt-cert possible fixable error codes */
1572415738
#endif /* WOLFSSL_ALT_CERT_CHAINS */
1572515739

1572615740
#if defined(__APPLE__) && defined(WOLFSSL_SYS_CA_CERTS)

‎src/ssl.c‎

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5866,7 +5866,9 @@ int AddCA(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int type, int verify)
58665866
DecodedCert cert[1];
58675867
#endif
58685868
DerBuffer* der = *pDer;
5869-
5869+
#ifdef WOLFSSL_DEBUG_CERTS
5870+
const char* msg;
5871+
#endif
58705872
WOLFSSL_MSG("Adding a CA");
58715873

58725874
if (cm == NULL) {
@@ -5891,8 +5893,30 @@ int AddCA(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int type, int verify)
58915893
}
58925894
#endif
58935895

5896+
WOLFSSL_MSG_CERT("\tParsing new CA");
58945897
ret = ParseCert(cert, CA_TYPE, verify, cm);
5898+
58955899
WOLFSSL_MSG("\tParsed new CA");
5900+
#ifdef WOLFSSL_SMALL_STACK
5901+
if (cert == NULL) {
5902+
WOLFSSL_MSG_CERT(MSG_CERT_INDENT"Failed; cert is NULL");
5903+
}
5904+
else {
5905+
#endif
5906+
if (ret == 0) {
5907+
WOLFSSL_MSG_CERT(MSG_CERT_INDENT"issuer: '%s'", cert->issuer);
5908+
WOLFSSL_MSG_CERT(MSG_CERT_INDENT"subject: '%s'", cert->subject);
5909+
}
5910+
else {
5911+
WOLFSSL_MSG_CERT(MSG_CERT_INDENT"Failed during parse of new CA");
5912+
#ifdef WOLFSSL_DEBUG_CERTS
5913+
msg = wc_GetErrorString(ret);
5914+
WOLFSSL_MSG_CERT(MSG_CERT_INDENT"error ret: %d; %s", ret, msg);
5915+
#endif
5916+
}
5917+
#ifdef WOLFSSL_SMALL_STACK
5918+
} /* cert pointer null check */
5919+
#endif
58965920

58975921
#ifndef NO_SKID
58985922
subjectHash = cert->extSubjKeyId;
@@ -5901,7 +5925,7 @@ int AddCA(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int type, int verify)
59015925
#endif
59025926

59035927
/* check CA key size */
5904-
if (verify) {
5928+
if (verify && (ret == 0 )) {
59055929
switch (cert->keyOID) {
59065930
#ifndef NO_RSA
59075931
#ifdef WC_RSA_PSS
@@ -5911,7 +5935,9 @@ int AddCA(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int type, int verify)
59115935
if (cm->minRsaKeySz < 0 ||
59125936
cert->pubKeySize < (word16)cm->minRsaKeySz) {
59135937
ret = RSA_KEY_SIZE_E;
5914-
WOLFSSL_MSG("\tCA RSA key size error");
5938+
WOLFSSL_MSG_CERT("\tCA RSA key size error: pubKeySize = %d;"
5939+
" minRsaKeySz = %d",
5940+
cert->pubKeySize, cm->minRsaKeySz);
59155941
}
59165942
break;
59175943
#endif /* !NO_RSA */
@@ -5920,7 +5946,9 @@ int AddCA(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int type, int verify)
59205946
if (cm->minEccKeySz < 0 ||
59215947
cert->pubKeySize < (word16)cm->minEccKeySz) {
59225948
ret = ECC_KEY_SIZE_E;
5923-
WOLFSSL_MSG("\tCA ECC key size error");
5949+
WOLFSSL_MSG_CERT("\tCA ECC key size error: pubKeySize = %d;"
5950+
" minRsaKeySz = %d",
5951+
cert->pubKeySize, cm->minRsaKeySz);
59245952
}
59255953
break;
59265954
#endif /* HAVE_ECC */

‎wolfcrypt/src/asn.c‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25590,7 +25590,7 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm,
2559025590
}
2559125591
}
2559225592
#endif /* IGNORE_NAME_CONSTRAINTS */
25593-
}
25593+
} /* cert->ca */
2559425594
#ifdef WOLFSSL_CERT_REQ
2559525595
else if (type == CERTREQ_TYPE) {
2559625596
/* try to confirm/verify signature */
@@ -25654,7 +25654,7 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm,
2565425654
#endif
2565525655
else {
2565625656
/* no signer */
25657-
WOLFSSL_MSG("No CA signer to verify with");
25657+
WOLFSSL_MSG_CERT("No CA signer to verify with");
2565825658
/* If you end up here with error -188,
2565925659
* consider using WOLFSSL_ALT_CERT_CHAINS. */
2566025660
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
@@ -25667,10 +25667,11 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm,
2566725667
#endif
2566825668
{
2566925669
WOLFSSL_ERROR_VERBOSE(ASN_NO_SIGNER_E);
25670+
WOLFSSL_MSG_CERT("Consider using WOLFSSL_ALT_CERT_CHAINS.");
2567025671
return ASN_NO_SIGNER_E;
2567125672
}
2567225673
}
25673-
}
25674+
} /* verify != NO_VERIFY && type != CA_TYPE && type != TRUSTED_PEER_TYPE */
2567425675

2567525676
#if defined(WOLFSSL_NO_TRUSTED_CERTS_VERIFY) && !defined(NO_SKID)
2567625677
exit_pcr:
@@ -25680,7 +25681,7 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm,
2568025681
if (verify != VERIFY_SKIP_DATE) {
2568125682
return cert->badDate;
2568225683
}
25683-
WOLFSSL_MSG("Date error: Verify option is skipping");
25684+
WOLFSSL_MSG_CERT("Date error: Verify option is skipping");
2568425685
}
2568525686

2568625687
if (cert->criticalExt != 0)

‎wolfcrypt/src/logging.c‎

Lines changed: 74 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,18 @@
2121

2222
#include <wolfssl/wolfcrypt/libwolfssl_sources.h>
2323

24+
/*
25+
* Display debug messages: wolfSSL_Debugging_ON();
26+
* Turn off debug messages: wolfSSL_Debugging_OFF();
27+
*
28+
* #define WOLFSSL_DEBUG_CERTS
29+
* Define to enable cert-related diagnostic messages.
30+
* Enabled automatically with DEBUG_WOLFSSL but can be use separately.
31+
*
32+
* Optional user callbacks:
33+
* wolfSSL_SetLoggingCb(my_log_cb);
34+
*/
35+
2436
#if defined(OPENSSL_EXTRA) && !defined(WOLFCRYPT_ONLY)
2537
/* avoid adding WANT_READ and WANT_WRITE to error queue */
2638
#include <wolfssl/error-ssl.h>
@@ -115,7 +127,7 @@ THREAD_LS_T void *StackSizeCheck_stackOffsetPointer = 0;
115127

116128
#endif /* HAVE_STACK_SIZE_VERBOSE */
117129

118-
#ifdef DEBUG_WOLFSSL
130+
#if defined(DEBUG_WOLFSSL) || defined(WOLFSSL_DEBUG_CERTS)
119131

120132
/* Set these to default values initially. */
121133
static wolfSSL_Logging_cb log_function = NULL;
@@ -178,7 +190,7 @@ void wolfSSL_Debugging_OFF(void)
178190

179191
WOLFSSL_API void wolfSSL_SetLoggingPrefix(const char* prefix)
180192
{
181-
#ifdef DEBUG_WOLFSSL
193+
#if defined(DEBUG_WOLFSSL) || defined(WOLFSSL_DEBUG_CERTS)
182194
log_prefix = prefix;
183195
#else
184196
(void)prefix;
@@ -228,7 +240,7 @@ void WOLFSSL_TIME(int count)
228240
}
229241
#endif
230242

231-
#ifdef DEBUG_WOLFSSL
243+
#if defined(DEBUG_WOLFSSL) || defined(WOLFSSL_DEBUG_CERTS)
232244

233245

234246
#ifdef HAVE_STACK_SIZE_VERBOSE
@@ -248,24 +260,33 @@ static void wolfssl_log(const int logLevel, const char* const file_name,
248260
#elif defined(WOLFSSL_DEBUG_PRINTF_FN)
249261
#ifdef WOLFSSL_MDK_ARM
250262
fflush(stdout);
263+
#endif
264+
/* see settings.h for platform-specific line endings */
265+
#ifndef WOLFSSL_DEBUG_LINE_ENDING
266+
#define WOLFSSL_DEBUG_LINE_ENDING "\n"
251267
#endif
252268
if (log_prefix != NULL) {
253-
if (file_name != NULL)
269+
if (file_name != NULL) {
254270
WOLFSSL_DEBUG_PRINTF_FN(WOLFSSL_DEBUG_PRINTF_FIRST_ARGS
255-
"[%s]: [%s L %d] %s\n",
271+
"[%s]: [%s L %d] %s"WOLFSSL_DEBUG_LINE_ENDING,
256272
log_prefix, file_name, line_number, logMessage);
257-
else
273+
}
274+
else {
258275
WOLFSSL_DEBUG_PRINTF_FN(WOLFSSL_DEBUG_PRINTF_FIRST_ARGS
259-
"[%s]: %s\n", log_prefix, logMessage);
260-
} else {
261-
if (file_name != NULL)
276+
"[%s]: %s"WOLFSSL_DEBUG_LINE_ENDING, log_prefix, logMessage);
277+
} /* file_name check */
278+
}
279+
else {
280+
if (file_name != NULL) {
262281
WOLFSSL_DEBUG_PRINTF_FN(WOLFSSL_DEBUG_PRINTF_FIRST_ARGS
263-
"[%s L %d] %s\n",
282+
"[%s L %d] %s"WOLFSSL_DEBUG_LINE_ENDING,
264283
file_name, line_number, logMessage);
265-
else
284+
}
285+
else {
266286
WOLFSSL_DEBUG_PRINTF_FN(WOLFSSL_DEBUG_PRINTF_FIRST_ARGS
267-
"%s\n", logMessage);
268-
}
287+
"%s"WOLFSSL_DEBUG_LINE_ENDING, logMessage);
288+
} /* file_name check */
289+
} /* log_prefix check */
269290
#ifdef WOLFSSL_MDK_ARM
270291
fflush(stdout);
271292
#endif
@@ -287,10 +308,14 @@ static void wolfssl_log(const int logLevel, const char* const file_name,
287308

288309
#if defined(XVSNPRINTF) && !defined(NO_WOLFSSL_MSG_EX)
289310
#include <stdarg.h> /* for var args */
311+
290312
#ifndef WOLFSSL_MSG_EX_BUF_SZ
291313
#define WOLFSSL_MSG_EX_BUF_SZ 100
292314
#endif
315+
293316
#undef WOLFSSL_MSG_EX /* undo WOLFSSL_DEBUG_CODEPOINTS wrapper */
317+
318+
#ifndef WOLFSSL_MSG_EX_DO_NOTHING
294319
#ifdef __clang__
295320
/* tell clang argument 1 is format */
296321
__attribute__((__format__ (__printf__, 1, 0)))
@@ -308,6 +333,7 @@ void WOLFSSL_MSG_EX(const char* fmt, ...)
308333
wolfssl_log(INFO_LOG, NULL, 0, msg);
309334
}
310335
}
336+
#endif
311337

312338
#ifdef WOLFSSL_DEBUG_CODEPOINTS
313339
void WOLFSSL_MSG_EX2(const char *file, int line, const char* fmt, ...)
@@ -323,16 +349,34 @@ void WOLFSSL_MSG_EX2(const char *file, int line, const char* fmt, ...)
323349
wolfssl_log(INFO_LOG, file, line, msg);
324350
}
325351
}
326-
#endif
352+
#endif /* WOLFSSL_DEBUG_CODEPOINTS */
327353

328-
#endif
354+
#if defined(DEBUG_WOLFSSL) || defined(WOLFSSL_DEBUG_CERTS)
355+
void WOLFSSL_MSG_CERT(const char* fmt, ...)
356+
{
357+
/* Always show cert debug messages, even with loggingEnabled == 0 */
358+
char msg[WOLFSSL_MSG_EX_BUF_SZ];
359+
int written;
360+
va_list args;
361+
va_start(args, fmt);
362+
written = XVSNPRINTF(msg, sizeof(msg), fmt, args);
363+
va_end(args);
364+
if (written > 0) {
365+
wolfssl_log(CERT_LOG, NULL, 0, msg);
366+
}
367+
}
368+
#endif /* DEBUG_WOLFSSL || WOLFSSL_DEBUG_CERTS */
369+
370+
#endif /* XVSNPRINTF && !NO_WOLFSSL_MSG_EX */
329371

330372
#undef WOLFSSL_MSG /* undo WOLFSSL_DEBUG_CODEPOINTS wrapper */
373+
#ifndef WOLFSSL_MSG_DO_NOTHING
331374
void WOLFSSL_MSG(const char* msg)
332375
{
333376
if (loggingEnabled)
334377
wolfssl_log(INFO_LOG, NULL, 0, msg);
335378
}
379+
#endif
336380

337381
#ifdef WOLFSSL_DEBUG_CODEPOINTS
338382
void WOLFSSL_MSG2(const char *file, int line, const char* msg)
@@ -420,6 +464,7 @@ void WOLFSSL_BUFFER(const byte* buffer, word32 length)
420464
}
421465

422466
#undef WOLFSSL_ENTER /* undo WOLFSSL_DEBUG_CODEPOINTS wrapper */
467+
#ifndef WOLFSSL_ENTER_DO_NOTHING
423468
void WOLFSSL_ENTER(const char* msg)
424469
{
425470
if (loggingEnabled) {
@@ -432,6 +477,7 @@ void WOLFSSL_ENTER(const char* msg)
432477
wolfssl_log(ENTER_LOG, NULL, 0, buffer);
433478
}
434479
}
480+
#endif /* WOLFSSL_ENTER_DO_NOTHING */
435481

436482
#ifdef WOLFSSL_DEBUG_CODEPOINTS
437483
void WOLFSSL_ENTER2(const char *file, int line, const char* msg)
@@ -449,6 +495,7 @@ void WOLFSSL_ENTER2(const char *file, int line, const char* msg)
449495
#endif
450496

451497
#undef WOLFSSL_LEAVE /* undo WOLFSSL_DEBUG_CODEPOINTS wrapper */
498+
#ifndef WOLFSSL_LEAVE_DO_NOTHING
452499
void WOLFSSL_LEAVE(const char* msg, int ret)
453500
{
454501
if (loggingEnabled) {
@@ -462,6 +509,7 @@ void WOLFSSL_LEAVE(const char* msg, int ret)
462509
wolfssl_log(LEAVE_LOG, NULL, 0, buffer);
463510
}
464511
}
512+
#endif /* WOLFSSL_LEAVE_DO_NOTHING */
465513

466514
#ifdef WOLFSSL_DEBUG_CODEPOINTS
467515
void WOLFSSL_LEAVE2(const char *file, int line, const char* msg, int ret)
@@ -490,15 +538,26 @@ void WOLFSSL_LEAVE2(const char *file, int line, const char* msg, int ret)
490538
#endif
491539
#endif
492540

541+
#ifndef WOLFSSL_IS_DEBUG_ON_DO_NOTHING
493542
WOLFSSL_API int WOLFSSL_IS_DEBUG_ON(void)
494543
{
495544
return loggingEnabled;
496545
}
546+
#endif /* WOLFSSL_IS_DEBUG_ON_NO_NOTHING */
497547
#endif /* !WOLFSSL_DEBUG_ERRORS_ONLY */
498548
#endif /* DEBUG_WOLFSSL */
499549

500550
#if defined(OPENSSL_EXTRA) || defined(DEBUG_WOLFSSL_VERBOSE) || defined(HAVE_MEMCACHED)
501551

552+
#ifndef DEBUG_WOLFSSL
553+
#define WOLFSSL_ENTER_DO_NOTHING
554+
#define WOLFSSL_LEAVE_DO_NOTHING
555+
#define WOLFSSL_MSG_DO_NOTHING
556+
#define WOLFSSL_ENTER(m) WC_DO_NOTHING
557+
#define WOLFSSL_LEAVE(m, r) WC_DO_NOTHING
558+
#define WOLFSSL_MSG(m) WC_DO_NOTHING
559+
#endif
560+
502561
#ifdef WOLFSSL_HAVE_ERROR_QUEUE
503562

504563
#ifdef ERROR_QUEUE_PER_THREAD

‎wolfcrypt/src/rsa.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2748,7 +2748,7 @@ static int RsaFunctionSync(const byte* in, word32 inLen, byte* out,
27482748
case RSA_PUBLIC_ENCRYPT:
27492749
case RSA_PUBLIC_DECRYPT:
27502750
if (mp_exptmod_nct(tmp, &key->e, &key->n, tmp) != MP_OKAY) {
2751-
WOLFSSL_MSG("mp_exptmod_nct failed");
2751+
WOLFSSL_MSG_CERT("mp_exptmod_nct failed");
27522752
ret = MP_EXPTMOD_E;
27532753
}
27542754
break;
@@ -2845,7 +2845,7 @@ static int wc_RsaFunctionSync(const byte* in, word32 inLen, byte* out,
28452845
*outLen = keyLen;
28462846
return RsaFunctionSync(in, inLen, out, outLen, type, key, rng);
28472847
#endif /* WOLFSSL_SP_MATH */
2848-
}
2848+
} /* wc_RsaFunctionSync */
28492849
#endif /* WOLF_CRYPTO_CB_ONLY_RSA */
28502850
#endif
28512851

0 commit comments

Comments
 (0)