Introduce WOLFSSL_DEBUG_CERTS Certificate Debug Messages #8902
Conversation
gojimmypi
force-pushed
the
pr-cert-logging
branch
from
381cb1e to
3bdf4c4
Compare
gojimmypi
force-pushed
the
pr-cert-logging
branch
3 times, most recently
from
fdfcd2b to
8eec175
Compare
|
Jenkins retest this please: |
There was a problem hiding this comment.
Please consider add a test to os-check.yml and also adding a small comment about the build option at top of logging.c.
Failure: ./configure CFLAGS="-DWOLFSSL_DEBUG_CERTS" && make
wolfcrypt/src/logging.c:307:6: error: no previous prototype for 'WOLFSSL_MSG_EX' [-Werror=missing-prototypes]
307 | void WOLFSSL_MSG_EX(const char* fmt, ...)
| ^~~~~~~~~~~~~~
wolfcrypt/src/logging.c:356:6: error: no previous prototype for 'WOLFSSL_MSG' [-Werror=missing-prototypes]
356 | void WOLFSSL_MSG(const char* msg)
| ^~~~~~~~~~~
wolfcrypt/src/logging.c:448:6: error: no previous prototype for 'WOLFSSL_ENTER' [-Werror=missing-prototypes]
448 | void WOLFSSL_ENTER(const char* msg)
| ^~~~~~~~~~~~~
wolfcrypt/src/logging.c:477:6: error: no previous prototype for 'WOLFSSL_LEAVE' [-Werror=missing-prototypes]
477 | void WOLFSSL_LEAVE(const char* msg, int ret)
| ^~~~~~~~~~~~~
wolfcrypt/src/logging.c:518:17: error: no previous prototype for 'WOLFSSL_IS_DEBUG_ON' [-Werror=missing-prototypes]
518 | WOLFSSL_API int WOLFSSL_IS_DEBUG_ON(void)
| ^~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[2]: *** [Makefile:8233: wolfcrypt/src/src_libwolfssl_la-logging.lo] Error 1
make[2]: *** Waiting for unfinished jobs....
make[2]: Leaving directory '/home/davidgarske/GitHub/wolfssl'
make[1]: *** [Makefile:10156: check-recursive] Error 1
make[1]: Leaving directory '/home/davidgarske/GitHub/wolfssl'
make: *** [Makefile:10650: check] Error 2```
gojimmypi
force-pushed
the
pr-cert-logging
branch
from
8eec175 to
65c681b
Compare
|
After addressing items in the most recent code review from @dgarske, I added additional |
gojimmypi
force-pushed
the
pr-cert-logging
branch
from
65c681b to
f22b741
Compare
Added
done
|
gojimmypi
force-pushed
the
pr-cert-logging
branch
from
f22b741 to
f6aca39
Compare
gojimmypi
force-pushed
the
pr-cert-logging
branch
from
f6aca39 to
55801ba
Compare
gojimmypi
force-pushed
the
pr-cert-logging
branch
from
55801ba to
4aeadb8
Compare
|
Thank you @dgarske ! Nice improvement in your suggested patch. Applied in 4aeadb8 Confirmed working on my ESP32 wolfssl_client WIP as well as both of these: |
|
Jenkins retest this please: PRB-dtls.txt_27 failed with " ClienSSL_write msg error -397, Peer closed underlying transport Error". Likely UDP issue. |
|
@JacobBarthelmeh or @douzzer can you please review this as well and merge if you approve? Thank you |
gojimmypi
force-pushed
the
pr-cert-logging
branch
from
934d947 to
9cfbb77
Compare
|
Thanks @douzzer for pointing out the off-topic Watcom compiler stuff; removed from this PR (but still problematic, needs PR). Existing Updated comments in Nothing recently changed in new Refreshed from upstream, merge conflict resolved, squashed to a single commit.
|
gojimmypi
force-pushed
the
pr-cert-logging
branch
from
9cfbb77 to
d64ef34
Compare
|
Pushed a new commit since the embedded |
|
Jenkins retest this please For AgentOfflineException: Unable to create live FilePath for wolf-linux-cloud-node-[n]; wolf-linux-cloud-node-[n] was marked offline: Connection was broken |
Description
Adds a new troubleshooting capability to view only interesting certificate-related messages:
Also a new macro:
WOLFSSL_MSG_CERT_LOGto print during eitherDEBUG_WOLFSSLorWOLFSSL_DEBUG_CERTS.Improves debugging messages: modifies
WOLFSSL_MSG_EXandWOLFSSL_MSG_CERT_EXon no-variadic macro compiler such as Watcom.Also adds
WOLFSSL_DEBUG_LINE_ENDINGto suppress LF characters on message printed for systems that supply their own line feeds during messaging, such as the EspressifESP_LOG.Turning on
WOLFSSL_DEBUGalways enablesWOLFSSL_DEBUG_CERTS.However
WOLFSSL_DEBUG_CERTScan be used withoutWOLFSSL_DEBUG.Macros of interest related to this PR:
Which Messages Displayed
MSG:
WOLFSSL_MSGandWOLFSSL_MSG_EXStandard wolfSSL debugging.
CERT:
WOLFSSL_MSG_CERTandWOLFSSL_MSG_CERT_EXCertificate Debugging: on by default with
DEBUG_WOLFSSL, but can disable certificate-specific verbose debugging withNO_WOLFSSL_DEBUG_CERTS.These will typically be the larger and more verbose messages specific to certificate debugging.
LOG:
WOLFSSL_MSG_CERT_LOGThese are certificate-debugging related messages, that are always printed with
DEBUG_WOLFSSL, even when verbose certificate debugging turned off withNO_WOLFSSL_DEBUG_CERTS.These will be typically small debug messages, that although certificate related, are also standard wolfssl debugging.
Why?
Turning on full debugging is often overly verbose. On embedded devices the delay in printing debug messages can have an adverse effect on timing-critical code, such as certificate validation during TLS connections.
Inspiration
See wolfSSL forum questions related to certificates. For me, recently:
Usage
To use, add to
user_settings.h:or from command-line:
Launch a server:
Launch a client:
Sample Linux Output:
Server:
Client:
Sample Espressif output:
FP_MAX_BITSinsight.and this suggestion to turn on
WOLFSSL_ALT_CERT_CHAINS, in addition to our old frienderror: -188:Fixes zd# n/a
Testing
How did you test?
Tested manually on embedded ESP32 / ESP-IDF.
Also tested with:
Checklist