Skip to content

Commit 37baeab

Browse files
JacobBarthelmehJacobBarthelmeh
committed
touch up of comments and demo
1 parent b4245cd commit 37baeab

8 files changed

Lines changed: 130 additions & 183 deletions

File tree

‎examples/demo/client/wh_demo_client_auth.c‎

Lines changed: 91 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,30 @@
11
/*
2-
* Auth Manager demo client
2+
* Copyright (C) 2026 wolfSSL Inc.
33
*
4-
* The session ID is associated with the client_id on the server side,
5-
* so subsequent operations from this client will be authorized based on
6-
* the authenticated session.
4+
* This file is part of wolfHSM.
5+
*
6+
* wolfHSM is free software; you can redistribute it and/or modify
7+
* it under the terms of the GNU General Public License as published by
8+
* the Free Software Foundation; either version 3 of the License, or
9+
* (at your option) any later version.
10+
*
11+
* wolfHSM is distributed in the hope that it will be useful,
12+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
13+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14+
* GNU General Public License for more details.
15+
*
16+
* You should have received a copy of the GNU General Public License
17+
* along with wolfHSM. If not, see <http://www.gnu.org/licenses/>.
718
*/
819

20+
921
#include <stdio.h>
1022
#include <string.h>
1123

1224
#include "wolfhsm/wh_error.h"
1325
#include "wolfhsm/wh_client.h"
1426
#include "wolfhsm/wh_auth.h"
27+
#include "wolfhsm/wh_message.h"
1528

1629
#include "wh_demo_client_auth.h"
1730
#include "wh_demo_client_crypto.h"
@@ -21,10 +34,10 @@ static int wh_DemoClient_AuthPin(whClientContext* clientContext)
2134
int rc = 0;
2235
int32_t serverRc = 0;
2336
const uint8_t pin[] = "1234"; /* demo PIN */
24-
const uint8_t badPin[] = "4321";
37+
const uint8_t newPin[] = "5678"; /* new PIN */
2538
whUserId userId = WH_USER_ID_INVALID;
39+
whUserId adminUserId = WH_USER_ID_INVALID;
2640
whAuthPermissions out_permissions;
27-
int32_t out_rc;
2841

2942
/* give permissions for everything */
3043
memset(&out_permissions, 0xFF, sizeof(whAuthPermissions));
@@ -33,100 +46,66 @@ static int wh_DemoClient_AuthPin(whClientContext* clientContext)
3346
return WH_ERROR_BADARGS;
3447
}
3548

36-
/* ============================================================
37-
* Step 1: Attempt crypto operation without authentication
38-
* ============================================================ */
39-
whUserId adminUserId = WH_USER_ID_INVALID;
4049
/* login as the admin and add a new user */
4150
rc = wh_Client_AuthLogin(clientContext,
42-
WH_AUTH_METHOD_PIN,
43-
"admin",
44-
"1234", 4,
45-
&serverRc,
46-
&adminUserId);
51+
WH_AUTH_METHOD_PIN, "admin", "1234", 4, &serverRc, &adminUserId);
4752
if (rc != 0) {
4853
printf("[AUTH-DEMO] Failed to login as admin: %d\n", rc);
4954
return rc;
5055
}
5156
if (serverRc != 0) {
52-
printf("[AUTH-DEMO] Server-side error logging in as admin: %d\n", (int)serverRc);
57+
printf("[AUTH-DEMO] Server-side error logging in as admin: %d\n",
58+
(int)serverRc);
5359
return (int)serverRc;
5460
}
5561

5662
memset(&out_permissions, 0, sizeof(whAuthPermissions));
5763
rc = wh_Client_AuthUserAdd(clientContext, "demo", out_permissions,
5864
WH_AUTH_METHOD_PIN, pin, (uint16_t)(sizeof(pin) - 1),
59-
&out_rc, &userId);
60-
if (rc != 0) {
61-
printf("[AUTH-DEMO] Failed to add user: %d\n", rc);
65+
&serverRc, &userId);
66+
if (rc != 0 || serverRc != 0) {
67+
printf("[AUTH-DEMO] Failed to add user: %d, server error %d\n", rc,
68+
serverRc);
6269
return rc;
6370
}
6471

6572
rc = wh_Client_AuthLogout(clientContext, adminUserId, &serverRc);
66-
if (rc != 0) {
73+
if (rc != 0 || serverRc != 0) {
6774
printf("[AUTH-DEMO] Failed to logout user: %d\n", rc);
6875
return rc;
6976
}
7077

71-
/* ============================================================
72-
* Step 2: Authenticate user
73-
* ============================================================ */
78+
/* Log in as the newly created 'demo' user */
7479
rc = wh_Client_AuthLogin(clientContext,
75-
WH_AUTH_METHOD_PIN,
76-
"demo",
77-
badPin,
78-
(uint16_t)(sizeof(badPin) - 1),
79-
&serverRc,
80-
&userId);
81-
82-
if (rc == WH_ERROR_OK && serverRc != WH_AUTH_LOGIN_FAILED) {
83-
printf("[AUTH-DEMO] Failed to not login with bad pin: %d, serverRc=%d\n", rc, serverRc);
84-
return rc;
85-
}
86-
87-
rc = wh_Client_AuthLogin(clientContext,
88-
WH_AUTH_METHOD_PIN,
89-
"demo",
90-
pin,
91-
(uint16_t)(sizeof(pin) - 1),
92-
&serverRc,
80+
WH_AUTH_METHOD_PIN, "demo", pin,
81+
(uint16_t)(sizeof(pin) - 1), &serverRc,
9382
&userId);
94-
95-
if (rc == WH_ERROR_NOTIMPL) {
96-
printf("[AUTH-DEMO] wh_Client_AuthAuthenticate() not implemented yet.\n");
97-
printf("[AUTH-DEMO] This demo currently serves as a control-flow sketch.\n");
98-
return rc;
99-
}
100-
10183
if (rc != 0) {
102-
printf("[AUTH-DEMO] Client-side error rc=%d while sending auth request.\n", rc);
84+
printf("[AUTH-DEMO] Login message failure, rc=%d\n", rc);
10385
return rc;
10486
}
10587

10688
if (serverRc != 0) {
107-
printf("[AUTH-DEMO] Server-side auth failed, rc=%d.\n", (int)serverRc);
89+
printf("[AUTH-DEMO] Server-side login failed, rc=%d.\n", (int)serverRc);
10890
return (int)serverRc;
10991
}
11092

111-
/* ============================================================
112-
* Step 3: Update user credentials
113-
* ============================================================ */
114-
const uint8_t newPin[] = "5678"; /* new PIN */
115-
93+
/* Update user credentials */
11694
rc = wh_Client_AuthUserSetCredentials(clientContext, userId,
11795
WH_AUTH_METHOD_PIN,
11896
pin, (uint16_t)(sizeof(pin) - 1), /* current credentials */
11997
newPin, (uint16_t)(sizeof(newPin) - 1), /* new credentials */
120-
&out_rc);
98+
&serverRc);
12199

122100
if (rc != 0) {
123101
printf("[AUTH-DEMO] Failed to update credentials: %d\n", rc);
124102
return rc;
125103
}
126104

127-
if (out_rc != 0) {
128-
printf("[AUTH-DEMO] Server-side error updating credentials: %d\n", (int)out_rc);
129-
return (int)out_rc;
105+
if (serverRc != 0) {
106+
printf("[AUTH-DEMO] Server-side error updating credentials: %d\n",
107+
(int)serverRc);
108+
return (int)serverRc;
130109
}
131110

132111
/* logout the user */
@@ -137,7 +116,8 @@ static int wh_DemoClient_AuthPin(whClientContext* clientContext)
137116
}
138117

139118
if (serverRc != 0) {
140-
printf("[AUTH-DEMO] Server-side error logging out user: %d\n", (int)serverRc);
119+
printf("[AUTH-DEMO] Server-side error logging out user: %d\n",
120+
(int)serverRc);
141121
return (int)serverRc;
142122
}
143123

@@ -189,7 +169,6 @@ static int wh_DemoClient_AuthCertificate(whClientContext* clientContext)
189169
whUserId userId = WH_USER_ID_INVALID;
190170
whUserId adminUserId = WH_USER_ID_INVALID;
191171
whAuthPermissions out_permissions;
192-
int32_t out_rc;
193172

194173
/* Include test certificates - prefer wolfssl/certs_test.h if available,
195174
* otherwise use test certificates from wh_test_cert_data.h */
@@ -211,11 +190,7 @@ static int wh_DemoClient_AuthCertificate(whClientContext* clientContext)
211190
return WH_ERROR_BADARGS;
212191
}
213192

214-
/* ============================================================
215-
* Step 1: Add user with CA certificate as credentials
216-
* ============================================================ */
217-
218-
/* login as the admin and add a new user */
193+
/* login as the admin and add a new user with CA certificate */
219194
rc = wh_Client_AuthLogin(clientContext,
220195
WH_AUTH_METHOD_PIN,
221196
"admin",
@@ -227,20 +202,23 @@ static int wh_DemoClient_AuthCertificate(whClientContext* clientContext)
227202
return rc;
228203
}
229204
if (serverRc != 0) {
230-
printf("[AUTH-DEMO] Server-side error logging in as admin: %d\n", (int)serverRc);
205+
printf("[AUTH-DEMO] Server-side error logging in as admin: %d\n",
206+
(int)serverRc);
231207
return (int)serverRc;
232208
}
233209

234210
rc = wh_Client_AuthUserAdd(clientContext, "certuser", out_permissions,
235211
WH_AUTH_METHOD_CERTIFICATE, ca_cert, ca_cert_len,
236-
&out_rc, &userId);
212+
&serverRc, &userId);
237213
if (rc != 0) {
238214
printf("[AUTH-DEMO] Failed to add user: %d\n", rc);
239215
return rc;
240216
}
241-
if (out_rc != 0) {
242-
printf("[AUTH-DEMO] Server-side error adding user: %d\n", (int)out_rc);
243-
return (int)out_rc;
217+
218+
if (serverRc != 0) {
219+
printf("[AUTH-DEMO] Server-side error adding user: %d\n",
220+
(int)serverRc);
221+
return (int)serverRc;
244222
}
245223

246224
rc = wh_Client_AuthLogout(clientContext, adminUserId, &serverRc);
@@ -249,33 +227,21 @@ static int wh_DemoClient_AuthCertificate(whClientContext* clientContext)
249227
return rc;
250228
}
251229

252-
/* ============================================================
253-
* Step 2: Authenticate user with server certificate
254-
* ============================================================ */
230+
/* Authenticate user with server certificate */
255231
rc = wh_Client_AuthLogin(clientContext,
256232
WH_AUTH_METHOD_CERTIFICATE,
257233
"certuser",
258234
server_cert,
259235
server_cert_len,
260236
&serverRc,
261237
&userId);
262-
263-
if (rc == WH_ERROR_NOTIMPL) {
264-
printf("[AUTH-DEMO] wh_Client_AuthLogin() not implemented for certificates.\n");
265-
return rc;
266-
}
267-
268-
if (rc != 0) {
269-
printf("[AUTH-DEMO] Client-side error rc=%d while sending auth request.\n", rc);
238+
if (rc != 0 || serverRc != 0) {
239+
printf("[AUTH-DEMO] Error logging in rc=%d server rc = %d.\n", rc,
240+
serverRc);
270241
return rc;
271242
}
272243

273-
if (serverRc != 0) {
274-
printf("[AUTH-DEMO] Server-side auth failed, rc=%d.\n", (int)serverRc);
275-
return (int)serverRc;
276-
}
277-
278-
/* Try doing a crypto operation, with permissions all 0 this should fail */
244+
/* Try doing a crypto operation, with permissions all 0, this should fail */
279245
rc = wh_DemoClient_CryptoAesCbc(clientContext);
280246
if (rc == 0 || rc == WH_ERROR_OK) {
281247
/* found success when should have failed */
@@ -291,6 +257,7 @@ static int wh_DemoClient_AuthCertificate(whClientContext* clientContext)
291257
return rc;
292258
}
293259

260+
294261
static int wh_DemoClient_AuthUserDelete(whClientContext* clientContext)
295262
{
296263
int rc = 0;
@@ -312,12 +279,14 @@ static int wh_DemoClient_AuthUserDelete(whClientContext* clientContext)
312279
return (int)serverRc;
313280
}
314281

315-
rc = wh_Client_AuthUserGet(clientContext, "certuser", &serverRc, &userId, &permissions);
282+
rc = wh_Client_AuthUserGet(clientContext, "certuser", &serverRc, &userId,
283+
&permissions);
316284
if (rc != 0) {
317285
return rc;
318286
}
319287
if (serverRc != 0) {
320-
printf("[AUTH-DEMO] Server-side error %d while getting user: %d\n", (int)serverRc, userId);
288+
printf("[AUTH-DEMO] Server-side error %d while getting user: %d\n",
289+
(int)serverRc, userId);
321290
return (int)serverRc;
322291
}
323292

@@ -327,7 +296,8 @@ static int wh_DemoClient_AuthUserDelete(whClientContext* clientContext)
327296
return rc;
328297
}
329298
if (serverRc != 0) {
330-
printf("[AUTH-DEMO] Server-side error deleting user: %d\n", (int)serverRc);
299+
printf("[AUTH-DEMO] Server-side error deleting user: %d\n",
300+
(int)serverRc);
331301
return (int)serverRc;
332302
}
333303

@@ -361,43 +331,54 @@ static int wh_DemoClient_AuthUserSetPermissions(whClientContext* clientContext)
361331
return rc;
362332
}
363333
if (serverRc != 0) {
364-
printf("[AUTH-DEMO] Server-side error %d while logging in as admin: %d\n", (int)serverRc, adminUserId);
334+
printf("[AUTH-DEMO] Error %d while logging in as admin: %d\n",
335+
(int)serverRc, adminUserId);
365336
return (int)serverRc;
366337
}
367338

368-
rc = wh_Client_AuthUserGet(clientContext, "demo", &serverRc, &userId, &permissions);
339+
rc = wh_Client_AuthUserGet(clientContext, "demo", &serverRc, &userId,
340+
&permissions);
369341
if (rc != 0) {
370342
printf("[AUTH-DEMO] Failed to get user: %d\n", rc);
371343
return rc;
372344
}
373345
if (serverRc != 0) {
374-
printf("[AUTH-DEMO] Server-side error %d while getting user: %d\n", (int)serverRc, userId);
346+
printf("[AUTH-DEMO] Server-side error %d while getting user: %d\n",
347+
(int)serverRc, userId);
375348
return (int)serverRc;
376349
}
377350

378-
/* Set up key IDs: allow access to key 1 for encrypt and key 2 for decrypt */
379-
permissions.keyIdCount = 2;
380-
permissions.keyIds[0] = 1; /* encrypt key */
381-
permissions.keyIds[1] = 2; /* decrypt key */
382-
383-
rc = wh_Client_AuthUserSetPermissions(clientContext, userId, permissions, &serverRc);
384-
if (rc != 0) {
385-
printf("[AUTH-DEMO] Failed to set permissions: %d\n", rc);
386-
return rc;
387-
}
388-
if (serverRc != 0) {
389-
printf("[AUTH-DEMO] Server-side error %d while setting permissions for user: %d\n", (int)serverRc, userId);
390-
return (int)serverRc;
351+
/* Enable CRYPTO group and all CRYPTO actions */
352+
memset(&permissions, 0, sizeof(permissions));
353+
permissions.groupPermissions |= WH_MESSAGE_GROUP_CRYPTO;
354+
355+
/* Enable all CRYPTO actions by setting all bits in all words, an example of
356+
* a CRYTPO action is WC_ALGO_TYPE_CIPHER or WC_ALGO_TYPE_PK*/
357+
{
358+
int groupIndex = (WH_MESSAGE_GROUP_CRYPTO >> 8) & 0xFF;
359+
int wordIndex;
360+
/* Set all action bits for CRYPTO group (allows all actions) */
361+
for (wordIndex = 0; wordIndex < WH_AUTH_ACTION_WORDS; wordIndex++) {
362+
permissions.actionPermissions[groupIndex][wordIndex] = 0xFFFFFFFF;
363+
}
391364
}
392365

366+
rc = wh_Client_AuthUserSetPermissions(clientContext, userId, permissions,
367+
&serverRc);
368+
if (rc != 0 || serverRc != 0) {
369+
printf("[AUTH-DEMO] Failed to set permissions: %d, server error %d\n",
370+
rc, serverRc);
371+
return rc != 0 ? rc : (int)serverRc;
372+
}
393373

394374
rc = wh_Client_AuthUserGet(clientContext, "demo", &serverRc, &userId, &permissions);
395375
if (rc != 0) {
396376
return rc;
397377
}
398-
if (serverRc != 0) {
399-
printf("[AUTH-DEMO] Server-side error %d while getting user: %d\n", (int)serverRc, userId);
400-
return (int)serverRc;
378+
if (rc != 0 || serverRc != 0) {
379+
printf("[AUTH-DEMO] Failed to get user: %d, server error %d\n", rc,
380+
serverRc);
381+
return rc != 0 ? rc : (int)serverRc;
401382
}
402383

403384
rc = wh_Client_AuthLogout(clientContext, adminUserId, &serverRc);

‎examples/demo/client/wh_demo_client_auth.h‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,6 @@
66

77
/*
88
* Simple Auth Manager demo entry point.
9-
*
10-
* This is intentionally a thin wrapper around the conceptual auth client
11-
* APIs. It is expected to evolve as the Auth Manager is implemented.
12-
* For now, it is primarily a place to experiment with control flow and
13-
* logging without enforcing any particular backend design.
149
*/
1510
int wh_DemoClient_Auth(whClientContext* clientContext);
1611

0 commit comments

Comments
 (0)