authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2022-12-29 20:58:42-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2023-01-02 16:57:16-07:00
log341e68ff8fb83a146f6000b2214c1eae668e9667
tree2b95c0a737fb7d810124adb317cb1017517faf3d
parent79b41dbdbfd6c511b2e206397788b81bc720d266

std.crypto.tls.Client: remove debug prints

2 files changed, 10 insertions(+), 82 deletions(-)

lib/std/crypto/Certificate.zig+1-8
...@@ -241,7 +241,6 @@ pub fn parse(cert: Certificate) !Parsed {...@@ -241,7 +241,6 @@ pub fn parse(cert: Certificate) !Parsed {
241241
242 var common_name = der.Element.Slice.empty;242 var common_name = der.Element.Slice.empty;
243 var name_i = subject.slice.start;243 var name_i = subject.slice.start;
244 //std.debug.print("subject name:\n", .{});
245 while (name_i < subject.slice.end) {244 while (name_i < subject.slice.end) {
246 const rdn = try der.Element.parse(cert_bytes, name_i);245 const rdn = try der.Element.parse(cert_bytes, name_i);
247 var rdn_i = rdn.slice.start;246 var rdn_i = rdn.slice.start;
...@@ -252,9 +251,6 @@ pub fn parse(cert: Certificate) !Parsed {...@@ -252,9 +251,6 @@ pub fn parse(cert: Certificate) !Parsed {
252 const ty_elem = try der.Element.parse(cert_bytes, atav_i);251 const ty_elem = try der.Element.parse(cert_bytes, atav_i);
253 const ty = try parseAttribute(cert_bytes, ty_elem);252 const ty = try parseAttribute(cert_bytes, ty_elem);
254 const val = try der.Element.parse(cert_bytes, ty_elem.slice.end);253 const val = try der.Element.parse(cert_bytes, ty_elem.slice.end);
255 //std.debug.print(" {s}: '{s}'\n", .{
256 // @tagName(ty), cert_bytes[val.slice.start..val.slice.end],
257 //});
258 switch (ty) {254 switch (ty) {
259 .commonName => common_name = val.slice,255 .commonName => common_name = val.slice,
260 else => {},256 else => {},
...@@ -452,10 +448,7 @@ fn parseEnum(comptime E: type, bytes: []const u8, element: der.Element) !E {...@@ -452,10 +448,7 @@ fn parseEnum(comptime E: type, bytes: []const u8, element: der.Element) !E {
452 if (element.identifier.tag != .object_identifier)448 if (element.identifier.tag != .object_identifier)
453 return error.CertificateFieldHasWrongDataType;449 return error.CertificateFieldHasWrongDataType;
454 const oid_bytes = bytes[element.slice.start..element.slice.end];450 const oid_bytes = bytes[element.slice.start..element.slice.end];
455 return E.map.get(oid_bytes) orelse {451 return E.map.get(oid_bytes) orelse return error.CertificateHasUnrecognizedObjectId;
456 //std.debug.print("tag: {}\n", .{std.fmt.fmtSliceHexLower(oid_bytes)});
457 return error.CertificateHasUnrecognizedObjectId;
458 };
459}452}
460453
461pub fn checkVersion(bytes: []const u8, version: der.Element) !void {454pub fn checkVersion(bytes: []const u8, version: der.Element) !void {
lib/std/crypto/tls/Client.zig+9-74
...@@ -147,7 +147,8 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -147,7 +147,8 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
147 .alert => {147 .alert => {
148 const level = @intToEnum(tls.AlertLevel, frag[0]);148 const level = @intToEnum(tls.AlertLevel, frag[0]);
149 const desc = @intToEnum(tls.AlertDescription, frag[1]);149 const desc = @intToEnum(tls.AlertDescription, frag[1]);
150 std.debug.print("alert: {s} {s}\n", .{ @tagName(level), @tagName(desc) });150 _ = level;
151 _ = desc;
151 return error.TlsAlert;152 return error.TlsAlert;
152 },153 },
153 .handshake => {154 .handshake => {
...@@ -226,14 +227,11 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -226,14 +227,11 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
226 shared_key = mul.affineCoordinates().x.toBytes(.Big);227 shared_key = mul.affineCoordinates().x.toBytes(.Big);
227 },228 },
228 else => {229 else => {
229 //std.debug.print("named group: {x}\n", .{named_group});
230 return error.TlsIllegalParameter;230 return error.TlsIllegalParameter;
231 },231 },
232 }232 }
233 },233 },
234 else => {234 else => {},
235 std.debug.print("unexpected extension: {x}\n", .{et});
236 },
237 }235 }
238 i = next_i;236 i = next_i;
239 }237 }
...@@ -283,18 +281,6 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -283,18 +281,6 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
283 p.server_handshake_key = hkdfExpandLabel(P.Hkdf, server_secret, "key", "", P.AEAD.key_length);281 p.server_handshake_key = hkdfExpandLabel(P.Hkdf, server_secret, "key", "", P.AEAD.key_length);
284 p.client_handshake_iv = hkdfExpandLabel(P.Hkdf, client_secret, "iv", "", P.AEAD.nonce_length);282 p.client_handshake_iv = hkdfExpandLabel(P.Hkdf, client_secret, "iv", "", P.AEAD.nonce_length);
285 p.server_handshake_iv = hkdfExpandLabel(P.Hkdf, server_secret, "iv", "", P.AEAD.nonce_length);283 p.server_handshake_iv = hkdfExpandLabel(P.Hkdf, server_secret, "iv", "", P.AEAD.nonce_length);
286 //std.debug.print("shared_key: {}\nhello_hash: {}\nearly_secret: {}\nempty_hash: {}\nderived_secret: {}\nhandshake_secret: {}\n client_secret: {}\n server_secret: {}\nclient_handshake_iv: {}\nserver_handshake_iv: {}\n", .{
287 // std.fmt.fmtSliceHexLower(&shared_key),
288 // std.fmt.fmtSliceHexLower(&hello_hash),
289 // std.fmt.fmtSliceHexLower(&early_secret),
290 // std.fmt.fmtSliceHexLower(&empty_hash),
291 // std.fmt.fmtSliceHexLower(&hs_derived_secret),
292 // std.fmt.fmtSliceHexLower(&p.handshake_secret),
293 // std.fmt.fmtSliceHexLower(&client_secret),
294 // std.fmt.fmtSliceHexLower(&server_secret),
295 // std.fmt.fmtSliceHexLower(&p.client_handshake_iv),
296 // std.fmt.fmtSliceHexLower(&p.server_handshake_iv),
297 //});
298 },284 },
299 else => {285 else => {
300 return error.TlsIllegalParameter;286 return error.TlsIllegalParameter;
...@@ -416,11 +402,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -416,11 +402,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
416 const next_ext_i = hs_i + ext_size;402 const next_ext_i = hs_i + ext_size;
417 switch (et) {403 switch (et) {
418 .server_name => {},404 .server_name => {},
419 else => {405 else => {},
420 std.debug.print("encrypted extension: {any}\n", .{
421 et,
422 });
423 },
424 }406 }
425 hs_i = next_ext_i;407 hs_i = next_ext_i;
426 }408 }
...@@ -467,12 +449,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -467,12 +449,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
467 @memcpy(&main_cert_pub_key_buf, pub_key.ptr, pub_key.len);449 @memcpy(&main_cert_pub_key_buf, pub_key.ptr, pub_key.len);
468 main_cert_pub_key_len = @intCast(@TypeOf(main_cert_pub_key_len), pub_key.len);450 main_cert_pub_key_len = @intCast(@TypeOf(main_cert_pub_key_len), pub_key.len);
469 } else {451 } else {
470 prev_cert.verify(subject) catch |err| {452 try prev_cert.verify(subject);
471 std.debug.print("unable to validate previous cert: {s}\n", .{
472 @errorName(err),
473 });
474 return err;
475 };
476 }453 }
477454
478 if (ca_bundle.verify(subject)) |_| {455 if (ca_bundle.verify(subject)) |_| {
...@@ -480,12 +457,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -480,12 +457,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
480 break :cert;457 break :cert;
481 } else |err| switch (err) {458 } else |err| switch (err) {
482 error.CertificateIssuerNotFound => {},459 error.CertificateIssuerNotFound => {},
483 else => |e| {460 else => |e| return e,
484 std.debug.print("unable to validate cert against system root CAs: {s}\n", .{
485 @errorName(e),
486 });
487 return e;
488 },
489 }461 }
490462
491 prev_cert = subject;463 prev_cert = subject;
...@@ -559,9 +531,6 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -559,9 +531,6 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
559 }531 }
560 },532 },
561 else => {533 else => {
562 //std.debug.print("signature scheme: {any}\n", .{
563 // scheme,
564 //});
565 return error.TlsBadSignatureScheme;534 return error.TlsBadSignatureScheme;
566 },535 },
567 }536 }
...@@ -609,11 +578,6 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -609,11 +578,6 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
609578
610 const client_secret = hkdfExpandLabel(P.Hkdf, p.master_secret, "c ap traffic", &handshake_hash, P.Hash.digest_length);579 const client_secret = hkdfExpandLabel(P.Hkdf, p.master_secret, "c ap traffic", &handshake_hash, P.Hash.digest_length);
611 const server_secret = hkdfExpandLabel(P.Hkdf, p.master_secret, "s ap traffic", &handshake_hash, P.Hash.digest_length);580 const server_secret = hkdfExpandLabel(P.Hkdf, p.master_secret, "s ap traffic", &handshake_hash, P.Hash.digest_length);
612 //std.debug.print("master_secret={}\nclient_secret={}\nserver_secret={}\n", .{
613 // std.fmt.fmtSliceHexLower(&p.master_secret),
614 // std.fmt.fmtSliceHexLower(&client_secret),
615 // std.fmt.fmtSliceHexLower(&server_secret),
616 //});
617 break :c @unionInit(tls.ApplicationCipher, @tagName(tag), .{581 break :c @unionInit(tls.ApplicationCipher, @tagName(tag), .{
618 .client_secret = client_secret,582 .client_secret = client_secret,
619 .server_secret = server_secret,583 .server_secret = server_secret,
...@@ -646,13 +610,11 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -646,13 +610,11 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
646 }610 }
647 },611 },
648 else => {612 else => {
649 std.debug.print("inner content type: {any}\n", .{inner_ct});
650 return error.TlsUnexpectedMessage;613 return error.TlsUnexpectedMessage;
651 },614 },
652 }615 }
653 },616 },
654 else => {617 else => {
655 std.debug.print("content type: {s}\n", .{@tagName(ct)});
656 return error.TlsUnexpectedMessage;618 return error.TlsUnexpectedMessage;
657 },619 },
658 }620 }
...@@ -707,16 +669,6 @@ pub fn write(c: *Client, stream: net.Stream, bytes: []const u8) !usize {...@@ -707,16 +669,6 @@ pub fn write(c: *Client, stream: net.Stream, bytes: []const u8) !usize {
707 c.write_seq += 1; // TODO send key_update on overflow669 c.write_seq += 1; // TODO send key_update on overflow
708 const nonce = @as(V, p.client_iv) ^ operand;670 const nonce = @as(V, p.client_iv) ^ operand;
709 P.AEAD.encrypt(ciphertext, auth_tag, cleartext, ad, nonce, p.client_key);671 P.AEAD.encrypt(ciphertext, auth_tag, cleartext, ad, nonce, p.client_key);
710 //std.debug.print("seq: {d} nonce: {} client_key: {} client_iv: {} ad: {} auth_tag: {}\nserver_key: {} server_iv: {}\n", .{
711 // c.write_seq - 1,
712 // std.fmt.fmtSliceHexLower(&nonce),
713 // std.fmt.fmtSliceHexLower(&p.client_key),
714 // std.fmt.fmtSliceHexLower(&p.client_iv),
715 // std.fmt.fmtSliceHexLower(ad),
716 // std.fmt.fmtSliceHexLower(auth_tag),
717 // std.fmt.fmtSliceHexLower(&p.server_key),
718 // std.fmt.fmtSliceHexLower(&p.server_iv),
719 //});
720672
721 const record = ciphertext_buf[record_start..ciphertext_end];673 const record = ciphertext_buf[record_start..ciphertext_end];
722 iovecs_buf[iovec_end] = .{674 iovecs_buf[iovec_end] = .{
...@@ -844,10 +796,6 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove...@@ -844,10 +796,6 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
844 c.partial_cleartext_idx = 0;796 c.partial_cleartext_idx = 0;
845 c.partial_ciphertext_idx = 0;797 c.partial_ciphertext_idx = 0;
846 c.partial_ciphertext_end = 0;798 c.partial_ciphertext_end = 0;
847 } else {
848 std.debug.print("finished giving partial cleartext. {d} bytes ciphertext remain\n", .{
849 c.partial_ciphertext_end - c.partial_ciphertext_idx,
850 });
851 }799 }
852 }800 }
853801
...@@ -943,11 +891,8 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove...@@ -943,11 +891,8 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
943 in += 1;891 in += 1;
944 const legacy_version = mem.readIntBig(u16, frag[in..][0..2]);892 const legacy_version = mem.readIntBig(u16, frag[in..][0..2]);
945 in += 2;893 in += 2;
946 //_ = legacy_version;894 _ = legacy_version;
947 const record_len = mem.readIntBig(u16, frag[in..][0..2]);895 const record_len = mem.readIntBig(u16, frag[in..][0..2]);
948 std.debug.print("ct={any} legacy_version={x} record_len={d}\n", .{
949 ct, legacy_version, record_len,
950 });
951 if (record_len > max_ciphertext_len) return error.TlsRecordOverflow;896 if (record_len > max_ciphertext_len) return error.TlsRecordOverflow;
952 in += 2;897 in += 2;
953 const end = in + record_len;898 const end = in + record_len;
...@@ -962,12 +907,8 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove...@@ -962,12 +907,8 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
962 const first = frag[in..];907 const first = frag[in..];
963 const full_record_len = record_len + tls.ciphertext_record_header_len;908 const full_record_len = record_len + tls.ciphertext_record_header_len;
964 const second_len = full_record_len - first.len;909 const second_len = full_record_len - first.len;
965 if (frag1.len < second_len) {910 if (frag1.len < second_len)
966 std.debug.print("end > frag.len finishRead2 end={d} frag.len={d}\n", .{
967 end, frag.len,
968 });
969 return finishRead2(c, first, frag1, vp.total);911 return finishRead2(c, first, frag1, vp.total);
970 }
971912
972 mem.copy(u8, frag[0..in], first);913 mem.copy(u8, frag[0..in], first);
973 mem.copy(u8, frag[first.len..], frag1[0..second_len]);914 mem.copy(u8, frag[first.len..], frag1[0..second_len]);
...@@ -1016,7 +957,7 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove...@@ -1016,7 +957,7 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
1016 c.partial_ciphertext_end = c.partial_ciphertext_idx;957 c.partial_ciphertext_end = c.partial_ciphertext_idx;
1017 return vp.total;958 return vp.total;
1018 }959 }
1019 std.debug.print("alert: {s} {s}\n", .{ @tagName(level), @tagName(desc) });960 _ = level;
1020 return error.TlsAlert;961 return error.TlsAlert;
1021 },962 },
1022 .handshake => {963 .handshake => {
...@@ -1032,11 +973,9 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove...@@ -1032,11 +973,9 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
1032 const handshake = cleartext[ct_i..next_handshake_i];973 const handshake = cleartext[ct_i..next_handshake_i];
1033 switch (handshake_type) {974 switch (handshake_type) {
1034 .new_session_ticket => {975 .new_session_ticket => {
1035 std.debug.print("new_session_ticket\n", .{});
1036 // This client implementation ignores new session tickets.976 // This client implementation ignores new session tickets.
1037 },977 },
1038 .key_update => {978 .key_update => {
1039 std.debug.print("key_update\n", .{});
1040 switch (c.application_cipher) {979 switch (c.application_cipher) {
1041 inline else => |*p| {980 inline else => |*p| {
1042 const P = @TypeOf(p.*);981 const P = @TypeOf(p.*);
...@@ -1085,13 +1024,10 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove...@@ -1085,13 +1024,10 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
1085 const dest = c.partially_read_buffer[c.partial_ciphertext_idx..];1024 const dest = c.partially_read_buffer[c.partial_ciphertext_idx..];
1086 mem.copy(u8, dest, msg);1025 mem.copy(u8, dest, msg);
1087 c.partial_ciphertext_idx = @intCast(@TypeOf(c.partial_ciphertext_idx), c.partial_ciphertext_idx + msg.len);1026 c.partial_ciphertext_idx = @intCast(@TypeOf(c.partial_ciphertext_idx), c.partial_ciphertext_idx + msg.len);
1088 std.debug.print("application_data {d} bytes to partial buffer\n", .{msg.len});
1089 } else {1027 } else {
1090 const amt = vp.put(msg);1028 const amt = vp.put(msg);
1091 std.debug.print("application_data {d} bytes to read buffer\n", .{msg.len});
1092 if (amt < msg.len) {1029 if (amt < msg.len) {
1093 const rest = msg[amt..];1030 const rest = msg[amt..];
1094 std.debug.print(" {d} bytes to partial buffer\n", .{rest.len});
1095 c.partial_cleartext_idx = 0;1031 c.partial_cleartext_idx = 0;
1096 c.partial_ciphertext_idx = @intCast(@TypeOf(c.partial_ciphertext_idx), rest.len);1032 c.partial_ciphertext_idx = @intCast(@TypeOf(c.partial_ciphertext_idx), rest.len);
1097 mem.copy(u8, &c.partially_read_buffer, rest);1033 mem.copy(u8, &c.partially_read_buffer, rest);
...@@ -1101,7 +1037,6 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove...@@ -1101,7 +1037,6 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
1101 // Output buffer was used directly which means no1037 // Output buffer was used directly which means no
1102 // memory copying needs to occur, and we can move1038 // memory copying needs to occur, and we can move
1103 // on to the next ciphertext record.1039 // on to the next ciphertext record.
1104 std.debug.print("application_data {d} bytes directly to read buffer\n", .{cleartext.len - 1});
1105 vp.next(cleartext.len - 1);1040 vp.next(cleartext.len - 1);
1106 }1041 }
1107 },1042 },