TLS1.3: Token used for running TLS tests

[kshitizvars]

Hi @Jakuje @simo5

Which token you are using for running https://github.com/latchset/pkcs11-provider/blob/c7fb177ab9f3e797f5a8c89e45e259ca74cd749b/tests/ttls ?
Could you please share the steps to setup the token?

On which platform, do you use this token? Is it ARM based?

CC: @sahilnxp

[Jakuje]

We are running all tests with SoftHSM, NSS Softokn and Kryoptic tokens. The token specific setup we use is in tests/{softhsm,softokn,kryoptic}-init.sh files and in the tests/setup.sh which populates the tokens with various keys/objects.

In github we run the tests only on x86_64, but we execute them also as part of downstream builds in Fedora, where everything runs on all Fedora supported architectures, which includes aarch64.

[kshitizvars]

Hi @Jakuje @simo5

We checked softhsm, softokn, kryoptic token code. Only kryoptic token seems to support HKDF. Please correct if I am wrong here.

• So, we are trying to build kryoptic token after following https://github.com/latchset/kryoptic, but getting below issue:-

Btw, we are trying to build it for ARM64 platform.

/usr/bin/perl "-I." "-Mconfigdata" "util/dofile.pl" "-oMakefile" include/openssl/x509.h.in > include/openssl/x509.h
  /usr/bin/perl "-I." "-Mconfigdata" "util/dofile.pl" "-oMakefile" include/openssl/x509_vfy.h.in > include/openssl/x509_vfy.h
  /usr/bin/perl "-I." "-Mconfigdata" "util/dofile.pl" "-oMakefile" include/openssl/x509v3.h.in > include/openssl/x509v3.h
  /usr/bin/perl "-I." "-Mconfigdata" "util/dofile.pl" "-oMakefile" test/provider_internal_test.cnf.in > test/provider_internal_test.cnf
  make depend && make _build_sw
  make[1]: Entering directory '/home/kryoptic/openssl'
  make[1]: Leaving directory '/home/kryoptic/openssl'
  make[1]: Entering directory '/home/kryoptic/openssl'
  /home/toolchain/arm-gnu-toolchain-13.2.Rel1-x86_64-aarch64-none-linux-gnu/bin/aarch64-none-linux-gnu-gcc  -I. -Iinclude -Iapps/include  -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O0 -g -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSLDIR="\"/usr/local/ssl\"" -DENGINESDIR="\"/usr/local/lib64/engines-3\"" -DMODULESDIR="\"/usr/local/lib64/ossl-modules\"" -DOPENSSL_BUILDING_OPENSSL  -MMD -MF apps/lib/libapps-lib-app_libctx.d.tmp -MT apps/lib/libapps-lib-app_libctx.o -c -o apps/lib/libapps-lib-app_libctx.o apps/lib/app_libctx.c
  make[1]: Leaving directory '/home/kryoptic/openssl'
 
  --- stderr
  aarch64-none-linux-gnu-gcc: error: unrecognized command-line option '-m64'
  make[1]: *** [Makefile:5315: apps/lib/libapps-lib-app_libctx.o] Error 1
  make: *** [Makefile:3618: build_sw] Error 2
  thread 'main' panicked at build.rs:130:17:
  could not build OpenSSL
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Are we missing something here?

• Can we build kryoptic using yocto? Is there any yocto recipe for that?

[simo5]

Are you trying to cross compile?
I do not think our build scripts are able to support that for openssl, I suggest you build on an actual aarch64 machine.

Sorry, we don't use yocto, no idea how to help there.

[kshitizvars]

Yes, i am trying to cross-compile.
Ok, I’ll try to generate on actual aarch64 machine.

[sahilnxp]

@simo5 just to confirm, can we offload TLS1.3 HKDF functions to kryoptic token ?

[simo5]

Yes, you should be able to.

[sahilnxp]

I am trying to build it on arm64 system and getting following error.

root@evk:~/kryoptic# CONFDIR=/etc cargo build
   Compiling kryoptic v0.1.0 (/root/kryoptic)
error: unsupported output in build script of `kryoptic v0.1.0 (/root/kryoptic)`: `cargo::rerun-if-changed=pkcs11_headers/3.1/pkcs11.h`
Found a `cargo::key=value` build directive which is reserved for future use.
Either change the directive to `cargo:key=value` syntax (note the single `:`) or upgrade your version of Rust.
See https://doc.rust-lang.org/cargo/reference/build-scripts.html#outputs-of-the-build-script for more information about build script outputs.
root@evk:~/kryoptic#

@simo5 @Jakuje Any idea about this ?

[sahilnxp]

I think there were 4 5 places in build.rs where the cargo::key=value is defined for some values, but from error it looks like it should be written with single : like cargo:key=value
I changed it to cargo:key=value and compilation was successful, but with lot of warnings.
Logs of warning attached.

kryoptic-compilation-warnings.txt

Pleae let me know if these warnings expected, or I missed something?

[sahilnxp]

Also there is no release folder made in target folder, there is debug folder there.
please let me know how to make the release folder ?

[simo5]

Build with --features=standard or you won't have most of the algorithms available.

Also please open an issue or submit a PR for the cargo::key=value problem please

[sahilnxp]

Pull request has been raised for build.rs fix: latchset/kryoptic#123

[sahilnxp]

Not able to find the kryoptic.sql

pkcs11-provider/tests/kryoptic-init.sh

Line 30 in 755cbc8

export KRYOPTIC_CONF="$TOKDIR/kryoptic.sql"

this file in kryoptic folder, can you please point me to that ?

[simo5]

The database is created on demand when the token is configured by setup.sh