authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2022-12-29 20:58:42-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2023-01-02 16:57:16-07:00
log341e68ff8fb83a146f6000b2214c1eae668e9667
tree2b95c0a737fb7d810124adb317cb1017517faf3d
parent79b41dbdbfd6c511b2e206397788b81bc720d266

std.crypto.tls.Client: remove debug prints

2 files changed, 10 insertions(+), 82 deletions(-)

lib/std/crypto/Certificate.zig+1-8
......@@ -241,7 +241,6 @@ pub fn parse(cert: Certificate) !Parsed {
241241
242242 var common_name = der.Element.Slice.empty;
243243 var name_i = subject.slice.start;
244 //std.debug.print("subject name:\n", .{});
245244 while (name_i < subject.slice.end) {
246245 const rdn = try der.Element.parse(cert_bytes, name_i);
247246 var rdn_i = rdn.slice.start;
......@@ -252,9 +251,6 @@ pub fn parse(cert: Certificate) !Parsed {
252251 const ty_elem = try der.Element.parse(cert_bytes, atav_i);
253252 const ty = try parseAttribute(cert_bytes, ty_elem);
254253 const val = try der.Element.parse(cert_bytes, ty_elem.slice.end);
255 //std.debug.print(" {s}: '{s}'\n", .{
256 // @tagName(ty), cert_bytes[val.slice.start..val.slice.end],
257 //});
258254 switch (ty) {
259255 .commonName => common_name = val.slice,
260256 else => {},
......@@ -452,10 +448,7 @@ fn parseEnum(comptime E: type, bytes: []const u8, element: der.Element) !E {
452448 if (element.identifier.tag != .object_identifier)
453449 return error.CertificateFieldHasWrongDataType;
454450 const oid_bytes = bytes[element.slice.start..element.slice.end];
455 return E.map.get(oid_bytes) orelse {
456 //std.debug.print("tag: {}\n", .{std.fmt.fmtSliceHexLower(oid_bytes)});
457 return error.CertificateHasUnrecognizedObjectId;
458 };
451 return E.map.get(oid_bytes) orelse return error.CertificateHasUnrecognizedObjectId;
459452}
460453
461454pub fn checkVersion(bytes: []const u8, version: der.Element) !void {
lib/std/crypto/tls/Client.zig+9-74
......@@ -147,7 +147,8 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
147147 .alert => {
148148 const level = @intToEnum(tls.AlertLevel, frag[0]);
149149 const desc = @intToEnum(tls.AlertDescription, frag[1]);
150 std.debug.print("alert: {s} {s}\n", .{ @tagName(level), @tagName(desc) });
150 _ = level;
151 _ = desc;
151152 return error.TlsAlert;
152153 },
153154 .handshake => {
......@@ -226,14 +227,11 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
226227 shared_key = mul.affineCoordinates().x.toBytes(.Big);
227228 },
228229 else => {
229 //std.debug.print("named group: {x}\n", .{named_group});
230230 return error.TlsIllegalParameter;
231231 },
232232 }
233233 },
234 else => {
235 std.debug.print("unexpected extension: {x}\n", .{et});
236 },
234 else => {},
237235 }
238236 i = next_i;
239237 }
......@@ -283,18 +281,6 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
283281 p.server_handshake_key = hkdfExpandLabel(P.Hkdf, server_secret, "key", "", P.AEAD.key_length);
284282 p.client_handshake_iv = hkdfExpandLabel(P.Hkdf, client_secret, "iv", "", P.AEAD.nonce_length);
285283 p.server_handshake_iv = hkdfExpandLabel(P.Hkdf, server_secret, "iv", "", P.AEAD.nonce_length);
286 //std.debug.print("shared_key: {}\nhello_hash: {}\nearly_secret: {}\nempty_hash: {}\nderived_secret: {}\nhandshake_secret: {}\n client_secret: {}\n server_secret: {}\nclient_handshake_iv: {}\nserver_handshake_iv: {}\n", .{
287 // std.fmt.fmtSliceHexLower(&shared_key),
288 // std.fmt.fmtSliceHexLower(&hello_hash),
289 // std.fmt.fmtSliceHexLower(&early_secret),
290 // std.fmt.fmtSliceHexLower(&empty_hash),
291 // std.fmt.fmtSliceHexLower(&hs_derived_secret),
292 // std.fmt.fmtSliceHexLower(&p.handshake_secret),
293 // std.fmt.fmtSliceHexLower(&client_secret),
294 // std.fmt.fmtSliceHexLower(&server_secret),
295 // std.fmt.fmtSliceHexLower(&p.client_handshake_iv),
296 // std.fmt.fmtSliceHexLower(&p.server_handshake_iv),
297 //});
298284 },
299285 else => {
300286 return error.TlsIllegalParameter;
......@@ -416,11 +402,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
416402 const next_ext_i = hs_i + ext_size;
417403 switch (et) {
418404 .server_name => {},
419 else => {
420 std.debug.print("encrypted extension: {any}\n", .{
421 et,
422 });
423 },
405 else => {},
424406 }
425407 hs_i = next_ext_i;
426408 }
......@@ -467,12 +449,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
467449 @memcpy(&main_cert_pub_key_buf, pub_key.ptr, pub_key.len);
468450 main_cert_pub_key_len = @intCast(@TypeOf(main_cert_pub_key_len), pub_key.len);
469451 } else {
470 prev_cert.verify(subject) catch |err| {
471 std.debug.print("unable to validate previous cert: {s}\n", .{
472 @errorName(err),
473 });
474 return err;
475 };
452 try prev_cert.verify(subject);
476453 }
477454
478455 if (ca_bundle.verify(subject)) |_| {
......@@ -480,12 +457,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
480457 break :cert;
481458 } else |err| switch (err) {
482459 error.CertificateIssuerNotFound => {},
483 else => |e| {
484 std.debug.print("unable to validate cert against system root CAs: {s}\n", .{
485 @errorName(e),
486 });
487 return e;
488 },
460 else => |e| return e,
489461 }
490462
491463 prev_cert = subject;
......@@ -559,9 +531,6 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
559531 }
560532 },
561533 else => {
562 //std.debug.print("signature scheme: {any}\n", .{
563 // scheme,
564 //});
565534 return error.TlsBadSignatureScheme;
566535 },
567536 }
......@@ -609,11 +578,6 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
609578
610579 const client_secret = hkdfExpandLabel(P.Hkdf, p.master_secret, "c ap traffic", &handshake_hash, P.Hash.digest_length);
611580 const server_secret = hkdfExpandLabel(P.Hkdf, p.master_secret, "s ap traffic", &handshake_hash, P.Hash.digest_length);
612 //std.debug.print("master_secret={}\nclient_secret={}\nserver_secret={}\n", .{
613 // std.fmt.fmtSliceHexLower(&p.master_secret),
614 // std.fmt.fmtSliceHexLower(&client_secret),
615 // std.fmt.fmtSliceHexLower(&server_secret),
616 //});
617581 break :c @unionInit(tls.ApplicationCipher, @tagName(tag), .{
618582 .client_secret = client_secret,
619583 .server_secret = server_secret,
......@@ -646,13 +610,11 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
646610 }
647611 },
648612 else => {
649 std.debug.print("inner content type: {any}\n", .{inner_ct});
650613 return error.TlsUnexpectedMessage;
651614 },
652615 }
653616 },
654617 else => {
655 std.debug.print("content type: {s}\n", .{@tagName(ct)});
656618 return error.TlsUnexpectedMessage;
657619 },
658620 }
......@@ -707,16 +669,6 @@ pub fn write(c: *Client, stream: net.Stream, bytes: []const u8) !usize {
707669 c.write_seq += 1; // TODO send key_update on overflow
708670 const nonce = @as(V, p.client_iv) ^ operand;
709671 P.AEAD.encrypt(ciphertext, auth_tag, cleartext, ad, nonce, p.client_key);
710 //std.debug.print("seq: {d} nonce: {} client_key: {} client_iv: {} ad: {} auth_tag: {}\nserver_key: {} server_iv: {}\n", .{
711 // c.write_seq - 1,
712 // std.fmt.fmtSliceHexLower(&nonce),
713 // std.fmt.fmtSliceHexLower(&p.client_key),
714 // std.fmt.fmtSliceHexLower(&p.client_iv),
715 // std.fmt.fmtSliceHexLower(ad),
716 // std.fmt.fmtSliceHexLower(auth_tag),
717 // std.fmt.fmtSliceHexLower(&p.server_key),
718 // std.fmt.fmtSliceHexLower(&p.server_iv),
719 //});
720672
721673 const record = ciphertext_buf[record_start..ciphertext_end];
722674 iovecs_buf[iovec_end] = .{
......@@ -844,10 +796,6 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
844796 c.partial_cleartext_idx = 0;
845797 c.partial_ciphertext_idx = 0;
846798 c.partial_ciphertext_end = 0;
847 } else {
848 std.debug.print("finished giving partial cleartext. {d} bytes ciphertext remain\n", .{
849 c.partial_ciphertext_end - c.partial_ciphertext_idx,
850 });
851799 }
852800 }
853801
......@@ -943,11 +891,8 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
943891 in += 1;
944892 const legacy_version = mem.readIntBig(u16, frag[in..][0..2]);
945893 in += 2;
946 //_ = legacy_version;
894 _ = legacy_version;
947895 const record_len = mem.readIntBig(u16, frag[in..][0..2]);
948 std.debug.print("ct={any} legacy_version={x} record_len={d}\n", .{
949 ct, legacy_version, record_len,
950 });
951896 if (record_len > max_ciphertext_len) return error.TlsRecordOverflow;
952897 in += 2;
953898 const end = in + record_len;
......@@ -962,12 +907,8 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
962907 const first = frag[in..];
963908 const full_record_len = record_len + tls.ciphertext_record_header_len;
964909 const second_len = full_record_len - first.len;
965 if (frag1.len < second_len) {
966 std.debug.print("end > frag.len finishRead2 end={d} frag.len={d}\n", .{
967 end, frag.len,
968 });
910 if (frag1.len < second_len)
969911 return finishRead2(c, first, frag1, vp.total);
970 }
971912
972913 mem.copy(u8, frag[0..in], first);
973914 mem.copy(u8, frag[first.len..], frag1[0..second_len]);
......@@ -1016,7 +957,7 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
1016957 c.partial_ciphertext_end = c.partial_ciphertext_idx;
1017958 return vp.total;
1018959 }
1019 std.debug.print("alert: {s} {s}\n", .{ @tagName(level), @tagName(desc) });
960 _ = level;
1020961 return error.TlsAlert;
1021962 },
1022963 .handshake => {
......@@ -1032,11 +973,9 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
1032973 const handshake = cleartext[ct_i..next_handshake_i];
1033974 switch (handshake_type) {
1034975 .new_session_ticket => {
1035 std.debug.print("new_session_ticket\n", .{});
1036976 // This client implementation ignores new session tickets.
1037977 },
1038978 .key_update => {
1039 std.debug.print("key_update\n", .{});
1040979 switch (c.application_cipher) {
1041980 inline else => |*p| {
1042981 const P = @TypeOf(p.*);
......@@ -1085,13 +1024,10 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
10851024 const dest = c.partially_read_buffer[c.partial_ciphertext_idx..];
10861025 mem.copy(u8, dest, msg);
10871026 c.partial_ciphertext_idx = @intCast(@TypeOf(c.partial_ciphertext_idx), c.partial_ciphertext_idx + msg.len);
1088 std.debug.print("application_data {d} bytes to partial buffer\n", .{msg.len});
10891027 } else {
10901028 const amt = vp.put(msg);
1091 std.debug.print("application_data {d} bytes to read buffer\n", .{msg.len});
10921029 if (amt < msg.len) {
10931030 const rest = msg[amt..];
1094 std.debug.print(" {d} bytes to partial buffer\n", .{rest.len});
10951031 c.partial_cleartext_idx = 0;
10961032 c.partial_ciphertext_idx = @intCast(@TypeOf(c.partial_ciphertext_idx), rest.len);
10971033 mem.copy(u8, &c.partially_read_buffer, rest);
......@@ -1101,7 +1037,6 @@ pub fn readvAdvanced(c: *Client, stream: net.Stream, iovecs: []const std.os.iove
11011037 // Output buffer was used directly which means no
11021038 // memory copying needs to occur, and we can move
11031039 // on to the next ciphertext record.
1104 std.debug.print("application_data {d} bytes directly to read buffer\n", .{cleartext.len - 1});
11051040 vp.next(cleartext.len - 1);
11061041 }
11071042 },