Add SM Cipher certificate test header: certs_test_sm.h

[gojimmypi]

Description

This update adds the certs_test_sm.h file: the SM Cipher specific certs in array format, partially addressing #6681.

Contents were semi-manually generated using gencertbuf.pl. I still need to create a script to automatically refresh it.

I'm in the process of polishing my Espressif examples that support the SM ciphers and need to have this file available not only here, but also in the ESP Registry. See also #6708

• edit: Here's an example of how this file is used in the ESP32 wolfssl_client TLS example.

• edit(2): Reminder that the SM cipher code needs to be installed into wolfSSL from wolfsm:

git clone https://github.com/wolfSSL/wolfsm.git
cd wolfsm
./install.sh
# or
./install.sh  /path/to/your/wolfssl

Fixes zd# n/a

Testing

Tested with ESP32 embedded apps only.

edit(3): Reminder for sample commandline testing (See wolfsm testing-tls):

./examples/client/client -v 3 -l ECDHE-ECDSA-SM4-CBC-SM3 \
                              -c ./certs/sm2/client-sm2.pem \
                              -k ./certs/sm2/client-sm2-priv.pem \
                              -A ./certs/sm2/root-sm2.pem -C

./examples/server/server -v 3 -l ECDHE-ECDSA-SM4-CBC-SM3 \
                              -c ./certs/sm2/server-sm2.pem \
                              -k ./certs/sm2/server-sm2-priv.pem \
                              -A ./certs/sm2/client-sm2.pem -V 

Example listening server on ESP32: (the one not working is the ESP32-H2, which has no built-in WiFi)

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[gojimmypi]

retest this please

[JacobBarthelmeh]

retest this please Jenkins

[JacobBarthelmeh]

fails test for special characters found

[check-source-text] [2 of 7] [3980560f00]

weird control chars, hard tabs, CRs, trailing whitespace:

./wolfssl/certs_test_sm.h:7028:»0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
./wolfssl/certs_test_sm.h:7029:»0x65, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x44, 0x61, 0x74,
./wolfssl/certs_test_sm.h:7030:»0x61, 0x3A, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
./wolfssl/certs_test_sm.h:7031:»0x20, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20,
./wolfssl/certs_test_sm.h:7032:»0x33, 0x20, 0x28, 0x30, 0x78, 0x32, 0x29, 0x0A, 0x20, 0x20,
./wolfssl/certs_test_sm.h:7033:»0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x53, 0x65, 0x72, 0x69,
./wolfssl/certs_test_sm.h:7034:»0x61, 0x6C, 0x20, 0x4E, 0x75, 0x6D, 0x62, 0x65, 0x72, 0x3A,
./wolfssl/certs_test_sm.h:7035:»0x0A, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
./wolfssl/certs_test_sm.h:7036:»0x20, 0x20, 0x20, 0x36, 0x30, 0x3A, 0x61, 0x30, 0x3A, 0x34,
./wolfssl/certs_test_sm.h:7037:»0x61, 0x3A, 0x30, 0x62, 0x3A, 0x33, 0x36, 0x3A, 0x65, 0x62,
[...and more...]

[gojimmypi]

fails test for special characters found

cleaned

[JacobBarthelmeh]

I like the addition of certs_test_sm.h but thinking on it more, should it go into the wolfsm repository and get added to wolfssl with the wolfsm/install.sh script?

[JacobBarthelmeh]

was gencertbuf_sm.pl supposed to be in this PR?

[gojimmypi]

Yes, see #6681 although the correct name is gencert_sm.sh and needs to be cleaned up.

[gojimmypi]

I've revised the original PR to instead use the existing gencertbuf.pl to generate both files.

[gojimmypi]

should it go into the wolfsm repository and get added to wolfssl with the wolfsm/install.sh script?

@JacobBarthelmeh : yes, good catch. I agree the certs should be copied with SM install instead.

I'll be creating a new PR over there in wolfsm this week.

[gojimmypi]

@JacobBarthelmeh would you like me to also move the certs/sm2 files to wolfSSL/wolfsm as well & include in the respective install.sh?

cc: @SparkiDev

[gojimmypi]

I'm planning to instead update existing certs_test.h here as noted in wolfSSL/wolfsm#16 (comment)

[gojimmypi]

Jenkins retest this please.

For Cannot contact wolf-linux-cloud-node-[n]: java.lang.InterruptedException
Unable to create live FilePath for wolf-linux-cloud-node-[n]; wolf-linux-cloud-node-[n]was marked offline: Connection was broken

[gojimmypi]

Jenkins retest this please.

For org.jenkinsci.plugins.workflow.support.steps.AgentOfflineException: Unable to create live FilePath for wolf-linux-cloud-node-[n]; wolf-linux-cloud-node-[n] was marked offline

[gojimmypi]

Heads up the current SM2 certs expire in a couple of months: November 11.

$ openssl x509 -in ./certs/sm2/ca-sm2.der -inform DER -noout -dates
notBefore=Feb 15 06:23:07 2023 GMT
notAfter=Nov 11 06:23:07 2025 GMT

I can put up a separate PR to refresh them sooner. See scripts in certs/sm2 :

./gen-sm2-keys.sh
./gen-sm2-certs.sh  

[gojimmypi]

The changes in this PR were merged in #9218