TlsConfig.c 34 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211
  1. /** @file
  2. SSL/TLS Configuration Library Wrapper Implementation over OpenSSL.
  3. Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
  4. (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
  5. SPDX-License-Identifier: BSD-2-Clause-Patent
  6. **/
  7. #include "InternalTlsLib.h"
  8. typedef struct {
  9. //
  10. // IANA/IETF defined Cipher Suite ID
  11. //
  12. UINT16 IanaCipher;
  13. //
  14. // OpenSSL-used Cipher Suite String
  15. //
  16. CONST CHAR8 *OpensslCipher;
  17. //
  18. // Length of OpensslCipher
  19. //
  20. UINTN OpensslCipherLength;
  21. } TLS_CIPHER_MAPPING;
  22. //
  23. // Create a TLS_CIPHER_MAPPING initializer from IanaCipher and OpensslCipher so
  24. // that OpensslCipherLength is filled in automatically. IanaCipher must be an
  25. // integer constant expression, and OpensslCipher must be a string literal.
  26. //
  27. #define MAP(IanaCipher, OpensslCipher) \
  28. { (IanaCipher), (OpensslCipher), sizeof (OpensslCipher) - 1 }
  29. //
  30. // The mapping table between IANA/IETF Cipher Suite definitions and
  31. // OpenSSL-used Cipher Suite name.
  32. //
  33. // Keep the table uniquely sorted by the IanaCipher field, in increasing order.
  34. //
  35. STATIC CONST TLS_CIPHER_MAPPING TlsCipherMappingTable[] = {
  36. MAP ( 0x0001, "NULL-MD5" ), /// TLS_RSA_WITH_NULL_MD5
  37. MAP ( 0x0002, "NULL-SHA" ), /// TLS_RSA_WITH_NULL_SHA
  38. MAP ( 0x0004, "RC4-MD5" ), /// TLS_RSA_WITH_RC4_128_MD5
  39. MAP ( 0x0005, "RC4-SHA" ), /// TLS_RSA_WITH_RC4_128_SHA
  40. MAP ( 0x000A, "DES-CBC3-SHA" ), /// TLS_RSA_WITH_3DES_EDE_CBC_SHA, mandatory TLS 1.1
  41. MAP ( 0x0016, "DHE-RSA-DES-CBC3-SHA" ), /// TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  42. MAP ( 0x002F, "AES128-SHA" ), /// TLS_RSA_WITH_AES_128_CBC_SHA, mandatory TLS 1.2
  43. MAP ( 0x0030, "DH-DSS-AES128-SHA" ), /// TLS_DH_DSS_WITH_AES_128_CBC_SHA
  44. MAP ( 0x0031, "DH-RSA-AES128-SHA" ), /// TLS_DH_RSA_WITH_AES_128_CBC_SHA
  45. MAP ( 0x0033, "DHE-RSA-AES128-SHA" ), /// TLS_DHE_RSA_WITH_AES_128_CBC_SHA
  46. MAP ( 0x0035, "AES256-SHA" ), /// TLS_RSA_WITH_AES_256_CBC_SHA
  47. MAP ( 0x0036, "DH-DSS-AES256-SHA" ), /// TLS_DH_DSS_WITH_AES_256_CBC_SHA
  48. MAP ( 0x0037, "DH-RSA-AES256-SHA" ), /// TLS_DH_RSA_WITH_AES_256_CBC_SHA
  49. MAP ( 0x0039, "DHE-RSA-AES256-SHA" ), /// TLS_DHE_RSA_WITH_AES_256_CBC_SHA
  50. MAP ( 0x003B, "NULL-SHA256" ), /// TLS_RSA_WITH_NULL_SHA256
  51. MAP ( 0x003C, "AES128-SHA256" ), /// TLS_RSA_WITH_AES_128_CBC_SHA256
  52. MAP ( 0x003D, "AES256-SHA256" ), /// TLS_RSA_WITH_AES_256_CBC_SHA256
  53. MAP ( 0x003E, "DH-DSS-AES128-SHA256" ), /// TLS_DH_DSS_WITH_AES_128_CBC_SHA256
  54. MAP ( 0x003F, "DH-RSA-AES128-SHA256" ), /// TLS_DH_RSA_WITH_AES_128_CBC_SHA256
  55. MAP ( 0x0067, "DHE-RSA-AES128-SHA256" ), /// TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
  56. MAP ( 0x0068, "DH-DSS-AES256-SHA256" ), /// TLS_DH_DSS_WITH_AES_256_CBC_SHA256
  57. MAP ( 0x0069, "DH-RSA-AES256-SHA256" ), /// TLS_DH_RSA_WITH_AES_256_CBC_SHA256
  58. MAP ( 0x006B, "DHE-RSA-AES256-SHA256" ), /// TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
  59. };
  60. /**
  61. Gets the OpenSSL cipher suite mapping for the supplied IANA TLS cipher suite.
  62. @param[in] CipherId The supplied IANA TLS cipher suite ID.
  63. @return The corresponding OpenSSL cipher suite mapping if found,
  64. NULL otherwise.
  65. **/
  66. STATIC
  67. CONST TLS_CIPHER_MAPPING *
  68. TlsGetCipherMapping (
  69. IN UINT16 CipherId
  70. )
  71. {
  72. INTN Left;
  73. INTN Right;
  74. INTN Middle;
  75. //
  76. // Binary Search Cipher Mapping Table for IANA-OpenSSL Cipher Translation
  77. //
  78. Left = 0;
  79. Right = ARRAY_SIZE (TlsCipherMappingTable) - 1;
  80. while (Right >= Left) {
  81. Middle = (Left + Right) / 2;
  82. if (CipherId == TlsCipherMappingTable[Middle].IanaCipher) {
  83. //
  84. // Translate IANA cipher suite ID to OpenSSL name.
  85. //
  86. return &TlsCipherMappingTable[Middle];
  87. }
  88. if (CipherId < TlsCipherMappingTable[Middle].IanaCipher) {
  89. Right = Middle - 1;
  90. } else {
  91. Left = Middle + 1;
  92. }
  93. }
  94. //
  95. // No Cipher Mapping found, return NULL.
  96. //
  97. return NULL;
  98. }
  99. /**
  100. Set a new TLS/SSL method for a particular TLS object.
  101. This function sets a new TLS/SSL method for a particular TLS object.
  102. @param[in] Tls Pointer to a TLS object.
  103. @param[in] MajorVer Major Version of TLS/SSL Protocol.
  104. @param[in] MinorVer Minor Version of TLS/SSL Protocol.
  105. @retval EFI_SUCCESS The TLS/SSL method was set successfully.
  106. @retval EFI_INVALID_PARAMETER The parameter is invalid.
  107. @retval EFI_UNSUPPORTED Unsupported TLS/SSL method.
  108. **/
  109. EFI_STATUS
  110. EFIAPI
  111. TlsSetVersion (
  112. IN VOID *Tls,
  113. IN UINT8 MajorVer,
  114. IN UINT8 MinorVer
  115. )
  116. {
  117. TLS_CONNECTION *TlsConn;
  118. UINT16 ProtoVersion;
  119. TlsConn = (TLS_CONNECTION *)Tls;
  120. if (TlsConn == NULL || TlsConn->Ssl == NULL) {
  121. return EFI_INVALID_PARAMETER;
  122. }
  123. ProtoVersion = (MajorVer << 8) | MinorVer;
  124. //
  125. // Bound TLS method to the particular specified version.
  126. //
  127. switch (ProtoVersion) {
  128. case TLS1_VERSION:
  129. //
  130. // TLS 1.0
  131. //
  132. SSL_set_min_proto_version (TlsConn->Ssl, TLS1_VERSION);
  133. SSL_set_max_proto_version (TlsConn->Ssl, TLS1_VERSION);
  134. break;
  135. case TLS1_1_VERSION:
  136. //
  137. // TLS 1.1
  138. //
  139. SSL_set_min_proto_version (TlsConn->Ssl, TLS1_1_VERSION);
  140. SSL_set_max_proto_version (TlsConn->Ssl, TLS1_1_VERSION);
  141. break;
  142. case TLS1_2_VERSION:
  143. //
  144. // TLS 1.2
  145. //
  146. SSL_set_min_proto_version (TlsConn->Ssl, TLS1_2_VERSION);
  147. SSL_set_max_proto_version (TlsConn->Ssl, TLS1_2_VERSION);
  148. break;
  149. default:
  150. //
  151. // Unsupported Protocol Version
  152. //
  153. return EFI_UNSUPPORTED;
  154. }
  155. return EFI_SUCCESS;;
  156. }
  157. /**
  158. Set TLS object to work in client or server mode.
  159. This function prepares a TLS object to work in client or server mode.
  160. @param[in] Tls Pointer to a TLS object.
  161. @param[in] IsServer Work in server mode.
  162. @retval EFI_SUCCESS The TLS/SSL work mode was set successfully.
  163. @retval EFI_INVALID_PARAMETER The parameter is invalid.
  164. @retval EFI_UNSUPPORTED Unsupported TLS/SSL work mode.
  165. **/
  166. EFI_STATUS
  167. EFIAPI
  168. TlsSetConnectionEnd (
  169. IN VOID *Tls,
  170. IN BOOLEAN IsServer
  171. )
  172. {
  173. TLS_CONNECTION *TlsConn;
  174. TlsConn = (TLS_CONNECTION *) Tls;
  175. if (TlsConn == NULL || TlsConn->Ssl == NULL) {
  176. return EFI_INVALID_PARAMETER;
  177. }
  178. if (!IsServer) {
  179. //
  180. // Set TLS to work in Client mode.
  181. //
  182. SSL_set_connect_state (TlsConn->Ssl);
  183. } else {
  184. //
  185. // Set TLS to work in Server mode.
  186. // It is unsupported for UEFI version currently.
  187. //
  188. //SSL_set_accept_state (TlsConn->Ssl);
  189. return EFI_UNSUPPORTED;
  190. }
  191. return EFI_SUCCESS;
  192. }
  193. /**
  194. Set the ciphers list to be used by the TLS object.
  195. This function sets the ciphers for use by a specified TLS object.
  196. @param[in] Tls Pointer to a TLS object.
  197. @param[in] CipherId Array of UINT16 cipher identifiers. Each UINT16
  198. cipher identifier comes from the TLS Cipher Suite
  199. Registry of the IANA, interpreting Byte1 and Byte2
  200. in network (big endian) byte order.
  201. @param[in] CipherNum The number of cipher in the list.
  202. @retval EFI_SUCCESS The ciphers list was set successfully.
  203. @retval EFI_INVALID_PARAMETER The parameter is invalid.
  204. @retval EFI_UNSUPPORTED No supported TLS cipher was found in CipherId.
  205. @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
  206. **/
  207. EFI_STATUS
  208. EFIAPI
  209. TlsSetCipherList (
  210. IN VOID *Tls,
  211. IN UINT16 *CipherId,
  212. IN UINTN CipherNum
  213. )
  214. {
  215. TLS_CONNECTION *TlsConn;
  216. EFI_STATUS Status;
  217. CONST TLS_CIPHER_MAPPING **MappedCipher;
  218. UINTN MappedCipherBytes;
  219. UINTN MappedCipherCount;
  220. UINTN CipherStringSize;
  221. UINTN Index;
  222. CONST TLS_CIPHER_MAPPING *Mapping;
  223. CHAR8 *CipherString;
  224. CHAR8 *CipherStringPosition;
  225. TlsConn = (TLS_CONNECTION *) Tls;
  226. if (TlsConn == NULL || TlsConn->Ssl == NULL || CipherId == NULL) {
  227. return EFI_INVALID_PARAMETER;
  228. }
  229. //
  230. // Allocate the MappedCipher array for recording the mappings that we find
  231. // for the input IANA identifiers in CipherId.
  232. //
  233. Status = SafeUintnMult (CipherNum, sizeof (*MappedCipher),
  234. &MappedCipherBytes);
  235. if (EFI_ERROR (Status)) {
  236. return EFI_OUT_OF_RESOURCES;
  237. }
  238. MappedCipher = AllocatePool (MappedCipherBytes);
  239. if (MappedCipher == NULL) {
  240. return EFI_OUT_OF_RESOURCES;
  241. }
  242. //
  243. // Map the cipher IDs, and count the number of bytes for the full
  244. // CipherString.
  245. //
  246. MappedCipherCount = 0;
  247. CipherStringSize = 0;
  248. for (Index = 0; Index < CipherNum; Index++) {
  249. //
  250. // Look up the IANA-to-OpenSSL mapping.
  251. //
  252. Mapping = TlsGetCipherMapping (CipherId[Index]);
  253. if (Mapping == NULL) {
  254. DEBUG ((DEBUG_VERBOSE, "%a:%a: skipping CipherId=0x%04x\n",
  255. gEfiCallerBaseName, __FUNCTION__, CipherId[Index]));
  256. //
  257. // Skipping the cipher is valid because CipherId is an ordered
  258. // preference list of ciphers, thus we can filter it as long as we
  259. // don't change the relative order of elements on it.
  260. //
  261. continue;
  262. }
  263. //
  264. // Accumulate Mapping->OpensslCipherLength into CipherStringSize. If this
  265. // is not the first successful mapping, account for a colon (":") prefix
  266. // too.
  267. //
  268. if (MappedCipherCount > 0) {
  269. Status = SafeUintnAdd (CipherStringSize, 1, &CipherStringSize);
  270. if (EFI_ERROR (Status)) {
  271. Status = EFI_OUT_OF_RESOURCES;
  272. goto FreeMappedCipher;
  273. }
  274. }
  275. Status = SafeUintnAdd (CipherStringSize, Mapping->OpensslCipherLength,
  276. &CipherStringSize);
  277. if (EFI_ERROR (Status)) {
  278. Status = EFI_OUT_OF_RESOURCES;
  279. goto FreeMappedCipher;
  280. }
  281. //
  282. // Record the mapping.
  283. //
  284. MappedCipher[MappedCipherCount++] = Mapping;
  285. }
  286. //
  287. // Verify that at least one IANA cipher ID could be mapped; account for the
  288. // terminating NUL character in CipherStringSize; allocate CipherString.
  289. //
  290. if (MappedCipherCount == 0) {
  291. DEBUG ((DEBUG_ERROR, "%a:%a: no CipherId could be mapped\n",
  292. gEfiCallerBaseName, __FUNCTION__));
  293. Status = EFI_UNSUPPORTED;
  294. goto FreeMappedCipher;
  295. }
  296. Status = SafeUintnAdd (CipherStringSize, 1, &CipherStringSize);
  297. if (EFI_ERROR (Status)) {
  298. Status = EFI_OUT_OF_RESOURCES;
  299. goto FreeMappedCipher;
  300. }
  301. CipherString = AllocatePool (CipherStringSize);
  302. if (CipherString == NULL) {
  303. Status = EFI_OUT_OF_RESOURCES;
  304. goto FreeMappedCipher;
  305. }
  306. //
  307. // Go over the collected mappings and populate CipherString.
  308. //
  309. CipherStringPosition = CipherString;
  310. for (Index = 0; Index < MappedCipherCount; Index++) {
  311. Mapping = MappedCipher[Index];
  312. //
  313. // Append the colon (":") prefix except for the first mapping, then append
  314. // Mapping->OpensslCipher.
  315. //
  316. if (Index > 0) {
  317. *(CipherStringPosition++) = ':';
  318. }
  319. CopyMem (CipherStringPosition, Mapping->OpensslCipher,
  320. Mapping->OpensslCipherLength);
  321. CipherStringPosition += Mapping->OpensslCipherLength;
  322. }
  323. //
  324. // NUL-terminate CipherString.
  325. //
  326. *(CipherStringPosition++) = '\0';
  327. ASSERT (CipherStringPosition == CipherString + CipherStringSize);
  328. //
  329. // Log CipherString for debugging. CipherString can be very long if the
  330. // caller provided a large CipherId array, so log CipherString in segments of
  331. // 79 non-newline characters. (MAX_DEBUG_MESSAGE_LENGTH is usually 0x100 in
  332. // DebugLib instances.)
  333. //
  334. DEBUG_CODE (
  335. UINTN FullLength;
  336. UINTN SegmentLength;
  337. FullLength = CipherStringSize - 1;
  338. DEBUG ((DEBUG_VERBOSE, "%a:%a: CipherString={\n", gEfiCallerBaseName,
  339. __FUNCTION__));
  340. for (CipherStringPosition = CipherString;
  341. CipherStringPosition < CipherString + FullLength;
  342. CipherStringPosition += SegmentLength) {
  343. SegmentLength = FullLength - (CipherStringPosition - CipherString);
  344. if (SegmentLength > 79) {
  345. SegmentLength = 79;
  346. }
  347. DEBUG ((DEBUG_VERBOSE, "%.*a\n", SegmentLength, CipherStringPosition));
  348. }
  349. DEBUG ((DEBUG_VERBOSE, "}\n"));
  350. //
  351. // Restore the pre-debug value of CipherStringPosition by skipping over the
  352. // trailing NUL.
  353. //
  354. CipherStringPosition++;
  355. ASSERT (CipherStringPosition == CipherString + CipherStringSize);
  356. );
  357. //
  358. // Sets the ciphers for use by the Tls object.
  359. //
  360. if (SSL_set_cipher_list (TlsConn->Ssl, CipherString) <= 0) {
  361. Status = EFI_UNSUPPORTED;
  362. goto FreeCipherString;
  363. }
  364. Status = EFI_SUCCESS;
  365. FreeCipherString:
  366. FreePool (CipherString);
  367. FreeMappedCipher:
  368. FreePool (MappedCipher);
  369. return Status;
  370. }
  371. /**
  372. Set the compression method for TLS/SSL operations.
  373. This function handles TLS/SSL integrated compression methods.
  374. @param[in] CompMethod The compression method ID.
  375. @retval EFI_SUCCESS The compression method for the communication was
  376. set successfully.
  377. @retval EFI_UNSUPPORTED Unsupported compression method.
  378. **/
  379. EFI_STATUS
  380. EFIAPI
  381. TlsSetCompressionMethod (
  382. IN UINT8 CompMethod
  383. )
  384. {
  385. COMP_METHOD *Cm;
  386. INTN Ret;
  387. Cm = NULL;
  388. Ret = 0;
  389. if (CompMethod == 0) {
  390. //
  391. // TLS defines one standard compression method, CompressionMethod.null (0),
  392. // which specifies that data exchanged via the record protocol will not be compressed.
  393. // So, return EFI_SUCCESS directly (RFC 3749).
  394. //
  395. return EFI_SUCCESS;
  396. } else if (CompMethod == 1) {
  397. Cm = COMP_zlib();
  398. } else {
  399. return EFI_UNSUPPORTED;
  400. }
  401. //
  402. // Adds the compression method to the list of available
  403. // compression methods.
  404. //
  405. Ret = SSL_COMP_add_compression_method (CompMethod, Cm);
  406. if (Ret != 0) {
  407. return EFI_UNSUPPORTED;
  408. }
  409. return EFI_SUCCESS;
  410. }
  411. /**
  412. Set peer certificate verification mode for the TLS connection.
  413. This function sets the verification mode flags for the TLS connection.
  414. @param[in] Tls Pointer to the TLS object.
  415. @param[in] VerifyMode A set of logically or'ed verification mode flags.
  416. **/
  417. VOID
  418. EFIAPI
  419. TlsSetVerify (
  420. IN VOID *Tls,
  421. IN UINT32 VerifyMode
  422. )
  423. {
  424. TLS_CONNECTION *TlsConn;
  425. TlsConn = (TLS_CONNECTION *) Tls;
  426. if (TlsConn == NULL || TlsConn->Ssl == NULL) {
  427. return;
  428. }
  429. //
  430. // Set peer certificate verification parameters with NULL callback.
  431. //
  432. SSL_set_verify (TlsConn->Ssl, VerifyMode, NULL);
  433. }
  434. /**
  435. Sets a TLS/SSL session ID to be used during TLS/SSL connect.
  436. This function sets a session ID to be used when the TLS/SSL connection is
  437. to be established.
  438. @param[in] Tls Pointer to the TLS object.
  439. @param[in] SessionId Session ID data used for session resumption.
  440. @param[in] SessionIdLen Length of Session ID in bytes.
  441. @retval EFI_SUCCESS Session ID was set successfully.
  442. @retval EFI_INVALID_PARAMETER The parameter is invalid.
  443. @retval EFI_UNSUPPORTED No available session for ID setting.
  444. **/
  445. EFI_STATUS
  446. EFIAPI
  447. TlsSetSessionId (
  448. IN VOID *Tls,
  449. IN UINT8 *SessionId,
  450. IN UINT16 SessionIdLen
  451. )
  452. {
  453. TLS_CONNECTION *TlsConn;
  454. SSL_SESSION *Session;
  455. TlsConn = (TLS_CONNECTION *) Tls;
  456. Session = NULL;
  457. if (TlsConn == NULL || TlsConn->Ssl == NULL || SessionId == NULL) {
  458. return EFI_INVALID_PARAMETER;
  459. }
  460. Session = SSL_get_session (TlsConn->Ssl);
  461. if (Session == NULL) {
  462. return EFI_UNSUPPORTED;
  463. }
  464. SSL_SESSION_set1_id (Session, (const unsigned char *)SessionId, SessionIdLen);
  465. return EFI_SUCCESS;
  466. }
  467. /**
  468. Adds the CA to the cert store when requesting Server or Client authentication.
  469. This function adds the CA certificate to the list of CAs when requesting
  470. Server or Client authentication for the chosen TLS connection.
  471. @param[in] Tls Pointer to the TLS object.
  472. @param[in] Data Pointer to the data buffer of a DER-encoded binary
  473. X.509 certificate or PEM-encoded X.509 certificate.
  474. @param[in] DataSize The size of data buffer in bytes.
  475. @retval EFI_SUCCESS The operation succeeded.
  476. @retval EFI_INVALID_PARAMETER The parameter is invalid.
  477. @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
  478. @retval EFI_ABORTED Invalid X.509 certificate.
  479. **/
  480. EFI_STATUS
  481. EFIAPI
  482. TlsSetCaCertificate (
  483. IN VOID *Tls,
  484. IN VOID *Data,
  485. IN UINTN DataSize
  486. )
  487. {
  488. BIO *BioCert;
  489. X509 *Cert;
  490. X509_STORE *X509Store;
  491. EFI_STATUS Status;
  492. TLS_CONNECTION *TlsConn;
  493. SSL_CTX *SslCtx;
  494. INTN Ret;
  495. UINTN ErrorCode;
  496. BioCert = NULL;
  497. Cert = NULL;
  498. X509Store = NULL;
  499. Status = EFI_SUCCESS;
  500. TlsConn = (TLS_CONNECTION *) Tls;
  501. Ret = 0;
  502. if (TlsConn == NULL || TlsConn->Ssl == NULL || Data == NULL || DataSize == 0) {
  503. return EFI_INVALID_PARAMETER;
  504. }
  505. //
  506. // DER-encoded binary X.509 certificate or PEM-encoded X.509 certificate.
  507. // Determine whether certificate is from DER encoding, if so, translate it to X509 structure.
  508. //
  509. Cert = d2i_X509 (NULL, (const unsigned char ** )&Data, (long) DataSize);
  510. if (Cert == NULL) {
  511. //
  512. // Certificate is from PEM encoding.
  513. //
  514. BioCert = BIO_new (BIO_s_mem ());
  515. if (BioCert == NULL) {
  516. Status = EFI_OUT_OF_RESOURCES;
  517. goto ON_EXIT;
  518. }
  519. if (BIO_write (BioCert, Data, (UINT32) DataSize) <= 0) {
  520. Status = EFI_ABORTED;
  521. goto ON_EXIT;
  522. }
  523. Cert = PEM_read_bio_X509 (BioCert, NULL, NULL, NULL);
  524. if (Cert == NULL) {
  525. Status = EFI_ABORTED;
  526. goto ON_EXIT;
  527. }
  528. }
  529. SslCtx = SSL_get_SSL_CTX (TlsConn->Ssl);
  530. X509Store = SSL_CTX_get_cert_store (SslCtx);
  531. if (X509Store == NULL) {
  532. Status = EFI_ABORTED;
  533. goto ON_EXIT;
  534. }
  535. //
  536. // Add certificate to X509 store
  537. //
  538. Ret = X509_STORE_add_cert (X509Store, Cert);
  539. if (Ret != 1) {
  540. ErrorCode = ERR_peek_last_error ();
  541. //
  542. // Ignore "already in table" errors
  543. //
  544. if (!(ERR_GET_FUNC (ErrorCode) == X509_F_X509_STORE_ADD_CERT &&
  545. ERR_GET_REASON (ErrorCode) == X509_R_CERT_ALREADY_IN_HASH_TABLE)) {
  546. Status = EFI_ABORTED;
  547. goto ON_EXIT;
  548. }
  549. }
  550. ON_EXIT:
  551. if (BioCert != NULL) {
  552. BIO_free (BioCert);
  553. }
  554. if (Cert != NULL) {
  555. X509_free (Cert);
  556. }
  557. return Status;
  558. }
  559. /**
  560. Loads the local public certificate into the specified TLS object.
  561. This function loads the X.509 certificate into the specified TLS object
  562. for TLS negotiation.
  563. @param[in] Tls Pointer to the TLS object.
  564. @param[in] Data Pointer to the data buffer of a DER-encoded binary
  565. X.509 certificate or PEM-encoded X.509 certificate.
  566. @param[in] DataSize The size of data buffer in bytes.
  567. @retval EFI_SUCCESS The operation succeeded.
  568. @retval EFI_INVALID_PARAMETER The parameter is invalid.
  569. @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
  570. @retval EFI_ABORTED Invalid X.509 certificate.
  571. **/
  572. EFI_STATUS
  573. EFIAPI
  574. TlsSetHostPublicCert (
  575. IN VOID *Tls,
  576. IN VOID *Data,
  577. IN UINTN DataSize
  578. )
  579. {
  580. BIO *BioCert;
  581. X509 *Cert;
  582. EFI_STATUS Status;
  583. TLS_CONNECTION *TlsConn;
  584. BioCert = NULL;
  585. Cert = NULL;
  586. Status = EFI_SUCCESS;
  587. TlsConn = (TLS_CONNECTION *) Tls;
  588. if (TlsConn == NULL || TlsConn->Ssl == NULL || Data == NULL || DataSize == 0) {
  589. return EFI_INVALID_PARAMETER;
  590. }
  591. //
  592. // DER-encoded binary X.509 certificate or PEM-encoded X.509 certificate.
  593. // Determine whether certificate is from DER encoding, if so, translate it to X509 structure.
  594. //
  595. Cert = d2i_X509 (NULL, (const unsigned char ** )&Data, (long) DataSize);
  596. if (Cert == NULL) {
  597. //
  598. // Certificate is from PEM encoding.
  599. //
  600. BioCert = BIO_new (BIO_s_mem ());
  601. if (BioCert == NULL) {
  602. Status = EFI_OUT_OF_RESOURCES;
  603. goto ON_EXIT;
  604. }
  605. if (BIO_write (BioCert, Data, (UINT32) DataSize) <= 0) {
  606. Status = EFI_ABORTED;
  607. goto ON_EXIT;
  608. }
  609. Cert = PEM_read_bio_X509 (BioCert, NULL, NULL, NULL);
  610. if (Cert == NULL) {
  611. Status = EFI_ABORTED;
  612. goto ON_EXIT;
  613. }
  614. }
  615. if (SSL_use_certificate (TlsConn->Ssl, Cert) != 1) {
  616. Status = EFI_ABORTED;
  617. goto ON_EXIT;
  618. }
  619. ON_EXIT:
  620. if (BioCert != NULL) {
  621. BIO_free (BioCert);
  622. }
  623. if (Cert != NULL) {
  624. X509_free (Cert);
  625. }
  626. return Status;
  627. }
  628. /**
  629. Adds the local private key to the specified TLS object.
  630. This function adds the local private key (PEM-encoded RSA or PKCS#8 private
  631. key) into the specified TLS object for TLS negotiation.
  632. @param[in] Tls Pointer to the TLS object.
  633. @param[in] Data Pointer to the data buffer of a PEM-encoded RSA
  634. or PKCS#8 private key.
  635. @param[in] DataSize The size of data buffer in bytes.
  636. @retval EFI_SUCCESS The operation succeeded.
  637. @retval EFI_UNSUPPORTED This function is not supported.
  638. @retval EFI_ABORTED Invalid private key data.
  639. **/
  640. EFI_STATUS
  641. EFIAPI
  642. TlsSetHostPrivateKey (
  643. IN VOID *Tls,
  644. IN VOID *Data,
  645. IN UINTN DataSize
  646. )
  647. {
  648. return EFI_UNSUPPORTED;
  649. }
  650. /**
  651. Adds the CA-supplied certificate revocation list for certificate validation.
  652. This function adds the CA-supplied certificate revocation list data for
  653. certificate validity checking.
  654. @param[in] Data Pointer to the data buffer of a DER-encoded CRL data.
  655. @param[in] DataSize The size of data buffer in bytes.
  656. @retval EFI_SUCCESS The operation succeeded.
  657. @retval EFI_UNSUPPORTED This function is not supported.
  658. @retval EFI_ABORTED Invalid CRL data.
  659. **/
  660. EFI_STATUS
  661. EFIAPI
  662. TlsSetCertRevocationList (
  663. IN VOID *Data,
  664. IN UINTN DataSize
  665. )
  666. {
  667. return EFI_UNSUPPORTED;
  668. }
  669. /**
  670. Gets the protocol version used by the specified TLS connection.
  671. This function returns the protocol version used by the specified TLS
  672. connection.
  673. If Tls is NULL, then ASSERT().
  674. @param[in] Tls Pointer to the TLS object.
  675. @return The protocol version of the specified TLS connection.
  676. **/
  677. UINT16
  678. EFIAPI
  679. TlsGetVersion (
  680. IN VOID *Tls
  681. )
  682. {
  683. TLS_CONNECTION *TlsConn;
  684. TlsConn = (TLS_CONNECTION *) Tls;
  685. ASSERT (TlsConn != NULL);
  686. return (UINT16)(SSL_version (TlsConn->Ssl));
  687. }
  688. /**
  689. Gets the connection end of the specified TLS connection.
  690. This function returns the connection end (as client or as server) used by
  691. the specified TLS connection.
  692. If Tls is NULL, then ASSERT().
  693. @param[in] Tls Pointer to the TLS object.
  694. @return The connection end used by the specified TLS connection.
  695. **/
  696. UINT8
  697. EFIAPI
  698. TlsGetConnectionEnd (
  699. IN VOID *Tls
  700. )
  701. {
  702. TLS_CONNECTION *TlsConn;
  703. TlsConn = (TLS_CONNECTION *) Tls;
  704. ASSERT (TlsConn != NULL);
  705. return (UINT8)SSL_is_server (TlsConn->Ssl);
  706. }
  707. /**
  708. Gets the cipher suite used by the specified TLS connection.
  709. This function returns current cipher suite used by the specified
  710. TLS connection.
  711. @param[in] Tls Pointer to the TLS object.
  712. @param[in,out] CipherId The cipher suite used by the TLS object.
  713. @retval EFI_SUCCESS The cipher suite was returned successfully.
  714. @retval EFI_INVALID_PARAMETER The parameter is invalid.
  715. @retval EFI_UNSUPPORTED Unsupported cipher suite.
  716. **/
  717. EFI_STATUS
  718. EFIAPI
  719. TlsGetCurrentCipher (
  720. IN VOID *Tls,
  721. IN OUT UINT16 *CipherId
  722. )
  723. {
  724. TLS_CONNECTION *TlsConn;
  725. CONST SSL_CIPHER *Cipher;
  726. TlsConn = (TLS_CONNECTION *) Tls;
  727. Cipher = NULL;
  728. if (TlsConn == NULL || TlsConn->Ssl == NULL || CipherId == NULL) {
  729. return EFI_INVALID_PARAMETER;
  730. }
  731. Cipher = SSL_get_current_cipher (TlsConn->Ssl);
  732. if (Cipher == NULL) {
  733. return EFI_UNSUPPORTED;
  734. }
  735. *CipherId = (SSL_CIPHER_get_id (Cipher)) & 0xFFFF;
  736. return EFI_SUCCESS;
  737. }
  738. /**
  739. Gets the compression methods used by the specified TLS connection.
  740. This function returns current integrated compression methods used by
  741. the specified TLS connection.
  742. @param[in] Tls Pointer to the TLS object.
  743. @param[in,out] CompressionId The current compression method used by
  744. the TLS object.
  745. @retval EFI_SUCCESS The compression method was returned successfully.
  746. @retval EFI_INVALID_PARAMETER The parameter is invalid.
  747. @retval EFI_ABORTED Invalid Compression method.
  748. @retval EFI_UNSUPPORTED This function is not supported.
  749. **/
  750. EFI_STATUS
  751. EFIAPI
  752. TlsGetCurrentCompressionId (
  753. IN VOID *Tls,
  754. IN OUT UINT8 *CompressionId
  755. )
  756. {
  757. return EFI_UNSUPPORTED;
  758. }
  759. /**
  760. Gets the verification mode currently set in the TLS connection.
  761. This function returns the peer verification mode currently set in the
  762. specified TLS connection.
  763. If Tls is NULL, then ASSERT().
  764. @param[in] Tls Pointer to the TLS object.
  765. @return The verification mode set in the specified TLS connection.
  766. **/
  767. UINT32
  768. EFIAPI
  769. TlsGetVerify (
  770. IN VOID *Tls
  771. )
  772. {
  773. TLS_CONNECTION *TlsConn;
  774. TlsConn = (TLS_CONNECTION *) Tls;
  775. ASSERT (TlsConn != NULL);
  776. return SSL_get_verify_mode (TlsConn->Ssl);
  777. }
  778. /**
  779. Gets the session ID used by the specified TLS connection.
  780. This function returns the TLS/SSL session ID currently used by the
  781. specified TLS connection.
  782. @param[in] Tls Pointer to the TLS object.
  783. @param[in,out] SessionId Buffer to contain the returned session ID.
  784. @param[in,out] SessionIdLen The length of Session ID in bytes.
  785. @retval EFI_SUCCESS The Session ID was returned successfully.
  786. @retval EFI_INVALID_PARAMETER The parameter is invalid.
  787. @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
  788. **/
  789. EFI_STATUS
  790. EFIAPI
  791. TlsGetSessionId (
  792. IN VOID *Tls,
  793. IN OUT UINT8 *SessionId,
  794. IN OUT UINT16 *SessionIdLen
  795. )
  796. {
  797. TLS_CONNECTION *TlsConn;
  798. SSL_SESSION *Session;
  799. CONST UINT8 *SslSessionId;
  800. TlsConn = (TLS_CONNECTION *) Tls;
  801. Session = NULL;
  802. if (TlsConn == NULL || TlsConn->Ssl == NULL || SessionId == NULL || SessionIdLen == NULL) {
  803. return EFI_INVALID_PARAMETER;
  804. }
  805. Session = SSL_get_session (TlsConn->Ssl);
  806. if (Session == NULL) {
  807. return EFI_UNSUPPORTED;
  808. }
  809. SslSessionId = SSL_SESSION_get_id (Session, (unsigned int *)SessionIdLen);
  810. CopyMem (SessionId, SslSessionId, *SessionIdLen);
  811. return EFI_SUCCESS;
  812. }
  813. /**
  814. Gets the client random data used in the specified TLS connection.
  815. This function returns the TLS/SSL client random data currently used in
  816. the specified TLS connection.
  817. @param[in] Tls Pointer to the TLS object.
  818. @param[in,out] ClientRandom Buffer to contain the returned client
  819. random data (32 bytes).
  820. **/
  821. VOID
  822. EFIAPI
  823. TlsGetClientRandom (
  824. IN VOID *Tls,
  825. IN OUT UINT8 *ClientRandom
  826. )
  827. {
  828. TLS_CONNECTION *TlsConn;
  829. TlsConn = (TLS_CONNECTION *) Tls;
  830. if (TlsConn == NULL || TlsConn->Ssl == NULL || ClientRandom == NULL) {
  831. return;
  832. }
  833. SSL_get_client_random (TlsConn->Ssl, ClientRandom, SSL3_RANDOM_SIZE);
  834. }
  835. /**
  836. Gets the server random data used in the specified TLS connection.
  837. This function returns the TLS/SSL server random data currently used in
  838. the specified TLS connection.
  839. @param[in] Tls Pointer to the TLS object.
  840. @param[in,out] ServerRandom Buffer to contain the returned server
  841. random data (32 bytes).
  842. **/
  843. VOID
  844. EFIAPI
  845. TlsGetServerRandom (
  846. IN VOID *Tls,
  847. IN OUT UINT8 *ServerRandom
  848. )
  849. {
  850. TLS_CONNECTION *TlsConn;
  851. TlsConn = (TLS_CONNECTION *) Tls;
  852. if (TlsConn == NULL || TlsConn->Ssl == NULL || ServerRandom == NULL) {
  853. return;
  854. }
  855. SSL_get_server_random (TlsConn->Ssl, ServerRandom, SSL3_RANDOM_SIZE);
  856. }
  857. /**
  858. Gets the master key data used in the specified TLS connection.
  859. This function returns the TLS/SSL master key material currently used in
  860. the specified TLS connection.
  861. @param[in] Tls Pointer to the TLS object.
  862. @param[in,out] KeyMaterial Buffer to contain the returned key material.
  863. @retval EFI_SUCCESS Key material was returned successfully.
  864. @retval EFI_INVALID_PARAMETER The parameter is invalid.
  865. @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
  866. **/
  867. EFI_STATUS
  868. EFIAPI
  869. TlsGetKeyMaterial (
  870. IN VOID *Tls,
  871. IN OUT UINT8 *KeyMaterial
  872. )
  873. {
  874. TLS_CONNECTION *TlsConn;
  875. SSL_SESSION *Session;
  876. TlsConn = (TLS_CONNECTION *) Tls;
  877. Session = NULL;
  878. if (TlsConn == NULL || TlsConn->Ssl == NULL || KeyMaterial == NULL) {
  879. return EFI_INVALID_PARAMETER;
  880. }
  881. Session = SSL_get_session (TlsConn->Ssl);
  882. if (Session == NULL) {
  883. return EFI_UNSUPPORTED;
  884. }
  885. SSL_SESSION_get_master_key (Session, KeyMaterial, SSL3_MASTER_SECRET_SIZE);
  886. return EFI_SUCCESS;
  887. }
  888. /**
  889. Gets the CA Certificate from the cert store.
  890. This function returns the CA certificate for the chosen
  891. TLS connection.
  892. @param[in] Tls Pointer to the TLS object.
  893. @param[out] Data Pointer to the data buffer to receive the CA
  894. certificate data sent to the client.
  895. @param[in,out] DataSize The size of data buffer in bytes.
  896. @retval EFI_SUCCESS The operation succeeded.
  897. @retval EFI_UNSUPPORTED This function is not supported.
  898. @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
  899. **/
  900. EFI_STATUS
  901. EFIAPI
  902. TlsGetCaCertificate (
  903. IN VOID *Tls,
  904. OUT VOID *Data,
  905. IN OUT UINTN *DataSize
  906. )
  907. {
  908. return EFI_UNSUPPORTED;
  909. }
  910. /**
  911. Gets the local public Certificate set in the specified TLS object.
  912. This function returns the local public certificate which was currently set
  913. in the specified TLS object.
  914. @param[in] Tls Pointer to the TLS object.
  915. @param[out] Data Pointer to the data buffer to receive the local
  916. public certificate.
  917. @param[in,out] DataSize The size of data buffer in bytes.
  918. @retval EFI_SUCCESS The operation succeeded.
  919. @retval EFI_INVALID_PARAMETER The parameter is invalid.
  920. @retval EFI_NOT_FOUND The certificate is not found.
  921. @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
  922. **/
  923. EFI_STATUS
  924. EFIAPI
  925. TlsGetHostPublicCert (
  926. IN VOID *Tls,
  927. OUT VOID *Data,
  928. IN OUT UINTN *DataSize
  929. )
  930. {
  931. X509 *Cert;
  932. TLS_CONNECTION *TlsConn;
  933. Cert = NULL;
  934. TlsConn = (TLS_CONNECTION *) Tls;
  935. if (TlsConn == NULL || TlsConn->Ssl == NULL || DataSize == NULL || (*DataSize != 0 && Data == NULL)) {
  936. return EFI_INVALID_PARAMETER;
  937. }
  938. Cert = SSL_get_certificate(TlsConn->Ssl);
  939. if (Cert == NULL) {
  940. return EFI_NOT_FOUND;
  941. }
  942. //
  943. // Only DER encoding is supported currently.
  944. //
  945. if (*DataSize < (UINTN) i2d_X509 (Cert, NULL)) {
  946. *DataSize = (UINTN) i2d_X509 (Cert, NULL);
  947. return EFI_BUFFER_TOO_SMALL;
  948. }
  949. *DataSize = (UINTN) i2d_X509 (Cert, (unsigned char **) &Data);
  950. return EFI_SUCCESS;
  951. }
  952. /**
  953. Gets the local private key set in the specified TLS object.
  954. This function returns the local private key data which was currently set
  955. in the specified TLS object.
  956. @param[in] Tls Pointer to the TLS object.
  957. @param[out] Data Pointer to the data buffer to receive the local
  958. private key data.
  959. @param[in,out] DataSize The size of data buffer in bytes.
  960. @retval EFI_SUCCESS The operation succeeded.
  961. @retval EFI_UNSUPPORTED This function is not supported.
  962. @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
  963. **/
  964. EFI_STATUS
  965. EFIAPI
  966. TlsGetHostPrivateKey (
  967. IN VOID *Tls,
  968. OUT VOID *Data,
  969. IN OUT UINTN *DataSize
  970. )
  971. {
  972. return EFI_UNSUPPORTED;
  973. }
  974. /**
  975. Gets the CA-supplied certificate revocation list data set in the specified
  976. TLS object.
  977. This function returns the CA-supplied certificate revocation list data which
  978. was currently set in the specified TLS object.
  979. @param[out] Data Pointer to the data buffer to receive the CRL data.
  980. @param[in,out] DataSize The size of data buffer in bytes.
  981. @retval EFI_SUCCESS The operation succeeded.
  982. @retval EFI_UNSUPPORTED This function is not supported.
  983. @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
  984. **/
  985. EFI_STATUS
  986. EFIAPI
  987. TlsGetCertRevocationList (
  988. OUT VOID *Data,
  989. IN OUT UINTN *DataSize
  990. )
  991. {
  992. return EFI_UNSUPPORTED;
  993. }